@certrev/cert-block 0.5.4 → 1.0.0

package/src/components/CertBadge.tsx

@@ -15,7 +15,7 @@
  * `'full'` shows the photo, certified/updated dates, and the memo (per display flags). BOTH
  * styles carry the compensation cue + FTC scope line (the always-on compliance disclosures).
  *
- * THEMING (WS6): presentation defaults come from `payload.content.display`; an optional
+ * THEMING: presentation defaults come from `payload.content.display`; an optional
  * `renderDef` prop layers a brand's validated themeable tokens (emitted as `--certrev-*`
  * CSS custom properties) and its subtractive field-visibility on top. No `renderDef` → the
  * CertREV preset default (theme output byte-identical to un-themed).
@@ -23,7 +23,8 @@
 
 import type { CertContent, CertPayload } from '../contract/kernel.js'
 import { safeHttpUrl } from './escape.js'
-import { credentialSuffix, expertNameWithCredentials, formatDate, resolveDisplay } from './format.js'
+import { credentialSuffix, dedupeCredential, expertNameWithCredentials, formatDate, resolveDisplay } from './format.js'
+import { CERTREV_LINK_REL } from './rel.js'
 import {
 	CERT_SCOPE_LINE,
 	CERT_STRINGS_VERSION,
@@ -42,7 +43,7 @@ export interface CertBadgeProps {
 	/** Override the badge style independent of the signed display config. */
 	readonly badgeStyle?: 'full' | 'compact'
 	/**
-	 * The brand render-def (WS6). ABSENT → the badge renders the CertREV preset
+	 * The brand render-def. ABSENT → the badge renders the CertREV preset
 	 * default (fail-safe; theme output byte-identical to un-themed). PRESENT → its
 	 * validated themeable tokens are emitted as `--certrev-*` CSS custom properties
 	 * and its subtractive hide-set removes brand-toggleable fields. Invalid tokens
@@ -79,7 +80,8 @@ function ExpertPhoto({ content, show }: { content: CertContent; show: boolean })
 		<img
 			className={`${ROOT_CLASS}__photo`}
 			src={src}
-			alt={`Photo of ${content.expert.displayName}`}
+			// Decorative: the byline renders the same name as text right beside it.
+			alt=""
 			width={40}
 			height={40}
 			loading="lazy"
@@ -98,7 +100,10 @@ export function CertBadge(props: CertBadgeProps) {
 	const profileUrl = safeHttpUrl(content.expert.profileUrl)
 	const certifiedLabel = formatDate(content.certifiedAt)
 	const updatedLabel = formatDate(content.contentModifiedAt)
-	const suffix = credentialSuffix(content)
+	// Composed name + suffix, so the suffix drops a credential the stored display name already
+	// carries ("Dr. Erik Schraga, MD" + "MD, EM" → one "MD"). `credentialSuffix` stays whole for
+	// callers that render the list away from the name.
+	const suffix = dedupeCredential(content.expert.displayName, credentialSuffix(content))
 	const accent = display.accentColor
 
 	const rootClass = `${ROOT_CLASS} ${ROOT_CLASS}--${style}${props.className ? ` ${props.className}` : ''}`
@@ -107,7 +112,7 @@ export function CertBadge(props: CertBadgeProps) {
 	// A THEMED brand additionally emits the surface/radius/font vars; with no render-def
 	// `themeCssVarDeclarations` is empty, so the un-themed style is byte-identical.
 	const rootStyle: Record<string, string> = {
-		['--certrev-accent']: accent,
+		'--certrev-accent': accent,
 		borderInlineStartColor: accent,
 	}
 	for (const [name, value] of themeCssVarDeclarations(theme)) rootStyle[name] = value
@@ -136,7 +141,7 @@ export function CertBadge(props: CertBadgeProps) {
 					<span className={`${ROOT_CLASS}__byline`}>
 						Reviewed by{' '}
 						{profileUrl ? (
-							<a className={`${ROOT_CLASS}__expert-link`} href={profileUrl} rel="noopener">
+							<a className={`${ROOT_CLASS}__expert-link`} href={profileUrl} rel={CERTREV_LINK_REL}>
 								{expertName}
 							</a>
 						) : (
@@ -189,7 +194,7 @@ export function CertBadge(props: CertBadgeProps) {
 				<span className={`${ROOT_CLASS}__compensated-cue`}>
 					Compensated{' '}
 					{profileUrl ? (
-						<a className={`${ROOT_CLASS}__cue-link`} href={profileUrl} rel="noopener">
+						<a className={`${ROOT_CLASS}__cue-link`} href={profileUrl} rel={CERTREV_LINK_REL}>
 							expert
 						</a>
 					) : (
@@ -205,7 +210,7 @@ export function CertBadge(props: CertBadgeProps) {
 				<a
 					className={`${ROOT_CLASS}__verify`}
 					href={verifyUrl}
-					rel="noopener"
+					rel={CERTREV_LINK_REL}
 					aria-label="Verify this certification on CertREV"
 				>
 					Verify on CertREV

