@roottale/cms-core 0.53.0 → 0.53.1

package/dist/index.js

@@ -380,6 +380,467 @@ function normalizeImageAlt(value) {
   return `${visible}\u2026`;
 }
 
+// src/imported-html-sanitize.ts
+import postcss from "postcss";
+import sanitizeHtmlLibrary from "sanitize-html";
+var IMPORT_SCOPE_RE = /^rt-import-[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var ALLOWED_AT_RULES = /* @__PURE__ */ new Set([
+  "container",
+  "font-face",
+  "keyframes",
+  "-webkit-keyframes",
+  "layer",
+  "media",
+  "supports"
+]);
+var URL_ATTRIBUTES = /* @__PURE__ */ new Set(["href", "src"]);
+var ALLOWED_URL_SCHEMES = /* @__PURE__ */ new Set(["http", "https", "mailto", "tel"]);
+var UNSAFE_CSS_VALUE_RE = /(?:expression\s*\(|javascript\s*:|vbscript\s*:|@import|<\/?(?:style|script)|\\0|\\0000)/i;
+var UNSAFE_CSS_PROPERTY_RE = /^(?:behavior|-moz-binding)$/i;
+var FIXED_POSITION_RE = /^(?:fixed|sticky)$/i;
+var ORIGINAL_H1_ATTRIBUTE = "data-rt-original-heading";
+var SCOPE_ROOT_BOUNDARY_PROPERTIES = /* @__PURE__ */ new Set([
+  "bottom",
+  "inset",
+  "inset-block",
+  "inset-inline",
+  "left",
+  "position",
+  "right",
+  "rotate",
+  "scale",
+  "top",
+  "transform",
+  "translate",
+  "z-index"
+]);
+function fromCodePointSafe(value, radix) {
+  const codePoint = Number.parseInt(value, radix);
+  if (!Number.isFinite(codePoint) || codePoint < 0 || codePoint > 1114111) {
+    return "";
+  }
+  try {
+    return String.fromCodePoint(codePoint);
+  } catch {
+    return "";
+  }
+}
+function isSafeUrl(tagName, attributeName, value) {
+  const normalized = value.replace(/&#x([0-9a-f]+);?/gi, (_, hex) => fromCodePointSafe(hex, 16)).replace(/&#(\d+);?/g, (_, decimal) => fromCodePointSafe(decimal, 10)).replace(/[\u0000-\u0020\u007f]/g, "").toLowerCase();
+  const scheme = /^([a-z][a-z0-9+.-]*):/.exec(normalized)?.[1];
+  if (!scheme) return true;
+  if (ALLOWED_URL_SCHEMES.has(scheme)) return true;
+  return tagName === "img" && attributeName === "src" && scheme === "data" && normalized.startsWith("data:image/") && !normalized.startsWith("data:image/svg");
+}
+function cssUrlsAreSafe(value, allowedAssetUrls) {
+  const urlRe = /url\(\s*(["']?)([^)'"\s]+)\1\s*\)/gi;
+  let matched = false;
+  for (const match of value.matchAll(urlRe)) {
+    matched = true;
+    const url = match[2]?.trim() ?? "";
+    if (!url.startsWith("#") && !allowedAssetUrls.has(url)) return false;
+  }
+  return !/url\s*\(/i.test(value) || matched;
+}
+function declarationIsSafe(property, value, allowedAssetUrls) {
+  if (UNSAFE_CSS_PROPERTY_RE.test(property) || UNSAFE_CSS_VALUE_RE.test(value)) {
+    return false;
+  }
+  if (!cssUrlsAreSafe(value, allowedAssetUrls)) return false;
+  if (property === "position" && /\b(?:fixed|sticky)\b/i.test(value)) {
+    return false;
+  }
+  if (property.startsWith("--") && FIXED_POSITION_RE.test(value.trim())) {
+    return false;
+  }
+  if (property === "z-index") {
+    const normalized = value.trim().toLowerCase();
+    if (normalized !== "auto") {
+      const zIndex = Number(normalized);
+      if (!Number.isInteger(zIndex) || Math.abs(zIndex) > 100) return false;
+    }
+  }
+  for (const match of value.matchAll(/(-?\d+(?:\.\d+)?)(px|vh|vw)/gi)) {
+    const magnitude = Math.abs(Number(match[1]));
+    const limit = match[2].toLowerCase() === "px" ? 4e3 : 200;
