
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
certrev-api-contract
Advanced tools
API contract types and schemas for CertRev verification engines. MVP is the source of truth.
API contract types and Zod schemas for CertRev verification engines.
The certrev-mvp repository is the SOURCE OF TRUTH for this contract.
# For MVP (workspace dependency)
pnpm add @certrev/api-contract
# For external engines (when published to npm)
npm install @certrev/api-contract
import type {
VerificationJob,
TipTapDocument,
ClaimResult,
APAReference,
} from '@certrev/api-contract'
const job: VerificationJob = { ... }
import {
VerificationJobSchema,
TipTapDocumentSchema,
CreateJobInputSchema,
} from '@certrev/api-contract'
// Validate incoming data
const result = VerificationJobSchema.safeParse(data)
if (!result.success) {
console.error('Invalid job:', result.error)
}
import {
STAGE_LABELS,
ERROR_MESSAGES,
CONTRACT_VERSION,
} from '@certrev/api-contract'
// Show progress to users
const label = STAGE_LABELS[job.stage_name] // "Verifying critical claims"
// Show errors to users
const message = ERROR_MESSAGES[error.code] // "Rate limit exceeded..."
Current version: 2.1.0
Check CONTRACT_VERSION constant for programmatic access.
Engines MUST:
verification_jobs table for jobs with status = 'pending' AND matching engineJobProgressUpdate schemaJobCompletion schemaJobFailure schemaSee schemas.ts for exact shapes.
Jobs are assigned to specific engines via the options.engine field. Each engine should poll only for jobs assigned to it:
-- cr-engine-v2 polls:
SELECT * FROM verification_jobs
WHERE status = 'pending'
AND options->>'engine' = 'cr-engine-v2'
ORDER BY created_at ASC
LIMIT 1
-- cr-engine-v3 polls:
SELECT * FROM verification_jobs
WHERE status = 'pending'
AND options->>'engine' = 'cr-engine-v3'
ORDER BY created_at ASC
LIMIT 1
Available engines:
| Engine ID | Name | Description |
|---|---|---|
cr-engine-v2 | CR Engine V2 | Stable version |
cr-engine-v3 | CR Engine V3 (BMAD) | Latest with BMAD improvements |
Handling legacy jobs: Jobs created before engine routing (without options.engine) can be handled by any engine or ignored based on your deployment needs.
The MVP frontend TipTap editor expects footnotes as marks with this exact structure:
// In output_document nodes, add this mark to cited text:
{
type: 'footnote',
attrs: {
footnoteNumbers: [1, 2], // References supporting this claim
claimId: 'uuid' // Links to ClaimResult.id
}
}
Example: A paragraph with a footnoted claim:
{
"type": "paragraph",
"content": [
{ "type": "text", "text": "Studies show this treatment is effective" },
{
"type": "text",
"text": " for patients",
"marks": [{
"type": "footnote",
"attrs": {
"footnoteNumbers": [1, 3],
"claimId": "claim-123"
}
}]
},
{ "type": "text", "text": "." }
]
}
The frontend renders this as: "...effective for patients[1,3]."
Frontend support:
Footnote extension in src/lib/editor/tiptap-config.ts<sup data-footnote="true" class="footnote-marker">[1,3]</sup>sup tag and data-footnote attributeSee CHANGELOG.md for version history.
What's breaking:
What's NOT breaking:
FAQs
API contract types and schemas for CertRev verification engines. MVP is the source of truth.
The npm package certrev-api-contract receives a total of 2 weekly downloads. As such, certrev-api-contract popularity was classified as not popular.
We found that certrev-api-contract demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.