@caretcms/core 0.1.0 → 0.1.2

package/dist/runtime/publish.js

@@ -0,0 +1,75 @@
+import { withEntryLock } from "./mutations/engine.js";
+import { TOMBSTONE_KEY } from "./storage/session-overlay-adapter.js";
+function isTombstoneData(data) {
+    return Boolean(data && data[TOMBSTONE_KEY] === true);
+}
+/** The (collection, id) pairs that currently exist in the overlay within scope. */
+async function overlayEntriesInScope(overlay, scope) {
+    const collections = scope.collection
+        ? [scope.collection]
+        : await overlay.discoverCollections();
+    const out = [];
+    for (const collection of collections) {
+        const ids = scope.collection && scope.id
+            ? [scope.id]
+            : await overlay.listEntryIds(collection);
+        for (const id of ids)
+            out.push({ collection, id });
+    }
+    return out;
+}
+/**
+ * Flush the overlay into the base. A tombstoned draft entry deletes from the
+ * base; any other draft entry is written, the base revision bumped, and a
+ * `"publish"` history entry (carrying the pre-publish base data) appended. Each
+ * published entry is then cleared from the overlay so it stops shadowing the
+ * base. Returns the new base revisions so the client can reconcile its cached
+ * revision map — without this, the first edit after a publish would 409.
+ *
+ * NOT atomic across multiple entries (per-entry locks only): on a partial
+ * failure the returned list reflects exactly what was committed. Callers that
+ * surface "publish all" should report that list.
+ */
+export async function publishOverlay(base, overlay, scope = {}) {
+    const targets = await overlayEntriesInScope(overlay, scope);
+    const published = [];
+    for (const { collection, id } of targets) {
+        const result = await withEntryLock(collection, id, async () => {
+            const draft = await overlay.getEntry(collection, id);
+            if (!draft)
+                return null; // raced away; nothing to publish
+            if (isTombstoneData(draft.data)) {
+                await base.deleteEntry(collection, id);
+                await overlay.deleteEntry(collection, id);
+                return { collection, id, revision: await base.getRevision(collection, id), deleted: true };
+            }
+            const before = await base.getEntry(collection, id);
+            await base.writeEntry(collection, id, draft.data);
+            const revision = await base.bumpRevision(collection, id);
+            await base.appendHistory(collection, id, {
+                ts: Date.now(),
+                action: "publish",
+                data: before?.data ?? null,
+            });
+            await overlay.deleteEntry(collection, id);
+            return { collection, id, revision, deleted: false };
+        });
+        if (result)
+            published.push(result);
+    }
+    return published;
+}
+/** Count draft entries currently held in an editor overlay. */
+export async function countOverlayDrafts(overlay, scope = {}) {
+    return (await overlayEntriesInScope(overlay, scope)).length;
+}
+/** Discard an editor's draft(s) within scope without touching the base. Returns
+ *  the number of overlay entries cleared. */
+export async function discardOverlay(overlay, scope = {}) {
+    const targets = await overlayEntriesInScope(overlay, scope);
+    for (const { collection, id } of targets) {
+        await withEntryLock(collection, id, () => overlay.deleteEntry(collection, id));
+    }
+    return targets.length;
+}
+//# sourceMappingURL=publish.js.map

package/dist/runtime/publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish.js","sourceRoot":"","sources":["../../src/runtime/publish.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AAiBrE,SAAS,eAAe,CAAC,IAAyC;IAChE,OAAO,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,qBAAqB,CAClC,OAAuB,EACvB,KAAmB;IAEnB,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU;QAClC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;QACpB,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,EAAE,CAAC;IACxC,MAAM,GAAG,GAA8C,EAAE,CAAC;IAC1D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,GAAG,GACP,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,EAAE;YAC1B,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACZ,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAC7C,KAAK,MAAM,EAAE,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAoB,EACpB,OAAuB,EACvB,QAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAqB,EAAE,CAAC;IAEvC,KAAK,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,IAAoC,EAAE;YAC5F,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,CAAC,iCAAiC;YAE1D,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBACvC,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;gBAC1C,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC7F,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACzD,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE;gBACvC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;gBACd,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,IAAI;aAC3B,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,IAAI,MAAM;YAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAuB,EACvB,QAAsB,EAAE;IAExB,OAAO,CAAC,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9D,CAAC;AAED;6CAC6C;AAC7C,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAuB,EACvB,QAAsB,EAAE;IAExB,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,KAAK,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,OAAO,EAAE,CAAC;QACzC,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC"}

