@growth-labs/conformance 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # @growth-labs/conformance Changelog
 
+## 0.5.0 — 2026-07-19
+
+### Added
+
+- Ship the stable `./endpoint` export with `initConformanceEndpoint` as the
+  deployment path: parses, validates, schema-strips, bounds, and serializes
+  the v2 artifact **once** at module initialization; per-request handling
+  validates only method and `versionMetadata.tag` — no I/O, no re-serialization.
+  Also exports `createDeploymentConformanceResponse` as a non-recommended
+  compatibility helper for direct per-request use (not the deployment path).
+- The immutable factory captures body bytes at initialization time; post-init
+  source mutation and schema-external enumerable getters cannot change served
+  bytes or trigger I/O. The combined stripping parse validates endpoint
+  `buildEvidence` and the served v2 bundle together without reading schema-external
+  fields — no `.passthrough()`.
+- Require `buildEvidence.generatedAt` (timezone-qualified ISO-8601 datetime) at
+  the deployment endpoint boundary alongside the existing `buildEvidence.commitSha`.
+  A missing or non-datetime `generatedAt` produces a permanently-failing handler.
+- Support `GET` and `HEAD`; `HEAD` returns the same headers without a body,
+  while unsupported methods return generic `405` JSON with `Allow: GET, HEAD`.
+- Require a non-empty string request method at runtime; missing, non-string, or
+  empty values fail closed with generic no-store JSON rather than defaulting to
+  `GET` or throwing from the helper.
+- Require the expected production site and an exact lowercase 40-character
+  deployment tag from Cloudflare version metadata `tag`; expose that tag as
+  `X-Growth-Labs-Commit-SHA` without serializing Cloudflare version IDs or
+  timestamps.
+- Require endpoint input bundles to carry an exact lowercase 40-character
+  `buildEvidence.commitSha` matching the deployment tag before returning any
+  success body or commit header. `buildEvidence.commitSha` is set from build
+  provenance independently of `versionMetadata.tag`; they are compared per
+  request and must match or the endpoint fails closed.
+- Bound successful endpoint JSON responses to 1 MiB and return
+  `Content-Type: application/json; charset=utf-8`, `Cache-Control: private,
+  no-store`, and `X-Content-Type-Options: nosniff`.
+- Fail closed with generic JSON for malformed bundles, wrong site or
+  environment, missing or malformed deployment tags, oversized evidence, and
+  internal exceptions.
+- Serialize only the parsed v2 `SiteEvidenceBundle` schema so unknown schema
+  fields are stripped before the body is emitted.
+- Document the consumer-owned sanitization boundary: the adapter does not
+  perform heuristic secret detection, and documented free-form finding or
+  receipt strings remain the consumer's responsibility.
+
+## 0.4.0 — 2026-07-18
+
+### Added
+
+- Add optional backward-compatible ownership fields to `publicationSurfaceSchema`:
+  `intendedOwner`, `observedOwner`, `ownerReceipt`, `observedCount`, and `minimumCount`.
+- Add `publicationSurfaceOwnerSchema` and `publicationSurfaceOwnerReceiptSchema` exports.
+- Add `publication.surface.static_shadow` finding: emitted when `intendedOwner=runtime` but
+  `observedOwner=static`, indicating the Worker is shadowed by a static asset (typically caused by
+  `assets.run_worker_first` not being set in `wrangler.toml`).
+- Add `publication.surface.owner_mismatch` finding: emitted when `intendedOwner` and `observedOwner`
+  are both explicitly declared, neither is `'na'`, and they do not agree.
+- Add `publication.surface.count_shortfall` finding: emitted when `observedCount < minimumCount`.
+- Add required negative fixture `llms-runtime-static-shadow`: HTTP 200/nonempty `llms` surface with
+  `intendedOwner=runtime`, `observedOwner=static`, 14 static entries, 0 minimum dynamic entries.
+  Proves the static-shadow detection path before any positive code.
+- The runner does not infer owner from response headers alone; both fields must be explicitly
+  declared by the fixture author or collector tool. Raw bodies and URLs are never retained in the
+  owner receipt.
+- Document `assets.run_worker_first`, Astro/Cloudflare collector evidence, artifact inspection for
+  counts, and explicit `'na'` ownership in `packages-docs/conformance.md`.
+
 ## 0.3.1 — 2026-07-17
 
 - Mark the `astro` peer dependency as optional (`peerDependenciesMeta.astro.optional: true`).

