feat(blocks): credit — "Powered by / Created by / Managed by" attribution

[nandal]

Catalog 53 → 54. Adds credit — the one-line attribution every generated site wants at the very bottom, linking out to whoever built or runs it.

copyright asserts ownership (© year holder). That is a different claim from "this was built by X", and the only way to express the latter today was to bend copyright's rights text into a line that cannot carry a link at all. The two compose: a copyright bar above a credit line.

The block

One brick rather than one per phrasing — label is free text, so "Created by", "Managed by", "Built by", "A project of" all fit the same contract with no new field and no new type.

field
label	the relationship word (default "Powered by")
name *	who is credited
href	where it goes — blank for an unlinked credit
newTab	default true
logo	image URL or a single emoji
note	trailing aside, after a ·
variant	bar (default) · badge · inline
align	start · center · end

Why the link is the guarded part

It is the whole point of the brick, so it gets the scrutiny:

• href runs through sanitizeUrl, and a hostile scheme degrades to unlinked plain text rather than href="#" — a credit with no destination should read as text, not as a link that goes nowhere.
• Outbound means newTab defaults to true, which brings rel="noopener noreferrer" and a visually hidden "(opens in a new tab)". The ↗ glyph is aria-hidden and announces nothing, so without that text a screen-reader user is moved to a new tab unwarned.
• newTab: false drops the target and the warning together, so the promise can never drift from the behaviour.

Total render, as required by the brick DoD: blank href → unlinked; blank everything → the landmark still renders; name and note are escaped.

Samples

{ "type": "credit", "config": {
  "label": "Created by", "name": "BytesBrains", "href": "https://bytesbrains.com",
  "newTab": true, "variant": "bar", "align": "center" } }

{ "type": "credit", "config": {
  "label": "Created by", "name": "AiToolK.it", "href": "https://aitoolk.it",
  "newTab": true, "logo": "🛠️", "note": "Built in minutes, not weeks",
  "variant": "badge", "align": "center" } }

Both, plus the addBlock op form and when to reach for credit vs copyright, are documented in a new Crediting the maker section in AGENT.md.

Notes

• Demoed on the block wall via SUPPLEMENT, not a starter placement — templates stay consumer-neutral, and a credit is only honest when it names someone real, so the wall credits this package's own maker.
• 9 tests in src/credit.test.ts cover the new-tab contract, scheme neutralization, escaping, logo URL-vs-emoji, and the empty-config landmark. Full suite: 189 passing. catalog.json / CATALOG.md regenerated.
• No package.json bump — CHANGELOG.md carries the 0.12.0 section for a later release PR.
• Drive-by: the README block table still said 52 blocks and was missing progress from 0.11.0.

🤖 Generated with Claude Code

[wrokin]

🤖 wrokin code review

Adds credit block for attribution with comprehensive tests; one defensive coding improvement recommended.

High-signal issues

• src/blocks/credit.ts:62 — sanitizeUrl(config.href) may receive undefined if the href field is not provided, which could cause sanitizeUrl to throw if it does not handle non-string input. The render output already guards against an absent link, but the call should be hardened: use sanitizeUrl(config.href ?? '') to guarantee a string argument.

_{Model: deepseek/deepseek-v4-pro · your key, your model (BYOK)}

[wrokin]

🤖 wrokin security audit

No security-relevant findings in this diff. All user-supplied text is properly escaped (escapeHtml, escapeAttr), URLs are sanitized (sanitizeUrl), and outbound links apply rel="noopener noreferrer" with accessible new‑tab warnings. The new credit block introduces no injection, authorization, secret exposure, or unsafe deserialisation vulnerabilities.

_{Model: deepseek/deepseek-v4-pro · your key, your model (BYOK)}

[nandal]

Thanks — checked the one finding; it's a false positive, so no change.

sanitizeUrl is typed (url: unknown) and opens with String(url ?? '') (src/schema.ts:157-164) — non-string input is coerced, not thrown on:

sanitizeUrl(undefined) → '#'
sanitizeUrl(null)      → '#'

It also can't be reached with an absent href in the first place: renderBlock runs parse(spec.schema, block.config) before calling a brick's render (src/render.ts:47), and the schema defaults href to ''. Total render is the engine's invariant, so every brick relies on that — socialLinks, footer and map all call sanitizeUrl(x.href) bare for the same reason. Adding ?? '' here would be dead code and would break that idiom.

The behaviour the finding is aimed at is covered by tests: a missing href renders an unlinked credit, and a javascript: scheme degrades to plain text rather than href="#" (src/credit.test.ts).