package/dist/runtime/rebuild-webhook.d.ts

@@ -0,0 +1,29 @@
+export interface RebuildWebhookConfig {
+    webhookUrl: string | null;
+    method?: "POST" | "PUT";
+    headers?: Record<string, string>;
+}
+export interface RebuildWebhookPayload {
+    published: Array<{
+        collection: string;
+        id: string;
+        revision: number;
+        deleted: boolean;
+    }>;
+    commit: string | null;
+}
+export type RebuildWebhookResult = {
+    triggered: false;
+    ok: true;
+} | {
+    triggered: true;
+    ok: true;
+    status: number;
+} | {
+    triggered: true;
+    ok: false;
+    status?: number;
+    error: string;
+};
+export declare function triggerRebuildWebhook(config: RebuildWebhookConfig, payload: RebuildWebhookPayload): Promise<RebuildWebhookResult>;
+//# sourceMappingURL=rebuild-webhook.d.ts.map

package/dist/runtime/rebuild-webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebuild-webhook.d.ts","sourceRoot":"","sources":["../../src/runtime/rebuild-webhook.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACzF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAC9B;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,oBAAoB,EAC5B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAoC/B"}

package/dist/runtime/rebuild-webhook.js

@@ -0,0 +1,37 @@
+export async function triggerRebuildWebhook(config, payload) {
+    const webhookUrl = config.webhookUrl?.trim();
+    if (!webhookUrl)
+        return { triggered: false, ok: true };
+    try {
+        const response = await fetch(webhookUrl, {
+            method: config.method ?? "POST",
+            headers: {
+                "content-type": "application/json",
+                ...(config.headers ?? {}),
+            },
+            body: JSON.stringify({
+                source: "caretcms",
+                event: "publish",
+                published: payload.published,
+                commit: payload.commit,
+            }),
+        });
+        if (!response.ok) {
+            return {
+                triggered: true,
+                ok: false,
+                status: response.status,
+                error: `Rebuild webhook failed with status ${response.status}`,
+            };
+        }
+        return { triggered: true, ok: true, status: response.status };
+    }
+    catch (error) {
+        return {
+            triggered: true,
+            ok: false,
+            error: error instanceof Error ? error.message : "Rebuild webhook failed",
+        };
+    }
+}
+//# sourceMappingURL=rebuild-webhook.js.map

package/dist/runtime/rebuild-webhook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rebuild-webhook.js","sourceRoot":"","sources":["../../src/runtime/rebuild-webhook.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA4B,EAC5B,OAA8B;IAE9B,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAEvD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YACvC,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM;YAC/B,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;aAC1B;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,UAAU;gBAClB,KAAK,EAAE,SAAS;gBAChB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,sCAAsC,QAAQ,CAAC,MAAM,EAAE;aAC/D,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,SAAS,EAAE,IAAI;YACf,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;SACzE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/runtime/request-context.d.ts

@@ -4,6 +4,25 @@ export interface CaretRequestContext {
     uploadHandler: UploadHandler;
     sessionId: string | null;
     demoMode: boolean;
+    /**
+     * True when this request is from an authenticated editor (or an active demo
+     * overlay). Gates draft-only behavior such as stega encoding in the live
+     * loaders. Set by the middleware after auth is resolved; absent means false.
+     */
+    editor?: boolean;
+    /**
+     * The authenticated editor's id (from the session cookie), when present. Keys
+     * the per-editor draft overlay so unpublished edits stay isolated per editor.
+     * Absent for anonymous/public requests and legacy sessions.
+     */
+    editorId?: string | null;
+    /**
+     * True only when a per-session storage overlay was actually installed for
+     * this demo request, guaranteeing writes are isolated from the shared base
+     * store. Demo editor rights are granted only when this holds — see
+     * `isEditorAuthenticated`. Absent/false means fail closed.
+     */
+    overlayActive?: boolean;
 }
 export declare function runWithRequestContext<T>(context: CaretRequestContext, fn: () => Promise<T>): Promise<T>;
 export declare function getRequestContext(): CaretRequestContext | undefined;

package/dist/runtime/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/runtime/request-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAID,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,mBAAmB,EAC5B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED,wBAAgB,iBAAiB,IAAI,mBAAmB,GAAG,SAAS,CAEnE;AAED,wBAAgB,qBAAqB,IAAI,mBAAmB,CAQ3D"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../../src/runtime/request-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,cAAc,CAAC;IACxB,aAAa,EAAE,aAAa,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAID,wBAAgB,qBAAqB,CAAC,CAAC,EACrC,OAAO,EAAE,mBAAmB,EAC5B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAEZ;AAED,wBAAgB,iBAAiB,IAAI,mBAAmB,GAAG,SAAS,CAEnE;AAED,wBAAgB,qBAAqB,IAAI,mBAAmB,CAQ3D"}

package/dist/runtime/request-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/runtime/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAUrD,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAuB,CAAC;AAE7D,MAAM,UAAU,qBAAqB,CACnC,OAA4B,EAC5B,EAAoB;IAEpB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,kIAAkI,CACnI,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../src/runtime/request-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AA6BrD,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAuB,CAAC;AAE7D,MAAM,UAAU,qBAAqB,CACnC,OAA4B,EAC5B,EAAoB;IAEpB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,kIAAkI,CACnI,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/runtime/rewrite.d.ts

