@roottale/cms-core 0.39.0 → 0.42.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @roottale/cms-core
 
+## 0.42.0
+
+### Minor Changes
+
+- d7dfe0a: `postsNotInAnyCollection`(cms-core) — `postsInAnyCollection` 의 대칭으로, 어느 스트림에도 안 속한("미소속") 글만 남긴다.
+
+  `RootTaleBlogList` 에 `excludeCollections?: boolean` prop 추가 — `collections` 와 함께 주면 스트림 소속 글을 전부 제외해 `/blog` 목록의 스트림 글 누출을 막는다(`collection` 과 배타, `collections` 없이 단독 지정은 throw). 아카이브 스트림(증상/질환/치료)만 선언하고 나머지 글을 `/blog` 로 보여주는 사이트용 — `blog` 자체가 선언 섹션인 사이트는 반대로 `collection="blog"` 가 정경로.
+
+- 8e8bc1c: `sanitizeHtml` 를 정규식 deny-list 에서 `sanitize-html` 기반 parser allow-list 로 교체했다. Tiptap/renderer 출력 태그와 RootTale `rt-*` class, 안전 URL scheme, raster `data:image/*` 정책을 보존하면서 미지 태그·이벤트 속성·비허용 style·SVG data URL 을 제거한다.
+
+## 0.41.0
+
+### Minor Changes
+
+- 3768f72: FAQ 블록 — `<details>` 아코디언 + FAQPage 구조화데이터(JSON-LD).
+
+  어드민 에디터의 FAQ 블록(`roottale/faq` → faqItem/faqQuestion/faqAnswer)이
+  발행되면 `RootTaleBlogPost`가 자동으로:
+  - `<details class="rt-cms-faq-item"><summary class="rt-cms-faq-q">…</summary>
+    <div class="rt-cms-faq-a">…</div></details>` 아코디언(0 JS)으로 렌더하고,
+  - 글 단위 `FAQPage` JSON-LD(`<script type="application/ld+json">`)를 1개 삽입한다.
+
+  추가 연동/키 불필요 — 기존 단일 API 키 위에서 동작하며, 업그레이드 시 기존 글에도
+  FAQ 블록이 있으면 즉시 반영된다. `@roottale/cms-core` 에 추출 유틸
+  `extractFaqEntries(doc)` / `faqPageJsonLd(entries)` 추가(렌더러 공유). 스타일은
+  `cms-public.css` 의 `.rt-cms-faq*` 클래스로 테마 토큰을 따른다.
+
 ## 0.39.0
 
 ### Patch Changes

package/dist/index.cjs

@@ -0,0 +1,647 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  BLOCK_NAME_PATTERN: () => BLOCK_NAME_PATTERN,
+  FIELD_BINDING_SOURCE: () => FIELD_BINDING_SOURCE,
+  FIELD_BINDING_SOURCE_ALIAS: () => FIELD_BINDING_SOURCE_ALIAS,
+  PHASE_1_CORE_BLOCKS: () => PHASE_1_CORE_BLOCKS,
+  PHASE_1_CSP: () => PHASE_1_CSP,
+  applyBlockBindings: () => applyBlockBindings,
+  bindingSrcValue: () => bindingSrcValue,
+  bindingTextValue: () => bindingTextValue,
+  blockSchema: () => blockSchema,
+  boundFieldValue: () => boundFieldValue,
+  chainResolvers: () => chainResolvers,
+  createFieldBindingResolver: () => createFieldBindingResolver,
+  ensureStableIds: () => ensureStableIds,
+  extractFaqEntries: () => extractFaqEntries,
+  faqPageJsonLd: () => faqPageJsonLd,
+  injectStableIdsTree: () => injectStableIdsTree,
+  isAllowedEmbedSrc: () => isAllowedEmbedSrc,
+  isInCollectionMode: () => isInCollectionMode,
+  isValidBlock: () => isValidBlock,
+  issuePreviewToken: () => issuePreviewToken,
+  normalizeEmbed: () => normalizeEmbed,
+  parseBlock: () => parseBlock,
+  postsForCollection: () => postsForCollection,
+  postsInAnyCollection: () => postsInAnyCollection,
+  postsNotInAnyCollection: () => postsNotInAnyCollection,
+  resolvePostCollection: () => resolvePostCollection,
+  resolvePostPath: () => resolvePostPath,
+  resolvePostUrl: () => resolvePostUrl,
+  sanitizeHtml: () => sanitizeHtml,
+  serializeBlock: () => serializeBlock,
+  validateCollections: () => validateCollections,
+  verifyPreviewToken: () => verifyPreviewToken
+});
+module.exports = __toCommonJS(src_exports);
+
+// src/block.ts
+var import_zod = require("zod");
+var BLOCK_NAME_PATTERN = /^(core|roottale)\/[a-z0-9-]+$/;
+var blockMetadataSchema = import_zod.z.object({
+  bindings: import_zod.z.record(
+    import_zod.z.object({
+      source: import_zod.z.string(),
+      args: import_zod.z.record(import_zod.z.unknown()).optional()
+    })
+  ).optional(),
+  name: import_zod.z.string().optional(),
+  reusableRef: import_zod.z.string().optional()
+}).strict().optional();
+var blockSchema = import_zod.z.lazy(
