@redsift/products 12.5.12-alpha.1 → 12.5.12-alpha.3

package/_internal/SignalCardSpfDomain.js

@@ -292,6 +292,7 @@ var EXTRACTOR_STRINGS = {
     "card.dmarc.error.invalid-rua-format": "Invalid rua format - must be mailto: URI",
     "card.dmarc.error.invalid-version": "Invalid DMARC version - must be DMARC1",
     "card.dmarc.error.misplaced-policy": "DMARC policy located at wrong subdomain",
+    "card.dmarc.error.multiple-policies": "More than one DMARC record is published on this domain",
     "card.dmarc.error.nxdomain": "NXDOMAIN - domain does not exist",
     "card.dmarc.error.policy-not-found": "DMARC policy not found",
     "card.dmarc.error.syntax-error": "Syntax error in DMARC record",
@@ -538,6 +539,7 @@ var EXTRACTOR_STRINGS = {
     "investigate:card.dmarc.full-rejection-subdomain-weak_md": "**100%** of unauthorized emails with the [](FROM#:glossary) `{domain}` will be **rejected**, but subdomains use a weaker policy (sp={sp}), leaving them vulnerable to spoofing.",
     "investigate:card.dmarc.misplaced-bad-policy_md": "**The [FULL](DMARC_POLICY#:glossary) is misplaced and has a syntax error:**",
     "investigate:card.dmarc.misplaced-policy_md": "**The [FULL](DMARC_POLICY#:glossary) is misplaced.**",
+    "investigate:card.dmarc.multiple-policies_md": "**More than one [FULL](DMARC_POLICY#:glossary) is published on `{policyDomain}`.** Receivers stop policy discovery and apply no DMARC policy at all, so the domain is unprotected. Publish exactly one DMARC record.",
     "investigate:card.dmarc.no-policy_md": "**No [FULL](DMARC_POLICY#:glossary) published on domain**\n\n**`{policyDomain}`**",
     "investigate:card.dmarc.no-txt-published-policy-on-domain_md": "No [](TXT_RECORDS#:glossary) published on `{policyDomain}`",
     "investigate:card.dmarc.permerror-no-rua_md": "No valid reporting URI ([](RUA#:glossary)) is present, so receivers will skip DMARC processing entirely.",
@@ -777,6 +779,7 @@ var EXTRACTOR_STRINGS = {
     "card.dmarc.error.invalid-rua-format": "Format rua invalide - doit \xEAtre une URI mailto:",
     "card.dmarc.error.invalid-version": "Version DMARC invalide - doit \xEAtre DMARC1",
     "card.dmarc.error.misplaced-policy": "Politique DMARC situ\xE9e au mauvais sous-domaine",
+    "card.dmarc.error.multiple-policies": "Plusieurs enregistrements DMARC pour ce domaine",
     "card.dmarc.error.nxdomain": "NXDOMAIN - le domaine n'existe pas",
     "card.dmarc.error.policy-not-found": "Politique DMARC introuvable",
     "card.dmarc.error.syntax-error": "Erreur de syntaxe dans l'enregistrement DMARC",
@@ -1023,6 +1026,7 @@ var EXTRACTOR_STRINGS = {
     "investigate:card.dmarc.full-rejection-subdomain-weak_md": "**100%** des courriels non autoris\xE9s avec le [](FROM#:glossary) `{domain}` seront **rejet\xE9s**, mais les sous-domaines utilisent une politique plus faible (sp={sp}), les laissant vuln\xE9rables \xE0 l'usurpation.",
     "investigate:card.dmarc.misplaced-bad-policy_md": "**Le [FULL](DMARC_POLICY#:glossary) est mal plac\xE9 et a une erreur de syntaxe:**",
     "investigate:card.dmarc.misplaced-policy_md": "**Le [FULL](DMARC_POLICY#:glossary) est mal plac\xE9.",
+    "investigate:card.dmarc.multiple-policies_md": "**Plusieurs [FULL](DMARC_POLICY#:glossary) sont publi\xE9es sur `{policyDomain}`.** Les destinataires interrompent la d\xE9couverte de la politique et n'appliquent aucune politique DMARC, le domaine n'est donc pas prot\xE9g\xE9. Publiez un seul enregistrement DMARC.",
     "investigate:card.dmarc.no-policy_md": "**Aucune [FULL](DMARC_POLICY#:glossary) publi\xE9e sur le domaine**\n\n**`{policyDomain}`**",
     "investigate:card.dmarc.no-txt-published-policy-on-domain_md": "Aucun [](TXT_RECORD#:glossary) publi\xE9 sur `{policyDomain}`",
