@roottale/cms-core 0.2.1 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @roottale/cms-core
 
+## 0.7.0
+
+### Minor Changes
+
+- e2067cf: feat: 영상 임베드 블록 + 공개 글 작성자 byline + Astro 목차(TOC)
+  - **cms-core**: `normalizeEmbed`/`isAllowedEmbedSrc` 추가 — YouTube·Vimeo
+    provider allowlist 기반 임베드 URL 정규화 + 렌더 단계 host·path 재검증(SSRF 방어).
+  - **cms-client**: `CmsPostContent.authorName` 노출(공개 표시명, email 비노출).
+  - **cms-renderer-next**: `core/embed` 노드 렌더(allowlist iframe, 미허용 시 원본
+    링크 fallback) + 글 상세 작성자 byline.
+  - **cms-renderer-astro**: 위와 동등한 embed 렌더 + 작성자 byline + Next 와 동등한
+    TOC 지원(`extractToc`/`attachHeadingIds`, `showTableOfContents` 옵션).
+
 ## 0.2.1
 
 ### Patch Changes

package/dist/index.d.ts

@@ -92,6 +92,25 @@ type BlockRegistry = ReadonlyMap<string, BlockDefinition>;
  */
 declare function serializeBlock(block: Block): string;
 
+type EmbedProvider = "youtube" | "vimeo";
+interface NormalizedEmbed {
+    provider: EmbedProvider;
+    /** allowlist host 의 canonical iframe src (가능 시 privacy-enhanced). */
+    embedSrc: string;
+    /** 사용자가 입력한 원본 URL — fallback 링크 / round-trip 보존용. */
+    originalUrl: string;
+}
+/**
+ * 사용자 입력 URL → allowlist provider 의 canonical embed. 지원하지 않는
+ * provider / 파싱 실패 시 `null`.
+ */
+declare function normalizeEmbed(input: unknown): NormalizedEmbed | null;
+/**
+ * 이미 저장된 embed src 가 allowlist host(https) 인지 검증 — 렌더러가 iframe
+ * 출력 전 호출. 임의 host / 비 https 는 거부.
+ */
+declare function isAllowedEmbedSrc(value: unknown): value is string;
+
 interface PreviewTokenPayload {
     postId: string;
     expiresAt: Date;
@@ -127,4 +146,4 @@ declare function injectStableIdsTree(blocks: readonly (Omit<Block, "_id"> & {
     _id?: string;
 })[]): Block[];
 
-export { type AstroIslandSpec, BLOCK_NAME_PATTERN, type Block, type BlockDefinition, type BlockRegistry, PHASE_1_CORE_BLOCKS, PHASE_1_CSP, type Phase1CoreBlockName, type PreviewTokenPayload, blockSchema, ensureStableIds, injectStableIdsTree, isValidBlock, issuePreviewToken, parseBlock, sanitizeHtml, serializeBlock, verifyPreviewToken };
+export { type AstroIslandSpec, BLOCK_NAME_PATTERN, type Block, type BlockDefinition, type BlockRegistry, type EmbedProvider, type NormalizedEmbed, PHASE_1_CORE_BLOCKS, PHASE_1_CSP, type Phase1CoreBlockName, type PreviewTokenPayload, blockSchema, ensureStableIds, injectStableIdsTree, isAllowedEmbedSrc, isValidBlock, issuePreviewToken, normalizeEmbed, parseBlock, sanitizeHtml, serializeBlock, verifyPreviewToken };

package/dist/index.js

@@ -68,6 +68,99 @@ function sanitizeAttributesForExport(block) {
   return { attributes: { ...block.attributes } };
 }
 
+// src/embed.ts
+var YOUTUBE_HOSTS = /* @__PURE__ */ new Set([
+  "youtube.com",
+  "www.youtube.com",
+  "m.youtube.com",
+  "youtu.be",
+  "www.youtu.be"
+]);
+var VIMEO_HOSTS = /* @__PURE__ */ new Set(["vimeo.com", "www.vimeo.com", "player.vimeo.com"]);
+var ALLOWED_EMBED_HOSTS = /* @__PURE__ */ new Set([
+  "www.youtube-nocookie.com",
+  "youtube-nocookie.com",
+  "www.youtube.com",
+  "youtube.com",
+  "player.vimeo.com"
+]);
+var YOUTUBE_ID = /^[A-Za-z0-9_-]{11}$/;
+var VIMEO_ID = /^\d+$/;
+function normalizeEmbed(input) {
+  if (typeof input !== "string") return null;
+  const raw = input.trim();
+  if (raw.length === 0) return null;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+  const host = url.hostname.toLowerCase();
+  if (YOUTUBE_HOSTS.has(host)) {
+    const id = extractYouTubeId(url, host);
+    if (id) {
+      return {
+        provider: "youtube",
+        embedSrc: `https://www.youtube-nocookie.com/embed/${id}`,
+        originalUrl: raw
+      };
+    }
+  }
+  if (VIMEO_HOSTS.has(host)) {
+    const id = extractVimeoId(url, host);
+    if (id) {
+      return {
+        provider: "vimeo",
+        embedSrc: `https://player.vimeo.com/video/${id}`,
+        originalUrl: raw
+      };
+    }
+  }
+  return null;
+}
+function isAllowedEmbedSrc(value) {
+  if (typeof value !== "string") return false;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  if (!ALLOWED_EMBED_HOSTS.has(host)) return false;
+  if (host === "player.vimeo.com") {
+    return /^\/video\/\d+$/.test(url.pathname);
+  }
+  return new RegExp("^/embed/[A-Za-z0-9_-]{11}$").test(url.pathname);
+}
+function extractYouTubeId(url, host) {
+  if (host === "youtu.be" || host === "www.youtu.be") {
+    const id = url.pathname.split("/").filter(Boolean)[0] ?? "";
+    return YOUTUBE_ID.test(id) ? id : null;
+  }
+  const v = url.searchParams.get("v");
+  if (v && YOUTUBE_ID.test(v)) return v;
+  const parts = url.pathname.split("/").filter(Boolean);
