@certrev/cert-block 0.5.4 → 1.0.0

package/dist/webcomponent/render-badge-html.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-badge-html.d.ts","sourceRoot":"","sources":["../../src/webcomponent/render-badge-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAGN,KAAK,aAAa,EAGlB,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CAClC;AASD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,GAAE,kBAAuB,GAAG,MAAM,CAkG3F"}
+{"version":3,"file":"render-badge-html.d.ts","sourceRoot":"","sources":["../../src/webcomponent/render-badge-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,OAAO,EAGN,KAAK,aAAa,EAGlB,MAAM,6BAA6B,CAAA;AACpC,OAAO,KAAK,EAAe,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAErE,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CAClC;AAwCD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,GAAE,kBAAuB,GAAG,MAAM,CA2G3F"}

package/dist/webcomponent/render-badge-html.js

@@ -12,9 +12,18 @@
  * the badge must be in the server HTML, never client-only.
  */
 import { escapeAttribute, escapeHtml, safeCssColor, safeHttpUrl } from '../components/escape.js';
-import { credentialSuffix, formatDate, resolveDisplay } from '../components/format.js';
+import { credentialSuffix, dedupeCredential, expertNameWithCredentials, formatDate, resolveDisplay, } from '../components/format.js';
+import { CERTREV_LINK_REL } from '../components/rel.js';
 import { CERT_SCOPE_LINE, CERT_STRINGS_VERSION, resolveRenderTheme, themeCssVarDeclarations, } from '../components/render-def.js';
 const C = 'certrev-badge';
+/**
+ * The badge has exactly two faces, and this is the ONE place that decides which. Anything
+ * that is not the compact face renders the full face — so an unvalidated `badgeStyle` (a
+ * malformed envelope's number, an untyped caller's typo) can never reach the class name.
+ */
+function badgeFace(style) {
+    return style === 'compact' ? 'compact' : 'full';
+}
 function attr(name, value) {
     if (value == null || value === '')
         return '';
@@ -26,26 +35,31 @@ function attr(name, value) {
  * already decided to render by the time this is called).
  */
 export function renderBadgeHtml(payload, opts = {}) {
-    const content = payload.content;
-    const display = resolveDisplay(content.display, opts.accentColor, opts.renderDef);
+    const content = payload?.content ?? {};
+    const expert = content.expert ?? null;
+    const display = resolveDisplay(content.display ?? undefined, opts.accentColor, opts.renderDef);
     const theme = resolveRenderTheme(opts.renderDef);
-    const style = opts.badgeStyle ?? display.badgeStyle;
+    const style = badgeFace(opts.badgeStyle ?? display.badgeStyle);
     const accent = safeCssColor(display.accentColor) ?? '#0f766e';
     const verifyUrl = safeHttpUrl(content.verifyUrl);
-    const profileUrl = safeHttpUrl(content.expert.profileUrl);
-    const photoUrl = style === 'full' && display.showExpertPhoto ? safeHttpUrl(content.expert.photoUrl) : null;
-    const suffix = credentialSuffix(content);
+    const profileUrl = safeHttpUrl(expert?.profileUrl);
+    const photoUrl = style === 'full' && display.showExpertPhoto ? safeHttpUrl(expert?.photoUrl) : null;
+    // Same composition rule as <CertBadge>: the suffix drops a credential the display name
+    // already carries, so the two renderers never disagree about one payload.
+    const suffix = dedupeCredential(expert?.displayName, credentialSuffix(payload?.content));
     const certified = formatDate(content.certifiedAt);
     const updated = formatDate(content.contentModifiedAt);
-    const name = `${escapeHtml(content.expert.displayName)}${suffix ? `<span class="${C}__credentials">, ${escapeHtml(suffix)}</span>` : ''}`;
+    const name = `${escapeHtml(expert?.displayName)}${suffix ? `<span class="${C}__credentials">, ${escapeHtml(suffix)}</span>` : ''}`;
     const nameNode = profileUrl
-        ? `<a class="${C}__expert-link" href="${escapeAttribute(profileUrl)}" rel="noopener">${name}</a>`
+        ? `<a class="${C}__expert-link" href="${escapeAttribute(profileUrl)}" rel="${CERTREV_LINK_REL}">${name}</a>`
         : name;
     const mark = `<svg class="${C}__mark" width="20" height="20" viewBox="0 0 24 24" fill="none" aria-hidden="true" focusable="false">` +
         `<circle cx="12" cy="12" r="11" fill="${escapeAttribute(accent)}"></circle>` +
         `<path d="M7 12.5l3.2 3.2L17 9" stroke="#ffffff" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"></path></svg>`;
+    // alt="" is deliberate: the byline below renders the same name as text, so alt text would make a
+    // screen reader announce it twice. Kept in lockstep with <CertBadge> and the modal avatar.
     const photo = photoUrl
-        ? `<img class="${C}__photo" src="${escapeAttribute(photoUrl)}" alt="Photo of ${escapeAttribute(content.expert.displayName)}" width="40" height="40" loading="lazy" decoding="async" />`
+        ? `<img class="${C}__photo" src="${escapeAttribute(photoUrl)}" alt="" width="40" height="40" loading="lazy" decoding="async" />`
         : '';
     const header = `<div class="${C}__header">${mark}${photo}` +
         `<div class="${C}__heading">` +
@@ -57,7 +71,7 @@ export function renderBadgeHtml(payload, opts = {}) {
         if (display.showMemo && content.memo) {
             body += `<p class="${C}__memo">${escapeHtml(content.memo)}</p>`;
         }
-        if (display.showAuthor && content.author.name && content.author.name !== content.expert.displayName) {
+        if (display.showAuthor && content.author?.name && content.author.name !== expert?.displayName) {
             const title = content.author.title ? `, ${escapeHtml(content.author.title)}` : '';
             body += `<p class="${C}__author">Written by ${escapeHtml(content.author.name)}${title}</p>`;
         }
@@ -79,17 +93,19 @@ export function renderBadgeHtml(payload, opts = {}) {
     // byte-verbatim COMPENSATED_EXPERT_CUE. The scope line is byte-verbatim
     // CERT_SCOPE_LINE (its curly apostrophe U+2019 survives escapeHtml untouched).
     const cueInner = profileUrl
-        ? `Compensated <a class="${C}__cue-link" href="${escapeAttribute(profileUrl)}" rel="noopener">expert</a>`
+        ? `Compensated <a class="${C}__cue-link" href="${escapeAttribute(profileUrl)}" rel="${CERTREV_LINK_REL}">expert</a>`
         : 'Compensated expert';
     const disclosure = `<div class="${C}__disclosure">` +
         `<span class="${C}__compensated-cue">${cueInner}</span>` +
         `<p class="${C}__ftc" data-ftc-disclosure><span data-ftc-line>${escapeHtml(CERT_SCOPE_LINE)}</span></p>` +
         `</div>`;
     const verify = verifyUrl
-        ? `<a class="${C}__verify" href="${escapeAttribute(verifyUrl)}" rel="noopener" aria-label="Verify this certification on CertREV">Verify on CertREV</a>`
+        ? `<a class="${C}__verify" href="${escapeAttribute(verifyUrl)}" rel="${CERTREV_LINK_REL}" aria-label="Verify this certification on CertREV">Verify on CertREV</a>`
         : '';
-    const ariaLabel = `Content reviewed by ${content.expert.displayName}${suffix ? `, ${suffix}` : ''}`;
-    // Accent LEADS so the un-themed output is byte-identical to the pre-WS6 single-var
+    // Same derivation <CertBadge> labels with, so the two renderers cannot drift on the one
+    // string a screen reader actually announces.
+    const ariaLabel = `Content reviewed by ${expertNameWithCredentials(payload?.content)}`;
+    // Accent LEADS so the un-themed output is byte-identical to the older single-var
     // form. A THEMED brand appends surface/radius/font: the data-bearing tokens ride
     // escaped (a no-op for validated hex/length — defense in depth), the font is a
     // controlled literal stack emitted raw. The whole string is NOT re-escaped
@@ -99,8 +115,11 @@ export function renderBadgeHtml(payload, opts = {}) {
     for (const [name, value] of themeCssVarDeclarations(theme)) {
         rootStyle += name === '--certrev-font' ? `;${name}:${value}` : `;${name}:${escapeAttribute(value)}`;
     }
-    return (`<section class="${C} ${C}--${escapeAttribute(style)}" style="${rootStyle}"` +
-        attr('data-certrev-cert-id', payload.certId) +
+    return (
+    // `style` is one of two literals by construction (`badgeFace`), so the class name needs
+    // no escaping — there is no path by which caller data reaches it.
+    `<section class="${C} ${C}--${style}" style="${rootStyle}"` +
+        attr('data-certrev-cert-id', payload?.certId) +
         ` data-certrev-strings-version="${CERT_STRINGS_VERSION}"` +
         attr('data-certrev-def-version', theme.version != null ? String(theme.version) : null) +
         ` aria-label="${escapeAttribute(ariaLabel)}">${header}${body}${disclosure}${verify}</section>`);