+  () => import_zod.z.object({
+    _id: import_zod.z.string().uuid(),
+    name: import_zod.z.string().regex(BLOCK_NAME_PATTERN),
+    attributes: import_zod.z.record(import_zod.z.unknown()),
+    innerBlocks: import_zod.z.array(blockSchema),
+    rawHtml: import_zod.z.string().optional(),
+    metadata: blockMetadataSchema
+  }).strict()
+);
+function isValidBlock(value) {
+  return blockSchema.safeParse(value).success;
+}
+function parseBlock(value) {
+  return blockSchema.parse(value);
+}
+var PHASE_1_CORE_BLOCKS = [
+  "core/paragraph",
+  "core/heading",
+  "core/image",
+  "core/list",
+  "core/quote",
+  "core/code",
+  "core/columns",
+  "core/group",
+  "core/separator",
+  "core/spacer"
+];
+
+// src/bindings.ts
+var FIELD_BINDING_SOURCE = "roottale/field";
+var FIELD_BINDING_SOURCE_ALIAS = "acf/field";
+function createFieldBindingResolver(fields) {
+  const values = fields ?? {};
+  return (binding) => {
+    if (binding.source !== FIELD_BINDING_SOURCE && binding.source !== FIELD_BINDING_SOURCE_ALIAS) {
+      return void 0;
+    }
+    const name = binding.args?.name;
+    if (typeof name !== "string") return void 0;
+    const v = values[name];
+    return v === void 0 ? void 0 : v;
+  };
+}
+function chainResolvers(...resolvers) {
+  return (binding, attribute, block) => {
+    for (const r of resolvers) {
+      const v = r(binding, attribute, block);
+      if (v !== void 0) return v;
+    }
+    return void 0;
+  };
+}
+function applyToBlock(block, resolver) {
+  const bindings = block.metadata?.bindings;
+  let attributes = block.attributes;
+  if (bindings) {
+    let mutated = false;
+    const next = { ...block.attributes };
+    for (const [attr, binding] of Object.entries(bindings)) {
+      const value = resolver(binding, attr, block);
+      if (value !== void 0) {
+        next[attr] = value;
+        mutated = true;
+      }
+    }
+    if (mutated) attributes = next;
+  }
+  const innerBlocks = block.innerBlocks.length ? block.innerBlocks.map((b) => applyToBlock(b, resolver)) : block.innerBlocks;
+  if (attributes === block.attributes && innerBlocks === block.innerBlocks) {
+    return block;
+  }
+  return { ...block, attributes, innerBlocks };
+}
+function applyBlockBindings(blocks, resolver) {
+  return blocks.map((b) => applyToBlock(b, resolver));
+}
+function boundFieldValue(bindings, attribute, fields) {
+  if (!bindings || typeof bindings !== "object" || !fields) return void 0;
+  const binding = bindings[attribute];
+  if (!binding || binding.source !== FIELD_BINDING_SOURCE && binding.source !== FIELD_BINDING_SOURCE_ALIAS) {
+    return void 0;
+  }
+  const name = binding.args?.name;
+  if (typeof name !== "string") return void 0;
+  const value = fields[name];
+  if (value === void 0 || value === null || value === "") return void 0;
+  return value;
+}
+function bindingTextValue(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  return void 0;
+}
+function bindingSrcValue(value) {
+  if (value && typeof value === "object") {
+    const url = value.url;
+    if (typeof url === "string" && /^https?:\/\//i.test(url)) return url;
+    return void 0;
+  }
+  if (typeof value === "string" && /^https?:\/\//i.test(value)) return value;
+  return void 0;
+}
+
+// src/collections.ts
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function isInCollectionMode(collections) {
+  return !!collections && collections.length > 0;
+}
+function resolvePostCollection(post, collections) {
+  if (!post.collectionKey) return null;
+  return collections.find((c) => c.key === post.collectionKey) ?? null;
+}
