@roottale/cms-core 0.2.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @roottale/cms-core
 
+## 0.7.0
+
+### Minor Changes
+
+- e2067cf: feat: 영상 임베드 블록 + 공개 글 작성자 byline + Astro 목차(TOC)
+  - **cms-core**: `normalizeEmbed`/`isAllowedEmbedSrc` 추가 — YouTube·Vimeo
+    provider allowlist 기반 임베드 URL 정규화 + 렌더 단계 host·path 재검증(SSRF 방어).
+  - **cms-client**: `CmsPostContent.authorName` 노출(공개 표시명, email 비노출).
+  - **cms-renderer-next**: `core/embed` 노드 렌더(allowlist iframe, 미허용 시 원본
+    링크 fallback) + 글 상세 작성자 byline.
+  - **cms-renderer-astro**: 위와 동등한 embed 렌더 + 작성자 byline + Next 와 동등한
+    TOC 지원(`extractToc`/`attachHeadingIds`, `showTableOfContents` 옵션).
+
+## 0.2.1
+
+### Patch Changes
+
+- dist build 도입 — `.ts` 소스 직접 publish 폐기.
+
+  기존 (0.1.0/0.2.0): `exports` 가 `./src/server.ts` 가리킴 → 외부 Next.js
+  Turbopack/Webpack 이 npm 모듈에서 TS 자동 컴파일 안 해 build 실패 (customer
+  site 가 `transpilePackages` 명시해야 했음).
+
+  수정: `tsup` 으로 `dist/*.js` + `dist/*.d.ts` (ESM) 출력. `exports` 가 dist
+  가리킴. customer site 측 `transpilePackages` 불필요.
+  - `cms-client@0.1.1` — ESM `dist/server.js` + types
+  - `cms-core@0.2.1` — ESM `dist/index.js` + types
+  - `cms-renderer-next@0.2.1` — ESM `dist/{server,index}.js` + types + `dist/cms-public.css`
+    - `server.tsx` 의 `import "./styles/cms-public.css"` 제거 — customer 가
+      `@roottale/cms-renderer-next/styles` 로 명시 import (README 정합).
+  - `cms-renderer-astro@0.2.1` — ESM `dist/index.js` + types
+
+  후속 (customer site PR):
+  - roottale-web / kjmtax / theoneulsan 의 `next.config` 의 `transpilePackages`
+    에서 `@roottale/cms-*` 제거. `pnpm update @roottale/cms-client @roottale/cms-renderer-next` 로 patch 적용.
+
 ## 0.2.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -0,0 +1,149 @@
+import { z, ZodSchema } from 'zod';
+
+/** WP-compatible name pattern: `core/<x>` | `roottale/<x>` */
+declare const BLOCK_NAME_PATTERN: RegExp;
+/**
+ * Block schema (recursive — innerBlocks).
+ * `_id` 는 internal-only (export 시 strip, ADR §5).
+ */
+declare const blockSchema: z.ZodType<Block>;
+interface Block {
+    /** uuidv7. Internal-only — never exported as WP delimiter attribute. */
+    _id: string;
+    /** `core/<x>` or `roottale/<x>` */
+    name: string;
+    attributes: Record<string, unknown>;
+    innerBlocks: Block[];
+    /** WP delimiter innerHTML (preserved for round-trip — codex v2 verdict #7). */
+    rawHtml?: string;
+    metadata?: {
+        bindings?: Record<string, {
+            source: string;
+            args?: Record<string, unknown>;
+        }>;
+        name?: string;
+        reusableRef?: string;
+    };
+}
+declare function isValidBlock(value: unknown): value is Block;
+declare function parseBlock(value: unknown): Block;
+/**
+ * Phase 1 core block names (10) — ADR-0034 §5.
+ * Phase 2+ 에 `core/embed`, `core/gallery`, `core/cover` 등 추가.
+ */
+declare const PHASE_1_CORE_BLOCKS: readonly ["core/paragraph", "core/heading", "core/image", "core/list", "core/quote", "core/code", "core/columns", "core/group", "core/separator", "core/spacer"];
+type Phase1CoreBlockName = (typeof PHASE_1_CORE_BLOCKS)[number];
+
+/**
+ * Astro island spec — `client:visible` / `client:idle` / `client:load` 등.
+ * frontend 의 native interactivity. WP Interactivity API 카피 안 함.
+ */
+interface AstroIslandSpec {
+    /** Astro `client:*` directive */
+    hydration?: "visible" | "idle" | "load" | "media" | "only";
+    /** client-side module path (relative to package) */
+    module?: string;
+}
+/**
+ * BlockDefinition<A> — block 의 schema + Astro render 어댑터.
+ * Phase 5 에 Next public renderer 활성 시 별도 ADR-amend 의 add 의무.
+ */
+interface BlockDefinition<A = Record<string, unknown>> {
+    /** `core/<x>` or `roottale/<x>` */
+    name: string;
+    /** display metadata for admin editor */
+    meta: {
+        title: string;
+        description?: string;
+        category?: "text" | "media" | "design" | "widgets" | "theme" | "embed";
+        icon?: string;
+    };
+    /** attributes validation */
+    schema: ZodSchema<A>;
+    /** WP `supports` 등 flags */
+    supports?: {
+        align?: boolean;
+        color?: boolean;
+        spacing?: boolean;
+        typography?: boolean;
+        customClassName?: boolean;
+    };
+    /** parent block name 강제 (e.g. `core/column` 은 `core/columns` 아래만) */
+    parent?: readonly string[];
+    /** ancestor block name 강제 */
+    ancestor?: readonly string[];
+    /** Astro server render — 본 함수는 packages/cms-renderer-astro 에서 호출 */
+    astroRender: (block: Block & {
+        attributes: A;
+    }) => unknown;
+    /** Astro client island (optional) */
+    clientHydration?: {
+        astro?: AstroIslandSpec;
+    };
+}
+/**
+ * Block registry — Phase 1 에서 register/lookup helper 추가 (현재는 type-only).
+ */
+type BlockRegistry = ReadonlyMap<string, BlockDefinition>;
+
+/**
+ * Block → WP delimiter 형식 직렬화 (export).
+ * `_id` 와 `metadata.reusableRef` 는 strip — WP 호환.
+ */
+declare function serializeBlock(block: Block): string;
+
+type EmbedProvider = "youtube" | "vimeo";
+interface NormalizedEmbed {
+    provider: EmbedProvider;
+    /** allowlist host 의 canonical iframe src (가능 시 privacy-enhanced). */
+    embedSrc: string;
+    /** 사용자가 입력한 원본 URL — fallback 링크 / round-trip 보존용. */
+    originalUrl: string;
+}
+/**
+ * 사용자 입력 URL → allowlist provider 의 canonical embed. 지원하지 않는
+ * provider / 파싱 실패 시 `null`.
+ */
+declare function normalizeEmbed(input: unknown): NormalizedEmbed | null;
+/**
+ * 이미 저장된 embed src 가 allowlist host(https) 인지 검증 — 렌더러가 iframe
+ * 출력 전 호출. 임의 host / 비 https 는 거부.
+ */
+declare function isAllowedEmbedSrc(value: unknown): value is string;
+
+interface PreviewTokenPayload {
+    postId: string;
+    expiresAt: Date;
+}
+/** 새 preview token 생성. DB insert 책임은 caller. */
+declare function issuePreviewToken(secret: string, payload: PreviewTokenPayload): string;
+/** Token 검증 (서명 + 만료). DB row consumed_at update 는 caller (atomic). */
+declare function verifyPreviewToken(secret: string, token: string): PreviewTokenPayload | null;
+
+/**
+ * 미니멀 XSS sanitize — Tiptap HTML output 또는 rawHtml 의 안전 정리.
+ * Phase 1 acceptance: `<script>alert(1)</script>` 인라인이 inert 가 되어야 함.
+ */
+declare function sanitizeHtml(html: string): string;
+/**
+ * 표준 CSP 헤더 값 (Phase 1 acceptance test #7 정합).
+ * Astro middleware / Next.js header config 에서 사용.
+ */
+declare const PHASE_1_CSP: string;
+
+/**
+ * Block 에 stable id 주입.
+ * 이미 `_id` 있는 block 은 그대로, 없으면 uuidv7 생성. recursive (innerBlocks).
+ */
+declare function ensureStableIds(block: Omit<Block, "_id"> & {
+    _id?: string;
+}): Block;
+/**
+ * 한 번에 block tree 전체에 stable id 주입.
+ * import 또는 새 post 생성 시 entrypoint.
+ */
+declare function injectStableIdsTree(blocks: readonly (Omit<Block, "_id"> & {
+    _id?: string;
+})[]): Block[];
+
+export { type AstroIslandSpec, BLOCK_NAME_PATTERN, type Block, type BlockDefinition, type BlockRegistry, type EmbedProvider, type NormalizedEmbed, PHASE_1_CORE_BLOCKS, PHASE_1_CSP, type Phase1CoreBlockName, type PreviewTokenPayload, blockSchema, ensureStableIds, injectStableIdsTree, isAllowedEmbedSrc, isValidBlock, issuePreviewToken, normalizeEmbed, parseBlock, sanitizeHtml, serializeBlock, verifyPreviewToken };