     "investigate:card.dmarc.permerror-no-rua_md": "Aucun URI de rapport valide ([](RUA#:glossary)) n'est pr\xE9sent, les destinataires ignoreront enti\xE8rement le traitement DMARC.",
@@ -1287,6 +1291,7 @@ var enUS = {
 	"investigate.extracted-email-short": "Extracted from your email",
 	"investigate.dkim-evaluation": "DKIM Evaluation",
 	"investigate.fcrdns-evaluation": "FCrDNS Evaluation",
+	"investigate.card.bimi.glossary-link": "What does this mean?",
 	"investigate.card.spf-passed_md": "**[](SPF#:glossary) authentication passed.**",
 	"investigate.card.spf-failed_md": "**[](SPF#:glossary) authentication failed.**",
 	"investigate.card.dmarc.error-raw_md": [
@@ -2004,6 +2009,7 @@ var frFR = {
 	"investigate.summary.dnssec": "DNSSEC",
 	"investigate.summary.dns-lookups": "{count} Recherches DNS",
 	"investigate.summary.void-lookups": "{count} Recherches vides",
+	"investigate.card.bimi.glossary-link": "Qu’est-ce que cela signifie ?",
 	"investigate.card.spf-passed_md": "**[](SPF#:glossary) authentification réussie.**",
 	"investigate.card.spf-failed_md": "**[](SPF#:glossary) authentification échouée.**",
 	"investigate.card.dmarc.error-raw_md": [
@@ -7468,9 +7474,273 @@ function renderDisplayValue(value) {
   return value;
 }
 
+/**
+ * BIMI code → glossary page map.
+ *
+ * Each BIMI finding carries a `checker_codes` schema id from `redsift/event-schemas`
+ * (e.g. `DNS-BIMI-0020`). The glossary publishes one explainer page per code. This
+ * module turns a code into the URL of its page so a card row can offer a
+ * "What does this mean?" link.
+ *
+ * ## Why the map lives here
+ *
+ * Decision D4a of the glossary design: the website deliberately publishes no
+ * code → slug manifest and performs no code → URL resolution. Its side of the
+ * contract is that these slugs are permanent; if one ever has to change, the
+ * website owes a redirect and an updated map here.
+ *
+ * ## Keyed on the code, never the slug or the message text
+ *
+ * The code is the only stable identifier. Titles, severities and statuses drift
+ * (0033 changed under WEB-1155; 0021's grammar changed) and slugs are human text,
+ * so they are the most likely thing to be re-worded later. Row message text is
+ * worse still — it is backend prose that `formatMessageWithUrls()` rewrites before
+ * it reaches the card, and it is not in any translation catalogue.
+ *
+ * ## Unmapped codes resolve to nothing, by design
+ *
+ * `resolveBimiGlossaryHref` returns `undefined` rather than guessing a URL. This is
+ * an everyday path, not an edge case:
+ *   - `DNS-BIMI-0003` has no glossary page — the authored set jumps 0002 → 0004.
+ *   - `msgCode` is a free-form string upstream; real payloads carry non-schema
+ *     values such as `multiple-records`, `config-error` and `DNS-BIMI-0000-MISMATCH`.
+ *   - IPForensics currently mis-assigns some codes (`bimi-error-invalid-record` is
+ *     tagged 0021, which is the "both l and a tags missed" page). A permissive
+ *     resolver would send a reader to a page describing a *different* error, which
+ *     is worse than offering no link at all.
+ *
+ * @see https://redsift.atlassian.net/browse/DS-113
+ */
+
+/** Production origin for glossary pages, used when the card renders outside the website. */
+const GLOSSARY_ORIGIN = 'https://redsift.com';
+
+/** Site-relative path prefix for glossary pages. */
+const GLOSSARY_PATH = '/glossary';
+
+/**
+ * Code → glossary slug. Read from the published Prismic API on 2026-08-18.
+ *
+ * 36 entries. Regenerate from the content API rather than editing by hand, and
+ * note the two known coverage gaps:
+ *   - 0003 is absent (no authored page).
+ *   - 0023–0032 are authored and live but the BIMI Checker does not emit them yet,
+ *     so they only appear on cards fed directly from the schema feed.
