@zeropress/build-core 0.1.8 → 0.1.10

package/README.md

@@ -9,7 +9,7 @@ Shared build and partial-render core for ZeroPress.
 This package is the deterministic rendering engine used by:
 
 - `zeropress-admin-api-v2`
-- future `@zeropress/build` CLI flows
+- [`@zeropress/build`](https://www.npmjs.com/package/@zeropress/build) package
 
 It accepts canonical preview-data plus a validated theme package and produces static HTML artifacts through a writer interface.
 
@@ -59,7 +59,12 @@ import {
   - `meta.json`
 - writing outputs through a pluggable writer
 
-It does not talk to databases, queues, KV, Durable Objects, R2, or deployment infrastructure directly.
+It does not:
+
+- fetch content from databases or APIs
+- package or validate theme directories on its own unless the caller uses `buildSiteFromThemeDir`
+- watch files, run a dev server, or perform deployment
+- talk to queues, KV, Durable Objects, R2, GitHub, or other infrastructure directly
 
 ---
 
@@ -97,7 +102,7 @@ Returns:
     }
   ],
   manifest: {
-    generatedAt: '2026-04-02T00:00:00.000Z',
+    generatedAt: '2026-04-02T00:00:00Z',
     files: [
       {
         path: 'index.html',
@@ -110,11 +115,29 @@ Returns:
 }
 ```
 
+Notes:
+
+- `writer` is required
+- `previewData` must already satisfy the canonical preview-data contract
+- `themePackage` must already be a validated in-memory theme package
+- `sitemap.xml` and `feed.xml` are emitted only when `site.url` is a non-empty canonical URL
+- `robots.txt` and `meta.json` are still emitted when `generateSpecialFiles` is enabled
+
 ### `buildSelectedRoutes(input)`
 
 Renders only selected post and list routes while preserving full-build parity for those outputs.
 
-This is intended for selective publish and other partial-render workflows.
+This is intended for targeted rebuilds, output parity checks, and other partial-render workflows.
+
+Current selection scope is limited to:
+
+- post detail routes
+- index pagination routes
+- archive routes
+- category routes
+- tag routes
+
+It does not currently support selecting individual page routes.
 
 Optional route templates are respected during both full and partial renders:
 
@@ -145,7 +168,7 @@ await buildSelectedRoutes({
 
 Loads a theme directory from disk and renders it using the same core pipeline.
 
-This is useful for local tooling and CLI flows.
+This is useful for local tooling that wants filesystem theme loading but still uses the same deterministic core renderer.
 
 ---
 
@@ -193,6 +216,8 @@ Theme validation is enforced through:
 
 - [`@zeropress/theme-validator`](https://www.npmjs.com/package/@zeropress/theme-validator)
 
+`buildSiteFromThemeDir()` is the convenience entry point that loads a theme directory and converts it into the required in-memory `themePackage`.
+
 As of `preview-data v0.4`, the payload no longer carries `routes` arrays or raw HTML fragments such as `categories_html`.
 
 Build-core now derives:
@@ -238,6 +263,13 @@ Supported options:
 
 These options apply to both full builds and partial renders where relevant.
 
+Defaults:
+
+- `assetHashing: true`
+- `generateSpecialFiles: true`
+- `injectHtmx: true`
+- `writeManifest: false`
+
 ---
 
 ## Requirements
@@ -251,7 +283,7 @@ These options apply to both full builds and partial renders where relevant.
 
 - [@zeropress/preview-data-validator](https://www.npmjs.com/package/@zeropress/preview-data-validator)
 - [@zeropress/theme-validator](https://www.npmjs.com/package/@zeropress/theme-validator)
-- [zeropress-theme](https://www.npmjs.com/package/zeropress-theme)
+- [@zeropress/theme](https://www.npmjs.com/package/@zeropress/theme)
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeropress/build-core",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Shared ZeroPress build and partial-render core",
   "type": "module",
   "license": "MIT",
@@ -33,7 +33,10 @@
     "node": ">=18.18.0"
   },
   "dependencies": {
-    "@zeropress/preview-data-validator": "^0.3.3",
-    "@zeropress/theme-validator": "^0.2.4"
+    "@zeropress/preview-data-validator": "^0.4.0",
+    "@zeropress/theme-validator": "^0.2.4",
+    "highlight.js": "^11.11.1",
+    "markdown-it": "^14.1.0",
+    "markdown-it-anchor": "^9.2.0"
   }
 }

package/src/api/build-site.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { assertPreviewData } from '@zeropress/preview-data-validator';
 import { validateThemeFiles } from '@zeropress/theme-validator';
 import { AssetProcessor } from '../assets/asset-processor.js';
+import { renderDocumentContent } from '../render/content-renderer.js';
