@certrev/cert-block 0.1.2 → 0.2.0

package/src/builder/__tests__/builder.test.tsx

@@ -1,81 +1,68 @@
 /**
- * SSR-render tests for the Builder.io adapter (`@certrev/cert-block/builder`), exercised
- * through `react-dom/server`'s `renderToStaticMarkup` — the same path Hydrogen/Next use to
- * produce crawlable HTML on the edge. These prove the adapter's load-bearing contract:
+ * SSR-render tests for the Builder.io adapter (`@certrev/cert-block/builder`), the panel-validated
+ * "ambient-URL anchor" model — exercised through `renderToStaticMarkup` (the edge SSR path).
  *
- *   • a render-verdict placement renders the in-DOM cert badge (crawlable);
- *   • EVERY non-render path — suppress verdict, unknown placement, missing placementId —
- *     renders NOTHING (fail-closed survives the CMS boundary);
- *   • when one Content tree mixes a valid + a revoked placement (the /builder-cert proof
- *     shape), only the valid one renders.
- *
- * Authority comes solely from the loader-supplied verdict in <CertVerifyProvider>; the
- * `placementId` is an opaque pointer the CMS cannot use to manufacture a badge.
+ * Contract proved here:
+ *   • the anchor renders the CURRENT page's verified badge — and badge ONLY (JSON-LD is emitted
+ *     server-side, decoupled from the visual slot);
+ *   • EVERY non-render path (suppress verdict, no credential for the page) renders nothing in
+ *     production (fail-closed);
+ *   • in the Builder editor (`isEditing`) with no live credential, a truthful placeholder shows —
+ *     never a fake badge, and never any JSON-LD;
+ *   • the registration is ZERO-input: the editor cannot choose or forge which credential renders.
  */
 import { renderToStaticMarkup } from 'react-dom/server'
 import { describe, expect, it } from 'vitest'
 import { makeMockPayload } from '../../contract/fixtures.js'
 import type { CertVerdict } from '../../contract/kernel.js'
-import { CertReviewBlock, CertVerifyProvider, certReviewBuilderComponent, type VerifiedPlacements } from '../index.js'
+import { CertRevAnchor, CertRevProvider, certRevAnchorComponent, type CurrentCredential } from '../index.js'
 
 const renderVerdict: CertVerdict = { decision: 'render', payload: makeMockPayload() }
 const suppressVerdict: CertVerdict = { decision: 'suppress', reason: 'revoked' }
 
-function renderBlock(placements: VerifiedPlacements, placementId?: string): string {
+function render(current: CurrentCredential | null, isEditing = false): string {
 	return renderToStaticMarkup(
-		<CertVerifyProvider value={placements}>
-			<CertReviewBlock placementId={placementId} />
-		</CertVerifyProvider>,
+		<CertRevProvider current={current} isEditing={isEditing}>
+			<CertRevAnchor />
+		</CertRevProvider>,
 	)
 }
 
-describe('Builder adapter — registration', () => {
-	it('registers as "CertREV Review" with a single required string `placementId` input', () => {
-		expect(certReviewBuilderComponent.name).toBe('CertREV Review')
-		expect(certReviewBuilderComponent.component).toBe(CertReviewBlock)
-		const input = certReviewBuilderComponent.inputs?.find((i) => i.name === 'placementId')
-		expect(input).toBeDefined()
-		expect(input?.required).toBe(true)
-		expect(input?.type).toBe('string')
+describe('Builder adapter — registration (zero-input anchor)', () => {
+	it('registers "CertREV Review" with NO inputs (editor places it; system resolves the credential)', () => {
+		expect(certRevAnchorComponent.name).toBe('CertREV Review')
+		expect(certRevAnchorComponent.component).toBe(CertRevAnchor)
+		expect(certRevAnchorComponent.inputs).toEqual([])
 	})
 })
 
-describe('Builder adapter — CertReviewBlock render', () => {
-	it('renders the verified badge for a render-verdict placement (in-DOM, crawlable)', () => {
-		const html = renderBlock({ 'p-valid': { verdict: renderVerdict, pageUrl: 'https://brand.example.com/a' } }, 'p-valid')
+describe('Builder adapter — CertRevAnchor render', () => {
+	it('renders the current page’s verified badge — and ONLY the badge (no JSON-LD; that is server-side)', () => {
+		const html = render({ verdict: renderVerdict, pageUrl: 'https://brand.example.com/a' })
 		expect(html).toContain('certrev-badge')
 		expect(html).toContain('Dr. Jane Doe')
-		expect(html).toContain('data-certrev-cert-id="cert_fixture_001"')
+		expect(html).not.toContain('application/ld+json') // JSON-LD decoupled to the article template
 	})
 