package/dist/webcomponent/render-badge-html.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-badge-html.js","sourceRoot":"","sources":["../../src/webcomponent/render-badge-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAChG,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AACtF,OAAO,EACN,eAAe,EACf,oBAAoB,EAEpB,kBAAkB,EAClB,uBAAuB,GACvB,MAAM,6BAA6B,CAAA;AAepC,MAAM,CAAC,GAAG,eAAe,CAAA;AAEzB,SAAS,IAAI,CAAC,IAAY,EAAE,KAAgC;IAC3D,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC5C,OAAO,IAAI,IAAI,KAAK,eAAe,CAAC,KAAK,CAAC,GAAG,CAAA;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB,EAAE,OAA2B,EAAE;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC/B,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACjF,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAA;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,SAAS,CAAA;IAC7D,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IACzD,MAAM,QAAQ,GAAG,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1G,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAErD,MAAM,IAAI,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,GACrD,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,oBAAoB,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAC7E,EAAE,CAAA;IACF,MAAM,QAAQ,GAAG,UAAU;QAC1B,CAAC,CAAC,aAAa,CAAC,wBAAwB,eAAe,CAAC,UAAU,CAAC,oBAAoB,IAAI,MAAM;QACjG,CAAC,CAAC,IAAI,CAAA;IAEP,MAAM,IAAI,GACT,eAAe,CAAC,sGAAsG;QACtH,wCAAwC,eAAe,CAAC,MAAM,CAAC,aAAa;QAC5E,iIAAiI,CAAA;IAElI,MAAM,KAAK,GAAG,QAAQ;QACrB,CAAC,CAAC,eAAe,CAAC,iBAAiB,eAAe,CAAC,QAAQ,CAAC,mBAAmB,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,6DAA6D;QACvL,CAAC,CAAC,EAAE,CAAA;IAEL,MAAM,MAAM,GACX,eAAe,CAAC,aAAa,IAAI,GAAG,KAAK,EAAE;QAC3C,eAAe,CAAC,aAAa;QAC7B,gBAAgB,CAAC,mCAAmC;QACpD,gBAAgB,CAAC,yBAAyB,QAAQ,SAAS;QAC3D,cAAc,CAAA;IAEf,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,IAAI,aAAa,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAA;QAChE,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACrG,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YACjF,IAAI,IAAI,aAAa,CAAC,wBAAwB,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAA;QAC5F,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,SAAS,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CACT,eAAe,CAAC,iDAAiD,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,oBAAoB,CACnJ,CAAA;QACF,CAAC;QACD,IAAI,OAAO,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CACT,eAAe,CAAC,oDAAoD,eAAe,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,oBAAoB,CAC1J,CAAA;QACF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,IAAI,cAAc,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAA;IAC3E,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,wEAAwE;IACxE,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,UAAU;QAC1B,CAAC,CAAC,yBAAyB,CAAC,qBAAqB,eAAe,CAAC,UAAU,CAAC,6BAA6B;QACzG,CAAC,CAAC,oBAAoB,CAAA;IACvB,MAAM,UAAU,GACf,eAAe,CAAC,gBAAgB;QAChC,gBAAgB,CAAC,sBAAsB,QAAQ,SAAS;QACxD,aAAa,CAAC,kDAAkD,UAAU,CAAC,eAAe,CAAC,aAAa;QACxG,QAAQ,CAAA;IAET,MAAM,MAAM,GAAG,SAAS;QACvB,CAAC,CAAC,aAAa,CAAC,mBAAmB,eAAe,CAAC,SAAS,CAAC,0FAA0F;QACvJ,CAAC,CAAC,EAAE,CAAA;IAEL,MAAM,SAAS,GAAG,uBAAuB,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;IACnG,mFAAmF;IACnF,iFAAiF;IACjF,+EAA+E;IAC/E,2EAA2E;IAC3E,iFAAiF;IACjF,mCAAmC;IACnC,IAAI,SAAS,GAAG,oBAAoB,eAAe,CAAC,MAAM,CAAC,8BAA8B,eAAe,CAAC,MAAM,CAAC,EAAE,CAAA;IAClH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,SAAS,IAAI,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAA;IACpG,CAAC;IAED,OAAO,CACN,mBAAmB,CAAC,IAAI,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,YAAY,SAAS,GAAG;QAC5E,IAAI,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,CAAC;QAC5C,kCAAkC,oBAAoB,GAAG;QACzD,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,gBAAgB,eAAe,CAAC,SAAS,CAAC,KAAK,MAAM,GAAG,IAAI,GAAG,UAAU,GAAG,MAAM,YAAY,CAC9F,CAAA;AACF,CAAC"}