package/src/components/CertJsonLd.tsx

@@ -14,7 +14,7 @@
  */
 
 import type { CertPayload } from '../contract/kernel.js'
-import { projectCertJsonLd, type ProjectJsonLdOptions, serializeJsonLdForScript } from '../jsonld/project.js'
+import { type ProjectJsonLdOptions, projectCertJsonLd, serializeJsonLdForScript } from '../jsonld/project.js'
 
 export interface CertJsonLdProps extends ProjectJsonLdOptions {
 	readonly payload: CertPayload

package/src/components/CertRevBacklink.tsx

@@ -10,6 +10,7 @@
 import type { CertPayload } from '../contract/kernel.js'
 import { safeHttpUrl } from './escape.js'
 import { resolveDisplay } from './format.js'
+import { CERTREV_LINK_REL } from './rel.js'
 
 export interface CertRevBacklinkProps {
 	readonly payload: CertPayload
@@ -28,14 +29,14 @@ export function CertRevBacklink(props: CertRevBacklinkProps) {
 	const rootClass = `${ROOT_CLASS}${props.className ? ` ${props.className}` : ''}`
 	// Typed as a string record (not inline) so the `--certrev-accent` CSS custom property
 	// is accepted — React's CSSProperties rejects arbitrary custom props on an inline literal.
-	const rootStyle: Record<string, string> = { ['--certrev-accent']: display.accentColor, color: display.accentColor }
+	const rootStyle: Record<string, string> = { '--certrev-accent': display.accentColor, color: display.accentColor }
 
 	return (
 		<a
 			className={rootClass}
 			style={rootStyle}
 			href={verifyUrl}
-			rel="noopener"
+			rel={CERTREV_LINK_REL}
 			aria-label="Verify this certification on CertREV"
 		>
 			<svg
@@ -55,7 +56,13 @@ export function CertRevBacklink(props: CertRevBacklinkProps) {
 					strokeWidth="1.8"
 					strokeLinejoin="round"
 				/>
-				<path d="M8.5 12l2.3 2.3L15.5 9" stroke="currentColor" strokeWidth="1.8" strokeLinecap="round" strokeLinejoin="round" />
+				<path
+					d="M8.5 12l2.3 2.3L15.5 9"
+					stroke="currentColor"
+					strokeWidth="1.8"
+					strokeLinecap="round"
+					strokeLinejoin="round"
+				/>
 			</svg>
 			<span className={`${ROOT_CLASS}__label`}>{props.label ?? 'Verify on CertREV'}</span>
 		</a>

package/src/components/CertReview.tsx

@@ -22,7 +22,7 @@ export interface CertReviewProps {
 	readonly className?: string
 	readonly badgeStyle?: 'full' | 'compact'
 	/**
-	 * The brand render-def (WS6). Forwarded to `<CertBadge>` for themeable-token
+	 * The brand render-def. Forwarded to `<CertBadge>` for themeable-token
 	 * emission + subtractive visibility; absent → the CertREV preset default. The
 	 * JSON-LD is presentation-blind, so the def never touches the structured data.
 	 */

package/src/components/ExpertBio.tsx

@@ -8,7 +8,8 @@
 
 import type { CertPayload } from '../contract/kernel.js'
 import { safeHttpUrl } from './escape.js'
-import { resolveDisplay } from './format.js'
+import { credentialSuffix, dedupeCredential, resolveDisplay } from './format.js'
+import { CERTREV_LINK_REL } from './rel.js'
 
 export interface ExpertBioProps {
 	readonly payload: CertPayload
@@ -28,14 +29,16 @@ export function ExpertBio(props: ExpertBioProps) {
 	const photoUrl = display.showExpertPhoto ? safeHttpUrl(expert.photoUrl) : null
 	const Heading = props.headingLevel ?? 'h3'
 	const rootClass = `${ROOT_CLASS}${props.className ? ` ${props.className}` : ''}`
-	const rootStyle: Record<string, string> = { ['--certrev-accent']: display.accentColor }
+	const rootStyle: Record<string, string> = { '--certrev-accent': display.accentColor }
 
