@bettercms-ai/richtext 0.12.1 → 0.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bettercms-ai/richtext",
-  "version": "0.12.1",
+  "version": "0.14.0",
   "type": "module",
   "sideEffects": false,
   "description": "The one Portable Text contract for BetterCMS: schema, converters, and rendering. Shared by the backend, the dashboard and every delivery SDK.",
@@ -26,11 +26,13 @@
     "test:watch": "vitest"
   },
   "dependencies": {
+    "@bettercms-ai/types": "^1.55.0",
     "@portabletext/to-html": "^6.0.0",
     "@portabletext/html": "^2.0.0",
     "@portabletext/schema": "^3.0.0"
   },
   "devDependencies": {
+    "fast-check": "^4.10.2",
     "tsup": "^8.5.1",
     "vitest": "^4.1.4"
   },

package/src/accept.ts

@@ -1,3 +1,11 @@
+import {
+  RICHTEXT_ADVANCED_ELEMENTS,
+  RICHTEXT_BLOCK_ELEMENTS,
+  RICHTEXT_CORE_ELEMENTS,
+  RICHTEXT_ELEMENTS,
+  normaliseRichTextFeatures,
+  type RichTextFeature as FeatureName,
+} from '@bettercms-ai/types'
 import { RICH_TEXT_CAPABILITY_MANIFEST, type RichTextFeature } from './features'
 import type { AllowEntry } from './features'
 import { STYLED_TAGS } from './styled'
@@ -12,21 +20,23 @@ import { STYLED_TAGS } from './styled'
  * moment content arrives by paste, from the AI hook, or from before the list was narrowed.
  */
 
-/** The elements Prismic exposes — the default-visible set. */
-export const CORE_ELEMENTS = [
-  'p', 'pre', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
-  'b', 'i', 'link', 'image', 'code', 'ul', 'ol', 'rtl',
-] as const
+/** The elements Prismic exposes — the default-visible set. (Names: @bettercms-ai/types.) */
+export const CORE_ELEMENTS = RICHTEXT_CORE_ELEMENTS
 
 /**
  * What this repo can do beyond Prismic. Behind "Advanced" so the panel reads like the spec at
  * rest, but present so enabling them is not a capability deletion.
  */
-export const ADVANCED_ELEMENTS = [
-  'u', 'mark', 's', 'checklist', 'table', 'columns', 'embed', 'internalLink',
-] as const
+export const ADVANCED_ELEMENTS = RICHTEXT_ADVANCED_ELEMENTS
 
-export const ALL_ELEMENTS = [...CORE_ELEMENTS, ...ADVANCED_ELEMENTS] as const
+/**
+ * The V2 blocks' elements. Each is reachable from its feature through `acceptFor`, but none is in
+ * the panel, the defaults or the sanitiser until its RT step ships the renderer and the ingest:
+ * a toggle with nothing behind it is the fake button the owner rule forbids.
+ */
+export const BLOCK_ELEMENTS = RICHTEXT_BLOCK_ELEMENTS
+
+export const ALL_ELEMENTS = RICHTEXT_ELEMENTS
 export type AcceptElement = (typeof ALL_ELEMENTS)[number]
 
 /** Labels name the CAPABILITY, never the key — an author reads "Headings", not `accept.h1`. */
@@ -37,6 +47,8 @@ export const ELEMENT_LABELS: Record<AcceptElement, string> = {
   ul: 'Bulleted list', ol: 'Numbered list', rtl: 'Right-to-left',
   u: 'Underline', mark: 'Highlight', s: 'Strikethrough', checklist: 'Checklist',
   table: 'Table', columns: 'Columns', embed: 'Video embed', internalLink: 'Internal link',
+  gallery: 'Gallery', providerEmbed: 'Embed', tableOfContents: 'Table of contents', relatedPosts: 'Related posts',
+  authorBio: 'Author bio', footnotes: 'Footnotes', button: 'Button',
 }
 
