<?xml version="1.0"?>
<ruleset name="Quick Event Manager">
	<description>Coding standards for the Quick Event Manager plugin.</description>

	<!-- Scan the plugin by default. -->
	<file>.</file>

	<!-- Third-party code and build artifacts are not ours to lint. -->
	<exclude-pattern>/vendor/*</exclude-pattern>
	<exclude-pattern>*.js</exclude-pattern>
	<exclude-pattern>*.css</exclude-pattern>

	<!-- Treat the whole WordPress ruleset as the baseline. -->
	<rule ref="WordPress"/>

	<!--
		qem_wp_kses_post() and qem_kses_post_svg_form() are thin wrappers around
		wp_kses_post() / wp_kses(). Output passed through them IS escaped, so the
		sniffer should recognise them as escaping functions rather than flagging
		every call site as "OutputNotEscaped".
	-->
	<rule ref="WordPress.Security.EscapeOutput">
		<properties>
			<property name="customEscapingFunctions" type="array">
				<element value="qem_wp_kses_post"/>
				<element value="qem_kses_post_svg_form"/>
			</property>
		</properties>
	</rule>

	<!-- Declare the plugin text domain so i18n sniffs validate against it. -->
	<rule ref="WordPress.WP.I18n">
		<properties>
			<property name="text_domain" type="array">
				<element value="quick-event-manager"/>
			</property>
		</properties>
	</rule>
</ruleset>