+	// Same composition rule as <CertBadge> / renderBadgeHtml: drop a credential the stored
+	// display name already carries, so one payload never reads "Dr. Erik Schraga, MD, MD, EM".
+	// The full list still renders below, away from the name, where every credential belongs.
+	const nameSuffix = dedupeCredential(expert.displayName, credentialSuffix(payload.content))
 	const nameNode = (
 		<Heading className={`${ROOT_CLASS}__name`}>
 			{expert.displayName}
-			{expert.credentials.length > 0 ? (
-				<span className={`${ROOT_CLASS}__credentials`}>, {expert.credentials.map((c) => c.abbreviation).join(', ')}</span>
-			) : null}
+			{nameSuffix ? <span className={`${ROOT_CLASS}__credentials`}>, {nameSuffix}</span> : null}
 		</Heading>
 	)
 
@@ -45,7 +48,9 @@ export function ExpertBio(props: ExpertBioProps) {
 				<img
 					className={`${ROOT_CLASS}__photo`}
 					src={photoUrl}
-					alt={`Photo of ${expert.displayName}`}
+					// Decorative: the name is announced by this aside's aria-label AND rendered as text
+					// immediately below, so alt text repeats it a third time. Matches the modal's avatar.
+					alt=""
 					width={64}
 					height={64}
 					loading="lazy"
@@ -54,7 +59,7 @@ export function ExpertBio(props: ExpertBioProps) {
 			) : null}
 			<div className={`${ROOT_CLASS}__body`}>
 				{profileUrl ? (
-					<a className={`${ROOT_CLASS}__name-link`} href={profileUrl} rel="noopener">
+					<a className={`${ROOT_CLASS}__name-link`} href={profileUrl} rel={CERTREV_LINK_REL}>
 						{nameNode}
 					</a>
 				) : (

package/src/components/escape.ts

@@ -12,8 +12,40 @@
  *
  * Everything here is pure and runtime-agnostic (no DOM, no Node APIs) so it runs in a
  * server component, an edge runtime, and the Web Component identically.
+ *
+ * Every helper here is TYPE-HOSTILE-SAFE, and that is load-bearing rather than defensive
+ * habit: these run downstream of `get-verified-envelope.ts`'s bare
+ * `JSON.parse(...) as CertDeliveryEnvelope` cast, and `verifyEnvelope` checks the SIGNATURE,
+ * never the SHAPE — so a number / object / array arrives where the contract promised a
+ * string. A `TypeError` here is not a missing badge: under `renderToReadableStream` it aborts
+ * the whole article route with zero HTML, and the Builder SDK ships no error boundary on its
+ * node/edge builds. So the family's contract is NEVER THROW — see `asText`.
  */
 
+/**
+ * Coerce an untyped value to renderable text. The rule is deliberately narrow:
+ *   • a string passes through untouched — every helper below preserves its exact string
+ *     semantics, because `escapeHtml` is the ONLY XSS boundary four hand-built-HTML
+ *     renderers have and any change to its string output is a security regression;
+ *   • a finite number renders as its digits (a stray count is at least legible copy);
+ *   • EVERYTHING ELSE — null, undefined, booleans, objects, arrays, functions, symbols,
+ *     NaN/Infinity — renders as empty.
+ *
+ * The last clause is the important one, and it is why this is not `String(input)`. Blind
+ * coercion would splice `[object Object]` (or a hostile `toString`'s payload) into the
+ * article body, and on a null-prototype object it throws the very TypeError this exists to
+ * prevent. A value that is not text is not copy; the correct render of it is nothing.
+ *
+ * Exported for `format.ts` only — so a helper there can't drift back to a bare dereference —
+ * and deliberately NOT re-exported from the package entry: an internal invariant, not a
+ * contract surface consumers should build on.
+ */
+export function asText(input: unknown): string {
+	if (typeof input === 'string') return input
+	if (typeof input === 'number') return Number.isFinite(input) ? String(input) : ''
+	return ''
+}
+
 const HTML_ESCAPES: Record<string, string> = {
 	'&': '&amp;',
 	'<': '&lt;',
@@ -23,8 +55,8 @@ const HTML_ESCAPES: Record<string, string> = {
 }
 