+  if (parts.length >= 2 && (parts[0] === "embed" || parts[0] === "shorts" || parts[0] === "v")) {
+    return YOUTUBE_ID.test(parts[1]) ? parts[1] : null;
+  }
+  return null;
+}
+function extractVimeoId(url, host) {
+  const parts = url.pathname.split("/").filter(Boolean);
+  let candidate;
+  if (host === "player.vimeo.com") {
+    const vi = parts.indexOf("video");
+    candidate = vi >= 0 ? parts[vi + 1] : parts[parts.length - 1];
+  } else {
+    candidate = parts[0];
+  }
+  return candidate && VIMEO_ID.test(candidate) ? candidate : null;
+}
+
 // src/preview-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 var DELIMITER = ".";
@@ -134,8 +227,10 @@ export {
   blockSchema,
   ensureStableIds,
   injectStableIdsTree,
+  isAllowedEmbedSrc,
   isValidBlock,
   issuePreviewToken,
+  normalizeEmbed,
   parseBlock,
   sanitizeHtml,
   serializeBlock,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/block.ts","../src/delimiter.ts","../src/preview-token.ts","../src/sanitize.ts","../src/stable-id.ts"],"sourcesContent":["// ADR-0034 §5 — Block JSON 스펙 (WP 호환)\n// Gutenberg block shape + 우리 확장:\n//   - `_id` (uuidv7 stable across revisions, ADR §2 P5)\n//   - `rawHtml` (WP delimiter innerHTML 보존, codex v2 verdict #7)\n//   - `metadata.reusableRef` (Phase 2 = flat expand)\n\nimport { z } from \"zod\";\n\n/** WP-compatible name pattern: `core/<x>` | `roottale/<x>` */\nexport const BLOCK_NAME_PATTERN = /^(core|roottale)\\/[a-z0-9-]+$/;\n\nconst blockMetadataSchema = z\n  .object({\n    bindings: z\n      .record(\n        z.object({\n          source: z.string(),\n          args: z.record(z.unknown()).optional(),\n        }),\n      )\n      .optional(),\n    name: z.string().optional(),\n    reusableRef: z.string().optional(),\n  })\n  .strict()\n  .optional();\n\n/**\n * Block schema (recursive — innerBlocks).\n * `_id` 는 internal-only (export 시 strip, ADR §5).\n */\nexport const blockSchema: z.ZodType<Block> = z.lazy(() =>\n  z\n    .object({\n      _id: z.string().uuid(),\n      name: z.string().regex(BLOCK_NAME_PATTERN),\n      attributes: z.record(z.unknown()),\n      innerBlocks: z.array(blockSchema),\n      rawHtml: z.string().optional(),\n      metadata: blockMetadataSchema,\n    })\n    .strict(),\n);\n\nexport interface Block {\n  /** uuidv7. Internal-only — never exported as WP delimiter attribute. */\n  _id: string;\n  /** `core/<x>` or `roottale/<x>` */\n  name: string;\n  attributes: Record<string, unknown>;\n  innerBlocks: Block[];\n  /** WP delimiter innerHTML (preserved for round-trip — codex v2 verdict #7). */\n  rawHtml?: string;\n  metadata?: {\n    bindings?: Record<string, { source: string; args?: Record<string, unknown> }>;\n    name?: string;\n    reusableRef?: string;\n  };\n}\n\nexport function isValidBlock(value: unknown): value is Block {\n  return blockSchema.safeParse(value).success;\n}\n\nexport function parseBlock(value: unknown): Block {\n  return blockSchema.parse(value);\n}\n\n/**\n * Phase 1 core block names (10) — ADR-0034 §5.\n * Phase 2+ 에 `core/embed`, `core/gallery`, `core/cover` 등 추가.\n */\nexport const PHASE_1_CORE_BLOCKS = [\n  \"core/paragraph\",\n  \"core/heading\",\n  \"core/image\",\n  \"core/list\",\n  \"core/quote\",\n  \"core/code\",\n  \"core/columns\",\n  \"core/group\",\n  \"core/separator\",\n  \"core/spacer\",\n] as const;\nexport type Phase1CoreBlockName = (typeof PHASE_1_CORE_BLOCKS)[number];\n","// ADR-0034 §5 + §6 — WP delimiter parse/serialize\n//\n// WP 의 block serialization 은 HTML 주석 형태:\n//   <!-- wp:paragraph {\"attr\":1} -->\n//   <p>본문</p>\n//   <!-- /wp:paragraph -->\n//\n// Round-trip 룰 (codex v2 verdict #7 + v3 verdict #4):\n//   - `_id` 는 export 시 strip (WP-side import 가 unknown attribute 로 인식해 깨짐 차단)\n//   - `rawHtml` ↔ innerHTML\n//   - 우리가 schema 정의 안 한 block = Tiptap opaque atom node (편집 불가, 보존)\n\nimport type { Block } from \"./block\";\n\n/**\n * Block → WP delimiter 형식 직렬화 (export).\n * `_id` 와 `metadata.reusableRef` 는 strip — WP 호환.\n */\nexport function serializeBlock(block: Block): string {\n  const exportable = sanitizeAttributesForExport(block);\n  const attrsJson = serializeAttributes(exportable.attributes);\n  const innerHtml = block.rawHtml ?? \"\";\n  const innerSerialized = (block.innerBlocks ?? [])\n    .map((b) => serializeBlock(b))\n    .join(\"\\n\");\n\n  // self-closing 형태 (innerHTML + innerBlocks 모두 없으면)\n  if (!innerHtml && innerSerialized.length === 0) {\n    return attrsJson\n      ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} /-->`\n      : `<!-- wp:${normalizeName(block.name)} /-->`;\n  }\n\n  const open = attrsJson\n    ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} -->`\n    : `<!