+{"version":3,"file":"render-badge-html.js","sourceRoot":"","sources":["../../src/webcomponent/render-badge-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAChG,OAAO,EACN,gBAAgB,EAChB,gBAAgB,EAChB,yBAAyB,EACzB,UAAU,EACV,cAAc,GACd,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EACN,eAAe,EACf,oBAAoB,EAEpB,kBAAkB,EAClB,uBAAuB,GACvB,MAAM,6BAA6B,CAAA;AAepC,MAAM,CAAC,GAAG,eAAe,CAAA;AAwBzB;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAc;IAChC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;AAChD,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,KAAgC;IAC3D,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,EAAE,CAAA;IAC5C,OAAO,IAAI,IAAI,KAAK,eAAe,CAAC,KAAK,CAAC,GAAG,CAAA;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB,EAAE,OAA2B,EAAE;IAClF,MAAM,OAAO,GAAiB,OAAO,EAAE,OAAO,IAAI,EAAE,CAAA;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAA;IACrC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IAC9F,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,SAAS,CAAA;IAC7D,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAClD,MAAM,QAAQ,GAAG,KAAK,KAAK,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnG,uFAAuF;IACvF,0EAA0E;IAC1E,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;IACxF,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAErD,MAAM,IAAI,GAAG,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,GAC9C,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,oBAAoB,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAC7E,EAAE,CAAA;IACF,MAAM,QAAQ,GAAG,UAAU;QAC1B,CAAC,CAAC,aAAa,CAAC,wBAAwB,eAAe,CAAC,UAAU,CAAC,UAAU,gBAAgB,KAAK,IAAI,MAAM;QAC5G,CAAC,CAAC,IAAI,CAAA;IAEP,MAAM,IAAI,GACT,eAAe,CAAC,sGAAsG;QACtH,wCAAwC,eAAe,CAAC,MAAM,CAAC,aAAa;QAC5E,iIAAiI,CAAA;IAElI,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,KAAK,GAAG,QAAQ;QACrB,CAAC,CAAC,eAAe,CAAC,iBAAiB,eAAe,CAAC,QAAQ,CAAC,oEAAoE;QAChI,CAAC,CAAC,EAAE,CAAA;IAEL,MAAM,MAAM,GACX,eAAe,CAAC,aAAa,IAAI,GAAG,KAAK,EAAE;QAC3C,eAAe,CAAC,aAAa;QAC7B,gBAAgB,CAAC,mCAAmC;QACpD,gBAAgB,CAAC,yBAAyB,QAAQ,SAAS;QAC3D,cAAc,CAAA;IAEf,IAAI,IAAI,GAAG,EAAE,CAAA;IACb,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,IAAI,aAAa,CAAC,WAAW,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAA;QAChE,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/F,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YACjF,IAAI,IAAI,aAAa,CAAC,wBAAwB,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAA;QAC5F,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,SAAS,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CACT,eAAe,CAAC,iDAAiD,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,UAAU,CAAC,SAAS,CAAC,oBAAoB,CACnJ,CAAA;QACF,CAAC;QACD,IAAI,OAAO,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CACT,eAAe,CAAC,oDAAoD,eAAe,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,UAAU,CAAC,OAAO,CAAC,oBAAoB,CAC1J,CAAA;QACF,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,IAAI,IAAI,cAAc,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAA;IAC3E,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,6EAA6E;IAC7E,gFAAgF;IAChF,wEAAwE;IACxE,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,UAAU;QAC1B,CAAC,CAAC,yBAAyB,CAAC,qBAAqB,eAAe,CAAC,UAAU,CAAC,UAAU,gBAAgB,cAAc;QACpH,CAAC,CAAC,oBAAoB,CAAA;IACvB,MAAM,UAAU,GACf,eAAe,CAAC,gBAAgB;QAChC,gBAAgB,CAAC,sBAAsB,QAAQ,SAAS;QACxD,aAAa,CAAC,kDAAkD,UAAU,CAAC,eAAe,CAAC,aAAa;QACxG,QAAQ,CAAA;IAET,MAAM,MAAM,GAAG,SAAS;QACvB,CAAC,CAAC,aAAa,CAAC,mBAAmB,eAAe,CAAC,SAAS,CAAC,UAAU,gBAAgB,2EAA2E;QAClK,CAAC,CAAC,EAAE,CAAA;IAEL,wFAAwF;IACxF,6CAA6C;IAC7C,MAAM,SAAS,GAAG,uBAAuB,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAA;IACtF,iFAAiF;IACjF,iFAAiF;IACjF,+EAA+E;IAC/E,2EAA2E;IAC3E,iFAAiF;IACjF,mCAAmC;IACnC,IAAI,SAAS,GAAG,oBAAoB,eAAe,CAAC,MAAM,CAAC,8BAA8B,eAAe,CAAC,MAAM,CAAC,EAAE,CAAA;IAClH,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,SAAS,IAAI,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAA;IACpG,CAAC;IAED,OAAO;IACN,wFAAwF;IACxF,kEAAkE;IAClE,mBAAmB,CAAC,IAAI,CAAC,KAAK,KAAK,YAAY,SAAS,GAAG;QAC3D,IAAI,CAAC,sBAAsB,EAAE,OAAO,EAAE,MAAM,CAAC;QAC7C,kCAAkC,oBAAoB,GAAG;QACzD,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,gBAAgB,eAAe,CAAC,SAAS,CAAC,KAAK,MAAM,GAAG,IAAI,GAAG,UAAU,GAAG,MAAM,YAAY,CAC9F,CAAA;AACF,CAAC"}