 /** Escape text for safe inclusion in HTML element content or double-quoted attributes. */
-export function escapeHtml(input: string): string {
-	return input.replace(/[&<>"']/g, (c) => HTML_ESCAPES[c] ?? c)
+export function escapeHtml(input: string | null | undefined): string {
+	return asText(input).replace(/[&<>"']/g, (c) => HTML_ESCAPES[c] ?? c)
 }
 
 /** Alias kept explicit at call sites where the value lands in an attribute. */
@@ -37,8 +69,7 @@ export const escapeAttribute = escapeHtml
  * Callers treat null as "omit the link".
  */
 export function safeHttpUrl(input: string | null | undefined): string | null {
-	if (!input) return null
-	const trimmed = input.trim()
+	const trimmed = asText(input).trim()
 	if (trimmed === '') return null
 	// Site-relative or protocol-relative URLs are safe (no scheme to abuse).
 	if (trimmed.startsWith('/') || trimmed.startsWith('#') || trimmed.startsWith('?')) return trimmed
@@ -57,8 +88,7 @@ export function safeHttpUrl(input: string | null | undefined): string | null {
  * `url(...)`, or break out of the style attribute. Returns null on anything suspicious.
  */
 export function safeCssColor(input: string | null | undefined): string | null {
-	if (!input) return null
-	const v = input.trim()
+	const v = asText(input).trim()
 	if (v === '') return null
 	if (/^#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/.test(v)) return v
 	if (/^(?:rgb|rgba|hsl|hsla)\(\s*[0-9.,%\s/]+\)$/.test(v)) return v
@@ -68,5 +98,5 @@ export function safeCssColor(input: string | null | undefined): string | null {
 
 /** Collapse interior whitespace + trim. Used to normalize display text. */
 export function tidyText(input: string | null | undefined): string {
-	return (input ?? '').replace(/\s+/g, ' ').trim()
+	return asText(input).replace(/\s+/g, ' ').trim()
 }

package/src/components/format.ts

@@ -4,6 +4,7 @@
  */
 
 import type { CertContent, CertDisplayConfig } from '../contract/kernel.js'
+import { asText } from './escape.js'
 import { type CertRenderDef, isFieldHidden, resolveRenderTheme } from './render-def.js'
 
 /** Default accent if the brand didn't pin one (CertREV teal). */
@@ -49,24 +50,119 @@ export function resolveDisplay(
  * We deliberately DON'T use `toLocaleDateString` — its output varies by runtime ICU data,
  * which would make SSR output non-deterministic + cause hydration mismatches. Fixed
  * English month abbreviations keep server + client byte-identical.
+ *
+ * ISO-8601 STRINGS ONLY — a non-string yields null. `Date.parse` coerces its argument, so an
+ * unguarded number sailed straight through as a YEAR: `formatDate(42)` returned "Jan 1, 2042"
+ * off a malformed envelope, while the number a caller would actually MEAN (epoch ms,
+ * 1750000000000) returned null. A date helper that invents a confident wrong certification
+ * date is worse than one that renders nothing, and the wire contract (`certifiedAt`,
+ * `contentModifiedAt`) is ISO-8601 strings — there is no second input format to honour.
  */
 const MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec']
 
 export function formatDate(iso: string | null | undefined): string | null {
-	if (!iso) return null
+	if (typeof iso !== 'string' || iso === '') return null
 	const ms = Date.parse(iso)
 	if (Number.isNaN(ms)) return null
 	const d = new Date(ms)
 	return `${MONTHS[d.getUTCMonth()]} ${d.getUTCDate()}, ${d.getUTCFullYear()}`
 }
 