@@ -9,5 +9,33 @@
  * Elements with nested child markup are skipped (editor warns at runtime).
  */
 import type { StorageAdapter } from "../types.js";
-export declare function rewriteCaretAttributes(html: string, adapter: StorageAdapter): Promise<string>;
+type ScopeMatch = {
+    collection: string;
+    id: string;
+};
+/**
+ * Tags whose text content the rewrite engine can swap (`data-caret` bindings).
+ * `<img>` (src swap) is handled separately. This list is a PUBLIC CONTRACT:
+ * caretize mirrors it as its candidate set (a parity test asserts equality) —
+ * a `data-caret` on any tag outside this list saves through the editor but is
+ * never injected into the public render (a silently inert binding).
+ */
+export declare const REWRITABLE_TEXT_TAGS: readonly ["h1", "h2", "h3", "h4", "h5", "h6", "p", "span", "small", "strong", "em", "a", "li", "td", "th", "label", "button", "figcaption", "blockquote", "dt", "dd", "summary", "caption", "legend"];
+/**
+ * CANONICAL data-caret value resolution (exported for the parser parity test):
+ * full triple as-is; bare field resolved against the nearest enclosing scope;
+ * anything else (2 or 4+ parts) is not a binding. The hand-mirrored copies in
+ * browser-runtime.ts, static/cms/editor/helpers.js, and
+ * static/cms/dev-toolbar/app.js are held to this behavior by
+ * tests/unit/caret-parser-parity.test.ts.
+ */
+export declare function resolveBinding(caretValue: string, scope: ScopeMatch | null): {
+    collection: string;
+    id: string;
+    field: string;
+} | null;
+export declare function rewriteCaretAttributes(html: string, adapter: StorageAdapter, options?: {
+    allowedClasses?: Record<string, readonly string[]>;
+}): Promise<string>;
+export {};
 //# sourceMappingURL=rewrite.d.ts.map

package/dist/runtime/rewrite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../../src/runtime/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAC;AAyL7D,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,MAAM,CAAC,CAyHjB"}
+{"version":3,"file":"rewrite.d.ts","sourceRoot":"","sources":["../../src/runtime/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,aAAa,CAAC;AAkB7D,KAAK,UAAU,GAAG;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ,CAAC;AASF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,uMAKvB,CAAC;AAwGX;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,UAAU,GAAG,IAAI,GACvB;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAW1D;AAmCD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,cAAc,EACvB,OAAO,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,GAC/D,OAAO,CAAC,MAAM,CAAC,CAyHjB"}

