@once-ui-system/core 1.7.12 → 1.7.13

package/dist/server/og-utils.js

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server';
+import { fetchValidatedUrl, OGUrlValidationError, validateOgUrl, } from './og-url-validation';
 function decodeHTMLEntities(text) {
     return text.replace(/&(#?[a-zA-Z0-9]+);/g, (match, entity) => {
         const entities = {
@@ -21,16 +22,16 @@ function decodeHTMLEntities(text) {
         return entities[entity] || match;
     });
 }
-async function fetchWithTimeout(url, timeout = 5000, userAgent = 'Mozilla/5.0 (compatible; OG-Fetcher/1.0)') {
+async function fetchWithTimeout(url, timeout = 5000, userAgent = 'Mozilla/5.0 (compatible; OG-Fetcher/1.0)', validationOptions = {}) {
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), timeout);
     try {
-        const response = await fetch(url, {
+        const response = await fetchValidatedUrl(url, {
             signal: controller.signal,
             headers: {
-                'User-Agent': userAgent
-            }
-        });
+                'User-Agent': userAgent,
+            },
+        }, validationOptions);
         clearTimeout(timeoutId);
         return response;
     }
@@ -39,17 +40,30 @@ async function fetchWithTimeout(url, timeout = 5000, userAgent = 'Mozilla/5.0 (c
         throw error;
     }
 }
+function validationErrorResponse() {
+    return NextResponse.json({ error: 'URL is not allowed' }, { status: 400 });
+}
 export async function handleOGFetch(request, options = {}) {
-    const { timeout = 5000, userAgent = 'Mozilla/5.0 (compatible; OG-Fetcher/1.0)', decodeEntities = true } = options;
+    const { timeout = 5000, userAgent = 'Mozilla/5.0 (compatible; OG-Fetcher/1.0)', decodeEntities = true, allowedDomains, } = options;
     const { searchParams } = new URL(request.url);
     const url = searchParams.get('url');
     if (!url) {
         return NextResponse.json({ error: 'URL parameter is required' }, { status: 400 });
     }
+    const validationOptions = { allowedDomains };
     try {
-        const response = await fetchWithTimeout(url, timeout, userAgent);
+        await validateOgUrl(url, validationOptions);
+    }
+    catch (error) {
+        if (error instanceof OGUrlValidationError) {
+            return validationErrorResponse();
+        }
+        return validationErrorResponse();
+    }
+    try {
+        const response = await fetchWithTimeout(url, timeout, userAgent, validationOptions);
         if (!response.ok) {
-            throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+            throw new Error(`HTTP ${response.status}`);
         }
         const html = await response.text();
         const ogData = {
@@ -89,24 +103,34 @@ export async function handleOGFetch(request, options = {}) {
     }
     catch (error) {
         console.error('Error fetching OG data:', error);
-        return NextResponse.json({ error: 'Failed to fetch Open Graph data', message: error instanceof Error ? error.message : 'Unknown error' }, { status: 500 });
+        return NextResponse.json({ error: 'Failed to fetch Open Graph data' }, { status: 500 });
     }
 }
 export async function handleOGProxy(request, options = {}) {
-    const { userAgent = 'Mozilla/5.0 (compatible; OG-Proxy/1.0)', cacheMaxAge = 3600 } = options;
+    const { userAgent = 'Mozilla/5.0 (compatible; OG-Proxy/1.0)', cacheMaxAge = 3600, allowedDomains, } = options;
     const { searchParams } = new URL(request.url);
     const url = searchParams.get('url');
     if (!url) {
         return NextResponse.json({ error: 'URL parameter is required' }, { status: 400 });
     }
+    const validationOptions = { allowedDomains };
     try {
-        const response = await fetch(url, {
+        await validateOgUrl(url, validationOptions);
+    }
+    catch (error) {
+        if (error instanceof OGUrlValidationError) {
+            return validationErrorResponse();
+        }
+        return validationErrorResponse();
+    }
+    try {
+        const response = await fetchValidatedUrl(url, {
             headers: {
                 'User-Agent': userAgent,
             },
-        });
+        }, validationOptions);
         if (!response.ok) {
-            return NextResponse.json({ error: `Failed to fetch image: ${response.status}` }, { status: response.status });
+            return NextResponse.json({ error: 'Failed to fetch image' }, { status: response.status >= 400 && response.status < 600 ? response.status : 502 });
         }
         const contentType = response.headers.get('content-type') || 'image/jpeg';
         const buffer = await response.arrayBuffer();
@@ -119,7 +143,8 @@ export async function handleOGProxy(request, options = {}) {
     }
     catch (error) {
         console.error('Error proxying image:', error);
-        return NextResponse.json({ error: 'Failed to proxy image', message: error instanceof Error ? error.message : 'Unknown error' }, { status: 500 });
+        return NextResponse.json({ error: 'Failed to proxy image' }, { status: 500 });
     }
 }
+export { OGUrlValidationError, validateOgUrl } from './og-url-validation';
 //# sourceMappingURL=og-utils.js.map

