[noeltock]

Problem

The 1.0 release needs a supported runtime baseline and refreshed dependencies. The previous locks reported vulnerabilities in the CLI, generated plugin and project-owned fixture graphs.

Solution

Prepare 1.0.0 with patched Node floors, current WordPress packages and WordPress 7.1.3 proof. The basic CLI/library retain Node 22 support through a required packed-consumer CI job; development and proof use Node 24/26 because the current WordPress tooling requires Node 24+. Update the generated plugin build toolchain and retain narrow security overrides where upstream ranges still resolve vulnerable packages. Emit declarations with TypeScript 7 directly, support npm 12's pack output, and avoid reading the Node 26 localStorage getter during headless bootstrap while restoring its original descriptor.

Behaviour that changes or must stay true	Read first	Proof
Supported runtime and install graph	package.json, src/node-support.ts	Engine graph check and clean packed install
Generated plugin build and native editing	src/plugin/profile.ts, proof/wp-env.json	Production ZIP build and WordPress proof
Typed public library	tsconfig.build.json, tsup.config.ts	Packed TypeScript consumer passed
Conversion remains stable	WordPress dependency pins	All 63 benchmark rows unchanged
Release evidence binds current artifacts	proof/reviews/1.0.0/agent-review.json	Fresh agent-assisted keyboard/focus review

Diff

+12,151 −19,709 · 49 files · dependency and runtime compatibility update

 release candidate
- Node 22.13 / 24.0; npm 11; WordPress 7.1
+ CLI/library: Node 22.23.4 / 24.22.1 / 26.12.1
+ Development/proof: Node 24.22.1 / 26.12.1; npm 12.2.1; WordPress 7.1.3
 generated plugin
- @wordpress/scripts 34.2.0
+ @wordpress/scripts 37.0.0 with patched transitive overrides
 headless bootstrap
- dependency initialization reads the host localStorage getter
+ use in-memory fallback during initialization; restore the host descriptor
 build
- tsup bundles JavaScript and declarations
+ tsup bundles JavaScript; TypeScript 7 emits declarations
 release review
- historical 0.9 owner attestation
+ current input/ZIP-bound agent-assisted browser review

Testing & verification

Reviewed revision: 8dc3ad3 · Environment: macOS, Node 24.22.1, npm 12.2.1, OrbStack, WordPress 7.1.3/PHP 8.3.36.

• npm audit --json: zero vulnerabilities across the root, generated plugin and project-owned fixture graphs.

• npm run smoke:package: clean engine-strict install, CLI, authoring examples and typed library consumer passed.

• npm run test:tools: 43 tests passed. Focused receipt and proof-version tests passed.

• npm run bench: all 63 rows unchanged from the previous dependency graph; no invalid blocks.

• Full WordPress release acceptance passed: installation, activation, edit/save/reopen, pattern overrides, frontend, visual regression and frontend axe passed. Three native Heading/Paragraph editor axe findings remain retained and matched against separately validated controls. The raw profile remains false; release acceptance is true.

• Agent-assisted Chrome review: keyboard editing/undo, tab order, visible focus and content reading order passed for the exact generated input and ZIP. This is not an owner attestation or screen-reader certification.

• Final-revision CI: Node 24.22.1 and 26.12.1 full verification, tooling, packed consumers and actual Node 20 rejection passed; Node 22.23.4 packed consumer, package-boundary and WordPress 7.1.3 automated acceptance checks passed. Each full product suite passed 882 tests with four existing skips.

• The local release matrix passed every consumer, package, project/user skill install, idempotence, generated ZIP and full-proof acceptance row. Its retained overall result is failed because its verify row preceded a corrected CI contract assertion; final-revision hosted verification above covers the corrected source.

• The Linux-generated input and ZIP hashes match the macOS agent-assisted review exactly.

• Release workflow: fresh full-release-matrix passed on clean merged revision a50f986; release acceptance is true, with the three matched native editor findings retained. npm published block-runner@1.0.0 with provenance and latest points to 1.0.0.

• Fresh registry consumer on Node 24.22.1: engine-strict install, CLI, typed library, documented authoring examples, asset preservation and stale-confirmation rejection passed. npm audit signatures: 293 verified registry signatures and 93 verified attestations.

• Post-merge CI passed on a50f986.

Not verified: the optional model benchmark was not run. Agent-assisted accessibility review is not a human owner attestation or screen-reader certification.

Risk / rollout

This establishes the 1.x compatibility policy and raises the minimum supported Node patch versions. Major WordPress/React/tooling upgrades need the full consumer and WordPress gates before merge and publication. The optional handoff change in #201 remains excluded.

Detection: CI and receipt-backed consumer/WordPress checks. Rollback: revert this candidate before publication; after npm publication, issue a corrective patch and move the latest dist-tag if required.