package/package.json

@@ -1,7 +1,16 @@
 {
 	"name": "@certrev/cert-block",
-	"version": "0.5.4",
-	"description": "Headless / crypto_verify render edge for the CertREV CertDeliveryEnvelope. SSR-safe React components (<CertBadge>/<ExpertBio>/<CertRevBacklink>), a deterministic schema.org JSON-LD projector, a fail-closed verify layer over the shared VerdictKernel, and a framework-agnostic <certrev-badge> Web Component. Sign once (portal), render everywhere (Hydrogen / Next / Builder / universal embed).",
+	"version": "1.0.0",
+	"description": "Headless render edge for the CertREV CertDeliveryEnvelope: SSR-safe React cert components, a framework-agnostic <certrev-badge> Web Component, a schema.org JSON-LD projector, and a fail-closed verify layer over the shared VerdictKernel.",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/CertREV/cert-kit.git",
+		"directory": "packages/cert-block"
+	},
+	"homepage": "https://github.com/CertREV/cert-kit/tree/HEAD/packages/cert-block#readme",
+	"bugs": {
+		"url": "https://github.com/CertREV/cert-kit/issues"
+	},
 	"type": "module",
 	"main": "./dist/index.js",
 	"types": "./dist/index.d.ts",
@@ -35,6 +44,9 @@
 	"files": [
 		"dist",
 		"src",
+		"!src/**/__tests__",
+		"!src/**/*.test.ts",
+		"!src/**/*.test.tsx",
 		"README.md",
 		"CHANGELOG.md"
 	],

package/src/builder/cert-chrome-data.ts

@@ -3,14 +3,14 @@
  * `BuilderCertChromeData` — the CANONICAL headless cert-chrome wire type
  * ─────────────────────────────────────────────────────────────────────────────
  *
- * The brand-render projection of the cert envelope (portal POR-10091) — the OPTIONS
+ * The brand-render projection of the cert envelope — the OPTIONS
  * of a brand's native cert component (the registered `CertReviewCard`) on
  * a headless blocks-mode entry (Builder.io). CertREV serves the data + the ready-made
  * strings; the brand renders it within the design-guide ladder (enforced live by the
  * crawl monitor + the MSA anti-stripping teeth).
  *
- * SINGLE SOURCE (POR-10721 W1): this type is HOMED HERE so the portal exporter
- * (`src/lib/builder/cert-chrome.ts`) and the kit component (`CertReviewCard`) +
+ * SINGLE SOURCE: this type is HOMED HERE so the portal's cert-chrome exporter,
+ * the kit component (`CertReviewCard`) and
  * `BUILDER_REGISTRATION.inputs` all reference ONE definition — killing the drift the
  * hand-rolled Hydrogen-replica component suffered (it carried a stale separate
  * `credential`/`credentialVerifiedAt` shape from before the fused-pair projection).
@@ -49,7 +49,12 @@ export interface CertChromeRenderDef {
 	readonly barInkFg?: '#141414' | '#ffffff'
 	/** The subtractive field-visibility hide-set. */
 	readonly hidden: readonly string[]
-	/** v2 layout axis. Omitted ⇒ 'banner'. */
+	/**
+	 * v2 layout axis. This is the DEF's own axis (what the brand baked), NOT the placement the
+	 * component renders — the entry/editor picks that via `mode`, and its default lives in
+	 * `renderCertBlock` alone (`sidebar`). This comment used to claim the default was 'banner',
+	 * which made it the third place a placement default was written down and the second one wrong.
+	 */
 	readonly layout?: string
 	/** Custom-face composition — present only when layout === 'custom'. */
 	readonly customFace?: { readonly placedFields: readonly string[] }
@@ -86,9 +91,22 @@ export interface BuilderCertChromeData {
 	background: string | null
 	/** The QA-SCREENED `verifiedExpertMemo` (never the raw in-flight `expertMemo`), or null. */
 	memo: string | null
-	/** The compensation cue (`Compensated expert`). Null for a pro-bono reviewer. */
+	/**
+	 * The compensation cue (`Compensated expert`). Null for a pro-bono reviewer.
+	 *
+	 * COPY IS NOT CARRIED BY THIS FIELD — only the BOOLEAN it implies is. The face renders the
+	 * locked `COMPENSATED_EXPERT_CUE` constant when the cue is present and NOTHING when it is
+	 * null; a rewritten string here changes no pixel. Kept on the wire type because the
+	 * pro-bono `null` is real signal, and because a brand's exporter payload already carries it.
+	 */
 	compensationCue: string | null
-	/** The verbatim FTC scope disclaimer. Always present. */
+	/**
+	 * The verbatim FTC scope disclaimer. Always present.
+	 *
+	 * Delivered for the brand's own records / non-CertREV surfaces. The face does NOT read it:
+	 * it renders the locked `CERT_SCOPE_LINE` constant, whose curly apostrophe is pinned to
+	 * MSA §3, so an edited copy here can never reach a rendered disclosure.
+	 */
 	scopeLine: string
 	/** Reviewer photo URL (cert-frozen override ?? live), or null. */
 	reviewerPhoto: string | null
@@ -117,8 +135,8 @@ export interface BuilderCertChromeData {
 
