@roottale/cms-core 0.66.0 → 0.67.1

package/dist/index.js

@@ -973,10 +973,10 @@ function scopeImportedCss(css, scope, allowedAssetUrls = []) {
 
 // src/internal-content-links.ts
 var INTERNAL_CONTENT_LINK_TOKEN_SOURCE = String.raw`\[\[internal:([a-z0-9가-힣]+(?:[.-][a-z0-9가-힣]+)*)\|([^\]\n|]+)\]\]`;
-function findInternalContentLinkTokens(text) {
+function findInternalContentLinkTokens(text2) {
   const pattern = new RegExp(INTERNAL_CONTENT_LINK_TOKEN_SOURCE, "giu");
   const tokens = [];
-  for (const match of text.matchAll(pattern)) {
+  for (const match of text2.matchAll(pattern)) {
     const [raw, key, label] = match;
     if (!key || !label || match.index === void 0) continue;
     tokens.push({
@@ -1035,19 +1035,19 @@ function escapeHtmlText(value) {
 var INTERNAL_CONTENT_LINK_CLASS = "rt-internal-link";
 var INTERNAL_CONTENT_LINK_PENDING_CLASS = "rt-internal-link--pending";
 var INTERNAL_CONTENT_LINK_PENDING_ATTR = "data-rt-internal-link-pending";
-function renderInternalContentLinksInText(text, resolve) {
-  const tokens = findInternalContentLinkTokens(text);
-  if (tokens.length === 0) return { html: text, hasTokens: false };
+function renderInternalContentLinksInText(text2, resolve) {
+  const tokens = findInternalContentLinkTokens(text2);
+  if (tokens.length === 0) return { html: text2, hasTokens: false };
   let cursor = 0;
   let html = "";
   for (const token of tokens) {
-    html += text.slice(cursor, token.index);
+    html += text2.slice(cursor, token.index);
     const path = resolve(token.key);
     const label = escapeHtmlText(token.label);
     html += isSafeInternalPath(path) ? `<a href="${escapeHtmlText(path)}" class="${INTERNAL_CONTENT_LINK_CLASS}">${label}</a>` : `<span class="${INTERNAL_CONTENT_LINK_CLASS} ${INTERNAL_CONTENT_LINK_PENDING_CLASS}" ${INTERNAL_CONTENT_LINK_PENDING_ATTR}="${escapeHtmlText(token.key)}">${label}</span>`;
     cursor = token.index + token.raw.length;
   }
-  html += text.slice(cursor);
+  html += text2.slice(cursor);
   return { html, hasTokens: true };
 }
 var INTERNAL_LINK_BLOCKED_HTML_TAGS = /* @__PURE__ */ new Set([
@@ -1081,12 +1081,12 @@ function renderInternalContentLinksInHtml(html, resolve) {
   let cursor = 0;
   let out = "";
   let hasTokens = false;
-  const emitText = (text) => {
-    if (blockedDepth > 0 || !text) {
-      out += text;
+  const emitText = (text2) => {
+    if (blockedDepth > 0 || !text2) {
+      out += text2;
       return;
     }
-    const rendered = renderInternalContentLinksInText(text, resolve);
+    const rendered = renderInternalContentLinksInText(text2, resolve);
     hasTokens ||= rendered.hasTokens;
     out += rendered.html;
   };
@@ -1225,8 +1225,8 @@ function fromCodePointSafe2(n) {
   }
 }
 function decodeUrlProbe(value) {
-  const decoded = value.replace(/&#x([0-9a-f]+);?/gi, (_, h) => fromCodePointSafe2(parseInt(h, 16))).replace(/&#(\d+);?/g, (_, d) => fromCodePointSafe2(parseInt(d, 10))).replace(/&([a-z]+);/gi, (m, name) => NAMED_ENTITY[name.toLowerCase()] ?? m);
-  return [...decoded].filter((c) => {
