@codepress/blog 0.0.0-stage → 0.1.0

package/dist/sanitize.d.ts

@@ -0,0 +1,33 @@
+import { type ChildNode } from "domhandler";
+/**
+ * An isomorphic allowlist sanitizer derived from the registry.
+ *
+ * This is the boundary between authored content and the page: the renderer
+ * always runs it, so a post that was never sanitized upstream still cannot put
+ * a script, an event handler or a `javascript:` URL on the page. It works on
+ * the parsed tree rather than on strings, so there is no regex over markup to
+ * get wrong.
+ */
+export interface SanitizeIssue {
+    kind: "element" | "attribute" | "url" | "props";
+    tag: string;
+    name?: string;
+    message: string;
+}
+export interface SanitizeResult {
+    nodes: ChildNode[];
+    issues: SanitizeIssue[];
+}
+/** Elements dropped together with everything inside them. */
+export declare const DROP_WITH_CONTENT: Set<string>;
+/**
+ * Returns the URL when it is safe to emit, otherwise null. Only the schemes in
+ * the registry pass; site-relative paths (`/x`, `#x`) are allowed, but not
+ * protocol-relative ones (`//host`, `/\host`), which browsers resolve to
+ * another origin. Any whitespace or control character rejects the value:
+ * browsers strip them inside a scheme, so `java\tscript:` must not slip by.
+ */
+export declare function sanitizeUrl(value: string): string | null;
+/** Parses `html` and returns the sanitized tree plus what was removed. */
+export declare function sanitizeNodes(html: string): SanitizeResult;
+export declare function sanitizeHtml(html: string): string;

package/dist/schema.d.ts

@@ -0,0 +1,24 @@
+import { type ComponentContent } from "./registry.js";
+/**
+ * Version of the `content-schema.json` shape. Bump only when a key or its
+ * meaning changes; adding an element or component does not change it.
+ */
+export declare const schemaVersion = 1;
+export interface ContentSchema {
+    version: number;
+    elements: Record<string, {
+        attributes: string[];
+        urlAttributes?: string[];
+    }>;
+    components: Record<string, {
+        attributes: string[];
+        content: ComponentContent;
+        props: Record<string, unknown>;
+    }>;
+    urlSchemes: string[];
+    /** Site-relative URLs (`/x`, `#x`) are allowed wherever a URL is. */
+    relativeUrls: boolean;
+    meta: Record<string, unknown>;
+}
+/** Builds the contract a site serves at `<blog>/_schema.json` from the registry. */
+export declare function buildContentSchema(): ContentSchema;

package/dist/seo.d.ts

@@ -0,0 +1,63 @@
+import type { PostMeta } from "./registry.js";
+/**
+ * Where a blog lives and who publishes it. Canonical URLs, structured data,
+ * the feed and the sitemap are all built from this, never from the request, so
+ * a blog mounted at `https://acme.com/blog` or `https://blog.acme.com` names
+ * itself correctly.
+ */
+export interface BlogSite {
+    /** Absolute URL of the blog index, for example `https://acme.com/blog`. */
+    baseUrl: string;
+    /** The publisher's name: default author, breadcrumb root, JSON-LD publisher. */
+    name: string;
+    /** The publisher's home page. Defaults to the origin of `baseUrl`. */
+    homeUrl?: string;
+    /** The feed's channel title, for example `Acme Blog`. */
+    title: string;
+    /** The feed's channel description. */
+    description: string;
+    /** Absolute URL of the image for posts without an `ogImage`. */
+    defaultImage: string;
+    /** The feed's language. Defaults to `en`. */
+    language?: string;
+}
+/** The blog index URL, without a trailing slash. */
+export declare function blogUrl(site: BlogSite): string;
+export declare function postUrl(site: BlogSite, slug: string): string;
+export declare function feedUrl(site: BlogSite): string;
+export declare function homeUrl(site: BlogSite): string;
+/** Escapes `<` so authored text can never close the JSON-LD script tag. */
+export declare function jsonLd(value: unknown): string;
+/** A post's `ogImage` as an absolute URL; site-relative paths use the blog's origin. */
+export declare function absoluteImage(site: BlogSite, ogImage: string | undefined): string;
+export declare function blogPostingJsonLd(site: BlogSite, slug: string, meta: PostMeta): {
+    keywords?: string | undefined;
+    "@context": string;
+    "@type": string;
+    headline: string;
+    description: string;
+    url: string;
+    mainEntityOfPage: string;
+    datePublished: string;
+    dateModified: string;
+    image: string;
+    author: {
+        "@type": string;
+        name: string;
+    }[];
+    publisher: {
+        "@type": string;
+        name: string;
+        url: string;
+    };
+};
+export declare function breadcrumbJsonLd(site: BlogSite, slug: string, title: string): {
+    "@context": string;
+    "@type": string;
+    itemListElement: {
+        "@type": string;
+        position: number;
+        name: string;
+        item: string;
+    }[];
+};