+    if (magnitude > limit) return false;
+  }
+  return true;
+}
+function cleanCssContainer(container, allowedAssetUrls) {
+  container.walkComments((comment) => {
+    comment.remove();
+  });
+  container.walkAtRules((atRule) => {
+    const name = atRule.name.toLowerCase();
+    const isKeyframes = name === "keyframes" || name === "-webkit-keyframes";
+    if (!ALLOWED_AT_RULES.has(name) || !atRule.nodes?.length || name === "font-face" && atRule.parent?.type !== "root" || isKeyframes && !/^[a-z_][\w-]*$/i.test(atRule.params.trim()) || /<\/?(?:style|script)/i.test(atRule.params)) {
+      atRule.remove();
+    }
+  });
+  container.walkDecls((declaration) => {
+    const property = declaration.prop.trim().toLowerCase();
+    if (!property || !declarationIsSafe(property, declaration.value, allowedAssetUrls)) {
+      declaration.remove();
+      return;
+    }
+  });
+  container.walkRules((rule) => {
+    if (!rule.selector.trim() || !rule.nodes?.length || /<\/?(?:style|script)/i.test(rule.selector)) {
+      rule.remove();
+    }
+  });
+  container.walkAtRules("font-face", (fontFace) => {
+    const declarations = fontFace.nodes ?? [];
+    const hasFamily = declarations.some(
+      (node) => node.type === "decl" && node.prop.toLowerCase() === "font-family"
+    );
+    const hasSource = declarations.some(
+      (node) => node.type === "decl" && node.prop.toLowerCase() === "src"
+    );
+    if (!hasFamily || !hasSource) fontFace.remove();
+  });
+}
+function sanitizeImportedCss(css, allowedAssetUrls = []) {
+  if (!css.trim()) return "";
+  try {
+    const root = postcss.parse(css);
+    cleanCssContainer(root, new Set(allowedAssetUrls));
+    return root.toString().trim();
+  } catch {
+    return "";
+  }
+}
+function sanitizeInlineStyle(style, allowedAssetUrls) {
+  try {
+    const root = postcss.parse(`x{${style}}`);
+    cleanCssContainer(root, allowedAssetUrls);
+    const rule = root.first;
+    if (!rule || rule.type !== "rule") return "";
+    return rule.nodes.map((node) => node.toString()).join(";");
+  } catch {
+    return "";
+  }
+}
+function sanitizeImportedAttributes(tagName, attributes, allowedAssetUrls) {
+  const next = {};
+  for (const [name, value] of Object.entries(attributes)) {
+    const attributeName = name.toLowerCase();
+    if (attributeName === "style") {
+      const style = sanitizeInlineStyle(value, allowedAssetUrls);
+      if (style) next[name] = style;
+      continue;
+    }
+    if (attributeName === "srcset") {
+      const srcset = sanitizeSrcset(value);
+      if (srcset) next[name] = srcset;
+      continue;
+    }
+    if ((attributeName === "fill" || attributeName === "stroke") && /url\s*\(/i.test(value) && !/^url\(#[a-z_][\w:.-]*\)$/i.test(value.trim())) {
+      continue;
+    }
+    if ((tagName === "use" || tagName === "image") && (attributeName === "href" || attributeName === "xlink:href") && !value.trim().startsWith("#")) {
+      continue;
+    }
+    next[name] = URL_ATTRIBUTES.has(attributeName) && !isSafeUrl(tagName, attributeName, value) ? "#" : value;
+  }
+  if (tagName === "a" && next.target === "_blank") {
+    next.rel = "noopener noreferrer";
+  }
+  if (tagName === "h1") {
+    next[ORIGINAL_H1_ATTRIBUTE] = "h1";
+    return { tagName: "h2", attribs: next };
+  }
+  return { tagName, attribs: next };
+}
+function sanitizeSrcset(value) {