 /**
@@ -76,6 +88,18 @@ const ELEMENT_TAGS: Record<AcceptElement, string[]> = {
   checklist: ['ul', 'li', 'input'], table: ['table', 'thead', 'tbody', 'tr', 'th', 'td'],
   columns: ['section', 'div', 'p', 'br'],
   embed: ['figure', 'iframe', 'video', 'source', 'figcaption'],
+  // None until its RT step teaches the ingest the block's markup: a tag the sanitiser lets through
+  // and the ingest cannot read is content an author loses on save.
+  // RT3: the embed's figure and what it draws. Never `script`: X's widget script is written by the
+  // renderer for a site that opted in, and no submitted markup may bring one.
+  providerEmbed: ['figure', 'iframe', 'audio', 'a', 'blockquote', 'p', 'footer'],
+  // RT4: the gallery's figure, its list and each image's own figure.
+  gallery: ['figure', 'ul', 'li', 'img', 'figcaption'],
+  // RT5: the contents' nav, its title and its (nested) list of links.
+  tableOfContents: ['nav', 'p', 'ol', 'li', 'a'],
+  relatedPosts: [], authorBio: [], footnotes: [],
+  // RT2: a button is an `<a data-button>`; the ingest reads it back (buttonLinkRule).
+  button: ['a'],
 }
 
 /**
@@ -92,7 +116,7 @@ export const HTML_BACKED_UNAVAILABLE_ACCEPT_REASONS: Partial<Record<AcceptElemen
   columns: 'Embedded blocks are available in entry rich text; component rich text stores HTML.',
 }
 
-const NEW_AUTHORING_EXCLUSIONS = new Set<AcceptElement>(['internalLink', 'rtl'])
+const NEW_AUTHORING_EXCLUSIONS = new Set<AcceptElement>(['internalLink', 'rtl', ...BLOCK_ELEMENTS])
 
 /** New defaults contain every capability whose complete consumer pipeline is currently live. */
 export const DEFAULT_ACCEPT: AcceptElement[] = ALL_ELEMENTS.filter(
@@ -122,6 +146,35 @@ export const DEFAULT_RICHTEXT_CONFIG: RichTextConfig = {
   allowMultipleParagraphs: true,
 }
 
+/**
+ * Each feature → the elements it grants. Total over the vocabulary (`satisfies` fails the build on
+ * a feature with no row); an alias (`headings`) has none, it is expanded before the lookup. Quote
+ * and divider grant nothing: `p` carries them, as `featuresFor` has always given both to any field
+ * with paragraphs.
+ */
+const FEATURE_ELEMENTS = {
+  bold: ['b'], italic: ['i'], underline: ['u'], strikethrough: ['s'], code: ['code'], highlight: ['mark'],
+  blockquote: [], horizontalRule: [],
+  orderedList: ['ol'], unorderedList: ['ul'], checklist: ['checklist'],
+  link: ['link'], internalLink: ['internalLink'], inlineImage: ['image'], videoEmbed: ['embed'],
+  codeBlock: ['pre'], table: ['table'], columns: ['columns'],
+  h1: ['h1'], h2: ['h2'], h3: ['h3'], h4: ['h4'], h5: ['h5'], h6: ['h6'],
+  gallery: ['gallery'], embed: ['providerEmbed'], tableOfContents: ['tableOfContents'], relatedPosts: ['relatedPosts'],
+  authorBio: ['authorBio'], footnotes: ['footnotes'], button: ['button'],
+} as const satisfies Record<FeatureName, readonly AcceptElement[]>
+
+/**
+ * A field's features → the elements it accepts: the ONE projection the sanitiser, the PT schema
+ * (`ptSchemaFor`), the dashboard codec and the kit consume, so `features` is the only stored gate.
+ * Aliases are expanded first (`headings` → the six levels) and unknown names grant nothing. `p` is
+ * the floor and never a feature, so `[]` is a field of paragraphs.
+ */
+export function acceptFor(features: readonly string[]): AcceptElement[] {
+  const granted = new Set<AcceptElement>(['p'])
+  for (const f of normaliseRichTextFeatures(features).features) for (const e of FEATURE_ELEMENTS[f]) granted.add(e)
+  return ALL_ELEMENTS.filter((e) => granted.has(e))
+}
+
 /** The tag allowlist the sanitiser enforces for a given Accept set. */
 export function allowedTags(accept: AcceptElement[]): string[] {
   // `span` carries marks and is never the reason content is stripped; the rest of `STYLED_TAGS`