-	it('FAIL-CLOSED: a suppress-verdict placement renders nothing', () => {
-		expect(renderBlock({ 'p-revoked': { verdict: suppressVerdict } }, 'p-revoked')).toBe('')
+	it('FAIL-CLOSED: a suppress verdict renders nothing', () => {
+		expect(render({ verdict: suppressVerdict })).toBe('')
 	})
 
-	it('FAIL-CLOSED: an unknown placementId renders nothing', () => {
-		expect(renderBlock({ 'p-valid': { verdict: renderVerdict } }, 'p-not-here')).toBe('')
+	it('FAIL-CLOSED: no credential for this page renders nothing in production', () => {
+		expect(render(null, false)).toBe('')
 	})
 
-	it('FAIL-CLOSED: a missing placementId renders nothing', () => {
-		expect(renderBlock({ 'p-valid': { verdict: renderVerdict } }, undefined)).toBe('')
+	it('EDITOR: no live credential + isEditing renders a truthful placeholder (no badge, no JSON-LD)', () => {
+		const html = render(null, true)
+		expect(html).toContain('data-certrev-editor-placeholder')
+		expect(html).toContain('resolves at publish')
+		expect(html).not.toContain('certrev-badge')
+		expect(html).not.toContain('application/ld+json')
 	})
 
-	it('mixed content (valid + revoked in one Content tree): only the valid placement renders', () => {
-		const placements: VerifiedPlacements = {
-			'p-valid': { verdict: renderVerdict, pageUrl: 'https://brand.example.com/a' },
-			'p-revoked': { verdict: suppressVerdict },
-		}
-		const html = renderToStaticMarkup(
-			<CertVerifyProvider value={placements}>
-				<div id="valid-block">
-					<CertReviewBlock placementId="p-valid" />
-				</div>
-				<div id="revoked-block">
-					<CertReviewBlock placementId="p-revoked" />
-				</div>
-			</CertVerifyProvider>,
-		)
-		expect(html).toContain('certrev-badge') // valid rendered
-		expect(html).toContain('<div id="revoked-block"></div>') // revoked empty — fail-closed through the CMS
+	it('EDITOR: a live verified credential renders the REAL badge even in editing mode (true draft-verify)', () => {
+		const html = render({ verdict: renderVerdict }, true)
+		expect(html).toContain('certrev-badge')
+		expect(html).not.toContain('data-certrev-editor-placeholder')
 	})
 })

package/src/builder/index.tsx

@@ -1,100 +1,122 @@
 /**
- * @certrev/cert-block/builder — the Builder.io adapter for the cert-block render edge.
+ * @certrev/cert-block/builder — Builder.io adapter, "ambient-URL anchor" model.
  *
- * Lets a Builder.io content editor place a "CertREV Review" block into a page; the
- * headless app's loader (Hydrogen/Next/Remix) crypto-verifies that placement's signed
- * envelope and supplies the verdict via React context; this block renders cert-block's
- * <CertReview> from the VERIFIED verdict — and renders NOTHING (fail-closed) on any
- * suppress or unknown placement.
+ * Validated by an independent architecture panel (Codex gpt-5.5 + Gemini, blind): a visual
+ * page builder must NOT choose WHICH credential renders — that invites cross-article misuse and
+ * re-opens the wrong-subject surface. Instead:
+ *   • the CMS controls LAYOUT — an editor drags a ZERO-INPUT <CertRevAnchor/> to position the
+ *     badge on the page;
+ *   • the SYSTEM controls TRUTH — the headless loader resolves THIS page's credential from its
+ *     own URL (Track-1 delivery), crypto-verifies it (fail-closed VerdictKernel), and supplies
+ *     the verdict via context.
+ * The anchor renders the current page's verified badge or NOTHING. It cannot be pointed at
+ * another article, and there is no `placementId` input to forge or mis-select.
  *
- * THE TRUST BOUNDARY: the credential is never trusted from CMS content. A Builder block
- * only carries an opaque `placementId` pointer; the authority comes solely from the
- * loader-side WebCrypto verdict supplied through <CertVerifyProvider>. So a revoked /
- * tampered / expired / wrong-subject placement that an editor drops into Builder renders
- * nothing, even though the block is present in the published content.
+ * JSON-LD is DECOUPLED (panel finding): the anchor renders the BADGE only (`omitJsonLd`). The
+ * article template emits the schema.org JSON-LD server-side from the same verified verdict, so a
+ * page builder can't duplicate, move, or omit structured data. (See the route example.)
  *
- * cert-block carries NO dependency on `@builder.io/sdk-react` — the registration's shape is
- * declared structurally below, so the emitted JS pulls no Builder code and the type resolves
- * without Builder installed. The consumer (who already has Builder) passes
- * `certReviewBuilderComponent` to Builder's `<Content customComponents={[...]}>`; it is
- * assignable to Builder's `RegisteredComponent` there.
+ * EDGE-CACHE DISCIPLINE (panel finding): the consumer's loader MUST verify per request as a
+ * dynamic edge subrequest and must NOT long-cache the rendered badge HTML — a revoked/expired
+ * credential sitting in a stale edge cache would defeat fail-closed. Bound any positive-verdict
+ * cache by min(expiry, revocation-TTL, content-version).
+ *
+ * cert-block carries no Builder dependency: the registration shape is declared structurally, and
+ * `isEditing` is a passed-in flag (the consumer supplies Builder's `isPreviewing()`).
  */
 import { createContext, type ReactNode, useContext } from 'react'
 import { CertReview } from '../components/CertReview.js'
 import type { CertVerdict } from '../contract/kernel.js'
 