+  const candidates = [];
+  for (const rawCandidate of value.split(",")) {
+    const candidate = rawCandidate.trim();
+    if (!candidate) continue;
+    const [url, ...descriptorParts] = candidate.split(/\s+/);
+    if (!url || !isSafeUrl("img", "src", url)) continue;
+    const descriptor = descriptorParts.join(" ");
+    if (descriptor && !/^(?:\d+(?:\.\d+)?x|\d+w)$/.test(descriptor)) continue;
+    candidates.push(descriptor ? `${url} ${descriptor}` : url);
+  }
+  return candidates.join(", ");
+}
+var IMPORTED_HTML_OPTIONS = {
+  allowedTags: [
+    "a",
+    "abbr",
+    "address",
+    "article",
+    "aside",
+    "b",
+    "bdi",
+    "bdo",
+    "blockquote",
+    "br",
+    "caption",
+    "cite",
+    "code",
+    "col",
+    "colgroup",
+    "dd",
+    "del",
+    "details",
+    "dfn",
+    "div",
+    "dl",
+    "dt",
+    "em",
+    "figcaption",
+    "figure",
+    "footer",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "header",
+    "hr",
+    "i",
+    "img",
+    "kbd",
+    "li",
+    "main",
+    "mark",
+    "nav",
+    "ol",
+    "p",
+    "picture",
+    "pre",
+    "q",
+    "s",
+    "samp",
+    "section",
+    "small",
+    "source",
+    "svg",
+    "g",
+    "path",
+    "circle",
+    "ellipse",
+    "line",
+    "polyline",
+    "polygon",
+    "rect",
+    "defs",
+    "lineargradient",
+    "radialgradient",
+    "stop",
+    "use",
+    "clippath",
+    "mask",
+    "pattern",
+    "title",
+    "desc",
+    "span",
+    "strong",
+    "sub",
+    "summary",
+    "sup",
+    "table",
+    "tbody",
+    "td",
+    "tfoot",
+    "th",
+    "thead",
+    "time",
+    "tr",
+    "u",
+    "ul",
+    "var",
+    "wbr"
+  ],
+  allowedAttributes: {
+    "*": ["aria-*", "class", "data-*", "dir", "id", "lang", "role", "style", "title"],
+    a: [
+      "href",
+      { name: "rel", multiple: true, values: ["noopener", "noreferrer"] },
+      { name: "target", values: ["_blank"] }
+    ],
+    col: ["span", "style"],
+    img: ["alt", "height", "loading", "sizes", "src", "srcset", "style", "width"],
+    source: ["height", "media", "sizes", "src", "srcset", "type", "width"],
+    svg: ["aria-*", "class", "fill", "height", "preserveAspectRatio", "role", "stroke", "style", "viewBox", "viewbox", "width", "xmlns"],
+    g: ["class", "fill", "stroke", "stroke-width", "style", "transform"],
+    path: ["class", "d", "fill", "fill-rule", "stroke", "stroke-linecap", "stroke-linejoin", "stroke-width", "style", "transform"],
+    circle: ["class", "cx", "cy", "fill", "r", "stroke", "stroke-width", "style", "transform"],
+    ellipse: ["class", "cx", "cy", "fill", "rx", "ry", "stroke", "stroke-width", "style", "transform"],
+    line: ["class", "stroke", "stroke-linecap", "stroke-width", "style", "transform", "x1", "x2", "y1", "y2"],
+    polyline: ["class", "fill", "points", "stroke", "stroke-linecap", "stroke-linejoin", "stroke-width", "style", "transform"],
+    polygon: ["class", "fill", "points", "stroke", "stroke-width", "style", "transform"],
+    rect: ["class", "fill", "height", "rx", "ry", "stroke", "stroke-width", "style", "transform", "width", "x", "y"],
+    lineargradient: ["gradientTransform", "gradientUnits", "id", "spreadMethod", "x1", "x2", "y1", "y2"],
+    radialgradient: ["cx", "cy", "fx", "fy", "gradientTransform", "gradientUnits", "id", "r", "spreadMethod"],
