@certrev/cert-block 0.5.4 → 0.5.5

package/CHANGELOG.md

@@ -5,6 +5,51 @@ change the rendered cert output and never break a compiling integration** (regis
 exports, types). Anything that would alter what a visitor sees — or require integration changes —
 is announced loudly here first.
 
+## 0.5.5 — 2026-07-31
+
+- **New:** `repository`, `homepage`, and `bugs` in `package.json` — the npm page now links to the
+  public source mirror (`github.com/CertREV/cert-kit`, `packages/cert-block`) and to the issue
+  tracker, so the registry listing is no longer a dead end. Provenance metadata only: no code, no
+  exports, no dependency change.
+- **Docs:** README gains a source-repo link and states the peer requirement explicitly — **React
+  `>=18`**. `peerDependencies.react` has enforced `>=18.0.0` since before 0.5.0 (and
+  `peerDependenciesMeta` marks it non-optional), but the README never said so; a consumer had to
+  read `package.json` to find the floor.
+- Rendered output: **byte-identical to 0.5.4** (metadata and prose only — no file under `dist/`
+  changes).
+
+## 0.5.4 — 2026-07-23
+
+- **Backfilled — this release shipped with no entry.** 0.5.4 published 2026-07-23 and is the first
+  release after this file was written; every other version from 0.3.0 on has a section, including
+  0.5.2 (a no-op republish). It changed the public type surface without the notice the contract
+  above requires. The omission is recorded here rather than quietly closed.
+- **Changed:** `FONT_SLOTS` / `FONT_STACKS` (`render-def`) widened 3 → 5 — `grotesk` (Plus Jakarta
+  Sans) and `mono` (JetBrains Mono) added at the shared guide values, byte-identical to this
+  package's `RENDER_BLOCK_FONT_STACKS`, the portal `FONT_SLOT_STACKS`, and the Liquid twin's
+  branches. Purely additive: `sans` / `serif` / `system` are untouched, so the card == modal
+  invariant holds. Shipped lockstep with the portal's Liquid + WordPress grotesk/mono wiring
+  (POR-10775 / POR-10721) — Phase-3 enablement of a vocabulary that was dormant on both engines,
+  not a repair of a live intra-page mismatch: before this release the Liquid card dropped
+  `grotesk`/`mono` too, and fell back exactly as the modal did.
+- **Breaking (types) — belonged in a minor, with notice:** `FONT_SLOTS`, `FONT_STACKS`, `FontSlot`
+  and `isFontSlot` are public exports. Widening the `FontSlot` union 3 → 5 breaks any consumer
+  holding an exhaustive `Record<FontSlot, string>` or an exhaustive `switch` over the slots — a
+  break of a compiling integration (exports, types) under the semver contract at the top of this
+  file, shipped in a patch.
+- Rendered output: the design-locked cert card and the modal bundle are **byte-identical to
+  0.5.3** — across the two published tarballs `dist/components/render-cert-block.js` (sha1
+  `22267d5d…`) and all 65 files under `dist/modal/` (`certrev-cert.js` sha1 `2013ebbe…`) are
+  unchanged, and neither resolves the shared `FONT_STACKS` (the card carries its own
+  `RENDER_BLOCK_FONT_STACKS`, which already listed all five slots; the modal consults no font map
+  at all). `<certrev-badge>` passes no `renderDef`, so it is unaffected by construction. Output can
+  differ on ONE path: a caller passing a `renderDef` with `fontSlot: 'grotesk' | 'mono'` into the
+  legacy `<CertBadge>` / `renderBadgeHtml`, where that slot now resolves to a `--certrev-font`
+  stack instead of being dropped as invalid. No brand could author those slots at release time (the
+  portal editor did not offer them; every known `render_def` writer emits `sans`), so no visitor's
+  render is known to have changed — that last point is inference from the call graph and the
+  authoring surface, not a production data check.
+
 ## 0.5.3 — 2026-07-22
 
 - **New:** `certRevCertComponent` (`./builder`) — the drop-in gen2 registration entry, with the

package/README.md

@@ -226,6 +226,12 @@ RFC-8785 JCS implementation used for signature verification). To be clear about
 **nothing cryptographic runs at card render** — the cert card draws purely from block options;
 verification enters only with the modal / the `getVerifiedEnvelope` verify layer.
 