package/dist/runtime/rewrite.js

@@ -9,7 +9,21 @@
  * Elements with nested child markup are skipped (editor warns at runtime).
  */
 import { sanitizeHtml } from "./sanitize-html.js";
+import { getNestedValue } from "./utils.js";
 // --- Patterns ---
+/**
+ * Tags whose text content the rewrite engine can swap (`data-caret` bindings).
+ * `<img>` (src swap) is handled separately. This list is a PUBLIC CONTRACT:
+ * caretize mirrors it as its candidate set (a parity test asserts equality) —
+ * a `data-caret` on any tag outside this list saves through the editor but is
+ * never injected into the public render (a silently inert binding).
+ */
+export const REWRITABLE_TEXT_TAGS = [
+    "h1", "h2", "h3", "h4", "h5", "h6",
+    "p", "span", "small", "strong", "em", "a", "li", "td", "th", "label",
+    "button", "figcaption", "blockquote", "dt", "dd", "summary", "caption",
+    "legend",
+];
 // Matches any element with data-caret attribute.
 // Captures: tag name, full opening tag, data-caret value, content between tags, closing tag
 //
@@ -19,7 +33,7 @@ import { sanitizeHtml } from "./sanitize-html.js";
 // capture the inner content. <img> is handled separately by IMG_ELEMENT_PATTERN
 // because it is a void element with no closing tag and (in standard HTML5
 // output) no self-closing slash — it would never match this pattern.
-const CARET_ELEMENT_PATTERN = /<(h[1-6]|p|span|small|strong|em|a|li|td|th|label|button|figcaption|blockquote|dt|dd|summary|caption|legend)\b([^>]*?\bdata-caret\s*=\s*"([^"]*)"[^>]*?)(?:\/>|>([\s\S]*?)<\/\1>)/;
+const CARET_ELEMENT_PATTERN = new RegExp(`<(${REWRITABLE_TEXT_TAGS.join("|")})\\b([^>]*?\\bdata-caret\\s*=\\s*"([^"]*)"[^>]*?)(?:\\/>|>([\\s\\S]*?)<\\/\\1>)`);
 // Void <img> with a data-caret binding. Closes on a bare `>` or a self-closing
 // `/>` — never on a closing tag. Captures: 1 = attribute string, 2 = data-caret value.
 const IMG_ELEMENT_PATTERN = /<img\b([^>]*?\bdata-caret\s*=\s*"([^"]*)"[^>]*?)\/?>/;
@@ -93,7 +107,15 @@ function findNearestScope(stack) {
     }
     return null;
 }
-function resolveBinding(caretValue, scope) {
+/**
+ * CANONICAL data-caret value resolution (exported for the parser parity test):
+ * full triple as-is; bare field resolved against the nearest enclosing scope;
+ * anything else (2 or 4+ parts) is not a binding. The hand-mirrored copies in
+ * browser-runtime.ts, static/cms/editor/helpers.js, and
+ * static/cms/dev-toolbar/app.js are held to this behavior by
+ * tests/unit/caret-parser-parity.test.ts.
+ */
+export function resolveBinding(caretValue, scope) {
     const parts = caretValue.split("::");
     if (parts.length === 3) {
         return { collection: parts[0], id: parts[1], field: parts[2] };
@@ -123,20 +145,12 @@ async function batchLoadEntries(adapter, keys) {
     await Promise.all(promises);
     return entries;
 }
-function getNestedValue(data, path) {
-    const keys = path.split(".");
-    let current = data;
-    for (const key of keys) {
-        if (current === null || current === undefined)
-            return undefined;
-        if (typeof current !== "object")
-            return undefined;
-        current = current[key];
-    }
-    return typeof current === "string" ? current : undefined;
+function getNestedString(data, path) {
+    const value = getNestedValue(data, path);
+    return typeof value === "string" ? value : undefined;
 }
 // --- Main rewrite ---
-export async function rewriteCaretAttributes(html, adapter) {
+export async function rewriteCaretAttributes(html, adapter, options) {
     // 1. Find all data-caret bindings and collect unique entry keys
     const bindings = [];
     const entryKeys = new Set();
@@ -193,7 +207,7 @@ export async function rewriteCaretAttributes(html, adapter) {
         const entry = entries.get(entryKey);
         if (!entry)
             continue;
-        const storedValue = getNestedValue(entry.data, binding.field);
+        const storedValue = getNestedString(entry.data, binding.field);
         if (storedValue === undefined)
             continue;
         if (binding.isImg) {
@@ -224,7 +238,7 @@ export async function rewriteCaretAttributes(html, adapter) {
                 const before = binding.fullMatch.slice(0, openTagEnd);
                 const after = binding.fullMatch.slice(closeTagStart);
                 const injected = binding.isRich
-                    ? sanitizeHtml(storedValue)
+                    ? sanitizeHtml(storedValue, { allowedClasses: options?.allowedClasses })
                     : escapeHtml(storedValue);
                 const newMatch = before + injected + after;
                 result =

