@domandigital/craft 0.12.0 → 0.14.0

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @domandigital/craft
 
+## 0.14.0
+
+### Minor Changes
+
+- 8686cf1: Phase N, specificity. `specificity(text, brief?)` counts what only this business could have written: names, places, numbers, prices, dates, contact details and trade nouns, with Title Case and shouted lines read without their capitals and stock figures ("24/7", "100%", "5-star") masked. A brief's own terms are recognised wherever they appear. Snapshots now record each section's `text` and the `firstScreenText` a visitor reads before scrolling, leaving out navigation, buttons, links and footers. Two new tells, both `warn`: `generic-hero-claim` (copy and rendered, home page only: the headline and the line under it name nothing particular) and `unproven-claim` (rendered: a claim of standing such as "trusted" or "fully qualified" with no review, rating, registration number or accreditation in its section or the one either side). `craft copy compare <ours> --competitor <theirs>` lists the hero and service sentences on each page that hold no specific the other page lacks. The catalogue table no longer prints "rendered + rendered" for rendered-only tells.
+
+## 0.13.0
+
+### Minor Changes
+
+- 72527d6: Phase L: component-level sameness.
+
+  - Six rendered tells, all `warn`, read from snapshot version 2: `cta-band-stock` (a centred band on its own colour with one or two buttons), `pricing-trio-popular` (three price cards, one badged "Most popular"), `testimonial-avatar-carousel`, `faq-accordion-closer` (the page ends on a question list), `stats-row` (a row of three to six big figures) and `centred-everything`. A version 1 snapshot never trips them. `CATALOGUE_VERSION` is `2026.09.10`.
+  - Tells can now have `surface: "rendered"`: they exist only on a rendered page, so they carry snapshot fixtures and no source fixtures. `runTell` refuses them; use `auditSnapshot`.
+  - Snapshot sections gain `badges`, `avatars`, `carousel` and `figures`; fingerprint sections gain `symmetry`, `controls`, `cards`, `background`, `badges`, `avatars`, `carousel` and `figures`.
+  - `craft estate compare --component <role>` ranks pairs of sites by how alike one component is and names what they share. `craft estate compare <site> --component <role>` compares one site against the rest. There is no sibling line for components yet, so it ranks and judges nothing.
+  - `craft audit --null` scores each component against the same role in the null model (`components` in the JSON).
+  - New exports: `RENDERED_TELLS`, `COMPONENT_ROLES`, `PROMO_BADGE`, `componentsOf`, `componentDistance`, `componentShared`, `closestComponents`, `estateComponentPairs`, `componentTypicality`, `componentTypicalities`, and the types `RenderedTell`, `ComponentPair`, `ComponentTypicality`.
+
+- 8f5dbf6: Phase M: imagery and provenance.
+
+  - Snapshots record every picture on the page as `images`: each `img` and each CSS background large enough to be one, with its source (unwrapped from `/_next/image?url=`, `/_vercel/image` and Cloudflare's `/cdn-cgi/image/`), size, position, section, alt text and a role (`photo`, `illustration`, `icon`, `avatar`, `logo`). At most 60, largest first. Older snapshots have no `images` and are never judged on them.
+  - `craft audit` reads the first 256 KB of up to 24 of the larger pictures (20 seconds at most per page) and records `provenance`: the IPTC digital source type when an XMP packet or a C2PA manifest says a trained model made the picture. Only a positive is evidence; a picture with no marker is unknown. `snapshotUrl(url, { provenance: false })` skips the reads.
+  - Four rendered tells, all `warn`: `stock-photo` (a stock library or placeholder service, by host or by the library's own file name), `stock-avatar` (placeholder-face services), `ai-image` (the picture's own metadata says a model made it) and `no-real-imagery` (a page of four or more sections with no photograph). `CATALOGUE_VERSION` is `2026.09.11`.
+  - New exports: `IMAGERY_TELLS`, `STOCK_PHOTO_HOSTS`, `STOCK_AVATAR_HOSTS`, `stockSource`, `stockAvatarSource`, `scanProvenance`, `PROVENANCE_SCAN_BYTES`, `AI_SOURCE_TYPES`, and the types `SnapshotImage`, `ImageRole`, `ImageProvenance`. From `@domandigital/craft/audit`: `PROVENANCE_MAX_IMAGES`, `PROVENANCE_BUDGET_MS`.
+
 ## 0.12.0
 
 ### Minor Changes

package/CHARACTER.md

@@ -192,6 +192,110 @@ against different sets.
 Known limit: a computed font family is the family the stylesheet asked for.
 A face that failed to load is still reported under its name.
 