+function resolvePostUrl(siteUrl, post, collections) {
+  const collection = resolvePostCollection(post, collections);
+  if (!collection) return null;
+  return `${trimTrailingSlash(siteUrl)}${trimTrailingSlash(collection.basePath)}/${encodeURIComponent(post.slug)}`;
+}
+function resolvePostPath(post, collections) {
+  const collection = resolvePostCollection(post, collections);
+  if (!collection) return null;
+  return `${trimTrailingSlash(collection.basePath)}/${encodeURIComponent(post.slug)}`;
+}
+function postsForCollection(posts, collections, key) {
+  return posts.filter((p) => resolvePostCollection(p, collections)?.key === key);
+}
+function postsInAnyCollection(posts, collections) {
+  return posts.filter((p) => resolvePostCollection(p, collections) !== null);
+}
+function postsNotInAnyCollection(posts, collections) {
+  return posts.filter((p) => resolvePostCollection(p, collections) === null);
+}
+function validateCollections(collections) {
+  const problems = [];
+  const seenKey = /* @__PURE__ */ new Set();
+  const seenBase = /* @__PURE__ */ new Set();
+  const categoryOwner = /* @__PURE__ */ new Map();
+  for (const c of collections) {
+    if (seenKey.has(c.key)) problems.push(`\uC911\uBCF5 collection key: "${c.key}"`);
+    seenKey.add(c.key);
+    const base = trimTrailingSlash(c.basePath);
+    if (seenBase.has(base)) problems.push(`\uC911\uBCF5 basePath: "${c.basePath}"`);
+    seenBase.add(base);
+    if (!c.basePath.startsWith("/")) {
+      problems.push(`basePath \uB294 "/" \uB85C \uC2DC\uC791\uD574\uC57C \uD568: "${c.basePath}" (${c.key})`);
+    }
+    for (const slug of c.categories) {
+      const owner = categoryOwner.get(slug);
+      if (owner && owner !== c.key) {
+        problems.push(
+          `category "${slug}" \uAC00 collection "${owner}" \uC640 "${c.key}" \uC5D0 \uC911\uBCF5 \u2014 \uD55C \uCE74\uD14C\uACE0\uB9AC\uB294 \uD55C \uC2A4\uD2B8\uB9BC\uC5D0\uB9CC.`
+        );
+      }
+      categoryOwner.set(slug, c.key);
+    }
+  }
+  return problems;
+}
+
+// src/delimiter.ts
+function serializeBlock(block) {
+  const exportable = sanitizeAttributesForExport(block);
+  const attrsJson = serializeAttributes(exportable.attributes);
+  const innerHtml = block.rawHtml ?? "";
+  const innerSerialized = (block.innerBlocks ?? []).map((b) => serializeBlock(b)).join("\n");
+  if (!innerHtml && innerSerialized.length === 0) {
+    return attrsJson ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} /-->` : `<!-- wp:${normalizeName(block.name)} /-->`;
+  }
+  const open = attrsJson ? `<!-- wp:${normalizeName(block.name)} ${attrsJson} -->` : `<!-- wp:${normalizeName(block.name)} -->`;
+  const close = `<!-- /wp:${normalizeName(block.name)} -->`;
+  const body = [innerHtml, innerSerialized].filter(Boolean).join("\n");
+  return `${open}
+${body}
+${close}`;
+}
+function normalizeName(name) {
+  return name.startsWith("core/") ? name.slice("core/".length) : name;
+}
+function serializeAttributes(attrs) {
+  const keys = Object.keys(attrs);
+  if (keys.length === 0) return "";
+  return JSON.stringify(attrs);
+}
+function sanitizeAttributesForExport(block) {
+  return { attributes: { ...block.attributes } };
+}
+
+// src/embed.ts
+var YOUTUBE_HOSTS = /* @__PURE__ */ new Set([
+  "youtube.com",
+  "www.youtube.com",
+  "m.youtube.com",
+  "youtu.be",
+  "www.youtu.be"
+]);
+var VIMEO_HOSTS = /* @__PURE__ */ new Set(["vimeo.com", "www.vimeo.com", "player.vimeo.com"]);
+var ALLOWED_EMBED_HOSTS = /* @__PURE__ */ new Set([
+  "www.youtube-nocookie.com",
+  "youtube-nocookie.com",
+  "www.youtube.com",
+  "youtube.com",
+  "player.vimeo.com"