+ */
+const BIMI_CODE_TO_GLOSSARY_SLUG = Object.freeze(Object.assign(Object.create(null), {
+  'DNS-BIMI-0001': 'logo-url-scheme-is-not-https-missing-vmc-in-record',
+  'DNS-BIMI-0002': 'no-vmc-in-record',
+  // 0003 intentionally absent — no glossary page authored.
+  'DNS-BIMI-0004': 'missing-l-tag',
+  'DNS-BIMI-0005': 'failed-to-fetch-logo',
+  'DNS-BIMI-0006': 'no-version-in-record',
+  'DNS-BIMI-0007': 'failed-to-fetch-authority-certificate',
+  'DNS-BIMI-0008': 'no-record',
+  'DNS-BIMI-0009': 'invalid-record',
+  'DNS-BIMI-0010': 'valid-record-but-dmarc-isn-t-ready',
+  'DNS-BIMI-0011': 'vmc-validation-errors',
+  'DNS-BIMI-0012': 'certificate-can-t-be-accessed-automatically',
+  'DNS-BIMI-0013': 'declination-to-publish',
+  'DNS-BIMI-0014': 'certificate-not-valid-for-the-domain',
+  'DNS-BIMI-0015': 'bimi-record-validation-errors',
+  'DNS-BIMI-0016': 'authority-url-scheme-is-not-https',
+  'DNS-BIMI-0017': 'logo-validation-errors',
+  'DNS-BIMI-0018': 'bimi-record-found-on-organizational-domain',
+  'DNS-BIMI-0019': 'multiple-bimi-records-found-on-target-domain',
+  'DNS-BIMI-0020': 'duplicate-tag-detected-in-bimi-record',
+  'DNS-BIMI-0021': 'both-l-and-a-tags-missed',
+  'DNS-BIMI-0022': 'no-bimi-record-found-and-dmarc-policy-is-insufficient',
+  'DNS-BIMI-0023': 'svg-logo-dimensions-use-non-pixel-values',
+  'DNS-BIMI-0024': 'svg-logo-dimensions-below-96x96-pixel-minimum',
+  'DNS-BIMI-0025': 'svg-logo-missing-width-or-height-attributes',
+  'DNS-BIMI-0026': 'vmc-pem-starts-with-utf-8-bom',
+  'DNS-BIMI-0027': 'vmc-pem-bundle-contains-only-the-leaf-certificate',
+  'DNS-BIMI-0028': 'vmc-certificate-chain-signature-verification-failed',
+  'DNS-BIMI-0029': 'vmc-certificate-chain-does-not-terminate-at-a-trusted-bimi-root-ca',
+  'DNS-BIMI-0030': 'vmc-certificate-chain-ordering-does-not-match-expected-issuance-order',
+  'DNS-BIMI-0031': 'vmc-pem-bundle-omits-the-root-ca-certificate',
+  'DNS-BIMI-0032': 'non-https-url-encountered-while-fetching-the-vmc-certificate',
+  'DNS-BIMI-0033': 'vmc-leaf-certificate-selection-is-ambiguous',
+  'DNS-BIMI-0034': 'timed-out-fetching-the-bimi-asset',
+  'DNS-BIMI-0035': 'bimi-asset-host-could-not-be-resolved',
+  'DNS-BIMI-0036': 'connection-to-the-bimi-asset-host-failed',
+  'DNS-BIMI-0037': 'tls-handshake-failed-fetching-the-bimi-asset'
+}));
+
+/** Options for {@link resolveBimiGlossaryHref}. */
+
+/**
+ * Resolve a BIMI schema code to its glossary page URL.
+ *
+ * @param code - A `checker_codes` schema id, e.g. `'DNS-BIMI-0020'`. Anything not
+ *               in {@link BIMI_CODE_TO_GLOSSARY_SLUG} resolves to `undefined`.
+ * @returns The page URL, or `undefined` when the code has no glossary page.
+ *
+ * @example
+ * resolveBimiGlossaryHref('DNS-BIMI-0008');
+ * // 'https://redsift.com/glossary/no-record'
+ * resolveBimiGlossaryHref('DNS-BIMI-0008', { relative: true });
+ * // '/glossary/no-record'
+ * resolveBimiGlossaryHref('DNS-BIMI-0003');   // undefined — no page authored
+ * resolveBimiGlossaryHref('config-error');    // undefined — not a schema code
+ */
+function resolveBimiGlossaryHref(code) {
+  let options = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  if (!code) return undefined;
+
+  // Own-property check, not just a truthiness test. `code` originates from `msgCode`,
+  // which is free-form backend data, so a key like `__proto__` or `constructor` would
+  // otherwise resolve to an inherited value — truthy, and stringified into a URL such
+  // as `/glossary/[object Object]`. Both maps are null-prototyped as well; this is the
+  // second layer, so reverting either one alone cannot reintroduce the hole.