+  const decoded2 = value.replace(/&#x([0-9a-f]+);?/gi, (_, h) => fromCodePointSafe2(parseInt(h, 16))).replace(/&#(\d+);?/g, (_, d) => fromCodePointSafe2(parseInt(d, 10))).replace(/&([a-z]+);/gi, (m, name) => NAMED_ENTITY[name.toLowerCase()] ?? m);
+  return [...decoded2].filter((c) => {
     const n = c.codePointAt(0) ?? 0;
     return n > 32 && n !== 127;
   }).join("").toLowerCase();
@@ -1850,6 +1850,287 @@ function formatSectionLockViolations(violations) {
     return `${label} \uAD6C\uC870 \uBCC0\uACBD(${violation.field})`;
   }).join(" / ");
 }
+
+// src/metadata-resolver.ts
+function text(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function imageUrl(value, base) {
+  const candidate = text(value);
+  if (!candidate || candidate.startsWith("//") || /[\\\u0000-\u0020\u007f]/u.test(candidate)) return void 0;
+  if (candidate.startsWith("/") && !base) return candidate;
+  try {
+    const url = new URL(candidate, base);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password) return void 0;
+    return url.href;
+  } catch {
+    return void 0;
+  }
+}
+function resolveMetadata(input) {
+  const layers = [input.overrides, input.defaults, input.siteDefaults, input.fallback];
+  const result = {};
+  for (const field of ["title", "description", "ogImageAlt"]) {
+    for (const layer of layers) {
+      const value = text(layer?.[field]);
+      if (value !== void 0) {
+        result[field] = value;
+        break;
+      }
+    }
+  }
+  for (const layer of layers) {
+    const value = imageUrl(layer?.ogImage, input.imageBaseUrl);
+    if (value !== void 0) {
+      result.ogImage = value;
+      break;
+    }
+  }
+  for (const field of ["noindex", "nofollow"]) {
+    for (const layer of layers) {
+      const value = layer?.[field];
+      if (typeof value === "boolean") {
+        result[field] = value;
+        break;
+      }
+    }
+  }
+  if (input.robots?.forceNoindex) result.noindex = true;
+  if (input.robots?.forceNofollow) result.nofollow = true;
+  return result;
+}
+
+// src/metadata-contract.ts
+import { z as z2 } from "zod";
+var METADATA_FIELDS = ["title", "description", "ogImage", "ogImageAlt", "noindex", "nofollow"];
+var MetadataFieldSchema = z2.enum(METADATA_FIELDS);
+var MetadataTargetKindSchema = z2.enum(["route", "post", "term"]);
+var textValue = (max) => z2.string().trim().min(1).max(max);
+var imageValue = textValue(2048).refine((value) => {
+  if (/[\\\u0000-\u0020\u007f]/u.test(value) || value.startsWith("//")) return false;
+  if (value.startsWith("/")) return true;
+  try {
+    const url = new URL(value);
+    return ["http:", "https:"].includes(url.protocol) && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}, "\uACF5\uC720 \uC774\uBBF8\uC9C0\uC5D0\uB294 \uC0AC\uC774\uD2B8 \uB0B4\uBD80 \uACBD\uB85C\uB098 HTTP/HTTPS \uC8FC\uC18C\uB97C \uC785\uB825\uD574 \uC8FC\uC138\uC694");
+var metadataFields = {
+  // Existing content titles (500) plus a site title template (400) remain valid automatic values.
+  title: textValue(1e3),
+  description: textValue(2e3),
+  ogImage: imageValue,
+  // Automatic alt text may use the complete automatic title and its site suffix.