-- wp:${normalizeName(block.name)} -->`;\n  const close = `<!-- /wp:${normalizeName(block.name)} -->`;\n\n  const body = [innerHtml, innerSerialized].filter(Boolean).join(\"\\n\");\n  return `${open}\\n${body}\\n${close}`;\n}\n\n/** WP-side 에서 `core/` 는 보통 namespace 생략 (e.g. `<!-- wp:paragraph -->`) */\nfunction normalizeName(name: string): string {\n  return name.startsWith(\"core/\") ? name.slice(\"core/\".length) : name;\n}\n\nfunction serializeAttributes(attrs: Record<string, unknown>): string {\n  const keys = Object.keys(attrs);\n  if (keys.length === 0) return \"\";\n  return JSON.stringify(attrs);\n}\n\nfunction sanitizeAttributesForExport(block: Block): {\n  attributes: Record<string, unknown>;\n} {\n  // `_id` 와 `metadata.reusableRef` 제거. attributes 안의 임의 키는 그대로 export.\n  return { attributes: { ...block.attributes } };\n}\n","// ADR-0034 §7.1.1 test #10 — Draft preview token sign/verify.\n//\n// HMAC-SHA256 signed token + DB row (post_preview_tokens_v2) lookup.\n// Atomic consume = consumedAt update at verify time.\n//\n// Token format: `<postId>.<expiresAt-ms>.<hmac-base64url>`\n\nimport { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\n\nexport interface PreviewTokenPayload {\n  postId: string;\n  expiresAt: Date;\n}\n\nconst DELIMITER = \".\";\n\nfunction base64url(buf: Buffer): string {\n  return buf.toString(\"base64url\");\n}\n\nfunction fromBase64url(s: string): Buffer {\n  return Buffer.from(s, \"base64url\");\n}\n\nfunction sign(secret: string, message: string): string {\n  return base64url(createHmac(\"sha256\", secret).update(message).digest());\n}\n\n/** 새 preview token 생성. DB insert 책임은 caller. */\nexport function issuePreviewToken(\n  secret: string,\n  payload: PreviewTokenPayload,\n): string {\n  const exp = payload.expiresAt.getTime();\n  const nonce = base64url(randomBytes(12));\n  const message = `${payload.postId}${DELIMITER}${exp}${DELIMITER}${nonce}`;\n  const sig = sign(secret, message);\n  return `${message}${DELIMITER}${sig}`;\n}\n\n/** Token 검증 (서명 + 만료). DB row consumed_at update 는 caller (atomic). */\nexport function verifyPreviewToken(\n  secret: string,\n  token: string,\n): PreviewTokenPayload | null {\n  const parts = token.split(DELIMITER);\n  if (parts.length !== 4) return null;\n  const [postId, expRaw, nonce, sig] = parts as [string, string, string, string];\n  const exp = Number(expRaw);\n  if (!Number.isFinite(exp)) return null;\n  if (Date.now() > exp) return null;\n\n  const expectedSig = sign(secret, `${postId}${DELIMITER}${exp}${DELIMITER}${nonce}`);\n  const a = fromBase64url(sig);\n  const b = fromBase64url(expectedSig);\n  if (a.length !== b.length) return null;\n  if (!timingSafeEqual(a, b)) return null;\n\n  return { postId, expiresAt: new Date(exp) };\n}\n","// ADR-0034 §7.1.1 test #7 — XSS sanitize helper (minimal allow-list).\n//\n// Phase 1 = strict CSP (`script-src 'self'`) 가 1차 방어. 본 helper 는 2차\n// 방어로 Tiptap output 의 inline `<script>` / `on*` attribute / `javascript:`\n// URL 을 strip. Phase 2 에 본격 sanitize (sanitize-html 또는 DOMPurify).\n\nconst SCRIPT_TAG_RE = /<script\\b[^>]*>[\\s\\S]*?<\\/script\\s*>/gi;\nconst ON_EVENT_ATTR_RE = /\\s+on[a-z]+\\s*=\\s*\"(?:[^\"\\\\]|\\\\.)*\"/gi;\nconst ON_EVENT_ATTR_RE_SINGLE = /\\s+on[a-z]+\\s*=\\s*'(?:[^'\\\\]|\\\\.)*'/gi;\nconst JS_URL_RE = /\\s+(href|src)\\s*=\\s*(['\"])\\s*javascript:[^'\"]*\\2/gi;\nconst DATA_URL_RE = /\\s+(href|src)\\s*=\\s*(['\"])\\s*data:(?!image\\/)[^'\"]*\\2/gi;\n\n/**\n * 미니멀 XSS sanitize — Tiptap HTML output 또는 rawHtml 의 안전 정리.\n * Phase 1 acceptance: `<script>alert(1)</script>` 인라인이 inert 가 되어야 함.\n */\nexport function sanitizeHtml(html: string): string {\n  return html\n    .replace(SCRIPT_TAG_RE, \"\")\n    .replace(ON_EVENT_ATTR_RE, \"\")\n    .replace(ON_EVENT_ATTR_RE_SINGLE, \"\")\n    .replace(JS_URL_RE, \" $1=\\\"#\\\"\")\n    .replace(DATA_URL_RE, \" $1=\\\"#\\\"\");\n}\n\n/**\n * 표준 CSP 헤더 값 (Phase 1 acceptance test #7 정합).\n * Astro middleware / Next.js header config 에서 사용.\n */\nexport const PHASE_1_CSP =\n  \"default-src 'self'; \" +\n  \"script-src 'self'; \" +\n  \"style-src 'self' 'unsafe-inline'; \" +\n  \"img-src 'self' data: https://imagedelivery.net https://*.r2.cloudflarestorage.com; \" +\n  \"font-src 'self' data:; \" +\n  \"connect-src 'self'; \" +\n  \"frame-ancestors 'none'; \" +\n  \"base-uri 'self'; \" +\n  \"form-action 'self'\";\n","// ADR-0034 §2 P5 — Stable block id (uuidv7 inject)\n//\n// Tiptap 의 BlockId extension 이 본 helper 를 사용해 새 block 에 uuidv7 inject.\n// 기존 block 의 `_id` 는 보존 (revision 간 정합).\n\nimport { uuidv7 } from \"uuidv7\";\n\nimport type { Block } from \"./block\";\n\n/**\n * Block 에 stable id 주입.