+    stop: ["offset", "stop-color", "stop-opacity", "style"],
+    use: ["fill", "height", "href", "stroke", "style", "width", "x", "xlink:href", "y"],
+    clippath: ["clipPathUnits", "id", "transform"],
+    mask: ["height", "id", "maskContentUnits", "maskUnits", "width", "x", "y"],
+    pattern: ["height", "id", "patternContentUnits", "patternTransform", "patternUnits", "preserveAspectRatio", "viewBox", "width", "x", "y"],
+    td: ["colspan", "rowspan", "style"],
+    th: [
+      "colspan",
+      "rowspan",
+      "style",
+      { name: "scope", values: ["col", "row", "colgroup", "rowgroup"] }
+    ],
+    time: ["datetime"]
+  },
+  allowedSchemes: ["http", "https", "mailto", "tel"],
+  allowedSchemesByTag: { img: ["http", "https", "data"] },
+  allowedSchemesAppliedToAttributes: ["href", "src"],
+  allowProtocolRelative: false,
+  nonTextTags: ["script", "style", "textarea", "option", "iframe", "object", "embed", "foreignobject", "math", "template"]
+};
+function sanitizeImportedHtml(html, allowedAssetUrls = []) {
+  if (!html) return html;
+  const allowedSet = new Set(allowedAssetUrls);
+  return sanitizeHtmlLibrary(html, {
+    ...IMPORTED_HTML_OPTIONS,
+    transformTags: {
+      "*": (tagName, attributes) => sanitizeImportedAttributes(tagName, attributes, allowedSet)
+    }
+  });
+}
+function ensureImportedHtmlDocumentRoots(html, allowedAssetUrls = []) {
+  const safeHtml = sanitizeImportedHtml(html, allowedAssetUrls).trim();
+  if (!safeHtml) return safeHtml;
+  if (/^<div\b[^>]*\bdata-rt-import-document(?:=(?:""|'')|(?=[\s>]))[^>]*>\s*<div\b[^>]*\bdata-rt-import-body(?:=(?:""|'')|(?=[\s>]))/i.test(
+    safeHtml
+  )) {
+    return safeHtml;
+  }
+  return `<div data-rt-import-document><div data-rt-import-body>${safeHtml}</div></div>`;
+}
+function normalizeDocumentSelector(selector) {
+  const typeBoundary = "(?=$|[\\s>+~,.#:\\[\\)])";
+  return selector.replace(/html\s*>\s*body/gi, "[data-rt-import-document] > [data-rt-import-body]").replace(/html\s+body/gi, "[data-rt-import-document] [data-rt-import-body]").replace(new RegExp(`(^|[\\s>+~,\\(])html${typeBoundary}`, "gi"), "$1[data-rt-import-document]").replace(new RegExp(`(^|[\\s>+~,\\(])body${typeBoundary}`, "gi"), "$1[data-rt-import-body]").replace(
+    new RegExp(`(^|[\\s>+~,\\(])h1${typeBoundary}`, "gi"),
+    `$1[${ORIGINAL_H1_ATTRIBUTE}="h1"]`
+  ).replace(/:root/g, "[data-rt-import-document]");
+}
+function selectorTargetsDocumentBoundary(selector) {
+  return selector.split(",").some((part) => {
+    const normalized = part.trim();
+    const targetsDocumentRoot = normalized.startsWith("[data-rt-import-document]") && !/[\s>+~]/.test(normalized.slice("[data-rt-import-document]".length));
+    const targetsBodyRoot = /\[data-rt-import-body\](?:[.#:][\w-]+|\[[^\]]+\])*\s*$/.test(
+      normalized
+    );
+    return targetsDocumentRoot || targetsBodyRoot;
+  });
+}
+function replaceAnimationName(value, names) {
+  let next = value;
+  for (const [name, scopedName] of names) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    next = next.replace(new RegExp(`(^|[^\\w-])${escaped}(?=$|[^\\w-])`, "g"), `$1${scopedName}`);
+  }
+  return next;
+}
+function unquoteCssIdentifier(value) {
+  const normalized = value.trim();
+  const match = /^(?:"([^"]+)"|'([^']+)'|([a-z_][\w -]*))$/i.exec(normalized);