package/dist/index.js

@@ -0,0 +1,239 @@
+// src/block.ts
+import { z } from "zod";
+var BLOCK_NAME_PATTERN = /^(core|roottale)\/[a-z0-9-]+$/;
+var blockMetadataSchema = z.object({
+  bindings: z.record(
+    z.object({
+      source: z.string(),
+      args: z.record(z.unknown()).optional()
+    })
+  ).optional(),
+  name: z.string().optional(),
+  reusableRef: z.string().optional()
+}).strict().optional();
+var blockSchema = z.lazy(
+  () => z.object({
+    _id: z.string().uuid(),
+    name: z.string().regex(BLOCK_NAME_PATTERN),
+    attributes: z.record(z.unknown()),
+    innerBlocks: z.array(blockSchema),
+    rawHtml: z.string().optional(),
+    metadata: blockMetadataSchema
+  }).strict()
+);
+function isValidBlock(value) {
+  return blockSchema.safeParse(value).success;
+}
+function parseBlock(value) {
+  return blockSchema.parse(value);
+}
+var PHASE_1_CORE_BLOCKS = [
+  "core/paragraph",
+  "core/heading",
+  "core/image",
+  "core/list",
+  "core/quote",
+  "core/code",
+  "core/columns",
+  "core/group",
+  "core/separator",
+  "core/spacer"
+];
+
+// src/delimiter.ts
+function serializeBlock(block) {
+  const exportable = sanitizeAttributesForExport(block);
+  const attrsJson = serializeAttributes(exportable.attributes);
+  const innerHtml = block.rawHtml ?? "";
+  const innerSerialized = (block.innerBlocks ?? []).map((b) => serializeBlock(b)).join("\n");
+  if (!innerHtml && innerSerialized.length === 0) {
+    return attrsJson ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} /-->` : `<!-- wp:${normalizeName(block.name)} /-->`;
+  }
+  const open = attrsJson ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} -->` : `<!-- wp:${normalizeName(block.name)} -->`;
+  const close = `<!-- /wp:${normalizeName(block.name)} -->`;
+  const body = [innerHtml, innerSerialized].filter(Boolean).join("\n");
+  return `${open}
+${body}
+${close}`;
+}
+function normalizeName(name) {
+  return name.startsWith("core/") ? name.slice("core/".length) : name;
+}
+function serializeAttributes(attrs) {
+  const keys = Object.keys(attrs);
+  if (keys.length === 0) return "";
+  return JSON.stringify(attrs);
+}
+function sanitizeAttributesForExport(block) {
+  return { attributes: { ...block.attributes } };
+}
+
+// src/embed.ts
+var YOUTUBE_HOSTS = /* @__PURE__ */ new Set([
+  "youtube.com",
+  "www.youtube.com",
+  "m.youtube.com",
+  "youtu.be",
+  "www.youtu.be"
+]);
+var VIMEO_HOSTS = /* @__PURE__ */ new Set(["vimeo.com", "www.vimeo.com", "player.vimeo.com"]);
+var ALLOWED_EMBED_HOSTS = /* @__PURE__ */ new Set([
+  "www.youtube-nocookie.com",
+  "youtube-nocookie.com",
+  "www.youtube.com",
+  "youtube.com",
+  "player.vimeo.com"
+]);
+var YOUTUBE_ID = /^[A-Za-z0-9_-]{11}$/;
+var VIMEO_ID = /^\d+$/;
+function normalizeEmbed(input) {
+  if (typeof input !== "string") return null;
+  const raw = input.trim();
+  if (raw.length === 0) return null;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+  const host = url.hostname.toLowerCase();
+  if (YOUTUBE_HOSTS.has(host)) {
+    const id = extractYouTubeId(url, host);
+    if (id) {
+      return {
+        provider: "youtube",
+        embedSrc: `https://www.youtube-nocookie.com/embed/${id}`,
+        originalUrl: raw
+      };
+    }
+  }
+  if (VIMEO_HOSTS.has(host)) {
+    const id = extractVimeoId(url, host);
+    if (id) {
+      return {
+        provider: "vimeo",
+        embedSrc: `https://player.vimeo.com/video/${id}`,
+        originalUrl: raw
+      };
+    }
+  }
+  return null;
+}
+function isAllowedEmbedSrc(value) {
+  if (typeof value !== "string") return false;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  if (!ALLOWED_EMBED_HOSTS.has(host)) return false;
+  if (host === "player.vimeo.com") {
+    return /^\/video\/\d+$/.test(url.pathname);
+  }
+  return new RegExp("^/embed/[A-Za-z0-9_-]{11}$").test(url.pathname);
+}
+function extractYouTubeId(url, host) {
+  if (host === "youtu.be" || host === "www.youtu.be") {
+    const id = url.pathname.split("/").filter(Boolean)[0] ?? "";
+    return YOUTUBE_ID.test(id) ? id : null;
+  }
+  const v = url.searchParams.get("v");
+  if (v && YOUTUBE_ID.test(v)) return v;
+  const parts = url.pathname.split("/").filter(Boolean);
+  if (parts.length >= 2 && (parts[0] === "embed" || parts[0] === "shorts" || parts[0] === "v")) {
+    return YOUTUBE_ID.test(parts[1]) ? parts[1] : null;
+  }
+  return null;
+}
+function extractVimeoId(url, host) {
+  const parts = url.pathname.split("/").filter(Boolean);
+  let candidate;
+  if (host === "player.vimeo.com") {
+    const vi = parts.indexOf("video");
+    candidate = vi >= 0 ? parts[vi + 1] : parts[parts.length - 1];
+  } else {
+    candidate = parts[0];
+  }
+  return candidate && VIMEO_ID.test(candidate) ? candidate : null;
+}
+
+// src/preview-token.ts
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+var DELIMITER = ".";
+function base64url(buf) {
+  return buf.toString("base64url");
+}
+function fromBase64url(s) {
+  return Buffer.from(s, "base64url");
+}
+function sign(secret, message) {
+  return base64url(createHmac("sha256", secret).update(message).digest());
+}
+function issuePreviewToken(secret, payload) {
+  const exp = payload.expiresAt.getTime();