+  // Raised in review on PR #1172.
+  if (!Object.prototype.hasOwnProperty.call(BIMI_CODE_TO_GLOSSARY_SLUG, code)) return undefined;
+  const slug = BIMI_CODE_TO_GLOSSARY_SLUG[code];
+  if (typeof slug !== 'string' || !slug) return undefined;
+  const path = `${GLOSSARY_PATH}/${slug}`;
+  return options.relative ? path : `${GLOSSARY_ORIGIN}${path}`;
+}
+
+/**
+ * signal-logic translation key → BIMI schema code, for rows that carry no `code`.
+ *
+ * The `bimiRecordStatus` switch in signal-logic builds its rows from a fixed
+ * translation key and never attaches a code, so those rows cannot be linked from
+ * `InfoItem.code` alone (see WEB-1239). The key, however, *is* deterministic: it is
+ * a literal in signal-logic's source, not backend prose, so mapping key → code is
+ * stable in a way that matching the rendered message text is not.
+ *
+ * Covers two families of key:
+ *
+ * 1. The `bimiRecordStatus` switch rows (`record-missing_md` and friends).
+ * 2. The per-error `recordValidationErrors` rows, keyed `card.bimi.errors.<errorCode>`.
+ *    These are the individual "Record l value needs to be a valid URL" lines listed
+ *    under an invalid record. They matter because they are the rows that actually tell
+ *    a reader *what* to fix, and the schema code that IPForensics assigned them is
+ *    destroyed before the card sees it: the website's `RecordMessageCodes` rewrites
+ *    `DNS-BIMI-00XX` into these `bimi-error-*` names, collapsing 0009/0015/0020/0021
+ *    all onto `bimi-error-invalid-record`. Mapping the name back is therefore the only
+ *    way to link these rows, and it is safe only where the relation is 1:1.
+ *
+ * Deliberately absent:
+ *   - `record-failed_md` — `NOT_VMC`, `WITH_ERRORS` and `CERT_INVALID` all collapse
+ *     to this one row, so it is many-to-one and cannot name a single page.
+ *   - `record-passed_md` / `record-declination_md` are pass/info states; 0013
+ *     (declination) is emitted separately as a coded report row.
+ *   - `record-unknown-error_md` has no page.
+ *   - `errors.bimi-error-unsupported-values` has no authored glossary page.
+ *   - `errors.bimi-error-invalid-record` — the website collapses 0009, 0015, 0020 and
+ *     0021 onto this one name, and those pages describe different errors: 0009 is a
+ *     record that cannot be parsed at all, while 0020 (duplicate tag) and 0021 (both
+ *     l= and a= missing) are parseable records. Mapping it to 0009 sent a reader
+ *     whose actual error was 0020 or 0021 to a page describing a parse failure that
+ *     did not happen. Raised in review on PR #1172.
+ *   - Most `logoErrors.invalid-svg-*` rows. These describe *which* SVG rule the logo
+ *     broke (bad root element, disallowed `script` element, wrong profile, …) and the
+ *     glossary has no page per rule — only the umbrella 0017 `logo-validation-errors`.
+ *     Pointing 16 distinct failures at one generic page would tell a reader nothing
+ *     they cannot already see on the row. `invalid-svg-missing-title` is the exception:
+ *     it appears on cards whose only other SVG row is the 0017 summary, so without it
+ *     an all-SVG failure card can have no link at all.
+ *   - `logoErrors.logo-extract-error` — the website collapses 0034/0035/0036/0037
+ *     (timeout, host unresolved, connection failed, TLS handshake failed) all onto it,
+ *     and each of those has its own distinct page, so it cannot name one.
+ *   - `pemErrors.cert-not-found` — lossy: the website maps 0002+0007 onto it, and
+ *     0034–0037 land there too.
