@certrev/cert-block 1.1.0 → 1.1.1

package/dist/modal/ftc-guard.d.ts

@@ -1,85 +0,0 @@
-/**
- * FTC disclosure tamper guard for the NATIVE Shopify cert render (iframe→native parity).
- *
- * In the cross-origin iframe model the expert-memo embed inlined the portal's
- * `ftcTamperGuardScript()`: a kill switch that blanks the memo if the verbatim FTC
- * material-connection disclosure is stripped, hidden, or altered — making the MSA §3
- * anti-stripping covenant TECHNICALLY enforced, not just contractual. The native memo renders
- * in the host theme's DOM (no sandbox), so without this it would lose that runtime enforcement.
- * This module restores it: on load + on later DOM mutation it verifies the in-DOM
- * `[data-ftc-line]` is present, carries the EXACT verbatim text, and is actually visible; if not,
- * it neutralizes the memo with a neutral notice so the memo NEVER renders without its disclosure.
- *
- * Native-specific semantics (differ from the iframe, which only existed when a memo did):
- *   - Enforcement is keyed on the MEMO element (`.certrev-memo`). A certified article with NO
- *     memo legitimately has no `.certrev-memo` and no disclosure — the guard does NOT fire
- *     (no false positive on the no-memo path).
- *   - On tamper it neutralizes ONLY the memo (never `document.body` — we're in the host page).
- *   - The contributors card is governed by the badge re-verify (`revalidate.ts`), not this guard;
- *     the card carries only the one-word "Compensated" cue, never the guarded disclosure.
- *   - COVERAGE, and it is narrower than it reads: `.certrev-memo` / `.certrev-memo-wrap` are portal
- *     LIQUID markup — NOTHING in this package emits either. So the kill switch covers the Liquid
- *     memo surface and nothing else. `<CertBadge>` and `render-badge-html.ts` emit the same
- *     `[data-ftc-line]` hook inside a `.certrev-badge` (no memo), and `renderCertBlock` emits no
- *     hook at all; on those surfaces a pass verifies nothing and says so (`'unguarded'`) rather
- *     than reporting success, and no observer is installed at all. Widening enforcement to the
- *     badge is a live design decision, not an omission — see `FtcEnforcementResult`.
- *
- * Pure DOM, no crypto, no network. The expected text is the single source of truth
- * `FTC_DISCLOSURE_LINE` (imported, not copied — so a reword can never desync this guard).
- */
-export declare const FTC_LINE_SELECTOR = "[data-ftc-line]";
-export declare const MEMO_SELECTOR = ".certrev-memo";
-export declare const MEMO_WRAP_SELECTOR = ".certrev-memo-wrap";
-/** Marker on the neutral notice node that replaces a tampered memo (testable / idempotent). */
-export declare const FTC_NEUTRALIZED_ATTR = "data-certrev-ftc-neutralized";
-/** True when a memo's disclosure line is present, exactly verbatim, and visible. */
-export declare function isDisclosureIntact(memo: Element): boolean;
-/**
- * Replace a tampered memo with a neutral, self-contained notice — no reviewer attribution, no
- * seal — so the surface can never read as an endorsement without its required disclosure.
- */
-export declare function neutralizeMemo(memo: Element): void;
-/**
- * What ONE enforcement pass actually established:
- *   - `'intact'`    — at least one memo was checked, and every one carried its verbatim, visible line.
- *   - `'tampered'`  — at least one memo failed the check and was neutralized.
- *   - `'unguarded'` — the document holds no `.certrev-memo`, so the pass checked nothing.
- *
- * `'unguarded'` used to be reported as `true`, indistinguishable from `'intact'`, and that
- * conflation was a correctness bug, not a cosmetic one: `.certrev-memo` is portal Liquid markup
- * this package never emits, so on every React / Web Component / `renderCertBlock` surface the pass
- * finds nothing and answered "all intact" about a disclosure it had never looked at — the kill
- * switch silently reporting success on exactly the surfaces it does not protect.