+  const nonce = base64url(randomBytes(12));
+  const message = `${payload.postId}${DELIMITER}${exp}${DELIMITER}${nonce}`;
+  const sig = sign(secret, message);
+  return `${message}${DELIMITER}${sig}`;
+}
+function verifyPreviewToken(secret, token) {
+  const parts = token.split(DELIMITER);
+  if (parts.length !== 4) return null;
+  const [postId, expRaw, nonce, sig] = parts;
+  const exp = Number(expRaw);
+  if (!Number.isFinite(exp)) return null;
+  if (Date.now() > exp) return null;
+  const expectedSig = sign(secret, `${postId}${DELIMITER}${exp}${DELIMITER}${nonce}`);
+  const a = fromBase64url(sig);
+  const b = fromBase64url(expectedSig);
+  if (a.length !== b.length) return null;
+  if (!timingSafeEqual(a, b)) return null;
+  return { postId, expiresAt: new Date(exp) };
+}
+
+// src/sanitize.ts
+var SCRIPT_TAG_RE = /<script\b[^>]*>[\s\S]*?<\/script\s*>/gi;
+var ON_EVENT_ATTR_RE = /\s+on[a-z]+\s*=\s*"(?:[^"\\]|\\.)*"/gi;
+var ON_EVENT_ATTR_RE_SINGLE = /\s+on[a-z]+\s*=\s*'(?:[^'\\]|\\.)*'/gi;
+var JS_URL_RE = /\s+(href|src)\s*=\s*(['"])\s*javascript:[^'"]*\2/gi;
+var DATA_URL_RE = /\s+(href|src)\s*=\s*(['"])\s*data:(?!image\/)[^'"]*\2/gi;
+function sanitizeHtml(html) {
+  return html.replace(SCRIPT_TAG_RE, "").replace(ON_EVENT_ATTR_RE, "").replace(ON_EVENT_ATTR_RE_SINGLE, "").replace(JS_URL_RE, ' $1="#"').replace(DATA_URL_RE, ' $1="#"');
+}
+var PHASE_1_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://imagedelivery.net https://*.r2.cloudflarestorage.com; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'";
+
+// src/stable-id.ts
+import { uuidv7 } from "uuidv7";
+function ensureStableIds(block) {
+  return {
+    ...block,
+    _id: block._id ?? uuidv7(),
+    innerBlocks: (block.innerBlocks ?? []).map(
+      (inner) => ensureStableIds(inner)
+    )
+  };
+}
+function injectStableIdsTree(blocks) {
+  return blocks.map((b) => ensureStableIds(b));
+}
+export {
+  BLOCK_NAME_PATTERN,
+  PHASE_1_CORE_BLOCKS,
+  PHASE_1_CSP,
+  blockSchema,
+  ensureStableIds,
+  injectStableIdsTree,
+  isAllowedEmbedSrc,
+  isValidBlock,
+  issuePreviewToken,
+  normalizeEmbed,
+  parseBlock,
+  sanitizeHtml,
+  serializeBlock,
+  verifyPreviewToken
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/block.ts","../src/delimiter.ts","../src/embed.ts","../src/preview-token.ts","../src/sanitize.ts","../src/stable-id.ts"],"sourcesContent":["// ADR-0034 §5 — Block JSON 스펙 (WP 호환)\n// Gutenberg block shape + 우리 확장:\n//   - `_id` (uuidv7 stable across revisions, ADR §2 P5)\n//   - `rawHtml` (WP delimiter innerHTML 보존, codex v2 verdict #7)\n//   - `metadata.reusableRef` (Phase 2 = flat expand)\n\nimport { z } from \"zod\";\n\n/** WP-compatible name pattern: `core/<x>` | `roottale/<x>` */\nexport const BLOCK_NAME_PATTERN = /^(core|roottale)\\/[a-z0-9-]+$/;\n\nconst blockMetadataSchema = z\n  .object({\n    bindings: z\n      .record(\n        z.object({\n          source: z.string(),\n          args: z.record(z.unknown()).optional(),\n        }),\n      )\n      .optional(),\n    name: z.string().optional(),\n    reusableRef: z.string().optional(),\n  })\n  .strict()\n  .optional();\n\n/**\n * Block schema (recursive — innerBlocks).\n * `_id` 는 internal-only (export 시 strip, ADR §5).\n */\nexport const blockSchema: z.ZodType<Block> = z.lazy(() =>\n  z\n    .object({\n      _id: z.string().uuid(),\n      name: z.string().regex(BLOCK_NAME_PATTERN),\n      attributes: z.record(z.unknown()),\n      innerBlocks: z.array(blockSchema),\n      rawHtml: z.string().optional(),\n      metadata: blockMetadataSchema,\n    })\n    .strict(),\n);\n\nexport interface Block {\n  /** uuidv7. Internal-only — never exported as WP delimiter attribute. */\n  _id: string;\n  /** `core/<x>` or `roottale/<x>` */\n  name: string;\n  attributes: Record<string, unknown>;\n  innerBlocks: Block[];\n  /** WP delimiter innerHTML (preserved for round-trip — codex v2 verdict #7). */\n  rawHtml?: string;\n  metadata?: {\n    bindings?: Record<string, { source: string; args?: Record<string, unknown> }>;\n    name?: string;\n    reusableRef?: string;\n  };\n}\n\nexport function isValidBlock(value: unknown): value is Block {\n  return blockSchema.safeParse(value).success;\n}\n\nexport function parseBlock(value: unknown): Block {\n  return blockSchema.parse(value);\n}\n\n/**\n * Phase 1 core block names (10) — ADR-0034 §5.\n * Phase 2+ 에 `core/embed`, `core/gallery`, `core/cover` 등 추가.\n */\nexport const PHASE_1_CORE_BLOCKS = [\n  \"core/paragraph\",\n  \"core/heading\",\n  \"core/image\",\n  \"core/list\",\n  \"core/quote\",\n  \"core/code\",\n  \"core/columns\",\n  \"core/group\",\n  \"core/separator\",\n  \"core/spacer\",\n] as const;\nexport type Phase1CoreBlockName = (typeof PHASE_1_CORE_BLOCKS)[number];\n","// ADR-0034 §5 + §6 — WP delimiter parse/serialize\n//\n// WP 의 block serialization 은 HTML 주석 형태:\n//   <!-- wp:paragraph {\"attr\":1} -->\n//   <p>본문</p>\n//   <!-- /wp:paragraph -->\n//\n// Round-trip 룰 (codex v2 verdict #7 + v3 verdict #4):\n//   - `_id` 는 export 시 strip (WP-side import 가 unknown attribute 로 인식해 깨짐 차단)\n//   - `rawHtml` ↔ innerHTML\n//   - 우리가 schema 정의 안 한 block = Tiptap opaque atom node (편집 불가, 보존)\n\nimport type { Block } from \"./block\";\n\n/**\n * Block → WP delimiter 형식 직렬화 (export).