@ultimat3/seo 10.0.0 → 11.0.0

package/CLAUDE.md

@@ -96,6 +96,16 @@ Tier 1. May import `@ultimat3/core`, `@ultimat3/schema`, `@ultimat3/i18n`. Nothi
   whole contract exists to prevent. `parseImageQuery` never validates `f` against real format
   names; that refusal stays `image-driver.ts`'s `X_IMAGE_UNSUPPORTED`, so one bad URL never
   carries two codes.
+- **`xml.ts` drops what XML 1.0 cannot represent, `As of 2026-08-23`.** The C0 controls other than
+  tab, LF and CR, plus U+FFFE and U+FFFF, are removed in `escapeXml`, `escapeAttribute` and
+  `cdata` — so `xmlElement`, `attributes`, every sitemap and every feed inherit it. Dropped and not
+  escaped, because there is no escape: `` is illegal in XML 1.0 for exactly the reason the raw
+  byte is. It has to happen in the escaper rather than at each call site, because ONE such byte in
+  ONE `FeedItem` title makes the whole document not well-formed and a reader answers with "invalid
+  XML" instead of the 49 items it could have parsed — and a scraped title, a paste out of a word
+  processor and a `\x00` a `text` column stored without complaint each produce one. Never widen the
+  class to the surrogate range: an astral character is a legal PAIR, and half of one is worse than
+  the byte the rule exists for.
 - **A feed date never throws and never lies.** `feed-dates.ts` is the only place a feed timestamp
   is parsed or formatted; `buildFeed` resolves every date once, so no builder ever sees a string it
   has to parse. An item date that will not parse is **absent** — the element is omitted (Atom's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/seo",
-  "version": "10.0.0",
+  "version": "11.0.0",
   "description": "Enforced SEO: typed meta, JSON-LD, sitemap, robots, feeds, responsive images, perf budgets",
   "license": "MIT",
   "type": "module",
@@ -31,6 +31,6 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "10.0.0"
+    "@ultimat3/core": "11.0.0"
   }
 }

package/src/xml.ts

@@ -9,21 +9,42 @@ const XML_ESCAPES: Readonly<Record<string, string>> = {
   "'": '&apos;',
 };
 
+/**
+ * The characters XML 1.0 excludes from `Char`: the C0 controls other than tab, LF and CR, and the
+ * two non-characters at the end of the BMP.
+ *
+ * They are dropped rather than escaped because XML 1.0 offers no way to write one — `&#1;` is
+ * illegal for exactly the same reason the raw byte is, so an emitter's only total move is to omit
+ * it. And it has to happen HERE, in the escaper every element, attribute and CDATA section goes
+ * through: one such byte in one `FeedItem` title makes the whole document not well-formed, and a
+ * reader answers that with "invalid XML" rather than with the 49 items it could have parsed. A
+ * scraped title, a paste out of a word processor and a `\x00` a `text` column stored without
+ * complaint all produce one.
+ */
+// The same exemption `@ultimat3/core`'s `error-render.ts` and `@ultimat3/schema`'s `errors.ts`
+// take, for the same reason.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: naming them is the point.
+const ILLEGAL_XML = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\uFFFE\uFFFF]/g;
+
+/** Never a surrogate range: an astral character is a legal PAIR, and half of one is worse. */
+const legal = (value: string): string => value.replace(ILLEGAL_XML, '');
+
 export function escapeXml(value: string): string {
-  return value.replace(/[&<>"']/g, (char) => XML_ESCAPES[char] ?? char);
+  return legal(value).replace(/[&<>"']/g, (char) => XML_ESCAPES[char] ?? char);
 }
 
 /** Attribute values only ever need these three; apostrophes stay readable. */
 export function escapeAttribute(value: string): string {
-  return value.replace(/[&<>"]/g, (char) => XML_ESCAPES[char] ?? char);
+  return legal(value).replace(/[&<>"]/g, (char) => XML_ESCAPES[char] ?? char);
 }
 
 export function xmlElement(name: string, text: string): string {
   return `<${name}>${escapeXml(text)}</${name}>`;
 }
 
+/** CDATA suspends MARKUP, never the character rule — `legal` applies here exactly as above. */
 export function cdata(value: string): string {
-  return `<![CDATA[${value.replaceAll(']]>', ']]]]><![CDATA[>')}]]>`;
+  return `<![CDATA[${legal(value).replaceAll(']]>', ']]]]><![CDATA[>')}]]>`;
 }
 
 export function attributes(attrs: Readonly<Record<string, string>>): string {