@certrev/cert-block 1.3.0 → 2.0.1

package/dist/builder/card-beacon.js

@@ -0,0 +1,178 @@
+/**
+ * The Builder card's beacon (2.0.1): what the card tells CertREV about itself, so a card that does not print on a brand's
+ * page is seen by CertREV and not only by the brand's console.
+ *
+ * One `POST <delivery origin>/api/cert/v1/beacon` per event, a `text/plain` JSON body (a CORS simple request, so no
+ * preflight; the origin is the delivery origin the page's `connect-src` already allows, so no new CSP source):
+ *
+ *     { v: 1, client: 'cert-block', clientVersion, contract, platform: 'builder', externalId, family,
+ *       events: [{ kind: 'fallback' | 'health', reason, outcome, status? }] }
+ *
+ * What it never carries: cookies (`credentials: 'omit'`), the page's address (`referrerPolicy: 'no-referrer'`) or text, the reader's user agent (only a
+ * coarse family: chromium, webkit, gecko, other, or server), or anything the reader typed. `externalId` is the Builder
+ * entry the block renders in, which the brand's page already sends to CertREV when it reads the card.
+ *
+ * How much: in a browser, every fallback (each placement and reason once per page, `card-report.ts`) and one health
+ * event per page in a hundred, at most three beacons per page (a page is a document address: an in-app navigation to
+ * another article starts a new budget); on a server, each placement, reason and origin at most
+ * once an hour per process, with a short deadline, never awaited. A beacon that fails is dropped: it never retries,
+ * never stores anything and never changes what the card prints.
+ */
+import { CARD_CONTRACT_VERSION } from './card-contract.js';
+import { CERT_BLOCK_VERSION } from './version.js';
+export const BEACON_PATH = '/api/cert/v1/beacon';
+/** Where a block with no accepted delivery marker reports: CertREV's production delivery origin. */
+export const DEFAULT_BEACON_ORIGIN = 'https://portal.certrev.com';
+/** The most beacons one page sends. */
+export const BEACON_MAX_PER_PAGE = 3;
+/** The share of page views that send one health event. */
+export const BEACON_HEALTH_SAMPLE = 0.01;
+/** A server sends one beacon per placement, reason and origin at most this often. */
+export const BEACON_SERVER_INTERVAL_MS = 3_600_000;
+const SERVER_MAX_KEYS = 500;
+const SERVER_TIMEOUT_MS = 1_500;
+/** The transport the card ships with: `fetch`, never awaited, never throwing (exported for CertREV's replica harness). */
+export const fetchBeaconTransport = (url, body, where) => {
+    try {
+        const send = globalThis.fetch;
+        if (typeof send !== 'function')
+            return;
+        const init = {
+            method: 'POST',
+            body,
+            headers: { 'content-type': 'text/plain;charset=UTF-8' },
+            credentials: 'omit',
+            // Never the reader's page address, whatever the storefront's Referrer-Policy.
+            referrerPolicy: 'no-referrer',
+            ...(where === 'browser'
+                ? // Opaque and kept alive: no CORS read of the answer, and it outlives a navigation away.
+                    { mode: 'no-cors', keepalive: true }
+                : typeof AbortSignal !== 'undefined' && typeof AbortSignal.timeout === 'function'
+                    ? { signal: AbortSignal.timeout(SERVER_TIMEOUT_MS) }
+                    : {}),
+        };
+        void send(url, init).catch(() => { });
+    }
+    catch {
+        // A beacon never throws into a render.
+    }
+};
+let transport = fetchBeaconTransport;
+let sentOnPage = 0;
+let healthDrawn = null;
+/** The document address the page budget belongs to. */
+let budgetPage = null;
+/** Start a new page budget when the document's address changed (an in-app navigation). */
+function samePageBudget() {
+    const page = typeof location !== 'undefined' ? `${location.pathname}${location.search}` : '';
+    if (page === budgetPage)
+        return;
+    budgetPage = page;
+    sentOnPage = 0;
+    healthDrawn = null;
+}
+const sentOnServer = new Map();
+let random = Math.random;
+let clock = Date.now;
+/** The coarse browser family, from the user agent; nothing else of it is kept. */
+export function browserFamily(userAgent) {
+    if (/Firefox\//.test(userAgent))
+        return 'gecko';
+    if (/(Chrome|Chromium|CriOS|Edg)\//.test(userAgent))
+        return 'chromium';
+    if (/AppleWebKit\//.test(userAgent))
+        return 'webkit';
+    return 'other';
+}
+/** The delivery origin a beacon goes to: an `https:` origin on certrev.com, else CertREV's production origin. */
+function beaconOrigin(baseUrl) {
+    if (!baseUrl)
+        return DEFAULT_BEACON_ORIGIN;
+    try {
+        const url = new URL(baseUrl);
+        const host = url.hostname;
+        if (url.protocol === 'https:' && (host === 'certrev.com' || host.endsWith('.certrev.com')))
+            return url.origin;
+    }
+    catch {
+        // Fall through.
