@constela/start 1.3.4 → 1.4.0

package/README.md

@@ -227,6 +227,22 @@ title: Getting Started
 </Callout>
 ```
 
+### Security
+
+MDX attribute expressions are validated at compile time. Dangerous patterns like `require()`, `eval()`, or `window` in actual code will throw explicit errors:
+
+```mdx
+<!-- Error: MDX attribute contains disallowed pattern: require -->
+<Button data={require("module")} />
+```
+
+However, these words are allowed inside string literals:
+
+```mdx
+<!-- OK: "require" is inside a string literal -->
+<PropsTable items={[{ description: "operations that require one" }]} />
+```
+
 ## Configuration
 
 Create `constela.config.json`:

package/dist/{chunk-QEXDD2F2.js → chunk-6FV75N45.js}

@@ -1,8 +1,9 @@
 import {
   generateHydrationScript,
+  generateMetaTags,
   renderPage,
   wrapHtml
-} from "./chunk-CYMS3K6V.js";
+} from "./chunk-XAC4ETQU.js";
 
 // src/router/file-router.ts
 import fg from "fast-glob";
@@ -2172,7 +2173,13 @@ async function createDevServer(options = {}) {
                 path: pathname
               };
               const hydrationScript = generateHydrationScript(composedProgram, widgets, routeContext);
+              const metaTags = generateMetaTags(composedProgram.route, {
+                params: match.params,
+                query: Object.fromEntries(url.searchParams.entries()),
+                path: pathname
+              });
               const cssHead = css ? (Array.isArray(css) ? css : [css]).map((p) => `<link rel="stylesheet" href="/${p}">`).join("\n") : "";
+              const head = [metaTags, cssHead].filter(Boolean).join("\n");
               const themeState = composedProgram.state?.["theme"];
               const initialTheme = themeState?.initial;
               const importMap = {
@@ -2182,7 +2189,7 @@ async function createDevServer(options = {}) {
                 "marked": "/node_modules/marked/lib/marked.esm.js",
                 "monaco-editor": "/node_modules/monaco-editor/esm/vs/editor/editor.api.js"
               };
-              const html = wrapHtml(content, hydrationScript, cssHead, {
+              const html = wrapHtml(content, hydrationScript, head || void 0, {
                 ...initialTheme ? {
                   theme: initialTheme,
                   defaultTheme: initialTheme,

package/dist/{chunk-CYMS3K6V.js → chunk-XAC4ETQU.js}

@@ -136,9 +136,65 @@ ${processedScript}
 </body>
 </html>`;
 }
+function escapeHtmlForMeta(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function evaluateMetaExpression(expr, ctx) {
+  switch (expr.expr) {
+    case "lit":
+      return String(expr.value);
+    case "route":
+      if (expr.source === "param") {
+        return ctx.params[expr.name] || "";
+      } else if (expr.source === "query") {
+        return ctx.query[expr.name] || "";
+      } else if (expr.source === "path") {
+        return ctx.path;
+      }
+      return "";
+    case "bin":
+      if (expr.op === "+") {
+        return evaluateMetaExpression(expr.left, ctx) + evaluateMetaExpression(expr.right, ctx);
+      }
+      return "";
+    case "concat":
+      return expr.items.map((item) => evaluateMetaExpression(item, ctx)).join("");
+    default:
+      return "";
+  }
+}
+function generateMetaTags(route, ctx) {
+  if (!route) {
+    return "";
+  }
+  const tags = [];
+  if (route.title) {
+    const titleValue = evaluateMetaExpression(route.title, ctx);
+    if (titleValue) {
+      tags.push(`<title>${escapeHtmlForMeta(titleValue)}</title>`);
+    }
+  }
+  if (route.meta) {
+    for (const [key, expr] of Object.entries(route.meta)) {
+      const value = evaluateMetaExpression(expr, ctx);
+      if (!value) {
+        continue;
+      }
+      const escapedValue = escapeHtmlForMeta(value);
+      if (key.startsWith("og:") || key.startsWith("twitter:")) {
+        tags.push(`<meta property="${key}" content="${escapedValue}">`);
+      } else {
+        tags.push(`<meta name="${key}" content="${escapedValue}">`);
+      }
+    }
+  }
+  return tags.join("\n");