\n * `_id` 와 `metadata.reusableRef` 는 strip — WP 호환.\n */\nexport function serializeBlock(block: Block): string {\n  const exportable = sanitizeAttributesForExport(block);\n  const attrsJson = serializeAttributes(exportable.attributes);\n  const innerHtml = block.rawHtml ?? \"\";\n  const innerSerialized = (block.innerBlocks ?? [])\n    .map((b) => serializeBlock(b))\n    .join(\"\\n\");\n\n  // self-closing 형태 (innerHTML + innerBlocks 모두 없으면)\n  if (!innerHtml && innerSerialized.length === 0) {\n    return attrsJson\n      ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} /-->`\n      : `<!-- wp:${normalizeName(block.name)} /-->`;\n  }\n\n  const open = attrsJson\n    ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} -->`\n    : `<!-- wp:${normalizeName(block.name)} -->`;\n  const close = `<!-- /wp:${normalizeName(block.name)} -->`;\n\n  const body = [innerHtml, innerSerialized].filter(Boolean).join(\"\\n\");\n  return `${open}\\n${body}\\n${close}`;\n}\n\n/** WP-side 에서 `core/` 는 보통 namespace 생략 (e.g. `<!-- wp:paragraph -->`) */\nfunction normalizeName(name: string): string {\n  return name.startsWith(\"core/\") ? name.slice(\"core/\".length) : name;\n}\n\nfunction serializeAttributes(attrs: Record<string, unknown>): string {\n  const keys = Object.keys(attrs);\n  if (keys.length === 0) return \"\";\n  return JSON.stringify(attrs);\n}\n\nfunction sanitizeAttributesForExport(block: Block): {\n  attributes: Record<string, unknown>;\n} {\n  // `_id` 와 `metadata.reusableRef` 제거. attributes 안의 임의 키는 그대로 export.\n  return { attributes: { ...block.attributes } };\n}\n","// ADR-0034 §5 — `core/embed` 영상 임베드 헬퍼 (provider allowlist)\n//\n// 본 모듈은 editor (URL → embed 노드 정규화) 와 renderer (저장된 embed src 의\n// 출력 시 재검증, defense-in-depth) 양쪽에서 공유. 순수 모듈 — `URL` 만 사용해\n// 브라우저/서버 모두 안전.\n//\n// 보안 원칙: 임의 iframe src 를 신뢰하지 않는다. 신규 삽입은 `normalizeEmbed`\n// 가 allowlist provider 의 canonical embed URL 로만 변환하고, 출력은\n// `isAllowedEmbedSrc` 로 host 를 한 번 더 검증한다 (legacy/import/외부 테넌트가\n// 임의 src 를 DB 에 남겨도 렌더 단계에서 차단).\n\nexport type EmbedProvider = \"youtube\" | \"vimeo\";\n\nexport interface NormalizedEmbed {\n  provider: EmbedProvider;\n  /** allowlist host 의 canonical iframe src (가능 시 privacy-enhanced). */\n  embedSrc: string;\n  /** 사용자가 입력한 원본 URL — fallback 링크 / round-trip 보존용. */\n  originalUrl: string;\n}\n\nconst YOUTUBE_HOSTS = new Set([\n  \"youtube.com\",\n  \"www.youtube.com\",\n  \"m.youtube.com\",\n  \"youtu.be\",\n  \"www.youtu.be\",\n]);\n\nconst VIMEO_HOSTS = new Set([\"vimeo.com\", \"www.vimeo.com\", \"player.vimeo.com\"]);\n\n/** 출력(iframe) 시 허용되는 embed src host — render 단계 defense-in-depth. */\nconst ALLOWED_EMBED_HOSTS = new Set([\n  \"www.youtube-nocookie.com\",\n  \"youtube-nocookie.com\",\n  \"www.youtube.com\",\n  \"youtube.com\",\n  \"player.vimeo.com\",\n]);\n\nconst YOUTUBE_ID = /^[A-Za-z0-9_-]{11}$/;\nconst VIMEO_ID = /^\\d+$/;\n\n/**\n * 사용자 입력 URL → allowlist provider 의 canonical embed. 지원하지 않는\n * provider / 파싱 실패 시 `null`.\n */\nexport function normalizeEmbed(input: unknown): NormalizedEmbed | null {\n  if (typeof input !== \"string\") return null;\n  const raw = input.trim();\n  if (raw.length === 0) return null;\n\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return null;\n  }\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") return null;\n\n  const host = url.hostname.toLowerCase();\n\n  if (YOUTUBE_HOSTS.has(host)) {\n    const id = extractYouTubeId(url, host);\n    if (id) {\n      return {\n        provider: \"youtube\",\n        embedSrc: `https://www.youtube-nocookie.com/embed/${id}`,\n        originalUrl: raw,\n      };\n    }\n  }\n\n  if (VIMEO_HOSTS.has(host)) {\n    const id = extractVimeoId(url, host);\n    if (id) {\n      return {\n        provider: \"vimeo\",\n        embedSrc: `https://player.vimeo.com/video/${id}`,\n        originalUrl: raw,\n      };\n    }\n  }\n\n  return null;\n}\n\n/**\n * 이미 저장된 embed src 가 allowlist host(https) 인지 검증 — 렌더러가 iframe\n * 출력 전 호출. 임의 host / 비 https 는 거부.\n */\nexport function isAllowedEmbedSrc(value: unknown): value is string {\n  if (typeof value !== \"string\") return false;\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  if (url.protocol !== \"https:\") return false;\n  const host = url.hostname.toLowerCase();\n  if (!ALLOWED_EMBED_HOSTS.has(host)) return false;\n  // host 뿐 아니라 canonical embed path 형태까지 검증 — 허용 host 의 임의 경로\n  // (예: 스크립트·홈) 가 iframe 으로 로드되는 것을 차단.\n  if (host === \"player.vimeo.com\") {\n    return /^\\/video\\/\\d+$/.test(url.pathname);\n  }\n  // youtube / youtube-nocookie → /embed/<11-char id>\n  return new RegExp(\"^/embed/[A-Za-z0-9_-]{11}$\").test(url.pathname);\n}\n\nfunction extractYouTubeId(url: URL, host: string): string | null {\n  if (host === \"youtu.be\" || host === \"www.youtu.be\") {\n    const id = url.pathname.split(\"/\").filter(Boolean)[0] ?? \"\";\n    return YOUTUBE_ID.test(id) ? id : null;\n  }\n  const v = url.searchParams.get(\"v\");\n  if (v && YOUTUBE_ID.test(v)) return v;\n  const parts = url.pathname.split(\"/\").filter(Boolean);\n  if (\n    parts.length >= 2 &&\n    (parts[0] === \"embed\" || parts[0] === \"shorts\" || parts[0] === \"v\")\n  ) {\n    return YOUTUBE_ID.test(parts[1]) ? parts[1] : null;\n  }\n  return null;\n}\n\nfunction extractVimeoId(url: URL, host: string): string | null {\n  const parts = url.pathname.split(\"/\").filter(Boolean);\n  let candidate: string | undefined;\n  if (host === \"player.vimeo.com\") {\n    const vi = parts.indexOf(\"video\");\n    candidate = vi >= 0 ? parts[vi + 1] : parts[parts.length - 1];\n  } else {\n    candidate = parts[0];\n  }\n  return candidate && VIMEO_ID.test(candidate) ? candidate : null;\n}\n","// ADR-0034 §7.1.1 test #10 — Draft preview token sign/verify.