-/** A loader-verified placement: the verdict cert-block renders from, plus the canonical
- *  page URL for JSON-LD @id alignment. */
-export interface VerifiedPlacement {
+/** The current page's credential, resolved + verified by the loader (Track-1 delivery). */
+export interface CurrentCredential {
 	readonly verdict: CertVerdict
+	/** Canonical page URL for JSON-LD @id alignment (used by the server-side JSON-LD, not the anchor). */
 	readonly pageUrl?: string
 }
 
-/** Map of `placementId` → the loader's verified result. Built server-side in the loader
- *  (it crypto-verifies each placement) and handed to <CertVerifyProvider>. */
-export type VerifiedPlacements = Record<string, VerifiedPlacement>
+interface CertRevContextValue {
+	readonly current: CurrentCredential | null
+	readonly isEditing: boolean
+}
 
-const CertVerifyContext = createContext<VerifiedPlacements>({})
+const CertRevContext = createContext<CertRevContextValue>({ current: null, isEditing: false })
 
-/** Wraps Builder's <Content>; carries the loader's verified verdicts down to every
- *  CertReview block, keyed by `placementId`. */
-export function CertVerifyProvider({
-	value,
+/**
+ * Supplies THIS page's loader-verified credential to the anchor. `current` is the verdict for
+ * the current page (or null if the page has no delivered credential). `isEditing` is the
+ * consumer's Builder `isPreviewing()` result — it ONLY toggles a design-time placeholder and
+ * NEVER affects the published render.
+ */
+export function CertRevProvider({
+	current,
+	isEditing = false,
 	children,
 }: {
-	readonly value: VerifiedPlacements
+	readonly current: CurrentCredential | null
+	readonly isEditing?: boolean
 	readonly children: ReactNode
 }) {
-	return <CertVerifyContext.Provider value={value}>{children}</CertVerifyContext.Provider>
+	return <CertRevContext.Provider value={{ current, isEditing }}>{children}</CertRevContext.Provider>
 }
 
-export interface CertReviewBlockProps {
-	/** The CertREV placement id the editor set on this Builder block. */
-	readonly placementId?: string
+/**
+ * Design-time placeholder shown ONLY in the Builder editor when the current page has no live
+ * verified credential. Truthful (never a fake badge), emits NO JSON-LD, and never renders in
+ * production — so it cannot leak to or be crawled on the live site.
+ */
+export function CertRevEditorPlaceholder() {
+	return (
+		<div
+			data-certrev-editor-placeholder=""
+			style={{
+				border: '1px dashed #e6007e',
+				borderRadius: 8,
+				padding: '10px 14px',
+				font: '13px system-ui',
+				color: '#6b7280',
+				background: '#fff5fa',
+			}}
+		>
+			CertREV Review — <b>resolves at publish</b> from issuer verification. The expert badge appears here once this
+			page’s article is certified, and only while the credential is valid.
+		</div>
+	)
 }
 