package/dist/runtime/rewrite.js.map

@@ -1 +1 @@
-{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../src/runtime/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA0BlD,mBAAmB;AAEnB,iDAAiD;AACjD,4FAA4F;AAC5F,EAAE;AACF,mFAAmF;AACnF,0EAA0E;AAC1E,4EAA4E;AAC5E,gFAAgF;AAChF,0EAA0E;AAC1E,qEAAqE;AACrE,MAAM,qBAAqB,GACzB,kLAAkL,CAAC;AAErL,+EAA+E;AAC/E,uFAAuF;AACvF,MAAM,mBAAmB,GACvB,sDAAsD,CAAC;AAEzD,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAEpD,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAC5D,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IACL,OAAO;IACP,IAAI;IACJ,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB,EAAE,OAAe;IACpD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACjC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,UAAkB,EAClB,KAA8C,EAC9C,KAAa;IAEb,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/B,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,KAAK,IAAI,UAAU;YAAE,MAAM;QAErC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAEvF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/B,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBACf,OAAO;gBACP,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CACrB,UAAkB,EAClB,KAAwB;IAExB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,0CAA0C;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4BAA4B;AAE5B,SAAS,cAAc,CAAC,OAAe;IACrC,yDAAyD;IACzD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,sBAAsB;AAEtB,KAAK,UAAU,gBAAgB,CAC7B,OAAuB,EACvB,IAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CACrB,IAA6B,EAC7B,IAAY;IAEZ,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,GAAY,IAAI,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAChE,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClD,OAAO,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,uBAAuB;AAEvB,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,OAAuB;IAEvB,gEAAgE;IAChE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,MAAM,UAAU,GAAG,CACjB,UAAkB,EAClB,KAAa,EACb,OAAe,EACf,KAAc,EACd,KAAwB,EACxB,SAAiB,EACjB,KAAa,EACP,EAAE;QACR,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,SAAS,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,QAAQ;YACX,SAAS;YACT,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM;YACpC,KAAK;YACL,MAAM,EAAE,CAAC,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1C,cAAc,EAAE,CAAC,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC;SAClD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,QAAQ,GAAG,CACf,OAAe,EACf,OAAmE,EAC7D,EAAE;QACR,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,EAAkB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC5D,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC;IAEF,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/C,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,QAAQ,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7C,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,wBAAwB;IACxB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,4DAA4D;IAC5D,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAE7E,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;QAC7B,wFAAwF;QACxF,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAExD,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,WAAW,KAAK,SAAS;YAAE,SAAS;QAExC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,6CAA6C;YAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;YACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,qEAAqE;gBACrE,yEAAyE;gBACzE,iEAAiE;gBACjE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAC9B,QAAQ,CAAC,CAAC,CAAC,EACX,GAAG,EAAE,CAAC,QAAQ,UAAU,CAAC,WAAW,CAAC,GAAG,CACzC,CAAC;gBACF,MAAM;oBACJ,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;wBACrC,SAAS;wBACT,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oCAAoC;YACpC,uEAAuE;YACvE,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAE1D,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,0CAA0C;YAC1C,IAAI,UAAU,GAAG,CAAC,IAAI,aAAa,IAAI,UAAU,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;oBAC7B,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC;oBAC3B,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;gBAC5B,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;gBAE3C,MAAM;oBACJ,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;wBACrC,QAAQ;wBACR,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mBAAmB;AAEnB,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"rewrite.js","sourceRoot":"","sources":["../../src/runtime/rewrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA0B5C,mBAAmB;AAEnB;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;IAClC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO;IACpE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;IACtE,QAAQ;CACA,CAAC;AAEX,iDAAiD;AACjD,4FAA4F;AAC5F,EAAE;AACF,mFAAmF;AACnF,0EAA0E;AAC1E,4EAA4E;AAC5E,gFAAgF;AAChF,0EAA0E;AAC1E,qEAAqE;AACrE,MAAM,qBAAqB,GAAG,IAAI,MAAM,CACtC,KAAK,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,iFAAiF,CACrH,CAAC;AAEF,+EAA+E;AAC/E,uFAAuF;AACvF,MAAM,mBAAmB,GACvB,sDAAsD,CAAC;AAEzD,MAAM,WAAW,GAAG,+BAA+B,CAAC;AAEpD,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAC5D,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAE5C,6EAA6E;AAC7E,mEAAmE;AACnE,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAE3C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IACL,OAAO;IACP,IAAI;IACJ,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,OAAO;IACP,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAmB,EAAE,OAAe;IACpD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YACjC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,UAAkB,EAClB,KAA8C,EAC9C,KAAa;IAEb,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/B,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,KAAK,IAAI,UAAU;YAAE,MAAM;QAErC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,aAAa,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAEvF,IAAI,SAAS,EAAE,CAAC;YACd,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC/B,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBACf,OAAO;gBACP,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAkB,EAClB,KAAwB;IAExB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,0CAA0C;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4BAA4B;AAE5B,SAAS,cAAc,CAAC,OAAe;IACrC,yDAAyD;IACzD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,sBAAsB;AAEtB,KAAK,UAAU,gBAAgB,CAC7B,OAAuB,EACvB,IAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC7C,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CACtB,IAA6B,EAC7B,IAAY;IAEZ,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,uBAAuB;AAEvB,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAAY,EACZ,OAAuB,EACvB,OAAgE;IAEhE,gEAAgE;IAChE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,MAAM,UAAU,GAAG,CACjB,UAAkB,EAClB,KAAa,EACb,OAAe,EACf,KAAc,EACd,KAAwB,EACxB,SAAiB,EACjB,KAAa,EACP,EAAE;QACR,MAAM,QAAQ,GAAG,cAAc,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,SAAS,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,QAAQ,CAAC,IAAI,CAAC;YACZ,GAAG,QAAQ;YACX,SAAS;YACT,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,KAAK,GAAG,SAAS,CAAC,MAAM;YACpC,KAAK;YACL,MAAM,EAAE,CAAC,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1C,cAAc,EAAE,CAAC,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC;SAClD,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,6EAA6E;IAC7E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,QAAQ,GAAG,CACf,OAAe,EACf,OAAmE,EAC7D,EAAE;QACR,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,EAAE,KAAK,EAAE,EAAkB,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC5D,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC;IAEF,gFAAgF;IAChF,QAAQ,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/C,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,QAAQ,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7C,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,wBAAwB;IACxB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,4DAA4D;IAC5D,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;IAE7E,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;QAC7B,wFAAwF;QACxF,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAExD,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/D,IAAI,WAAW,KAAK,SAAS;YAAE,SAAS;QAExC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,6CAA6C;YAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;YACjC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,QAAQ,EAAE,CAAC;gBACb,qEAAqE;gBACrE,yEAAyE;gBACzE,iEAAiE;gBACjE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAC9B,QAAQ,CAAC,CAAC,CAAC,EACX,GAAG,EAAE,CAAC,QAAQ,UAAU,CAAC,WAAW,CAAC,GAAG,CACzC,CAAC;gBACF,MAAM;oBACJ,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;wBACrC,SAAS;wBACT,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,oCAAoC;YACpC,uEAAuE;YACvE,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtD,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAE1D,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,0CAA0C;YAC1C,IAAI,UAAU,GAAG,CAAC,IAAI,aAAa,IAAI,UAAU,EAAE,CAAC;gBAClD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM;oBAC7B,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;oBACxE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;gBAC5B,MAAM,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;gBAE3C,MAAM;oBACJ,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC;wBACrC,QAAQ;wBACR,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,mBAAmB;AAEnB,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC"}