package/src/embed.ts

@@ -0,0 +1,242 @@
+/**
+ * RT3: the embed. Stored `{ url, title, aspect }`; everything else is DERIVED from the url at
+ * render: the provider, its shape and the frame src (never stored; R8 refuses them on write).
+ *
+ * The resolver is pure and the frame src comes only from code: each provider's player URL is
+ * BUILT from ids parsed out of the link, for a host on this file's allowlist, over https. A link
+ * no rule recognises is a link card, never an iframe of whatever it points at. The allowlist grows
+ * from evidence (an import's `embed.legacy_iframe:<host>` lines), one pure parser per provider.
+ *
+ * An X post is a card: its words come from an oEmbed fetch the server makes when it builds the
+ * html cache (never stored in the value). Without that data, it is a link card.
+ */
+import type { EmbedCard, RichTextEmbeds } from "@bettercms-ai/types";
+import { resolveVideoSource } from "./video";
+import { safeHref } from "./href";
+
+export type { EmbedCard, RichTextEmbeds };
+
+export const EMBED_ASPECTS = ["16:9", "4:3", "1:1", "9:16"] as const;
+export type EmbedAspect = (typeof EMBED_ASPECTS)[number];
+export const isEmbedAspect = (v: unknown): v is EmbedAspect => (EMBED_ASPECTS as readonly unknown[]).includes(v);
+/** V2's title cap: screen-reader only, never shown. */
+export const EMBED_TITLE_MAX = 120;
+
+export type EmbedProvider =
+  | "youtube" | "vimeo" | "x" | "codepen" | "figma" | "maps" | "spotify" | "podcast" | "audio"
+  | "calendly" | "typeform" | "loom" | "airtable" | "google"
+  | "link";
+
+/** V2's detectEmbed (kit rich-text article.ts), verbatim: which provider a link is, and its label. */
+export function detectEmbed(url: string): { provider: EmbedProvider; label: string; host: string } {
+  const u = url.trim();
+  let host = "";
+  try {
+    host = new URL(u).hostname.replace(/^www\./, "");
+  } catch {
+    host = "";
+  }
+  const is = (re: RegExp) => re.test(u);
+  if (is(/(?:youtube\.com\/(?:watch\?|embed\/|shorts\/|live\/)|youtu\.be\/)/i)) return { provider: "youtube", label: "YouTube", host };
+  if (is(/vimeo\.com\/(?:video\/)?\d+/i)) return { provider: "vimeo", label: "Vimeo", host };
+  if (is(/(?:twitter|x)\.com\/[^/]+\/status\/\d+/i)) return { provider: "x", label: "X post", host };
+  if (is(/codepen\.io\/[^/]+\/(?:pen|embed)\//i)) return { provider: "codepen", label: "CodePen", host };
+  if (is(/figma\.com\/(?:file|design|proto|board)\//i)) return { provider: "figma", label: "Figma", host };
+  if (is(/(?:google\.[a-z.]+\/maps|maps\.app\.goo\.gl|goo\.gl\/maps)/i)) return { provider: "maps", label: "Google Maps", host };
+  if (is(/open\.spotify\.com\/(?:episode|track|show|playlist|album)\//i)) return { provider: "spotify", label: "Spotify", host };
+  if (is(/podcasts\.apple\.com\//i)) return { provider: "podcast", label: "Apple Podcasts", host };
+  if (is(/\.(?:mp3|m4a|wav|ogg|aac)(?:\?|$)/i)) return { provider: "audio", label: "Audio", host };
+  return { provider: "link", label: host || "Link", host };
+}
+
+/**
+ * Past V2's list: the providers the import evidence asked for, and the PLAYER urls an imported
+ * `<iframe>` carries (a YouTube nocookie frame, a Spotify /embed/ path) that V2's page-url patterns miss.
+ */
+function detectMore(url: URL): { provider: EmbedProvider; label: string } | null {
+  const host = url.hostname.toLowerCase().replace(/^www\./, "");
+  const path = url.pathname;
+  if (host === "youtube-nocookie.com" && path.startsWith("/embed/")) return { provider: "youtube", label: "YouTube" };
+  if (host === "open.spotify.com" && /^\/embed\/(?:episode|track|show|playlist|album)\//.test(path)) return { provider: "spotify", label: "Spotify" };
+  if (host === "calendly.com") return { provider: "calendly", label: "Calendly" };
+  if (host.endsWith(".typeform.com") && /^\/to\//.test(path)) return { provider: "typeform", label: "Typeform" };
+  if (host === "loom.com" && /^\/(?:share|embed)\//.test(path)) return { provider: "loom", label: "Loom" };
+  if (host === "airtable.com") return { provider: "airtable", label: "Airtable" };
+  if (host === "docs.google.com") {
+    const kind = path.split("/")[1];
+    const label = { forms: "Google Forms", document: "Google Docs", spreadsheets: "Google Sheets", presentation: "Google Slides" }[kind ?? ""];
+    if (label) return { provider: "google", label };
+  }
+  return null;
+}
+
+/** How an embed renders, all of it derived from the stored url. */
+export type ResolvedEmbed =