+  ogImageAlt: textValue(1e3),
+  noindex: z2.boolean(),
+  nofollow: z2.boolean()
+};
+var MetadataValuesSchema = z2.object(metadataFields).partial().strict();
+var MetadataPatchSchema = z2.object({
+  title: textValue(300).nullable().optional(),
+  description: metadataFields.description.nullable().optional(),
+  ogImage: metadataFields.ogImage.nullable().optional(),
+  ogImageAlt: textValue(500).nullable().optional(),
+  noindex: metadataFields.noindex.nullable().optional(),
+  nofollow: metadataFields.nofollow.nullable().optional()
+}).strict();
+var MetadataRobotsPolicySchema = z2.object({
+  forceNoindex: z2.boolean().optional(),
+  forceNofollow: z2.boolean().optional()
+}).strict();
+function readMetadataValues(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return {};
+  const record = input;
+  const output = {};
+  for (const field of METADATA_FIELDS) {
+    const parsed = metadataFields[field].safeParse(record[field]);
+    if (parsed.success) output[field] = parsed.data;
+  }
+  return MetadataValuesSchema.parse(output);
+}
+function mergeMetadataPatch(current, input) {
+  const patch = MetadataPatchSchema.parse(input);
+  const next = { ...current };
+  for (const field of METADATA_FIELDS) {
+    if (patch[field] === null) delete next[field];
+    else if (patch[field] !== void 0) next[field] = patch[field];
+  }
+  return next;
+}
+
+// src/metadata-defaults.ts
+import { z as z3 } from "zod";
+var fallbackText = z3.string().max(2e3);
+var imageOrigin = z3.string().max(2048).refine((value) => {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.origin === value;
+  } catch {
+    return false;
+  }
+}, "\uC774\uBBF8\uC9C0 \uD5C8\uC6A9 \uBAA9\uB85D\uC5D0\uB294 \uACBD\uB85C \uC5C6\uB294 HTTPS origin\uB9CC \uC120\uC5B8\uD569\uB2C8\uB2E4");
+var MetadataTextRuleSchema = z3.object({
+  source: z3.enum(["content", "fallback"]).optional(),
+  stripLeadingLabel: z3.enum(["question", "answer"]).optional(),
+  replaceLineBreakTokens: z3.boolean().optional(),
+  removeEmDashes: z3.boolean().optional(),
+  normalizeWhitespace: z3.boolean().optional(),
+  maxLength: z3.number().int().min(1).max(2e3).optional(),
+  ellipsis: z3.string().max(10).optional(),
+  fallback: fallbackText.optional(),
+  fallbackWithParent: fallbackText.optional(),
+  fallbackWithoutParent: fallbackText.optional(),
+  fallbackBySlug: z3.record(z3.string().max(200), fallbackText).optional()
+}).strict().refine((rule) => !rule.ellipsis || rule.maxLength !== void 0 && rule.ellipsis.length < rule.maxLength, "\uB9D0\uC904\uC784\uD45C\uC5D0\uB294 \uB354 \uAE34 \uCD5C\uB300 \uAE38\uC774\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4");
+var MetadataDefaultRulesSchema = z3.object({
+  title: MetadataTextRuleSchema.optional(),
+  description: MetadataTextRuleSchema.optional(),
+  useFirstBodyImage: z3.boolean().optional(),
+  useTermImage: z3.boolean().optional(),
+  imageAltSource: z3.enum(["content", "title"]).optional(),
+  legacyImageSource: z3.literal("legacy-thumbnail").optional(),
+  imageAllowedOrigins: z3.array(imageOrigin).min(1).max(32).optional(),
+  legacyImageAllowedOrigins: z3.array(imageOrigin).min(1).max(32).optional(),
+  normalizeCloudflareImages: z3.boolean().optional(),
+  fallback: MetadataValuesSchema.optional()
+}).strict().refine((rule) => !rule.legacyImageSource || Boolean(rule.legacyImageAllowedOrigins?.length), "\uC774\uC804 \uC774\uBBF8\uC9C0 \uC6D0\uBCF8\uC5D0\uB294 \uD5C8\uC6A9 origin \uC120\uC5B8\uC774 \uD544\uC694\uD569\uB2C8\uB2E4");
+function cleanText(value, rule) {
+  let text2 = value.trim();
+  if (rule?.stripLeadingLabel === "question") text2 = text2.replace(/^\s*Q[.．:]?\s*/iu, "");
+  if (rule?.stripLeadingLabel === "answer") text2 = text2.replace(/^\s*A[.．:]?\s*/iu, "");