\n * 이미 `_id` 있는 block 은 그대로, 없으면 uuidv7 생성. recursive (innerBlocks).\n */\nexport function ensureStableIds(block: Omit<Block, \"_id\"> & { _id?: string }): Block {\n  return {\n    ...block,\n    _id: block._id ?? uuidv7(),\n    innerBlocks: (block.innerBlocks ?? []).map((inner) =>\n      ensureStableIds(inner as Omit<Block, \"_id\"> & { _id?: string }),\n    ),\n  };\n}\n\n/**\n * 한 번에 block tree 전체에 stable id 주입.\n * import 또는 새 post 생성 시 entrypoint.\n */\nexport function injectStableIdsTree(blocks: readonly (Omit<Block, \"_id\"> & { _id?: string })[]): Block[] {\n  return blocks.map((b) => ensureStableIds(b));\n}\n"],"mappings":";AAMA,SAAS,SAAS;AAGX,IAAM,qBAAqB;AAElC,IAAM,sBAAsB,EACzB,OAAO;AAAA,EACN,UAAU,EACP;AAAA,IACC,EAAE,OAAO;AAAA,MACP,QAAQ,EAAE,OAAO;AAAA,MACjB,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,IACvC,CAAC;AAAA,EACH,EACC,SAAS;AAAA,EACZ,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC,EACA,OAAO,EACP,SAAS;AAML,IAAM,cAAgC,EAAE;AAAA,EAAK,MAClD,EACG,OAAO;AAAA,IACN,KAAK,EAAE,OAAO,EAAE,KAAK;AAAA,IACrB,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB;AAAA,IACzC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC;AAAA,IAChC,aAAa,EAAE,MAAM,WAAW;AAAA,IAChC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,UAAU;AAAA,EACZ,CAAC,EACA,OAAO;AACZ;AAkBO,SAAS,aAAa,OAAgC;AAC3D,SAAO,YAAY,UAAU,KAAK,EAAE;AACtC;AAEO,SAAS,WAAW,OAAuB;AAChD,SAAO,YAAY,MAAM,KAAK;AAChC;AAMO,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACjEO,SAAS,eAAe,OAAsB;AACnD,QAAM,aAAa,4BAA4B,KAAK;AACpD,QAAM,YAAY,oBAAoB,WAAW,UAAU;AAC3D,QAAM,YAAY,MAAM,WAAW;AACnC,QAAM,mBAAmB,MAAM,eAAe,CAAC,GAC5C,IAAI,CAAC,MAAM,eAAe,CAAC,CAAC,EAC5B,KAAK,IAAI;AAGZ,MAAI,CAAC,aAAa,gBAAgB,WAAW,GAAG;AAC9C,WAAO,YACH,WAAW,cAAc,MAAM,IAAI,CAAC,IAAI,SAAS,UACjD,WAAW,cAAc,MAAM,IAAI,CAAC;AAAA,EAC1C;AAEA,QAAM,OAAO,YACT,WAAW,cAAc,MAAM,IAAI,CAAC,IAAI,SAAS,SACjD,WAAW,cAAc,MAAM,IAAI,CAAC;AACxC,QAAM,QAAQ,YAAY,cAAc,MAAM,IAAI,CAAC;AAEnD,QAAM,OAAO,CAAC,WAAW,eAAe,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AACnE,SAAO,GAAG,IAAI;AAAA,EAAK,IAAI;AAAA,EAAK,KAAK;AACnC;AAGA,SAAS,cAAc,MAAsB;AAC3C,SAAO,KAAK,WAAW,OAAO,IAAI,KAAK,MAAM,QAAQ,MAAM,IAAI;AACjE;AAEA,SAAS,oBAAoB,OAAwC;AACnE,QAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,MAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,SAAO,KAAK,UAAU,KAAK;AAC7B;AAEA,SAAS,4BAA4B,OAEnC;AAEA,SAAO,EAAE,YAAY,EAAE,GAAG,MAAM,WAAW,EAAE;AAC/C;;;ACnDA,SAAS,YAAY,aAAa,uBAAuB;AAOzD,IAAM,YAAY;AAElB,SAAS,UAAU,KAAqB;AACtC,SAAO,IAAI,SAAS,WAAW;AACjC;AAEA,SAAS,cAAc,GAAmB;AACxC,SAAO,OAAO,KAAK,GAAG,WAAW;AACnC;AAEA,SAAS,KAAK,QAAgB,SAAyB;AACrD,SAAO,UAAU,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,CAAC;AACxE;AAGO,SAAS,kBACd,QACA,SACQ;AACR,QAAM,MAAM,QAAQ,UAAU,QAAQ;AACtC,QAAM,QAAQ,UAAU,YAAY,EAAE,CAAC;AACvC,QAAM,UAAU,GAAG,QAAQ,MAAM,GAAG,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,KAAK;AACvE,QAAM,MAAM,KAAK,QAAQ,OAAO;AAChC,SAAO,GAAG,OAAO,GAAG,SAAS,GAAG,GAAG;AACrC;AAGO,SAAS,mBACd,QACA,OAC4B;AAC5B,QAAM,QAAQ,MAAM,MAAM,SAAS;AACnC,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,CAAC,QAAQ,QAAQ,OAAO,GAAG,IAAI;AACrC,QAAM,MAAM,OAAO,MAAM;AACzB,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,IAAI,IAAI,IAAK,QAAO;AAE7B,QAAM,cAAc,KAAK,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,KAAK,EAAE;AAClF,QAAM,IAAI,cAAc,GAAG;AAC3B,QAAM,IAAI,cAAc,WAAW;AACnC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,CAAC,gBAAgB,GAAG,CAAC,EAAG,QAAO;AAEnC,SAAO,EAAE,QAAQ,WAAW,IAAI,KAAK,GAAG,EAAE;AAC5C;;;ACrDA,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,YAAY;AAClB,IAAM,cAAc;AAMb,SAAS,aAAa,MAAsB;AACjD,SAAO,KACJ,QAAQ,eAAe,EAAE,EACzB,QAAQ,kBAAkB,EAAE,EAC5B,QAAQ,yBAAyB,EAAE,EACnC,QAAQ,WAAW,SAAW,EAC9B,QAAQ,aAAa,SAAW;AACrC;AAMO,IAAM,cACX;;;ACzBF,SAAS,cAAc;AAQhB,SAAS,gBAAgB,OAAqD;AACnF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,KAAK,MAAM,OAAO,OAAO;AAAA,IACzB,cAAc,MAAM,eAAe,CAAC,GAAG;AAAA,MAAI,CAAC,UAC1C,gBAAgB,KAA8C;AAAA,IAChE;AAAA,EACF;AACF;AAMO,SAAS,oBAAoB,QAAqE;AACvG,SAAO,OAAO,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC7C;","names":[]}