+]);
+var YOUTUBE_ID = /^[A-Za-z0-9_-]{11}$/;
+var VIMEO_ID = /^\d+$/;
+function normalizeEmbed(input) {
+  if (typeof input !== "string") return null;
+  const raw = input.trim();
+  if (raw.length === 0) return null;
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") return null;
+  const host = url.hostname.toLowerCase();
+  if (YOUTUBE_HOSTS.has(host)) {
+    const id = extractYouTubeId(url, host);
+    if (id) {
+      return {
+        provider: "youtube",
+        embedSrc: `https://www.youtube-nocookie.com/embed/${id}`,
+        originalUrl: raw
+      };
+    }
+  }
+  if (VIMEO_HOSTS.has(host)) {
+    const id = extractVimeoId(url, host);
+    if (id) {
+      return {
+        provider: "vimeo",
+        embedSrc: `https://player.vimeo.com/video/${id}`,
+        originalUrl: raw
+      };
+    }
+  }
+  return null;
+}
+function isAllowedEmbedSrc(value) {
+  if (typeof value !== "string") return false;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol !== "https:") return false;
+  const host = url.hostname.toLowerCase();
+  if (!ALLOWED_EMBED_HOSTS.has(host)) return false;
+  if (host === "player.vimeo.com") {
+    return /^\/video\/\d+$/.test(url.pathname);
+  }
+  return new RegExp("^/embed/[A-Za-z0-9_-]{11}$").test(url.pathname);
+}
+function extractYouTubeId(url, host) {
+  if (host === "youtu.be" || host === "www.youtu.be") {
+    const id = url.pathname.split("/").filter(Boolean)[0] ?? "";
+    return YOUTUBE_ID.test(id) ? id : null;
+  }
+  const v = url.searchParams.get("v");
+  if (v && YOUTUBE_ID.test(v)) return v;
+  const parts = url.pathname.split("/").filter(Boolean);
+  if (parts.length >= 2 && (parts[0] === "embed" || parts[0] === "shorts" || parts[0] === "v")) {
+    return YOUTUBE_ID.test(parts[1]) ? parts[1] : null;
+  }
+  return null;
+}
+function extractVimeoId(url, host) {
+  const parts = url.pathname.split("/").filter(Boolean);
+  let candidate;
+  if (host === "player.vimeo.com") {
+    const vi = parts.indexOf("video");
+    candidate = vi >= 0 ? parts[vi + 1] : parts[parts.length - 1];
+  } else {
+    candidate = parts[0];
+  }
+  return candidate && VIMEO_ID.test(candidate) ? candidate : null;
+}
+
+// src/faq.ts
+function plainText(node) {
+  if (!node) return "";
+  if (typeof node.text === "string") return node.text;
+  if (!Array.isArray(node.content)) return "";
+  return node.content.map(plainText).join(" ");
+}
+function collapse(s) {
+  return s.replace(/\s+/g, " ").trim();
+}
+function extractFaqEntries(doc) {
+  const out = [];
+  const walk = (node) => {
+    if (!node || typeof node !== "object") return;
+    if (node.type === "faqItem" && Array.isArray(node.content)) {
+      const q = node.content.find((c) => c.type === "faqQuestion");
+      const a = node.content.find((c) => c.type === "faqAnswer");
+      const question = collapse(plainText(q));
+      const answer = collapse(plainText(a));
+      if (question && answer) out.push({ question, answer });
+      return;
+    }
+    if (Array.isArray(node.content)) node.content.forEach(walk);
+  };
+  if (doc && typeof doc === "object") {
+    walk(doc);
+  }
+  return out;
+}
+function faqPageJsonLd(entries) {
+  if (entries.length === 0) return null;
+  return {
+    "@context": "https://schema.org",
+    "@type": "FAQPage",
+    mainEntity: entries.map((e) => ({
+      "@type": "Question",
+      name: e.question,
+      acceptedAnswer: { "@type": "Answer", text: e.answer }
+    }))
+  };
+}
+
+// src/preview-token.ts
+var import_node_crypto = require("crypto");
+var DELIMITER = ".";
+function base64url(buf) {