 /**
- * The component Builder renders for a "CertREV Review" block. It pulls the loader-verified
- * verdict for its `placementId` from context and renders <CertReview>. Unknown placement
- * OR a non-`render` verdict → renders nothing. cert-block's <CertReview> ALSO suppresses on
- * a non-render verdict, so the boundary fails closed twice over (defense in depth).
+ * The Builder block. ZERO inputs — a layout anchor only. Renders the current page's VERIFIED
+ * badge (badge only; JSON-LD is emitted server-side), the editor placeholder in design mode, or
+ * NOTHING in production (fail-closed). The credential is whatever Track-1 delivered + verified for
+ * THIS page; the editor can neither choose nor forge it.
  */
-export function CertReviewBlock({ placementId }: CertReviewBlockProps) {
-	const placements = useContext(CertVerifyContext)
-	const placement = placementId ? placements[placementId] : undefined
-	if (!placement) return null
-	return <CertReview verdict={placement.verdict} pageUrl={placement.pageUrl} />
+export function CertRevAnchor() {
+	const { current, isEditing } = useContext(CertRevContext)
+	if (current && current.verdict.decision === 'render') {
+		return <CertReview verdict={current.verdict} pageUrl={current.pageUrl} omitJsonLd />
+	}
+	if (isEditing) return <CertRevEditorPlaceholder />
+	return null
 }
 
 /**
- * Structural shape of `@builder.io/sdk-react`'s `RegisteredComponent` — exactly the subset
- * cert-block populates. Declared locally (not imported) so cert-block needs no Builder
- * build- or runtime-dependency; the object below is assignable to Builder's
- * `RegisteredComponent` at the consumer's `<Content customComponents={[...]}>` call site.
+ * Structural shape of `@builder.io/sdk-react`'s `RegisteredComponent` — the subset cert-block
+ * populates. Declared locally so cert-block needs no Builder build/runtime dependency; assignable
+ * to Builder's `RegisteredComponent` at the consumer's `<Content customComponents={[...]}>`.
  */
-export interface CertReviewBuilderRegistration {
-	component: typeof CertReviewBlock
+export interface CertRevBuilderRegistration {
+	component: typeof CertRevAnchor
 	name: string
-	inputs: Array<{ name: string; type: 'string'; required?: boolean; helperText?: string }>
+	inputs: never[]
 }
 
 /**
- * The registration object to pass to Builder's `<Content customComponents={[...]}>`.
- * Editors see a "CertREV Review" component with one input — the placement id. Because the
- * block is matched by NAME at render time, this also works for content created via the
- * Builder Write API (no visual-editor registration required for rendering).
+ * The registration to pass to Builder's `<Content customComponents={[...]}>`. ZERO inputs by
+ * design — the editor places it (layout); the system resolves the credential from the page URL
+ * (truth). Matched by NAME at render, so Write-API content works without visual-editor setup.
  */
-export const certReviewBuilderComponent: CertReviewBuilderRegistration = {
-	component: CertReviewBlock,
+export const certRevAnchorComponent: CertRevBuilderRegistration = {
+	component: CertRevAnchor,
 	name: 'CertREV Review',
-	inputs: [
-		{
-			name: 'placementId',
-			type: 'string',
-			required: true,
-			helperText:
-				'CertREV placement id (which certified article this badge attests). The headless ' +
-				'loader verifies that placement’s signed envelope; only a render-verdict shows a badge.',
-		},
-	],
+	inputs: [],
 }

package/src/components/CertBadge.tsx

@@ -11,23 +11,44 @@
  * an inline custom property (no color-only meaning — the credential text carries it), an
  * expert photo with meaningful alt text, and a verify link with a descriptive label.
  *
- * `badgeStyle: 'compact'` collapses to a single line (name + credentials + verify link);
- * `'full'` shows the photo, certified/updated dates, and the memo (per display flags).
+ * `badgeStyle: 'compact'` collapses the reviewer block to a single line (name + credentials);
+ * `'full'` shows the photo, certified/updated dates, and the memo (per display flags). BOTH
+ * styles carry the compensation cue + FTC scope line (the always-on compliance disclosures).
+ *
+ * THEMING (WS6): presentation defaults come from `payload.content.display`; an optional
+ * `renderDef` prop layers a brand's validated themeable tokens (emitted as `--certrev-*`
+ * CSS custom properties) and its subtractive field-visibility on top. No `renderDef` → the
+ * CertREV preset default (theme output byte-identical to un-themed).
  */
 