+  return (match?.[1] ?? match?.[2] ?? match?.[3] ?? "").trim() || null;
+}
+function replaceFontFamilyName(value, names) {
+  let next = value;
+  for (const [name, scopedName] of names) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    next = next.replace(
+      new RegExp(`(["'])${escaped}\\1|(^|[,\\s])${escaped}(?=$|[,\\s/])`, "gi"),
+      (matched, quote, prefix) => quote ? `${quote}${scopedName}${quote}` : `${prefix ?? ""}${scopedName}`
+    );
+  }
+  return next;
+}
+function scopeImportedCss(css, scope, allowedAssetUrls = []) {
+  if (!IMPORT_SCOPE_RE.test(scope)) return "";
+  const safeCss = sanitizeImportedCss(css, allowedAssetUrls);
+  if (!safeCss) return "";
+  try {
+    const root = postcss.parse(safeCss);
+    const keyframeNames = /* @__PURE__ */ new Map();
+    const fontFamilyNames = /* @__PURE__ */ new Map();
+    const fontFaces = root.nodes.filter(
+      (node) => node.type === "atrule" && node.name.toLowerCase() === "font-face"
+    );
+    for (const fontFace of fontFaces) {
+      if (fontFace.type !== "atrule") continue;
+      const family = fontFace.nodes?.find(
+        (node) => node.type === "decl" && node.prop.toLowerCase() === "font-family"
+      );
+      if (!family || family.type !== "decl") {
+        fontFace.remove();
+        continue;
+      }
+      const originalName = unquoteCssIdentifier(family.value);
+      const hasSupportedSource = fontFace.nodes?.some(
+        (node) => node.type === "decl" && node.prop.toLowerCase() === "src" && /url\(\s*["']?https:\/\/[^)'"\s]+\.woff2?(?:[?#][^)'"\s]*)?["']?\s*\)/i.test(
+          node.value
+        )
+      );
+      if (!originalName || !hasSupportedSource) {
+        fontFace.remove();
+        continue;
+      }
+      const scopedName = `${scope}-${originalName}`;
+      fontFamilyNames.set(originalName, scopedName);
+      family.value = family.value.replace(originalName, scopedName);
+    }
+    root.walkAtRules((atRule) => {
+      const name = atRule.name.toLowerCase();
+      if (name !== "keyframes" && name !== "-webkit-keyframes") return;
+      const originalName = atRule.params.trim();
+      const scopedName = `${scope}-${originalName}`;
+      keyframeNames.set(originalName, scopedName);
+      atRule.params = scopedName;
+    });
+    root.walkDecls((declaration) => {
+      const property = declaration.prop.trim().toLowerCase();
+      if (property === "animation" || property === "animation-name") {
+        declaration.value = replaceAnimationName(declaration.value, keyframeNames);
+      }
+      if (property === "font-family" || property === "font") {
+        declaration.value = replaceFontFamilyName(
+          declaration.value,
+          fontFamilyNames
+        );
+      }
+    });
+    root.walkRules((rule) => {
+      const parent = rule.parent;
+      if (parent?.type === "atrule" && (parent.name.toLowerCase() === "keyframes" || parent.name.toLowerCase() === "-webkit-keyframes")) {
+        return;
+      }
+      rule.selector = normalizeDocumentSelector(rule.selector);
+      if (selectorTargetsDocumentBoundary(rule.selector)) {
+        rule.walkDecls((declaration) => {
+          if (SCOPE_ROOT_BOUNDARY_PROPERTIES.has(
+            declaration.prop.trim().toLowerCase()
+          )) {
+            declaration.remove();