package/dist/runtime/rich-allowlist.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Shared rich-text allowlist + class matcher.
+ *
+ * The single source of truth for what the rich-text sanitizers keep. Imported
+ * by the two TypeScript sanitizers — the server render path (sanitize-html.ts,
+ * regex-based, no DOM) and the cloud live-sync path (browser-runtime.ts, DOM).
+ *
+ * The editor-save sanitizer in static/cms/editor/sanitize.js is shipped as raw,
+ * unbundled JS, so it can't import this module — it MUST mirror these values
+ * and the classAllowed() logic by hand. That hand mirror is held in lockstep by
+ * tests/unit/contracts-parity.test.ts ("browser sanitizer parity"), which fails
+ * CI on any drift (W0). Keep all three sanitizers in lockstep.
+ */
+export declare const RICH_ALLOWED_TAGS: Set<string>;
+/** Attributes preserved per tag (class is gated separately, by allowedClasses). */
+export declare const RICH_ALLOWED_ATTRS: Record<string, Set<string>>;
+export declare const SAFE_HREF_RE: RegExp;
+/**
+ * Per-tag class allowlist. Keys are tag names, values are allowed class names.
+ * A pattern ending in `*` is a prefix match (`text-*` allows `text-primary`);
+ * a lone `*` allows any class on that tag. Anything not matched is dropped.
+ * Mirrors the `allowedClasses` option of the `sanitize-html` package.
+ */
+export type AllowedClasses = Record<string, readonly string[]>;
+/** Does `cls` match any pattern in `patterns`? (exact, `prefix-*`, or lone `*`) */
+export declare function classAllowed(cls: string, patterns: readonly string[]): boolean;
+/** Filter a raw class attribute value to the tag's allowed patterns. */
+export declare function filterClasses(value: string, patterns: readonly string[]): string;
+//# sourceMappingURL=rich-allowlist.d.ts.map

package/dist/runtime/rich-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rich-allowlist.d.ts","sourceRoot":"","sources":["../../src/runtime/rich-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,eAAO,MAAM,iBAAiB,aAE5B,CAAC;AAEH,mFAAmF;AACnF,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAE1D,CAAC;AAEF,eAAO,MAAM,YAAY,QAAkC,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;AAE/D,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAU9E;AAED,wEAAwE;AACxE,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAKhF"}

