@flamingo-stack/openframe-frontend-core 0.0.255 → 0.0.256

package/src/utils/common.ts

@@ -49,6 +49,18 @@ export function truncateString(str: string, maxLength: number, suffix = "..."):
   return str.substring(0, maxLength - suffix.length) + suffix
 }
 
+/**
+ * Serialize a JSON-LD schema for a `<script type="application/ld+json">`
+ * block — THE one home of the escape rule (the hub re-exports this from
+ * lib/utils/breadcrumbs). JSON.stringify does NOT HTML-escape: a stored
+ * "</script>" inside any admin/user-entered field would terminate the tag
+ * early (stored XSS). Every "<" becomes the JSON escape sequence
+ * backslash-u003c — still valid JSON, inert in HTML.
+ */
+export function serializeJsonLd(schema: unknown): string {
+  return JSON.stringify(schema).replace(/</g, "\\u003c")
+}
+
 /**
  * Deep clone an object
  * @param obj - Object to clone

package/src/utils/index.ts

@@ -12,7 +12,7 @@ export { formatDate, formatNumber, formatPrice, formatBytes } from './format'
 // SVG path constants — re-exported here (server-safe) because icons-v2 has "use client"
 export { PLAY_ICON_PATH } from '../components/icons-v2-generated/media-playback/play-icon'
 export { getPlatformAccentColor, getCurrentPlatform, type ColorCategory, HEX_PATTERN } from './ods-color-utils'
-export { delay, generateRandomString, truncateString, deepClone, getSlackCommunityJoinUrl } from './common'
+export { delay, generateRandomString, truncateString, deepClone, getSlackCommunityJoinUrl, serializeJsonLd } from './common'
 export { getBaseUrl } from '../utils/cn'
 
 export * from './platform-config'