\n//\n// HMAC-SHA256 signed token + DB row (post_preview_tokens_v2) lookup.\n// Atomic consume = consumedAt update at verify time.\n//\n// Token format: `<postId>.<expiresAt-ms>.<hmac-base64url>`\n\nimport { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\n\nexport interface PreviewTokenPayload {\n  postId: string;\n  expiresAt: Date;\n}\n\nconst DELIMITER = \".\";\n\nfunction base64url(buf: Buffer): string {\n  return buf.toString(\"base64url\");\n}\n\nfunction fromBase64url(s: string): Buffer {\n  return Buffer.from(s, \"base64url\");\n}\n\nfunction sign(secret: string, message: string): string {\n  return base64url(createHmac(\"sha256\", secret).update(message).digest());\n}\n\n/** 새 preview token 생성. DB insert 책임은 caller. */\nexport function issuePreviewToken(\n  secret: string,\n  payload: PreviewTokenPayload,\n): string {\n  const exp = payload.expiresAt.getTime();\n  const nonce = base64url(randomBytes(12));\n  const message = `${payload.postId}${DELIMITER}${exp}${DELIMITER}${nonce}`;\n  const sig = sign(secret, message);\n  return `${message}${DELIMITER}${sig}`;\n}\n\n/** Token 검증 (서명 + 만료). DB row consumed_at update 는 caller (atomic). */\nexport function verifyPreviewToken(\n  secret: string,\n  token: string,\n): PreviewTokenPayload | null {\n  const parts = token.split(DELIMITER);\n  if (parts.length !== 4) return null;\n  const [postId, expRaw, nonce, sig] = parts as [string, string, string, string];\n  const exp = Number(expRaw);\n  if (!Number.isFinite(exp)) return null;\n  if (Date.now() > exp) return null;\n\n  const expectedSig = sign(secret, `${postId}${DELIMITER}${exp}${DELIMITER}${nonce}`);\n  const a = fromBase64url(sig);\n  const b = fromBase64url(expectedSig);\n  if (a.length !== b.length) return null;\n  if (!timingSafeEqual(a, b)) return null;\n\n  return { postId, expiresAt: new Date(exp) };\n}\n","// ADR-0034 §7.1.1 test #7 — XSS sanitize helper (minimal allow-list).\n//\n// Phase 1 = strict CSP (`script-src 'self'`) 가 1차 방어. 본 helper 는 2차\n// 방어로 Tiptap output 의 inline `<script>` / `on*` attribute / `javascript:`\n// URL 을 strip. Phase 2 에 본격 sanitize (sanitize-html 또는 DOMPurify).\n\nconst SCRIPT_TAG_RE = /<script\\b[^>]*>[\\s\\S]*?<\\/script\\s*>/gi;\nconst ON_EVENT_ATTR_RE = /\\s+on[a-z]+\\s*=\\s*\"(?:[^\"\\\\]|\\\\.)*\"/gi;\nconst ON_EVENT_ATTR_RE_SINGLE = /\\s+on[a-z]+\\s*=\\s*'(?:[^'\\\\]|\\\\.)*'/gi;\nconst JS_URL_RE = /\\s+(href|src)\\s*=\\s*(['\"])\\s*javascript:[^'\"]*\\2/gi;\nconst DATA_URL_RE = /\\s+(href|src)\\s*=\\s*(['\"])\\s*data:(?!image\\/)[^'\"]*\\2/gi;\n\n/**\n * 미니멀 XSS sanitize — Tiptap HTML output 또는 rawHtml 의 안전 정리.\n * Phase 1 acceptance: `<script>alert(1)</script>` 인라인이 inert 가 되어야 함.\n */\nexport function sanitizeHtml(html: string): string {\n  return html\n    .replace(SCRIPT_TAG_RE, \"\")\n    .replace(ON_EVENT_ATTR_RE, \"\")\n    .replace(ON_EVENT_ATTR_RE_SINGLE, \"\")\n    .replace(JS_URL_RE, \" $1=\\\"#\\\"\")\n    .replace(DATA_URL_RE, \" $1=\\\"#\\\"\");\n}\n\n/**\n * 표준 CSP 헤더 값 (Phase 1 acceptance test #7 정합).\n * Astro middleware / Next.js header config 에서 사용.\n */\nexport const PHASE_1_CSP =\n  \"default-src 'self'; \" +\n  \"script-src 'self'; \" +\n  \"style-src 'self' 'unsafe-inline'; \" +\n  \"img-src 'self' data: https://imagedelivery.net https://*.r2.cloudflarestorage.com; \" +\n  \"font-src 'self' data:; \" +\n  \"connect-src 'self'; \" +\n  \"frame-ancestors 'none'; \" +\n  \"base-uri 'self'; \" +\n  \"form-action 'self'\";\n","// ADR-0034 §2 P5 — Stable block id (uuidv7 inject)\n//\n// Tiptap 의 BlockId extension 이 본 helper 를 사용해 새 block 에 uuidv7 inject.\n// 기존 block 의 `_id` 는 보존 (revision 간 정합).\n\nimport { uuidv7 } from \"uuidv7\";\n\nimport type { Block } from \"./block\";\n\n/**\n * Block 에 stable id 주입.\n * 이미 `_id` 있는 block 은 그대로, 없으면 uuidv7 생성. recursive (innerBlocks).\n */\nexport function ensureStableIds(block: Omit<Block, \"_id\"> & { _id?: string }): Block {\n  return {\n    ...block,\n    _id: block._id ?? uuidv7(),\n    innerBlocks: (block.innerBlocks ?? []).map((inner) =>\n      ensureStableIds(inner as Omit<Block, \"_id\"> & { _id?: string }),\n    ),\n  };\n}\n\n/**\n * 한 번에 block tree 전체에 stable id 주입.\n * import 또는 새 post 생성 시 entrypoint.