+          }
+        });
+      }
+    });
+    const scoped = postcss.atRule({
+      name: "scope",
+      params: `([data-rt-import-scope="${scope}"])`
+    });
+    const preservedFontFaces = fontFaces.filter((fontFace) => fontFace.parent);
+    for (const fontFace of preservedFontFaces) fontFace.remove();
+    scoped.append(root.nodes);
+    return [...preservedFontFaces.map((fontFace) => fontFace.toString()), scoped.toString()].filter(Boolean).join("\n");
+  } catch {
+    return "";
+  }
+}
+
 // src/preview-token.ts
 import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 var DELIMITER = ".";
@@ -415,15 +876,58 @@ function verifyPreviewToken(secret, token) {
 }
 
 // src/sanitize.ts
-import sanitizeHtmlLibrary from "sanitize-html";
+import sanitizeHtmlLibrary2 from "sanitize-html";
 var URL_ATTRS = /* @__PURE__ */ new Set(["href", "src", "xlink:href"]);
-var ALLOWED_URL_SCHEMES = /* @__PURE__ */ new Set(["http", "https", "mailto", "tel"]);
+var ALLOWED_URL_SCHEMES2 = /* @__PURE__ */ new Set(["http", "https", "mailto", "tel"]);
 var MALFORMED_DANGEROUS_TOKEN_RE = /<\/?[^>\s/]*(?:script|style|iframe|object|embed|svg|math|template)[^>\s/]*(?:\s[^>]*)?>[\s\S]*?<\/?[^>\s/]*(?:script|style|iframe|object|embed|svg|math|template)[^>\s/]*(?:\s[^>]*)?>/gi;
 var SLASH_EVENT_ATTR_IN_URL_RE = /\/on[a-z]+=/i;
 var ROOTTALE_CLASS_RE = /^rt-[a-z0-9_-]+$/;
 var HEX_COLOR_RE = /^#[0-9a-f]{3}(?:[0-9a-f]{3})?$/i;
 var TEXT_ALIGN_RE = /^(left|right|center|justify)$/;
 var ASPECT_RATIO_RE = /^\d+(?:\.\d+)?\s*\/\s*\d+(?:\.\d+)?$/;
+var CSS_LENGTH_RE = /^(?:0|\d+(?:\.\d+)?(?:px|em|rem|%))$/i;
+var CSS_LENGTH_LIST_RE = /^(?:0|\d+(?:\.\d+)?(?:px|em|rem|%))(?:\s+(?:0|\d+(?:\.\d+)?(?:px|em|rem|%))){0,3}$/i;
+var CSS_LINE_HEIGHT_RE = /^(?:normal|\d+(?:\.\d+)?(?:px|em|rem|%)?)$/i;
+var CSS_FONT_WEIGHT_RE = /^(?:normal|bold|[1-9]00)$/i;
+var CSS_BORDER_RE = /^(?:none|0|(?:\d(?:\.\d+)?|[12]\d(?:\.\d+)?|3[0-2](?:\.0+)?)px\s+(?:solid|dashed|dotted)\s+#[0-9a-f]{3}(?:[0-9a-f]{3})?)$/i;
+var CSS_TEXT_DECORATION_RE = /^(?:none|underline|line-through)$/i;
+var CSS_MAGNITUDE_LIMITS = {
+  "font-size": { "": 0, px: 96, em: 5, rem: 5, "%": 200 },
+  "line-height": { "": 5, px: 96, em: 5, rem: 5, "%": 500 },
+  margin: { "": 0, px: 2e3, em: 20, rem: 20, "%": 200 },
+  "margin-bottom": { "": 0, px: 2e3, em: 20, rem: 20, "%": 200 },
+  "margin-left": { "": 0, px: 2e3, em: 20, rem: 20, "%": 200 },
+  "margin-right": { "": 0, px: 2e3, em: 20, rem: 20, "%": 200 },
+  "margin-top": { "": 0, px: 2e3, em: 20, rem: 20, "%": 200 },
+  padding: { "": 0, px: 2e3, em: 20, rem: 20, "%": 200 },
+  "padding-bottom": { "": 0, px: 2e3, em: 20, rem: 20, "%": 200 },
+  "padding-left": { "": 0, px: 2e3, em: 20, rem: 20, "%": 200 },
+  "padding-right": { "": 0, px: 2e3, em: 20, rem: 20, "%": 200 },
+  "padding-top": { "": 0, px: 2e3, em: 20, rem: 20, "%": 200 },
+  width: { "": 0, px: 4e3, em: 100, rem: 100, "%": 100 },
+  "max-width": { "": 0, px: 4e3, em: 100, rem: 100, "%": 100 },
+  height: { "": 0, px: 4e3, em: 100, rem: 100, "%": 100 }
+};
+function hasSafeCssMagnitude(property, value) {
+  const limits = CSS_MAGNITUDE_LIMITS[property];
+  if (!limits) return true;
+  const numericTokens = value.matchAll(/(\d+(?:\.\d+)?)(px|em|rem|%)?/gi);
+  for (const match of numericTokens) {
+    const unit = (match[2] ?? "").toLowerCase();
