@domandigital/craft 0.11.0 → 0.13.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @domandigital/craft
 
+## 0.13.0
+
+### Minor Changes
+
+- 72527d6: Phase L: component-level sameness.
+
+  - Six rendered tells, all `warn`, read from snapshot version 2: `cta-band-stock` (a centred band on its own colour with one or two buttons), `pricing-trio-popular` (three price cards, one badged "Most popular"), `testimonial-avatar-carousel`, `faq-accordion-closer` (the page ends on a question list), `stats-row` (a row of three to six big figures) and `centred-everything`. A version 1 snapshot never trips them. `CATALOGUE_VERSION` is `2026.09.10`.
+  - Tells can now have `surface: "rendered"`: they exist only on a rendered page, so they carry snapshot fixtures and no source fixtures. `runTell` refuses them; use `auditSnapshot`.
+  - Snapshot sections gain `badges`, `avatars`, `carousel` and `figures`; fingerprint sections gain `symmetry`, `controls`, `cards`, `background`, `badges`, `avatars`, `carousel` and `figures`.
+  - `craft estate compare --component <role>` ranks pairs of sites by how alike one component is and names what they share. `craft estate compare <site> --component <role>` compares one site against the rest. There is no sibling line for components yet, so it ranks and judges nothing.
+  - `craft audit --null` scores each component against the same role in the null model (`components` in the JSON).
+  - New exports: `RENDERED_TELLS`, `COMPONENT_ROLES`, `PROMO_BADGE`, `componentsOf`, `componentDistance`, `componentShared`, `closestComponents`, `estateComponentPairs`, `componentTypicality`, `componentTypicalities`, and the types `RenderedTell`, `ComponentPair`, `ComponentTypicality`.
+
+- 8f5dbf6: Phase M: imagery and provenance.
+
+  - Snapshots record every picture on the page as `images`: each `img` and each CSS background large enough to be one, with its source (unwrapped from `/_next/image?url=`, `/_vercel/image` and Cloudflare's `/cdn-cgi/image/`), size, position, section, alt text and a role (`photo`, `illustration`, `icon`, `avatar`, `logo`). At most 60, largest first. Older snapshots have no `images` and are never judged on them.
+  - `craft audit` reads the first 256 KB of up to 24 of the larger pictures (20 seconds at most per page) and records `provenance`: the IPTC digital source type when an XMP packet or a C2PA manifest says a trained model made the picture. Only a positive is evidence; a picture with no marker is unknown. `snapshotUrl(url, { provenance: false })` skips the reads.
+  - Four rendered tells, all `warn`: `stock-photo` (a stock library or placeholder service, by host or by the library's own file name), `stock-avatar` (placeholder-face services), `ai-image` (the picture's own metadata says a model made it) and `no-real-imagery` (a page of four or more sections with no photograph). `CATALOGUE_VERSION` is `2026.09.11`.
+  - New exports: `IMAGERY_TELLS`, `STOCK_PHOTO_HOSTS`, `STOCK_AVATAR_HOSTS`, `stockSource`, `stockAvatarSource`, `scanProvenance`, `PROVENANCE_SCAN_BYTES`, `AI_SOURCE_TYPES`, and the types `SnapshotImage`, `ImageRole`, `ImageProvenance`. From `@domandigital/craft/audit`: `PROVENANCE_MAX_IMAGES`, `PROVENANCE_BUDGET_MS`.
+
+## 0.12.0
+
+### Minor Changes
+
+- 7622bd9: Phase K: snapshot version 2.
+
+  - Every section gains a `role`: `cta-band`, `footer-cta`, `pricing`, `testimonials`, `faq`, `process`, `features`, `team`, `contact`, or its `kind`. `kind` keeps its version 1 meaning, so the rendered tells and the calibrated null models and estate read exactly as before.
+  - Every section gains `geometry`: `centredShare`, `mirrorSymmetry`, `whitespaceRatio`, `contentWidthRatio`, `background` and `controls`. The page gains `rhythmVariance` (how much section heights vary).
+  - `visual`: colourfulness (Hasler and Süsstrunk), edge density and left-right symmetry, from a screenshot of the first 6000px. None of them passes or fails anything. `snapshotUrl(url, { visual: false })` skips the screenshot; a driver without `page.screenshot` gets no `visual`.
+  - `SNAPSHOT_VERSION` is 2. `readSnapshot()` reads version 1 files as version 2 marked `migratedFrom: 1`; every command that loads a saved snapshot uses it, so old snapshots still work.
+  - `FINGERPRINT_VERSION` is 2: fingerprints carry `sections` (role, centring, width), and `layoutDistance` compares by role and geometry when both sides have them. Against a version 1 fingerprint it compares by `kind`, exactly as before.
+  - New exports: `readSnapshot`, `READABLE_SNAPSHOT_VERSIONS`, `visualMeasures`, `EDGE_STEP`, `layoutDistance`, and the types `SectionRole`, `SectionGeometry`, `SnapshotVisual`, `FingerprintSection`, `RgbaImage`.
+
+- 07d1cf5: From the 2026-09-11 AI-look research. A new tell, `shadcn-card-stock`: the registry Card recipe left unchanged (`warn`). Cal Sans joins the second-wave reflex fonts. The icon-tile tells now see Unicons, MUI icons and Material Symbols as well as Lucide, Heroicons, Phosphor and Tabler. `craft direction validate` warns when a display or body face is missing from the new licence register, or is capped, per-site or unverified there. The register ships as `licences.json` and as `LICENCES` and `faceLicence()`. Catalogue `2026.09.9`.
+- c63cded: **Behaviour change:** under `craft copy --gate`, a repo can no longer lower the house blocking tier. A `warn` or `off` in `craft.config.json`, or an `art-direction.json` exception, naming a blocking tell (em dash, contrastive negation, chatbot residue and the rest) is refused and listed as "Exception not applied". Raising a tell still works, runs without `--gate` are unchanged, and a genuine one-off still takes `copy-ok` on its line. `holdHouseBlocks` and `HOUSE_LOCKED` are exported from the house policy.
+
 ## 0.11.0
 