package/dist/sitemap.d.ts

@@ -0,0 +1,4 @@
+import type { PostSummary } from "./content-source.js";
+import { type BlogSite } from "./seo.js";
+/** A sitemap of the blog index and every post; `posts` are newest first. */
+export declare function sitemapXml(site: BlogSite, posts: PostSummary[]): string;

package/dist/xml.d.ts

@@ -0,0 +1 @@
+export declare function escapeXml(value: string): string;

package/package.json

@@ -1,6 +1,94 @@
 {
   "name": "@codepress/blog",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Render a CodePress blog: registry, sanitizer, schema, SEO, feed, sitemap, content source and React renderer.",
+  "type": "module",
+  "sideEffects": [
+    "*.css"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./react": {
+      "types": "./dist/react/index.d.ts",
+      "default": "./dist/react/index.js"
+    },
+    "./next": {
+      "types": "./dist/next/index.d.ts",
+      "default": "./dist/next/index.js"
+    },
+    "./next/pages": {
+      "types": "./dist/next/pages.d.ts",
+      "default": "./dist/next/pages.js"
+    },
+    "./next/routes": {
+      "types": "./dist/next/routes.d.ts",
+      "default": "./dist/next/routes.js"
+    },
+    "./editor": {
+      "types": "./dist/editor/index.d.ts",
+      "default": "./dist/editor/index.js"
+    },
+    "./editor/client": {
+      "types": "./dist/editor/client.d.ts",
+      "default": "./dist/editor/client.js"
+    },
+    "./blog.css": "./dist/blog.css"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@radix-ui/react-dropdown-menu": "^2.1.16",
+    "@radix-ui/react-tooltip": "^1.2.8",
+    "dom-serializer": "^3.1.1",
+    "domhandler": "^6.0.1",
+    "html-react-parser": "^6.1.8",
+    "htmlparser2": "^12.0.0",
+    "lucide-react": "^0.541.0",
+    "tailwind-merge": "^3.5.0",
+    "zod": "^4.3.6"
+  },
+  "peerDependencies": {
+    "@tiptap/extension-image": "3.24.0",
+    "@tiptap/extension-unique-id": "3.24.0",
+    "@tiptap/pm": "3.24.0",
+    "@tiptap/react": "3.24.0",
+    "@tiptap/starter-kit": "3.24.0",
+    "@tiptap/suggestion": "3.24.0",
+    "next": ">=15.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@tiptap/extension-image": {
+      "optional": true
+    },
+    "@tiptap/extension-unique-id": {
+      "optional": true
+    },
+    "@tiptap/pm": {
+      "optional": true
+    },
+    "@tiptap/react": {
+      "optional": true
+    },
+    "@tiptap/starter-kit": {
+      "optional": true
+    },
+    "@tiptap/suggestion": {
+      "optional": true
+    },
+    "next": {
+      "optional": true
+    }
+  },
+  "bin": {
+    "codepress-blog": "./dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ]
+}