@roottale/cms-core 0.68.0 → 0.70.0

package/dist/index.js

@@ -225,6 +225,9 @@ function validateCollections(collections) {
 }
 
 // src/category-tree.ts
+function isReservedCategoryTreeSlug(presentation, slug) {
+  return slug === presentation.categoryFallbackSlug || presentation.reservedCategorySlugs?.includes(slug) === true;
+}
 function basePathPrefix(basePath) {
   if (!basePath.trim()) return null;
   return basePath.replace(/\/+$/, "");
@@ -253,6 +256,7 @@ function hasChildCategory(termId, terms) {
 function resolveCategoryTreeChain(presentation, termId, terms) {
   const chain = categoryTreeAncestry(presentation.categoryDepth, termId, terms);
   if (!chain) return null;
+  if (chain.some((term) => isReservedCategoryTreeSlug(presentation, term.slug))) return null;
   if (presentation.entryCategory === "leaf") return chain;
   if (hasChildCategory(termId, terms)) return null;
   return chain.length === presentation.categoryDepth ? chain : null;
@@ -261,6 +265,33 @@ function resolveCategoryTreeSelection(presentation, termId, terms) {
   if (hasChildCategory(termId, terms)) return null;
   return resolveCategoryTreeChain(presentation, termId, terms);
 }
+function resolveCategoryTreeEntryCategory(presentation, entry, terms) {
+  const termsById = new Map(terms.map((term) => [term.id, term]));
+  const first = presentation.categorySelection === "first";
+  const categoryIds = [...new Set(entry.terms.filter((term) => term.taxonomy === "category" && (first || termsById.has(term.id))).map((term) => term.id))];
+  if (first) {
+    if (termsById.size !== terms.length) return null;
+    if (categoryIds.length === 0) {
+      const slug = presentation.categoryFallbackSlug;
+      if (presentation.categoryDepth !== 1 || !slug || presentation.reservedCategorySlugs?.includes(slug) || terms.some((term) => term.slug === slug)) return null;
+      return { kind: "fallback", slug };
+    }
+    const candidates = [];
+    for (const id of categoryIds) {
+      const category2 = termsById.get(id);
+      if (!category2 || !Number.isInteger(category2.termOrder ?? 0)) return null;
+      const chain2 = resolveCategoryTreeChain(presentation, id, terms);
+      if (!chain2) return null;
+      candidates.push({ category: category2, chain: chain2 });
+    }
+    candidates.sort((a, b) => (a.category.termOrder ?? 0) - (b.category.termOrder ?? 0) || (a.category.id < b.category.id ? -1 : a.category.id > b.category.id ? 1 : 0));
+    return { kind: "category", ...candidates[0] };
+  }
+  if (categoryIds.length !== 1) return null;
+  const category = termsById.get(categoryIds[0]);
+  const chain = resolveCategoryTreeChain(presentation, category.id, terms);
+  return chain ? { kind: "category", category, chain } : null;
+}
 function resolveCategoryTreeHubPaths(presentation, termId, terms) {
   const chain = resolveCategoryTreeChain(presentation, termId, terms);
   const prefix = basePathPrefix(presentation.basePath);
@@ -275,20 +306,11 @@ function resolveCategoryTreeHubPaths(presentation, termId, terms) {
 }
 function resolveCategoryTreeEntryPath(presentation, entry, terms) {
   if (!entry.slug) return null;
-  const knownIds = new Set(terms.map((term) => term.id));
-  const categoryIds = [
-    ...new Set(
-      entry.terms.filter((term) => term.taxonomy === "category" && knownIds.has(term.id)).map((term) => term.id)
-    )
-  ];
-  if (categoryIds.length !== 1) return null;
-  const hubs = resolveCategoryTreeHubPaths(
-    presentation,
-    categoryIds[0],
-    terms
-  );
-  const leafPath = hubs?.at(-1);
-  return leafPath ? `${leafPath}/${encodeURIComponent(entry.slug)}` : null;
+  const selected = resolveCategoryTreeEntryCategory(presentation, entry, terms);
+  const prefix = basePathPrefix(presentation.basePath);
+  if (!selected || prefix === null) return null;
+  const slugs = selected.kind === "fallback" ? [selected.slug] : selected.chain.map((term) => term.slug);
+  return `${prefix}/${[...slugs, entry.slug].map(encodeURIComponent).join("/")}`;
 }
 
 // src/public-path.ts
@@ -973,10 +995,10 @@ function scopeImportedCss(css, scope, allowedAssetUrls = []) {
 
 // src/internal-content-links.ts
 var INTERNAL_CONTENT_LINK_TOKEN_SOURCE = String.raw`\[\[internal:([a-z0-9가-힣]+(?:[.-][a-z0-9가-힣]+)*)\|([^\]\n|]+)\]\]`;
-function findInternalContentLinkTokens(text2) {
+function findInternalContentLinkTokens(text3) {
   const pattern = new RegExp(INTERNAL_CONTENT_LINK_TOKEN_SOURCE, "giu");
   const tokens = [];
-  for (const match of text2.matchAll(pattern)) {
+  for (const match of text3.matchAll(pattern)) {
     const [raw, key, label] = match;
     if (!key || !label || match.index === void 0) continue;
     tokens.push({
@@ -1035,19 +1057,19 @@ function escapeHtmlText(value) {
 var INTERNAL_CONTENT_LINK_CLASS = "rt-internal-link";
 var INTERNAL_CONTENT_LINK_PENDING_CLASS = "rt-internal-link--pending";
 var INTERNAL_CONTENT_LINK_PENDING_ATTR = "data-rt-internal-link-pending";
-function renderInternalContentLinksInText(text2, resolve) {
-  const tokens = findInternalContentLinkTokens(text2);
-  if (tokens.length === 0) return { html: text2, hasTokens: false };
+function renderInternalContentLinksInText(text3, resolve) {
