npm - @growth-labs/conformance - Versions diffs - 0.1.0 - Mend

@growth-labs/conformance 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (30) hide show

package/CHANGELOG.md +14 -0
package/README.md +118 -0
package/dist/html.d.ts +24 -0
package/dist/html.d.ts.map +1 -0
package/dist/html.js +138 -0
package/dist/html.js.map +1 -0
package/dist/index.d.ts +4 -0
package/dist/index.d.ts.map +1 -0
package/dist/index.js +4 -0
package/dist/index.js.map +1 -0
package/dist/policy.d.ts +18 -0
package/dist/policy.d.ts.map +1 -0
package/dist/policy.js +72 -0
package/dist/policy.js.map +1 -0
package/dist/runner.d.ts +7 -0
package/dist/runner.d.ts.map +1 -0
package/dist/runner.js +382 -0
package/dist/runner.js.map +1 -0
package/dist/schema.d.ts +878 -0
package/dist/schema.d.ts.map +1 -0
package/dist/schema.js +129 -0
package/dist/schema.js.map +1 -0
package/fixtures/negative/required-negative-fixtures.json +132 -0
package/fixtures/valid/public-article.json +76 -0
package/package.json +48 -0
package/src/html.ts +175 -0
package/src/index.ts +51 -0
package/src/policy.ts +97 -0
package/src/runner.ts +477 -0
package/src/schema.ts +165 -0

package/CHANGELOG.md ADDED Viewed

@@ -0,0 +1,14 @@
+# @growth-labs/conformance Changelog
+## 0.1.0 — 2026-07-15
+### Added
+- Initial reusable fleet publication conformance harness.
+- Added Zod schemas for fixtures, site evidence bundles, and fleet evidence
+  bundles.
+- Added shared SSR/static header and cache policy helpers.
+- Added deterministic required negative fixtures for CSP, runtime headers,
+  declared NA boundaries, JSON-LD booleans, VideoObject upload dates, image
+  dimensions, Discover hero width, robots `max-image-preview:large`, cache
+  key separation, and runtime canonical overrides.