package/README.md

@@ -87,7 +87,7 @@ const fixture = {
 	},
 	buildEvidence: {
 		commitSha: 'bd39d718f6a5b0df9a249e11638a8b430050941e',
-		packageVersions: { '@growth-labs/conformance': '0.3.0', '@growth-labs/seo': '0.9.0' },
+		packageVersions: { '@growth-labs/conformance': '0.5.0', '@growth-labs/seo': '0.9.0' },
 		staticHeaderPolicy: true,
 		ssrHeaderPolicy: true,
 	},
@@ -97,6 +97,50 @@ const siteBundle = runSiteConformance(fixture)
 const fleetBundle = runFleetConformance([fixture])
 ```
 
+## Deployment Endpoint Adapter
+
+Consumers own the route, the conformance artifact, and the Cloudflare
+`[version_metadata]` binding. The CI/build probe step runs
+`runSiteConformance()`, serializes the result to a JSON artifact file, and
+bundles that file with the Worker. The adapter reads the pre-built artifact at
+module load (not per request) and serves it:
+
+```ts
+import artifact from './conformance-artifact.json' with { type: 'json' }
+import { initConformanceEndpoint } from '@growth-labs/conformance/endpoint'
+
+// Artifact produced by the CI probe step before deployment.
+// Static import: a missing conformance-artifact.json is a build-time error —
+// the Worker never starts if the artifact is absent.
+// Artifact is parsed, schema-stripped, bounded, and serialized ONCE here.
+const handler = initConformanceEndpoint(artifact, 'fronts')
+
+// src/pages/.well-known/growth-labs-conformance.json.ts
+export function GET({ locals, request }) {
+	return handler.handle({
+		method: request.method,
+		versionMetadata: locals.runtime.env.CF_VERSION_METADATA,
+	})
+}
+
+export const HEAD = GET
+```
+
+`initConformanceEndpoint` parses the artifact, validates it against the v2
+schema, checks `environment: 'production'` and the expected site, requires
+`buildEvidence.commitSha` (lowercase 40-character hex) and
+`buildEvidence.generatedAt` (timezone-qualified ISO-8601 datetime), and
+serializes the schema-stripped body bytes once. Per-request handling only
+validates the method and compares `versionMetadata.tag` against the baked commit
+SHA — no I/O, no probe execution, no re-serialization. Missing/malformed
+artifacts and wrong site/environment produce a handler that always returns 503.
+The adapter never reads or serializes environment bindings, request headers,
+Cloudflare version IDs, Cloudflare version timestamps, internal exceptions, or
+fields outside the parsed v2 schema. It does not perform heuristic secret
+detection: documented free-form strings such as finding messages, finding
+evidence, remediation text, and receipt evidence remain unchanged and are the
+consumer's sanitization responsibility.
+
 ## Shared Header Policy
 
 Use `buildSharedPublicationHeaders()` when a site wants the package-owned

package/dist/endpoint.d.ts

@@ -0,0 +1,21 @@
+export declare const CONFORMANCE_ENDPOINT_MAX_BYTES: number;
+export interface CloudflareVersionMetadataLike {
+    id?: unknown;
+    tag?: unknown;
+    timestamp?: unknown;
+}
+export interface DeploymentConformanceResponseOptions {
+    method: string;
+    bundle: unknown;
+    expectedSite: string;
+    versionMetadata?: CloudflareVersionMetadataLike | null;
+}
+export interface ConformanceEndpointHandler {
+    handle(options: {
+        method: unknown;
+        versionMetadata?: CloudflareVersionMetadataLike | null;
+    }): Response;
+}
+export declare function initConformanceEndpoint(artifact: unknown, expectedSite: string): ConformanceEndpointHandler;
+export declare function createDeploymentConformanceResponse(options: DeploymentConformanceResponseOptions): Response;
+//# sourceMappingURL=endpoint.d.ts.map

package/dist/endpoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../src/endpoint.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,8BAA8B,QAAc,CAAA;AAiBzD,MAAM,WAAW,6BAA6B;IAC7C,EAAE,CAAC,EAAE,OAAO,CAAA;IACZ,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,SAAS,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,MAAM,WAAW,oCAAoC;IACpD,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,OAAO,CAAA;IACf,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,CAAC,EAAE,6BAA6B,GAAG,IAAI,CAAA;CACtD;AAED,MAAM,WAAW,0BAA0B;IAC1C,MAAM,CAAC,OAAO,EAAE;QACf,MAAM,EAAE,OAAO,CAAA;QACf,eAAe,CAAC,EAAE,6BAA6B,GAAG,IAAI,CAAA;KACtD,GAAG,QAAQ,CAAA;CACZ;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,MAAM,GAClB,0BAA0B,CA+C5B;AAUD,wBAAgB,mCAAmC,CAClD,OAAO,EAAE,oCAAoC,GAC3C,QAAQ,CA8BV"}

package/dist/endpoint.js

@@ -0,0 +1,225 @@
+import { z } from 'zod';
+import { buildEvidenceSchema, siteEvidenceBundleSchema } from './schema.js';
+export const CONFORMANCE_ENDPOINT_MAX_BYTES = 1024 * 1024;
+const COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/;
+const CONTENT_TYPE = 'application/json; charset=utf-8';
+const GENERIC_FAILURE_BODY = '{"status":"unavailable"}';
+const INIT_FAILURE_DIAGNOSTIC = '[conformance] initConformanceEndpoint: artifact validation failed at init';
+// Single stripping schema: validates endpoint buildEvidence and the v2 bundle together
+// without touching schema-external fields. No .passthrough() — unknown fields are stripped.