 ### Minor Changes

package/CHARACTER.md

@@ -88,6 +88,13 @@ clean, premium, elegant and the rest), and a value on the tell catalogue
 without an exception carrying the same reason. Given a snapshot, it warns
 where the page does not show what the file declares.
 
+It also reads the display and body faces against the licence register
+(`src/direction/licences.ts`, exported as `licences.json`) and warns on a face
+the register does not know, or knows only as capped, per-site or unverified. A
+licence warning does not undecide the choice: the reason can be sound and the
+face still unlicensed for this client. The register records facts, checked on
+the licensor's own page. It is not a shortlist, and nothing proposes from it.
+
 `craft direction init` writes what the site does today with every reason
 empty, so the first thing it produces is the list of things nobody decided.
 Run on RMP's live home page (2026-09-23) it records Fraunces, Manrope, a cream
@@ -185,6 +192,64 @@ against different sets.
 Known limit: a computed font family is the family the stylesheet asked for.
 A face that failed to load is still reported under its name.
 
+### Stock components (snapshot v2)
+
+A version 2 snapshot names what each section is for (`role`: a CTA band,
+pricing, testimonials, an FAQ, a process, features, a team, a contact form)
+and how it is laid out (`geometry`: centring, width, balance, its own ground,
+its buttons), with the parts that make a component a stock one: badge texts,
+round portraits, a carousel, a row of big figures. Six tells read them, and
+only them, so a version 1 snapshot never trips one:
+
+- `cta-band-stock`: a centred band on its own colour with one or two buttons.
+- `pricing-trio-popular`: three price cards, one badged "Most popular".
+- `testimonial-avatar-carousel`: round headshots in a sliding carousel.
+- `faq-accordion-closer`: the page ends on a question-and-answer list.
+- `stats-row`: three to six big figures in a row (not straight after the
+  hero, which is `hero-then-proof`'s finding).
+- `centred-everything`: 80% or more of the sections centre their text.
+
+Each fix keeps the component's job (the ask, the prices, the proof, the
+answers) and changes how it looks. None removes a section, because the
+page's order is the client's, not ours.
+
+These six have rendered paths only (surface `rendered`): no source file shows
+a pricing trio reliably. They ship as warnings like every tell, and have not
+yet been read against the estate. Snapshot the estate with this build before
+any is considered for `block`.
+
+### Imagery and provenance
+
+A snapshot records every picture on the page (`images`): each `img` and
+each CSS background large enough to be one, with its source (unwrapped from
+an image optimiser such as `/_next/image?url=`), size, position, section and
+a role: photo, illustration, icon, avatar or logo. `craft audit` also reads
+the first 256 KB of up to 24 of the larger pictures and looks for the IPTC
+digital source type that says a trained model made them
+(`trainedAlgorithmicMedia` or `compositeWithTrainedAlgorithmicMedia`), in an
+XMP packet or a C2PA manifest (Content Credentials). Four tells read them:
+
+- `stock-photo`: a picture from a stock library or placeholder service, by
+  its host (Unsplash, Pexels, iStock, Adobe Stock and others) or, when it was
+  downloaded and self-hosted, by the library's own file name
+  (`shutterstock_1234567890.jpg`, `…-unsplash.jpg`).
+- `stock-avatar`: round portraits from a placeholder-face service
+  (randomuser.me, Pravatar, DiceBear, generated-face sites) or a stock library.
+- `ai-image`: a picture whose own metadata says a model made it.
+- `no-real-imagery`: a page of four or more sections with no photograph at
+  all, only icons and illustrations.
+
+Provenance only ever counts for. Most pictures carry no metadata, anything
+that re-encodes them (a CMS, an image optimiser) strips it, and a PNG can
+keep it after the pixels, beyond the bytes read. A picture with no marker is
+unknown, not real. `snapshotUrl(url, { provenance: false })` skips the reads.
+
+Snapshots taken before craft recorded images have no `images`, and none of
+these tells judges them. There is no `blob-illustration` tell: telling an
+abstract blob from a diagram needs an SVG's path data or its pixels, which a
+cross-origin picture does not give the page, and no flag case has been proved
+reliable. It stays on the list until one is.
+
 ## The counterfactual
 