+  const tokens = findInternalContentLinkTokens(text3);
+  if (tokens.length === 0) return { html: text3, hasTokens: false };
   let cursor = 0;
   let html = "";
   for (const token of tokens) {
-    html += text2.slice(cursor, token.index);
+    html += text3.slice(cursor, token.index);
     const path = resolve(token.key);
     const label = escapeHtmlText(token.label);
     html += isSafeInternalPath(path) ? `<a href="${escapeHtmlText(path)}" class="${INTERNAL_CONTENT_LINK_CLASS}">${label}</a>` : `<span class="${INTERNAL_CONTENT_LINK_CLASS} ${INTERNAL_CONTENT_LINK_PENDING_CLASS}" ${INTERNAL_CONTENT_LINK_PENDING_ATTR}="${escapeHtmlText(token.key)}">${label}</span>`;
     cursor = token.index + token.raw.length;
   }
-  html += text2.slice(cursor);
+  html += text3.slice(cursor);
   return { html, hasTokens: true };
 }
 var INTERNAL_LINK_BLOCKED_HTML_TAGS = /* @__PURE__ */ new Set([
@@ -1081,12 +1103,12 @@ function renderInternalContentLinksInHtml(html, resolve) {
   let cursor = 0;
   let out = "";
   let hasTokens = false;
-  const emitText = (text2) => {
-    if (blockedDepth > 0 || !text2) {
-      out += text2;
+  const emitText = (text3) => {
+    if (blockedDepth > 0 || !text3) {
+      out += text3;
       return;
     }
-    const rendered = renderInternalContentLinksInText(text2, resolve);
+    const rendered = renderInternalContentLinksInText(text3, resolve);
     hasTokens ||= rendered.hasTokens;
     out += rendered.html;
   };
@@ -1806,13 +1828,13 @@ function findSectionLockViolations(beforeDoc, afterDoc) {
       ...Object.keys(next.attrs)
     ]);
     fields.delete("props");
-    for (const field of fields) {
-      if (!valueEquals(section.attrs[field], next.attrs[field])) {
+    for (const field3 of fields) {
+      if (!valueEquals(section.attrs[field3], next.attrs[field3])) {
         violations.push({
-          code: field === "lock" ? "locked_section_lock_changed" : "locked_section_structure_changed",
+          code: field3 === "lock" ? "locked_section_lock_changed" : "locked_section_structure_changed",
           sectionId: section.id,
           sectionType: section.sectionType,
-          field
+          field: field3
         });
       }
     }
@@ -1870,11 +1892,11 @@ function imageUrl(value, base) {
 function resolveMetadata(input) {
   const layers = [input.overrides, input.defaults, input.siteDefaults, input.fallback];
   const result = {};
-  for (const field of ["title", "description", "ogImageAlt"]) {
+  for (const field3 of ["title", "description", "ogImageAlt"]) {
     for (const layer of layers) {
-      const value = text(layer?.[field]);
+      const value = text(layer?.[field3]);
       if (value !== void 0) {
-        result[field] = value;
+        result[field3] = value;
         break;
       }
     }
@@ -1886,11 +1908,11 @@ function resolveMetadata(input) {
       break;
     }
   }
-  for (const field of ["noindex", "nofollow"]) {
+  for (const field3 of ["noindex", "nofollow"]) {
     for (const layer of layers) {
-      const value = layer?.[field];
+      const value = layer?.[field3];
       if (typeof value === "boolean") {
-        result[field] = value;
+        result[field3] = value;
         break;
       }
     }
@@ -1937,30 +1959,32 @@ var MetadataPatchSchema = z2.object({
 }).strict();
 var MetadataRobotsPolicySchema = z2.object({
   forceNoindex: z2.boolean().optional(),
-  forceNofollow: z2.boolean().optional()
+  forceNofollow: z2.boolean().optional(),
+  /** Stable policy reason codes. They explain an enforced exclusion, never relax it. */
+  noindexReasons: z2.array(z2.string().trim().min(1).max(200)).max(64).optional()
 }).strict();
 function readMetadataValues(input) {
   if (!input || typeof input !== "object" || Array.isArray(input)) return {};
-  const record = input;
+  const record2 = input;
   const output = {};
-  for (const field of METADATA_FIELDS) {
-    const parsed = metadataFields[field].safeParse(record[field]);
-    if (parsed.success) output[field] = parsed.data;
+  for (const field3 of METADATA_FIELDS) {
+    const parsed = metadataFields[field3].safeParse(record2[field3]);
+    if (parsed.success) output[field3] = parsed.data;
   }
   return MetadataValuesSchema.parse(output);
 }
 function mergeMetadataPatch(current, input) {
   const patch = MetadataPatchSchema.parse(input);
   const next = { ...current };
-  for (const field of METADATA_FIELDS) {
-    if (patch[field] === null) delete next[field];
-    else if (patch[field] !== void 0) next[field] = patch[field];
+  for (const field3 of METADATA_FIELDS) {
+    if (patch[field3] === null) delete next[field3];
+    else if (patch[field3] !== void 0) next[field3] = patch[field3];
   }
   return next;
 }
 
 // src/metadata-defaults.ts
-import { z as z4 } from "zod";
+import { z as z6 } from "zod";
 
 // src/metadata-text.ts
 import { z as z3 } from "zod";
@@ -1991,13 +2015,13 @@ var MetadataTextRuleSchema = z3.object({
   fallbackBySlug: z3.record(z3.string().max(200), fallbackText).optional()