package/dist/server/og-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"og-utils.js","sourceRoot":"","sources":["../../src/server/og-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB3C,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3D,MAAM,QAAQ,GAA8B;YAC1C,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;SACX,CAAC;QAEF,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC/B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,OAAO,GAAG,IAAI,EAAE,SAAS,GAAG,0CAA0C;IACjH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;aACxB;SACF,CAAC,CAAC;QACH,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,UAA0B,EAAE;IAChF,MAAM,EAAE,OAAO,GAAG,IAAI,EAAE,SAAS,GAAG,0CAA0C,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAClH,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAEjE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnC,MAAM,MAAM,GAAW;YACrB,GAAG,EAAE,GAAG;YACR,KAAK,EAAE,EAAE;YACT,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC/D,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC3G,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,wEAAwE,CAAC;eACjG,IAAI,CAAC,KAAK,CAAC,wEAAwE,CAAC;eACpF,IAAI,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACjG,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,yEAAyE,CAAC;eACrG,IAAI,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC3F,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACjH,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,CAAC,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,iCAAiC,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EAC/G,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,UAA0B,EAAE;IAChF,MAAM,EAAE,SAAS,GAAG,wCAAwC,EAAE,WAAW,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC7F,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;aACxB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE,EAAE,EACtD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAC5B,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE5C,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE;YAC9B,OAAO,EAAE;gBACP,cAAc,EAAE,WAAW;gBAC3B,eAAe,EAAE,mBAAmB,WAAW,EAAE;aAClD;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,EACrG,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"og-utils.js","sourceRoot":"","sources":["../../src/server/og-utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EAEpB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAgB7B,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC3D,MAAM,QAAQ,GAA8B;YAC1C,KAAK,EAAE,GAAG;YACV,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;SACX,CAAC;QAEF,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC/B,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChC,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,OAAO,GAAG,IAAI,EACd,SAAS,GAAG,0CAA0C,EACtD,oBAA4C,EAAE;IAE9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,GAAG,EACH;YACE,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;aACxB;SACF,EACD,iBAAiB,CAClB,CAAC;QACF,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,UAA0B,EAAE;IAChF,MAAM,EACJ,OAAO,GAAG,IAAI,EACd,SAAS,GAAG,0CAA0C,EACtD,cAAc,GAAG,IAAI,EACrB,cAAc,GACf,GAAG,OAAO,CAAC;IACZ,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,iBAAiB,GAAG,EAAE,cAAc,EAAE,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,OAAO,uBAAuB,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAEpF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEnC,MAAM,MAAM,GAAW;YACrB,GAAG,EAAE,GAAG;YACR,KAAK,EAAE,EAAE;YACT,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,EAAE;SACV,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC/D,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC3G,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,wEAAwE,CAAC;eACjG,IAAI,CAAC,KAAK,CAAC,wEAAwE,CAAC;eACpF,IAAI,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACjG,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,yEAAyE,CAAC;eACrG,IAAI,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC3F,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACjH,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,CAAC;QAED,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,CAAC,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAC5C,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,UAA0B,EAAE;IAChF,MAAM,EACJ,SAAS,GAAG,wCAAwC,EACpD,WAAW,GAAG,IAAI,EAClB,cAAc,GACf,GAAG,OAAO,CAAC;IACZ,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAEpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,iBAAiB,GAAG,EAAE,cAAc,EAAE,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAC1C,OAAO,uBAAuB,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,uBAAuB,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,GAAG,EACH;YACE,OAAO,EAAE;gBACP,YAAY,EAAE,SAAS;aACxB;SACF,EACD,iBAAiB,CAClB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAClC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE5C,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE;YAC9B,OAAO,EAAE;gBACP,cAAc,EAAE,WAAW;gBAC3B,eAAe,EAAE,mBAAmB,WAAW,EAAE;aAClD;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,YAAY,CAAC,IAAI,CACtB,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAClC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/utils/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./devLogger";
 export * from "./MissingDependency";
 export * from "./dropdownState";
+export * from "./safe-html";
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}