+    }
+    return DEFAULT_BEACON_ORIGIN;
+}
+export function beaconBody(externalId, events, family) {
+    return {
+        v: 1,
+        client: 'cert-block',
+        clientVersion: CERT_BLOCK_VERSION,
+        contract: CARD_CONTRACT_VERSION,
+        platform: 'builder',
+        ...(externalId ? { externalId } : {}),
+        family,
+        events,
+    };
+}
+/** Send one event from the browser, within the page's budget. */
+export function sendBrowserBeacon(baseUrl, externalId, event) {
+    if (typeof document === 'undefined')
+        return;
+    samePageBudget();
+    if (sentOnPage >= BEACON_MAX_PER_PAGE)
+        return;
+    sentOnPage++;
+    const userAgent = typeof navigator !== 'undefined' ? String(navigator.userAgent ?? '') : '';
+    const body = beaconBody(externalId, [event], browserFamily(userAgent));
+    transport(`${beaconOrigin(baseUrl)}${BEACON_PATH}`, JSON.stringify(body), 'browser');
+}
+/** Send one health event from the browser on one page view in a hundred (drawn once per page). */
+export function maybeSendBrowserHealth(baseUrl, externalId) {
+    if (typeof document === 'undefined')
+        return;
+    samePageBudget();
+    if (healthDrawn === null)
+        healthDrawn = random() < BEACON_HEALTH_SAMPLE;
+    if (!healthDrawn)
+        return;
+    healthDrawn = false;
+    sendBrowserBeacon(baseUrl, externalId, { kind: 'health', reason: 'card_printed', outcome: 'ok' });
+}
+/** Send one event from a server: each placement, reason and origin at most once an hour per process. */
+export function sendServerBeacon(baseUrl, externalId, event) {
+    const origin = beaconOrigin(baseUrl);
+    const key = `${origin}|${externalId}|${event.kind}|${event.reason}`;
+    const now = clock();
+    const last = sentOnServer.get(key);
+    if (last !== undefined && now - last < BEACON_SERVER_INTERVAL_MS)
+        return;
+    sentOnServer.delete(key);
+    if (sentOnServer.size >= SERVER_MAX_KEYS) {
+        const oldest = sentOnServer.keys().next().value;
+        if (oldest !== undefined)
+            sentOnServer.delete(oldest);
+    }
+    sentOnServer.set(key, now);
+    transport(`${origin}${BEACON_PATH}`, JSON.stringify(beaconBody(externalId, [event], 'server')), 'server');
+}
+/**
+ * Test seam: replace the transport (and the sampling draw and clock) and forget the page's and the process's budget.
+ * Returns a restore.
+ */
+export function setCardBeaconForTests(overrides = {}) {
+    const previous = { transport, random, clock };
+    transport = overrides.transport ?? (() => { });
+    random = overrides.random ?? (() => 1);
+    clock = overrides.now ?? Date.now;
+    forgetCardBeaconsForTests();
+    return () => {
+        transport = previous.transport;
+        random = previous.random;
+        clock = previous.clock;
+    };
+}
+/** Test seam: a new page and a new process. */
+export function forgetCardBeaconsForTests() {
+    sentOnPage = 0;
+    healthDrawn = null;
+    budgetPage = null;
+    sentOnServer.clear();
+}
+//# sourceMappingURL=card-beacon.js.map

package/dist/builder/card-beacon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-beacon.js","sourceRoot":"","sources":["../../src/builder/card-beacon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEjD,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAA;AAChD,oGAAoG;AACpG,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAA;AACjE,uCAAuC;AACvC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAA;AACpC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAA;AACxC,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAA;AAClD,MAAM,eAAe,GAAG,GAAG,CAAA;AAC3B,MAAM,iBAAiB,GAAG,KAAK,CAAA;AA2B/B,0HAA0H;AAC1H,MAAM,CAAC,MAAM,oBAAoB,GAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;IACzE,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAA;QAC7B,IAAI,OAAO,IAAI,KAAK,UAAU;YAAE,OAAM;QACtC,MAAM,IAAI,GAAgB;YACzB,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;YACvD,WAAW,EAAE,MAAM;YACnB,8EAA8E;YAC9E,cAAc,EAAE,aAAa;YAC7B,GAAG,CAAC,KAAK,KAAK,SAAS;gBACtB,CAAC,CAAC,wFAAwF;oBACzF,EAAE,IAAI,EAAE,SAAkB,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC9C,CAAC,CAAC,OAAO,WAAW,KAAK,WAAW,IAAI,OAAO,WAAW,CAAC,OAAO,KAAK,UAAU;oBAChF,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE;oBACpD,CAAC,CAAC,EAAE,CAAC;SACP,CAAA;QACD,KAAK,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,uCAAuC;IACxC,CAAC;AACF,CAAC,CAAA;AAED,IAAI,SAAS,GAAoB,oBAAoB,CAAA;AACrD,IAAI,UAAU,GAAG,CAAC,CAAA;AAClB,IAAI,WAAW,GAAmB,IAAI,CAAA;AACtC,uDAAuD;AACvD,IAAI,UAAU,GAAkB,IAAI,CAAA;AAEpC,0FAA0F;AAC1F,SAAS,cAAc;IACtB,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC5F,IAAI,IAAI,KAAK,UAAU;QAAE,OAAM;IAC/B,UAAU,GAAG,IAAI,CAAA;IACjB,UAAU,GAAG,CAAC,CAAA;IACd,WAAW,GAAG,IAAI,CAAA;AACnB,CAAC;AACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;AAC9C,IAAI,MAAM,GAAiB,IAAI,CAAC,MAAM,CAAA;AACtC,IAAI,KAAK,GAAiB,IAAI,CAAC,GAAG,CAAA;AAElC,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC9C,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,CAAA;IAC/C,IAAI,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,CAAA;IACtE,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAA;IACpD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