 A list of tells goes stale; the model does not. So signal 2 asks the model
@@ -250,6 +315,29 @@ pipeline that has decided to hold the line.
 `craft direction propose --estate estate.json` reads the register too, so a
 proposed accent steers away from one a sibling already uses.
 
+Sites that share one component are rarer than siblings and easier to fix:
+
+```bash
+craft estate compare --component cta-band    # every pair's closest CTA bands
+craft estate compare --component pricing --json
+craft estate compare rmp --component cta-band   # one site against the rest
+```
+
+Each pair lists what its two components share ("centred", "1 button", "same
+coloured band"), closest first. There is no sibling line for components yet:
+it needs a calibration set of real components (see the CTA collection in
+`calibration/idiom/cta/` once it exists), so this ranks and names, and judges
+nothing. Only sites added with snapshot v2 have components to compare, and
+the command says so when fewer than two have the role. `--component` takes
+one of `cta-band`, `footer-cta`, `pricing`, `testimonials`, `faq`, `process`,
+`features`, `team`, `contact` or `stats`.
+
+With `--null`, `craft audit` also places each of the page's components
+against the same role in the null model, the way it places the whole page
+(`components` in the JSON). A role needs at least five null pages that have
+it. Null models built before snapshot v2 have no components, and the report
+says so rather than printing nothing.
+
 ## The character report
 
 `craft report` reads one site against everything above and gives a verdict:
@@ -534,7 +622,7 @@ Generated from the package. Run `pnpm --filter @domandigital/craft run docs`
 after changing an entry; a test fails until you do.
 
 <!-- craft:catalogue:start -->
-Catalogue version `2026.09.8`, 55 tells.
+Catalogue version `2026.09.11`, 66 tells.
 
 | Id | Gen | Surface | Severity | Tell | Why it is a default |
 | --- | --- | --- | --- | --- | --- |
@@ -549,6 +637,7 @@ Catalogue version `2026.09.8`, 55 tells.
 | `reveal-everywhere` | 1 | source + rendered | warn | Reveal on every section | When every block fades up on scroll, the motion stops meaning anything and the page feels slow. MMM had 70, DD 40, sen-sphere 27. |
 | `pill-everything` | 1 | source + rendered | warn | Pills everywhere | rounded-full on every button, badge and tag is the framework's friendliest default. MMM had 162, DD 125. A shape used everywhere is not a shape language. |
 | `shadcn-dump` | 1 | source | warn | Stock component dump | A generator exports the whole shadcn/ui kit whether the site uses it or not. Rise & Bloom ships a full set under its own book, vine and petal assets. |
+| `shadcn-card-stock` | 1 | source | warn | Stock shadcn Card | The registry Card (bg-card, a plain border, rounded-lg or rounded-xl, shadow-sm) is the container every generated page is built from. Left as shipped, every card on the site looks like every other shadcn site's. |
 | `cream-palette` | 2 | source + rendered | warn | Cream ground | Once white-and-violet was named, models moved to a warm off-white: parchment, linen, oat. It reads as 'tasteful' in the same way everywhere. |
 | `italic-serif-display` | 2 | source + rendered | warn | Italic serif display | A serif heading with one italic word ('Beauty, reimagined') is the second wave's signature move. |
 | `hero-eyebrow-chip` | 2 | source + rendered | warn | Eyebrow chip above the hero | A small bordered pill ('New · Now booking') above the headline is in almost every generated hero. |
@@ -593,4 +682,14 @@ Catalogue version `2026.09.8`, 55 tells.
 | `repeated-sentence` | 1 | copy | warn | Repeated sentence | The same sentence on two pages, or the same nine words lightly edited, is one of the strongest signs a document was assembled rather than written. |
 | `heading-shape` | 2 | copy | warn | One heading shape | Headings that all share one shape ('X, and Y', 'X, because Y', 'Keep, rewrite, consolidate, retire') read as a template filled in section by section. |
 | `heading-echo` | 2 | copy | warn | Heading echoed | A heading repeated word for word as the first line under it spends the reader's attention twice on the same words. |
+| `cta-band-stock` | 1 | rendered + rendered | warn | Stock call-to-action band | A full-width coloured band with a centred heading, one line and one or two buttons is what a model closes every section run with. It asks for the booking the same way on every site. |
+| `pricing-trio-popular` | 1 | rendered + rendered | warn | Three-tier pricing with a popular badge | Three price cards with the middle one badged 'Most popular' is the SaaS pricing page, applied to a plumber or a salon whether or not anyone chose the middle option. |
+| `testimonial-avatar-carousel` | 1 | rendered + rendered | warn | Avatar testimonial carousel | Round headshots over quotes in a sliding carousel is the stock testimonial block. Most visitors see the first slide only, and stock or AI faces make every quote read as invented. |
+| `faq-accordion-closer` | 2 | rendered + rendered | warn | FAQ accordion as the closer | Ending the page on a collapsed FAQ, often followed only by a band, is the model's default page ending. The answers a buyer needs are hidden behind clicks at the point they decide. |
+| `stats-row` | 1 | rendered + rendered | warn | Row of big numbers | Three or four large figures in a row (500+ clients, 98% satisfaction, 10 years) is the stock proof block, and the numbers are often round, unsourced or invented. |
+| `centred-everything` | 2 | rendered + rendered | warn | Every section centred | When almost every section stacks a centred heading over centred text, the page has no reading line and every block looks like the one before. It is the layout nothing was decided for. |
+| `stock-photo` | 1 | rendered + rendered | warn | Stock photography | A picture from a stock library is the picture every other site in the trade can use. It shows a job the client did not do, in a kitchen that is not theirs, and a visitor who has seen it before stops believing the rest. |
+| `stock-avatar` | 1 | rendered + rendered | warn | Stock or placeholder faces | Round portraits from a placeholder-face service or a stock library next to reviews make every quote read as invented, and some of those faces are generated people who do not exist. |
+| `ai-image` | 2 | rendered + rendered | warn | Generated image | The file itself says a model made it (its XMP or Content Credentials name a trained-model source). A generated picture stands in for work the client did not photograph, and anyone can read the label. |
+| `no-real-imagery` | 1 | rendered + rendered | warn | No photograph on the page | A page with no photograph at all, only icons and illustrations, is the page a model builds when it has no assets. Icon tiles stand in for the evidence a buyer looks for: the work, the premises, the people. |
 <!-- craft:catalogue:end -->