 }).strict().refine((rule) => !rule.ellipsis || rule.maxLength !== void 0 && rule.ellipsis.length < rule.maxLength, "\uB9D0\uC904\uC784\uD45C\uC5D0\uB294 \uB354 \uAE34 \uCD5C\uB300 \uAE38\uC774\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4").refine((rule) => rule.source === "template" ? rule.template !== void 0 : rule.template === void 0, "\uD14D\uC2A4\uD2B8 template\uC740 source: template\uACFC \uD568\uAED8 \uC120\uC5B8\uD569\uB2C8\uB2E4").refine((rule) => !rule.wordBoundaryMinLength || Boolean(rule.maxLength && rule.wordBoundaryMinLength < rule.maxLength), "\uB2E8\uC5B4 \uACBD\uACC4\uC5D0\uB294 \uB354 \uAE34 \uCD5C\uB300 \uAE38\uC774\uAC00 \uD544\uC694\uD569\uB2C8\uB2E4");
 function cleanMetadataText(value, rule) {
-  let text2 = value.trim();
-  if (rule?.stripLeadingLabel === "question") text2 = text2.replace(/^\s*Q[.．:]?\s*/iu, "");
-  if (rule?.stripLeadingLabel === "answer") text2 = text2.replace(/^\s*A[.．:]?\s*/iu, "");
-  if (rule?.replaceLineBreakTokens) text2 = text2.replace(/\[\[br(?::[^\]]*)?\]\]/giu, " ");
-  if (rule?.removeEmDashes) text2 = text2.replaceAll("\u2014", "");
-  if (rule?.normalizeWhitespace) text2 = text2.replace(/\s+/gu, " ");
-  return text2.trim();
+  let text3 = value.trim();
+  if (rule?.stripLeadingLabel === "question") text3 = text3.replace(/^\s*Q[.．:]?\s*/iu, "");
+  if (rule?.stripLeadingLabel === "answer") text3 = text3.replace(/^\s*A[.．:]?\s*/iu, "");
+  if (rule?.replaceLineBreakTokens) text3 = text3.replace(/\[\[br(?::[^\]]*)?\]\]/giu, " ");
+  if (rule?.removeEmDashes) text3 = text3.replaceAll("\u2014", "");
+  if (rule?.normalizeWhitespace) text3 = text3.replace(/\s+/gu, " ");
+  return text3.trim();
 }
 function metadataBodyParagraphs(value) {
   const paragraphs = [];
@@ -2015,37 +2039,37 @@ function metadataBodyParagraphs(value) {
     if (!node || typeof node !== "object") return;
     const item = node;
     if (item.type === "paragraph") {
-      const text2 = textParts(item.content).join(" ").replace(/\s+/gu, " ").trim();
-      if (text2) paragraphs.push(text2);
+      const text3 = textParts(item.content).join(" ").replace(/\s+/gu, " ").trim();
+      if (text3) paragraphs.push(text3);
     } else walk(item.content);
   };
   walk(value);
   return paragraphs;
 }
 function formatMetadataText(value, rule, input, name) {
-  let text2 = rule?.source === "fallback" ? "" : cleanMetadataText(value ?? "", rule);
+  let text3 = rule?.source === "fallback" ? "" : cleanMetadataText(value ?? "", rule);
   if (rule?.source === "template") {
-    text2 = cleanMetadataText((rule.template ?? "").replace(templateToken, (token) => {
+    text3 = cleanMetadataText((rule.template ?? "").replace(templateToken, (token) => {
       if (token === "{{title}}") return name;
-      const field = token.slice(8, -2);
-      const value2 = Object.hasOwn(input.fields ?? {}, field) ? input.fields?.[field] : void 0;
+      const field3 = token.slice(8, -2);
+      const value2 = Object.hasOwn(input.fields ?? {}, field3) ? input.fields?.[field3] : void 0;
       return typeof value2 === "string" ? value2.trim() : "";
     }), rule);
   }
-  if (!text2 && rule?.bodyFallback) {
+  if (!text3 && rule?.bodyFallback) {
     const paragraphs = input.bodyParagraphs ?? [];
     const preferred = rule.bodyFallback.preferContaining;
-    text2 = (preferred ? paragraphs.find((paragraph) => paragraph.includes(preferred)) : void 0) ?? paragraphs[0] ?? "";
-    if (rule.bodyFallback.stripLeadingLabel === "conclusion") text2 = text2.replace(/^(먼저\s*)?결론부터\s*(말씀드리면|말씀드릴게요)[.!?]?\s*/u, "");
-    text2 = cleanMetadataText(text2, rule);
+    text3 = (preferred ? paragraphs.find((paragraph) => paragraph.includes(preferred)) : void 0) ?? paragraphs[0] ?? "";
+    if (rule.bodyFallback.stripLeadingLabel === "conclusion") text3 = text3.replace(/^(먼저\s*)?결론부터\s*(말씀드리면|말씀드릴게요)[.!?]?\s*/u, "");
+    text3 = cleanMetadataText(text3, rule);
   }
-  if (!text2) {
+  if (!text3) {
     const slugFallback = input.slug && Object.hasOwn(rule?.fallbackBySlug ?? {}, input.slug) ? rule?.fallbackBySlug?.[input.slug] : void 0;
     const fallback = input.parentId ? rule?.fallbackWithParent ?? rule?.fallback : slugFallback ?? rule?.fallbackWithoutParent ?? rule?.fallback;
-    text2 = cleanMetadataText((fallback ?? "").replaceAll("%s", () => name), rule);
+    text3 = cleanMetadataText((fallback ?? "").replaceAll("%s", () => name), rule);
   }
-  if (!text2) return void 0;
-  const units = rule?.lengthUnit === "code-points" ? [...text2] : text2.split("");
+  if (!text3) return void 0;
+  const units = rule?.lengthUnit === "code-points" ? [...text3] : text3.split("");
   if (rule?.maxLength && units.length > rule.maxLength) {
     const suffix = rule.ellipsis ?? "";
     const suffixLength = rule.lengthUnit === "code-points" ? [...suffix].length : suffix.length;
@@ -2054,11 +2078,294 @@ function formatMetadataText(value, rule, input, name) {
     if (rule.wordBoundaryMinLength && boundary >= rule.wordBoundaryMinLength) head = head.slice(0, boundary);
     return suffix ? head.trimEnd() + suffix : head;
   }
-  return text2;
+  return text3;
+}
+
+// src/content-policy-schema.ts
+import { z as z4 } from "zod";
+var ContentPolicyFieldNameSchema = z4.string().min(1).max(64).regex(/^[A-Za-z_][A-Za-z0-9_]*$/).refine((name) => name !== "prototype" && !Object.hasOwn(Object.prototype, name));