package/dist/utils/index.js

@@ -1,4 +1,5 @@
 export * from "./devLogger";
 export * from "./MissingDependency";
 export * from "./dropdownState";
+export * from "./safe-html";
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,qBAAqB,CAAC;AACpC,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC"}

package/dist/utils/safe-html.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Escapes HTML special characters for safe insertion into HTML text nodes
+ * or attributes when content is not already sanitized HTML.
+ */
+export declare function escapeHtml(text: string): string;
+/**
+ * Serializes a value for safe embedding inside HTML <script> tags.
+ * JSON.stringify escapes quotes and backslashes but not `<`, which allows
+ * `</script>` breakout when prop values are attacker-controlled.
+ */
+export declare function safeScriptJson(value: unknown): string;
+/**
+ * Returns a trimmed href when it is safe to use as a navigation target,
+ * otherwise `undefined`. Blocks `javascript:`, `data:`, and other non-allowlisted
+ * schemes (including variants with embedded whitespace/control characters).
+ * Scheme-less values (relative paths, `#hash`, `?query`) are allowed.
+ */
+export declare function sanitizeHref(href: string | null | undefined): string | undefined;
+//# sourceMappingURL=safe-html.d.ts.map

package/dist/utils/safe-html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-html.d.ts","sourceRoot":"","sources":["../../src/utils/safe-html.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO/C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAErD;AAID;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAchF"}

package/dist/utils/safe-html.js

@@ -0,0 +1,43 @@
+/**
+ * Escapes HTML special characters for safe insertion into HTML text nodes
+ * or attributes when content is not already sanitized HTML.
+ */
+export function escapeHtml(text) {
+    return text
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;")
+        .replace(/'/g, "&#39;");
+}
+/**
+ * Serializes a value for safe embedding inside HTML <script> tags.
+ * JSON.stringify escapes quotes and backslashes but not `<`, which allows
+ * `</script>` breakout when prop values are attacker-controlled.
+ */
+export function safeScriptJson(value) {
+    return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+const ALLOWED_HREF_SCHEMES = new Set(["http", "https", "mailto", "tel", "sms"]);
+/**
+ * Returns a trimmed href when it is safe to use as a navigation target,
+ * otherwise `undefined`. Blocks `javascript:`, `data:`, and other non-allowlisted
+ * schemes (including variants with embedded whitespace/control characters).
+ * Scheme-less values (relative paths, `#hash`, `?query`) are allowed.
+ */
+export function sanitizeHref(href) {
+    if (href == null)
+        return undefined;
+    const trimmed = href.trim();
+    if (!trimmed)
+        return undefined;
+    const forScheme = trimmed.replace(/[\u0000-\u001F\u007F\s]/g, "");
+    const schemeMatch = forScheme.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):/);
+    if (schemeMatch) {
+        const scheme = schemeMatch[1].toLowerCase();
+        if (!ALLOWED_HREF_SCHEMES.has(scheme))
+            return undefined;
+    }
+    return trimmed;
+}
+//# sourceMappingURL=safe-html.js.map

package/dist/utils/safe-html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-html.js","sourceRoot":"","sources":["../../src/utils/safe-html.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,IAAI;SACR,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAA+B;IAC1D,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAE/B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACnE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;IAC1D,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@once-ui-system/core",
-  "version": "1.7.12",
+  "version": "1.7.13",
   "description": "Once UI for Next.js NPM package",
   "keywords": [
     "once-ui",
@@ -9,7 +9,10 @@
     "scss",
     "design system",
     "design framework",
-    "nextjs design system"
+    "nextjs design system",
+    "ai",
+    "agent",
+    "codegen"
   ],
   "author": "Once UI",
   "license": "MIT",
@@ -22,6 +25,21 @@
     "url": "https://github.com/once-ui-system/core/issues"
   },
   "homepage": "https://docs.once-ui.com",
+  "onceUi": {
+    "harness": "./ai/manifest.json",
+    "bootstrap": [
+      "./ai/rules.compact.md",
+      "./ai/catalog.json"
+    ],
+    "tasks": "./ai/tasks/index.json",
+    "validate": "./scripts/validate-ai-code.js",
+    "initAgent": "./scripts/init-agent.js",
+    "docs": "https://docs.once-ui.com/once-ui/ai-coding"
+  },
+  "bin": {
+    "once-ui-init-agent": "./scripts/init-agent.js",
+    "once-ui-validate-ai-code": "./scripts/validate-ai-code.js"
+  },
   "main": "dist/index.js",
   "exports": {
     ".": {
@@ -80,7 +98,8 @@
     "./ai/tasks/*": "./ai/tasks/*",
     "./ai/components/*": "./ai/components/*",
     "./ai/examples/*": "./ai/examples/*",
-    "./ai/examples/blocks/*": "./ai/examples/blocks/*"
+    "./ai/examples/blocks/*": "./ai/examples/blocks/*",
+    "./AGENTS.md": "./AGENTS.md"
   },
   "scripts": {
     "build": "pnpm clean && pnpm generate-emoji-data && pnpm generate-ai-spec && tsc --project tsconfig.build.json && pnpm copy-files && pnpm build:css",
@@ -97,6 +116,7 @@
     "prepack": "pnpm build",
     "generate-emoji-data": "node scripts/generate-emoji-data.js",
     "generate-ai-spec": "node scripts/generate-ai-spec.js",
+    "init-agent": "node scripts/init-agent.js",
     "validate-ai-code": "node scripts/validate-ai-code.js"
   },
   "dependencies": {