+{"version":3,"sources":["../src/block.ts","../src/delimiter.ts","../src/embed.ts","../src/preview-token.ts","../src/sanitize.ts","../src/stable-id.ts"],"sourcesContent":["// ADR-0034 §5 — Block JSON 스펙 (WP 호환)\n// Gutenberg block shape + 우리 확장:\n//   - `_id` (uuidv7 stable across revisions, ADR §2 P5)\n//   - `rawHtml` (WP delimiter innerHTML 보존, codex v2 verdict #7)\n//   - `metadata.reusableRef` (Phase 2 = flat expand)\n\nimport { z } from \"zod\";\n\n/** WP-compatible name pattern: `core/<x>` | `roottale/<x>` */\nexport const BLOCK_NAME_PATTERN = /^(core|roottale)\\/[a-z0-9-]+$/;\n\nconst blockMetadataSchema = z\n  .object({\n    bindings: z\n      .record(\n        z.object({\n          source: z.string(),\n          args: z.record(z.unknown()).optional(),\n        }),\n      )\n      .optional(),\n    name: z.string().optional(),\n    reusableRef: z.string().optional(),\n  })\n  .strict()\n  .optional();\n\n/**\n * Block schema (recursive — innerBlocks).\n * `_id` 는 internal-only (export 시 strip, ADR §5).\n */\nexport const blockSchema: z.ZodType<Block> = z.lazy(() =>\n  z\n    .object({\n      _id: z.string().uuid(),\n      name: z.string().regex(BLOCK_NAME_PATTERN),\n      attributes: z.record(z.unknown()),\n      innerBlocks: z.array(blockSchema),\n      rawHtml: z.string().optional(),\n      metadata: blockMetadataSchema,\n    })\n    .strict(),\n);\n\nexport interface Block {\n  /** uuidv7. Internal-only — never exported as WP delimiter attribute. */\n  _id: string;\n  /** `core/<x>` or `roottale/<x>` */\n  name: string;\n  attributes: Record<string, unknown>;\n  innerBlocks: Block[];\n  /** WP delimiter innerHTML (preserved for round-trip — codex v2 verdict #7). */\n  rawHtml?: string;\n  metadata?: {\n    bindings?: Record<string, { source: string; args?: Record<string, unknown> }>;\n    name?: string;\n    reusableRef?: string;\n  };\n}\n\nexport function isValidBlock(value: unknown): value is Block {\n  return blockSchema.safeParse(value).success;\n}\n\nexport function parseBlock(value: unknown): Block {\n  return blockSchema.parse(value);\n}\n\n/**\n * Phase 1 core block names (10) — ADR-0034 §5.\n * Phase 2+ 에 `core/embed`, `core/gallery`, `core/cover` 등 추가.\n */\nexport const PHASE_1_CORE_BLOCKS = [\n  \"core/paragraph\",\n  \"core/heading\",\n  \"core/image\",\n  \"core/list\",\n  \"core/quote\",\n  \"core/code\",\n  \"core/columns\",\n  \"core/group\",\n  \"core/separator\",\n  \"core/spacer\",\n] as const;\nexport type Phase1CoreBlockName = (typeof PHASE_1_CORE_BLOCKS)[number];\n","// ADR-0034 §5 + §6 — WP delimiter parse/serialize\n//\n// WP 의 block serialization 은 HTML 주석 형태:\n//   <!-- wp:paragraph {\"attr\":1} -->\n//   <p>본문</p>\n//   <!-- /wp:paragraph -->\n//\n// Round-trip 룰 (codex v2 verdict #7 + v3 verdict #4):\n//   - `_id` 는 export 시 strip (WP-side import 가 unknown attribute 로 인식해 깨짐 차단)\n//   - `rawHtml` ↔ innerHTML\n//   - 우리가 schema 정의 안 한 block = Tiptap opaque atom node (편집 불가, 보존)\n\nimport type { Block } from \"./block\";\n\n/**\n * Block → WP delimiter 형식 직렬화 (export).\n * `_id` 와 `metadata.reusableRef` 는 strip — WP 호환.\n */\nexport function serializeBlock(block: Block): string {\n  const exportable = sanitizeAttributesForExport(block);\n  const attrsJson = serializeAttributes(exportable.attributes);\n  const innerHtml = block.rawHtml ?? \"\";\n  const innerSerialized = (block.innerBlocks ?? [])\n    .map((b) => serializeBlock(b))\n    .join(\"\\n\");\n\n  // self-closing 형태 (innerHTML + innerBlocks 모두 없으면)\n  if (!innerHtml && innerSerialized.length === 0) {\n    return attrsJson\n      ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} /-->`\n      : `<!-- wp:${normalizeName(block.name)} /-->`;\n  }\n\n  const open = attrsJson\n    ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} -->`\n    : `<!-- wp:${normalizeName(block.name)} -->`;\n  const close = `<!-- /wp:${normalizeName(block.name)} -->`;\n\n  const body = [innerHtml, innerSerialized].filter(Boolean).join(\"\\n\");\n  return `${open}\\n${body}\\n${close}`;\n}\n\n/** WP-side 에서 `core/` 는 보통 namespace 생략 (e.g. `<!-- wp:paragraph -->`) */\nfunction normalizeName(name: string): string {\n  return name.startsWith(\"core/\") ? name.slice(\"core/\".length) : name;\n}\n\nfunction serializeAttributes(attrs: Record<string, unknown>): string {\n  const keys = Object.keys(attrs);\n  if (keys.length === 0) return \"\";\n  return JSON.stringify(attrs);\n}\n\nfunction sanitizeAttributesForExport(block: Block): {\n  attributes: Record<string, unknown>;\n} {\n  // `_id` 와 `metadata.reusableRef` 제거. attributes 안의 임의 키는 그대로 export.\n  return { attributes: { ...block.attributes } };\n}\n","// ADR-0034 §5 — `core/embed` 영상 임베드 헬퍼 (provider allowlist)\n//\n// 본 모듈은 editor (URL → embed 노드 정규화) 와 renderer (저장된 embed src 의\n// 출력 시 재검증, defense-in-depth) 양쪽에서 공유. 순수 모듈 — `URL` 만 사용해\n// 브라우저/서버 모두 안전.\n//\n// 보안 원칙: 임의 iframe src 를 신뢰하지 않는다. 신규 삽입은 `normalizeEmbed`\n// 가 allowlist provider 의 canonical embed URL 로만 변환하고, 출력은\n// `isAllowedEmbedSrc` 로 host 를 한 번 더 검증한다 (legacy/import/외부 테넌트가\n// 임의 src 를 DB 에 남겨도 렌더 단계에서 차단).