\n */\nexport function injectStableIdsTree(blocks: readonly (Omit<Block, \"_id\"> & { _id?: string })[]): Block[] {\n  return blocks.map((b) => ensureStableIds(b));\n}\n"],"mappings":";AAMA,SAAS,SAAS;AAGX,IAAM,qBAAqB;AAElC,IAAM,sBAAsB,EACzB,OAAO;AAAA,EACN,UAAU,EACP;AAAA,IACC,EAAE,OAAO;AAAA,MACP,QAAQ,EAAE,OAAO;AAAA,MACjB,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,IACvC,CAAC;AAAA,EACH,EACC,SAAS;AAAA,EACZ,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC,EACA,OAAO,EACP,SAAS;AAML,IAAM,cAAgC,EAAE;AAAA,EAAK,MAClD,EACG,OAAO;AAAA,IACN,KAAK,EAAE,OAAO,EAAE,KAAK;AAAA,IACrB,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB;AAAA,IACzC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC;AAAA,IAChC,aAAa,EAAE,MAAM,WAAW;AAAA,IAChC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,UAAU;AAAA,EACZ,CAAC,EACA,OAAO;AACZ;AAkBO,SAAS,aAAa,OAAgC;AAC3D,SAAO,YAAY,UAAU,KAAK,EAAE;AACtC;AAEO,SAAS,WAAW,OAAuB;AAChD,SAAO,YAAY,MAAM,KAAK;AAChC;AAMO,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACjEO,SAAS,eAAe,OAAsB;AACnD,QAAM,aAAa,4BAA4B,KAAK;AACpD,QAAM,YAAY,oBAAoB,WAAW,UAAU;AAC3D,QAAM,YAAY,MAAM,WAAW;AACnC,QAAM,mBAAmB,MAAM,eAAe,CAAC,GAC5C,IAAI,CAAC,MAAM,eAAe,CAAC,CAAC,EAC5B,KAAK,IAAI;AAGZ,MAAI,CAAC,aAAa,gBAAgB,WAAW,GAAG;AAC9C,WAAO,YACH,WAAW,cAAc,MAAM,IAAI,CAAC,IAAI,SAAS,UACjD,WAAW,cAAc,MAAM,IAAI,CAAC;AAAA,EAC1C;AAEA,QAAM,OAAO,YACT,WAAW,cAAc,MAAM,IAAI,CAAC,IAAI,SAAS,SACjD,WAAW,cAAc,MAAM,IAAI,CAAC;AACxC,QAAM,QAAQ,YAAY,cAAc,MAAM,IAAI,CAAC;AAEnD,QAAM,OAAO,CAAC,WAAW,eAAe,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AACnE,SAAO,GAAG,IAAI;AAAA,EAAK,IAAI;AAAA,EAAK,KAAK;AACnC;AAGA,SAAS,cAAc,MAAsB;AAC3C,SAAO,KAAK,WAAW,OAAO,IAAI,KAAK,MAAM,QAAQ,MAAM,IAAI;AACjE;AAEA,SAAS,oBAAoB,OAAwC;AACnE,QAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,MAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,SAAO,KAAK,UAAU,KAAK;AAC7B;AAEA,SAAS,4BAA4B,OAEnC;AAEA,SAAO,EAAE,YAAY,EAAE,GAAG,MAAM,WAAW,EAAE;AAC/C;;;ACrCA,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,cAAc,oBAAI,IAAI,CAAC,aAAa,iBAAiB,kBAAkB,CAAC;AAG9E,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,aAAa;AACnB,IAAM,WAAW;AAMV,SAAS,eAAe,OAAwC;AACrE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,MAAM,MAAM,KAAK;AACvB,MAAI,IAAI,WAAW,EAAG,QAAO;AAE7B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,GAAG;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,YAAY,IAAI,aAAa,QAAS,QAAO;AAElE,QAAM,OAAO,IAAI,SAAS,YAAY;AAEtC,MAAI,cAAc,IAAI,IAAI,GAAG;AAC3B,UAAM,KAAK,iBAAiB,KAAK,IAAI;AACrC,QAAI,IAAI;AACN,aAAO;AAAA,QACL,UAAU;AAAA,QACV,UAAU,0CAA0C,EAAE;AAAA,QACtD,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAAY,IAAI,IAAI,GAAG;AACzB,UAAM,KAAK,eAAe,KAAK,IAAI;AACnC,QAAI,IAAI;AACN,aAAO;AAAA,QACL,UAAU;AAAA,QACV,UAAU,kCAAkC,EAAE;AAAA,QAC9C,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMO,SAAS,kBAAkB,OAAiC;AACjE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,MAAI,CAAC,oBAAoB,IAAI,IAAI,EAAG,QAAO;AAG3C,MAAI,SAAS,oBAAoB;AAC/B,WAAO,iBAAiB,KAAK,IAAI,QAAQ;AAAA,EAC3C;AAEA,SAAO,IAAI,OAAO,4BAA4B,EAAE,KAAK,IAAI,QAAQ;AACnE;AAEA,SAAS,iBAAiB,KAAU,MAA6B;AAC/D,MAAI,SAAS,cAAc,SAAS,gBAAgB;AAClD,UAAM,KAAK,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,CAAC,KAAK;AACzD,WAAO,WAAW,KAAK,EAAE,IAAI,KAAK;AAAA,EACpC;AACA,QAAM,IAAI,IAAI,aAAa,IAAI,GAAG;AAClC,MAAI,KAAK,WAAW,KAAK,CAAC,EAAG,QAAO;AACpC,QAAM,QAAQ,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACpD,MACE,MAAM,UAAU,MACf,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,MAAM,MAC/D;AACA,WAAO,WAAW,KAAK,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI;AAAA,EAChD;AACA,SAAO;AACT;AAEA,SAAS,eAAe,KAAU,MAA6B;AAC7D,QAAM,QAAQ,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACpD,MAAI;AACJ,MAAI,SAAS,oBAAoB;AAC/B,UAAM,KAAK,MAAM,QAAQ,OAAO;AAChC,gBAAY,MAAM,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,MAAM,SAAS,CAAC;AAAA,EAC9D,OAAO;AACL,gBAAY,MAAM,CAAC;AAAA,EACrB;AACA,SAAO,aAAa,SAAS,KAAK,SAAS,IAAI,YAAY;AAC7D;;;ACnIA,SAAS,YAAY,aAAa,uBAAuB;AAOzD,IAAM,YAAY;AAElB,SAAS,UAAU,KAAqB;AACtC,SAAO,IAAI,SAAS,WAAW;AACjC;AAEA,SAAS,cAAc,GAAmB;AACxC,SAAO,OAAO,KAAK,GAAG,WAAW;AACnC;AAEA,SAAS,KAAK,QAAgB,SAAyB;AACrD,SAAO,UAAU,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,CAAC;AACxE;AAGO,SAAS,kBACd,QACA,SACQ;AACR,QAAM,MAAM,QAAQ,UAAU,QAAQ;AACtC,QAAM,QAAQ,UAAU,YAAY,EAAE,CAAC;AACvC,QAAM,UAAU,GAAG,QAAQ,MAAM,GAAG,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,KAAK;AACvE,QAAM,MAAM,KAAK,QAAQ,OAAO;AAChC,SAAO,GAAG,OAAO,GAAG,SAAS,GAAG,GAAG;AACrC;AAGO,SAAS,mBACd,QACA,OAC4B;AAC5B,QAAM,QAAQ,MAAM,MAAM,SAAS;AACnC,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,CAAC,QAAQ,QAAQ,OAAO,GAAG,IAAI;AACrC,QAAM,MAAM,OAAO,MAAM;AACzB,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,IAAI,IAAI,IAAK,QAAO;AAE7B,QAAM,cAAc,KAAK,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,KAAK,EAAE;AAClF,QAAM,IAAI,cAAc,GAAG;AAC3B,QAAM,IAAI,cAAc,WAAW;AACnC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,CAAC,gBAAgB,GAAG,CAAC,EAAG,QAAO;AAEnC,SAAO,EAAE,QAAQ,WAAW,IAAI,KAAK,GAAG,EAAE;AAC5C;;;ACrDA,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,YAAY;AAClB,IAAM,cAAc;AAMb,SAAS,aAAa,MAAsB;AACjD,SAAO,KACJ,QAAQ,eAAe,EAAE,EACzB,QAAQ,kBAAkB,EAAE,EAC5B,QAAQ,yBAAyB,EAAE,EACnC,QAAQ,WAAW,SAAW,EAC9B,QAAQ,aAAa,SAAW;AACrC;AAMO,IAAM,cACX;;;ACzBF,SAAS,cAAc;AAQhB,SAAS,gBAAgB,OAAqD;AACnF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,KAAK,MAAM,OAAO,OAAO;AAAA,IACzB,cAAc,MAAM,eAAe,CAAC,GAAG;AAAA,MAAI,CAAC,UAC1C,gBAAgB,KAA8C;AAAA,IAChE;AAAA,EACF;AACF;AAMO,SAAS,oBAAoB,QAAqE;AACvG,SAAO,OAAO,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC7C;","names":[]}