package/dist/runtime/rich-allowlist.js

@@ -0,0 +1,49 @@
+/**
+ * Shared rich-text allowlist + class matcher.
+ *
+ * The single source of truth for what the rich-text sanitizers keep. Imported
+ * by the two TypeScript sanitizers — the server render path (sanitize-html.ts,
+ * regex-based, no DOM) and the cloud live-sync path (browser-runtime.ts, DOM).
+ *
+ * The editor-save sanitizer in static/cms/editor/sanitize.js is shipped as raw,
+ * unbundled JS, so it can't import this module — it MUST mirror these values
+ * and the classAllowed() logic by hand. That hand mirror is held in lockstep by
+ * tests/unit/contracts-parity.test.ts ("browser sanitizer parity"), which fails
+ * CI on any drift (W0). Keep all three sanitizers in lockstep.
+ */
+// `span` (W4) lets styled inline runs (`<span class="gold">…</span>`, common in
+// headings) survive in rich content — but it carries NO attributes of its own
+// (see RICH_ALLOWED_ATTRS): its `class` is kept only when blessed via the per-tag
+// `allowedClasses` config, and everything else (incl. on*=, style=) is stripped.
+// Fuzzed in tests/unit/sanitize-html-properties.test.ts.
+export const RICH_ALLOWED_TAGS = new Set([
+    "b", "strong", "i", "em", "u", "s", "a", "br", "sub", "sup", "span",
+]);
+/** Attributes preserved per tag (class is gated separately, by allowedClasses). */
+export const RICH_ALLOWED_ATTRS = {
+    a: new Set(["href", "target", "rel"]),
+};
+export const SAFE_HREF_RE = /^(?:https?:|mailto:|tel:|\/)/i;
+/** Does `cls` match any pattern in `patterns`? (exact, `prefix-*`, or lone `*`) */
+export function classAllowed(cls, patterns) {
+    for (const p of patterns) {
+        if (p === "*")
+            return true;
+        if (p.endsWith("*")) {
+            if (cls.startsWith(p.slice(0, -1)))
+                return true;
+        }
+        else if (cls === p) {
+            return true;
+        }
+    }
+    return false;
+}
+/** Filter a raw class attribute value to the tag's allowed patterns. */
+export function filterClasses(value, patterns) {
+    return value
+        .split(/\s+/)
+        .filter((c) => c !== "" && classAllowed(c, patterns))
+        .join(" ");
+}
+//# sourceMappingURL=rich-allowlist.js.map

package/dist/runtime/rich-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rich-allowlist.js","sourceRoot":"","sources":["../../src/runtime/rich-allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,gFAAgF;AAChF,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AACjF,yDAAyD;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACvC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;CACpE,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAgC;IAC7D,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;CACtC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAU5D,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAA2B;IACnE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC3B,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClD,CAAC;aAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,QAA2B;IACtE,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,CAAC;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;SACpD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC"}

package/dist/runtime/routes/_helpers.d.ts

@@ -1,5 +1,37 @@
 import type { StorageAdapter, UploadHandler } from "../../types.js";
+/**
+ * Storage adapter for CMS API/Studio routes. Prefer the middleware ALS scope;
+ * fall back to the configured base adapter when injectRoute handlers run
+ * outside middleware (seen in Astro static dev after HMR or stale processes).
+ */
+export declare function resolveAdapter(): Promise<StorageAdapter>;
+export declare function resolveUploadHandler(): Promise<UploadHandler>;
 export declare function json(body: Record<string, unknown>, status?: number): Response;
+/** Default cap for JSON command payloads (mutate/history/login). */
+export declare const MAX_JSON_BODY_BYTES: number;
+/** Default cap for multipart upload bodies before they're buffered. */
+export declare const MAX_UPLOAD_BODY_BYTES: number;
+/**
+ * Reject a request whose declared Content-Length exceeds `maxBytes`. Cheap
+ * first line of defense for bodies we must hand to a buffering parser (e.g.
+ * formData()): an honest client and most attacks announce their size. Returns
+ * a 413 response when over the cap, otherwise null. Absent/garbage
+ * Content-Length passes here — pair with a streaming cap where possible.
+ */
+export declare function enforceContentLength(request: Request, maxBytes: number): Response | null;
+type JsonBodyResult = {
+    ok: true;
+    value: unknown;
+} | {
+    ok: false;
+    response: Response;
+};
+/**
+ * Read and JSON-parse a request body with a hard byte cap, streaming the body
+ * and aborting once the running total exceeds `maxBytes` so an attacker can't
+ * exhaust memory by omitting Content-Length and sending a chunked flood.
+ */
+export declare function readJsonBody(request: Request, maxBytes?: number): Promise<JsonBodyResult>;
 /**
  * Lightweight CSRF defense for mutating endpoints.
  *
@@ -14,4 +46,5 @@ export declare function enforceCsrfHeader(request: Request): Response | null;
 export declare function getAdapter(): StorageAdapter;
 export declare function getUploadHandler(): UploadHandler;
 export declare function getSessionId(): string | null;
+export {};
 //# sourceMappingURL=_helpers.d.ts.map