 import type { CertContent, CertPayload } from '../contract/kernel.js'
 import { safeHttpUrl } from './escape.js'
 import { credentialSuffix, expertNameWithCredentials, formatDate, resolveDisplay } from './format.js'
+import {
+	CERT_SCOPE_LINE,
+	CERT_STRINGS_VERSION,
+	type CertRenderDef,
+	resolveRenderTheme,
+	themeCssVarDeclarations,
+} from './render-def.js'
 
 export interface CertBadgeProps {
 	/** The cryptographically-verified payload (from `getVerifiedEnvelope`). */
 	readonly payload: CertPayload
-	/** Optional accent override (else `display.accentColor`, else CertREV default). */
+	/** Optional accent override (else render-def, else `display.accentColor`, else CertREV default). */
 	readonly accentColor?: string
 	/** Extra class names appended to the root element's class list. */
 	readonly className?: string
 	/** Override the badge style independent of the signed display config. */
 	readonly badgeStyle?: 'full' | 'compact'
+	/**
+	 * The brand render-def (WS6). ABSENT → the badge renders the CertREV preset
+	 * default (fail-safe; theme output byte-identical to un-themed). PRESENT → its
+	 * validated themeable tokens are emitted as `--certrev-*` CSS custom properties
+	 * and its subtractive hide-set removes brand-toggleable fields. Invalid tokens
+	 * are dropped (defense-in-depth over the write-path gate).
+	 */
+	readonly renderDef?: CertRenderDef
 }
 
 const ROOT_CLASS = 'certrev-badge'
@@ -70,7 +91,8 @@ function ExpertPhoto({ content, show }: { content: CertContent; show: boolean })
 export function CertBadge(props: CertBadgeProps) {
 	const { payload } = props
 	const content = payload.content
-	const display = resolveDisplay(content.display, props.accentColor)
+	const display = resolveDisplay(content.display, props.accentColor, props.renderDef)
+	const theme = resolveRenderTheme(props.renderDef)
 	const style = props.badgeStyle ?? display.badgeStyle
 	const verifyUrl = safeHttpUrl(content.verifyUrl)
 	const profileUrl = safeHttpUrl(content.expert.profileUrl)
@@ -82,10 +104,13 @@ export function CertBadge(props: CertBadgeProps) {
 	const rootClass = `${ROOT_CLASS} ${ROOT_CLASS}--${style}${props.className ? ` ${props.className}` : ''}`
 	// Accent is exposed as a custom property so brand themes can read it, and applied
 	// directly to the accent border so the component is self-styling without a stylesheet.
+	// A THEMED brand additionally emits the surface/radius/font vars; with no render-def
+	// `themeCssVarDeclarations` is empty, so the un-themed style is byte-identical.
 	const rootStyle: Record<string, string> = {
 		['--certrev-accent']: accent,
 		borderInlineStartColor: accent,
 	}
+	for (const [name, value] of themeCssVarDeclarations(theme)) rootStyle[name] = value
 
 	const expertName = (
 		<span className={`${ROOT_CLASS}__expert-name`}>
@@ -99,6 +124,8 @@ export function CertBadge(props: CertBadgeProps) {
 			className={rootClass}
 			style={rootStyle}
 			data-certrev-cert-id={payload.certId}
+			data-certrev-strings-version={CERT_STRINGS_VERSION}
+			data-certrev-def-version={theme.version}
 			aria-label={`Content reviewed by ${expertNameWithCredentials(content)}`}
 		>
 			<div className={`${ROOT_CLASS}__header`}>
@@ -149,6 +176,31 @@ export function CertBadge(props: CertBadgeProps) {
 				</>
 			) : null}
 
+			{/* Design guide §3: the compensation cue + FTC scope line are LOCKED on every
+			    claim-bearing face (named / credentialed / memo) — with or without a memo —
+			    so a brand can never show an endorsement impression without its disclosures.
+			    cert-block only ever renders a claim face (it always carries the reviewer
+			    byline), so both lines render on both the full AND compact styles. This is
+			    the compliance BASELINE — it lands regardless of a render-def, matching the
+			    Shopify/WordPress engine fix. The cue's "expert" links to the reviewer's
+			    CertREV profile (the whole cue tag-strips to the byte-verbatim
+			    COMPENSATED_EXPERT_CUE). The scope line is byte-verbatim CERT_SCOPE_LINE. */}
+			<div className={`${ROOT_CLASS}__disclosure`}>
+				<span className={`${ROOT_CLASS}__compensated-cue`}>
+					Compensated{' '}
+					{profileUrl ? (
+						<a className={`${ROOT_CLASS}__cue-link`} href={profileUrl} rel="noopener">
+							expert
+						</a>
+					) : (
+						'expert'
+					)}
+				</span>
+				<p className={`${ROOT_CLASS}__ftc`} data-ftc-disclosure>
+					<span data-ftc-line>{CERT_SCOPE_LINE}</span>
+				</p>
+			</div>
+
 			{verifyUrl ? (
 				<a
 					className={`${ROOT_CLASS}__verify`}