 /**
  * The ordered keys of `BuilderCertChromeData` — the SINGLE SOURCE the Builder
- * `inputs` array and the W3 exporter⇄inputs⇄wire-type parity lock derive from, so
- * the three can never silently drift again (POR-10721 W3). Adding a field to the
+ * `inputs` array and the exporter⇄inputs⇄wire-type parity lock derive from, so
+ * the three can never silently drift again. Adding a field to the
  * interface without adding it here (or vice-versa) fails the `keyof` exhaustiveness
  * check in `assertChromeKeysExhaustive` below.
  */

package/src/builder/cert-review-card.tsx

@@ -8,7 +8,7 @@
  * `BuilderCertChromeData` projection — so the visible cert chrome renders itself,
  * design-identical to the Shopify Liquid + WordPress PHP faces (same `renderCertBlock`
  * string renderer). This REPLACES the ~200-line hand-rolled component every headless
- * brand copied from the demo (POR-10721 W1).
+ * brand copied from the demo.
  *
  * Improvements over the canary demo's hand-rolled version:
  *  - consumes the CANONICAL `BuilderCertChromeData` (the fused `credentialVerification`
@@ -31,11 +31,15 @@ import { BUILDER_CERT_CHROME_KEYS } from './cert-chrome-data.js'
 export const CERT_COMPONENT_NAME = 'CertREV Cert'
 
 export interface CertReviewCardProps extends Partial<BuilderCertChromeData> {
-	/** Placement face — the ENTRY/editor chooses this, NOT the exporter (not a wire-type field). */
+	/**
+	 * Placement face — the ENTRY/editor chooses this, NOT the exporter (not a wire-type field).
+	 * Absent ⇒ whatever `renderCertBlock` defaults to (`sidebar`); this component names no
+	 * fallback of its own, so there is exactly ONE place the default is written down.
+	 */
 	mode?: CertBlockMode | null
 	/**
 	 * Banner memo placement (not a wire-type field — the ENTRY/editor chooses it). Passed
-	 * straight through to `renderCertBlock`'s first-class `part` (POR-10741): `'full'`
+	 * straight through to `renderCertBlock`'s first-class `part`: `'full'`
 	 * (default) renders header + memo in one block; `'header'`/`'memo'` render only that
 	 * card so the memo can be placed as its own block under the article body. The old
 	 * string-splitting shim is gone — `renderCertBlock` composes each part directly.
@@ -43,59 +47,106 @@ export interface CertReviewCardProps extends Partial<BuilderCertChromeData> {
 	part?: 'full' | 'header' | 'memo' | null
 }
 
+/**
+ * Coerce ONE untyped option to renderable text.
+ *
+ * `CertReviewCardProps` is erased at runtime and these options are authored in a VISUAL
+ * EDITOR — a number, an object or an array can sit in any field, and `??` does nothing about
+ * it (`props.memo ?? ''` forwards the number 42 happily). `renderCertBlock` reads its facts as
+ * strings (`.trim()`, `.split()`), so a mistyped option threw INSIDE the SSR render; under
+ * `renderToReadableStream` that aborts the whole article route with zero HTML. A value that is
+ * not text is not copy, so it renders as nothing.
+ */
+function text(value: unknown): string {
+	return typeof value === 'string' ? value : ''
+}
+
+/** The same rule where ABSENT and EMPTY are different renders (`authorTitle`, `bio`). */
+function optionalText(value: unknown): string | undefined {
+	return text(value) || undefined
+}
+
+/**
+ * The fused credential pair — accepted ONLY when both halves are present AND both are strings.
+ *
+ * The R1 gate ("a credential never displays without its dated verification") is THIS FUNCTION,
+ * not the type: the pair arrives as untyped CMS JSON, and the old truthiness check keyed the
+ * whole pair off the OBJECT, so `{credential:'MD'}` forwarded `verifiedAt: undefined` into the
+ * renderer and crashed. Anything malformed — a half pair, a bare string, an array, a number
+ * where a date belongs — degrades to the name-only face, which is the honest render of a
+ * delivery whose verification cannot be read.
+ */
+function fusedCredential(pair: BuilderCertChromeData['credentialVerification'] | undefined) {
+	if (!pair || typeof pair !== 'object') return null
+	const credential = text(pair.credential)
+	const verifiedAt = text(pair.verifiedAt)
+	return credential && verifiedAt ? { credential, verifiedAt } : null
+}
+
 export function CertReviewCard(props: CertReviewCardProps) {
-	const { reviewerName, verifyUrl } = props
-	if (!reviewerName || !verifyUrl) return null // no chrome pre-cert
+	const reviewerName = text(props.reviewerName)
+	const verifyUrl = text(props.verifyUrl)
+	if (!reviewerName || !verifyUrl) return null // no chrome pre-cert (or an unreadable delivery)
 