package/README.md ADDED Viewed

@@ -0,0 +1,118 @@
+# @growth-labs/conformance
+Reusable publication conformance harness for Growth Labs sites. It validates
+per-site fixtures and emits machine-parseable evidence bundles for render,
+cache, security headers, metadata, structured data, images, publication
+surfaces, Discover eligibility, and build evidence.
+This package is consumed by sites and CI jobs. It is not a central fleet
+runtime and it does not fetch, mutate, deploy, or store fleet state.
+## Install
+```bash
+pnpm add @growth-labs/conformance
+```
+## Basic Usage
+```ts
+import { runFleetConformance, runSiteConformance } from '@growth-labs/conformance'
+const fixture = {
+	id: 'fronts:article:public',
+	site: 'fronts',
+	environment: 'production',
+	url: 'https://fronts.co/example',
+	renderMode: 'ssr',
+	audience: 'public',
+	response: {
+		status: 200,
+		headers: {
+			'content-security-policy': "default-src 'self'; script-src 'self' 'nonce-runtime'",
+			'strict-transport-security': 'max-age=31536000; includeSubDomains; preload',
+			'x-frame-options': 'DENY',
+			'x-content-type-options': 'nosniff',
+			'referrer-policy': 'strict-origin-when-cross-origin',
+			'permissions-policy': 'camera=(), microphone=(), geolocation=()',
+			'cache-control': 'public, max-age=0, s-maxage=300',
+		},
+		html: '<!doctype html>...',
+	},
+	expected: {
+		canonicalUrl: 'https://fronts.co/example',
+		schemaTypes: ['NewsArticle'],
+		discoverEligible: true,
+	},
+	publicationSurfaces: [
+		{ name: 'sitemap', status: 'present', httpStatus: 200, bodyBytes: 1024 },
+		{ name: 'robots', status: 'present', httpStatus: 200, bodyBytes: 256 },
+		{ name: 'feed', status: 'na', capabilityBoundary: 'No editorial feed', evidence: 'site type' },
+	],
+	cacheVariants: [
+		{ audience: 'public', cacheKey: 'fronts:public:/example' },
+		{ audience: 'crawler', cacheKey: 'fronts:crawler:/example' },
+	],
+	buildEvidence: {
+		commitSha: 'bd39d718f6a5b0df9a249e11638a8b430050941e',
+		packageVersions: { '@growth-labs/seo': '0.9.0' },
+		staticHeaderPolicy: true,
+		ssrHeaderPolicy: true,
+	},
+}
+const siteBundle = runSiteConformance(fixture)
+const fleetBundle = runFleetConformance([fixture])
+```
+## Shared Header Policy
+Use `buildSharedPublicationHeaders()` when a site wants the package-owned
+baseline for SSR and static response headers:
+```ts
+import { buildSharedPublicationHeaders } from '@growth-labs/conformance/policy'
+const headers = buildSharedPublicationHeaders({
+	renderMode: 'ssr',
+	audience: 'public',
+	nonce: runtimeNonce,
+	markdownTwinUrl: 'https://example.com/article.md',
+})
+```
+The policy emits CSP, HSTS, frame protection, MIME sniffing protection,
+referrer policy, permissions policy, cache semantics, and optional markdown
+twin `Link` metadata. Private audiences use `private, no-store`; public SSR
+uses short shared-cache semantics; public static surfaces get longer
+shared-cache semantics.
+## Fixture Commands
+The root repo exposes:
+```bash
+pnpm run conformance:test-fixtures
+pnpm run conformance:verify-schema
+```
+The fixture command proves the required negative fixtures fail loudly with
+stable finding codes:
+- `csp-unsafe-inline`
+- `headers-static-only-while-ssr-missing`
+- `undeclared-na`
+- `stringified-is-accessible-for-free`
+- `video-object-date-only-upload-date`
+- `missing-image-dimensions`
+- `hero-under-1200px`
+- `missing-max-image-preview-large`
+- `crawler-public-cache-key-collision`
+- `runtime-canonical-override-not-applied`
+## Evidence Shape
+`runSiteConformance()` returns a `SiteEvidenceBundle`; `runFleetConformance()`
+returns a `FleetEvidenceBundle`. Both are validated by exported Zod schemas
+and carry `schemaVersion: "growth-labs.conformance.v1"` so downstream jobs can
+parse them without relying on console text.

package/dist/html.d.ts ADDED Viewed

@@ -0,0 +1,24 @@
+export interface JsonLdParseError {
+    message: string;
+    path: string;
+}
+export interface JsonLdNode {
+    [key: string]: unknown;
+}
+export interface ExtractedImage {
+    url?: string;
+    width?: number;
+    height?: number;
+    path: string;
+}
+export interface HtmlSignals {
+    canonicalUrl?: string;
+    robotsContent?: string;
+    jsonLdNodes: JsonLdNode[];
+    jsonLdParseErrors: JsonLdParseError[];
+    jsonLdImages: ExtractedImage[];
+}
+export declare function extractHtmlSignals(html?: string): HtmlSignals;
+export declare function getSchemaTypes(node: JsonLdNode): string[];
+export declare function nodeHasSchemaType(node: JsonLdNode, expectedType: string): boolean;
+//# sourceMappingURL=html.d.ts.map

package/dist/html.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../src/html.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,UAAU;IAC1B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,cAAc;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,WAAW;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,UAAU,EAAE,CAAA;IACzB,iBAAiB,EAAE,gBAAgB,EAAE,CAAA;IACrC,YAAY,EAAE,cAAc,EAAE,CAAA;CAC9B;AAED,wBAAgB,kBAAkB,CAAC,IAAI,SAAK,GAAG,WAAW,CAazD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,EAAE,CAKzD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAEjF"}