- *
- * The legitimate no-memo certified article (card only, no memo, no disclosure owed) lands here too,
- * and the guard genuinely cannot tell the two apart from the DOM alone. That is the point of a
- * third state rather than a second boolean: "nothing was verified" is the honest answer to both,
- * and it is the caller — which knows which surface it rendered — that can tell whether that is
- * expected or a coverage gap.
- */
-export type FtcEnforcementResult = 'intact' | 'tampered' | 'unguarded';
-/**
- * Enforce the disclosure across every memo in the doc: neutralize any whose disclosure isn't
- * intact. A doc with no `.certrev-memo` is a no-op — see `FtcEnforcementResult` for why that is
- * `'unguarded'` and not success.
- */
-export declare function enforceFtcDisclosure(doc: Document): FtcEnforcementResult;
-/**
- * Install the guard once per document: enforce now (on DOM ready) and re-enforce on later DOM
- * mutations within the guarded subtree(s) — so a host script that strips / hides / edits the
- * disclosure after load still trips the kill switch. Idempotent.
- *
- * The observer scope is the memo wrap(s) — placement.ts relocates a wrap as a node, so the observer
- * tracks it wherever it moves — plus any memo sitting outside a wrap. When the document has
- * NEITHER, NO observer is installed at all. That bail-out is the whole storefront case, not an edge
- * one: this package emits neither selector (both are portal Liquid), so the old `<body>` fallback
- * was the only branch a React / Web Component / `renderCertBlock` page could take, and it pinned a
- * subtree + attributes + characterData observer — no `attributeFilter`, no coalescing — on the
- * host's entire page for the life of the tab, re-running an enforce pass on EVERY mutation a busy
- * storefront makes, to query a selector that could never match. A guard watching a page it cannot
- * act on is pure cost; `enforceFtcDisclosure`'s `'unguarded'` result is the correctness half of the
- * same gap.
- */
-export declare function installFtcGuard(doc: Document): void;
-//# sourceMappingURL=ftc-guard.d.ts.map

package/dist/modal/ftc-guard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ftc-guard.d.ts","sourceRoot":"","sources":["../../src/modal/ftc-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,eAAO,MAAM,iBAAiB,oBAAoB,CAAA;AAClD,eAAO,MAAM,aAAa,kBAAkB,CAAA;AAC5C,eAAO,MAAM,kBAAkB,uBAAuB,CAAA;AACtD,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,iCAAiC,CAAA;AAgClE,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAUlD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,UAAU,GAAG,WAAW,CAAA;AAEtE;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,QAAQ,GAAG,oBAAoB,CAWxE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,CA0BnD"}

package/dist/modal/ftc-guard.js

@@ -1,150 +0,0 @@
-/**
- * FTC disclosure tamper guard for the NATIVE Shopify cert render (iframe→native parity).
- *
- * In the cross-origin iframe model the expert-memo embed inlined the portal's
- * `ftcTamperGuardScript()`: a kill switch that blanks the memo if the verbatim FTC
- * material-connection disclosure is stripped, hidden, or altered — making the MSA §3
- * anti-stripping covenant TECHNICALLY enforced, not just contractual. The native memo renders
- * in the host theme's DOM (no sandbox), so without this it would lose that runtime enforcement.
- * This module restores it: on load + on later DOM mutation it verifies the in-DOM
- * `[data-ftc-line]` is present, carries the EXACT verbatim text, and is actually visible; if not,
- * it neutralizes the memo with a neutral notice so the memo NEVER renders without its disclosure.
- *
- * Native-specific semantics (differ from the iframe, which only existed when a memo did):
- *   - Enforcement is keyed on the MEMO element (`.certrev-memo`). A certified article with NO
- *     memo legitimately has no `.certrev-memo` and no disclosure — the guard does NOT fire
- *     (no false positive on the no-memo path).
- *   - On tamper it neutralizes ONLY the memo (never `document.body` — we're in the host page).