-	// The credential + its verification date arrive ONLY as the fused pair, so we can
-	// never obtain one without the other (name-only face when the pair is null, or when
-	// the brand set showCredentials:false). This IS the R1 gate, enforced by the type.
-	const cv = props.credentialVerification ?? null
+	// Name-only face when the pair is unreadable, or when the brand set showCredentials:false.
 	const showCred = props.display?.showCredentials !== false
-	const withCred = cv && showCred ? cv : null
+	const withCred = showCred ? fusedCredential(props.credentialVerification) : null
 
 	const tokens = props.renderDef?.tokens
 	const theme: Partial<ResolvedBlockTheme> | undefined = tokens
 		? {
-				accentColor: tokens.accentColor,
-				surface: tokens.surface,
-				cornerRadius: tokens.cornerRadius,
-				fontSlot: tokens.fontSlot as ResolvedBlockTheme['fontSlot'] | undefined,
+				accentColor: optionalText(tokens.accentColor),
+				surface: optionalText(tokens.surface),
+				cornerRadius: optionalText(tokens.cornerRadius),
+				fontSlot: optionalText(tokens.fontSlot) as ResolvedBlockTheme['fontSlot'] | undefined,
 				// v2 brand-ink (post-demo): the bar + free-content ink follow the def.
-				barInk: tokens.barInk,
-				inkColor: tokens.inkColor,
+				barInk: optionalText(tokens.barInk),
+				inkColor: optionalText(tokens.inkColor),
 			}
 		: undefined
 
 	const html = renderCertBlock({
-		mode: (props.mode as CertBlockMode) ?? 'banner',
+		// NO fallback here, deliberately: `renderCertBlock` owns the ONE placement default
+		// (absent or unrecognised ⇒ sidebar). This line used to say `?? 'banner'`, and it was
+		// one of THREE layers each naming a default — here, the registered input's helper text,
+		// and the wire type's own doc comment — while the renderer, the only place that actually
+		// paints a face, named none. Three copies of a default is three chances to disagree.
+		mode: props.mode ?? undefined,
 		theme,
-		// First-class banner memo split (POR-10741) — renderCertBlock composes the requested
-		// part directly; no string-splitting. Ignored outside banner mode.
+		// First-class banner memo split — renderCertBlock composes the requested
+		// part directly; no string-splitting. Ignored outside banner mode, and an unrecognised
+		// value is normalised to 'full' there, same as `mode` — not here.
 		...(props.part ? { part: props.part } : {}),
 		facts: {
-			authorName: props.authorName ?? 'Editorial',
-			authorTitle: props.authorTitle ?? undefined,
+			authorName: optionalText(props.authorName) ?? 'Editorial',
+			authorTitle: optionalText(props.authorTitle),
 			reviewerName,
-			credential: withCred ? withCred.credential : '',
-			credentialVerifiedAt: withCred ? withCred.verifiedAt : '',
-			certifiedAt: props.certifiedAt ?? '',
-			memo: props.memo ?? '',
-			bio: props.bio ?? undefined,
-			profileUrl: props.reviewerProfileUrl ?? '',
+			credential: withCred?.credential ?? '',
+			credentialVerifiedAt: withCred?.verifiedAt ?? '',
+			certifiedAt: text(props.certifiedAt),
+			memo: text(props.memo),
+			bio: optionalText(props.bio),
+			profileUrl: text(props.reviewerProfileUrl),
 			certificateUrl: verifyUrl,
-			// Locked strings default byte-verbatim inside renderCertBlock; pass the
-			// delivered cue/scope through so a pro-bono (null-cue) delivery is honored.
-			...(props.compensationCue ? { compensationCue: props.compensationCue } : {}),
-			...(props.scopeLine ? { scopeLine: props.scopeLine } : {}),
+			// The compliance disclosures are CONSTANTS the renderer owns — a delivered cue is
+			// IGNORED (an editor cannot retype the FTC copy into something friendlier), and the
+			// scope line is not forwarded at all. The ONE thing honored is an explicit `null`:
+			// the pro-bono reviewer has no compensation to disclose, so the cue is omitted
+			// rather than replaced by the compensated constant (the modal already gets this
+			// right — a card claiming "Compensated expert" over a volunteer is an FTC-facing
+			// falsehood, not a cosmetic default).
+			compensationCue: props.compensationCue === null ? null : undefined,
 		},
 	})
 
 	return (
 		<div
 			data-certrev-cert-chrome=""
-			data-certrev-strings-version={props.stringsVersion ?? undefined}
-			data-certrev-def-version={props.renderDef?.v ?? undefined}
+			// The two provenance stamps the crawl monitor reads — emitted ONLY when the delivery
+			// carried the right type, so a mistyped option leaves the attribute off instead of
+			// stamping "[object Object]" as a version.
+			data-certrev-strings-version={optionalText(props.stringsVersion)}
+			data-certrev-def-version={typeof props.renderDef?.v === 'number' ? props.renderDef.v : undefined}
 			// biome-ignore lint/security/noDangerouslySetInnerHtml: renderCertBlock is the escaping-safe SSR string renderer
 			dangerouslySetInnerHTML={{ __html: html }}
 		/>
@@ -106,12 +157,28 @@ export function CertReviewCard(props: CertReviewCardProps) {
 // Builder.io registration — inputs SINGLE-SOURCED from the wire-type keys (W1/W3)
 // ─────────────────────────────────────────────────────────────────────────────
 