,iHAAiH;AACjH,SAAS,YAAY,CAAC,OAA2B;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,qBAAqB,CAAA;IAC1C,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAA;QACzB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC,MAAM,CAAA;IAC9G,CAAC;IAAC,MAAM,CAAC;QACR,gBAAgB;IACjB,CAAC;IACD,OAAO,qBAAqB,CAAA;AAC7B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,UAAkB,EAAE,MAA8B,EAAE,MAAoB;IAClG,OAAO;QACN,CAAC,EAAE,CAAC;QACJ,MAAM,EAAE,YAAY;QACpB,aAAa,EAAE,kBAAkB;QACjC,QAAQ,EAAE,qBAAqB;QAC/B,QAAQ,EAAE,SAAS;QACnB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM;QACN,MAAM;KACN,CAAA;AACF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,iBAAiB,CAAC,OAA2B,EAAE,UAAkB,EAAE,KAAkB;IACpG,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAM;IAC3C,cAAc,EAAE,CAAA;IAChB,IAAI,UAAU,IAAI,mBAAmB;QAAE,OAAM;IAC7C,UAAU,EAAE,CAAA;IACZ,MAAM,SAAS,GAAG,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3F,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC,CAAA;IACtE,SAAS,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAA;AACrF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,sBAAsB,CAAC,OAA2B,EAAE,UAAkB;IACrF,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAM;IAC3C,cAAc,EAAE,CAAA;IAChB,IAAI,WAAW,KAAK,IAAI;QAAE,WAAW,GAAG,MAAM,EAAE,GAAG,oBAAoB,CAAA;IACvE,IAAI,CAAC,WAAW;QAAE,OAAM;IACxB,WAAW,GAAG,KAAK,CAAA;IACnB,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;AAClG,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,gBAAgB,CAAC,OAA2B,EAAE,UAAkB,EAAE,KAAkB;IACnG,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,UAAU,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAA;IACnE,MAAM,GAAG,GAAG,KAAK,EAAE,CAAA;IACnB,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,yBAAyB;QAAE,OAAM;IACxE,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACxB,IAAI,YAAY,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAA;QAC/C,IAAI,MAAM,KAAK,SAAS;YAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;IACD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC1B,SAAS,CAAC,GAAG,MAAM,GAAG,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA;AAC1G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACpC,YAAwF,EAAE;IAE1F,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC7C,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC7C,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;IACtC,KAAK,GAAG,SAAS,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACjC,yBAAyB,EAAE,CAAA;IAC3B,OAAO,GAAG,EAAE;QACX,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;QAC9B,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;QACxB,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;IACvB,CAAC,CAAA;AACF,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,yBAAyB;IACxC,UAAU,GAAG,CAAC,CAAA;IACd,WAAW,GAAG,IAAI,CAAA;IAClB,UAAU,GAAG,IAAI,CAAA;IACjB,YAAY,CAAC,KAAK,EAAE,CAAA;AACrB,CAAC"}

package/dist/builder/card-contract.d.ts

@@ -0,0 +1,151 @@
+/**
+ * ─────────────────────────────────────────────────────────────────────────────
+ * The contract-1 card a Builder block prints (2.0.0): the server's card document, bound by the signed digest
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * CertREV's contract v1 (portal ADR 0001) moves the card to the server: one renderer paints every part of a placement
+ * into a CARD DOCUMENT, and every CMS client prints those parts verbatim. Nothing visual, no string a reader sees and
+ * no layout is computed here. The Builder Delivery response carries the document as an UNSIGNED top-level sibling,
+ * `card`, beside `payload`, `signature`, `renderDef` and `face`. What binds it is the signed
+ * `payload.content.faceDigest`, which for a contract-1 Builder placement is
+ *
+ *   { v: 1, defVersion, html, css, contract: 1, doc }
+ *
+ * where `doc` is the lowercase hex sha256 of the document's RFC 8785 bytes (cert-contract's `canonicalizeJson`) and
+ * `html`/`css` bind 1.3.x's delivered face, which this client no longer reads for such a placement.
+ *
+ * THE SCHEMA IS THE PORTAL'S (`src/lib/cert-delivery/card-document.ts`, `CardDocumentV1`; source read at portal
+ * v1-core d5e459b685). This module mirrors only the fields a client reads, read-only, and never redefines them: the
+ * digest covers the document's exact bytes, so `parseCardDocument` returns the object it was given, never a copy.
+ *
+ * Which path a verified delivery takes is decided by the SIGNED binding alone (`acceptedCardBinding`):
+ *  - no `contract` key in the digest (every brand without CertREV's contract-1 entitlement): the 1.3.1 path, unchanged;
+ *  - a well-formed contract-1 binding: the card, only when the served document hashes to `doc` and names the same
+ *    design version, certificate and placement (`cardBinds`); anything else prints nothing and is reported;
+ *  - a `contract` key that is not a well-formed contract-1 binding (a later contract, a malformed digest): nothing, and
+ *    reported. A client refuses a contract it does not support (ADR 0001, section 2).
+ *
+ * React-free. Hashing uses WebCrypto (`crypto.subtle.digest`), as the kernel and the 1.3.0 face gate do, so it runs
+ * wherever the card verifies (Node SSR, edge runtimes, a browser in a secure context); the card owns the suspension.