+const deploymentArtifactSchema = siteEvidenceBundleSchema.extend({
+    buildEvidence: buildEvidenceSchema.extend({
+        commitSha: z.string().regex(COMMIT_SHA_PATTERN),
+        generatedAt: z.string().datetime({ offset: true }),
+    }),
+});
+export function initConformanceEndpoint(artifact, expectedSite) {
+    let capturedBody = null;
+    let capturedBuildCommitSha = null;
+    try {
+        const site = readExpectedSite(expectedSite);
+        const { buildEvidence, ...bundle } = deploymentArtifactSchema.parse(artifact);
+        if (bundle.site !== site || bundle.environment !== 'production') {
+            throw new Error('Conformance endpoint evidence does not match the expected production site.');
+        }
+        capturedBody = stringifyJsonBounded(bundle, CONFORMANCE_ENDPOINT_MAX_BYTES);
+        capturedBuildCommitSha = buildEvidence.commitSha;
+    }
+    catch {
+        reportInitFailure();
+    }
+    return {
+        handle(options) {
+            let isHead = false;
+            try {
+                const methodStr = readRequestMethod(options.method);
+                isHead = methodStr === 'HEAD';
+                if (methodStr !== 'GET' && methodStr !== 'HEAD') {
+                    return genericFailureResponse(405, false, { Allow: 'GET, HEAD' });
+                }
+                if (capturedBody === null || capturedBuildCommitSha === null) {
+                    throw new Error('Conformance endpoint artifact initialization failed.');
+                }
+                const commitSha = readDeploymentCommitSha(options.versionMetadata);
+                if (!commitShaEquals(capturedBuildCommitSha, commitSha)) {
+                    throw new Error('Conformance endpoint build evidence does not match the deployment tag.');
+                }
+                return new Response(isHead ? null : capturedBody, {
+                    status: 200,
+                    headers: responseHeaders(commitSha),
+                });
+            }
+            catch {
+                return genericFailureResponse(503, isHead);
+            }
+        },
+    };
+}
+function reportInitFailure() {
+    try {
+        console.error(INIT_FAILURE_DIAGNOSTIC);
+    }
+    catch {
+        // Logging must never turn a fail-closed handler into an import-time crash.