\n\nexport type EmbedProvider = \"youtube\" | \"vimeo\";\n\nexport interface NormalizedEmbed {\n  provider: EmbedProvider;\n  /** allowlist host 의 canonical iframe src (가능 시 privacy-enhanced). */\n  embedSrc: string;\n  /** 사용자가 입력한 원본 URL — fallback 링크 / round-trip 보존용. */\n  originalUrl: string;\n}\n\nconst YOUTUBE_HOSTS = new Set([\n  \"youtube.com\",\n  \"www.youtube.com\",\n  \"m.youtube.com\",\n  \"youtu.be\",\n  \"www.youtu.be\",\n]);\n\nconst VIMEO_HOSTS = new Set([\"vimeo.com\", \"www.vimeo.com\", \"player.vimeo.com\"]);\n\n/** 출력(iframe) 시 허용되는 embed src host — render 단계 defense-in-depth. */\nconst ALLOWED_EMBED_HOSTS = new Set([\n  \"www.youtube-nocookie.com\",\n  \"youtube-nocookie.com\",\n  \"www.youtube.com\",\n  \"youtube.com\",\n  \"player.vimeo.com\",\n]);\n\nconst YOUTUBE_ID = /^[A-Za-z0-9_-]{11}$/;\nconst VIMEO_ID = /^\\d+$/;\n\n/**\n * 사용자 입력 URL → allowlist provider 의 canonical embed. 지원하지 않는\n * provider / 파싱 실패 시 `null`.\n */\nexport function normalizeEmbed(input: unknown): NormalizedEmbed | null {\n  if (typeof input !== \"string\") return null;\n  const raw = input.trim();\n  if (raw.length === 0) return null;\n\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return null;\n  }\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") return null;\n\n  const host = url.hostname.toLowerCase();\n\n  if (YOUTUBE_HOSTS.has(host)) {\n    const id = extractYouTubeId(url, host);\n    if (id) {\n      return {\n        provider: \"youtube\",\n        embedSrc: `https://www.youtube-nocookie.com/embed/${id}`,\n        originalUrl: raw,\n      };\n    }\n  }\n\n  if (VIMEO_HOSTS.has(host)) {\n    const id = extractVimeoId(url, host);\n    if (id) {\n      return {\n        provider: \"vimeo\",\n        embedSrc: `https://player.vimeo.com/video/${id}`,\n        originalUrl: raw,\n      };\n    }\n  }\n\n  return null;\n}\n\n/**\n * 이미 저장된 embed src 가 allowlist host(https) 인지 검증 — 렌더러가 iframe\n * 출력 전 호출. 임의 host / 비 https 는 거부.\n */\nexport function isAllowedEmbedSrc(value: unknown): value is string {\n  if (typeof value !== \"string\") return false;\n  let url: URL;\n  try {\n    url = new URL(value);\n  } catch {\n    return false;\n  }\n  if (url.protocol !== \"https:\") return false;\n  const host = url.hostname.toLowerCase();\n  if (!ALLOWED_EMBED_HOSTS.has(host)) return false;\n  // host 뿐 아니라 canonical embed path 형태까지 검증 — 허용 host 의 임의 경로\n  // (예: 스크립트·홈) 가 iframe 으로 로드되는 것을 차단.\n  if (host === \"player.vimeo.com\") {\n    return /^\\/video\\/\\d+$/.test(url.pathname);\n  }\n  // youtube / youtube-nocookie → /embed/<11-char id>\n  return new RegExp(\"^/embed/[A-Za-z0-9_-]{11}$\").test(url.pathname);\n}\n\nfunction extractYouTubeId(url: URL, host: string): string | null {\n  if (host === \"youtu.be\" || host === \"www.youtu.be\") {\n    const id = url.pathname.split(\"/\").filter(Boolean)[0] ?? \"\";\n    return YOUTUBE_ID.test(id) ? id : null;\n  }\n  const v = url.searchParams.get(\"v\");\n  if (v && YOUTUBE_ID.test(v)) return v;\n  const parts = url.pathname.split(\"/\").filter(Boolean);\n  if (\n    parts.length >= 2 &&\n    (parts[0] === \"embed\" || parts[0] === \"shorts\" || parts[0] === \"v\")\n  ) {\n    return YOUTUBE_ID.test(parts[1]) ? parts[1] : null;\n  }\n  return null;\n}\n\nfunction extractVimeoId(url: URL, host: string): string | null {\n  const parts = url.pathname.split(\"/\").filter(Boolean);\n  let candidate: string | undefined;\n  if (host === \"player.vimeo.com\") {\n    const vi = parts.indexOf(\"video\");\n    candidate = vi >= 0 ? parts[vi + 1] : parts[parts.length - 1];\n  } else {\n    candidate = parts[0];\n  }\n  return candidate && VIMEO_ID.test(candidate) ? candidate : null;\n}\n","// ADR-0034 §7.1.1 test #10 — Draft preview token sign/verify.\n//\n// HMAC-SHA256 signed token + DB row (post_preview_tokens_v2) lookup.\n// Atomic consume = consumedAt update at verify time.\n//\n// Token format: `<postId>.<expiresAt-ms>.<hmac-base64url>`\n\nimport { createHmac, randomBytes, timingSafeEqual } from \"node:crypto\";\n\nexport interface PreviewTokenPayload {\n  postId: string;\n  expiresAt: Date;\n}\n\nconst DELIMITER = \".\";\n\nfunction base64url(buf: Buffer): string {\n  return buf.toString(\"base64url\");\n}\n\nfunction fromBase64url(s: string): Buffer {\n  return Buffer.from(s, \"base64url\");\n}\n\nfunction sign(secret: string, message: string): string {\n  return base64url(createHmac(\"sha256\", secret).update(message).digest());\n}\n\n/** 새 preview token 생성. DB insert 책임은 caller. */\nexport function issuePreviewToken(\n  secret: string,\n  payload: PreviewTokenPayload,\n): string {\n  const exp = payload.expiresAt.getTime();\n  const nonce = base64url(randomBytes(12));\n  const message = `${payload.postId}${DELIMITER}${exp}${DELIMITER}${nonce}`;\n  const sig = sign(secret, message);\n  return `${message}${DELIMITER}${sig}`;\n}\n\n/** Token 검증 (서명 + 만료). DB row consumed_at update 는 caller (atomic). */\nexport function verifyPreviewToken(\n  secret: string,\n  token: string,\n): PreviewTokenPayload | null {\n  const parts = token.split(DELIMITER);\n  if (parts.length !