+  | { kind: "frame"; provider: EmbedProvider; label: string; src: string; width: string; height: string }
+  | { kind: "audio"; provider: "audio"; label: string; src: string }
+  | { kind: "card"; provider: "x"; label: string; url: string }
+  | { kind: "link"; provider: EmbedProvider; label: string; url: string | null };
+
+/** A video frame's default box per aspect: the size it has with no stylesheet at all. */
+const FRAME_SIZE: Record<EmbedAspect, [string, string]> = {
+  "16:9": ["640", "360"],
+  "4:3": ["640", "480"],
+  "1:1": ["640", "640"],
+  "9:16": ["360", "640"],
+};
+
+const ID = /^[A-Za-z0-9_-]{1,64}$/;
+/** A form, a calendar, a table or a document fills the column and is as tall as it needs. */
+const FULL_WIDTH_HEIGHT: Partial<Record<EmbedProvider, string>> = { calendly: "700", typeform: "500", airtable: "533" };
+
+/** The provider's player url (and, for a full-width player, its height), or null when we cannot frame the link. */
+function frameOf(provider: EmbedProvider, url: URL): { src: string; height?: string } | null {
+  const parts = url.pathname.split("/").filter(Boolean);
+  switch (provider) {
+    case "youtube":
+    case "vimeo": {
+      // The video block's resolver: one place knows YouTube's and Vimeo's player urls.
+      const video = resolveVideoSource(url.href);
+      return video?.kind === "iframe" ? { src: video.src } : null;
+    }
+    case "codepen": {
+      const [user, mode, id] = parts;
+      return user && ID.test(user) && (mode === "pen" || mode === "embed") && id && ID.test(id)
+        ? { src: `https://codepen.io/${user}/embed/${id}?default-tab=result` }
+        : null;
+    }
+    case "figma": {
+      const [mode, key] = parts;
+      if (!mode || !["file", "design", "proto", "board"].includes(mode) || !key || !ID.test(key)) return null;
+      const frame = new URL(`https://embed.figma.com/${mode}/${key}`);
+      const node = url.searchParams.get("node-id");
+      if (node && /^[0-9A-Za-z:_-]{1,64}$/.test(node)) frame.searchParams.set("node-id", node);
+      frame.searchParams.set("embed-host", "bettercms");
+      return { src: frame.href };
+    }
+    case "maps": {
+      if (!/^(?:www\.)?google\.[a-z.]+$/i.test(url.hostname)) return null; // a short link needs a fetch to resolve
+      const pb = url.searchParams.get("pb");
+      if (parts[0] === "maps" && parts[1] === "embed" && pb && /^[!A-Za-z0-9._:%+-]{1,2000}$/.test(pb)) {
+        return { src: `https://www.google.com/maps/embed?pb=${encodeURIComponent(pb)}` };
+      }
+      const at = /@(-?\d{1,3}(?:\.\d+)?),(-?\d{1,3}(?:\.\d+)?)/.exec(url.pathname);
+      const place = parts[0] === "maps" && parts[1] === "place" && parts[2] ? decodeURIComponent(parts[2]).replace(/\+/g, " ") : null;
+      const q = at ? `${at[1]},${at[2]}` : (url.searchParams.get("q") ?? place);
+      if (!q || q.length > 200) return null;
+      return { src: `https://maps.google.com/maps?q=${encodeURIComponent(q)}&output=embed` };
+    }
+    case "spotify": {
+      const [type, id] = parts[0] === "embed" ? parts.slice(1) : parts;
+      if (!type || !["episode", "track", "show", "playlist", "album"].includes(type) || !id || !ID.test(id)) return null;
+      return { src: `https://open.spotify.com/embed/${type}/${id}`, height: type === "track" || type === "episode" ? "152" : "352" };
+    }
+    case "podcast":
+      return (url.hostname === "podcasts.apple.com" || url.hostname === "embed.podcasts.apple.com") && parts.length >= 2
+        ? { src: `https://embed.podcasts.apple.com${url.pathname}${url.search}`, height: url.searchParams.has("i") ? "175" : "450" }
+        : null;
+    case "calendly":
+      return parts.length >= 1 && parts.length <= 2 && parts.every((p) => ID.test(p))
+        ? { src: `https://calendly.com/${parts.join("/")}?embed_type=Inline&hide_gdpr_banner=1` }
+        : null;
+    case "typeform": {
+      const id = parts[0] === "to" ? parts[1] : undefined;
+      return id && /^[A-Za-z0-9]{4,32}$/.test(id) ? { src: `https://form.typeform.com/to/${id}` } : null;
+    }
+    case "loom": {
+      const id = parts[1];
+      return (parts[0] === "share" || parts[0] === "embed") && id && /^[0-9a-f]{32}$/.test(id) ? { src: `https://www.loom.com/embed/${id}` } : null;
+    }
+    case "airtable": {
+      const ids = parts[0] === "embed" ? parts.slice(1) : parts;
+      return ids.length >= 1 && ids.length <= 3 && ids.every((p) => /^(?:app|shr|tbl|viw)[A-Za-z0-9]{14}$/.test(p)) && ids.some((p) => p.startsWith("shr"))