+    }
+}
+export function createDeploymentConformanceResponse(options) {
+    let isHead = false;
+    try {
+        const method = readRequestMethod(options.method);
+        isHead = method === 'HEAD';
+        if (method !== 'GET' && method !== 'HEAD') {
+            return genericFailureResponse(405, false, { Allow: 'GET, HEAD' });
+        }
+        const commitSha = readDeploymentCommitSha(options.versionMetadata);
+        const expectedSite = readExpectedSite(options.expectedSite);
+        const { buildEvidence, ...bundle } = deploymentArtifactSchema.parse(options.bundle);
+        if (bundle.site !== expectedSite || bundle.environment !== 'production') {
+            throw new Error('Conformance endpoint evidence does not match the expected production site.');
+        }
+        if (!commitShaEquals(buildEvidence.commitSha, commitSha)) {
+            throw new Error('Conformance endpoint build evidence does not match the deployment tag.');
+        }
+        const body = stringifyJsonBounded(bundle, CONFORMANCE_ENDPOINT_MAX_BYTES);
+        return new Response(isHead ? null : body, {
+            status: 200,
+            headers: responseHeaders(commitSha),
+        });
+    }
+    catch {
+        return genericFailureResponse(503, isHead);
+    }
+}
+function readRequestMethod(method) {
+    if (typeof method !== 'string') {
+        throw new Error('Request method is required.');
+    }
+    const normalizedMethod = method.trim().toUpperCase();
+    if (normalizedMethod.length === 0) {
+        throw new Error('Request method is required.');
+    }
+    return normalizedMethod;
+}
+function readExpectedSite(expectedSite) {
+    if (typeof expectedSite !== 'string' || expectedSite.trim().length === 0) {
+        throw new Error('Expected site identity is required.');
+    }
+    return expectedSite;
+}
+function readDeploymentCommitSha(versionMetadata) {
+    if (!versionMetadata || typeof versionMetadata !== 'object') {
+        throw new Error('Cloudflare version metadata is required.');
+    }
+    const { tag } = versionMetadata;
+    if (typeof tag !== 'string' || !COMMIT_SHA_PATTERN.test(tag)) {
+        throw new Error('Cloudflare version metadata tag must be a lowercase 40-character commit SHA.');
+    }
+    return tag;
+}
+function commitShaEquals(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < left.length; index += 1) {
+        difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+    }
+    return difference === 0;
+}
+function responseHeaders(commitSha) {
+    const headers = new Headers({
+        'Content-Type': CONTENT_TYPE,
+        'Cache-Control': 'private, no-store',
+        'X-Content-Type-Options': 'nosniff',
+    });
+    if (commitSha)
+        headers.set('X-Growth-Labs-Commit-SHA', commitSha);
+    return headers;
+}
+function genericFailureResponse(status, head, extraHeaders = {}) {
+    const headers = responseHeaders();
+    for (const [name, value] of Object.entries(extraHeaders))
+        headers.set(name, value);
+    return new Response(head ? null : GENERIC_FAILURE_BODY, { status, headers });
+}
+function stringifyJsonBounded(value, maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+        throw new RangeError('maxBytes must be a positive safe integer.');
+    }
+    const encoder = new TextEncoder();
+    const parts = [];
+    const seen = new Set();
+    let bytes = 0;
+    function append(part) {
+        const nextBytes = bytes + encoder.encode(part).byteLength;
+        if (nextBytes > maxBytes)
+            throw new RangeError('Conformance endpoint response is too large.');
+        bytes = nextBytes;
+        parts.push(part);
+    }
+    function writeJsonString(text) {
+        append(JSON.stringify(text));
+    }
+    function write(next) {
+        if (next === null) {
+            append('null');
+            return;
+        }
+        switch (typeof next) {
+            case 'string':
+                writeJsonString(next);
+                return;
+            case 'number':
+                append(Number.isFinite(next) ? String(next) : 'null');
+                return;
+            case 'boolean':
+                append(next ? 'true' : 'false');
+                return;
+            case 'object':
+                writeObject(next);
+                return;
+            default:
+                throw new TypeError('Unsupported JSON value.');
+        }
+    }
+    function writeObject(next) {
+        if (seen.has(next))
+            throw new TypeError('Cannot serialize circular evidence.');
+        seen.add(next);
+        try {
+            if (Array.isArray(next)) {
+                append('[');
+                next.forEach((item, index) => {
+                    if (index > 0)
+                        append(',');
+                    if (item === undefined || typeof item === 'function' || typeof item === 'symbol') {
+                        append('null');
+                        return;
+                    }
+                    write(item);
+                });
+                append(']');