package/scripts/copy-files.js

@@ -0,0 +1,103 @@
+const fs = require("fs");
+const path = require("path");
+
+// Function to copy directory recursively
+function copyDir(src, dest) {
+  // Create destination directory if it doesn't exist
+  if (!fs.existsSync(dest)) {
+    fs.mkdirSync(dest, { recursive: true });
+  }
+
+  // Read source directory
+  const entries = fs.readdirSync(src, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const srcPath = path.join(src, entry.name);
+    const destPath = path.join(dest, entry.name);
+
+    if (entry.isDirectory()) {
+      // Recursively copy directory
+      copyDir(srcPath, destPath);
+    } else {
+      // Copy file if it's not a TypeScript file (TS files are handled by tsc)
+      const ext = path.extname(entry.name).toLowerCase();
+      if (![".ts", ".tsx"].includes(ext)) {
+        fs.copyFileSync(srcPath, destPath);
+      }
+    }
+  }
+}
+
+// Copy all style files and other assets
+const srcDir = path.resolve(__dirname, "../src");
+const destDir = path.resolve(__dirname, "../dist");
+
+// Copy package.json with modifications
+const packageJson = require("../package.json");
+
+// Remove unnecessary fields for the published package
+const fieldsToRemove = ["scripts", "devDependencies", "overrides"];
+
+fieldsToRemove.forEach((field) => {
+  delete packageJson[field];
+});
+
+// Move some dependencies to peerDependencies
+const peerDeps = {
+  react: packageJson.dependencies.react,
+  "react-dom": packageJson.dependencies["react-dom"],
+  next: packageJson.dependencies.next,
+};
+
+// Add peer dependencies
+packageJson.peerDependencies = {
+  ...peerDeps,
+  react: ">=18.0.0",
+  "react-dom": ">=18.0.0",
+  next: ">=13.0.0",
+};
+
+// Remove peer deps from dependencies
+Object.keys(peerDeps).forEach((dep) => {
+  delete packageJson.dependencies[dep];
+});
+
+// Write the modified package.json to dist
+fs.writeFileSync(path.resolve(destDir, "package.json"), JSON.stringify(packageJson, null, 2));
+
+// Copy README and AGENTS.md
+if (fs.existsSync(path.resolve(__dirname, "../README.md"))) {
+  fs.copyFileSync(path.resolve(__dirname, "../README.md"), path.resolve(destDir, "README.md"));
+}
+if (fs.existsSync(path.resolve(__dirname, "../AGENTS.md"))) {
+  fs.copyFileSync(path.resolve(__dirname, "../AGENTS.md"), path.resolve(destDir, "AGENTS.md"));
+}
+
+// Copy CLI scripts and agent templates for npm publish
+const scriptsDir = path.resolve(destDir, "scripts");
+fs.mkdirSync(scriptsDir, { recursive: true });
+for (const script of ["init-agent.js", "validate-ai-code.js"]) {
+  fs.copyFileSync(
+    path.resolve(__dirname, script),
+    path.join(scriptsDir, script),
+  );
+}
+const agentSrc = path.resolve(__dirname, "../agent");
+const agentDest = path.resolve(destDir, "agent");
+if (fs.existsSync(agentSrc)) {
+  copyDir(agentSrc, agentDest);
+}
+
+// Copy style files
+console.log("Copying style files and other assets...");
+copyDir(srcDir, destDir);
+
+// Copy AI harness artifacts for npm publish
+const aiDir = path.resolve(__dirname, "../ai");
+const aiDest = path.resolve(destDir, "ai");
+if (fs.existsSync(aiDir)) {
+  console.log("Copying AI artifacts...");
+  copyDir(aiDir, aiDest);
+}
+
+console.log("Files copied successfully!");