+var ContentPolicyScalarSchema = z4.union([
+  z4.string().max(2048),
+  z4.number().finite(),
+  z4.boolean(),
+  z4.null()
+]);
+var contentPolicyEquality = z4.object({
+  field: ContentPolicyFieldNameSchema,
+  equals: ContentPolicyScalarSchema
+}).strict();
+var ContentPolicyWhenSchema = z4.union([
+  contentPolicyEquality,
+  z4.object({
+    all: z4.array(contentPolicyEquality).min(1).max(4).optional(),
+    unlessAll: z4.array(contentPolicyEquality).min(1).max(4).optional()
+  }).strict().refine(
+    (when2) => when2.all !== void 0 || when2.unlessAll !== void 0,
+    "\uCF58\uD150\uCE20 \uC870\uAC74\uC5D0\uB294 all \uB610\uB294 unlessAll \uADF8\uB8F9\uC774 \uD544\uC694\uD569\uB2C8\uB2E4"
+  )
+]);
+var ContentPolicyInternalPathSchema = z4.string().min(1).max(2048).refine((path) => {
+  if (!path.startsWith("/") || path.startsWith("//") || /[\\?#\u0000-\u0020\u007f]/u.test(path)) return false;
+  try {
+    return path.split("/").every((part, index) => {
+      if (index === 0) return true;
+      const decoded2 = decodeURIComponent(part);
+      return decoded2 !== "." && decoded2 !== ".." && !/[\\/\u0000-\u0020\u007f]/u.test(decoded2);
+    });
+  } catch {
+    return false;
+  }
+}, "\uCF58\uD150\uCE20 \uACBD\uB85C\uB294 \uC548\uC804\uD55C \uC0AC\uC774\uD2B8 \uB0B4\uBD80 \uACBD\uB85C\uC5EC\uC57C \uD569\uB2C8\uB2E4");
+var field = { field: ContentPolicyFieldNameSchema };
+var scalarChecks = [
+  z4.object({ ...field, op: z4.literal("equals"), value: ContentPolicyScalarSchema }).strict(),
+  z4.object({ ...field, op: z4.literal("notEquals"), value: ContentPolicyScalarSchema }).strict(),
+  z4.object({ ...field, op: z4.literal("oneOf"), values: z4.array(ContentPolicyScalarSchema).min(1).max(16), allowEmpty: z4.boolean().optional() }).strict(),
+  z4.object({ ...field, op: z4.literal("text") }).strict(),
+  z4.object({ ...field, op: z4.literal("date") }).strict(),
+  z4.object({ ...field, op: z4.literal("safeHttps") }).strict(),
+  z4.object({ ...field, op: z4.literal("allowedPath"), paths: z4.array(ContentPolicyInternalPathSchema).min(1).max(512) }).strict()
+];
+var ContentPolicyScalarCheckSchema = z4.discriminatedUnion("op", scalarChecks);
+var when = { when: ContentPolicyWhenSchema.optional() };
+var ContentPolicyCheckSchema = z4.discriminatedUnion("op", [
+  scalarChecks[0].extend(when),
+  scalarChecks[1].extend(when),
+  scalarChecks[2].extend(when),
+  scalarChecks[3].extend(when),
+  scalarChecks[4].extend(when),
+  scalarChecks[5].extend(when),
+  scalarChecks[6].extend(when),
+  z4.object({ ...field, ...when, op: z4.literal("some"), checks: z4.array(ContentPolicyScalarCheckSchema).min(1).max(8) }).strict(),
+  z4.object({
+    ...when,
+    op: z4.literal("bodyContent"),
+    allowExcerpt: z4.boolean().optional(),
+    allowFeaturedImage: z4.boolean().optional(),
+    additionalUrl: z4.object({ ...field, ...when }).strict().optional()
+  }).strict(),
+  z4.object({ ...when, op: z4.literal("bodyText") }).strict()
+]);
+var contentPolicy = z4.object({
+  visibility: z4.array(ContentPolicyCheckSchema).max(24),
+  indexing: z4.array(ContentPolicyCheckSchema).max(24),
+  pathSegmentFormat: z4.literal("lower-kebab").optional()
+}).strict();
+var ContentPolicySchema = contentPolicy.superRefine((policy, ctx) => {
+  const refs = collectContentPolicyFieldRefs(policy);
+  if (refs.length > 64) ctx.addIssue({ code: z4.ZodIssueCode.custom, message: "\uCF58\uD150\uCE20 \uC815\uCC45\uC740 \uACF5\uAC1C \uD544\uB4DC 64\uAC1C\uAE4C\uC9C0 \uCC38\uC870\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4" });
+  for (const ref of refs) {
+    if ((ref.children?.length ?? 0) > 8) ctx.addIssue({ code: z4.ZodIssueCode.custom, message: `\uBC18\uBCF5 \uD544\uB4DC ${ref.name}\uC758 \uC790\uC2DD \uCC38\uC870\uB294 8\uAC1C\uAE4C\uC9C0 \uD5C8\uC6A9\uD569\uB2C8\uB2E4` });
+  }
+});
+function collectContentPolicyFieldRefs(policy) {
+  const refs = /* @__PURE__ */ new Map();
+  const add = (name, children = []) => {
+    const names = refs.get(name) ?? /* @__PURE__ */ new Set();
+    for (const child of children) names.add(child);
+    refs.set(name, names);
+  };
+  const addWhen = (when2) => {
+    if (!when2) return;
+    if ("field" in when2) add(when2.field);
+    else for (const condition of [...when2.all ?? [], ...when2.unlessAll ?? []]) add(condition.field);
+  };
+  for (const check of [...policy.visibility, ...policy.indexing]) {
+    addWhen(check.when);
+    if ("field" in check) add(check.field, check.op === "some" ? check.checks.map((child) => child.field) : []);
+    if (check.op === "bodyContent" && check.additionalUrl) {
+      add(check.additionalUrl.field);
+      addWhen(check.additionalUrl.when);
+    }
+  }
+  return [...refs].map(([name, children]) => ({ name, ...children.size ? { children: [...children] } : {} }));
+}
+
+// src/content-policy-condition.ts
+function matchesContentPolicyWhen(when2, fields) {
+  if (!when2) return true;
+  const matches = ({ field: field3, equals }) => {
+    const value = Object.hasOwn(fields, field3) ? fields[field3] : void 0;
+    return value === equals;
+  };
+  if ("field" in when2) return matches(when2);