+ */
+import { type CertContent, type CertPayload } from '../contract/kernel.js';
+/** The contract this client prints. */
+export declare const CARD_CONTRACT_VERSION = 1;
+/** The part names a document can hold, by where they go: banner card and memo, the sidebar rail, the floating pill. */
+export declare const CARD_PART_NAMES: readonly ["top", "bottom", "rail", "pill"];
+export type CardPartName = (typeof CARD_PART_NAMES)[number];
+/** The layouts a document paints. */
+export type CardLayout = 'banner' | 'sidebar' | 'floating';
+/**
+ * The fields of the portal's `CardDocumentV1` this client reads. The document carries more (`renderer`, `placement`,
+ * `jsonld`, `lifecycle`, `cache`, `illustrative`); they are part of the digest and printed nowhere by Builder.
+ */
+export interface CardDocumentV1 {
+    readonly contract: 1;
+    readonly kind: 'certrev.card';
+    readonly certId: string;
+    readonly subject: {
+        readonly platform: string;
+        readonly externalId: string;
+    };
+    readonly defVersion: number;
+    readonly layout: CardLayout;
+    /** Each part is one complete `<certrev-card>` host holding a declarative shadow root. */
+    readonly parts: Partial<Record<CardPartName, string>>;
+    /** CertREV's own certificate and expert-profile dialogs: complete hosts, identical on every brand and CMS. */
+    readonly dialogs: {
+        readonly expert?: string;
+        readonly certificate?: string;
+    };
+    readonly assets: {
+        /** A complete `<style data-certrev-card-head>` fragment: the pill's fixed box and the fonts. */
+        readonly head: string;
+        /** The hosted runtime (dialogs, revalidate, polyfill), present once CertREV serves it. */
+        readonly runtime?: {
+            readonly src: string;
+            readonly integrity: string;
+        };
+    };
+}
+/** The signed binding of a contract-1 card, as the verified `content.faceDigest` carries it. */
+export interface CardBinding {
+    readonly contract: 1;
+    readonly defVersion: number;
+    readonly doc: string;
+}
+/**
+ * The signed binding, judged:
+ *  - `null`: the verified content's digest has no `contract` key (or there is no digest): not a contract-1 placement,
+ *    so the card paints what 1.3.1 paints;
+ *  - a `CardBinding`: `{ v: 1, contract: 1 }` with a non-negative integer `defVersion` and a 64-char lowercase hex `doc`
+ *    (`html` and `css` may be there or not; this client does not read them);
+ *  - `'unsupported'`: a `contract` key with anything else (another contract, a malformed binding). Fails closed.
+ */
+export declare function acceptedCardBinding(content: CertContent | null | undefined): CardBinding | 'unsupported' | null;
+/**
+ * The served document, shape-checked for what this client reads: the object itself when it is a contract-1 card
+ * document, else null. Nothing is copied or normalised (the digest covers the object as served). Parts it does not
+ * know are left in place (they are part of the digest) and never printed.
+ */
+export declare function parseCardDocument(value: unknown): CardDocumentV1 | null;
+/** Lowercase hex sha256 of a document's RFC 8785 bytes; null when it cannot be canonicalized or hashed. */
+export declare function cardDocumentDigest(card: unknown): Promise<string | null>;
+/** One document's digest: the pending hash, and its answer once settled (null never matches). */
+export interface CardDigestMemo {
+    readonly pending: Promise<string | null>;
+    settled?: {
+        readonly digest: string | null;
+    };
+}
+/**
+ * The memoized digest of one document, keyed by its canonical bytes (a seed parsed afresh from the page and the
+ * server's cached read of the same document share one entry). A document that cannot be canonicalized settles to null
+ * at once, without a key.
+ */
+export declare function cardDigestFor(card: unknown): CardDigestMemo;
+/** Test seam: forget every document's digest (a new process). */
+export declare function forgetCardDigestsForTests(): void;
+/**
+ * The synchronous half of the check: the document binds this binding, payload and placement in everything but its
+ * bytes (contract, design version, certificate, and the Builder placement it was painted for).
+ */
+export declare function cardMatchesPlacement(card: CardDocumentV1, binding: CardBinding, payload: CertPayload, externalId: string): boolean;
+/** The asynchronous half's verdict: the document's own digest is the signed one. */
+export declare function cardDigestMatches(digest: string | null, binding: CardBinding): boolean;
+/** Both halves at once (for callers outside React): the served document is the one the verified envelope signs. */
+export declare function cardBinds(card: CardDocumentV1, binding: CardBinding, payload: CertPayload, externalId: string): Promise<boolean>;
+/**
+ * The parts one Builder block prints, in page order. The saved design decides the layout (the block's `mode` is not
+ * read). A banner block prints its card (`top`) and its memo (`bottom`); a block whose `part` is `'header'` prints the
+ * card only, and one whose `part` is `'memo'` the memo only, so a split banner prints each part once. Outside the
+ * banner a `'memo'` block prints nothing and any other block the design's one part (the rail, the pill): a page that
+ * kept its split header and memo blocks after the brand chose a sidebar design shows one sidebar card, not two.
+ */
+export declare function cardPartsFor(card: CardDocumentV1, part: unknown): CardPartName[];
+/** The runtime's tag, or '' when the document names none. */
+export declare function cardRuntimeTag(card: CardDocumentV1): string;
+/**
+ * The document's first part: `top`, else `rail`, else `pill`, from the document's own parts (the lead's ruling on ADR
+ * 0001's head-once-per-page, relay 074dbd2c8ef3); `bottom` only for a document with none of those, so its head and
+ * dialogs always have a block to print them. Null for a document with no part.