+ */
+const BIMI_TRANSLATION_KEY_TO_CODE = Object.freeze(Object.assign(Object.create(null), {
+  // bimiRecordStatus switch rows
+  'card.bimi.record-missing_md': 'DNS-BIMI-0008',
+  // no-record
+  'card.bimi.record-invalid_md': 'DNS-BIMI-0009',
+  // invalid-record
+  'card.bimi.record-no-cert_md': 'DNS-BIMI-0007',
+  // failed-to-fetch-authority-certificate
+  // The row's own "[here]" help link is stripped by the adapter, so the glossary page
+  // is the single destination rather than competing with it.
+  'card.bimi.cert-forbidden_md': 'DNS-BIMI-0012',
+  // certificate-can-t-be-accessed-automatically
+  'card.bimi.could-not-fetch_md': 'DNS-BIMI-0005',
+  // failed-to-fetch-logo
+  // Per-error recordValidationErrors rows
+  'card.bimi.errors.bimi-error-missing-l': 'DNS-BIMI-0004',
+  // missing-l-tag
+  'card.bimi.errors.bimi-error-missing-a': 'DNS-BIMI-0002',
+  // no-vmc-in-record
+  'card.bimi.errors.bimi-error-missing-v': 'DNS-BIMI-0006',
+  // no-version-in-record
+  'card.bimi.errors.bimi-error-invalid-l': 'DNS-BIMI-0001',
+  // logo-url-scheme-is-not-https…
+  'card.bimi.errors.bimi-error-invalid-a': 'DNS-BIMI-0016',
+  // authority-url-scheme-is-not-https
+  'card.bimi.errors.bimi-error-cert-not-valid': 'DNS-BIMI-0014',
+  // certificate-not-valid-for-the-domain
+  'card.bimi.errors.bimi-error-incorrect-v': 'DNS-BIMI-0006',
+  // no-version-in-record — v= present but wrong
+  // No page describes an unspecified error, but the row only ever appears under record
+  // validation, and 0015 is that section's umbrella page — better than nothing for a
+  // reader who cannot otherwise tell what to do next.
+  'card.bimi.errors.bimi-error-unknown': 'DNS-BIMI-0015',
+  // bimi-record-validation-errors
+  // Safe SVG section
+  'card.bimi.svg-missing-title_md': 'DNS-BIMI-0004',
+  // missing-l-tag — no logo published on the record
+  'card.bimi.record-svg-added-from-itag-invalid_md': 'DNS-BIMI-0017',
+  // logo-validation-errors
+  // VMC/CMC certificate rows
+  'card.bimi.vmc-invalid-title_md': 'DNS-BIMI-0011',
+  // vmc-validation-errors
+  'card.bimi.vmc-not-vmc-title_md': 'DNS-BIMI-0011',
+  // vmc-validation-errors — not a VMC/CMC at all
+  'card.bimi.vmc.cert-ambiguous-leaf_md': 'DNS-BIMI-0033',
+  // vmc-leaf-certificate-selection-is-ambiguous
+  'card.bimi.logoErrors.invalid-svg-missing-title_md': 'DNS-BIMI-0017',
+  // logo-validation-errors
+  // signal-logic's catch-all for an svgErrors string it has no translation for. Those
+  // strings are raw fetch/parse failures ("can't fetch SVG from ...: http status not
+  // OK"), which IPForensics tags extractError = DNS-BIMI-0005, so failed-to-fetch-logo
+  // is the page. Without this the row renders with no link at all, since the fallback
+  // branch attaches neither a code nor a per-error key.
+  'card.bimi.svg-error-fallback_md': 'DNS-BIMI-0005',
+  // failed-to-fetch-logo
+  // IPForensics tags the l=/certificate logo mismatch 'DNS-BIMI-0000-MISMATCH', which is
+  // not a schema code and matches no page, so the code on the item cannot resolve.
+  // The umbrella 0017 page covers this class, and the sibling "image with errors" row
+  // on the same card already points there.
+  'card.bimi.logoErrors.logo-and-evidence-mismatch_md': 'DNS-BIMI-0017',
+  // logo-validation-errors
+  // VMC/PEM error rows that map 1:1
+  'card.bimi.pemErrors.cert-not-https_md': 'DNS-BIMI-0016',
+  // authority-url-scheme-is-not-https
+  'card.bimi.pemErrors.cert-forbidden_md': 'DNS-BIMI-0012',
+  // certificate-can-t-be-accessed-automatically
+  // Matches the `bimi-error-cert-not-valid` row, which resolves to the same page.
+  // Leaving this unlinked made identical "Certificate is not valid" text linked under
+  // BIMI record status but not under VMC/CMC Certificate on the same card.