package/dist/html.js ADDED Viewed

@@ -0,0 +1,138 @@
+export function extractHtmlSignals(html = '') {
+    const jsonLd = extractJsonLdNodes(html);
+    const jsonLdImages = jsonLd.nodes.flatMap((node, index) => extractImagesFromJsonLdValue(node.image, `jsonLd[${index}].image`));
+    return {
+        canonicalUrl: extractCanonicalUrl(html),
+        robotsContent: extractMetaContent(html, 'robots'),
+        jsonLdNodes: jsonLd.nodes,
+        jsonLdParseErrors: jsonLd.errors,
+        jsonLdImages,
+    };
+}
+export function getSchemaTypes(node) {
+    const value = node['@type'];
+    if (typeof value === 'string')
+        return [value];
+    if (Array.isArray(value))
+        return value.filter((item) => typeof item === 'string');
+    return [];
+}
+export function nodeHasSchemaType(node, expectedType) {
+    return getSchemaTypes(node).includes(expectedType);
+}
+function extractCanonicalUrl(html) {
+    for (const tag of findOpeningTags(html, 'link')) {
+        const attrs = parseAttributes(tag);
+        if (attrs.rel?.split(/\s+/).some((value) => value.toLowerCase() === 'canonical')) {
+            return attrs.href;
+        }
+    }
+    return undefined;
+}
+function extractMetaContent(html, name) {
+    const wanted = name.toLowerCase();
+    for (const tag of findOpeningTags(html, 'meta')) {
+        const attrs = parseAttributes(tag);
+        const metaName = attrs.name?.toLowerCase() ?? attrs.property?.toLowerCase();
+        if (metaName === wanted)
+            return attrs.content;
+    }
+    return undefined;
+}
+function extractJsonLdNodes(html) {
+    const nodes = [];
+    const errors = [];
+    const scriptPattern = /<script\b[^>]*>([\s\S]*?)<\/script>/gi;
+    let scriptIndex = 0;
+    for (const match of html.matchAll(scriptPattern)) {
+        const fullTag = match[0] ?? '';
+        const openTag = fullTag.slice(0, fullTag.indexOf('>') + 1);
+        const attrs = parseAttributes(openTag);
+        if ((attrs.type ?? '').toLowerCase() !== 'application/ld+json')
+            continue;
+        const body = match[1] ?? '';
+        try {
+            const parsed = JSON.parse(body.trim());
+            collectJsonLdNodes(parsed, nodes);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            errors.push({ message, path: `script[application/ld+json][${scriptIndex}]` });
+        }
+        scriptIndex += 1;
+    }
+    return { nodes, errors };
+}
+function collectJsonLdNodes(value, out) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectJsonLdNodes(item, out);
+        return;
+    }
+    if (!isRecord(value))
+        return;
+    out.push(value);
+    const graph = value['@graph'];
+    if (Array.isArray(graph)) {
+        for (const item of graph)
+            collectJsonLdNodes(item, out);
+    }
+}
+function extractImagesFromJsonLdValue(value, path) {
+    if (Array.isArray(value)) {
+        return value.flatMap((item, index) => extractImagesFromJsonLdValue(item, `${path}[${index}]`));
+    }
+    if (typeof value === 'string') {
+        return [{ url: value, path }];
+    }
+    if (!isRecord(value))
+        return [];
+    const url = firstString(value.url, value.contentUrl, value['@id']);
+    const width = toFiniteNumber(value.width);
+    const height = toFiniteNumber(value.height);
+    return [{ url, width, height, path }];
+}
+function findOpeningTags(html, tagName) {
+    const pattern = new RegExp(`<${tagName}\\b[^>]*>`, 'gi');
+    return [...html.matchAll(pattern)].map((match) => match[0] ?? '');
+}
+function parseAttributes(tag) {
+    const attrs = {};
+    const attributePattern = /([A-Za-z_:][-A-Za-z0-9_:.]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/g;
+    for (const match of tag.matchAll(attributePattern)) {
+        const name = match[1]?.toLowerCase();
+        if (!name)
+            continue;
+        attrs[name] = decodeHtmlEntities(match[2] ?? match[3] ?? match[4] ?? '');
+    }
+    return attrs;
+}
+function firstString(...values) {
+    for (const value of values) {
+        if (typeof value === 'string' && value.trim() !== '')
+            return value;
+    }
+    return undefined;
+}
+function toFiniteNumber(value) {
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string' && value.trim() !== '') {
+        const parsed = Number(value);
+        if (Number.isFinite(parsed))
+            return parsed;
+    }
+    return undefined;
+}
+function decodeHtmlEntities(value) {
+    return value
+        .replaceAll('&amp;', '&')
+        .replaceAll('&quot;', '"')
+        .replaceAll('&#39;', "'")
+        .replaceAll('&lt;', '<')
+        .replaceAll('&gt;', '>');
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=html.js.map