+  return (when2.all?.every(matches) ?? true) && !(when2.unlessAll?.every(matches) ?? false);
+}
+
+// src/post-body-source.ts
+function resolvePostBodySource(bodyHtml) {
+  if (typeof bodyHtml !== "string") return { kind: "json" };
+  const trimmed = bodyHtml.trim();
+  if (trimmed.length === 0) return { kind: "json" };
+  const sanitized = sanitizeHtml(trimmed);
+  const visible = /<(?:img|hr|br|iframe|video|audio)\b/i.test(sanitized) || sanitized.replace(/<[^>]*>/g, "").replace(/&nbsp;/gi, " ").trim().length > 0;
+  return visible ? { kind: "html", html: sanitized } : { kind: "json" };
+}
+
+// src/content-policy.ts
+var text2 = (value) => typeof value === "string" ? value.trim() : "";
+var record = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+function fieldValue(fields, field3) {
+  return Object.hasOwn(fields, field3) ? fields[field3] : void 0;
+}
+function contentPolicySafeHttpsUrl(value) {
+  if (typeof value !== "string" || /[\\\u0000-\u0020\u007f]/u.test(value)) return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password ? url.href : null;
+  } catch {
+    return null;
+  }
+}
+function dateValue(value) {
+  if (!value || typeof value !== "string" && typeof value !== "number") return null;
+  if (!Number.isFinite(Date.parse(String(value)))) return null;
+  const date = new Date(value).getTime();
+  return Number.isFinite(date) ? date : null;
+}
+function contentPolicyBodyText(bodyJson) {
+  const root = record(bodyJson);
+  if (root?.type !== "doc" || !Array.isArray(root.content)) return "";
+  const pending = [{ node: root, depth: 0 }];
+  const output = [];
+  let count = 0;
+  while (pending.length) {
+    const entry = pending.pop();
+    if (++count > 1e5 || entry.depth > 128) throw new Error("Content policy body exceeds traversal limits");
+    const node = record(entry.node);
+    if (!node) continue;
+    if (node.type === "text") {
+      const value = text2(node.text);
+      if (value) output.push(value);
+    } else if (Array.isArray(node.content)) {
+      for (let index = node.content.length - 1; index >= 0; index--) {
+        pending.push({ node: node.content[index], depth: entry.depth + 1 });
+      }
+    }
+  }
+  return output.join(" ");
+}
+function matchesContentScalarCheck(check, fields) {
+  const value = fieldValue(fields, check.field);
+  switch (check.op) {
+    case "equals":
+      return value === check.value;
+    case "notEquals":
+      return value !== check.value;
+    case "oneOf":
+      return check.allowEmpty === true && !value || check.values.some((candidate) => candidate === value);
+    case "text":
+      return text2(value).length > 0;
+    case "date":
+      return dateValue(value) !== null;
+    case "safeHttps":
+      return contentPolicySafeHttpsUrl(value) !== null;
+    case "allowedPath":
+      return check.paths.includes(text2(value));
+  }
+}
+function bodyFacts(post) {
+  const jsonText = contentPolicyBodyText(post.bodyJson);
+  const source = resolvePostBodySource(post.bodyHtml);
+  const html = source.kind === "html" ? source.html : "";
+  return { jsonText, html, text: source.kind === "html" ? html.replace(/<[^>]*>/g, "").replace(/&nbsp;/gi, " ").trim() : jsonText };
+}
+function matchesCheck(check, post, fields, getBody) {
+  if (!matchesContentPolicyWhen(check.when, fields)) return true;
+  if (check.op === "some") {
+    const value = fieldValue(fields, check.field);
+    return Array.isArray(value) && value.some((item) => {
+      const child = record(item);
+      return child !== null && check.checks.every((scalar) => matchesContentScalarCheck(scalar, child));
+    });
+  }
+  if (check.op === "bodyText") return Boolean(getBody().text);
+  if (check.op === "bodyContent") {
+    const body = getBody();
+    return Boolean(body.jsonText || body.html || check.allowExcerpt && text2(post.excerpt) || check.allowFeaturedImage && contentPolicySafeHttpsUrl(post.featuredImageUrl) || check.additionalUrl && matchesContentPolicyWhen(check.additionalUrl.when, fields) && contentPolicySafeHttpsUrl(fieldValue(fields, check.additionalUrl.field)));
+  }
+  return matchesContentScalarCheck(check, fields);
+}
+function validPath(policy, post, options) {
+  const path = text2(post.path).replace(/\/+$/, "");
+  if (!path || !ContentPolicyInternalPathSchema.safeParse(path).success) return false;
+  const segments = path.slice(1).split("/");
+  if (segments.some((segment) => !segment)) return false;
+  if (policy.pathSegmentFormat === "lower-kebab" && segments.some((segment) => !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(segment))) return false;
+  if (decodeURIComponent(segments.at(-1)) !== post.slug) return false;
+  if (options.expectedPath !== void 0) {
+    return options.expectedPath !== null && path === options.expectedPath.replace(/\/+$/, "");
+  }
+  return true;
+}
+function evaluateContentPolicy(policy, post, options = {}) {
+  const visibility = [];
+  if (post.status !== "published") visibility.push("content:not-published");
+  if (!text2(post.id) || !text2(post.title) || !text2(post.slug)) visibility.push("content:invalid-identity");
+  const publishedAt = dateValue(post.publishedAt);