-/** "PhD, RD" — the expert's credential abbreviations, comma-joined. */
+/**
+ * "PhD, RD" — the expert's credential abbreviations, comma-joined.
+ *
+ * Shape-guarded because the envelope reaching here was only SIGNATURE-checked: a signed
+ * payload whose `credentials` is absent or is not an array used to throw
+ * `TypeError: ...map is not a function` and take the host route down with it. An entry with
+ * no usable abbreviation is DROPPED rather than joined as empty — the old code rendered
+ * "Dr. Jane Doe, , RD" off one missing field. A well-formed envelope is byte-identical.
+ */
 export function credentialSuffix(content: CertContent): string {
-	return content.expert.credentials.map((c) => c.abbreviation).join(', ')
+	const credentials = content?.expert?.credentials
+	if (!Array.isArray(credentials)) return ''
+	return credentials
+		.map((c) => asText(c?.abbreviation))
+		.filter((abbreviation) => abbreviation !== '')
+		.join(', ')
+}
+
+/**
+ * Split a comma-separated label into its trimmed, non-empty parts.
+ * "Dr. Erik Schraga, MD" → `['Dr. Erik Schraga', 'MD']`.
+ */
+function commaTokens(value: string): string[] {
+	return value
+		.split(',')
+		.map((token) => token.trim())
+		.filter((token) => token !== '')
+}
+
+/**
+ * Fold one token to the form two spellings of the SAME credential share: case-insensitive,
+ * periods dropped, interior whitespace collapsed. "M.D." / "MD." / "md" → `md`.
+ */
+function credentialKey(token: string): string {
+	return token.toLowerCase().replace(/\./g, '').replace(/\s+/g, ' ').trim()
 }
 
-/** "Dr. Jane Doe, PhD, RD" — display name with credential suffix appended. */
+/**
+ * Drop from `credential` any token the display NAME already prints, so a name that arrives
+ * carrying its own post-nominal doesn't get it appended a second time — the defect that put
+ * "Dr. Erik Schraga, MD, MD, EM" on a live customer page (P2-6).
+ *
+ * THE ROOT CAUSE IS UPSTREAM DATA, NOT THIS FUNCTION. Portal cleans an expert display name
+ * with `cleanExpertDisplayName` and has DB CHECK constraints for exactly this shape
+ * (migration 20260506151204), but `resolveStampReviewerName` skips the cleaner and
+ * `package_drafts.expert_display_name` carries no constraint — so the duplicate is STORED,
+ * and a consumer reading the Delivery API directly still receives it. This is the render
+ * boundary refusing to print the same claim twice, nothing more.
+ *
+ * THE RULE, and why it is drawn this narrowly — a false positive here would delete a REAL
+ * credential from a compliance-facing card, which is worse than the duplicate it fixes:
+ *   • a credential token is dropped only when it equals a WHOLE comma-separated segment of
+ *     the name. Never a substring: "MD" must survive against "Dr. MDonald", "Jane Amdahl"
+ *     and "Md. Rahman", all of which a naive `name.includes(credential)` would gut;
+ *   • comparison is `credentialKey`'d, so "M.D." in the name cancels "MD" in the credential;
+ *   • the credential may be a LIST ("MD, FAAD"): each token is judged on its own, and the
+ *     survivors keep their original spelling and order. A name carrying only "MD" therefore
+ *     still renders ", FAAD" — no verified credential is ever lost to a partial overlap;
+ *   • nothing duplicated ⇒ the credential string is returned VERBATIM (not re-joined), so
+ *     the overwhelmingly common case is byte-identical to the pre-guard render.
+ *
+ * What it deliberately does NOT do: it never edits the NAME. "Dr. Erik Schraga, MD" keeps its
+ * inline "MD" — un-embedding a post-nominal is `cleanExpertDisplayName`'s job on the write
+ * path, and guessing at it here would be the same false-positive class in the other direction.
+ * It also cannot catch a duplicate spelled differently in the two fields ("Doctor of Medicine"
+ * in the name against "MD" in the credential) or one embedded mid-name rather than as its own
+ * segment ("Erik Schraga MD" with no comma) — both stay for the upstream fix.
+ */
+export function dedupeCredential(name: unknown, credential: unknown): string {
+	const suffix = asText(credential)
+	const tokens = commaTokens(suffix)
+	if (tokens.length === 0) return suffix
+	// Every segment of the name, not just the trailing ones: for a well-formed name the first
+	// segment is a human name and can never equal a credential token, and the one case where it
+	// does — a stored name that is NOTHING but a credential ("MD") — is exactly the case where
+	// dropping the suffix is right, since the token still renders once as the name.
+	const carried = new Set(commaTokens(asText(name)).map(credentialKey))
+	const kept = tokens.filter((token) => !carried.has(credentialKey(token)))
+	if (kept.length === tokens.length) return suffix
+	return kept.join(', ')
+}
+
+/**
+ * "Dr. Jane Doe, PhD, RD" — display name with credential suffix appended.
+ *
+ * With no name there is nobody to attribute the review to, so the whole label is empty:
+ * credentials alone would read as "Content reviewed by PhD, RD" in `CertBadge`'s aria-label.
+ *
+ * The suffix passes `dedupeCredential` because this composes name AND credential into one
+ * string; `credentialSuffix` above stays the full verified list, so a caller rendering the
+ * credentials AWAY from the name (a chip row, a standalone line) still gets every one of them.
+ */
 export function expertNameWithCredentials(content: CertContent): string {
-	const suffix = credentialSuffix(content)
-	return suffix ? `${content.expert.displayName}, ${suffix}` : content.expert.displayName
+	const name = asText(content?.expert?.displayName)
+	if (name === '') return ''
+	const suffix = dedupeCredential(name, credentialSuffix(content))
+	return suffix ? `${name}, ${suffix}` : name
 }