+React is the one **peer** dependency left — **`react >=18.0.0`**, declared non-optional, so a
+peer-enforcing resolver (npm 7+) fails the install on React 17 with `ERESOLVE` rather than
+warning. Only the React entries need it: `./webcomponent` and `./modal` build React-free (no
+`react/jsx-runtime`) and there is no `react-dom` peer. CI builds and runs the SSR tests on
+React 18.3; the range admits 19.
+
 ## Known issues (upstream)
 
 - `@builder.io/sdk-react@5.2.4` ships types that fail to compile under
@@ -251,7 +257,12 @@ Facts are mocked via `makeMockPayload` / `makeSignedEnvelope` (`src/contract/fix
 
 ## Version
 
-`0.5.3` — see [CHANGELOG.md](./CHANGELOG.md) for the release history and the semver contract
+`0.5.5` — see [CHANGELOG.md](./CHANGELOG.md) for the release history and the semver contract
 (patch/minor never change the rendered cert output or break a compiling integration). Publishes
 **publicly** to npm as `@certrev/cert-block` (`publishConfig.access: public`) via GitHub Actions
 trusted publishing (OIDC); the internal `@certrev` GitHub-Packages channel mirrors it.
+
+Source is public at [`CertREV/cert-kit`](https://github.com/CertREV/cert-kit) (MIT) — this
+package is `packages/cert-block/`; report a vulnerability privately through that repo's
+`SECURITY.md`. The tarball also ships `src/` alongside `dist/`, so a security review reads the
+exact code for the version it installed.

package/package.json

@@ -1,7 +1,16 @@
 {
 	"name": "@certrev/cert-block",
-	"version": "0.5.4",
+	"version": "0.5.5",
 	"description": "Headless / crypto_verify render edge for the CertREV CertDeliveryEnvelope. SSR-safe React components (<CertBadge>/<ExpertBio>/<CertRevBacklink>), a deterministic schema.org JSON-LD projector, a fail-closed verify layer over the shared VerdictKernel, and a framework-agnostic <certrev-badge> Web Component. Sign once (portal), render everywhere (Hydrogen / Next / Builder / universal embed).",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/CertREV/cert-kit.git",
+		"directory": "packages/cert-block"
+	},
+	"homepage": "https://github.com/CertREV/cert-kit/tree/HEAD/packages/cert-block#readme",
+	"bugs": {
+		"url": "https://github.com/CertREV/cert-kit/issues"
+	},
 	"type": "module",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",

package/src/__tests__/readme-version.test.ts

@@ -0,0 +1,51 @@
+import { readFileSync } from 'node:fs'
+import { describe, expect, it } from 'vitest'
+
+/**
+ * Both public packages open a `## Version` section with a bare version stamp, and both ship
+ * README.md inside the published tarball (`files`) — so the stamp is what a consumer reads
+ * after `npm i`, not just what a browser shows on GitHub.
+ *
+ * It has now drifted twice, in both packages:
+ *   - cert-contract 0.5.1 was a docs-only release whose entire purpose was unsticking this
+ *     stamp ("README Version section brought current (0.4.0 / 0.5.0 were missing)").
+ *   - cert-block 0.5.4 bumped package.json and touched nothing else, so the published 0.5.4
+ *     tarball ships a README claiming to be 0.5.3. That is live on npm right now.
+ *
+ * Nothing caught either one, because nothing was looking: the stamp is prose, and prose has
+ * no compiler. A release step nobody can forget beats a release step written down somewhere.
+ * This is that step.
+ *
+ * The two packages word the line differently ("`x.y.z` — see" vs "Current: `x.y.z` — see"),
+ * so the pattern below matches the first backticked token after the heading rather than a
+ * fixed sentence. If a README reshapes that section, update the pattern — do not delete the
+ * assertion; the drift it catches has shipped to npm twice.
+ */
+const PACKAGES = ['cert-block', 'cert-contract'] as const
+
+describe.each(PACKAGES)('%s README version stamp', (pkgName) => {
+	const pkgUrl = new URL(`../../../${pkgName}/package.json`, import.meta.url)
+	const readmeUrl = new URL(`../../../${pkgName}/README.md`, import.meta.url)
+
+	const { version } = JSON.parse(readFileSync(pkgUrl, 'utf8')) as { version: string }
+	const readme = readFileSync(readmeUrl, 'utf8')
+
+	it('matches package.json — bump both, or neither', () => {
+		// First backticked token after the `## Version` heading.
+		const stamp = readme.match(/^## Version\s*\n+[^`\n]*`([^`]+)`/m)
+
+		expect(
+			stamp,
+			`${pkgName}: README has no \`## Version\` section opening with a backticked stamp. If the ` +
+				'section was renamed or reshaped, update this pattern to match the new shape rather ' +
+				'than deleting the assertion.',
+		).not.toBeNull()
+
+		expect(
+			stamp?.[1],
+			`${pkgName}: README's \`## Version\` stamp is ${stamp?.[1]} but package.json is ${version}. ` +
+				'README.md ships inside the npm tarball, so this mismatch gets published to consumers. ' +
+				`Bump the stamp in packages/${pkgName}/README.md.`,
+		).toBe(version)
+	})
+})