== 4) return null;\n  const [postId, expRaw, nonce, sig] = parts as [string, string, string, string];\n  const exp = Number(expRaw);\n  if (!Number.isFinite(exp)) return null;\n  if (Date.now() > exp) return null;\n\n  const expectedSig = sign(secret, `${postId}${DELIMITER}${exp}${DELIMITER}${nonce}`);\n  const a = fromBase64url(sig);\n  const b = fromBase64url(expectedSig);\n  if (a.length !== b.length) return null;\n  if (!timingSafeEqual(a, b)) return null;\n\n  return { postId, expiresAt: new Date(exp) };\n}\n","// ADR-0034 §7.1.1 test #7 — XSS sanitize helper (minimal allow-list).\n//\n// Phase 1 = strict CSP (`script-src 'self'`) 가 1차 방어. 본 helper 는 2차\n// 방어로 Tiptap output 의 inline `<script>` / `on*` attribute / `javascript:`\n// URL 을 strip. Phase 2 에 본격 sanitize (sanitize-html 또는 DOMPurify).\n\nconst SCRIPT_TAG_RE = /<script\\b[^>]*>[\\s\\S]*?<\\/script\\s*>/gi;\nconst ON_EVENT_ATTR_RE = /\\s+on[a-z]+\\s*=\\s*\"(?:[^\"\\\\]|\\\\.)*\"/gi;\nconst ON_EVENT_ATTR_RE_SINGLE = /\\s+on[a-z]+\\s*=\\s*'(?:[^'\\\\]|\\\\.)*'/gi;\nconst JS_URL_RE = /\\s+(href|src)\\s*=\\s*(['\"])\\s*javascript:[^'\"]*\\2/gi;\nconst DATA_URL_RE = /\\s+(href|src)\\s*=\\s*(['\"])\\s*data:(?!image\\/)[^'\"]*\\2/gi;\n\n/**\n * 미니멀 XSS sanitize — Tiptap HTML output 또는 rawHtml 의 안전 정리.\n * Phase 1 acceptance: `<script>alert(1)</script>` 인라인이 inert 가 되어야 함.\n */\nexport function sanitizeHtml(html: string): string {\n  return html\n    .replace(SCRIPT_TAG_RE, \"\")\n    .replace(ON_EVENT_ATTR_RE, \"\")\n    .replace(ON_EVENT_ATTR_RE_SINGLE, \"\")\n    .replace(JS_URL_RE, \" $1=\\\"#\\\"\")\n    .replace(DATA_URL_RE, \" $1=\\\"#\\\"\");\n}\n\n/**\n * 표준 CSP 헤더 값 (Phase 1 acceptance test #7 정합).\n * Astro middleware / Next.js header config 에서 사용.\n */\nexport const PHASE_1_CSP =\n  \"default-src 'self'; \" +\n  \"script-src 'self'; \" +\n  \"style-src 'self' 'unsafe-inline'; \" +\n  \"img-src 'self' data: https://imagedelivery.net https://*.r2.cloudflarestorage.com; \" +\n  \"font-src 'self' data:; \" +\n  \"connect-src 'self'; \" +\n  \"frame-ancestors 'none'; \" +\n  \"base-uri 'self'; \" +\n  \"form-action 'self'\";\n","// ADR-0034 §2 P5 — Stable block id (uuidv7 inject)\n//\n// Tiptap 의 BlockId extension 이 본 helper 를 사용해 새 block 에 uuidv7 inject.\n// 기존 block 의 `_id` 는 보존 (revision 간 정합).\n\nimport { uuidv7 } from \"uuidv7\";\n\nimport type { Block } from \"./block\";\n\n/**\n * Block 에 stable id 주입.\n * 이미 `_id` 있는 block 은 그대로, 없으면 uuidv7 생성. recursive (innerBlocks).\n */\nexport function ensureStableIds(block: Omit<Block, \"_id\"> & { _id?: string }): Block {\n  return {\n    ...block,\n    _id: block._id ?? uuidv7(),\n    innerBlocks: (block.innerBlocks ?? []).map((inner) =>\n      ensureStableIds(inner as Omit<Block, \"_id\"> & { _id?: string }),\n    ),\n  };\n}\n\n/**\n * 한 번에 block tree 전체에 stable id 주입.\n * import 또는 새 post 생성 시 entrypoint.\n */\nexport function injectStableIdsTree(blocks: readonly (Omit<Block, \"_id\"> & { _id?: string })[]): Block[] {\n  return blocks.map((b) => ensureStableIds(b));\n}\n"],"mappings":";AAMA,SAAS,SAAS;AAGX,IAAM,qBAAqB;AAElC,IAAM,sBAAsB,EACzB,OAAO;AAAA,EACN,UAAU,EACP;AAAA,IACC,EAAE,OAAO;AAAA,MACP,QAAQ,EAAE,OAAO;AAAA,MACjB,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,IACvC,CAAC;AAAA,EACH,EACC,SAAS;AAAA,EACZ,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,aAAa,EAAE,OAAO,EAAE,SAAS;AACnC,CAAC,EACA,OAAO,EACP,SAAS;AAML,IAAM,cAAgC,EAAE;AAAA,EAAK,MAClD,EACG,OAAO;AAAA,IACN,KAAK,EAAE,OAAO,EAAE,KAAK;AAAA,IACrB,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB;AAAA,IACzC,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC;AAAA,IAChC,aAAa,EAAE,MAAM,WAAW;AAAA,IAChC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,UAAU;AAAA,EACZ,CAAC,EACA,OAAO;AACZ;AAkBO,SAAS,aAAa,OAAgC;AAC3D,SAAO,YAAY,UAAU,KAAK,EAAE;AACtC;AAEO,SAAS,WAAW,OAAuB;AAChD,SAAO,YAAY,MAAM,KAAK;AAChC;AAMO,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACjEO,SAAS,eAAe,OAAsB;AACnD,QAAM,aAAa,4BAA4B,KAAK;AACpD,QAAM,YAAY,oBAAoB,WAAW,UAAU;AAC3D,QAAM,YAAY,MAAM,WAAW;AACnC,QAAM,mBAAmB,MAAM,eAAe,CAAC,GAC5C,IAAI,CAAC,MAAM,eAAe,CAAC,CAAC,EAC5B,KAAK,IAAI;AAGZ,MAAI,CAAC,aAAa,gBAAgB,WAAW,GAAG;AAC9C,WAAO,YACH,WAAW,cAAc,MAAM,IAAI,CAAC,IAAI,SAAS,UACjD,WAAW,cAAc,MAAM,IAAI,CAAC;AAAA,EAC1C;AAEA,QAAM,OAAO,YACT,WAAW,cAAc,MAAM,IAAI,CAAC,IAAI,SAAS,SACjD,WAAW,cAAc,MAAM,IAAI,CAAC;AACxC,QAAM,QAAQ,YAAY,cAAc,MAAM,IAAI,CAAC;AAEnD,QAAM,OAAO,CAAC,WAAW,eAAe,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI;AACnE,SAAO,GAAG,IAAI;AAAA,EAAK,IAAI;AAAA,EAAK,KAAK;AACnC;AAGA,SAAS,cAAc,MAAsB;AAC3C,SAAO,KAAK,WAAW,OAAO,IAAI,KAAK,MAAM,QAAQ,MAAM,IAAI;AACjE;AAEA,SAAS,oBAAoB,OAAwC;AACnE,QAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,MAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,SAAO,KAAK,UAAU,KAAK;AAC7B;AAEA,SAAS,4BAA4B,OAEnC;AAEA,SAAO,EAAE,YAAY,EAAE,GAAG,MAAM,WAAW,EAAE;AAC/C;;;ACrCA,IAAM,gBAAgB,oBAAI,IAAI;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,cAAc,oBAAI,IAAI,CAAC,aAAa,iBAAiB,kBAAkB,CAAC;AAG9E,IAAM,sBAAsB,oBAAI,IAAI;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,aAAa;AACnB,IAAM,WAAW;AAMV,SAAS,eAAe,OAAwC;AACrE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,MAAM,MAAM,KAAK;AACvB,MAAI,IAAI,WAAW,EAAG,QAAO;AAE7B,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,GAAG;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,YAAY,IAAI,aAAa,QAAS,QAAO;AAElE,QAAM,OAAO,IAAI,SAAS,YAAY;AAEtC,MAAI,cAAc,IAAI,IAAI,GAAG;AAC3B,UAAM,KAAK,iBAAiB,KAAK,IAAI;AACrC,QAAI,IAAI;AACN,aAAO;AAAA,QACL,UAAU;AAAA,QACV,UAAU,0CAA0C,EAAE;AAAA,QACtD,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAAY,IAAI,IAAI,GAAG;AACzB,UAAM,KAAK,eAAe,KAAK,IAAI;AACnC,QAAI,IAAI;AACN,aAAO;AAAA,QACL,UAAU;AAAA,QACV,UAAU,kCAAkC,EAAE;AAAA,QAC9C,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAMO,SAAS,kBAAkB,OAAiC;AACjE,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,IAAI,aAAa,SAAU,QAAO;AACtC,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,MAAI,CAAC,oBAAoB,IAAI,IAAI,EAAG,QAAO;AAG3C,MAAI,SAAS,oBAAoB;AAC/B,WAAO,iBAAiB,KAAK,IAAI,QAAQ;AAAA,EAC3C;AAEA,SAAO,IAAI,OAAO,4BAA4B,EAAE,KAAK,IAAI,QAAQ;AACnE;AAEA,SAAS,iBAAiB,KAAU,MAA6B;AAC/D,MAAI,SAAS,cAAc,SAAS,gBAAgB;AAClD,UAAM,KAAK,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,CAAC,KAAK;AACzD,WAAO,WAAW,KAAK,EAAE,IAAI,KAAK;AAAA,EACpC;AACA,QAAM,IAAI,IAAI,aAAa,IAAI,GAAG;AAClC,MAAI,KAAK,WAAW,KAAK,CAAC,EAAG,QAAO;AACpC,QAAM,QAAQ,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACpD,MACE,MAAM,UAAU,MACf,MAAM,CAAC,MAAM,WAAW,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,MAAM,MAC/D;AACA,WAAO,WAAW,KAAK,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI;AAAA,EAChD;AACA,SAAO;AACT;AAEA,SAAS,eAAe,KAAU,MAA6B;AAC7D,QAAM,QAAQ,IAAI,SAAS,MAAM,GAAG,EAAE,OAAO,OAAO;AACpD,MAAI;AACJ,MAAI,SAAS,oBAAoB;AAC/B,UAAM,KAAK,MAAM,QAAQ,OAAO;AAChC,gBAAY,MAAM,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,MAAM,SAAS,CAAC;AAAA,EAC9D,OAAO;AACL,gBAAY,MAAM,CAAC;AAAA,EACrB;AACA,SAAO,aAAa,SAAS,KAAK,SAAS,IAAI,YAAY;AAC7D;;;ACnIA,SAAS,YAAY,aAAa,uBAAuB;AAOzD,IAAM,YAAY;AAElB,SAAS,UAAU,KAAqB;AACtC,SAAO,IAAI,SAAS,WAAW;AACjC;AAEA,SAAS,cAAc,GAAmB;AACxC,SAAO,OAAO,KAAK,GAAG,WAAW;AACnC;AAEA,SAAS,KAAK,QAAgB,SAAyB;AACrD,SAAO,UAAU,WAAW,UAAU,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,CAAC;AACxE;AAGO,SAAS,kBACd,QACA,SACQ;AACR,QAAM,MAAM,QAAQ,UAAU,QAAQ;AACtC,QAAM,QAAQ,UAAU,YAAY,EAAE,CAAC;AACvC,QAAM,UAAU,GAAG,QAAQ,MAAM,GAAG,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,KAAK;AACvE,QAAM,MAAM,KAAK,QAAQ,OAAO;AAChC,SAAO,GAAG,OAAO,GAAG,SAAS,GAAG,GAAG;AACrC;AAGO,SAAS,mBACd,QACA,OAC4B;AAC5B,QAAM,QAAQ,MAAM,MAAM,SAAS;AACnC,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,CAAC,QAAQ,QAAQ,OAAO,GAAG,IAAI;AACrC,QAAM,MAAM,OAAO,MAAM;AACzB,MAAI,CAAC,OAAO,SAAS,GAAG,EAAG,QAAO;AAClC,MAAI,KAAK,IAAI,IAAI,IAAK,QAAO;AAE7B,QAAM,cAAc,KAAK,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,GAAG,GAAG,SAAS,GAAG,KAAK,EAAE;AAClF,QAAM,IAAI,cAAc,GAAG;AAC3B,QAAM,IAAI,cAAc,WAAW;AACnC,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,CAAC,gBAAgB,GAAG,CAAC,EAAG,QAAO;AAEnC,SAAO,EAAE,QAAQ,WAAW,IAAI,KAAK,GAAG,EAAE;AAC5C;;;ACrDA,IAAM,gBAAgB;AACtB,IAAM,mBAAmB;AACzB,IAAM,0BAA0B;AAChC,IAAM,YAAY;AAClB,IAAM,cAAc;AAMb,SAAS,aAAa,MAAsB;AACjD,SAAO,KACJ,QAAQ,eAAe,EAAE,EACzB,QAAQ,kBAAkB,EAAE,EAC5B,QAAQ,yBAAyB,EAAE,EACnC,QAAQ,WAAW,SAAW,EAC9B,QAAQ,aAAa,SAAW;AACrC;AAMO,IAAM,cACX;;;ACzBF,SAAS,cAAc;AAQhB,SAAS,gBAAgB,OAAqD;AACnF,SAAO;AAAA,IACL,GAAG;AAAA,IACH,KAAK,MAAM,OAAO,OAAO;AAAA,IACzB,cAAc,MAAM,eAAe,CAAC,GAAG;AAAA,MAAI,CAAC,UAC1C,gBAAgB,KAA8C;AAAA,IAChE;AAAA,EACF;AACF;AAMO,SAAS,oBAAoB,QAAqE;AACvG,SAAO,OAAO,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC;AAC7C;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@roottale/cms-core",
-  "version": "0.2.1",
+  "version": "0.7.0",
   "type": "module",
   "description": "RootTale CMS core — Block JSON schema (Gutenberg-compatible), serialize, validate. ADR-0034 §3 §5. Transitive dependency of @roottale/cms-renderer-next / @roottale/cms-renderer-astro.",
   "main": "./dist/index.js",