package/package.json

@@ -1,15 +1,20 @@
 {
   "name": "@roottale/cms-core",
-  "version": "0.2.0",
+  "version": "0.7.0",
   "type": "module",
   "description": "RootTale CMS core — Block JSON schema (Gutenberg-compatible), serialize, validate. ADR-0034 §3 §5. Transitive dependency of @roottale/cms-renderer-next / @roottale/cms-renderer-astro.",
-  "main": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts",
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
     "./package.json": "./package.json"
   },
   "files": [
-    "src/",
+    "dist/",
     "README.md",
     "CHANGELOG.md"
   ],
@@ -41,7 +46,7 @@
     "directory": "packages/cms-core"
   },
   "scripts": {
-    "build": "tsc --noEmit",
+    "build": "tsup",
     "type-check": "tsc --noEmit",
     "test": "vitest run --passWithNoTests"
   }

package/src/__tests__/preview-token.test.ts

@@ -1,58 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { issuePreviewToken, verifyPreviewToken } from "../preview-token";
-
-describe("preview-token (HMAC + expiry)", () => {
-  const secret = "test-secret-do-not-use-in-prod";
-
-  it("issue → verify round-trips postId + expiry", () => {
-    const expiresAt = new Date(Date.now() + 60_000);
-    const token = issuePreviewToken(secret, {
-      postId: "post-abc",
-      expiresAt,
-    });
-    const payload = verifyPreviewToken(secret, token);
-    expect(payload?.postId).toBe("post-abc");
-    expect(payload?.expiresAt.getTime()).toBe(expiresAt.getTime());
-  });
-
-  it("rejects wrong secret", () => {
-    const token = issuePreviewToken(secret, {
-      postId: "post-abc",
-      expiresAt: new Date(Date.now() + 60_000),
-    });
-    expect(verifyPreviewToken("other-secret", token)).toBeNull();
-  });
-
-  it("rejects expired token", () => {
-    const token = issuePreviewToken(secret, {
-      postId: "post-abc",
-      expiresAt: new Date(Date.now() - 1),
-    });
-    expect(verifyPreviewToken(secret, token)).toBeNull();
-  });
-
-  it("rejects tampered postId", () => {
-    const token = issuePreviewToken(secret, {
-      postId: "post-abc",
-      expiresAt: new Date(Date.now() + 60_000),
-    });
-    const parts = token.split(".");
-    // swap postId
-    parts[0] = "post-evil";
-    const tampered = parts.join(".");
-    expect(verifyPreviewToken(secret, tampered)).toBeNull();
-  });
-
-  it("rejects malformed token (wrong segment count)", () => {
-    expect(verifyPreviewToken(secret, "only.two")).toBeNull();
-    expect(verifyPreviewToken(secret, "a.b.c.d.e")).toBeNull();
-  });
-
-  it("two issues with same payload differ (nonce randomness)", () => {
-    const expiresAt = new Date(Date.now() + 60_000);
-    const t1 = issuePreviewToken(secret, { postId: "p", expiresAt });
-    const t2 = issuePreviewToken(secret, { postId: "p", expiresAt });
-    expect(t1).not.toBe(t2);
-  });
-});

package/src/block-definition.ts

@@ -1,57 +0,0 @@
-// ADR-0034 §5 — BlockDefinition (렌더러 어댑터)
-// codex v2 verdict #3 + #11: Astro = 유일 public renderer (Phase 0~4).
-// `nextRender` 시그니처 의도적 제거 — Phase 5 에 Next public 활성 시 별도 ADR.
-
-import type { ZodSchema } from "zod";
-
-import type { Block } from "./block";
-
-/**
- * Astro island spec — `client:visible` / `client:idle` / `client:load` 등.
- * frontend 의 native interactivity. WP Interactivity API 카피 안 함.
- */
-export interface AstroIslandSpec {
-  /** Astro `client:*` directive */
-  hydration?: "visible" | "idle" | "load" | "media" | "only";
-  /** client-side module path (relative to package) */
-  module?: string;
-}
-
-/**
- * BlockDefinition<A> — block 의 schema + Astro render 어댑터.
- * Phase 5 에 Next public renderer 활성 시 별도 ADR-amend 의 add 의무.
- */
-export interface BlockDefinition<A = Record<string, unknown>> {
-  /** `core/<x>` or `roottale/<x>` */
-  name: string;
-  /** display metadata for admin editor */
-  meta: {
-    title: string;
-    description?: string;
-    category?: "text" | "media" | "design" | "widgets" | "theme" | "embed";
-    icon?: string;
-  };
-  /** attributes validation */
-  schema: ZodSchema<A>;
-  /** WP `supports` 등 flags */
-  supports?: {
-    align?: boolean;
-    color?: boolean;
-    spacing?: boolean;
-    typography?: boolean;
-    customClassName?: boolean;
-  };
-  /** parent block name 강제 (e.g. `core/column` 은 `core/columns` 아래만) */
-  parent?: readonly string[];
-  /** ancestor block name 강제 */
-  ancestor?: readonly string[];
-  /** Astro server render — 본 함수는 packages/cms-renderer-astro 에서 호출 */
-  astroRender: (block: Block & { attributes: A }) => unknown;
-  /** Astro client island (optional) */
-  clientHydration?: { astro?: AstroIslandSpec };
-}
-
-/**
- * Block registry — Phase 1 에서 register/lookup helper 추가 (현재는 type-only).
- */
-export type BlockRegistry = ReadonlyMap<string, BlockDefinition>;

package/src/block.ts

@@ -1,85 +0,0 @@
-// ADR-0034 §5 — Block JSON 스펙 (WP 호환)
-// Gutenberg block shape + 우리 확장:
-//   - `_id` (uuidv7 stable across revisions, ADR §2 P5)
-//   - `rawHtml` (WP delimiter innerHTML 보존, codex v2 verdict #7)
-//   - `metadata.reusableRef` (Phase 2 = flat expand)
-
-import { z } from "zod";
-
-/** WP-compatible name pattern: `core/<x>` | `roottale/<x>` */
-export const BLOCK_NAME_PATTERN = /^(core|roottale)\/[a-z0-9-]+$/;
-
-const blockMetadataSchema = z
-  .object({
-    bindings: z
-      .record(
-        z.object({
-          source: z.string(),
-          args: z.record(z.unknown()).optional(),
-        }),
-      )
-      .optional(),
-    name: z.string().optional(),
-    reusableRef: z.string().optional(),
-  })
-  .strict()
-  .optional();
-
-/**
- * Block schema (recursive — innerBlocks).
- * `_id` 는 internal-only (export 시 strip, ADR §5).
- */
-export const blockSchema: z.ZodType<Block> = z.lazy(() =>
-  z
-    .object({
-      _id: z.string().uuid(),
-      name: z.string().regex(BLOCK_NAME_PATTERN),
-      attributes: z.record(z.unknown()),
-      innerBlocks: z.array(blockSchema),
-      rawHtml: z.string().optional(),
-      metadata: blockMetadataSchema,
-    })
-    .strict(),
-);
-
-export interface Block {
-  /** uuidv7. Internal-only — never exported as WP delimiter attribute. */
-  _id: string;
-  /** `core/<x>` or `roottale/<x>` */
-  name: string;
-  attributes: Record<string, unknown>;
-  innerBlocks: Block[];
-  /** WP delimiter innerHTML (preserved for round-trip — codex v2 verdict #7). */
-  rawHtml?: string;
-  metadata?: {
-    bindings?: Record<string, { source: string; args?: Record<string, unknown> }>;
-    name?: string;
-    reusableRef?: string;
-  };
-}
-
-export function isValidBlock(value: unknown): value is Block {
-  return blockSchema.safeParse(value).success;
-}
-
-export function parseBlock(value: unknown): Block {
-  return blockSchema.parse(value);
-}
-
-/**
- * Phase 1 core block names (10) — ADR-0034 §5.
- * Phase 2+ 에 `core/embed`, `core/gallery`, `core/cover` 등 추가.
- */
-export const PHASE_1_CORE_BLOCKS = [
-  "core/paragraph",
-  "core/heading",
-  "core/image",
-  "core/list",
-  "core/quote",
-  "core/code",
-  "core/columns",
-  "core/group",
-  "core/separator",
-  "core/spacer",
-] as const;
-export type Phase1CoreBlockName = (typeof PHASE_1_CORE_BLOCKS)[number];