+  'card.bimi.pemErrors.cert-not-valid_md': 'DNS-BIMI-0014',
+  // certificate-not-valid-for-the-domain
+  'card.bimi.pemErrors.cert-bad-signature_md': 'DNS-BIMI-0028' // vmc-certificate-chain-signature-verification-failed
+}));
+
+/**
+ * Resolve the BIMI schema code for a signal-logic translation key, for rows that
+ * signal-logic derives from status alone and therefore emits without a `code`.
+ *
+ * @returns The schema code, or `undefined` when the key maps to no single code.
+ */
+function resolveBimiCodeForTranslationKey(key) {
+  if (!key) return undefined;
+  // Same own-property guard as resolveBimiGlossaryHref: translation keys are literals
+  // today, but this must not become the weak link if that ever changes.
+  if (!Object.prototype.hasOwnProperty.call(BIMI_TRANSLATION_KEY_TO_CODE, key)) return undefined;
+  const code = BIMI_TRANSLATION_KEY_TO_CODE[key];
+  return typeof code === 'string' && code ? code : undefined;
+}
+
 // =============================================================================
 // BIMI TRANSLATION KEY → data-testid MAPPING
 // =============================================================================
+
 /**
  * Maps signal-logic BIMI translation keys to the data-testid values
  * that the old DS helpers used to set on checklist items.
@@ -7554,17 +7824,106 @@ function adaptExtractedItemCategory(cat) {
   };
 }
 
+/**
+ * Build the markdown for a row's "What does this mean?" glossary link (DS-113).
+ *
+ * Returns `undefined` when the row carries no code, or a code with no glossary page.
+ * The link is emitted as markdown so the existing `parseGlossaryMarkdown` path in
+ * Checklist renders it — that path already validates the protocol and applies
+ * `target="_blank" rel="noopener noreferrer"`, so this adds no new render surface.
+ *
+ * The reader never sees the raw code: `DNS-BIMI-0024` means nothing to them.
+ */
+function buildGlossaryLinkMarkdown(code, t) {
+  const href = resolveBimiGlossaryHref(code);
+  if (!href) return undefined;
+  return `[${t('card.bimi.glossary-link')}](${href})`;
+}
+
+/**
+ * Markdown links whose target is a "how to fix it" help article, in either of the two
+ * hosts signal-logic links to.
+ *
+ * Matches the whole markdown link plus any leading space, so removing it leaves no gap.
+ * The label is matched loosely (any text) but each href is pinned:
+ *   - a bare `community.redsift.com/s/article/<n>` — no `#fragment` branch, so a
+ *     glossary *term* link like `[BIMI Record](…/article/000001019#bimi-record)`, which
+ *     defines a term mid-sentence rather than offering a fix, is left intact.
+ *   - a `knowledge.ondmarc.redsift.com/en/articles/<slug>` — the "[here]" link on the
+ *     anti-bot row.
+ */
+const HELP_ARTICLE_LINK = /\s*\[[^\]]*\]\((?:https:\/\/community\.redsift\.com\/s\/article\/\d+|https:\/\/knowledge\.ondmarc\.redsift\.com\/en\/articles\/[^)]+)\)/g;
+
+/**
+ * A trailing clause left behind once a help-article link is removed.
+ *
+ * Deliberately **locale-agnostic**: it cuts everything after the last sentence-ending
+ * punctuation rather than matching known lead-in wording. Listing English phrases
+ * would leave every other locale broken — `fr-FR` renders the anti-bot row as
+ * "…anti-bot. En savoir plus et comment résoudre le problème [ici](…)", so an
+ * English-only pattern strips the link and leaves the French clause dangling in front
+ * of the glossary link.
+ *
+ * Requires a preceding sentence to keep: a row that is *only* a lead-in has nothing
+ * to fall back to, so the guard in `stripHelpArticleLink` leaves it alone.
+ */
+const TRAILING_CLAUSE = /([.!?](?:\*{1,2}|_{1,2}|`)?)[^.!?]*$/;
+
+/**
+ * Drop a row's help-article link when a glossary link replaces it.
+ *
+ * Both answer the same question, and the glossary page is the canonical explainer —
+ * it covers what the error means *and* how to fix it — so showing both leaves the
+ * reader choosing between two competing links on one line.
+ *
+ * A clause left stranded by the removal goes with it, in any locale. When the row has
+ * no earlier sentence to fall back on, the text is left as-is minus the link rather
+ * than risk emptying the row.