+  if (publishedAt === null) visibility.push("content:invalid-published-at");
+  else if (publishedAt > (options.now ?? Date.now())) visibility.push("content:future-publication");
+  if (!validPath(policy, post, options)) visibility.push("content:invalid-path");
+  const fields = post.fields ?? {};
+  let body;
+  const getBody = () => body ??= bodyFacts(post);
+  const failures = (checks, stage) => checks.flatMap((check) => matchesCheck(check, post, fields, getBody) ? [] : [`content:${stage}:${check.op}${"field" in check ? `:${check.field}` : ""}`]);
+  if (visibility.length === 0) visibility.push(...failures(policy.visibility, "visibility"));
+  const visible = visibility.length === 0;
+  const indexing = visible ? failures(policy.indexing, "indexing") : [];
+  const forced = !visible || indexing.length > 0 || options.robots?.forceNoindex === true;
+  const inheritedReasons = options.robots?.forceNoindex ? options.robots.noindexReasons?.length ? options.robots.noindexReasons : ["content:forced-noindex"] : [];
+  const noindexReasons = [.../* @__PURE__ */ new Set([...visibility, ...indexing, ...inheritedReasons])].slice(0, 64);
+  const manualNoindex = readMetadataValues(post.metaJson?.seo).noindex === true;
+  return {
+    visible,
+    indexable: visible && !forced && !manualNoindex,
+    robots: {
+      ...options.robots,
+      ...forced ? { forceNoindex: true } : {},
+      ...noindexReasons.length ? { noindexReasons } : {}
+    },
+    reasons: [...noindexReasons, ...manualNoindex ? ["content:manual-noindex"] : []]
+  };
+}
+
+// src/metadata-video-thumbnail.ts
+import { z as z5 } from "zod";
+var MetadataVideoThumbnailRuleSchema = z5.object({
+  source: z5.literal("youtube"),
+  field: ContentPolicyFieldNameSchema,
+  when: ContentPolicyWhenSchema.optional()
+}).strict();
+function metadataVideoThumbnail(rule, fields) {
+  if (!rule || !matchesContentPolicyWhen(rule.when, fields ?? {})) return void 0;
+  const value = fields && Object.hasOwn(fields, rule.field) ? fields[rule.field] : void 0;
+  const safe = contentPolicySafeHttpsUrl(value);
+  if (!safe) return void 0;
+  const url = new URL(safe);
+  const id = url.hostname === "youtu.be" ? url.pathname.slice(1) : ["www.youtube.com", "youtube.com", "m.youtube.com"].includes(url.hostname) ? url.pathname === "/watch" ? url.searchParams.get("v") : url.pathname.match(/^\/(?:shorts|embed)\/([^/]+)$/)?.[1] : null;
+  return /^[a-zA-Z0-9_-]{11}$/.test(id ?? "") ? `https://i.ytimg.com/vi/${id}/hqdefault.jpg` : void 0;
+}
+
+// src/metadata-default-fields.ts
+function collectMetadataDefaultFieldRefs(rule) {
+  const fields = /* @__PURE__ */ new Set();
+  const video = rule?.videoThumbnail;
+  if (video) {
+    fields.add(video.field);
+    if (video.when) {
+      if ("field" in video.when) fields.add(video.when.field);
+      else for (const condition of [...video.when.all ?? [], ...video.when.unlessAll ?? []]) fields.add(condition.field);
+    }
+  }
+  for (const text3 of [rule?.title, rule?.description]) {
+    if (text3?.source !== "template") continue;
+    for (const match of (text3.template ?? "").matchAll(/\{\{field:([a-zA-Z][a-zA-Z0-9_-]{0,159})\}\}/gu)) fields.add(match[1]);
+  }
+  return [...fields].map((name) => ({ name }));
 }
 
 // src/metadata-defaults.ts
-var imageOrigin = z4.string().max(2048).refine((value) => {
+var imageOrigin = z6.string().max(2048).refine((value) => {
   try {
     const url = new URL(value);
     return url.protocol === "https:" && url.origin === value;
@@ -2066,23 +2373,34 @@ var imageOrigin = z4.string().max(2048).refine((value) => {
     return false;
   }
 }, "\uC774\uBBF8\uC9C0 \uD5C8\uC6A9 \uBAA9\uB85D\uC5D0\uB294 \uACBD\uB85C \uC5C6\uB294 HTTPS origin\uB9CC \uC120\uC5B8\uD569\uB2C8\uB2E4");
-var MetadataDefaultRulesSchema = z4.object({
+var MetadataDefaultRulesSchema = z6.object({
   title: MetadataTextRuleSchema.optional(),
-  titleTemplateMaxLength: z4.number().int().min(1).max(1e3).optional(),
+  titleTemplateMaxLength: z6.number().int().min(1).max(1e3).optional(),
   description: MetadataTextRuleSchema.optional(),
   /** Code-owned defaults precede site defaults but always follow manual overrides. */
   defaults: MetadataValuesSchema.optional(),
   robots: MetadataRobotsPolicySchema.optional(),
-  useFeaturedImage: z4.boolean().optional(),
-  useFirstBodyImage: z4.boolean().optional(),
-  useTermImage: z4.boolean().optional(),
-  imageAltSource: z4.enum(["content", "title"]).optional(),
-  legacyImageSource: z4.literal("legacy-thumbnail").optional(),
-  imageAllowedOrigins: z4.array(imageOrigin).min(1).max(32).optional(),
-  legacyImageAllowedOrigins: z4.array(imageOrigin).min(1).max(32).optional(),
-  normalizeCloudflareImages: z4.boolean().optional(),
+  useFeaturedImage: z6.boolean().optional(),
+  videoThumbnail: MetadataVideoThumbnailRuleSchema.optional(),
+  useFirstBodyImage: z6.boolean().optional(),
+  useTermImage: z6.boolean().optional(),
+  imageAltSource: z6.enum(["content", "title"]).optional(),
+  legacyImageSource: z6.literal("legacy-thumbnail").optional(),
+  imageAllowedOrigins: z6.array(imageOrigin).min(1).max(32).optional(),