-/** The subset of the Builder.io input schema this kit emits. */
+/**
+ * The subset of the Builder.io input schema this kit emits. Every field below is verified
+ * against `@builder.io/sdk-react`'s own `Input` declaration (`types/types/input.d.ts`, 5.2.7) —
+ * a field the SDK ignores would be worse than none, because it READS as configured.
+ */
 export interface BuilderInput {
 	readonly name: string
 	readonly type: 'string' | 'longText' | 'object' | 'boolean' | 'number'
 	readonly friendlyName?: string
 	readonly helperText?: string
+	/** The value Builder pre-fills a freshly-dropped block with (`Input.defaultValue`). */
+	readonly defaultValue?: string
+	/**
+	 * Turns a `string` input into a DROPDOWN of exactly these choices (`Input.enum`). The SDK
+	 * accepts bare strings or `{label, value}` pairs; the kit uses pairs so the editor reads a
+	 * capitalised label while the component still receives its lowercase mode/part literal.
+	 * The ARRAY is deliberately mutable (the entries are not): the SDK types `Input.enum` as a
+	 * mutable array, and a `readonly` one here makes the whole registration un-assignable to
+	 * `RegisteredComponent` — the same reason `inputs` itself is mutable below (verified by
+	 * compiling this shape against the installed SDK's `RegisteredComponent`).
+	 */
+	readonly enum?: { readonly label: string; readonly value: string }[]
 	/** Tucks the input under the editor's "Advanced" reveal (Builder's `Input.advanced`). */
 	readonly advanced?: boolean
 }
@@ -139,6 +206,23 @@ const WIRE_INPUT_TYPE: Record<(typeof BUILDER_CERT_CHROME_KEYS)[number], Builder
 	stringsVersion: 'string',
 }
 
+/**
+ * The COMPLIANCE-COPY inputs, called what they are.
+ *
+ * `advanced: true` is only a UI fold, so an editor who opens "Advanced" sees these two beside
+ * the rest and reads them as theirs to type in. They are NOT: the renderer paints the locked
+ * `COMPENSATED_EXPERT_CUE` / `CERT_SCOPE_LINE` constants and ignores whatever is here. They
+ * stay REGISTERED because they are wire-type keys — dropping them would change the contract
+ * the portal exporter writes, and would strand the `null` that signals a pro-bono reviewer.
+ * So the fix is truthful labelling, not removal.
+ */
+const WIRE_INPUT_HELPER_TEXT: Partial<Record<(typeof BUILDER_CERT_CHROME_KEYS)[number], string>> = {
+	compensationCue:
+		'System-populated by CertREV. Only its PRESENCE is read (absent = a pro-bono reviewer, so no cue renders); the cue itself is a locked constant, so editing this text changes nothing on the page — and clearing it does not remove the disclosure.',
+	scopeLine:
+		'System-populated by CertREV. The FTC scope line renders byte-verbatim from a locked constant — editing this text changes nothing on the page.',
+}
+
 /**
  * The wire-type inputs — DERIVED from `BUILDER_CERT_CHROME_KEYS`, so the 19-field
  * option set can never drift from the type (the W3 lock asserts name-parity). This
@@ -147,20 +231,45 @@ const WIRE_INPUT_TYPE: Record<(typeof BUILDER_CERT_CHROME_KEYS)[number], Builder
 export const WIRE_INPUTS: readonly BuilderInput[] = BUILDER_CERT_CHROME_KEYS.map((name) => ({
 	name,
 	type: WIRE_INPUT_TYPE[name],
+	...(WIRE_INPUT_HELPER_TEXT[name] ? { helperText: WIRE_INPUT_HELPER_TEXT[name] } : {}),
 	// Exporter-populated wire fields: collapsed under the editor's "Advanced" reveal so the
 	// Options tab leads with the two placement choices an editor actually makes (mode/part).
 	advanced: true,
 }))
 
-/** Placement inputs — chosen by the entry/editor, NOT emitted by the exporter (not wire-type keys). */
+/**
+ * Placement inputs — chosen by the entry/editor, NOT emitted by the exporter (not wire-type keys).
+ *
+ * `defaultValue` + `enum` are what make these two REAL choices in the editor: a dropdown of the
+ * faces that exist, pre-filled with the same default the renderer applies. They were free-text
+ * with no default before, so the only description of the default was the helper text — which had
+ * drifted from the code (it advertised `banner`; the renderer's default is `sidebar`).
+ */
 export const PLACEMENT_INPUTS: readonly BuilderInput[] = [
 	{
 		name: 'mode',
 		type: 'string',
 		friendlyName: 'Placement',
-		helperText: 'banner (default) · sidebar · floating',
+		helperText: 'sidebar (default) · banner · floating',
+		defaultValue: 'sidebar',
+		enum: [
+			{ label: 'Sidebar', value: 'sidebar' },
+			{ label: 'Banner', value: 'banner' },
+			{ label: 'Floating', value: 'floating' },
+		],
+	},
+	{
+		name: 'part',
+		type: 'string',
+		friendlyName: 'Banner part',
+		helperText: 'full (default) · header · memo — banner placement only',
+		defaultValue: 'full',
+		enum: [
+			{ label: 'Full (header + memo)', value: 'full' },
+			{ label: 'Header only', value: 'header' },
+			{ label: 'Memo only', value: 'memo' },
+		],
 	},
-	{ name: 'part', type: 'string', friendlyName: 'Banner part', helperText: 'full (default) · header · memo' },
 ]
 
 /** A Builder.io custom-component registration (the general shape; the anchor uses the same). */
@@ -207,6 +316,6 @@ export const certRevCertComponent: CertReviewCardRegisteredComponent = {
 	name: CERT_COMPONENT_NAME,
 	component: CertReviewCard,
 	description:
-		'CertREV expert-review cert card. Options are populated by the CertREV exporter — editors choose placement (mode/part) only.',
+		'CertREV expert-review cert card. Options are populated by the CertREV exporter; editors choose placement (mode/part) only.',
 	inputs: [...PLACEMENT_INPUTS, ...WIRE_INPUTS],
 }