package/COPY.md

@@ -256,8 +256,12 @@ For genuine exceptions only, and the reason matters more than the mechanism:
 - `.copyauditignore` at the repo root: globs, matched on the repo-relative
   path and the bare filename.
 - `.nocopycheck` at the repo root: skips the repo.
-- An `exceptions` entry in `art-direction.json`, with a `because` of at least
-  a sentence.
+- An `exceptions` entry in `art-direction.json`, or a `severity` entry in
+  `craft.config.json`, with a `because` of at least a sentence. **Never for
+  the blocking tier.** Under `craft copy --gate` a repo can raise a rule but
+  not lower one that blocks: the gate refuses the entry and says so. A
+  genuine one-off in the blocking tier takes `copy-ok` on its line, where a
+  reviewer sees it.
 
 Reaching for these more than occasionally means a rule is miscalibrated. Fix
 it here and in craft, not in forty repos.

package/README.md

@@ -129,6 +129,11 @@ repo. `.claude`, `.agents` and `.cursor` are never walked, config or not.
 A severity change needs a `because`, like an exception. `off` is applied as an
 exception, so the report lists what it silenced.
 
+Under `craft copy --gate`, a repo can raise a copy tell but never lower one in
+the house blocking tier. A `warn` or `off` for a blocking tell, here or as an
+exception in `art-direction.json`, is refused and listed in the report. A
+genuine one-off takes `copy-ok` on its line.
+
 ### Copy
 
 [COPY.md](./COPY.md) is the house copy standard: the blocking tier, the review

package/dist/{audit-QIPXL7E4.js → audit-5TYDYRXV.js}

@@ -1,4 +1,7 @@
 import {
+  PROVENANCE_BUDGET_MS,
+  PROVENANCE_MAX_IMAGES,
+  VISUAL_MAX_HEIGHT,
   audit,
   collectInPage,
   loadPlaywright,
@@ -6,10 +9,13 @@ import {
   snapshotPage,
   snapshotUrl,
   snapshotUrls
-} from "./chunk-JP75P2DU.js";
-import "./chunk-QMYERCBB.js";
-import "./chunk-3NGWXZZE.js";
+} from "./chunk-ZLDA2SYB.js";
+import "./chunk-JYNXGCYZ.js";
+import "./chunk-GMVXADJ6.js";
 export {
+  PROVENANCE_BUDGET_MS,
+  PROVENANCE_MAX_IMAGES,
+  VISUAL_MAX_HEIGHT,
   audit,
   collectInPage,
   loadPlaywright,