+  legacyImageAllowedOrigins: z6.array(imageOrigin).min(1).max(32).optional(),
+  normalizeCloudflareImages: z6.boolean().optional(),
   fallback: MetadataValuesSchema.optional()
-}).strict().refine((rule) => !rule.legacyImageSource || Boolean(rule.legacyImageAllowedOrigins?.length), "\uC774\uC804 \uC774\uBBF8\uC9C0 \uC6D0\uBCF8\uC5D0\uB294 \uD5C8\uC6A9 origin \uC120\uC5B8\uC774 \uD544\uC694\uD569\uB2C8\uB2E4");
+}).strict().refine((rule) => !rule.legacyImageSource || Boolean(rule.legacyImageAllowedOrigins?.length), "\uC774\uC804 \uC774\uBBF8\uC9C0 \uC6D0\uBCF8\uC5D0\uB294 \uD5C8\uC6A9 origin \uC120\uC5B8\uC774 \uD544\uC694\uD569\uB2C8\uB2E4").superRefine((rule, context) => {
+  if (!rule.videoThumbnail) return;
+  const refs = collectMetadataDefaultFieldRefs(rule);
+  if (refs.length > 64) context.addIssue({ code: z6.ZodIssueCode.custom, message: "\uC601\uC0C1 \uC790\uB3D9\uAC12\uC740 \uACF5\uAC1C \uD544\uB4DC 64\uAC1C\uAE4C\uC9C0 \uCC38\uC870\uD560 \uC218 \uC788\uC2B5\uB2C8\uB2E4" });
+  for (const { name } of refs) {
+    if (!ContentPolicyFieldNameSchema.safeParse(name).success) context.addIssue({
+      code: z6.ZodIssueCode.custom,
+      message: "\uC601\uC0C1 \uC790\uB3D9\uAC12\uC758 \uD14D\uC2A4\uD2B8\xB7\uC870\uAC74\uC740 \uC548\uC804\uD55C \uACF5\uAC1C \uD544\uB4DC \uC774\uB984\uC744 \uC0AC\uC6A9\uD569\uB2C8\uB2E4"
+    });
+  }
+});
 function metadataContentImageUrl(value, normalizeCloudflareImages = false) {
   if (!normalizeCloudflareImages) return value;
   try {
@@ -2129,8 +2447,9 @@ function formatMetadataDefaults(input, declaration) {
   const finalTitle = templatedTitle && rule?.titleTemplateMaxLength && templatedTitle.length > rule.titleTemplateMaxLength ? title : templatedTitle;
   const description = formatMetadataText(input.description, rule?.description, input, name);
   const bodyImage = input.firstBodyImage && (input.firstBodyImage.startsWith("https://") || /^\/(?!\/)/u.test(input.firstBodyImage)) ? input.firstBodyImage : void 0;
-  const featuredImage = (input.kind === "terms" ? rule?.useTermImage : rule?.useFeaturedImage) === false ? void 0 : input.featuredImage;
-  const candidateImage = featuredImage || (rule?.useFirstBodyImage ? bodyImage : void 0) || legacyImageUrl(input.legacyImage, rule);
+  const rawFeaturedImage = (input.kind === "terms" ? rule?.useTermImage : rule?.useFeaturedImage) === false ? void 0 : input.featuredImage;
+  const featuredImage = rule?.videoThumbnail ? contentPolicySafeHttpsUrl(rawFeaturedImage) : rawFeaturedImage;
+  const candidateImage = featuredImage || (input.kind === "posts" ? metadataVideoThumbnail(rule?.videoThumbnail, input.fields) : void 0) || (rule?.useFirstBodyImage ? bodyImage : void 0) || legacyImageUrl(input.legacyImage, rule);
   const ogImage = candidateImage && contentCandidateAllowed(candidateImage, input, rule) ? readMetadataValues({ ogImage: metadataContentImageUrl(candidateImage, rule?.normalizeCloudflareImages) }).ogImage : void 0;
   return {
     ...readMetadataValues(rule?.defaults),
@@ -2140,6 +2459,85 @@ function formatMetadataDefaults(input, declaration) {
   };
 }
 
+// src/content-query.ts
+import { z as z7 } from "zod";
+var field2 = { field: ContentPolicyFieldNameSchema };
+var ContentQueryFilterSchema = z7.discriminatedUnion("op", [
+  z7.object({ ...field2, op: z7.literal("equals"), value: ContentPolicyScalarSchema }).strict(),
+  z7.object({ ...field2, op: z7.literal("notEquals"), value: ContentPolicyScalarSchema }).strict(),
+  z7.object({ ...field2, op: z7.literal("oneOf"), values: z7.array(ContentPolicyScalarSchema).min(1).max(16), allowEmpty: z7.boolean().optional() }).strict()
+]);
+var ContentQuerySchema = z7.object({
+  modelKeys: z7.array(z7.string().min(1).max(100).regex(/^[a-z][a-z0-9_-]*$/)).min(1).max(16),
+  filters: z7.array(ContentQueryFilterSchema).max(8).optional(),
+  scope: z7.enum(["currentTerm", "currentPath"]).optional(),
+  pinnedField: ContentPolicyFieldNameSchema.optional(),
+  pageSize: z7.number().int().min(1).max(100),
+  requireItems: z7.boolean().optional()
+}).strict();
+function collectContentQueryFieldRefs(query) {
+  return [.../* @__PURE__ */ new Set([...(query.filters ?? []).map((filter) => filter.field), ...query.pinnedField ? [query.pinnedField] : []])].map((name) => ({ name }));
+}
+function matchesScope(query, post, options) {
+  if (query.scope === "currentTerm") return post.terms?.some((term) => term.id === options.termId) === true;
+  if (query.scope === "currentPath") {
+    const path = options.path.replace(/\/+$/, "");
+    return post.path?.trim().startsWith(`${path}/`) === true;
+  }
+  return true;
+}
+function evaluateContentQuery(query, candidates, options) {
+  if (!options.complete) throw new Error("Content query input is incomplete");
+  const page = options.page ?? 1;
+  if (!Number.isSafeInteger(page) || page < 1) throw new Error("Content query page must be a positive safe integer");
+  if (query.scope === "currentTerm" && !options.termId) throw new Error("Content query requires the current term id");
+  if (query.scope === "currentPath" && (!options.path || !ContentPolicyInternalPathSchema.safeParse(options.path).success)) throw new Error("Content query requires a safe current path");