+### Stock components (snapshot v2)
+
+A version 2 snapshot names what each section is for (`role`: a CTA band,
+pricing, testimonials, an FAQ, a process, features, a team, a contact form)
+and how it is laid out (`geometry`: centring, width, balance, its own ground,
+its buttons), with the parts that make a component a stock one: badge texts,
+round portraits, a carousel, a row of big figures. Six tells read them, and
+only them, so a version 1 snapshot never trips one:
+
+- `cta-band-stock`: a centred band on its own colour with one or two buttons.
+- `pricing-trio-popular`: three price cards, one badged "Most popular".
+- `testimonial-avatar-carousel`: round headshots in a sliding carousel.
+- `faq-accordion-closer`: the page ends on a question-and-answer list.
+- `stats-row`: three to six big figures in a row (not straight after the
+  hero, which is `hero-then-proof`'s finding).
+- `centred-everything`: 80% or more of the sections centre their text.
+
+Each fix keeps the component's job (the ask, the prices, the proof, the
+answers) and changes how it looks. None removes a section, because the
+page's order is the client's, not ours.
+
+These six have rendered paths only (surface `rendered`): no source file shows
+a pricing trio reliably. They ship as warnings like every tell, and have not
+yet been read against the estate. Snapshot the estate with this build before
+any is considered for `block`.
+
+### Imagery and provenance
+
+A snapshot records every picture on the page (`images`): each `img` and
+each CSS background large enough to be one, with its source (unwrapped from
+an image optimiser such as `/_next/image?url=`), size, position, section and
+a role: photo, illustration, icon, avatar or logo. `craft audit` also reads
+the first 256 KB of up to 24 of the larger pictures and looks for the IPTC
+digital source type that says a trained model made them
+(`trainedAlgorithmicMedia` or `compositeWithTrainedAlgorithmicMedia`), in an
+XMP packet or a C2PA manifest (Content Credentials). Four tells read them:
+
+- `stock-photo`: a picture from a stock library or placeholder service, by
+  its host (Unsplash, Pexels, iStock, Adobe Stock and others) or, when it was
+  downloaded and self-hosted, by the library's own file name
+  (`shutterstock_1234567890.jpg`, `…-unsplash.jpg`).
+- `stock-avatar`: round portraits from a placeholder-face service
+  (randomuser.me, Pravatar, DiceBear, generated-face sites) or a stock library.
+- `ai-image`: a picture whose own metadata says a model made it.
+- `no-real-imagery`: a page of four or more sections with no photograph at
+  all, only icons and illustrations.
+
+Provenance only ever counts for. Most pictures carry no metadata, anything
+that re-encodes them (a CMS, an image optimiser) strips it, and a PNG can
+keep it after the pixels, beyond the bytes read. A picture with no marker is
+unknown, not real. `snapshotUrl(url, { provenance: false })` skips the reads.
+
+Snapshots taken before craft recorded images have no `images`, and none of
+these tells judges them. There is no `blob-illustration` tell: telling an
+abstract blob from a diagram needs an SVG's path data or its pixels, which a
+cross-origin picture does not give the page, and no flag case has been proved
+reliable. It stays on the list until one is.
+
+### Specificity
+
+A page built from no brief could belong to anyone, because the model had
+nothing particular to say. Specificity counts what only this business could
+have written: names, places, numbers, prices, dates, contact details, and
+the nouns of the trade (`TRADE_NOUNS`, a seed list). Two rules keep the
+count honest. A Title Case or shouted line's capitals are not read as names
+("Quality You Can Trust" is not a proper noun), and the figures every site
+uses ("24/7", "100%", "5-star", "No. 1") are masked before counting. A text
+is generic when it has no specific other than trade nouns and fewer than two
+of those: one trade noun ("quality plumbing you can trust") is what every
+competitor also says.
+
+A snapshot now records the page's text: each section's headings,
+paragraphs, list items and quotes (`text`), and what a visitor reads before
+scrolling (`firstScreenText`), leaving out navigation, a header without the
+headline, footers and the words on buttons and links. Two tells read it:
+
+- `generic-hero-claim`: the home page's first screen names nothing
+  particular. Also a copy tell, on a literal `<h1>` and the paragraph under
+  it in the home page's source (a root route file such as `app/page.tsx`, a
+  top-level `index.html`, or a hero or home component). Every other page's
+  headline is a label ("Privacy policy", "Boiler repairs"), not a claim, and
+  is not judged.
+- `unproven-claim`: a claim of standing ("trusted", "fully qualified",
+  "award-winning", "5-star service") with no review, rating, quoted
+  testimonial, registration number or accreditation (by name, or as a logo
+  whose alt text or file name names it) in its section or the one either
+  side.
+
+A brief sharpens the count: its own terms (the business's name, its town,
+its trade) are recognised wherever they appear, even opening a sentence or
+in a shouted heading. The tells run without one. `craft copy compare <ours>
+--competitor <theirs>` uses one, from `--brief`, `art-direction.json` or a
+null model's `null.json`, and lists the hero and service sentences on each
+page that hold no specific the other page lacks: a town both name, or a
+trade noun both use, is shared; the business's name, its prices and its
+jobs are its own. It is a measure for a person to read and always exits 0.
+
+The limits, stated so nobody reads more into a pass than is there: a place
+in a Title Case heading ("Boiler Repairs In Brackley") is not recognised
+without a brief, a headline whose words come from data (`{site.headline}`)
+is not read in source, and "specific" means particular, not true. `craft
+copy claims` is where a figure gets checked. Snapshots taken before craft
+recorded text have none, and neither tell judges them.
+
 ## The counterfactual
 