package/src/builder/index.tsx

@@ -1,25 +1,42 @@
 /**
  * @certrev/cert-block/builder — Builder.io adapter, "ambient-URL anchor" model.
  *
- * Validated by an independent architecture panel (Codex gpt-5.5 + Gemini, blind): a visual
- * page builder must NOT choose WHICH credential renders — that invites cross-article misuse and
- * re-opens the wrong-subject surface. Instead:
+ * A visual page builder must NOT choose WHICH credential renders — that invites cross-article
+ * misuse and re-opens the wrong-subject surface. The ANCHOR path splits the two concerns:
  *   • the CMS controls LAYOUT — an editor drags a ZERO-INPUT <CertRevAnchor/> to position the
  *     badge on the page;
  *   • the SYSTEM controls TRUTH — the headless loader resolves THIS page's credential from its
- *     own URL (Track-1 delivery), crypto-verifies it (fail-closed VerdictKernel), and supplies
- *     the verdict via context.
+ *     own URL, crypto-verifies it (fail-closed VerdictKernel), and supplies the verdict via
+ *     context.
  * The anchor renders the current page's verified badge or NOTHING. It cannot be pointed at
  * another article, and there is no `placementId` input to forge or mis-select.
  *
- * JSON-LD is DECOUPLED (panel finding): the anchor renders the BADGE only (`omitJsonLd`). The
- * article template emits the schema.org JSON-LD server-side from the same verified verdict, so a
- * page builder can't duplicate, move, or omit structured data. (See the route example.)
+ * THE PUSH KIT DOES NOT INHERIT THAT PROPERTY, and this module exports it too. `CertReviewCard` /
+ * `certRevCertComponent` register the 19 wire-type fields — `reviewerName`,
+ * `credentialVerification`, `verifyUrl`, `memo` — as Builder INPUTS, and the card renders what
+ * those inputs hold; it runs no signature check and consults no verdict. `advanced: true` folds
+ * them out of the editor's default view, which is a UI reveal and not a lock, and `safeHttpUrl`
+ * bounds `verifyUrl` to the http(s) SCHEME rather than to a CertREV origin. So to the card a
+ * hand-typed option and an exporter-written one are the same string: the trust boundary on the
+ * PUSH path is WRITE ACCESS TO THE CMS SPACE, not a signature, and nothing in this package
+ * narrows it. See "PUSH trust model" in the package README for the full statement — including
+ * what a revocation upstream does and does not reach.
  *
- * EDGE-CACHE DISCIPLINE (panel finding): the consumer's loader MUST verify per request as a
- * dynamic edge subrequest and must NOT long-cache the rendered badge HTML — a revoked/expired
- * credential sitting in a stale edge cache would defeat fail-closed. Bound any positive-verdict
- * cache by min(expiry, revocation-TTL, content-version).
+ * Three things the card DOES enforce, and they are the limit of it: no chrome at all without a
+ * `reviewerName` and a `verifyUrl`; a credential renders only welded to its dated verification
+ * (the fused pair); and the FTC disclosures render from locked constants, so rewriting the
+ * `compensationCue` / `scopeLine` options changes no pixel. Use the anchor when the page itself
+ * must not be able to state a credential.
+ *
+ * JSON-LD is DECOUPLED: the anchor renders the BADGE only (`omitJsonLd`). The article template
+ * emits the schema.org JSON-LD server-side from the same verified verdict, so a page builder
+ * can't duplicate, move, or omit structured data. See "The article route example" in the package
+ * README for the route both halves meet in.
+ *
+ * EDGE-CACHE DISCIPLINE: the consumer's loader MUST verify per request as a dynamic edge
+ * subrequest and must NOT long-cache the rendered badge HTML — a revoked/expired credential
+ * sitting in a stale edge cache would defeat fail-closed. Bound any positive-verdict cache by
+ * min(expiry, revocation-TTL, content-version).
  *
  * cert-block carries no Builder dependency: the registration shape is declared structurally, and
  * `isEditing` is a passed-in flag (the consumer supplies Builder's `isPreviewing()`).
@@ -28,7 +45,7 @@ import { createContext, type ReactNode, useContext } from 'react'
 import { CertReview } from '../components/CertReview.js'
 import type { CertVerdict } from '../contract/kernel.js'
 
-/** The current page's credential, resolved + verified by the loader (Track-1 delivery). */
+/** The current page's credential, resolved + verified by the consumer's loader. */
 export interface CurrentCredential {
 	readonly verdict: CertVerdict
 	/** Canonical page URL for JSON-LD @id alignment (used by the server-side JSON-LD, not the anchor). */
@@ -87,8 +104,8 @@ export function CertRevEditorPlaceholder() {
 /**
  * The Builder block. ZERO inputs — a layout anchor only. Renders the current page's VERIFIED
  * badge (badge only; JSON-LD is emitted server-side), the editor placeholder in design mode, or
- * NOTHING in production (fail-closed). The credential is whatever Track-1 delivered + verified for
- * THIS page; the editor can neither choose nor forge it.
+ * NOTHING in production (fail-closed). The credential is whatever the loader delivered + verified
+ * for THIS page; the editor can neither choose nor forge it.
  */
 export function CertRevAnchor() {
 	const { current, isEditing } = useContext(CertRevContext)
@@ -121,7 +138,7 @@ export const certRevAnchorComponent: CertRevBuilderRegistration = {
 	inputs: [],
 }
 
-// ── POR-10721 W1/W3: the Builder.io PUSH kit (CertReviewCard) + single-sourced wire type ──
+// ── The Builder.io PUSH kit (CertReviewCard) + the single-sourced wire type ──
 export {
 	BUILDER_CERT_CHROME_KEYS,
 	type BuilderCertChromeData,
@@ -133,10 +150,10 @@ export {
 	type BuilderInput,
 	CERT_COMPONENT_NAME,
 	type CertBlockBuilderRegistration,
-	certRevCertComponent,
 	CertReviewCard,
 	type CertReviewCardProps,
 	type CertReviewCardRegisteredComponent,
+	certRevCertComponent,
 	PLACEMENT_INPUTS,
 	WIRE_INPUTS,
 } from './cert-review-card.js'