<?xml version="1.0"?>
<ruleset name="Brand Commerce">
	<description>WordPress and WooCommerce coding standards for the theme and the business plugin.</description>

	<file>wp-content/themes/brand-theme</file>
	<file>wp-content/plugins/brand-commerce</file>

	<exclude-pattern>*/node_modules/*</exclude-pattern>
	<exclude-pattern>*/vendor/*</exclude-pattern>
	<exclude-pattern>*/assets/dist/*</exclude-pattern>

	<arg name="extensions" value="php"/>
	<arg name="colors"/>
	<arg value="sp"/>
	<arg name="parallel" value="4"/>

	<config name="minimum_wp_version" value="6.5"/>
	<config name="testVersion" value="8.2-"/>

	<rule ref="WordPress-Extra">
		<!-- We use a PSR-style autoloader with class-{name}.php files. -->
		<exclude name="WordPress.Files.FileName.InvalidClassFileName"/>
	</rule>

	<rule ref="WordPress-Docs"/>
	<rule ref="WordPress.WP.I18n">
		<properties>
			<property name="text_domain" type="array">
				<element value="brand"/>
			</property>
		</properties>
	</rule>

	<rule ref="WordPress.NamingConventions.PrefixAllGlobals">
		<properties>
			<property name="prefixes" type="array">
				<element value="bc_"/>
				<element value="BC_"/>
			</property>
		</properties>
		<!-- bc_ / BC_ is the prefix locked in CLAUDE.md and the technical
		     architecture doc. It is deliberately short; do not flag it. -->
		<exclude name="WordPress.NamingConventions.PrefixAllGlobals.ShortPrefixPassed"/>
	</rule>

	<!-- WooCommerce sniffs, installed via composer -->
	<rule ref="WooCommerce-Core"/>

	<!-- Escaping and sanitisation are not negotiable on this project. -->
	<rule ref="WordPress.Security.EscapeOutput">
		<severity>10</severity>
	</rule>
	<rule ref="WordPress.Security.ValidatedSanitizedInput">
		<severity>10</severity>
	</rule>
	<rule ref="WordPress.Security.NonceVerification">
		<severity>10</severity>
	</rule>
	<rule ref="WordPress.DB.PreparedSQL">
		<severity>10</severity>
	</rule>
</ruleset>