+                return;
+            }
+            append('{');
+            let first = true;
+            for (const key of Object.keys(next)) {
+                const item = next[key];
+                if (item === undefined || typeof item === 'function' || typeof item === 'symbol')
+                    continue;
+                if (!first)
+                    append(',');
+                first = false;
+                append(JSON.stringify(key));
+                append(':');
+                write(item);
+            }
+            append('}');
+        }
+        finally {
+            seen.delete(next);
+        }
+    }
+    write(value);
+    return parts.join('');
+}
+//# sourceMappingURL=endpoint.js.map

package/dist/endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint.js","sourceRoot":"","sources":["../src/endpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAE3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,GAAG,IAAI,CAAA;AAEzD,MAAM,kBAAkB,GAAG,gBAAgB,CAAA;AAC3C,MAAM,YAAY,GAAG,iCAAiC,CAAA;AACtD,MAAM,oBAAoB,GAAG,0BAA0B,CAAA;AACvD,MAAM,uBAAuB,GAC5B,2EAA2E,CAAA;AAE5E,uFAAuF;AACvF,4FAA4F;AAC5F,MAAM,wBAAwB,GAAG,wBAAwB,CAAC,MAAM,CAAC;IAChE,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC;QACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;KAClD,CAAC;CACF,CAAC,CAAA;AAsBF,MAAM,UAAU,uBAAuB,CACtC,QAAiB,EACjB,YAAoB;IAEpB,IAAI,YAAY,GAAkB,IAAI,CAAA;IACtC,IAAI,sBAAsB,GAAkB,IAAI,CAAA;IAEhD,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAA;QAC3C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAE7E,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;QAC9F,CAAC;QACD,YAAY,GAAG,oBAAoB,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAA;QAC3E,sBAAsB,GAAG,aAAa,CAAC,SAAS,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,iBAAiB,EAAE,CAAA;IACpB,CAAC;IAED,OAAO;QACN,MAAM,CAAC,OAAO;YACb,IAAI,MAAM,GAAG,KAAK,CAAA;YAClB,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACnD,MAAM,GAAG,SAAS,KAAK,MAAM,CAAA;gBAE7B,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACjD,OAAO,sBAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;gBAClE,CAAC;gBAED,IAAI,YAAY,KAAK,IAAI,IAAI,sBAAsB,KAAK,IAAI,EAAE,CAAC;oBAC9D,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;gBACxE,CAAC;gBAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;gBAElE,IAAI,CAAC,eAAe,CAAC,sBAAsB,EAAE,SAAS,CAAC,EAAE,CAAC;oBACzD,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;gBAC1F,CAAC;gBAED,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,EAAE;oBACjD,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC;iBACnC,CAAC,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAC3C,CAAC;QACF,CAAC;KACD,CAAA;AACF,CAAC;AAED,SAAS,iBAAiB;IACzB,IAAI,CAAC;QACJ,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACR,2EAA2E;IAC5E,CAAC;AACF,CAAC;AAED,MAAM,UAAU,mCAAmC,CAClD,OAA6C;IAE7C,IAAI,MAAM,GAAG,KAAK,CAAA;IAElB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,GAAG,MAAM,KAAK,MAAM,CAAA;QAE1B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3C,OAAO,sBAAsB,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;QAClE,CAAC;QAED,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;QAClE,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAC3D,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAEnF,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;QAC9F,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;QAC1F,CAAC;QAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAA;QACzE,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;YACzC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC;SACnC,CAAC,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAe;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAC/C,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpD,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,gBAAgB,CAAA;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAoB;IAC7C,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,YAAY,CAAA;AACpB,CAAC;AAED,SAAS,uBAAuB,CAC/B,eAAiE;IAEjE,IAAI,CAAC,eAAe,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,eAAe,CAAA;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAA;IAChG,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAE9C,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IAC/D,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,eAAe,CAAC,SAAkB;IAC1C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC3B,cAAc,EAAE,YAAY;QAC5B,eAAe,EAAE,mBAAmB;QACpC,wBAAwB,EAAE,SAAS;KACnC,CAAC,CAAA;IACF,IAAI,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,SAAS,CAAC,CAAA;IACjE,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,sBAAsB,CAC9B,MAAc,EACd,IAAa,EACb,eAAuC,EAAE;IAEzC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAA;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAClF,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,QAAgB;IAC7D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,UAAU,CAAC,2CAA2C,CAAC,CAAA;IAClE,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,IAAI,KAAK,GAAG,CAAC,CAAA;IAEb,SAAS,MAAM,CAAC,IAAY;QAC3B,MAAM,SAAS,GAAG,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAA;QACzD,IAAI,SAAS,GAAG,