- renderJournalBody runs the UI-SPEC L7 order on the sanitized body:
h1 demotion, the CMS phrase auto-links, the outbound rules and lazy,
async images, with vue-seo-layer's autolink, applyOutbound and
imageAttrs; PostBody feeds it the page's resolve answer (autolinks,
autolink_max, outbound, url) and the seo.links.newTabHint option
- the sanitizer keeps a link rel of only nofollow, sponsored and ugc
(the Blog Editor's link form, as the Journal plugin's policy does);
target is never kept, the outbound rules add it
- editor-corpus.json copied again from sm-journal-plugin (link-rel and
image-decorative entries)
- smoke:ssr script; expectations for auto-links, both new-tab modes and
the hint switched off
- htmlGate.ts mirrors the four editor-output rules of the Go policy:
figure data-embed (^youtube$) and data-id (^[A-Za-z0-9_-]{11}$),
img alt with any text, ol start (integer)
- embeds.ts: EMBED_PROVIDERS (youtube on youtube-nocookie.com),
EMBED_PLACEHOLDER and expandEmbeds
- JournalPostBody and JournalCategoryHeader render
expandEmbeds(sanitizeJournalHtml(html)); payload transforms only sanitize
- .journal-embed styles (16 / 9 block, borderless iframe)
- tests: byte copy of the editor corpus, mirror and pipeline cases;
acme hello-acme carries a placeholder and the SSR smoke checks the iframe
- README Embeds section and decision note Policy amendment