+  const visible = candidates.filter(({ policy }) => policy.visible);
+  const pathCounts = /* @__PURE__ */ new Map();
+  const canonical = (post) => post.path?.trim().replace(/\/+$/, "") ?? null;
+  for (const { post } of visible) pathCounts.set(canonical(post), (pathCounts.get(canonical(post)) ?? 0) + 1);
+  const seen = /* @__PURE__ */ new Set();
+  const selected = visible.filter(({ post }) => {
+    if (pathCounts.get(canonical(post)) !== 1 || seen.has(post.id)) return false;
+    seen.add(post.id);
+    return query.modelKeys.includes(post.modelKey ?? post.collectionKey ?? "") && matchesScope(query, post, options) && (query.filters ?? []).every((filter) => matchesContentScalarCheck(filter, post.fields ?? {}));
+  }).sort((left, right) => {
+    if (query.pinnedField) {
+      const delta = Number(right.post.fields?.[query.pinnedField] === true) - Number(left.post.fields?.[query.pinnedField] === true);
+      if (delta) return delta;
+    }
+    return Date.parse(right.post.publishedAt) - Date.parse(left.post.publishedAt) || left.post.id.localeCompare(right.post.id);
+  });
+  const pageCount = Math.max(1, Math.ceil(selected.length / query.pageSize));
+  const current = selected.slice((page - 1) * query.pageSize, page * query.pageSize);
+  const pageVisible = page <= pageCount && (!query.requireItems || selected.length > 0);
+  const hasIndexable = current.some(({ policy }) => policy.indexable);
+  const forced = !hasIndexable || options.robots?.forceNoindex === true;
+  const reasons = [.../* @__PURE__ */ new Set([
+    ...page > pageCount ? ["content:invalid-page"] : query.requireItems && !selected.length ? ["content:empty-required-list"] : !current.length ? ["content:empty-page"] : !hasIndexable ? ["content:no-indexable-items"] : [],
+    ...options.robots?.forceNoindex ? options.robots.noindexReasons?.length ? options.robots.noindexReasons : ["content:forced-noindex"] : []
+  ])].slice(0, 64);
+  return {
+    items: current.map(({ post }) => post),
+    total: selected.length,
+    page,
+    pageCount,
+    visible: pageVisible,
+    indexable: pageVisible && !forced,
+    robots: { ...options.robots, ...forced ? { forceNoindex: true } : {}, ...reasons.length ? { noindexReasons: reasons } : {} },
+    reasons
+  };
+}
+function selectContentQuery(query, posts, policies, options) {
+  if (!options.complete) throw new Error("Content query input is incomplete");
+  const candidates = posts.filter((post) => query.modelKeys.includes(post.modelKey ?? post.collectionKey ?? "")).map((post) => {
+    const modelKey = post.modelKey ?? post.collectionKey ?? "";
+    if (!Object.hasOwn(policies, modelKey)) throw new Error(`Content query has no policy for model ${modelKey}`);
+    return { post, policy: evaluateContentPolicy(policies[modelKey], post, { now: options.now, ...options.postOptions(post) }) };
+  });
+  return evaluateContentQuery(query, candidates, options);
+}
+
 // src/redirect-paths.ts
 var CONTROL_OR_BACKSLASH = /[\\\u0000-\u001f\u007f]/u;
 var PROTECTED_PREFIX = /^\/(?:api|_next|_vercel|auth|admin|login|logout|revalidate|preview|assets|static|images|fonts|\.well-known)(?:\/|$)/i;
@@ -2206,6 +2604,15 @@ export {
   CMS_IMAGE_WIDTHS,
   CMS_LINE_HEIGHTS,
   CMS_PARAGRAPH_SPACINGS,
+  ContentPolicyCheckSchema,
+  ContentPolicyFieldNameSchema,
+  ContentPolicyInternalPathSchema,
+  ContentPolicyScalarCheckSchema,
+  ContentPolicyScalarSchema,
+  ContentPolicySchema,
+  ContentPolicyWhenSchema,
+  ContentQueryFilterSchema,
+  ContentQuerySchema,
   DEFAULT_SITE_PATTERN_PRESENTATION,
   EMPTY_SITE_PATTERN_PLACEMENTS,
   FIELD_BINDING_SOURCE,
@@ -2243,10 +2650,17 @@ export {
   cmsImageWidth,
   cmsLineHeight,
   cmsParagraphSpacing,
+  collectContentPolicyFieldRefs,
+  collectContentQueryFieldRefs,
+  collectMetadataDefaultFieldRefs,
+  contentPolicyBodyText,
+  contentPolicySafeHttpsUrl,
   createFieldBindingResolver,
   emptyPatternSlots,
   ensureImportedHtmlDocumentRoots,
   ensureStableIds,
+  evaluateContentPolicy,
+  evaluateContentQuery,
   extractFaqEntries,
   faqPageJsonLd,
   findInternalContentLinkTokens,
@@ -2263,14 +2677,17 @@ export {
   isAllowedMapEmbedSrc,
   isInCollectionMode,
   isProtectedRedirectPath,
+  isReservedCategoryTreeSlug,
   isSectionContentPropPath,
   isSitePatternSlotKey,
   isValidBlock,
   isValidSitePatternKey,
   issuePreviewToken,
+  matchesContentScalarCheck,
   mergeMetadataPatch,
   metadataBodyParagraphs,
   metadataContentImageUrl,
+  metadataVideoThumbnail,
   normalizeEmbed,
   normalizeHexColor,
   normalizeImageAlt,
@@ -2289,11 +2706,13 @@ export {
   renderInternalContentLinksInText,
   resolveCategoryPath,
   resolveCategoryTreeChain,
+  resolveCategoryTreeEntryCategory,
   resolveCategoryTreeEntryPath,
   resolveCategoryTreeHubPaths,
   resolveCategoryTreeSelection,
   resolveMetadata,
   resolvePatternSlots,
+  resolvePostBodySource,
   resolvePostCategorySlug,
   resolvePostCollection,
   resolvePostPath,
@@ -2303,6 +2722,7 @@ export {
   sanitizeImportedCss,
   sanitizeImportedHtml,
   scopeImportedCss,
+  selectContentQuery,
   serializeBlock,
   setSitePatternPlacementRule,
   sitePatternButtonColor,