+  if (rule?.replaceLineBreakTokens) text2 = text2.replace(/\[\[br(?::[^\]]*)?\]\]/giu, " ");
+  if (rule?.removeEmDashes) text2 = text2.replaceAll("\u2014", "");
+  if (rule?.normalizeWhitespace) text2 = text2.replace(/\s+/gu, " ");
+  return text2.trim();
+}
+function formatText(value, rule, input, name) {
+  let text2 = rule?.source === "fallback" ? "" : cleanText(value ?? "", rule);
+  if (!text2) {
+    const fallback = input.parentId ? rule?.fallbackWithParent ?? rule?.fallback : (input.slug ? rule?.fallbackBySlug?.[input.slug] : void 0) ?? rule?.fallbackWithoutParent ?? rule?.fallback;
+    text2 = cleanText((fallback ?? "").replaceAll("%s", () => name), rule);
+  }
+  if (!text2) return void 0;
+  if (rule?.maxLength && text2.length > rule.maxLength) {
+    const suffix = rule.ellipsis ?? "";
+    const head = text2.slice(0, rule.maxLength - suffix.length);
+    return suffix ? head.trimEnd() + suffix : head;
+  }
+  return text2;
+}
+function metadataContentImageUrl(value, normalizeCloudflareImages = false) {
+  if (!normalizeCloudflareImages) return value;
+  try {
+    const url = new URL(value);
+    const [account, id, variant] = url.pathname.split("/").filter(Boolean);
+    if (url.protocol === "https:" && url.hostname === "imagedelivery.net" && account && id && variant) {
+      url.pathname = `/${account}/${id}/lg`;
+      return url.href;
+    }
+  } catch {
+  }
+  return value;
+}
+function legacyImageUrl(value, rule) {
+  if (!value || rule?.legacyImageSource !== "legacy-thumbnail") return void 0;
+  try {
+    const url = new URL(value);
+    if (!rule.legacyImageAllowedOrigins?.includes(url.origin)) return void 0;
+    return readMetadataValues({ ogImage: url.href }).ogImage;
+  } catch {
+    return void 0;
+  }
+}
+function contentCandidateAllowed(value, input, rule) {
+  if (!rule?.imageAllowedOrigins) return true;
+  if (value.startsWith("/") && !value.startsWith("//")) return true;
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "https:") return false;
+    const origins = [...rule.imageAllowedOrigins];
+    if (input.imageBaseUrl) origins.push(new URL(input.imageBaseUrl).origin);
+    return origins.includes(url.origin);
+  } catch {
+    return false;
+  }
+}
+function formatMetadataDefaults(input, declaration) {
+  const dynamic = declaration[input.kind];
+  const rule = dynamic?.defaultRules?.[input.modelKey];
+  const name = cleanText(input.title, rule?.title);
+  const title = formatText(input.title, rule?.title, input, name);
+  const template = dynamic?.titleTemplates?.[input.modelKey];
+  const description = formatText(input.description, rule?.description, input, name);
+  const bodyImage = input.firstBodyImage && (input.firstBodyImage.startsWith("https://") || /^\/(?!\/)/u.test(input.firstBodyImage)) ? input.firstBodyImage : void 0;
+  const candidateImage = input.kind === "terms" && rule?.useTermImage === false ? void 0 : input.featuredImage || (rule?.useFirstBodyImage ? bodyImage : void 0) || legacyImageUrl(input.legacyImage, rule);
+  const ogImage = candidateImage && contentCandidateAllowed(candidateImage, input, rule) ? readMetadataValues({ ogImage: metadataContentImageUrl(candidateImage, rule?.normalizeCloudflareImages) }).ogImage : void 0;
+  return {
+    ...title ? { title: template ? template.replace("%s", () => title) : title } : {},
+    ...description ? { description } : {},
+    ...ogImage ? { ogImage } : {}
+  };
+}
+
+// src/redirect-paths.ts
+var CONTROL_OR_BACKSLASH = /[\\\u0000-\u001f\u007f]/u;
+var PROTECTED_PREFIX = /^\/(?:api|_next|_vercel|auth|admin|login|logout|revalidate|preview|assets|static|images|fonts|\.well-known)(?:\/|$)/i;
+var STATIC_EXTENSION = /\.(?:ico|png|jpe?g|gif|svg|webp|avif|css|js|txt|xml|json|woff2?|map)$/i;
+function decoded(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+}