+ */
+export declare function cardFirstPart(card: CardDocumentV1): CardPartName | null;
+/** Whether the block printing `names` prints the page's head fragment, dialogs and runtime: it holds the first part. */
+export declare function cardCarriesAssets(card: CardDocumentV1, names: readonly CardPartName[]): boolean;
+/**
+ * 2.0.1: the page's CertREV graph, when the document carries one CertREV's server resolved for this placement
+ * (`card.jsonld.graph`: a complete JSON-LD object, every link and page fact filled in, an additive key under contract
+ * 1). Printed verbatim as `<script type="application/ld+json" data-certrev-graph ...>`, with every `<` written as
+ * `\u003c` so no value can close the element; '' when the document has no graph. The block never builds or edits the
+ * graph: what it says, and when it changes, is the server's.
+ */
+export declare function cardGraphTag(card: CardDocumentV1): string;
+/**
+ * Exactly what a block prints inside its wrapper: its parts in page order and, only in the block holding the document's
+ * first part (`cardCarriesAssets`), the head fragment before them and both dialogs (expert, then certificate), the
+ * runtime's tag and (2.0.1) the page's graph after. So a split banner (a header block and a memo block) prints the head, the dialogs and the runtime
+ * once, in the header block, with no coordination between the blocks and with JavaScript off; the runtime finds a
+ * control's dialog anywhere on the page by its placement. Every byte but the runtime tag is the document's own.
+ */
+export declare function cardHtml(card: CardDocumentV1, names: readonly CardPartName[]): string;
+//# sourceMappingURL=card-contract.d.ts.map

package/dist/builder/card-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-contract.d.ts","sourceRoot":"","sources":["../../src/builder/card-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAoB,MAAM,uBAAuB,CAAA;AAG5F,uCAAuC;AACvC,eAAO,MAAM,qBAAqB,IAAI,CAAA;AAEtC,uHAAuH;AACvH,eAAO,MAAM,eAAe,4CAA6C,CAAA;AACzE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAE3D,qCAAqC;AACrC,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAA;AAG1D;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAA;IACrD,8GAA8G;IAC9G,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7E,QAAQ,CAAC,MAAM,EAAE;QAChB,gGAAgG;QAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;QACrB,0FAA0F;QAC1F,QAAQ,CAAC,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAA;KACvE,CAAA;CACD;AAED,gGAAgG;AAChG,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACpB;AAQD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,aAAa,GAAG,IAAI,CAU/G;AAwBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAyBvE;AAED,2GAA2G;AAC3G,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAY9E;AAED,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACxC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAC5C;AAMD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAyB3D;AAED,iEAAiE;AACjE,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CACnC,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,GAChB,OAAO,CAQT;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAEtF;AAED,mHAAmH;AACnH,wBAAsB,SAAS,CAC9B,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,WAAW,EACpB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,GAAG,YAAY,EAAE,CAUhF;AAMD,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAI3D;AAKD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,YAAY,GAAG,IAAI,CAEvE;AAED,wHAAwH;AACxH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,OAAO,CAG/F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,CAazD;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAMrF"}

package/dist/builder/card-contract.js

@@ -0,0 +1,286 @@
+/**
+ * ─────────────────────────────────────────────────────────────────────────────
+ * The contract-1 card a Builder block prints (2.0.0): the server's card document, bound by the signed digest
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * CertREV's contract v1 (portal ADR 0001) moves the card to the server: one renderer paints every part of a placement
+ * into a CARD DOCUMENT, and every CMS client prints those parts verbatim. Nothing visual, no string a reader sees and
+ * no layout is computed here. The Builder Delivery response carries the document as an UNSIGNED top-level sibling,
+ * `card`, beside `payload`, `signature`, `renderDef` and `face`. What binds it is the signed
+ * `payload.content.faceDigest`, which for a contract-1 Builder placement is
+ *
+ *   { v: 1, defVersion, html, css, contract: 1, doc }
+ *
+ * where `doc` is the lowercase hex sha256 of the document's RFC 8785 bytes (cert-contract's `canonicalizeJson`) and
+ * `html`/`css` bind 1.3.x's delivered face, which this client no longer reads for such a placement.
+ *
+ * THE SCHEMA IS THE PORTAL'S (`src/lib/cert-delivery/card-document.ts`, `CardDocumentV1`; source read at portal
+ * v1-core d5e459b685). This module mirrors only the fields a client reads, read-only, and never redefines them: the
+ * digest covers the document's exact bytes, so `parseCardDocument` returns the object it was given, never a copy.
+ *
+ * Which path a verified delivery takes is decided by the SIGNED binding alone (`acceptedCardBinding`):
+ *  - no `contract` key in the digest (every brand without CertREV's contract-1 entitlement): the 1.3.1 path, unchanged;
+ *  - a well-formed contract-1 binding: the card, only when the served document hashes to `doc` and names the same
+ *    design version, certificate and placement (`cardBinds`); anything else prints nothing and is reported;
+ *  - a `contract` key that is not a well-formed contract-1 binding (a later contract, a malformed digest): nothing, and
+ *    reported. A client refuses a contract it does not support (ADR 0001, section 2).
+ *
+ * React-free. Hashing uses WebCrypto (`crypto.subtle.digest`), as the kernel and the 1.3.0 face gate do, so it runs
+ * wherever the card verifies (Node SSR, edge runtimes, a browser in a secure context); the card owns the suspension.