+        ? { src: `https://airtable.com/embed/${ids.join("/")}` }
+        : null;
+    }
+    case "google": {
+      // /<kind>/d/e/<id>/… is a published file, /<kind>/d/<id>/… a shared one.
+      const [kind, d, maybeE, maybeId] = parts;
+      if (d !== "d") return null;
+      const published = maybeE === "e";
+      const id = published ? maybeId : maybeE;
+      if (!id || !/^[A-Za-z0-9_-]{10,128}$/.test(id)) return null;
+      const base = `https://docs.google.com/${kind}/d/${published ? `e/${id}` : id}`;
+      if (kind === "forms") return { src: `${base}/viewform?embedded=true`, height: "800" };
+      if (kind === "document") return { src: published ? `${base}/pub?embedded=true` : `${base}/preview`, height: "600" };
+      if (kind === "spreadsheets") return { src: published ? `${base}/pubhtml?widget=true&headers=false` : `${base}/preview`, height: "600" };
+      if (kind === "presentation") return { src: published ? `${base}/embed` : `${base}/preview` };
+      return null;
+    }
+    default:
+      return null;
+  }
+}
+
+/** The X post id and handle in a status link, any of its spellings. */
+const X_STATUS = /^\/([A-Za-z0-9_]{1,15})\/status\/(\d{1,25})(?:\/|$)/;
+const X_HOSTS = /^(?:www\.|mobile\.)?(?:twitter|x)\.com$/i;
+
+/**
+ * The url an embed's derived data is keyed by. An X post in any spelling (twitter.com or x.com,
+ * www. or mobile., a tracking query, a /photo/1 tail, any handle case) is one
+ * `https://x.com/<handle>/status/<id>`; any other link is itself, normalised and without its
+ * fragment. Null for a link no renderer would follow.
+ */
+export function canonicalEmbedUrl(raw: unknown): string | null {
+  const url = typeof raw === "string" ? raw.trim() : "";
+  const safe = url ? safeHref(url) : null;
+  if (!safe || !/^https?:\/\//i.test(safe)) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(safe);
+  } catch {
+    return null;
+  }
+  const status = X_HOSTS.test(parsed.hostname) ? X_STATUS.exec(parsed.pathname) : null;
+  if (status) return `https://x.com/${status[1].toLowerCase()}/status/${status[2]}`;
+  parsed.hash = "";
+  return parsed.href;
+}
+
+/**
+ * The embed's rendering, derived from its stored url and aspect. Pure. An unsafe url is a link
+ * card with no href; one no rule recognises (or a short link) is a link card to itself.
+ */
+export function resolveEmbed(rawUrl: unknown, aspect: unknown = "16:9"): ResolvedEmbed {
+  const url = typeof rawUrl === "string" ? rawUrl.trim() : "";
+  const v2 = detectEmbed(url);
+  const safe = url ? safeHref(url) : null;
+  let parsed: URL | null = null;
+  try {
+    parsed = safe && /^https?:\/\//i.test(safe) ? new URL(safe) : null;
+  } catch {
+    parsed = null;
+  }
+  const { provider, label } = v2.provider === "link" && parsed ? (detectMore(parsed) ?? v2) : v2;
+  const link: ResolvedEmbed = { kind: "link", provider, label, url: safe };
+  if (!parsed) return link;
+  if (provider === "x") return { kind: "card", provider: "x", label, url: canonicalEmbedUrl(parsed.href) ?? parsed.href };
+  if (provider === "audio") return parsed.protocol === "https:" ? { kind: "audio", provider: "audio", label, src: parsed.href } : link;
+  const frame = frameOf(provider, parsed);
+  if (!frame) return link;
+  const height = frame.height ?? FULL_WIDTH_HEIGHT[provider];
+  if (height) return { kind: "frame", provider, label, src: frame.src, width: "100%", height };
+  const [width, h] = FRAME_SIZE[isEmbedAspect(aspect) ? aspect : "16:9"];
+  return { kind: "frame", provider, label, src: frame.src, width, height: h };
+}
+
+/** What a render needs that the value does not hold: the cards fetched for it. */
+export type EmbedRender = Partial<RichTextEmbeds>;
+
+/** X's widget script, loaded once per page on a site that opted in (next `BcmsEmbedScripts`), never by a value's html. */
+export const X_WIDGET_SCRIPT = "https://platform.twitter.com/widgets.js";
+
+/** The aspect nearest an imported frame's width and height (16:9 when it gives none). */
+export function nearestEmbedAspect(width: unknown, height: unknown): EmbedAspect {
+  const w = Number(width);
+  const h = Number(height);
+  if (!(w > 0) || !(h > 0)) return "16:9";
+  const ratio = w / h;
+  const ratios: [EmbedAspect, number][] = [["16:9", 16 / 9], ["4:3", 4 / 3], ["1:1", 1], ["9:16", 9 / 16]];
+  return ratios.reduce((best, cur) => (Math.abs(cur[1] - ratio) < Math.abs(best[1] - ratio) ? cur : best))[0];
+}