+}
 
 export {
   renderPage,
   generateHydrationScript,
-  wrapHtml
+  wrapHtml,
+  evaluateMetaExpression,
+  generateMetaTags
 };

package/dist/cli/index.js

@@ -4,8 +4,8 @@ import {
   hyperlink,
   loadConfig,
   resolveConfig
-} from "../chunk-QEXDD2F2.js";
-import "../chunk-CYMS3K6V.js";
+} from "../chunk-6FV75N45.js";
+import "../chunk-XAC4ETQU.js";
 
 // src/cli/index.ts
 import { Command } from "commander";

package/dist/index.js

@@ -24,12 +24,13 @@ import {
   transformCsv,
   transformMdx,
   transformYaml
-} from "./chunk-QEXDD2F2.js";
+} from "./chunk-6FV75N45.js";
 import {
   generateHydrationScript,
+  generateMetaTags,
   renderPage,
   wrapHtml
-} from "./chunk-CYMS3K6V.js";
+} from "./chunk-XAC4ETQU.js";
 
 // src/build/ssg.ts
 import { mkdir, writeFile } from "fs/promises";
@@ -113,6 +114,11 @@ async function generateSinglePage(pattern, outDir, program, params = {}) {
     path: pattern
   };
   const hydrationScript = generateHydrationScript(program, void 0, routeContext);
+  const metaTags = generateMetaTags(program.route, {
+    params,
+    query: {},
+    path: pattern
+  });
   const wrapOptions = {};
   const themeState = program.state?.["theme"];
   if (themeState?.initial) {
@@ -122,7 +128,7 @@ async function generateSinglePage(pattern, outDir, program, params = {}) {
   const html = wrapHtml(
     content,
     hydrationScript,
-    void 0,
+    metaTags || void 0,
     Object.keys(wrapOptions).length > 0 ? wrapOptions : void 0
   );
   await writeFile(outputPath, html, "utf-8");

package/dist/runtime/entry-server.d.ts

@@ -1,4 +1,4 @@
-import { CompiledProgram } from '@constela/compiler';
+import { CompiledProgram, CompiledExpression, CompiledRouteDefinition } from '@constela/compiler';
 
 /**
  * Server-side entry point for Constela applications
@@ -76,5 +76,21 @@ declare function generateHydrationScript(program: CompiledProgram, widgets?: Wid
  * @returns Complete HTML document string
  */
 declare function wrapHtml(content: string, hydrationScript: string, head?: string, options?: WrapHtmlOptions): string;
+/**
+ * Context for evaluating meta tag expressions
+ */
+interface MetaContext {
+    params: Record<string, string>;
+    query: Record<string, string>;
+    path: string;
+}
+/**
+ * Evaluates a compiled expression for meta tag values.
+ */
+declare function evaluateMetaExpression(expr: CompiledExpression, ctx: MetaContext): string;
+/**
+ * Generates HTML meta tags from route definition.
+ */
+declare function generateMetaTags(route: CompiledRouteDefinition | undefined, ctx: MetaContext): string;
 
-export { type HydrationRouteContext, type SSRContext, type WidgetConfig, type WrapHtmlOptions, generateHydrationScript, renderPage, wrapHtml };
+export { type HydrationRouteContext, type MetaContext, type SSRContext, type WidgetConfig, type WrapHtmlOptions, evaluateMetaExpression, generateHydrationScript, generateMetaTags, renderPage, wrapHtml };

package/dist/runtime/entry-server.js

@@ -1,10 +1,14 @@
 import {
+  evaluateMetaExpression,
   generateHydrationScript,
+  generateMetaTags,
   renderPage,
   wrapHtml
-} from "../chunk-CYMS3K6V.js";
+} from "../chunk-XAC4ETQU.js";
 export {
+  evaluateMetaExpression,
   generateHydrationScript,
+  generateMetaTags,
   renderPage,
   wrapHtml
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constela/start",
-  "version": "1.3.4",
+  "version": "1.4.0",
   "description": "Meta-framework for Constela applications",
   "type": "module",
   "main": "./dist/index.js",
@@ -43,11 +43,11 @@
     "postcss": "^8.5.0",
     "@tailwindcss/postcss": "^4.0.0",
     "tailwindcss": "^4.0.0",
-    "@constela/compiler": "0.9.1",
-    "@constela/core": "0.9.1",
-    "@constela/server": "5.0.1",
-    "@constela/runtime": "0.12.2",
-    "@constela/router": "10.0.0"
+    "@constela/compiler": "0.10.0",
+    "@constela/router": "11.0.0",
+    "@constela/core": "0.10.0",
+    "@constela/runtime": "0.13.0",
+    "@constela/server": "6.0.0"
   },
   "devDependencies": {
     "@types/mdast": "^4.0.4",