- *   - The contributors card is governed by the badge re-verify (`revalidate.ts`), not this guard;
- *     the card carries only the one-word "Compensated" cue, never the guarded disclosure.
- *   - COVERAGE, and it is narrower than it reads: `.certrev-memo` / `.certrev-memo-wrap` are portal
- *     LIQUID markup — NOTHING in this package emits either. So the kill switch covers the Liquid
- *     memo surface and nothing else. `<CertBadge>` and `render-badge-html.ts` emit the same
- *     `[data-ftc-line]` hook inside a `.certrev-badge` (no memo), and `renderCertBlock` emits no
- *     hook at all; on those surfaces a pass verifies nothing and says so (`'unguarded'`) rather
- *     than reporting success, and no observer is installed at all. Widening enforcement to the
- *     badge is a live design decision, not an omission — see `FtcEnforcementResult`.
- *
- * Pure DOM, no crypto, no network. The expected text is the single source of truth
- * `FTC_DISCLOSURE_LINE` (imported, not copied — so a reword can never desync this guard).
- */
-import { FTC_DISCLOSURE_LINE } from './ftc-disclosure.js';
-export const FTC_LINE_SELECTOR = '[data-ftc-line]';
-export const MEMO_SELECTOR = '.certrev-memo';
-export const MEMO_WRAP_SELECTOR = '.certrev-memo-wrap';
-/** Marker on the neutral notice node that replaces a tampered memo (testable / idempotent). */
-export const FTC_NEUTRALIZED_ATTR = 'data-certrev-ftc-neutralized';
-/**
- * Link qualification for the notice's CertREV anchor — a CertREV link on a brand's page that the
- * brand did not author, so it carries the same qualification as every other anchor this package
- * emits. Deliberately a LOCAL literal rather than an import of `CERTREV_LINK_REL`
- * (`../components/rel.ts`): `src/modal/` imports NOTHING from `src/components/` by design — every
- * shared string here (`ftc-disclosure.ts`, `logo-paths.ts`, `display-strings.ts`) is a modal-local
- * copy so the browser IIFE never drags the SSR renderer in. `ftc-guard.test.ts` imports the
- * components constant and asserts this value stays a superset of it, so the copies cannot drift.
- *
- * `noreferrer` rides ON TOP of the shared tokens (which omit it): this is the only anchor the
- * package opens with `target="_blank"`, and it fires from a page whose operator has just stripped
- * the disclosure — withholding the referrer there is worth the token.
- */
-const NOTICE_LINK_REL = 'nofollow sponsored noopener noreferrer';
-/** Documents already guarded, so a double script-load can't double-bind. */
-const guardedDocs = new WeakSet();
-/** Visible = not display:none / visibility:hidden / opacity:0 and a non-zero box. */
-function isVisible(el) {
-    const win = el.ownerDocument.defaultView;
-    // No view (detached / SSR): we can't measure, so don't treat as hidden — the text/presence
-    // checks still apply; only the layout-based hide vector is skipped.
-    if (!win)
-        return true;
-    const s = win.getComputedStyle(el);
-    if (s.display === 'none' || s.visibility === 'hidden' || Number.parseFloat(s.opacity || '1') === 0)
-        return false;
-    const r = el.getBoundingClientRect();
-    return r.width > 0 && r.height > 0;
-}
-/** True when a memo's disclosure line is present, exactly verbatim, and visible. */
-export function isDisclosureIntact(memo) {
-    const line = memo.querySelector(FTC_LINE_SELECTOR);
-    if (!line)
-        return false;
-    if ((line.textContent || '').trim() !== FTC_DISCLOSURE_LINE)
-        return false;
-    return isVisible(line);
-}
-/**
- * Replace a tampered memo with a neutral, self-contained notice — no reviewer attribution, no
- * seal — so the surface can never read as an endorsement without its required disclosure.