+ */
+import { canonicalizeJson } from '../contract/kernel.js';
+import { evictOldestSettled, sha256HexUtf8 } from './delivered-face.js';
+/** The contract this client prints. */
+export const CARD_CONTRACT_VERSION = 1;
+/** The part names a document can hold, by where they go: banner card and memo, the sidebar rail, the floating pill. */
+export const CARD_PART_NAMES = ['top', 'bottom', 'rail', 'pill'];
+const CARD_LAYOUTS = ['banner', 'sidebar', 'floating'];
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+const SRI = /^(?:sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2}(?:\s+(?:sha256|sha384|sha512)-[A-Za-z0-9+/]+={0,2})*$/;
+const isRecord = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const isString = (v) => typeof v === 'string';
+/**
+ * The signed binding, judged:
+ *  - `null`: the verified content's digest has no `contract` key (or there is no digest): not a contract-1 placement,
+ *    so the card paints what 1.3.1 paints;
+ *  - a `CardBinding`: `{ v: 1, contract: 1 }` with a non-negative integer `defVersion` and a 64-char lowercase hex `doc`
+ *    (`html` and `css` may be there or not; this client does not read them);
+ *  - `'unsupported'`: a `contract` key with anything else (another contract, a malformed binding). Fails closed.
+ */
+export function acceptedCardBinding(content) {
+    const digest = content?.faceDigest;
+    // Own keys via `Object.keys`, not `Object.hasOwn`: this runs for every verified placement, in browsers 1.3.1 painted in
+    // (Safari before 15.4 has no `Object.hasOwn`; break-it B3).
+    if (!isRecord(digest) || !Object.keys(digest).includes('contract'))
+        return null;
+    const { v, contract, defVersion, doc } = digest;
+    if (v !== 1 || contract !== CARD_CONTRACT_VERSION)
+        return 'unsupported';
+    if (typeof defVersion !== 'number' || !Number.isSafeInteger(defVersion) || defVersion < 0)
+        return 'unsupported';
+    if (!isString(doc) || !SHA256_HEX.test(doc))
+        return 'unsupported';
+    return { contract: CARD_CONTRACT_VERSION, defVersion, doc };
+}
+/**
+ * The runtime's `src` must be CertREV's: an `https:` URL on `certrev.com` or one of its subdomains, with no credentials
+ * and no port (the rule the delivery marker's origin follows). Anything else is not a runtime, so no document, even one
+ * planted in a page's record, can make the card load a script from elsewhere (break-it B7).
+ */
+function isCertrevRuntimeUrl(value) {
+    if (!isString(value))
+        return false;
+    try {
+        const url = new URL(value);
+        const host = url.hostname.toLowerCase();
+        return (url.protocol === 'https:' &&
+            !url.username &&
+            !url.password &&
+            !url.port &&
+            (host === 'certrev.com' || host.endsWith('.certrev.com')));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The served document, shape-checked for what this client reads: the object itself when it is a contract-1 card
+ * document, else null. Nothing is copied or normalised (the digest covers the object as served). Parts it does not
+ * know are left in place (they are part of the digest) and never printed.
+ */
+export function parseCardDocument(value) {
+    if (!isRecord(value))
+        return null;
+    const { contract, kind, certId, subject, defVersion, layout, parts, dialogs, assets } = value;
+    if (contract !== CARD_CONTRACT_VERSION || kind !== 'certrev.card' || !isString(certId))
+        return null;
+    if (!isRecord(subject) || !isString(subject.platform) || !isString(subject.externalId))
+        return null;
+    if (typeof defVersion !== 'number' || !Number.isSafeInteger(defVersion) || defVersion < 0)
+        return null;
+    if (!isString(layout) || !CARD_LAYOUTS.includes(layout))
+        return null;
+    if (!isRecord(parts))
+        return null;
+    for (const name of CARD_PART_NAMES)
+        if (parts[name] !== undefined && !isString(parts[name]))
+            return null;
+    if (!isRecord(dialogs))
+        return null;
+    if (dialogs.expert !== undefined && !isString(dialogs.expert))
+        return null;
+    if (dialogs.certificate !== undefined && !isString(dialogs.certificate))
+        return null;
+    if (!isRecord(assets) || !isString(assets.head))
+        return null;
+    if (assets.runtime !== undefined) {
+        const runtime = assets.runtime;
+        if (!isRecord(runtime) ||
+            !isCertrevRuntimeUrl(runtime.src) ||
+            !isString(runtime.integrity) ||
+            !SRI.test(runtime.integrity)) {
+            return null;
+        }
+    }
+    return value;
+}
+/** Lowercase hex sha256 of a document's RFC 8785 bytes; null when it cannot be canonicalized or hashed. */
+export async function cardDocumentDigest(card) {
+    let canonical;
+    try {
+        canonical = canonicalizeJson(card);
+    }
+    catch {
+        return null;
+    }
+    try {
+        return await sha256HexUtf8(canonical);
+    }
+    catch {
+        return null;
+    }
+}
+/** How many documents' digests are kept (insertion order; the oldest goes first). A page holds one or a few. */
+const CARD_DIGEST_MEMO_MAX = 32;
+const cardDigestMemo = new Map();
+/**
+ * The memoized digest of one document, keyed by its canonical bytes (a seed parsed afresh from the page and the
+ * server's cached read of the same document share one entry). A document that cannot be canonicalized settles to null
+ * at once, without a key.
