@ultimat3/seo 9.0.0 → 11.0.0

package/CLAUDE.md

@@ -82,6 +82,11 @@ Tier 1. May import `@ultimat3/core`, `@ultimat3/schema`, `@ultimat3/i18n`. Nothi
   whether that string is a path, a storage key or a URL is the app's fact, not seo's — never add
   a filesystem fallback. Pixels come from `@ultimat3/core`'s pipeline; seo owns no second scaler,
   and the driver reports the size it probed off the output, never the size that was requested.
+- **A table keyed on a caller string is read with `Object.hasOwn`, never a bare index.**
+  `MIME_TYPES[format]` in `images.ts` walked the prototype, so `formats: ['constructor']` rendered
+  `<source type="function Object() { [native code] }">` — into the one attribute a browser reads to
+  decide whether to fetch the candidate at all. `mimeTypeFor` is the own-key read; the fallback is
+  still `image/<format>`.
 - **One spelling of the transform query keys.** `IMAGE_QUERY_KEYS` in `images.ts` is the only
   place `w`/`f`/`q` are spelled; `defaultUrlFor` writes them and `parseImageQuery` is the only
   reader — never hand-roll either half against a literal. A present-but-unusable `w` or `q`
@@ -91,6 +96,16 @@ Tier 1. May import `@ultimat3/core`, `@ultimat3/schema`, `@ultimat3/i18n`. Nothi
   whole contract exists to prevent. `parseImageQuery` never validates `f` against real format
   names; that refusal stays `image-driver.ts`'s `X_IMAGE_UNSUPPORTED`, so one bad URL never
   carries two codes.
+- **`xml.ts` drops what XML 1.0 cannot represent, `As of 2026-08-23`.** The C0 controls other than
+  tab, LF and CR, plus U+FFFE and U+FFFF, are removed in `escapeXml`, `escapeAttribute` and
+  `cdata` — so `xmlElement`, `attributes`, every sitemap and every feed inherit it. Dropped and not
+  escaped, because there is no escape: `&#1;` is illegal in XML 1.0 for exactly the reason the raw
+  byte is. It has to happen in the escaper rather than at each call site, because ONE such byte in
+  ONE `FeedItem` title makes the whole document not well-formed and a reader answers with "invalid
+  XML" instead of the 49 items it could have parsed — and a scraped title, a paste out of a word
+  processor and a `\x00` a `text` column stored without complaint each produce one. Never widen the
+  class to the surrogate range: an astral character is a legal PAIR, and half of one is worse than
+  the byte the rule exists for.
 - **A feed date never throws and never lies.** `feed-dates.ts` is the only place a feed timestamp
   is parsed or formatted; `buildFeed` resolves every date once, so no builder ever sees a string it
   has to parse. An item date that will not parse is **absent** — the element is omitted (Atom's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ultimat3/seo",
-  "version": "9.0.0",
+  "version": "11.0.0",
   "description": "Enforced SEO: typed meta, JSON-LD, sitemap, robots, feeds, responsive images, perf budgets",
   "license": "MIT",
   "type": "module",
@@ -31,6 +31,6 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@ultimat3/core": "9.0.0"
+    "@ultimat3/core": "11.0.0"
   }
 }

package/src/errors.ts

@@ -55,7 +55,6 @@ export class SeoError extends UltimateError {
       code: init.code,
       cause: init.cause,
       fix: init.fix,
-      docs: `https://ultimate.dev/errors/${init.code}`,
       meta: init.meta,
     });
   }

package/src/images.ts

@@ -186,6 +186,11 @@ export function srcsetFor(
   return widths.map((width) => `${urlFor(input.src, width, format)} ${width}w`).join(', ');
 }
 
+/** The declared MIME type, else the conventional `image/<format>`. Own keys only. */
+function mimeTypeFor(format: string): string {
+  return Object.hasOwn(MIME_TYPES, format) ? (MIME_TYPES[format] as string) : `image/${format}`;
+}
+
 export function responsiveImage(
   input: ImageInput,
   options: ResponsiveImageOptions = {},
@@ -196,7 +201,10 @@ export function responsiveImage(
   const formats = options.formats ?? FORMAT_ORDER;
 
   const sources: ImageSourceSet[] = formats.map((format) => ({
-    type: MIME_TYPES[format] ?? `image/${format}`,
+    // `Object.hasOwn`, never a bare index: `MIME_TYPES` is a `{}`-prototyped literal, so an
+    // unlisted format spelled `constructor` or `toString` rendered a function into the one
+    // attribute a browser reads to decide whether to fetch the candidate at all.
+    type: mimeTypeFor(format),
     srcset: srcsetFor(input, widths, format, urlFor),
     sizes,
   }));

package/src/xml.ts

@@ -9,21 +9,42 @@ const XML_ESCAPES: Readonly<Record<string, string>> = {
   "'": '&apos;',
 };
 
+/**
+ * The characters XML 1.0 excludes from `Char`: the C0 controls other than tab, LF and CR, and the
+ * two non-characters at the end of the BMP.
+ *
+ * They are dropped rather than escaped because XML 1.0 offers no way to write one — `&#1;` is
+ * illegal for exactly the same reason the raw byte is, so an emitter's only total move is to omit
+ * it. And it has to happen HERE, in the escaper every element, attribute and CDATA section goes
+ * through: one such byte in one `FeedItem` title makes the whole document not well-formed, and a
+ * reader answers that with "invalid XML" rather than with the 49 items it could have parsed. A
+ * scraped title, a paste out of a word processor and a `\x00` a `text` column stored without
+ * complaint all produce one.
+ */
+// The same exemption `@ultimat3/core`'s `error-render.ts` and `@ultimat3/schema`'s `errors.ts`
+// take, for the same reason.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: naming them is the point.
+const ILLEGAL_XML = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\uFFFE\uFFFF]/g;
+
+/** Never a surrogate range: an astral character is a legal PAIR, and half of one is worse. */
+const legal = (value: string): string => value.replace(ILLEGAL_XML, '');
+
 export function escapeXml(value: string): string {
-  return value.replace(/[&<>"']/g, (char) => XML_ESCAPES[char] ?? char);
+  return legal(value).replace(/[&<>"']/g, (char) => XML_ESCAPES[char] ?? char);
 }
 
 /** Attribute values only ever need these three; apostrophes stay readable. */
 export function escapeAttribute(value: string): string {
-  return value.replace(/[&<>"]/g, (char) => XML_ESCAPES[char] ?? char);
+  return legal(value).replace(/[&<>"]/g, (char) => XML_ESCAPES[char] ?? char);
 }
 
 export function xmlElement(name: string, text: string): string {
   return `<${name}>${escapeXml(text)}</${name}>`;
 }
 
+/** CDATA suspends MARKUP, never the character rule — `legal` applies here exactly as above. */
 export function cdata(value: string): string {
-  return `<![CDATA[${value.replaceAll(']]>', ']]]]><![CDATA[>')}]]>`;
+  return `<![CDATA[${legal(value).replaceAll(']]>', ']]]]><![CDATA[>')}]]>`;
 }
 
 export function attributes(attrs: Readonly<Record<string, string>>): string {