package/dist/html.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"html.js","sourceRoot":"","sources":["../src/html.ts"],"names":[],"mappings":"AAwBA,MAAM,UAAU,kBAAkB,CAAC,IAAI,GAAG,EAAE;IAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACzD,4BAA4B,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,KAAK,SAAS,CAAC,CAClE,CAAA;IAED,OAAO;QACN,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC;QACvC,aAAa,EAAE,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC;QACjD,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,iBAAiB,EAAE,MAAM,CAAC,MAAM;QAChC,YAAY;KACZ,CAAA;AACF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAgB;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAA;IACjG,OAAO,EAAE,CAAA;AACV,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAgB,EAAE,YAAoB;IACvE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACxC,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,EAAE,CAAC;YAClF,OAAO,KAAK,CAAC,IAAI,CAAA;QAClB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,IAAY;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IACjC,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAA;QAC3E,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC,OAAO,CAAA;IAC9C,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAuB,EAAE,CAAA;IACrC,MAAM,aAAa,GAAG,uCAAuC,CAAA;IAC7D,IAAI,WAAW,GAAG,CAAC,CAAA;IAEnB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAC1D,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACtC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,qBAAqB;YAAE,SAAQ;QAExE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAY,CAAA;YACjD,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACtE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,+BAA+B,WAAW,GAAG,EAAE,CAAC,CAAA;QAC9E,CAAC;QACD,WAAW,IAAI,CAAC,CAAA;IACjB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc,EAAE,GAAiB;IAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACvD,OAAM;IACP,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAM;IAC5B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAEf,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC7B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC;AACF,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc,EAAE,IAAY;IACjE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9B,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAE/B,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAE3C,OAAO,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,OAAe;IACrD,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,IAAI,OAAO,WAAW,EAAE,IAAI,CAAC,CAAA;IACxD,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IACnC,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,MAAM,gBAAgB,GAAG,yEAAyE,CAAA;IAElG,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAA;QACpC,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,OAAO,KAAK,CAAA;AACb,CAAC;AAED,SAAS,WAAW,CAAC,GAAG,MAAiB;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;IACnE,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QAC5B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAA;IAC3C,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACxC,OAAO,KAAK;SACV,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;SACxB,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SACzB,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC;SACxB,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC;SACvB,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC"}

package/dist/index.d.ts ADDED Viewed

@@ -0,0 +1,4 @@
+export { buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, type CachePolicyOptions, type HeaderPolicyOptions, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, } from './policy.js';
+export { type RunConformanceOptions, runFleetConformance, runSiteConformance } from './runner.js';
+export { type Audience, audienceSchema, type BuildEvidence, buildEvidenceSchema, type CacheVariant, type ConformanceCheckReceipt, type ConformanceFinding, type ConformanceFixture, type ConformanceFixtureInput, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, EVIDENCE_SCHEMA_VERSION, type EvidenceSummary, evidenceSummarySchema, type FleetEvidenceBundle, findingSeveritySchema, fleetEvidenceBundleSchema, type HeaderMap, headerMapSchema, headerValueSchema, type PublicationSurfaceEvidence, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_NEGATIVE_FIXTURE_CODES, type RenderMode, type RequiredNegativeFindingCode, type RequiredNegativeFixtureId, renderModeSchema, type SiteEvidenceBundle, type SurfaceResponse, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,qBAAqB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EACN,KAAK,QAAQ,EACb,cAAc,EACd,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,eAAe,EACf,iBAAiB,EACjB,KAAK,0BAA0B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,KAAK,UAAU,EACf,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}