package/dist/runtime/routes/_helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_helpers.d.ts","sourceRoot":"","sources":["../../../src/runtime/routes/_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAMpE,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,SAAM,GAAG,QAAQ,CAK1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAWnE;AAED,wBAAgB,UAAU,IAAI,cAAc,CAE3C;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C"}
+{"version":3,"file":"_helpers.d.ts","sourceRoot":"","sources":["../../../src/runtime/routes/_helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAyBpE;;;;GAIG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,CAI9D;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,aAAa,CAAC,CAInE;AAKD,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,SAAM,GAAG,QAAQ,CAK1E;AAED,oEAAoE;AACpE,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAC/C,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,QAAmB,CAAC;AAEtD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,MAAM,GACf,QAAQ,GAAG,IAAI,CAMjB;AAED,KAAK,cAAc,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtC;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,OAAO,EAChB,QAAQ,GAAE,MAA4B,GACrC,OAAO,CAAC,cAAc,CAAC,CAmBzB;AA2CD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,IAAI,CAWnE;AAED,wBAAgB,UAAU,IAAI,cAAc,CAE3C;AAED,wBAAgB,gBAAgB,IAAI,aAAa,CAEhD;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C"}

package/dist/runtime/routes/_helpers.js

@@ -1,4 +1,37 @@
-import { requireRequestContext } from "../request-context.js";
+import { getRequestContext, requireRequestContext, } from "../request-context.js";
+import { getRuntimeServices } from "../providers.js";
+let bootstrapContext = null;
+async function bootstrapRequestContext() {
+    if (!bootstrapContext) {
+        bootstrapContext = getRuntimeServices().then((services) => ({
+            adapter: services.adapter,
+            uploadHandler: services.uploadHandler,
+            sessionId: null,
+            editorId: null,
+            demoMode: false,
+            overlayActive: false,
+            editor: false,
+        }));
+    }
+    return bootstrapContext;
+}
+/**
+ * Storage adapter for CMS API/Studio routes. Prefer the middleware ALS scope;
+ * fall back to the configured base adapter when injectRoute handlers run
+ * outside middleware (seen in Astro static dev after HMR or stale processes).
+ */
+export async function resolveAdapter() {
+    const ctx = getRequestContext();
+    if (ctx)
+        return ctx.adapter;
+    return (await bootstrapRequestContext()).adapter;
+}
+export async function resolveUploadHandler() {
+    const ctx = getRequestContext();
+    if (ctx)
+        return ctx.uploadHandler;
+    return (await bootstrapRequestContext()).uploadHandler;
+}
 const CSRF_HEADER = "x-caret-request";
 const CSRF_HEADER_VALUE = "1";
 export function json(body, status = 200) {
@@ -7,6 +40,89 @@ export function json(body, status = 200) {
         headers: { "Content-Type": "application/json; charset=utf-8" },
     });
 }
+/** Default cap for JSON command payloads (mutate/history/login). */
+export const MAX_JSON_BODY_BYTES = 1024 * 1024; // 1 MB
+/** Default cap for multipart upload bodies before they're buffered. */
+export const MAX_UPLOAD_BODY_BYTES = 25 * 1024 * 1024; // 25 MB
+/**
+ * Reject a request whose declared Content-Length exceeds `maxBytes`. Cheap
+ * first line of defense for bodies we must hand to a buffering parser (e.g.
+ * formData()): an honest client and most attacks announce their size. Returns
+ * a 413 response when over the cap, otherwise null. Absent/garbage
+ * Content-Length passes here — pair with a streaming cap where possible.
+ */
+export function enforceContentLength(request, maxBytes) {
+    const declared = Number(request.headers.get("content-length") ?? "");
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        return json({ error: "Payload too large" }, 413);
+    }
+    return null;
+}
+/**
+ * Read and JSON-parse a request body with a hard byte cap, streaming the body
+ * and aborting once the running total exceeds `maxBytes` so an attacker can't
+ * exhaust memory by omitting Content-Length and sending a chunked flood.
+ */
+export async function readJsonBody(request, maxBytes = MAX_JSON_BODY_BYTES) {
+    const tooLarge = enforceContentLength(request, maxBytes);
+    if (tooLarge)
+        return { ok: false, response: tooLarge };
+    let text;
+    try {
+        text = await readBodyTextCapped(request, maxBytes);
+    }
+    catch (error) {
+        if (error instanceof BodyTooLargeError) {
+            return { ok: false, response: json({ error: "Payload too large" }, 413) };
+        }
+        return { ok: false, response: json({ error: "Invalid body" }, 400) };
+    }
+    try {
+        return { ok: true, value: JSON.parse(text) };
+    }
+    catch {
+        return { ok: false, response: json({ error: "Invalid JSON" }, 400) };
+    }
+}
+class BodyTooLargeError extends Error {
+}
+async function readBodyTextCapped(request, maxBytes) {
+    const body = request.body;
+    if (!body) {
+        const text = await request.text();
+        if (text.length > maxBytes)
+            throw new BodyTooLargeError();
+        return text;
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value)
+                continue;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel().catch(() => { });
+                throw new BodyTooLargeError();
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const merged = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        merged.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(merged);
+}
 /**
  * Lightweight CSRF defense for mutating endpoints.
  *