+ */
+function stripHelpArticleLink(text) {
+  const withoutLink = text.replace(HELP_ARTICLE_LINK, '');
+  if (withoutLink === text) return text;
+  const trimmedEnd = withoutLink.trimEnd();
+  // Nothing after the final sentence break means nothing dangled — keep as-is.
+  if (/[.!?]\s*$/.test(trimmedEnd)) return trimmedEnd;
+  const cut = trimmedEnd.replace(TRAILING_CLAUSE, '$1');
+  return cut === trimmedEnd ? trimmedEnd : cut;
+}
+
 /**
  * Convert an InfoItem (DisplayValue text) → ChecklistItem-compatible shape.
+ *
+ * When the item carries a `code` (a `checker_codes` schema id forwarded by
+ * signal-logic under WEB-1239) and that code has a glossary page, a
+ * "What does this mean?" link is appended to the end of the row's own text, so it
+ * reads inline rather than as a stacked second line — a card listing several
+ * validation errors would otherwise double in height.
+ *
+ * The link can only be appended inline when the row text is a plain string. A
+ * StructuredData row (charts, status lists, code blocks) has no meaningful "end of
+ * the line" to append to, so those fall back to a subtext beneath the row.
+ *
+ * Where the row already carried a help-article link ("Learn how to fix it", or the
+ * anti-bot row's "[here]"), that link is removed: the glossary page supersedes it, and
+ * two links answering the same question on one line makes the reader choose between
+ * them.
  */
-function adaptInfoItem(item, testId) {
+function adaptInfoItem(item, testId, t, fallbackCode) {
+  var _item$code;
+  const existing = item.subtexts ? item.subtexts.map(s => ({
+    text: renderDisplayValue(s.text)
+  })) : undefined;
+  // A code carried on the item always wins; the fallback only fills in for rows
+  // signal-logic derives from status alone (DS-113).
+  const link = t ? buildGlossaryLinkMarkdown((_item$code = item.code) !== null && _item$code !== void 0 ? _item$code : fallbackCode, t) : undefined;
+  const inlineable = link !== undefined && typeof item.text === 'string';
   return _objectSpread2({
     type: item.type,
     theme: item.theme,
-    text: renderDisplayValue(item.text),
-    subtexts: item.subtexts ? item.subtexts.map(s => ({
-      text: renderDisplayValue(s.text)
-    })) : undefined
+    text: renderDisplayValue(inlineable ? `${stripHelpArticleLink(item.text)} ${link}` : item.text),
+    subtexts: link !== undefined && !inlineable ? [...(existing !== null && existing !== void 0 ? existing : []), {
+      text: renderDisplayValue(link)
+    }] : existing
   }, testId ? {
     'data-testid': testId
   } : undefined);
@@ -7734,12 +8093,14 @@ function adaptBimiExtractor() {
   const [props, t, context] = args;
 
   // Wrap t to track which translation keys map to which returned strings.
-  // This lets us stamp data-testid on items by matching the translated text back to its key.
+  // This lets us stamp data-testid on items by matching the translated text back to its key,
+  // and (DS-113) recover the BIMI schema code for status-derived rows that signal-logic
+  // emits without an `InfoItem.code`.
   const translatedValueToKey = new Map();
   const trackingT = (key, params) => {
     const value = t(key, params);
-    // Only track keys that have a known testId mapping
-    if (BIMI_KEY_TO_TESTID[key]) {
+    // Track keys that carry a testId mapping or a glossary code
+    if (BIMI_KEY_TO_TESTID[key] || resolveBimiCodeForTranslationKey(key)) {
       translatedValueToKey.set(value, key);
     }
     return value;
@@ -7780,11 +8141,49 @@ function adaptBimiExtractor() {
     }
     return undefined;
   };
+
+  // Recover the schema code for a status-derived row (DS-113). signal-logic attaches
+  // `code` only to rows built from a coded error; the `bimiRecordStatus`, validation
+  // error, Safe SVG and VMC-title rows carry none, so fall back to the translation key
+  // that produced the text.
+  //
+  // Mirrors resolveTestId's reverse CMC→VMC pass: signal-logic post-processes several
+  // of these strings with localizeAssertionMarkdown() after t() returns, so the text on
+  // the item no longer matches what the tracking wrapper recorded.
