@accelflow/space-content 0.1.0-beta.3 → 0.1.0-beta.5

package/README.md

@@ -1,6 +1,13 @@
-# Space build content SDK
+# Accelflow Space Headless CMS SDK
 
-Node 24+ build-time content synchronization for Space Headless CMS, with optional browser-safe table-of-contents presentation. Licensed under MIT.
+The official Headless CMS SDK for [Accelflow Space](https://space.accelflow.jp/en/), developed and maintained by [Accelflow Inc.](https://accelflow.jp/).
+
+Create, review, and publish content with your team in Space, then bring it into your own website with Vite, Next.js, or another build system. The SDK synchronizes published content at build time and provides optional rendering, table-of-contents, and author-profile utilities. Requires Node.js 24 or later. Licensed under MIT.
+
+- [Service website](https://space.accelflow.jp/en/)
+- [Headless CMS use case](https://space.accelflow.jp/en/use-cases/headless-cms/)
+- [Company website — Accelflow Inc.](https://accelflow.jp/)
+- [Source code](https://github.com/Accelflow/space-content-sdk) · [Report an issue](https://github.com/Accelflow/space-content-sdk/issues)
 
 The beta package is available on npm.
 
@@ -64,7 +71,7 @@ repository; the tests here exercise the client with synthetic protocol fixtures.
 
 ## Full framework examples
 
-See [Vite and Next.js examples](examples/README.md) for complete static builds,
+See [Vite and Next.js examples](https://github.com/Accelflow/space-content-sdk/tree/main/examples#readme) for complete static builds,
 CI cache handling, HTML rendering, asset headers and deployment boundaries.
 
 ## Table of contents
@@ -75,7 +82,7 @@ The browser-safe entry is separate from the authenticated Node client:
 import { mountTableOfContents } from '@accelflow/space-content/toc';
 import '@accelflow/space-content/toc.css';
 
-const cleanup = mountTableOfContents(articleElement, { locale: 'ja' });
+const cleanup = mountTableOfContents(articleElement, { locale: 'en' });
 // Call cleanup when replacing the article or unmounting the component.
 ```
 
@@ -85,14 +92,14 @@ In Next.js, use this browser entry in a client component effect and return the c
 
 ## Release preparation
 
-See [RELEASING.md](RELEASING.md) for packaging checks, initial publication and OIDC setup.
+See [RELEASING.md](https://github.com/Accelflow/space-content-sdk/blob/main/RELEASING.md) for packaging checks, initial publication and OIDC setup.
 
 ## JSON and HTML rendering
 
 ```js
 import {renderArticleBody} from '@accelflow/space-content/render';
 const html = renderArticleBody(article.body, {
-  assets: content.assets, locale: 'ja', pdfMode: 'link',
+  assets: content.assets, locale: 'en', pdfMode: 'link',
   renderers: {paragraph: ({children}) => `<p>${children}</p>`},
 });
 ```
@@ -132,12 +139,12 @@ import '@accelflow/space-content/profile.css';
 
 const profile = createAuthorProfile(content.articles, {
   origin: 'https://your-site.example',
-  locale: 'ja',
-  url: '/ja/blog/authors/editorial-team/',
-  articleHref: article => `/ja/blog/${article.slug}/`,
+  locale: 'en',
+  url: '/en/blog/authors/editorial-team/',
+  articleHref: article => `/en/blog/${article.slug}/`,
 });
 const html = renderAuthorProfile(profile, {
-  labels: {about: '編集部について', articles: '編集部の記事'},
+  labels: {about: 'About the editorial team', articles: 'Articles by the editorial team'},
 });
 ```
 
@@ -161,7 +168,7 @@ Draft articles, other locales and articles with a different author are excluded.
 
 When a Space workspace has a CMS URL, the delivery API rewrites article links
 before returning HTML or JSON. Use the article base URL (for example,
-`https://example.com/ja/blog/`). Workspace references use that base plus the
+`https://example.com/en/blog/`). Workspace references use that base plus the
 published page-tree path. Links with the same hostname become root-relative;
 other HTTP(S) links retain an absolute URL and carry `target="_blank"` with
 `rel="noopener noreferrer"`. The renderer preserves these safe external targets.
@@ -207,3 +214,19 @@ paragraphs and content outside this wrapper are unchanged. Customize the gap:
 ```css
 .space-content { --space-content-paragraph-gap: 0.75em; }
 ```
+
+### Image dimensions
+
+`renderArticleBody` retains independently specified `width` and `height` for JSON
+image nodes and raster attachment nodes. Each dimension must be an integer from
+1 through 10000 pixels. Missing dimensions retain the browser's automatic sizing.
+Images keep `max-width:100%` so they fit narrower article containers.
+
+For HTML bodies, the sanitizer retains only bounded pixel width/height, image
+`width:100%`, `height:auto`, and `max-width:100%` on the image/figure elements used
+by Space exports. Other inline CSS and executable attributes remain disallowed.
+
+Run `npm run verify:local` for the standard local verification. This runs the
+SDK tests, including Build API transfer-to-render image regressions for JSON and
+HTML, then verifies the packed public exports and Vite/Next static builds, and
+audits dependencies. The same image regressions run against the packed SDK.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@accelflow/space-content",
-  "version": "0.1.0-beta.3",
+  "version": "0.1.0-beta.5",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -29,7 +29,9 @@
   "scripts": {
     "test": "node --test test/*.test.mjs",
     "prepack": "npm test",
-    "verify:package": "node scripts/verify-package.mjs"
+    "verify:package": "node scripts/verify-package.mjs",
+    "audit:dependencies": "npm audit --audit-level=moderate",
+    "verify:local": "npm run verify:package && npm run audit:dependencies"
   },
   "files": [
     "node.mjs",
@@ -55,12 +57,16 @@
   "bugs": {
     "url": "https://github.com/Accelflow/space-content-sdk/issues"
   },
-  "homepage": "https://github.com/Accelflow/space-content-sdk#readme",
+  "homepage": "https://space.accelflow.jp/en/",
   "publishConfig": {
     "access": "public",
     "tag": "beta"
   },
   "dependencies": {
-    "sanitize-html": "^2.18.0"
+    "sanitize-html": "2.18.1"
+  },
+  "author": {
+    "name": "Accelflow Inc.",
+    "url": "https://accelflow.jp/"
   }
 }