package/src/components/preview-block.ts

@@ -1,6 +1,6 @@
 /**
  * `renderPreviewBlock` — a STATIC, NON-DELIVERY preview of the cert block for pre-sales
- * look-demos (POR-10743, from the Builder demo).
+ * look-demos (lifted from the Builder demo).
  *
  * The visual is BYTE-FOR-BYTE `renderCertBlock` (pixel-parity — "see it on your own site
  * today"), wrapped in a `[data-certrev-preview]` container carrying a REQUIRED expiry.
@@ -37,7 +37,7 @@ export interface PreviewBlockOptions {
 	readonly labelText?: string
 }
 
-const DEFAULT_LABEL = 'Preview — not a verified certification'
+const DEFAULT_LABEL = 'Preview · Not a verified certification'
 
 /** Extract a preview block's baked expiry (ISO), or null if the HTML isn't a preview block. */
 export function previewExpiry(html: string): string | null {
@@ -65,7 +65,7 @@ export function renderPreviewBlock(input: RenderCertBlockInput, options: Preview
 		? `<div data-certrev-preview-label style="font:500 11px/1.4 ui-monospace,SFMono-Regular,Menlo,monospace;letter-spacing:.08em;text-transform:uppercase;color:#9a9a9a;margin-bottom:8px;">${escapeHtml(options.labelText ?? DEFAULT_LABEL)}</div>`
 		: ''
 	return (
-		`<!-- CertREV PREVIEW — static, non-revocable, NOT a verified certification. Expires ${escapeHtml(expires)}. Never use as delivery. -->` +
+		`<!-- CertREV PREVIEW: static, non-revocable, NOT a verified certification. Expires ${escapeHtml(expires)}. Never use as delivery. -->` +
 		`<div data-certrev-preview="1" data-certrev-preview-expires="${escapeAttribute(expires)}">` +
 		label +
 		renderCertBlock(input) +

package/src/components/rel.ts

@@ -0,0 +1,23 @@
+/**
+ * Link qualification for every anchor this package emits to a CertREV-owned host.
+ *
+ * The package renders links the consumer did not author and cannot edit: `CertBadgeProps`
+ * has no `rel` input, and the string renderers build their anchors internally. That makes
+ * qualification the PACKAGE's job — a consumer who wanted to qualify them has no seam to
+ * do it through.
+ *
+ * Google's link-spam policy treats a link a vendor requires on a customer's page as
+ * paid/placed unless it is qualified, and names the remedy explicitly: it is not a
+ * violation "as long as they are qualified with rel='nofollow' or rel='sponsored'".
+ * `sponsored` is the accurate token for a commercial placement; `nofollow` is carried
+ * alongside it because it is the token every downstream tool actually reads. `noopener`
+ * is unrelated to ranking and is kept for the window-handle hardening it always gave.
+ *
+ * There is NO override seam, deliberately: every anchor this package emits points at a
+ * CertREV-owned host (a profile URL or a verify URL, both carried on the signed payload —
+ * a brand cannot author either), so no consumer has a link of their own here to widen, and
+ * an opt-out would only be a way to un-qualify the placement the policy is about. The
+ * constant is exported so a consumer can READ the value and reason about it; the anchors
+ * themselves are not configurable.
+ */
+export const CERTREV_LINK_REL = 'nofollow sponsored noopener'