- */
-export function neutralizeMemo(memo) {
-    const doc = memo.ownerDocument;
-    const notice = doc.createElement('div');
-    notice.setAttribute(FTC_NEUTRALIZED_ATTR, '');
-    notice.style.cssText =
-        'font-family:system-ui,-apple-system,sans-serif;font-size:12px;color:#555;padding:12px;line-height:1.4';
-    notice.innerHTML =
-        'This CertREV verification cannot be displayed because its required disclosure was not shown. ' +
-            `<a href="https://certrev.com" style="color:#555" target="_blank" rel="${NOTICE_LINK_REL}">Learn more</a>.`;
-    memo.replaceWith(notice);
-}
-/**
- * Enforce the disclosure across every memo in the doc: neutralize any whose disclosure isn't
- * intact. A doc with no `.certrev-memo` is a no-op — see `FtcEnforcementResult` for why that is
- * `'unguarded'` and not success.
- */
-export function enforceFtcDisclosure(doc) {
-    const memos = Array.from(doc.querySelectorAll(MEMO_SELECTOR));
-    if (!memos.length)
-        return 'unguarded';
-    let result = 'intact';
-    for (const memo of memos) {
-        if (!isDisclosureIntact(memo)) {
-            result = 'tampered';
-            neutralizeMemo(memo);
-        }
-    }
-    return result;
-}
-/**
- * Install the guard once per document: enforce now (on DOM ready) and re-enforce on later DOM
- * mutations within the guarded subtree(s) — so a host script that strips / hides / edits the
- * disclosure after load still trips the kill switch. Idempotent.
- *
- * The observer scope is the memo wrap(s) — placement.ts relocates a wrap as a node, so the observer
- * tracks it wherever it moves — plus any memo sitting outside a wrap. When the document has
- * NEITHER, NO observer is installed at all. That bail-out is the whole storefront case, not an edge
- * one: this package emits neither selector (both are portal Liquid), so the old `<body>` fallback
- * was the only branch a React / Web Component / `renderCertBlock` page could take, and it pinned a
- * subtree + attributes + characterData observer — no `attributeFilter`, no coalescing — on the
- * host's entire page for the life of the tab, re-running an enforce pass on EVERY mutation a busy
- * storefront makes, to query a selector that could never match. A guard watching a page it cannot
- * act on is pure cost; `enforceFtcDisclosure`'s `'unguarded'` result is the correctness half of the
- * same gap.
- */
-export function installFtcGuard(doc) {
-    if (guardedDocs.has(doc))
-        return;
-    guardedDocs.add(doc);
-    const run = () => {
-        enforceFtcDisclosure(doc);
-    };
-    const start = () => {
-        run();
-        const MO = doc.defaultView?.MutationObserver;
-        if (!MO)
-            return;
-        // The guarded roots: the stable wrap(s), plus any memo not inside one (in the Liquid shape a
-        // wrap always contains its memo, so this is normally just the wraps). No root ⇒ no observer.