package/dist/index.js ADDED Viewed

@@ -0,0 +1,4 @@
+export { buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, } from './policy.js';
+export { runFleetConformance, runSiteConformance } from './runner.js';
+export { audienceSchema, buildEvidenceSchema, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, EVIDENCE_SCHEMA_VERSION, evidenceSummarySchema, findingSeveritySchema, fleetEvidenceBundleSchema, headerMapSchema, headerValueSchema, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_NEGATIVE_FIXTURE_CODES, renderModeSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAG7B,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAA8B,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAEN,cAAc,EAEd,mBAAmB,EAMnB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,uBAAuB,EAEvB,qBAAqB,EAErB,qBAAqB,EACrB,yBAAyB,EAEzB,eAAe,EACf,iBAAiB,EAEjB,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAI/B,gBAAgB,EAGhB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}

package/dist/policy.d.ts ADDED Viewed

@@ -0,0 +1,18 @@
+import type { Audience, HeaderMap, RenderMode } from './schema.js';
+export declare const REQUIRED_SECURITY_HEADERS: readonly ["content-security-policy", "strict-transport-security", "x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy"];
+export interface HeaderPolicyOptions {
+    renderMode: RenderMode;
+    audience: Audience;
+    nonce?: string;
+    markdownTwinUrl?: string;
+}
+export interface CachePolicyOptions {
+    renderMode: RenderMode;
+    audience: Audience;
+}
+export declare function buildSharedPublicationHeaders(options: HeaderPolicyOptions): Record<string, string>;
+export declare function buildContentSecurityPolicy(nonce?: string): string;
+export declare function buildCacheControl({ renderMode, audience }: CachePolicyOptions): string;
+export declare function normalizeHeaders(headers: HeaderMap | undefined): Record<string, string>;
+export declare function isPrivateAudience(audience: Audience): boolean;
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAElE,eAAO,MAAM,yBAAyB,yJAO5B,CAAA;AAEV,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,eAAe,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IAClC,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,QAAQ,CAAA;CAClB;AAED,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,mBAAmB,GAC1B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBxB;AAED,wBAAgB,0BAA0B,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAoBjE;AAED,wBAAgB,iBAAiB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,kBAAkB,GAAG,MAAM,CAMtF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAavF;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAO7D"}