 A list of tells goes stale; the model does not. So signal 2 asks the model
@@ -257,6 +361,29 @@ pipeline that has decided to hold the line.
 `craft direction propose --estate estate.json` reads the register too, so a
 proposed accent steers away from one a sibling already uses.
 
+Sites that share one component are rarer than siblings and easier to fix:
+
+```bash
+craft estate compare --component cta-band    # every pair's closest CTA bands
+craft estate compare --component pricing --json
+craft estate compare rmp --component cta-band   # one site against the rest
+```
+
+Each pair lists what its two components share ("centred", "1 button", "same
+coloured band"), closest first. There is no sibling line for components yet:
+it needs a calibration set of real components (see the CTA collection in
+`calibration/idiom/cta/` once it exists), so this ranks and names, and judges
+nothing. Only sites added with snapshot v2 have components to compare, and
+the command says so when fewer than two have the role. `--component` takes
+one of `cta-band`, `footer-cta`, `pricing`, `testimonials`, `faq`, `process`,
+`features`, `team`, `contact` or `stats`.
+
+With `--null`, `craft audit` also places each of the page's components
+against the same role in the null model, the way it places the whole page
+(`components` in the JSON). A role needs at least five null pages that have
+it. Null models built before snapshot v2 have no components, and the report
+says so rather than printing nothing.
+
 ## The character report
 
 `craft report` reads one site against everything above and gives a verdict:
@@ -541,7 +668,7 @@ Generated from the package. Run `pnpm --filter @domandigital/craft run docs`
 after changing an entry; a test fails until you do.
 
 <!-- craft:catalogue:start -->
-Catalogue version `2026.09.9`, 56 tells.
+Catalogue version `2026.09.12`, 68 tells.
 