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,6CAA6C,CAAC,CAAA;QAC7F,KAAK,GAAG,SAAS,CAAA;QACjB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACjB,CAAC;IAED,SAAS,eAAe,CAAC,IAAY;QACpC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7B,CAAC;IAED,SAAS,KAAK,CAAC,IAAa;QAC3B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,CAAA;YACd,OAAM;QACP,CAAC;QAED,QAAQ,OAAO,IAAI,EAAE,CAAC;YACrB,KAAK,QAAQ;gBACZ,eAAe,CAAC,IAAI,CAAC,CAAA;gBACrB,OAAM;YACP,KAAK,QAAQ;gBACZ,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;gBACrD,OAAM;YACP,KAAK,SAAS;gBACb,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;gBAC/B,OAAM;YACP,KAAK,QAAQ;gBACZ,WAAW,CAAC,IAAI,CAAC,CAAA;gBACjB,OAAM;YACP;gBACC,MAAM,IAAI,SAAS,CAAC,yBAAyB,CAAC,CAAA;QAChD,CAAC;IACF,CAAC;IAED,SAAS,WAAW,CAAC,IAAY;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAA;QAC9E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACJ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;oBAC5B,IAAI,KAAK,GAAG,CAAC;wBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;oBAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,UAAU,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAClF,MAAM,CAAC,MAAM,CAAC,CAAA;wBACd,OAAM;oBACP,CAAC;oBACD,KAAK,CAAC,IAAI,CAAC,CAAA;gBACZ,CAAC,CAAC,CAAA;gBACF,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,OAAM;YACP,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,CAAA;YACX,IAAI,KAAK,GAAG,IAAI,CAAA;YAChB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAwB,CAAC,CAAA;gBAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,UAAU,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAQ;gBAC1F,IAAI,CAAC,KAAK;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;gBACvB,KAAK,GAAG,KAAK,CAAA;gBACb,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC3B,MAAM,CAAC,GAAG,CAAC,CAAA;gBACX,KAAK,CAAC,IAAI,CAAC,CAAA;YACZ,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,CAAA;QACZ,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;IACF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,CAAA;IACZ,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACtB,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
 export { type AstroCspConfig, type AstroCspPolicyOptions, type AstroCspResource, buildAstroCspConfig, buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, buildStrictTransportSecurity, type CachePolicyOptions, type ContentSecurityPolicyOptions, type CrossOriginOpenerPolicy, type CrossOriginResourcePolicy, collectHeaders, type HeaderPolicyOptions, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, type StrictTransportSecurityOptions, } from './policy.js';
 export { type RunConformanceOptions, runFleetConformance, runSiteConformance } from './runner.js';
-export { type Audience, audienceSchema, type BuildEvidence, buildEvidenceSchema, type CacheVariant, type ConformanceCheckReceipt, type ConformanceFinding, type ConformanceFixture, type ConformanceFixtureInput, type CspReportReceipt, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, cspReportReceiptSchema, EVIDENCE_SCHEMA_VERSION, type EvidenceSummary, evidenceSummarySchema, type FleetEvidenceBundle, findingSeveritySchema, fleetEvidenceBundleSchema, type HeaderMap, headerMapSchema, headerValueSchema, type InlineStyleAttributeInventory, inlineStyleAttributeInventorySchema, type PublicationSurfaceEvidence, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, REQUIRED_NEGATIVE_FIXTURE_CODES, type RenderMode, type RequiredNegativeFindingCode, type RequiredNegativeFixtureId, renderModeSchema, type SecurityFunctionalProbeReceipt, type SecurityReceipts, type SiteEvidenceBundle, type SurfaceResponse, securityFunctionalProbeReceiptSchema, securityReceiptsSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
+export { type Audience, audienceSchema, type BuildEvidence, buildEvidenceSchema, type CacheVariant, type ConformanceCheckReceipt, type ConformanceFinding, type ConformanceFixture, type ConformanceFixtureInput, type CspReportReceipt, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, cspReportReceiptSchema, EVIDENCE_SCHEMA_VERSION, type EvidenceSummary, evidenceSummarySchema, type FleetEvidenceBundle, findingSeveritySchema, fleetEvidenceBundleSchema, type HeaderMap, headerMapSchema, headerValueSchema, type InlineStyleAttributeInventory, inlineStyleAttributeInventorySchema, type PublicationSurfaceEvidence, type PublicationSurfaceOwner, type PublicationSurfaceOwnerReceipt, parseConformanceFixture, publicationSurfaceOwnerReceiptSchema, publicationSurfaceOwnerSchema, publicationSurfaceSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, REQUIRED_NEGATIVE_FIXTURE_CODES, type RenderMode, type RequiredNegativeFindingCode, type RequiredNegativeFixtureId, renderModeSchema, type SecurityFunctionalProbeReceipt, type SecurityReceipts, type SiteEvidenceBundle, type