+    const limit = limits[unit];
+    if (limit === void 0 || Number(match[1]) > limit) return false;
+  }
+  return true;
+}
+function filterUnsafeCssMagnitudes(style) {
+  return style.split(";").map((declaration) => declaration.trim()).filter(Boolean).filter((declaration) => {
+    const colon = declaration.indexOf(":");
+    if (colon < 1) return false;
+    const property = declaration.slice(0, colon).trim().toLowerCase();
+    const value = declaration.slice(colon + 1).trim();
+    return hasSafeCssMagnitude(property, value);
+  }).join(";");
+}
 var NAMED_ENTITY = {
   colon: ":",
   tab: "	",
@@ -436,7 +940,7 @@ var NAMED_ENTITY = {
   lpar: "(",
   rpar: ")"
 };
-function fromCodePointSafe(n) {
+function fromCodePointSafe2(n) {
   if (!Number.isFinite(n) || n < 0 || n > 1114111) return "";
   try {
     return String.fromCodePoint(n);
@@ -445,7 +949,7 @@ function fromCodePointSafe(n) {
   }
 }
 function decodeUrlProbe(value) {
-  const decoded = value.replace(/&#x([0-9a-f]+);?/gi, (_, h) => fromCodePointSafe(parseInt(h, 16))).replace(/&#(\d+);?/g, (_, d) => fromCodePointSafe(parseInt(d, 10))).replace(/&([a-z]+);/gi, (m, name) => NAMED_ENTITY[name.toLowerCase()] ?? m);
+  const decoded = value.replace(/&#x([0-9a-f]+);?/gi, (_, h) => fromCodePointSafe2(parseInt(h, 16))).replace(/&#(\d+);?/g, (_, d) => fromCodePointSafe2(parseInt(d, 10))).replace(/&([a-z]+);/gi, (m, name) => NAMED_ENTITY[name.toLowerCase()] ?? m);
   return [...decoded].filter((c) => {
     const n = c.codePointAt(0) ?? 0;
     return n > 32 && n !== 127;
@@ -465,7 +969,7 @@ function isSafeUrlValue(tag, attr, value) {
   if (SLASH_EVENT_ATTR_IN_URL_RE.test(probe)) return false;
   const scheme = /^([a-z][a-z0-9+.-]*):/.exec(probe)?.[1];
   if (!scheme) return true;
-  if (ALLOWED_URL_SCHEMES.has(scheme)) return true;
+  if (ALLOWED_URL_SCHEMES2.has(scheme)) return true;
   if (scheme === "data" && tag === "img" && attr === "src" && probe.startsWith("data:image/")) {
     return !probe.startsWith("data:image/svg");
   }
@@ -475,8 +979,16 @@ function sanitizeUrlAttributes(tagName, attribs) {
   const next = {};
   for (const [name, value] of Object.entries(attribs)) {
     const attr = name.toLowerCase();
+    if (attr === "style") {
+      const style = filterUnsafeCssMagnitudes(value);
+      if (style) next[name] = style;
+      continue;
+    }
     next[name] = URL_ATTRS.has(attr) && !isSafeUrlValue(tagName, attr, value) ? "#" : value;
   }
+  if (tagName === "a" && next.target === "_blank") {
+    next.rel = "noopener noreferrer";
+  }
   return { tagName, attribs: next };
 }
 var SANITIZE_OPTIONS = {
@@ -502,19 +1014,25 @@ var SANITIZE_OPTIONS = {
     "p",
     "pre",
     "s",
+    "section",
+    "small",
     "span",
     "strong",
+    "sub",
     "summary",
+    "sup",
     "table",
     "tbody",
     "td",
+    "tfoot",
     "th",
+    "thead",
     "tr",
     "u",
     "ul"
   ],
   allowedAttributes: {
-    "*": ["class", "data-*"],
+    "*": ["class", "data-*", "style"],
     a: [
       "href",
       "title",
@@ -531,7 +1049,14 @@ var SANITIZE_OPTIONS = {
     p: ["class", "data-*", "style"],
     span: ["class", "data-*", "style"],
     td: ["colspan", "rowspan", "class", "data-*"],
-    th: ["colspan", "rowspan", "class", "data-*"]
+    // scope 는 표 머리행의 접근성 의미(스크린리더 열/행 연결) — 값 집합을 고정해 허용.