+  return buf.toString("base64url");
+}
+function fromBase64url(s) {
+  return Buffer.from(s, "base64url");
+}
+function sign(secret, message) {
+  return base64url((0, import_node_crypto.createHmac)("sha256", secret).update(message).digest());
+}
+function issuePreviewToken(secret, payload) {
+  const exp = payload.expiresAt.getTime();
+  const nonce = base64url((0, import_node_crypto.randomBytes)(12));
+  const message = `${payload.postId}${DELIMITER}${exp}${DELIMITER}${nonce}`;
+  const sig = sign(secret, message);
+  return `${message}${DELIMITER}${sig}`;
+}
+function verifyPreviewToken(secret, token) {
+  const parts = token.split(DELIMITER);
+  if (parts.length !== 4) return null;
+  const [postId, expRaw, nonce, sig] = parts;
+  const exp = Number(expRaw);
+  if (!Number.isFinite(exp)) return null;
+  if (Date.now() > exp) return null;
+  const expectedSig = sign(secret, `${postId}${DELIMITER}${exp}${DELIMITER}${nonce}`);
+  const a = fromBase64url(sig);
+  const b = fromBase64url(expectedSig);
+  if (a.length !== b.length) return null;
+  if (!(0, import_node_crypto.timingSafeEqual)(a, b)) return null;
+  return { postId, expiresAt: new Date(exp) };
+}
+
+// src/sanitize.ts
+var import_sanitize_html = __toESM(require("sanitize-html"), 1);
+var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "xlink:href"]);
+var ALLOWED_URL_SCHEMES = /* @__PURE__ */ new Set(["http", "https", "mailto", "tel"]);
+var MALFORMED_DANGEROUS_TOKEN_RE = /<\/?[^>\s/]*(?:script|style|iframe|object|embed|svg|math|template)[^>\s/]*(?:\s[^>]*)?>[\s\S]*?<\/?[^>\s/]*(?:script|style|iframe|object|embed|svg|math|template)[^>\s/]*(?:\s[^>]*)?>/gi;
+var SLASH_EVENT_ATTR_IN_URL_RE = /\/on[a-z]+=/i;
+var ROOTTALE_CLASS_RE = /^rt-[a-z0-9_-]+$/;
+var HEX_COLOR_RE = /^#[0-9a-f]{3}(?:[0-9a-f]{3})?$/i;
+var TEXT_ALIGN_RE = /^(left|right|center|justify)$/;
+var ASPECT_RATIO_RE = /^\d+(?:\.\d+)?\s*\/\s*\d+(?:\.\d+)?$/;
+var NAMED_ENTITY = {
+  colon: ":",
+  tab: "	",
+  newline: "\n",
+  sol: "/",
+  semi: ";",
+  num: "#",
+  period: ".",
+  comma: ",",
+  lpar: "(",
+  rpar: ")"
+};
+function fromCodePointSafe(n) {
+  if (!Number.isFinite(n) || n < 0 || n > 1114111) return "";
+  try {
+    return String.fromCodePoint(n);
+  } catch {
+    return "";
+  }
+}
+function decodeUrlProbe(value) {
+  const decoded = value.replace(/&#x([0-9a-f]+);?/gi, (_, h) => fromCodePointSafe(parseInt(h, 16))).replace(/&#(\d+);?/g, (_, d) => fromCodePointSafe(parseInt(d, 10))).replace(/&([a-z]+);/gi, (m, name) => NAMED_ENTITY[name.toLowerCase()] ?? m);
+  return [...decoded].filter((c) => {
+    const n = c.codePointAt(0) ?? 0;
+    return n > 32 && n !== 127;
+  }).join("").toLowerCase();
+}
+function stripMalformedDangerousTokens(html) {
+  let out = html;
+  for (let i = 0; i < 3; i++) {
+    const next = out.replace(MALFORMED_DANGEROUS_TOKEN_RE, "");
+    if (next === out) return out;
+    out = next;
+  }
+  return out;
+}
+function isSafeUrlValue(tag, attr, value) {
+  const probe = decodeUrlProbe(value);
+  if (SLASH_EVENT_ATTR_IN_URL_RE.test(probe)) return false;
+  const scheme = /^([a-z][a-z0-9+.-]*):/.exec(probe)?.[1];
+  if (!scheme) return true;
+  if (ALLOWED_URL_SCHEMES.has(scheme)) return true;
+  if (scheme === "data" && tag === "img" && attr === "src" && probe.startsWith("data:image/")) {
+    return !probe.startsWith("data:image/svg");
+  }
+  return false;
+}
+function sanitizeUrlAttributes(tagName, attribs) {
+  const next = {};
+  for (const [name, value] of Object.entries(attribs)) {
+    const attr = name.toLowerCase();
+    next[name] = URL_ATTRS.has(attr) && !isSafeUrlValue(tagName, attr, value) ? "#" : value;