 | Id | Gen | Surface | Severity | Tell | Why it is a default |
 | --- | --- | --- | --- | --- | --- |
@@ -601,4 +728,16 @@ Catalogue version `2026.09.9`, 56 tells.
 | `repeated-sentence` | 1 | copy | warn | Repeated sentence | The same sentence on two pages, or the same nine words lightly edited, is one of the strongest signs a document was assembled rather than written. |
 | `heading-shape` | 2 | copy | warn | One heading shape | Headings that all share one shape ('X, and Y', 'X, because Y', 'Keep, rewrite, consolidate, retire') read as a template filled in section by section. |
 | `heading-echo` | 2 | copy | warn | Heading echoed | A heading repeated word for word as the first line under it spends the reader's attention twice on the same words. |
+| `generic-hero-claim` | 1 | copy + rendered | warn | Headline that fits any business | The first thing a visitor reads on the home page names no place, no person, no price and no job, so it would fit every competitor's site unchanged. A model writes it when it has nothing particular to say. |
+| `cta-band-stock` | 1 | rendered | warn | Stock call-to-action band | A full-width coloured band with a centred heading, one line and one or two buttons is what a model closes every section run with. It asks for the booking the same way on every site. |
+| `pricing-trio-popular` | 1 | rendered | warn | Three-tier pricing with a popular badge | Three price cards with the middle one badged 'Most popular' is the SaaS pricing page, applied to a plumber or a salon whether or not anyone chose the middle option. |
+| `testimonial-avatar-carousel` | 1 | rendered | warn | Avatar testimonial carousel | Round headshots over quotes in a sliding carousel is the stock testimonial block. Most visitors see the first slide only, and stock or AI faces make every quote read as invented. |
+| `faq-accordion-closer` | 2 | rendered | warn | FAQ accordion as the closer | Ending the page on a collapsed FAQ, often followed only by a band, is the model's default page ending. The answers a buyer needs are hidden behind clicks at the point they decide. |
+| `stats-row` | 1 | rendered | warn | Row of big numbers | Three or four large figures in a row (500+ clients, 98% satisfaction, 10 years) is the stock proof block, and the numbers are often round, unsourced or invented. |
+| `centred-everything` | 2 | rendered | warn | Every section centred | When almost every section stacks a centred heading over centred text, the page has no reading line and every block looks like the one before. It is the layout nothing was decided for. |
+| `stock-photo` | 1 | rendered | warn | Stock photography | A picture from a stock library is the picture every other site in the trade can use. It shows a job the client did not do, in a kitchen that is not theirs, and a visitor who has seen it before stops believing the rest. |
+| `stock-avatar` | 1 | rendered | warn | Stock or placeholder faces | Round portraits from a placeholder-face service or a stock library next to reviews make every quote read as invented, and some of those faces are generated people who do not exist. |
+| `ai-image` | 2 | rendered | warn | Generated image | The file itself says a model made it (its XMP or Content Credentials name a trained-model source). A generated picture stands in for work the client did not photograph, and anyone can read the label. |
+| `no-real-imagery` | 1 | rendered | warn | No photograph on the page | A page with no photograph at all, only icons and illustrations, is the page a model builds when it has no assets. Icon tiles stand in for the evidence a buyer looks for: the work, the premises, the people. |
+| `unproven-claim` | 1 | rendered | warn | Claim with no proof next to it | "Trusted", "fully qualified" and "award-winning" ask the visitor to take the business's word for it. A page built with no reviews and no registration number makes the claim anyway, with nothing beside it. |
 <!-- craft:catalogue:end -->

package/COPY.md

@@ -102,6 +102,7 @@ person reading decides which instance earns its place.
 | `inline-label-list` | three or more bullets in a row opening "**Label:**", where the label repeats the line |
 | `prompt-context` | "This article uses the attached Perplexity research file as the primary source", "the attached research is right to say", "the attached brief asks": the model naming what it was given. A web page has no attachment. **Zero in anything published** |
 | `placeholder` | "[Insert client name]", lorem ipsum, `TODO_PLACEHOLDER`. Fine in a draft commit; **zero in anything delivered** |
+| `generic-hero-claim` | on the home page (a root route file, a top-level `index.html`, or a hero or home component), a literal `<h1>` and the paragraph under it that name no place, person, number, price or job: "Quality you can trust", "Your vision, our expertise". One trade noun is not enough ("quality plumbing"); two are ("boiler and radiator repairs"). Also read on the rendered first screen by `craft audit` |
 
 ### Style is not evidence
 
@@ -218,6 +219,10 @@ Hyphenated compounds count as one word. Not automated.
   sourced or UNSOURCED. A claim is sourced, corrected or cut, never re-cited
   from memory. The copy check cannot do this part: a false figure in clean
   prose passes every tell.
+- **Proof sits next to the claim it backs.** "Trusted", "fully qualified",
+  "award-winning" and "5-star service" need a review, a rating or an
+  accreditation in the same section or the one either side of it. `craft
+  audit` reports each one that has none (`unproven-claim`, a warning).
 
 ## CTA rule
 

package/dist/{audit-5QWFLZ6L.js → audit-6WHR7ZTV.js}

@@ -1,4 +1,6 @@
 import {
+  PROVENANCE_BUDGET_MS,
+  PROVENANCE_MAX_IMAGES,
   VISUAL_MAX_HEIGHT,
   audit,
   collectInPage,
@@ -7,11 +9,13 @@ import {
   snapshotPage,
   snapshotUrl,
   snapshotUrls
-} from "./chunk-ULPI335S.js";
+} from "./chunk-Q7ILL2HV.js";
 import "./chunk-JYNXGCYZ.js";
-import "./chunk-PZ4MF2VV.js";
-import "./chunk-AL6MRG6V.js";
+import "./chunk-GQVEYTBY.js";
+import "./chunk-QYBAVU3P.js";
 export {
+  PROVENANCE_BUDGET_MS,
+  PROVENANCE_MAX_IMAGES,
   VISUAL_MAX_HEIGHT,
   audit,
   collectInPage,