SurfaceResponse, securityFunctionalProbeReceiptSchema, securityReceiptsSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAC5B,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,cAAc,EACd,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,8BAA8B,GACnC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,qBAAqB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EACN,KAAK,QAAQ,EACb,cAAc,EACd,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,eAAe,EACf,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,UAAU,EACf,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,gBAAgB,EAChB,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAC5B,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,cAAc,EACd,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,8BAA8B,GACnC,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,qBAAqB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EACN,KAAK,QAAQ,EACb,cAAc,EACd,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,EACrB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,eAAe,EACpB,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,eAAe,EACf,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,mCAAmC,EACnC,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EACnC,uBAAuB,EACvB,oCAAoC,EACpC,6BAA6B,EAC7B,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAC/B,KAAK,UAAU,EACf,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,gBAAgB,EAChB,KAAK,8BAA8B,EACnC,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -1,4 +1,4 @@
 export { buildAstroCspConfig, buildCacheControl, buildContentSecurityPolicy, buildSharedPublicationHeaders, buildStrictTransportSecurity, collectHeaders, isPrivateAudience, normalizeHeaders, REQUIRED_SECURITY_HEADERS, } from './policy.js';
 export { runFleetConformance, runSiteConformance } from './runner.js';
-export { audienceSchema, buildEvidenceSchema, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, cspReportReceiptSchema, EVIDENCE_SCHEMA_VERSION, evidenceSummarySchema, findingSeveritySchema, fleetEvidenceBundleSchema, headerMapSchema, headerValueSchema, inlineStyleAttributeInventorySchema, parseConformanceFixture, publicationSurfaceSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, REQUIRED_NEGATIVE_FIXTURE_CODES, renderModeSchema, securityFunctionalProbeReceiptSchema, securityReceiptsSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
+export { audienceSchema, buildEvidenceSchema, cacheVariantSchema, checkStatusSchema, conformanceCheckReceiptSchema, conformanceExpectedSchema, conformanceFindingSchema, conformanceFixtureSchema, cspReportReceiptSchema, EVIDENCE_SCHEMA_VERSION, evidenceSummarySchema, findingSeveritySchema, fleetEvidenceBundleSchema, headerMapSchema, headerValueSchema, inlineStyleAttributeInventorySchema, parseConformanceFixture, publicationSurfaceOwnerReceiptSchema, publicationSurfaceOwnerSchema, publicationSurfaceSchema, REQUIRED_FUNCTIONAL_PROBE_NAMES, REQUIRED_NEGATIVE_FIXTURE_CODES, renderModeSchema, securityFunctionalProbeReceiptSchema, securityReceiptsSchema, siteEvidenceBundleSchema, surfaceResponseSchema, validateFleetEvidenceBundle, validateSiteEvidenceBundle, } from './schema.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAK5B,cAAc,EAEd,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GAEzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAA8B,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAEN,cAAc,EAEd,mBAAmB,EAOnB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EAEvB,qBAAqB,EAErB,qBAAqB,EACrB,yBAAyB,EAEzB,eAAe,EACf,iBAAiB,EAEjB,mCAAmC,EAEnC,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAI/B,gBAAgB,EAKhB,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,mBAAmB,EACnB,iBAAiB,EACjB,0BAA0B,EAC1B,6BAA6B,EAC7B,4BAA4B,EAK5B,cAAc,EAEd,iBAAiB,EACjB,gBAAgB,EAChB,yBAAyB,GAEzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAA8B,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACjG,OAAO,EAEN,cAAc,EAEd,mBAAmB,EAOnB,kBAAkB,EAClB,iBAAiB,EACjB,6BAA6B,EAC7B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EAEvB,qBAAqB,EAErB,qBAAqB,EACrB,yBAAyB,EAEzB,eAAe,EACf,iBAAiB,EAEjB,mCAAmC,EAInC,uBAAuB,EACvB,oCAAoC,EACpC,6BAA6B,EAC7B,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAI/B,gBAAgB,EAKhB,oCAAoC,EACpC,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC1B,MAAM,aAAa,CAAA"}

package/dist/runner.js

@@ -825,7 +825,7 @@ function checkPublicationSurfaces(fixture) {
             findings.push({
                 code: 'publication.surface.missing',
                 severity: 'error',
-                message: `Publication surface ${required} must be present or explicitly declared NA.`,
+                message: 'Required publication surface is missing or not declared NA.',
                 path: `publicationSurfaces.${required}`,
             });
         }
@@ -839,7 +839,6 @@ function checkPublicationSurfaces(fixture) {
                     severity: 'error',
                     message: 'NA publication surfaces require a capability boundary and evidence.',
                     path,
-                    evidence: surface.name,
                     remediation: 'Declare why the site cannot provide the surface and attach supporting evidence.',
                 });
             }
@@ -849,7 +848,7 @@ function checkPublicationSurfaces(fixture) {
             findings.push({
                 code: 'publication.surface.missing',
                 severity: 'error',