package/src/components/CertReview.tsx

@@ -11,6 +11,7 @@
 import type { CertVerdict } from '../contract/kernel.js'
 import { CertBadge } from './CertBadge.js'
 import { CertJsonLd } from './CertJsonLd.js'
+import type { CertRenderDef } from './render-def.js'
 
 export interface CertReviewProps {
 	/** The verdict from `getVerifiedEnvelope` (or a direct kernel call). */
@@ -20,6 +21,12 @@ export interface CertReviewProps {
 	readonly accentColor?: string
 	readonly className?: string
 	readonly badgeStyle?: 'full' | 'compact'
+	/**
+	 * The brand render-def (WS6). Forwarded to `<CertBadge>` for themeable-token
+	 * emission + subtractive visibility; absent → the CertREV preset default. The
+	 * JSON-LD is presentation-blind, so the def never touches the structured data.
+	 */
+	readonly renderDef?: CertRenderDef
 	/** Omit the JSON-LD (e.g. the page already emits it elsewhere). Default false. */
 	readonly omitJsonLd?: boolean
 }
@@ -35,6 +42,7 @@ export function CertReview(props: CertReviewProps) {
 				accentColor={props.accentColor}
 				className={props.className}
 				badgeStyle={props.badgeStyle}
+				renderDef={props.renderDef}
 			/>
 			{props.omitJsonLd ? null : <CertJsonLd payload={payload} pageUrl={props.pageUrl} />}
 		</>

package/src/components/format.ts

@@ -4,6 +4,7 @@
  */
 
 import type { CertContent, CertDisplayConfig } from '../contract/kernel.js'
+import { type CertRenderDef, isFieldHidden, resolveRenderTheme } from './render-def.js'
 
 /** Default accent if the brand didn't pin one (CertREV teal). */
 export const DEFAULT_ACCENT = '#0f766e'
@@ -16,13 +17,29 @@ export interface ResolvedDisplay {
 	readonly badgeStyle: 'full' | 'compact'
 }
 
-/** Resolve the optional display config to concrete presentation flags + accent. */
-export function resolveDisplay(display: CertDisplayConfig | undefined, accentOverride?: string): ResolvedDisplay {
+/**
+ * Resolve the optional display config + optional brand render-def to concrete
+ * presentation flags + accent.
+ *
+ * Accent PRECEDENCE mirrors the Shopify Liquid engine exactly: an explicit
+ * `accentOverride` (a block/prop override) wins, then the render-def's validated
+ * accent (a THEMED brand), then the signed display's accent, else the CertREV
+ * default. Visibility is SUBTRACTIVE: the render-def's hide-set can only turn a
+ * preset-placed field OFF (never on) — a hidden `reviewerPhoto` / `memo` wins over
+ * a display flag that shows it. When no render-def is supplied the theme resolves
+ * empty, so accent + visibility are byte-identical to the pre-theming behavior.
+ */
+export function resolveDisplay(
+	display: CertDisplayConfig | undefined,
+	accentOverride?: string,
+	renderDef?: CertRenderDef,
+): ResolvedDisplay {
+	const theme = resolveRenderTheme(renderDef)
 	return {
-		accentColor: accentOverride ?? display?.accentColor ?? DEFAULT_ACCENT,
-		showExpertPhoto: display?.showExpertPhoto ?? true,
+		accentColor: accentOverride ?? theme.accent ?? display?.accentColor ?? DEFAULT_ACCENT,
+		showExpertPhoto: (display?.showExpertPhoto ?? true) && !isFieldHidden(renderDef, 'reviewerPhoto'),
 		showAuthor: display?.showAuthor ?? true,
-		showMemo: display?.showMemo ?? true,
+		showMemo: (display?.showMemo ?? true) && !isFieldHidden(renderDef, 'memo'),
 		badgeStyle: display?.badgeStyle ?? 'full',
 	}
 }