-        const wraps = Array.from(doc.querySelectorAll(MEMO_WRAP_SELECTOR));
-        const looseMemos = Array.from(doc.querySelectorAll(MEMO_SELECTOR)).filter((memo) => !memo.closest(MEMO_WRAP_SELECTOR));
-        for (const node of [...wraps, ...looseMemos]) {
-            const mo = new MO(run);
-            mo.observe(node, { childList: true, subtree: true, characterData: true, attributes: true });
-        }
-    };
-    if (doc.readyState === 'loading')
-        doc.addEventListener('DOMContentLoaded', start, { once: true });
-    else
-        start();
-}
-//# sourceMappingURL=ftc-guard.js.map

package/dist/modal/ftc-guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ftc-guard.js","sourceRoot":"","sources":["../../src/modal/ftc-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAEzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,iBAAiB,CAAA;AAClD,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAA;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAA;AACtD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAA;AAElE;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG,wCAAwC,CAAA;AAEhE,4EAA4E;AAC5E,MAAM,WAAW,GAAG,IAAI,OAAO,EAAY,CAAA;AAE3C,qFAAqF;AACrF,SAAS,SAAS,CAAC,EAAW;IAC7B,MAAM,GAAG,GAAG,EAAE,CAAC,aAAa,CAAC,WAAW,CAAA;IACxC,2FAA2F;IAC3F,oEAAoE;IACpE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,MAAM,CAAC,GAAG,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;IAClC,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAChH,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAA;IACpC,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;AACnC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAA;IAClD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACvB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAA;IACzE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAA;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,CAAC,YAAY,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAA;IAC7C,MAAM,CAAC,KAAK,CAAC,OAAO;QACnB,uGAAuG,CAAA;IACxG,MAAM,CAAC,SAAS;QACf,+FAA+F;YAC/F,yEAAyE,eAAe,mBAAmB,CAAA;IAC5G,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAA;AACzB,CAAC;AAsBD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAa;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAA;IAC7D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,WAAW,CAAA;IACrC,IAAI,MAAM,GAAyB,QAAQ,CAAA;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,UAAU,CAAA;YACnB,cAAc,CAAC,IAAI,CAAC,CAAA;QACrB,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,GAAa;IAC5C,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAM;IAChC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEpB,MAAM,GAAG,GAAG,GAAS,EAAE;QACtB,oBAAoB,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,GAAS,EAAE;QACxB,GAAG,EAAE,CAAA;QACL,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAA;QAC5C,IAAI,CAAC,EAAE;YAAE,OAAM;QACf,6FAA6F;QAC7F,6FAA6F;QAC7F,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAA;QAClE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CACxE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAC3C,CAAA;QACD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,EAAE,GAAG,UAAU,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,CAAA;YACtB,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5F,CAAC;IACF,CAAC,CAAA;IAED,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;;QAC5F,KAAK,EAAE,CAAA;AACb,CAAC"}

package/src/modal/ftc-guard.ts

@@ -1,174 +0,0 @@
-/**
- * FTC disclosure tamper guard for the NATIVE Shopify cert render (iframe→native parity).
- *
- * In the cross-origin iframe model the expert-memo embed inlined the portal's
- * `ftcTamperGuardScript()`: a kill switch that blanks the memo if the verbatim FTC
- * material-connection disclosure is stripped, hidden, or altered — making the MSA §3
- * anti-stripping covenant TECHNICALLY enforced, not just contractual. The native memo renders
- * in the host theme's DOM (no sandbox), so without this it would lose that runtime enforcement.
- * This module restores it: on load + on later DOM mutation it verifies the in-DOM
- * `[data-ftc-line]` is present, carries the EXACT verbatim text, and is actually visible; if not,
- * it neutralizes the memo with a neutral notice so the memo NEVER renders without its disclosure.
- *
- * Native-specific semantics (differ from the iframe, which only existed when a memo did):
- *   - Enforcement is keyed on the MEMO element (`.certrev-memo`). A certified article with NO
- *     memo legitimately has no `.certrev-memo` and no disclosure — the guard does NOT fire
- *     (no false positive on the no-memo path).
- *   - On tamper it neutralizes ONLY the memo (never `document.body` — we're in the host page).
- *   - The contributors card is governed by the badge re-verify (`revalidate.ts`), not this guard;
- *     the card carries only the one-word "Compensated" cue, never the guarded disclosure.
- *   - COVERAGE, and it is narrower than it reads: `.certrev-memo` / `.certrev-memo-wrap` are portal
- *     LIQUID markup — NOTHING in this package emits either. So the kill switch covers the Liquid
- *     memo surface and nothing else. `<CertBadge>` and `render-badge-html.ts` emit the same
- *     `[data-ftc-line]` hook inside a `.certrev-badge` (no memo), and `renderCertBlock` emits no
- *     hook at all; on those surfaces a pass verifies nothing and says so (`'unguarded'`) rather
- *     than reporting success, and no observer is installed at all. Widening enforcement to the
- *     badge is a live design decision, not an omission — see `FtcEnforcementResult`.