-                message: `Publication surface ${surface.name} is missing.`,
+                message: 'Publication surface is missing.',
                 path,
             });
             return;
@@ -858,18 +857,85 @@ function checkPublicationSurfaces(fixture) {
             findings.push({
                 code: 'publication.surface.http_error',
                 severity: 'error',
-                message: `Publication surface ${surface.name} returned HTTP ${surface.httpStatus}.`,
+                message: 'Publication surface returned an HTTP error.',
                 path: `${path}.httpStatus`,
+                evidence: `httpStatus=${surface.httpStatus}`,
             });
         }
         if (surface.bodyBytes !== undefined && surface.bodyBytes === 0) {
             findings.push({
                 code: 'publication.surface.empty',
                 severity: 'error',
-                message: `Publication surface ${surface.name} has an empty body.`,
+                message: 'Publication surface has an empty body.',
                 path: `${path}.bodyBytes`,
             });
         }
+        const { intendedOwner, observedOwner } = surface;
+        const hasIntended = intendedOwner !== undefined;
+        const hasObserved = observedOwner !== undefined;
+        if (hasIntended !== hasObserved) {
+            findings.push({
+                code: 'publication.surface.owner_pair_incomplete',
+                severity: 'error',
+                message: 'Publication surface ownership requires both intendedOwner and observedOwner.',
+                path: hasIntended ? `${path}.observedOwner` : `${path}.intendedOwner`,
+                remediation: 'Declare both intendedOwner and observedOwner together, or omit both for legacy surfaces.',
+            });
+        }
+        else if (hasIntended && hasObserved && intendedOwner !== 'na' && observedOwner !== 'na') {
+            if (!surface.ownerReceipt) {
+                findings.push({
+                    code: 'publication.surface.owner_receipt_missing',
+                    severity: 'error',
+                    message: 'Publication surface ownership requires a deterministic receipt when ownership is declared.',
+                    path: `${path}.ownerReceipt`,
+                    remediation: 'Attach a privacy-safe receipt with a versioned collector, observedAt timestamp, and signalHash.',
+                });
+            }
+            if (intendedOwner !== observedOwner) {
+                if (intendedOwner === 'runtime' && observedOwner === 'static') {
+                    findings.push({
+                        code: 'publication.surface.static_shadow',
+                        severity: 'error',
+                        message: 'Publication surface is intended to be runtime-owned but is served from static assets.',
+                        path: `${path}.observedOwner`,
+                        evidence: 'intended=runtime; observed=static',
+                        remediation: 'Set assets.run_worker_first = true in wrangler.toml so the Worker handles requests before static assets.',
+                    });
+                }
+                else {
+                    findings.push({
+                        code: 'publication.surface.owner_mismatch',
+                        severity: 'error',
+                        message: 'Publication surface intended owner does not match observed owner.',
+                        path: `${path}.observedOwner`,
+                        evidence: `intended=${intendedOwner}; observed=${observedOwner}`,
+                        remediation: 'Verify the routing configuration ensures the intended owner handles requests for this surface.',
+                    });
+                }
+            }
+        }
+        if (surface.minimumCount !== undefined && surface.observedCount === undefined) {
+            findings.push({
+                code: 'publication.surface.count_dimension_incomplete',
+                severity: 'error',
+                message: 'Publication surface count minimum requires both observedCount and minimumCount.',
+                path: `${path}.observedCount`,
+                remediation: 'Provide both observedCount and minimumCount, or omit both for surfaces without a count contract.',
+            });
+        }
+        else if (surface.minimumCount !== undefined &&
+            surface.observedCount !== undefined &&
+            surface.observedCount < surface.minimumCount) {
+            findings.push({
+                code: 'publication.surface.count_shortfall',
+                severity: 'error',
+                message: 'Publication surface has fewer entries than the required minimum.',
+                path: `${path}.observedCount`,
+                evidence: `observed=${surface.observedCount}; minimum=${surface.minimumCount}`,
+                remediation: 'Verify the surface is populated with the expected number of entries by the intended owner.',
+            });
+        }
     });
     return receipt('publication-surfaces', findings);
 }