+  }
+  return { tagName, attribs: next };
+}
+var SANITIZE_OPTIONS = {
+  allowedTags: [
+    "a",
+    "blockquote",
+    "br",
+    "cite",
+    "code",
+    "details",
+    "div",
+    "em",
+    "figcaption",
+    "figure",
+    "h2",
+    "h3",
+    "h4",
+    "hr",
+    "img",
+    "li",
+    "mark",
+    "ol",
+    "p",
+    "pre",
+    "s",
+    "span",
+    "strong",
+    "summary",
+    "table",
+    "tbody",
+    "td",
+    "th",
+    "tr",
+    "u",
+    "ul"
+  ],
+  allowedAttributes: {
+    "*": ["class", "data-*"],
+    a: [
+      "href",
+      "title",
+      { name: "rel", multiple: true, values: ["noopener", "noreferrer"] },
+      { name: "target", values: ["_blank"] }
+    ],
+    details: ["open", "class", "data-*"],
+    div: ["class", "data-*", "style"],
+    h2: ["id", "class", "data-*", "style"],
+    h3: ["id", "class", "data-*", "style"],
+    h4: ["id", "class", "data-*", "style"],
+    img: ["src", "alt", "title", "width", "height", "loading", "class", "data-*"],
+    mark: ["class", "data-*", "style"],
+    p: ["class", "data-*", "style"],
+    span: ["class", "data-*", "style"],
+    td: ["colspan", "rowspan", "class", "data-*"],
+    th: ["colspan", "rowspan", "class", "data-*"]
+  },
+  allowedClasses: {
+    "*": [ROOTTALE_CLASS_RE]
+  },
+  allowedStyles: {
+    "*": {
+      "aspect-ratio": [ASPECT_RATIO_RE],
+      background: [HEX_COLOR_RE],
+      "background-color": [HEX_COLOR_RE],
+      color: [HEX_COLOR_RE],
+      "text-align": [TEXT_ALIGN_RE]
+    }
+  },
+  allowedSchemes: ["http", "https", "mailto", "tel"],
+  allowedSchemesByTag: {
+    img: ["data"]
+  },
+  allowedSchemesAppliedToAttributes: ["href", "src", "xlink:href"],
+  allowProtocolRelative: false,
+  nonTextTags: [
+    "script",
+    "style",
+    "textarea",
+    "option",
+    "iframe",
+    "object",
+    "embed",
+    "svg",
+    "math",
+    "template"
+  ],
+  transformTags: {
+    "*": sanitizeUrlAttributes
+  }
+};
+function sanitizeHtml(html) {
+  if (!html) return html;
+  return (0, import_sanitize_html.default)(stripMalformedDangerousTokens(html), SANITIZE_OPTIONS);
+}
+var PHASE_1_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://imagedelivery.net https://*.r2.cloudflarestorage.com; font-src 'self' data:; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://www.youtube.com https://player.vimeo.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'";
+
+// src/stable-id.ts
+var import_uuidv7 = require("uuidv7");
+function ensureStableIds(block) {
+  return {
+    ...block,
+    _id: block._id ?? (0, import_uuidv7.uuidv7)(),
+    innerBlocks: (block.innerBlocks ?? []).map(
+      (inner) => ensureStableIds(inner)
+    )
+  };
+}
+function injectStableIdsTree(blocks) {
+  return blocks.map((b) => ensureStableIds(b));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BLOCK_NAME_PATTERN,
+  FIELD_BINDING_SOURCE,
+  FIELD_BINDING_SOURCE_ALIAS,
+  PHASE_1_CORE_BLOCKS,
+  PHASE_1_CSP,
+  applyBlockBindings,
+  bindingSrcValue,
+  bindingTextValue,
+  blockSchema,
+  boundFieldValue,
+  chainResolvers,
+  createFieldBindingResolver,
+  ensureStableIds,
+  extractFaqEntries,
+  faqPageJsonLd,
+  injectStableIdsTree,
+  isAllowedEmbedSrc,
+  isInCollectionMode,
+  isValidBlock,
+  issuePreviewToken,
+  normalizeEmbed,
+  parseBlock,
+  postsForCollection,
+  postsInAnyCollection,
+  postsNotInAnyCollection,
+  resolvePostCollection,
+  resolvePostPath,
+  resolvePostUrl,
+  sanitizeHtml,
+  serializeBlock,
+  validateCollections,
+  verifyPreviewToken
+});
+//# sourceMappingURL=index.cjs.map