package/src/features.ts

@@ -1,29 +1,12 @@
 // ─── Feature Catalog ───────────────────────────────────────────────────────────
+// The vocabulary lives in @bettercms-ai/types (RICHTEXT_FEATURES), the one list richtext, the kit
+// and the backend validation read. These are its Lexical-era groups, unchanged: the Lexical editor
+// still switches every heading level with `headings`, which the vocabulary keeps as an alias only.
+import { RICHTEXT_MARK_FEATURES, RICHTEXT_TOGGLE_FEATURES } from '@bettercms-ai/types'
 
-export const ALWAYS_ON_FEATURES = [
-  'bold',
-  'italic',
-  'underline',
-  'strikethrough',
-  'code',
-  'highlight',
-] as const
+export const ALWAYS_ON_FEATURES = RICHTEXT_MARK_FEATURES
 
-export const TOGGLEABLE_FEATURES = [
-  'headings',
-  'blockquote',
-  'horizontalRule',
-  'orderedList',
-  'unorderedList',
-  'checklist',
-  'link',
-  'internalLink',
-  'inlineImage',
-  'videoEmbed',
-  'codeBlock',
-  'table',
-  'columns',
-] as const
+export const TOGGLEABLE_FEATURES = ['headings', ...RICHTEXT_TOGGLE_FEATURES] as const
 
 export type ToggleableRichTextFeature = (typeof TOGGLEABLE_FEATURES)[number]
 