- *
- * Pure DOM, no crypto, no network. The expected text is the single source of truth
- * `FTC_DISCLOSURE_LINE` (imported, not copied — so a reword can never desync this guard).
- */
-
-import { FTC_DISCLOSURE_LINE } from './ftc-disclosure.js'
-
-export const FTC_LINE_SELECTOR = '[data-ftc-line]'
-export const MEMO_SELECTOR = '.certrev-memo'
-export const MEMO_WRAP_SELECTOR = '.certrev-memo-wrap'
-/** Marker on the neutral notice node that replaces a tampered memo (testable / idempotent). */
-export const FTC_NEUTRALIZED_ATTR = 'data-certrev-ftc-neutralized'
-
-/**
- * Link qualification for the notice's CertREV anchor — a CertREV link on a brand's page that the
- * brand did not author, so it carries the same qualification as every other anchor this package
- * emits. Deliberately a LOCAL literal rather than an import of `CERTREV_LINK_REL`
- * (`../components/rel.ts`): `src/modal/` imports NOTHING from `src/components/` by design — every
- * shared string here (`ftc-disclosure.ts`, `logo-paths.ts`, `display-strings.ts`) is a modal-local
- * copy so the browser IIFE never drags the SSR renderer in. `ftc-guard.test.ts` imports the
- * components constant and asserts this value stays a superset of it, so the copies cannot drift.
- *
- * `noreferrer` rides ON TOP of the shared tokens (which omit it): this is the only anchor the
- * package opens with `target="_blank"`, and it fires from a page whose operator has just stripped
- * the disclosure — withholding the referrer there is worth the token.
- */
-const NOTICE_LINK_REL = 'nofollow sponsored noopener noreferrer'
-
-/** Documents already guarded, so a double script-load can't double-bind. */
-const guardedDocs = new WeakSet<Document>()
-
-/** Visible = not display:none / visibility:hidden / opacity:0 and a non-zero box. */
-function isVisible(el: Element): boolean {
-	const win = el.ownerDocument.defaultView
-	// No view (detached / SSR): we can't measure, so don't treat as hidden — the text/presence
-	// checks still apply; only the layout-based hide vector is skipped.
-	if (!win) return true
-	const s = win.getComputedStyle(el)
-	if (s.display === 'none' || s.visibility === 'hidden' || Number.parseFloat(s.opacity || '1') === 0) return false
-	const r = el.getBoundingClientRect()
-	return r.width > 0 && r.height > 0
-}
-
-/** True when a memo's disclosure line is present, exactly verbatim, and visible. */
-export function isDisclosureIntact(memo: Element): boolean {
-	const line = memo.querySelector(FTC_LINE_SELECTOR)
-	if (!line) return false
-	if ((line.textContent || '').trim() !== FTC_DISCLOSURE_LINE) return false
-	return isVisible(line)
-}
-
-/**
- * Replace a tampered memo with a neutral, self-contained notice — no reviewer attribution, no
- * seal — so the surface can never read as an endorsement without its required disclosure.
- */
-export function neutralizeMemo(memo: Element): void {
-	const doc = memo.ownerDocument
-	const notice = doc.createElement('div')
-	notice.setAttribute(FTC_NEUTRALIZED_ATTR, '')
-	notice.style.cssText =
-		'font-family:system-ui,-apple-system,sans-serif;font-size:12px;color:#555;padding:12px;line-height:1.4'
-	notice.innerHTML =
-		'This CertREV verification cannot be displayed because its required disclosure was not shown. ' +
-		`<a href="https://certrev.com" style="color:#555" target="_blank" rel="${NOTICE_LINK_REL}">Learn more</a>.`
-	memo.replaceWith(notice)
-}
-
-/**
- * What ONE enforcement pass actually established:
- *   - `'intact'`    — at least one memo was checked, and every one carried its verbatim, visible line.
- *   - `'tampered'`  — at least one memo failed the check and was neutralized.