+ */
+export function cardDigestFor(card) {
+    let key;
+    try {
+        key = canonicalizeJson(card);
+    }
+    catch {
+        const failed = { pending: Promise.resolve(null), settled: { digest: null } };
+        return failed;
+    }
+    const known = cardDigestMemo.get(key);
+    if (known)
+        return known;
+    const fresh = {
+        pending: sha256HexUtf8(key).then((digest) => {
+            fresh.settled = { digest };
+            return digest;
+        }, () => {
+            fresh.settled = { digest: null };
+            return null;
+        }),
+    };
+    evictOldestSettled(cardDigestMemo, CARD_DIGEST_MEMO_MAX);
+    cardDigestMemo.set(key, fresh);
+    return fresh;
+}
+/** Test seam: forget every document's digest (a new process). */
+export function forgetCardDigestsForTests() {
+    cardDigestMemo.clear();
+}
+/**
+ * The synchronous half of the check: the document binds this binding, payload and placement in everything but its
+ * bytes (contract, design version, certificate, and the Builder placement it was painted for).
+ */
+export function cardMatchesPlacement(card, binding, payload, externalId) {
+    return (card.contract === binding.contract &&
+        card.defVersion === binding.defVersion &&
+        card.certId === payload.certId &&
+        card.subject.platform === 'builder' &&
+        card.subject.externalId === externalId);
+}
+/** The asynchronous half's verdict: the document's own digest is the signed one. */
+export function cardDigestMatches(digest, binding) {
+    return digest !== null && digest === binding.doc;
+}
+/** Both halves at once (for callers outside React): the served document is the one the verified envelope signs. */
+export async function cardBinds(card, binding, payload, externalId) {
+    if (!cardMatchesPlacement(card, binding, payload, externalId))
+        return false;
+    return cardDigestMatches(await cardDigestFor(card).pending, binding);
+}
+/**
+ * The parts one Builder block prints, in page order. The saved design decides the layout (the block's `mode` is not
+ * read). A banner block prints its card (`top`) and its memo (`bottom`); a block whose `part` is `'header'` prints the
+ * card only, and one whose `part` is `'memo'` the memo only, so a split banner prints each part once. Outside the
+ * banner a `'memo'` block prints nothing and any other block the design's one part (the rail, the pill): a page that
+ * kept its split header and memo blocks after the brand chose a sidebar design shows one sidebar card, not two.
+ */
+export function cardPartsFor(card, part) {
+    let names;
+    if (card.layout === 'banner') {
+        names = part === 'header' ? ['top'] : part === 'memo' ? ['bottom'] : ['top', 'bottom'];
+    }
+    else if (part === 'memo') {
+        names = [];
+    }
+    else {
+        names = card.layout === 'sidebar' ? ['rail'] : ['pill'];
+    }
+    return names.filter((name) => typeof card.parts[name] === 'string');
+}
+function escapeAttribute(value) {
+    return value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+/** The runtime's tag, or '' when the document names none. */
+export function cardRuntimeTag(card) {
+    const runtime = card.assets.runtime;
+    if (!runtime)
+        return '';
+    return `<script src="${escapeAttribute(runtime.src)}" integrity="${escapeAttribute(runtime.integrity)}" crossorigin="anonymous" defer></script>`;
+}
+/** Which of the document's parts is its first, in this order: the block holding it prints the page's assets. */
+const CARD_FIRST_PART_ORDER = ['top', 'rail', 'pill', 'bottom'];
+/**
+ * The document's first part: `top`, else `rail`, else `pill`, from the document's own parts (the lead's ruling on ADR
+ * 0001's head-once-per-page, relay 074dbd2c8ef3); `bottom` only for a document with none of those, so its head and
+ * dialogs always have a block to print them. Null for a document with no part.
+ */
+export function cardFirstPart(card) {
+    return CARD_FIRST_PART_ORDER.find((name) => typeof card.parts[name] === 'string') ?? null;
+}
+/** Whether the block printing `names` prints the page's head fragment, dialogs and runtime: it holds the first part. */
+export function cardCarriesAssets(card, names) {
+    const first = cardFirstPart(card);
+    return first !== null && names.includes(first);
+}
+/**
+ * 2.0.1: the page's CertREV graph, when the document carries one CertREV's server resolved for this placement
+ * (`card.jsonld.graph`: a complete JSON-LD object, every link and page fact filled in, an additive key under contract
+ * 1). Printed verbatim as `<script type="application/ld+json" data-certrev-graph ...>`, with every `<` written as
+ * `\u003c` so no value can close the element; '' when the document has no graph. The block never builds or edits the
+ * graph: what it says, and when it changes, is the server's.
+ */
+export function cardGraphTag(card) {
+    const jsonld = card.jsonld;
+    if (typeof jsonld !== 'object' || jsonld === null)
+        return '';
+    const graph = jsonld.graph;
+    if (typeof graph !== 'object' || graph === null || Array.isArray(graph))
+        return '';
+    let json;
+    try {
+        json = JSON.stringify(graph);
+    }
+    catch {
+        return '';
+    }
+    const id = escapeAttribute(card.subject.externalId);
+    return `<script type="application/ld+json" data-certrev-graph="" data-certrev-platform="builder" data-certrev-external-id="${id}">${json.replace(/</g, '\\u003c')}</script>`;
+}
+/**
+ * Exactly what a block prints inside its wrapper: its parts in page order and, only in the block holding the document's
+ * first part (`cardCarriesAssets`), the head fragment before them and both dialogs (expert, then certificate), the
+ * runtime's tag and (2.0.1) the page's graph after. So a split banner (a header block and a memo block) prints the head, the dialogs and the runtime
+ * once, in the header block, with no coordination between the blocks and with JavaScript off; the runtime finds a
+ * control's dialog anywhere on the page by its placement. Every byte but the runtime tag is the document's own.