package/src/gallery.ts

@@ -0,0 +1,147 @@
+import { PT_TYPES } from "./types";
+import { isPortableTextTable } from "./table";
+import { safeHref } from "./href";
+
+/**
+ * RT4: the gallery (`PortableTextGallery`, types.ts): the limits, the write check, and the read
+ * both renderers share.
+ *
+ * The limits are the V2 kit's (`ARTICLE_SCHEMAS.gallery` in `controls/rich-text/article.ts`): 2 to
+ * 24 images, a caption of at most 160 characters. As with key takeaways, V2's `min: 2` and its
+ * required image are the editor's, not the write's: an author adds images one at a time, and
+ * refusing the autosave in between would refuse the gallery they are building. So a gallery of
+ * one, or an image not yet chosen, stores; the view leaves an unchosen image out, as V2 does.
+ *
+ * The image is the rich-text image's own `{ src, alt }` (+ an optional media id), so whatever
+ * reads a rich-text image's src and alt reads a gallery image's the same way.
+ */
+export const PT_GALLERY_LIMITS = { minImages: 2, images: 24, captionChars: 160 } as const;
+export const GALLERY_LAYOUTS = ["grid", "carousel"] as const;
+export type GalleryLayout = (typeof GALLERY_LAYOUTS)[number];
+
+const isRecord = (v: unknown): v is Record<string, unknown> =>
+  !!v && typeof v === "object" && !Array.isArray(v);
+
+/** One reason a stored gallery is refused, at its own path inside the block. */
+export type PortableTextGalleryProblem = { path: Array<string | number>; code: string; message: string };
+
+const KEYS = new Set(["_type", "_key", "layout", "images"]);
+const ITEM_KEYS = new Set(["_key", "image", "caption"]);
+const IMAGE_KEYS = new Set(["src", "alt", "mediaId"]);
+
+/**
+ * Every reason `node` cannot be stored, each named with a code: `gallery_invalid` (a shape
+ * problem) or `gallery_limit_exceeded` (a V2 limit). Only a `gallery` block is judged; the type is
+ * new, so there is nothing stored before it to grandfather.
+ */
+export function galleryProblems(node: unknown): PortableTextGalleryProblem[] {
+  const out: PortableTextGalleryProblem[] = [];
+  if (!isRecord(node) || node._type !== PT_TYPES.gallery) return out;
+  const bad = (path: Array<string | number>, message: string, code = "gallery_invalid") =>
+    out.push({ path, code, message: `${code}: ${message}` });
+  for (const k of Object.keys(node)) if (!KEYS.has(k)) bad([k], `unknown key "${k}" (layout, images)`);
+  if (!(GALLERY_LAYOUTS as readonly unknown[]).includes(node.layout)) bad(["layout"], 'layout must be "grid" or "carousel"');
+  if (!Array.isArray(node.images)) {
+    bad(["images"], "images must be an array");
+    return out;
+  }
+  node.images.forEach((item, i) => {
+    const at = ["images", i];
+    if (!isRecord(item)) return bad(at, `images[${i}] must be an object`);
+    for (const k of Object.keys(item)) if (!ITEM_KEYS.has(k)) bad([...at, k], `unknown key "${k}" (image, caption)`);
+    if (typeof item._key !== "string" || !item._key) bad([...at, "_key"], `images[${i}] needs a _key`);
+    if (item.caption !== undefined) {
+      if (typeof item.caption !== "string") bad([...at, "caption"], "caption must be a string");
+      else if (item.caption.length > PT_GALLERY_LIMITS.captionChars) {
+        bad([...at, "caption"], `caption is ${item.caption.length} characters; at most ${PT_GALLERY_LIMITS.captionChars}`, "gallery_limit_exceeded");
+      }
+    }
+    const image = item.image;
+    if (image === undefined || image === null) return;
+    if (!isRecord(image)) return bad([...at, "image"], "image must be { src, alt }");
+    for (const k of Object.keys(image)) if (!IMAGE_KEYS.has(k)) bad([...at, "image", k], `unknown key "${k}" (src, alt, mediaId)`);
+    if (typeof image.src !== "string") bad([...at, "image", "src"], "src must be a string");
+    if (typeof image.alt !== "string") bad([...at, "image", "alt"], "alt must be a string");