+  const resolveFallbackCode = text => {
+    const direct = resolveBimiCodeForTranslationKey(translatedValueToKey.get(text));
+    if (direct) return direct;
+    const vmcText = text.replace(/CMC/g, 'VMC');
+    if (vmcText !== text) {
+      const viaVmc = resolveBimiCodeForTranslationKey(translatedValueToKey.get(vmcText));
+      if (viaVmc) return viaVmc;
+    }
+    return undefined;
+  };
+
+  // A row whose message contains a URL is not a string: signal-logic runs it through
+  // formatMessageWithUrls(), which returns FormattedText StructuredData with the text
+  // split into segments. Flatten those segments back to a plain string so the key
+  // lookups above can see rows like the svgErrors fallback ("can't fetch SVG from
+  // <url>: http status not OK"), which would otherwise never resolve a code.
+  const plainText = value => {
+    if (typeof value === 'string') return value;
+    if (!value || typeof value !== 'object') return undefined;
+    const segments = value.segments;
+    if (!Array.isArray(segments)) return undefined;
+    const joined = segments.map(s => {
+      var _s$text;
+      return (_s$text = s === null || s === void 0 ? void 0 : s.text) !== null && _s$text !== void 0 ? _s$text : '';
+    }).join('');
+    return joined || undefined;
+  };
   const adaptWithTestIds = categories => categories === null || categories === void 0 ? void 0 : categories.map(cat => ({
     title: cat.title,
     items: cat.items.map(item => {
-      const testId = typeof item.text === 'string' ? resolveTestId(item.text) : undefined;
-      return adaptInfoItem(item, testId);
+      const text = plainText(item.text);
+      const testId = text !== undefined ? resolveTestId(text) : undefined;
+      const fallbackCode = text !== undefined ? resolveFallbackCode(text) : undefined;
+      return adaptInfoItem(item, testId, t, fallbackCode);
     })
   }));
   return {
@@ -8668,20 +9067,43 @@ const buildPublishedCertificateSections = (cert, pem, t, now, assertionMarkType)
 
   // --- Verification issues ---
   // Sourced from PEM evidence errors plus an ambiguous leaf-selection signal.
-  const errorMessages = ((_pem$errors = pem === null || pem === void 0 ? void 0 : pem.errors) !== null && _pem$errors !== void 0 ? _pem$errors : []).map(e => typeof e === 'string' ? e : e === null || e === void 0 ? void 0 : e.message).filter(m => !!m);
+  //
+  // These rows are built here rather than in the extractor adapter, so the adapter's
+  // glossary-link pass (DS-113) does not reach them. Append the link locally, keyed on
+  // the same code the adapter uses, so a verification issue is explained exactly as the
+  // equivalent row in the legacy VMC section is.
+  const withGlossaryLink = (text, code) => {
+    const href = resolveBimiGlossaryHref(code);
+    return href ? `${text} [${t('card.bimi.glossary-link')}](${href})` : text;
+  };
+
+  // pem.errors entries carry a code alongside the message (IPForensics BimiError);
+  // keep it so the row can resolve its page rather than dropping to message-only.
+  const errorEntries = ((_pem$errors = pem === null || pem === void 0 ? void 0 : pem.errors) !== null && _pem$errors !== void 0 ? _pem$errors : []).map(e => typeof e === 'string' ? {
+    message: e,
+    code: undefined
+  } : {
+    message: e === null || e === void 0 ? void 0 : e.message,
+    code: e === null || e === void 0 ? void 0 : e.code
+  }).filter(e => !!e.message);
   const isAmbiguous = (pem === null || pem === void 0 ? void 0 : pem.leafSelectionMethod) === 'AMBIGUOUS';
   const issueItems = [];
   if (isAmbiguous) {
+    const key = 'card.bimi.vmc.cert-ambiguous-leaf_md';
     issueItems.push({
       type: 'warning',
-      text: t('card.bimi.vmc.cert-ambiguous-leaf_md'),
+      text: withGlossaryLink(t(key), resolveBimiCodeForTranslationKey(key)),
       'data-testid': 'bimi-cert-issue-ambiguous'
     });
   }
-  errorMessages.forEach((message, idx) => {
+  errorEntries.forEach((_ref2, idx) => {
+    let {
+      message,
+      code
+    } = _ref2;
     issueItems.push({
       type: 'warning',
-      text: message,
+      text: withGlossaryLink(message, code),
       'data-testid': `bimi-cert-issue-${idx}`
     });
   });