- *   - `'unguarded'` — the document holds no `.certrev-memo`, so the pass checked nothing.
- *
- * `'unguarded'` used to be reported as `true`, indistinguishable from `'intact'`, and that
- * conflation was a correctness bug, not a cosmetic one: `.certrev-memo` is portal Liquid markup
- * this package never emits, so on every React / Web Component / `renderCertBlock` surface the pass
- * finds nothing and answered "all intact" about a disclosure it had never looked at — the kill
- * switch silently reporting success on exactly the surfaces it does not protect.
- *
- * The legitimate no-memo certified article (card only, no memo, no disclosure owed) lands here too,
- * and the guard genuinely cannot tell the two apart from the DOM alone. That is the point of a
- * third state rather than a second boolean: "nothing was verified" is the honest answer to both,
- * and it is the caller — which knows which surface it rendered — that can tell whether that is
- * expected or a coverage gap.
- */
-export type FtcEnforcementResult = 'intact' | 'tampered' | 'unguarded'
-
-/**
- * Enforce the disclosure across every memo in the doc: neutralize any whose disclosure isn't
- * intact. A doc with no `.certrev-memo` is a no-op — see `FtcEnforcementResult` for why that is
- * `'unguarded'` and not success.
- */
-export function enforceFtcDisclosure(doc: Document): FtcEnforcementResult {
-	const memos = Array.from(doc.querySelectorAll(MEMO_SELECTOR))
-	if (!memos.length) return 'unguarded'
-	let result: FtcEnforcementResult = 'intact'
-	for (const memo of memos) {
-		if (!isDisclosureIntact(memo)) {
-			result = 'tampered'
-			neutralizeMemo(memo)
-		}
-	}
-	return result
-}
-
-/**
- * Install the guard once per document: enforce now (on DOM ready) and re-enforce on later DOM
- * mutations within the guarded subtree(s) — so a host script that strips / hides / edits the
- * disclosure after load still trips the kill switch. Idempotent.
- *
- * The observer scope is the memo wrap(s) — placement.ts relocates a wrap as a node, so the observer
- * tracks it wherever it moves — plus any memo sitting outside a wrap. When the document has
- * NEITHER, NO observer is installed at all. That bail-out is the whole storefront case, not an edge
- * one: this package emits neither selector (both are portal Liquid), so the old `<body>` fallback
- * was the only branch a React / Web Component / `renderCertBlock` page could take, and it pinned a
- * subtree + attributes + characterData observer — no `attributeFilter`, no coalescing — on the
- * host's entire page for the life of the tab, re-running an enforce pass on EVERY mutation a busy
- * storefront makes, to query a selector that could never match. A guard watching a page it cannot
- * act on is pure cost; `enforceFtcDisclosure`'s `'unguarded'` result is the correctness half of the
- * same gap.
- */
-export function installFtcGuard(doc: Document): void {
-	if (guardedDocs.has(doc)) return
-	guardedDocs.add(doc)
-
-	const run = (): void => {
-		enforceFtcDisclosure(doc)
-	}
-
-	const start = (): void => {
-		run()
-		const MO = doc.defaultView?.MutationObserver
-		if (!MO) return
-		// The guarded roots: the stable wrap(s), plus any memo not inside one (in the Liquid shape a
-		// wrap always contains its memo, so this is normally just the wraps). No root ⇒ no observer.
-		const wraps = Array.from(doc.querySelectorAll(MEMO_WRAP_SELECTOR))
-		const looseMemos = Array.from(doc.querySelectorAll(MEMO_SELECTOR)).filter(
-			(memo) => !memo.closest(MEMO_WRAP_SELECTOR),
-		)
-		for (const node of [...wraps, ...looseMemos]) {
-			const mo = new MO(run)
-			mo.observe(node, { childList: true, subtree: true, characterData: true, attributes: true })
-		}
-	}
-
-	if (doc.readyState === 'loading') doc.addEventListener('DOMContentLoaded', start, { once: true })
-	else start()
-}