+    th: [
+      "colspan",
+      "rowspan",
+      "class",
+      "data-*",
+      { name: "scope", values: ["col", "row", "colgroup", "rowgroup"] }
+    ]
   },
   allowedClasses: {
     "*": [ROOTTALE_CLASS_RE]
@@ -541,8 +1066,31 @@ var SANITIZE_OPTIONS = {
       "aspect-ratio": [ASPECT_RATIO_RE],
       background: [HEX_COLOR_RE],
       "background-color": [HEX_COLOR_RE],
+      border: [CSS_BORDER_RE],
+      "border-bottom": [CSS_BORDER_RE],
+      "border-left": [CSS_BORDER_RE],
+      "border-right": [CSS_BORDER_RE],
+      "border-top": [CSS_BORDER_RE],
+      "border-collapse": [/^(?:collapse|separate)$/i],
       color: [HEX_COLOR_RE],
-      "text-align": [TEXT_ALIGN_RE]
+      "font-size": [CSS_LENGTH_RE],
+      "font-weight": [CSS_FONT_WEIGHT_RE],
+      height: [CSS_LENGTH_RE, /^auto$/i],
+      "line-height": [CSS_LINE_HEIGHT_RE],
+      margin: [CSS_LENGTH_LIST_RE],
+      "margin-bottom": [CSS_LENGTH_RE],
+      "margin-left": [CSS_LENGTH_RE],
+      "margin-right": [CSS_LENGTH_RE],
+      "margin-top": [CSS_LENGTH_RE],
+      "max-width": [CSS_LENGTH_RE, /^none$/i],
+      padding: [CSS_LENGTH_LIST_RE],
+      "padding-bottom": [CSS_LENGTH_RE],
+      "padding-left": [CSS_LENGTH_RE],
+      "padding-right": [CSS_LENGTH_RE],
+      "padding-top": [CSS_LENGTH_RE],
+      "text-align": [TEXT_ALIGN_RE],
+      "text-decoration": [CSS_TEXT_DECORATION_RE],
+      width: [CSS_LENGTH_RE, /^auto$/i]
     }
   },
   allowedSchemes: ["http", "https", "mailto", "tel"],
@@ -571,7 +1119,18 @@ var SANITIZE_OPTIONS = {
 };
 function sanitizeHtml(html) {
   if (!html) return html;
-  return sanitizeHtmlLibrary(stripMalformedDangerousTokens(html), SANITIZE_OPTIONS);
+  return sanitizeHtmlLibrary2(stripMalformedDangerousTokens(html), SANITIZE_OPTIONS);
+}
+function htmlToPlainText(html) {
+  const safeHtml = sanitizeHtml(html);
+  const withBlockBoundaries = safeHtml.replace(
+    /<(?:br|hr)\b[^>]*>|<\/(?:blockquote|details|div|figcaption|figure|h[2-4]|li|p|pre|section|summary|table|tbody|td|th|tr)>/gi,
+    " "
+  );
+  return sanitizeHtmlLibrary2(withBlockBoundaries, {
+    allowedTags: [],
+    allowedAttributes: {}
+  }).replace(/\u00a0/g, " ").replace(/\s+/g, " ").trim();
 }
 var PHASE_1_CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://imagedelivery.net https://*.r2.cloudflarestorage.com; font-src 'self' data:; connect-src 'self'; frame-src https://www.youtube-nocookie.com https://www.youtube.com https://player.vimeo.com; frame-ancestors 'none'; base-uri 'self'; form-action 'self'";
 
@@ -603,9 +1162,11 @@ export {
   boundFieldValue,
   chainResolvers,
   createFieldBindingResolver,
+  ensureImportedHtmlDocumentRoots,
   ensureStableIds,
   extractFaqEntries,
   faqPageJsonLd,
+  htmlToPlainText,
   injectStableIdsTree,
   isAllowedEmbedSrc,
   isAllowedMapEmbedSrc,
@@ -622,6 +1183,9 @@ export {
   resolvePostPath,
   resolvePostUrl,
   sanitizeHtml,
+  sanitizeImportedCss,
+  sanitizeImportedHtml,
+  scopeImportedCss,
   serializeBlock,
   validateCollections,
   verifyPreviewToken