package/dist/policy.js ADDED Viewed

@@ -0,0 +1,72 @@
+export const REQUIRED_SECURITY_HEADERS = [
+    'content-security-policy',
+    'strict-transport-security',
+    'x-frame-options',
+    'x-content-type-options',
+    'referrer-policy',
+    'permissions-policy',
+];
+export function buildSharedPublicationHeaders(options) {
+    const headers = {
+        'Content-Security-Policy': buildContentSecurityPolicy(options.nonce),
+        'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',
+        'X-Frame-Options': 'DENY',
+        'X-Content-Type-Options': 'nosniff',
+        'Referrer-Policy': 'strict-origin-when-cross-origin',
+        'Permissions-Policy': 'accelerometer=(), camera=(), geolocation=(), gyroscope=(), microphone=(), payment=(), usb=()',
+        'Cache-Control': buildCacheControl(options),
+    };
+    if (options.markdownTwinUrl) {
+        headers.Link = `<${options.markdownTwinUrl}>; rel="alternate"; type="text/markdown"`;
+    }
+    return headers;
+}
+export function buildContentSecurityPolicy(nonce) {
+    const scriptSources = ["'self'"];
+    const styleSources = ["'self'"];
+    if (nonce) {
+        scriptSources.push(`'nonce-${nonce}'`);
+        styleSources.push(`'nonce-${nonce}'`);
+    }
+    return [
+        "default-src 'self'",
+        `script-src ${scriptSources.join(' ')}`,
+        `style-src ${styleSources.join(' ')}`,
+        "img-src 'self' data: https:",
+        "font-src 'self' data:",
+        "connect-src 'self' https:",
+        "object-src 'none'",
+        "base-uri 'self'",
+        "frame-ancestors 'none'",
+        'upgrade-insecure-requests',
+    ].join('; ');
+}
+export function buildCacheControl({ renderMode, audience }) {
+    if (isPrivateAudience(audience))
+        return 'private, no-store';
+    if (renderMode === 'static') {
+        return 'public, max-age=300, s-maxage=86400, stale-while-revalidate=604800';
+    }
+    return 'public, max-age=0, s-maxage=300, stale-while-revalidate=86400';
+}
+export function normalizeHeaders(headers) {
+    const normalized = {};
+    if (!headers)
+        return normalized;
+    for (const [name, value] of Object.entries(headers)) {
+        if (typeof value === 'string') {
+            normalized[name.toLowerCase()] = value;
+        }
+        else if (Array.isArray(value)) {
+            normalized[name.toLowerCase()] = value.join(', ');
+        }
+    }
+    return normalized;
+}
+export function isPrivateAudience(audience) {
+    return (audience === 'subscriber' ||
+        audience === 'member' ||
+        audience === 'admin' ||
+        audience === 'private');
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,yBAAyB;IACzB,2BAA2B;IAC3B,iBAAiB;IACjB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;CACX,CAAA;AAcV,MAAM,UAAU,6BAA6B,CAC5C,OAA4B;IAE5B,MAAM,OAAO,GAA2B;QACvC,yBAAyB,EAAE,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC;QACpE,2BAA2B,EAAE,8CAA8C;QAC3E,iBAAiB,EAAE,MAAM;QACzB,wBAAwB,EAAE,SAAS;QACnC,iBAAiB,EAAE,iCAAiC;QACpD,oBAAoB,EACnB,8FAA8F;QAC/F,eAAe,EAAE,iBAAiB,CAAC,OAAO,CAAC;KAC3C,CAAA;IAED,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,GAAG,IAAI,OAAO,CAAC,eAAe,0CAA0C,CAAA;IACrF,CAAC;IAED,OAAO,OAAO,CAAA;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACxD,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,CAAA;IAChC,MAAM,YAAY,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/B,IAAI,KAAK,EAAE,CAAC;QACX,aAAa,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAA;QACtC,YAAY,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,CAAA;IACtC,CAAC;IAED,OAAO;QACN,oBAAoB;QACpB,cAAc,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACvC,aAAa,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrC,6BAA6B;QAC7B,uBAAuB;QACvB,2BAA2B;QAC3B,mBAAmB;QACnB,iBAAiB;QACjB,wBAAwB;QACxB,2BAA2B;KAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACb,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAsB;IAC7E,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,mBAAmB,CAAA;IAC3D,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,oEAAoE,CAAA;IAC5E,CAAC;IACD,OAAO,+DAA+D,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAA8B;IAC9D,MAAM,UAAU,GAA2B,EAAE,CAAA;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAA;IAE/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAA;QACvC,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClD,CAAC;IACF,CAAC;IAED,OAAO,UAAU,CAAA;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAkB;IACnD,OAAO,CACN,QAAQ,KAAK,YAAY;QACzB,QAAQ,KAAK,QAAQ;QACrB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,SAAS,CACtB,CAAA;AACF,CAAC"}

package/dist/runner.d.ts ADDED Viewed

@@ -0,0 +1,7 @@
+import { type ConformanceFixtureInput, type FleetEvidenceBundle, type SiteEvidenceBundle } from './schema.js';
+export interface RunConformanceOptions {
+    now?: () => string;
+}
+export declare function runSiteConformance(input: ConformanceFixtureInput, options?: RunConformanceOptions): SiteEvidenceBundle;
+export declare function runFleetConformance(inputs: ConformanceFixtureInput[], options?: RunConformanceOptions): FleetEvidenceBundle;
+//# sourceMappingURL=runner.d.ts.map

package/dist/runner.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAEA,OAAO,EAKN,KAAK,uBAAuB,EAG5B,KAAK,mBAAmB,EAExB,KAAK,kBAAkB,EAEvB,MAAM,aAAa,CAAA;AAKpB,MAAM,WAAW,qBAAqB;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAClB;AAED,wBAAgB,kBAAkB,CACjC,KAAK,EAAE,uBAAuB,EAC9B,OAAO,GAAE,qBAA0B,GACjC,kBAAkB,CA6BpB;AAED,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,uBAAuB,EAAE,EACjC,OAAO,GAAE,qBAA0B,GACjC,mBAAmB,CAuBrB"}