package/src/delimiter.ts

@@ -1,59 +0,0 @@
-// ADR-0034 §5 + §6 — WP delimiter parse/serialize
-//
-// WP 의 block serialization 은 HTML 주석 형태:
-//   <!-- wp:paragraph {"attr":1} -->
-//   <p>본문</p>
-//   <!-- /wp:paragraph -->
-//
-// Round-trip 룰 (codex v2 verdict #7 + v3 verdict #4):
-//   - `_id` 는 export 시 strip (WP-side import 가 unknown attribute 로 인식해 깨짐 차단)
-//   - `rawHtml` ↔ innerHTML
-//   - 우리가 schema 정의 안 한 block = Tiptap opaque atom node (편집 불가, 보존)
-
-import type { Block } from "./block";
-
-/**
- * Block → WP delimiter 형식 직렬화 (export).
- * `_id` 와 `metadata.reusableRef` 는 strip — WP 호환.
- */
-export function serializeBlock(block: Block): string {
-  const exportable = sanitizeAttributesForExport(block);
-  const attrsJson = serializeAttributes(exportable.attributes);
-  const innerHtml = block.rawHtml ?? "";
-  const innerSerialized = (block.innerBlocks ?? [])
-    .map((b) => serializeBlock(b))
-    .join("\n");
-
-  // self-closing 형태 (innerHTML + innerBlocks 모두 없으면)
-  if (!innerHtml && innerSerialized.length === 0) {
-    return attrsJson
-      ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} /-->`
-      : `<!-- wp:${normalizeName(block.name)} /-->`;
-  }
-
-  const open = attrsJson
-    ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} -->`
-    : `<!-- wp:${normalizeName(block.name)} -->`;
-  const close = `<!-- /wp:${normalizeName(block.name)} -->`;
-
-  const body = [innerHtml, innerSerialized].filter(Boolean).join("\n");
-  return `${open}\n${body}\n${close}`;
-}
-
-/** WP-side 에서 `core/` 는 보통 namespace 생략 (e.g. `<!-- wp:paragraph -->`) */
-function normalizeName(name: string): string {
-  return name.startsWith("core/") ? name.slice("core/".length) : name;
-}
-
-function serializeAttributes(attrs: Record<string, unknown>): string {
-  const keys = Object.keys(attrs);
-  if (keys.length === 0) return "";
-  return JSON.stringify(attrs);
-}
-
-function sanitizeAttributesForExport(block: Block): {
-  attributes: Record<string, unknown>;
-} {
-  // `_id` 와 `metadata.reusableRef` 제거. attributes 안의 임의 키는 그대로 export.
-  return { attributes: { ...block.attributes } };
-}

package/src/index.ts

@@ -1,7 +0,0 @@
-// @roottale/cms-core — ADR-0034 §3 §5 (Phase 1 Block JSON foundation)
-export * from "./block";
-export * from "./block-definition";
-export * from "./delimiter";
-export * from "./preview-token";
-export * from "./sanitize";
-export * from "./stable-id";

package/src/preview-token.ts

@@ -1,60 +0,0 @@
-// ADR-0034 §7.1.1 test #10 — Draft preview token sign/verify.
-//
-// HMAC-SHA256 signed token + DB row (post_preview_tokens_v2) lookup.
-// Atomic consume = consumedAt update at verify time.
-//
-// Token format: `<postId>.<expiresAt-ms>.<hmac-base64url>`
-
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-
-export interface PreviewTokenPayload {
-  postId: string;
-  expiresAt: Date;
-}
-
-const DELIMITER = ".";
-
-function base64url(buf: Buffer): string {
-  return buf.toString("base64url");
-}
-
-function fromBase64url(s: string): Buffer {
-  return Buffer.from(s, "base64url");
-}
-
-function sign(secret: string, message: string): string {
-  return base64url(createHmac("sha256", secret).update(message).digest());
-}
-
-/** 새 preview token 생성. DB insert 책임은 caller. */
-export function issuePreviewToken(
-  secret: string,
-  payload: PreviewTokenPayload,
-): string {
-  const exp = payload.expiresAt.getTime();
-  const nonce = base64url(randomBytes(12));
-  const message = `${payload.postId}${DELIMITER}${exp}${DELIMITER}${nonce}`;
-  const sig = sign(secret, message);
-  return `${message}${DELIMITER}${sig}`;
-}
-
-/** Token 검증 (서명 + 만료). DB row consumed_at update 는 caller (atomic). */
-export function verifyPreviewToken(
-  secret: string,
-  token: string,
-): PreviewTokenPayload | null {
-  const parts = token.split(DELIMITER);
-  if (parts.length !== 4) return null;
-  const [postId, expRaw, nonce, sig] = parts as [string, string, string, string];
-  const exp = Number(expRaw);
-  if (!Number.isFinite(exp)) return null;
-  if (Date.now() > exp) return null;
-
-  const expectedSig = sign(secret, `${postId}${DELIMITER}${exp}${DELIMITER}${nonce}`);
-  const a = fromBase64url(sig);
-  const b = fromBase64url(expectedSig);
-  if (a.length !== b.length) return null;
-  if (!timingSafeEqual(a, b)) return null;
-
-  return { postId, expiresAt: new Date(exp) };
-}

package/src/sanitize.ts

@@ -1,39 +0,0 @@
-// ADR-0034 §7.1.1 test #7 — XSS sanitize helper (minimal allow-list).
-//
-// Phase 1 = strict CSP (`script-src 'self'`) 가 1차 방어. 본 helper 는 2차
-// 방어로 Tiptap output 의 inline `<script>` / `on*` attribute / `javascript:`
-// URL 을 strip. Phase 2 에 본격 sanitize (sanitize-html 또는 DOMPurify).
-
-const SCRIPT_TAG_RE = /<script\b[^>]*>[\s\S]*?<\/script\s*>/gi;
-const ON_EVENT_ATTR_RE = /\s+on[a-z]+\s*=\s*"(?:[^"\\]|\\.)*"/gi;
-const ON_EVENT_ATTR_RE_SINGLE = /\s+on[a-z]+\s*=\s*'(?:[^'\\]|\\.)*'/gi;
-const JS_URL_RE = /\s+(href|src)\s*=\s*(['"])\s*javascript:[^'"]*\2/gi;
-const DATA_URL_RE = /\s+(href|src)\s*=\s*(['"])\s*data:(?!image\/)[^'"]*\2/gi;
-
-/**
- * 미니멀 XSS sanitize — Tiptap HTML output 또는 rawHtml 의 안전 정리.
- * Phase 1 acceptance: `<script>alert(1)</script>` 인라인이 inert 가 되어야 함.
- */
-export function sanitizeHtml(html: string): string {
-  return html
-    .replace(SCRIPT_TAG_RE, "")
-    .replace(ON_EVENT_ATTR_RE, "")
-    .replace(ON_EVENT_ATTR_RE_SINGLE, "")
-    .replace(JS_URL_RE, " $1=\"#\"")
-    .replace(DATA_URL_RE, " $1=\"#\"");
-}
-
-/**
- * 표준 CSP 헤더 값 (Phase 1 acceptance test #7 정합).
- * Astro middleware / Next.js header config 에서 사용.
- */
-export const PHASE_1_CSP =
-  "default-src 'self'; " +
-  "script-src 'self'; " +
-  "style-src 'self' 'unsafe-inline'; " +
-  "img-src 'self' data: https://imagedelivery.net https://*.r2.cloudflarestorage.com; " +
-  "font-src 'self' data:; " +
-  "connect-src 'self'; " +
-  "frame-ancestors 'none'; " +
-  "base-uri 'self'; " +
-  "form-action 'self'";

package/src/stable-id.ts

@@ -1,30 +0,0 @@
-// ADR-0034 §2 P5 — Stable block id (uuidv7 inject)
-//
-// Tiptap 의 BlockId extension 이 본 helper 를 사용해 새 block 에 uuidv7 inject.
-// 기존 block 의 `_id` 는 보존 (revision 간 정합).
-
-import { uuidv7 } from "uuidv7";
-
-import type { Block } from "./block";
-
-/**
- * Block 에 stable id 주입.
- * 이미 `_id` 있는 block 은 그대로, 없으면 uuidv7 생성. recursive (innerBlocks).
- */
-export function ensureStableIds(block: Omit<Block, "_id"> & { _id?: string }): Block {
-  return {
-    ...block,
-    _id: block._id ?? uuidv7(),
-    innerBlocks: (block.innerBlocks ?? []).map((inner) =>
-      ensureStableIds(inner as Omit<Block, "_id"> & { _id?: string }),
-    ),
-  };
-}
-
-/**
- * 한 번에 block tree 전체에 stable id 주입.
- * import 또는 새 post 생성 시 entrypoint.
- */
-export function injectStableIdsTree(blocks: readonly (Omit<Block, "_id"> & { _id?: string })[]): Block[] {
-  return blocks.map((b) => ensureStableIds(b));
-}