+    if (image.mediaId !== undefined && typeof image.mediaId !== "string") bad([...at, "image", "mediaId"], "mediaId must be a string");
+  });
+  if (node.images.length > PT_GALLERY_LIMITS.images) {
+    bad(["images"], `${node.images.length} images; at most ${PT_GALLERY_LIMITS.images}`, "gallery_limit_exceeded");
+  }
+  return out;
+}
+
+/**
+ * `galleryProblems` for every gallery in a rich-text value (top level, and inside table cells),
+ * with the block's `_key` so a refusal names the block an author has to find.
+ */
+export function portableTextGalleryProblems(value: unknown): Array<PortableTextGalleryProblem & { block: string }> {
+  const out: Array<PortableTextGalleryProblem & { block: string }> = [];
+  const walk = (blocks: unknown) => {
+    if (!Array.isArray(blocks)) return;
+    for (const node of blocks) {
+      if (isPortableTextTable(node)) {
+        for (const row of node.rows as unknown[]) {
+          if (!isRecord(row) || !Array.isArray(row.cells)) continue;
+          for (const cell of row.cells) if (isRecord(cell)) walk(cell.content);
+        }
+        continue;
+      }
+      if (!isRecord(node) || node._type !== PT_TYPES.gallery) continue;
+      const block = typeof node._key === "string" ? node._key : "";
+      for (const p of galleryProblems(node)) out.push({ ...p, block });
+    }
+  };
+  walk(value);
+  return out;
+}
+
+/**
+ * The same widened check the rich-text image's `<img>` gets (html.ts `mediaSrc`): http(s), or a
+ * site-relative path with no scheme, whitespace or protocol-relative `//`.
+ */
+export const galleryMediaSrc = (raw: string): string | null =>
+  safeHref(raw) ?? (raw !== "" && !raw.startsWith("//") && !/[:\s]/.test(raw) ? raw : null);
+
+/**
+ * The layout, as inline CSS both renderers write (ui turns each into a React style object). A grid
+ * of equal cells; a carousel is one image per view in a scroll-snap row, its no-JS fallback being
+ * itself.
+ */
+export const GALLERY_STYLES: Record<GalleryLayout, { ul: string; li: string; figure: string; img: string }> = {
+  grid: {
+    ul: "display:grid;grid-template-columns:repeat(auto-fill,minmax(12rem,1fr));gap:1rem;list-style:none;margin:0;padding:0",
+    li: "margin:0",
+    figure: "margin:0",
+    img: "display:block;width:100%;height:auto",
+  },
+  carousel: {
+    ul: "display:flex;gap:1rem;overflow-x:auto;scroll-snap-type:x mandatory;list-style:none;margin:0;padding:0",
+    li: "flex:0 0 100%;scroll-snap-align:start;margin:0",
+    figure: "margin:0",
+    img: "display:block;width:100%;height:auto",
+  },
+};
+
+/**
+ * What a reader sees of a gallery: its layout (grid unless it says carousel) and each image that
+ * has a safe src, with its alt and trimmed caption. An unchosen image is left out, as V2's
+ * `renderArticle("gallery")` leaves it out. Read defensively: a value that never passed the write
+ * check renders what it can.
+ */
+export function galleryView(value: unknown): { layout: GalleryLayout; images: { key: string; src: string; alt: string; caption: string }[] } {
+  const v = isRecord(value) ? value : {};
+  const layout: GalleryLayout = v.layout === "carousel" ? "carousel" : "grid";
+  const images: { key: string; src: string; alt: string; caption: string }[] = [];
+  (Array.isArray(v.images) ? v.images : []).forEach((item, i) => {
+    if (!isRecord(item) || !isRecord(item.image)) return;
+    const src = galleryMediaSrc(typeof item.image.src === "string" ? item.image.src.trim() : "");
+    if (!src) return;
+    images.push({
+      key: typeof item._key === "string" && item._key ? item._key : `i${i}`,
+      src,
+      alt: typeof item.image.alt === "string" ? item.image.alt : "",
+      caption: typeof item.caption === "string" ? item.caption.trim() : "",
+    });
+  });
+  return { layout, images };
+}