+ */
+export function cardHtml(card, names) {
+    let parts = '';
+    for (const name of names)
+        parts += card.parts[name] ?? '';
+    if (!cardCarriesAssets(card, names))
+        return parts;
+    const dialogs = (card.dialogs.expert ?? '') + (card.dialogs.certificate ?? '');
+    return card.assets.head + parts + dialogs + cardRuntimeTag(card) + cardGraphTag(card);
+}
+//# sourceMappingURL=card-contract.js.map

package/dist/builder/card-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card-contract.js","sourceRoot":"","sources":["../../src/builder/card-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAsC,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC5F,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEvE,uCAAuC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAA;AAEtC,uHAAuH;AACvH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAU,CAAA;AAKzE,MAAM,YAAY,GAAsB,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;AAgCzE,MAAM,UAAU,GAAG,gBAAgB,CAAA;AACnC,MAAM,GAAG,GAAG,sGAAsG,CAAA;AAElH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACvH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAA;AAEnE;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAuC;IAC1E,MAAM,MAAM,GAAa,OAAuD,EAAE,UAAU,CAAA;IAC5F,wHAAwH;IACxH,4DAA4D;IAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/E,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;IAC/C,IAAI,CAAC,KAAK,CAAC,IAAI,QAAQ,KAAK,qBAAqB;QAAE,OAAO,aAAa,CAAA;IACvE,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,aAAa,CAAA;IAC/G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAA;IACjE,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAA;AAC5D,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QACvC,OAAO,CACN,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,QAAQ;YACb,CAAC,GAAG,CAAC,IAAI;YACT,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CACzD,CAAA;IACF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAA;IACb,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC/C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,CAAA;IAC7F,IAAI,QAAQ,KAAK,qBAAqB,IAAI,IAAI,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACnG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IACnG,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACpE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,eAAe;QAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;IACxG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1E,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IACpF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5D,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;QAC9B,IACC,CAAC,QAAQ,CAAC,OAAO,CAAC;YAClB,CAAC,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC;YACjC,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;YAC5B,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAC3B,CAAC;YACF,OAAO,IAAI,CAAA;QACZ,CAAC;IACF,CAAC;IACD,OAAO,KAAkC,CAAA;AAC1C,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAa;IACrD,IAAI,SAAiB,CAAA;IACrB,IAAI,CAAC;QACJ,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,MAAM,aAAa,CAAC,SAAS,CAAC,CAAA;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAA;IACZ,CAAC;AACF,CAAC;AAQD,gHAAgH;AAChH,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAC/B,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAA;AAExD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa;IAC1C,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACJ,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,MAAM,GAAmB,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAA;QAC5F,OAAO,MAAM,CAAA;IACd,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAA;IACvB,MAAM,KAAK,GAAmB;QAC7B,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,CAC/B,CAAC,MAAM,EAAE,EAAE;YACV,KAAK,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,CAAA;YAC1B,OAAO,MAAM,CAAA;QACd,CAAC,EACD,GAAG,EAAE;YACJ,KAAK,CAAC,OAAO,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;YAChC,OAAO,IAAI,CAAA;QACZ,CAAC,CACD;KACD,CAAA;IACD,kBAAkB,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAA;IACxD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC9B,OAAO,KAAK,CAAA;AACb,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,yBAAyB;IACxC,cAAc,CAAC,KAAK,EAAE,CAAA;AACvB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CACnC,IAAoB,EACpB,OAAoB,EACpB,OAAoB,EACpB,UAAkB;IAElB,OAAO,CACN,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QAClC,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QACtC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAC9B,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;QACnC,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU,CACtC,CAAA;AACF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,MAAqB,EAAE,OAAoB;IAC5E,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,OAAO,CAAC,GAAG,CAAA;AACjD,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC9B,IAAoB,EACpB,OAAoB,EACpB,OAAoB,EACpB,UAAkB;IAElB,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3E,OAAO,iBAAiB,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAoB,EAAE,IAAa;IAC/D,IAAI,KAAqB,CAAA;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACvF,CAAC;SAAM,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,KAAK,GAAG,EAAE,CAAA;IACX,CAAC;SAAM,CAAC;QACP,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AACxG,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,cAAc,CAAC,IAAoB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAA;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,OAAO,gBAAgB,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,2CAA2C,CAAA;AACjJ,CAAC;AAED,gHAAgH;AAChH,MAAM,qBAAqB,GAA4B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AAExF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoB;IACjD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAA;AAC1F,CAAC;AAED,wHAAwH;AACxH,MAAM,UAAU,iBAAiB,CAAC,IAAoB,EAAE,KAA8B;IACrF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IACjC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAoB;IAChD,MAAM,MAAM,GAAI,IAAwC,CAAC,MAAM,CAAA;IAC/D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC5D,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAA;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAClF,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IACnD,OAAO,sHAAsH,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,WAAW,CAAA;AAC7K,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,IAAoB,EAAE,KAA8B;IAC5E,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IACzD,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACjD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAA;IAC9E,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,GAAG,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;AACtF,CAAC"}