+function trimInternalPath(path) {
+  if (!path.startsWith("/")) path = `/${path}`;
+  if (path.length > 1) path = path.replace(/\/+$/, "");
+  return path || "/";
+}
+function normalizeRedirectPath(raw) {
+  return trimInternalPath((decoded(raw) ?? raw).split(/[?#]/, 1)[0] ?? "");
+}
+function isProtectedRedirectPath(path) {
+  const normalized = normalizeRedirectPath(path);
+  return PROTECTED_PREFIX.test(normalized) || STATIC_EXTENSION.test(normalized);
+}
+function unsafePath(path) {
+  return CONTROL_OR_BACKSLASH.test(path) || path.startsWith("//") || /(?:^|\/)\.{1,2}(?:\/|$)/.test(path) || /[%](?:2f|5c|0[0-9a-f]|1[0-9a-f]|7f)/i.test(path);
+}
+function normalizeRedirectSource(raw) {
+  const invalid = { ok: false, code: "invalid_source_path" };
+  if (CONTROL_OR_BACKSLASH.test(raw)) return invalid;
+  const trimmed = raw.trim();
+  if (!trimmed || /^[a-z][a-z\d+.-]*:/i.test(trimmed) || trimmed.startsWith("//")) return invalid;
+  const rawPath = trimmed.split(/[?#]/, 1)[0] ?? "";
+  const path = decoded(rawPath);
+  if (!path || unsafePath(path) || /[?#*]/.test(path)) return invalid;
+  const normalized = trimInternalPath(path);
+  if (isProtectedRedirectPath(normalized)) return invalid;
+  return { ok: true, value: normalized };
+}
+function normalizeRedirectTarget(raw) {
+  const invalid = { ok: false, code: "invalid_target" };
+  const decodedRaw = decoded(raw);
+  if (decodedRaw === null || CONTROL_OR_BACKSLASH.test(raw) || CONTROL_OR_BACKSLASH.test(decodedRaw)) return invalid;
+  const trimmed = raw.trim();
+  if (!trimmed || trimmed.startsWith("//")) return invalid;
+  if (trimmed.startsWith("/")) {
+    const suffixIndex = trimmed.search(/[?#]/);
+    const rawPath = suffixIndex === -1 ? trimmed : trimmed.slice(0, suffixIndex);
+    const path = decoded(rawPath);
+    if (!path || unsafePath(path) || /[?#]/.test(path)) return invalid;
+    const suffix = suffixIndex === -1 ? "" : trimmed.slice(suffixIndex);
+    return { ok: true, value: `${trimInternalPath(path)}${suffix}`, kind: "internal" };
+  }
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password) return invalid;
+    return { ok: true, value: url.toString(), kind: "external" };
+  } catch {
+    return invalid;
+  }
+}
 export {
   BLOCK_NAME_PATTERN,
   CMS_FONT_SIZES,
@@ -1866,6 +2147,14 @@ export {
   INTERNAL_CONTENT_LINK_PENDING_CLASS,
   INTERNAL_CONTENT_LINK_TOKEN_SOURCE,
   LEGACY_BLOG_DETAIL_PATH,
+  METADATA_FIELDS,
+  MetadataDefaultRulesSchema,
+  MetadataFieldSchema,
+  MetadataPatchSchema,
+  MetadataRobotsPolicySchema,
+  MetadataTargetKindSchema,
+  MetadataTextRuleSchema,
+  MetadataValuesSchema,
   PHASE_1_CORE_BLOCKS,
   PHASE_1_CSP,
   POST_FOOTER_SLOT,
@@ -1894,6 +2183,7 @@ export {
   findInternalContentLinkTokens,
   findSectionLockViolations,
   findSitePatternPlacementRule,
+  formatMetadataDefaults,
   formatSectionLockViolations,
   htmlToPlainText,
   injectStableIdsTree,
@@ -1903,18 +2193,25 @@ export {
   isAllowedEmbedSrc,
   isAllowedMapEmbedSrc,
   isInCollectionMode,
+  isProtectedRedirectPath,
   isSectionContentPropPath,
   isSitePatternSlotKey,
   isValidBlock,
   isValidSitePatternKey,
   issuePreviewToken,
+  mergeMetadataPatch,
+  metadataContentImageUrl,
   normalizeEmbed,
   normalizeHexColor,
   normalizeImageAlt,
+  normalizeRedirectPath,
+  normalizeRedirectSource,
+  normalizeRedirectTarget,
   parseBlock,
   postsForCollection,
   postsInAnyCollection,
   postsNotInAnyCollection,
+  readMetadataValues,
   readSitePatternPlacements,
   readSitePatternPresentation,
   referencedSitePatternKeys,
@@ -1925,6 +2222,7 @@ export {
   resolveCategoryTreeEntryPath,
   resolveCategoryTreeHubPaths,
   resolveCategoryTreeSelection,
+  resolveMetadata,
   resolvePatternSlots,
   resolvePostCategorySlug,
   resolvePostCollection,