package/render.mjs

@@ -4,6 +4,11 @@ export const escapeHtml = value => String(value ?? '').replace(/[&<>"']/g, c =>
 const linkTarget = attrs => attrs?.target === '_blank' ? ' target="_blank" rel="noopener noreferrer"' : '';
 const hash = /^[a-f0-9]{64}$/;
 const raster = new Set(['image/png','image/jpeg','image/gif','image/webp','image/avif']);
+const imagePixels = /^(?:[1-9]\d{0,3}|10000)px$/;
+function imageStyle(attrs) {
+ const dimensions=['width','height'].filter(key=>Number.isSafeInteger(attrs[key])&&attrs[key]>0&&attrs[key]<=10000).map(key=>`${key}:${attrs[key]}px`);
+ return dimensions.length?` style="max-width:100%;${dimensions.join(';')}"`:'';
+}
 function assetsIndex(assets = []) {
  const ids = new Map(), paths = new Map();
  for (const a of assets) {
@@ -26,12 +31,16 @@ export function sanitizeArticleHtml(html, {assets = [], pdfMode = 'link'} = {})
   allowedTags: [...sanitizeHtml.defaults.allowedTags,'img','details','summary','nav',...(pdfMode==='embed'?['iframe']:[])],
   allowedAttributes: {
    '*':['id','class'], a:['href','title','data-level','download','target','rel'],
-   img:['src','alt','title','width','height','loading','referrerpolicy'],
+   img:['src','alt','title','width','height','loading','referrerpolicy','style'], figure:['style'],
    nav:['data-table-of-contents','data-max-level','aria-label'], details:['open','data-space-toc'],
    li:['data-level','data-checked'], ol:['start'], td:['colspan','rowspan'], th:['colspan','rowspan','scope'],
    iframe:['src','title','sandbox','loading','referrerpolicy'],
   },
   allowedClasses:{'*':['*']},
+  allowedStyles:{
+   img:{width:[imagePixels,/^100%$/],height:[imagePixels,/^auto$/],'max-width':[/^100%$/]},
+   figure:{width:[imagePixels],'max-width':[/^100%$/]},
+  },
   allowedSchemes:['https','http','mailto','tel'], allowedSchemesByTag:{img:['https'],iframe:[]}, allowProtocolRelative:false,
   transformTags: {
    a: (tagName, attrs) => {const {target,rel,...rest}=attrs;return {tagName,attribs:{...rest,...(target==='_blank'&&/^https?:\/\//i.test(safeUrl(attrs.href))?{target:'_blank',rel:'noopener noreferrer'}:{})}};},
@@ -69,11 +78,11 @@ export function renderArticleBody(body, options = {}) {
    for(const mark of Array.isArray(n.marks)?n.marks:[]) {const tag={bold:'strong',italic:'em',underline:'u',strike:'s',code:'code'}[mark?.type];if(tag)html=wrap(tag,html);else if(mark?.type==='link'){const href=safeUrl(mark.attrs?.href);if(href)html=wrap('a',html,` href="${e(href)}"${linkTarget(mark.attrs)}`);}}
   } else if(n.type==='heading') html=wrap('h'+(Number.isInteger(a.level)&&a.level>=1&&a.level<=6?a.level:2),children,` id="${e(anchors.get(n))}"`);
   else if(n.type==='tableOfContents') html=renderTableOfContents(headings,{locale:options.locale??'ja',maxLevel:a.maxLevel===2?2:3});
-  else if(n.type==='image') {const src=safeUrl(a.src,true);html=src?`<img src="${e(src)}" alt="${e(a.alt)}" loading="lazy" referrerpolicy="no-referrer">`:'';}
+  else if(n.type==='image') {const src=safeUrl(a.src,true);html=src?`<img src="${e(src)}" alt="${e(a.alt)}" loading="lazy" referrerpolicy="no-referrer"${imageStyle(a)}>`:'';}
   else if(n.type==='attachment') {
    const asset=ids.get(a.attachmentId);if(!asset)throw Error('attachment_not_in_manifest');
    const src='/space-assets/'+asset.hash, label=e(asset.filename);
-   html=raster.has(asset.contentType)?`<img src="${src}" alt="${label}" loading="lazy">`:`<a href="${src}" download="${label}">${label}</a>`;
+   html=raster.has(asset.contentType)?`<img src="${src}" alt="${label}" loading="lazy"${imageStyle(a)}>`:`<a href="${src}" download="${label}">${label}</a>`;
    if(asset.contentType==='application/pdf'&&options.pdfMode==='embed')html=`<iframe class="space-pdf" src="${src}" title="${label}" sandbox="" loading="lazy" referrerpolicy="no-referrer"></iframe>`+html;
   } else if(n.type==='externalLinkCard') {const href=safeUrl(a.href);html=href?wrap('a',e(a.title||href),` href="${e(href)}"${linkTarget(a)}`):e(a.title);}
   else if(n.type==='articleReference') {const target=options.resolveArticle?.(a);const href=safeUrl(target?.href);const label=e(a.labelMode==='custom'?a.customLabel:target?.title??a.fallbackTitle??a.title??'');html=href?wrap('a',label,` href="${e(href)}"`):label;}