 import { ZeroPressEngine } from '../render/zeropress-engine.js';
 
 const DEFAULT_OPTIONS = {
@@ -28,7 +29,7 @@ export async function buildSite(input) {
     await renderPost(state, post);
   }
 
-  for (const page of state.previewData.content.pages) {
+  for (const page of state.renderData.pages) {
     await renderPage(state, page);
   }
 
@@ -170,7 +171,7 @@ async function finalizeBuildResult(writer, summaries, options) {
   let manifest;
   if (options.writeManifest) {
     manifest = {
-      generatedAt: new Date().toISOString(),
+      generatedAt: formatUtcIsoSeconds(new Date()),
       files: summaries.map((file) => ({ ...file })),
     };
     await writeOutput(
@@ -324,10 +325,15 @@ function normalizePreviewData(previewData) {
     site: normalizedSite,
     content: {
       ...previewData.content,
+      authors: previewData.content.authors.map((author) => ({
+        ...author,
+        avatar: normalizeMediaField(author.avatar, normalizedSite.mediaBaseUrl),
+      })),
       posts: previewData.content.posts
         .map((post) => ({
           ...post,
-          author_avatar: normalizeMediaField(post.author_avatar, normalizedSite.mediaBaseUrl),
+          published_at_iso: normalizeIsoTimestamp(post.published_at_iso),
+          updated_at_iso: normalizeIsoTimestamp(post.updated_at_iso),
           featured_image: normalizeMediaField(post.featured_image, normalizedSite.mediaBaseUrl),
         }))
         .sort((left, right) => toDate(right.published_at_iso).getTime() - toDate(left.published_at_iso).getTime()),
@@ -342,6 +348,7 @@ function normalizePreviewData(previewData) {
 }
 
 function createRenderData(previewData) {
+  const authorsById = new Map(previewData.content.authors.map((author) => [author.id, author]));
   const categoriesBySlug = new Map(previewData.content.categories.map((category) => [category.slug, category]));
   const tagsBySlug = new Map(previewData.content.tags.map((tag) => [tag.slug, tag]));
   const categoryPostsBySlug = new Map();
@@ -361,13 +368,15 @@ function createRenderData(previewData) {
     }
   }
 
-  const posts = previewData.content.posts.map((post) => preparePost(post, previewData.site, categoriesBySlug, tagsBySlug));
+  const posts = previewData.content.posts.map((post) => preparePost(post, previewData.site, authorsById, categoriesBySlug, tagsBySlug));
+  const pages = previewData.content.pages.map((page) => preparePage(page));
   const postBySlug = new Map(posts.map((post) => [post.slug, post]));
   const categoryLinks = renderCategoryLinks(previewData.content.categories, categoryCountBySlug);
   const tagLinks = renderTagLinks(previewData.content.tags, tagCountBySlug);
 
   return {
     posts,
+    pages,
     postBySlug,
     indexRoutes: buildPaginatedCollection({
       items: previewData.content.posts,
@@ -412,12 +421,30 @@ function createRenderData(previewData) {
   };
 }
 
-function preparePost(post, site, categoriesBySlug, tagsBySlug) {
+function preparePage(page) {
+  const documentType = normalizeDocumentType(page.document_type);
+
+  return {
+    ...page,
+    document_type: documentType,
+    html: renderDocumentContent(page.content, documentType),
+  };
+}
+
+function preparePost(post, site, authorsById, categoriesBySlug, tagsBySlug) {
+  const documentType = normalizeDocumentType(post.document_type);
+  const html = renderDocumentContent(post.content, documentType);
+  const author = authorsById.get(post.author_id);
+
   return {
     ...post,
+    document_type: documentType,
+    html,
+    author_name: normalizeNonEmptyString(author?.display_name, post.author_id),
+    author_avatar: author?.avatar,
     published_at: formatTimestamp(post.published_at_iso, site),
     updated_at: formatTimestamp(post.updated_at_iso, site),
-    reading_time: calculateReadingTime(post.html),
+    reading_time: calculateReadingTime(html),
     categories_html: renderInlineTaxonomyLinks(post.category_slugs, categoriesBySlug, 'category'),
     tags_html: renderInlineTaxonomyLinks(post.tag_slugs, tagsBySlug, 'tag'),
     comments_html: renderCommentsContainer(site, post),
@@ -774,6 +801,10 @@ function normalizeLocale(value) {
   }).join('-');
 }
 
+function normalizeDocumentType(value) {
+  return value === 'plaintext' || value === 'html' ? value : 'markdown';
+}
+
 function hasTemplate(state, templateName) {
   return state.engine.themePackage?.templates?.has(templateName) === true;
 }
@@ -1066,7 +1097,7 @@ function buildSitemapXml(site, emitted, generatedAt) {
   const body = entries.map((entry) => {
     const loc = escapeXml(resolveSiteUrl(site.url, entry.url));
     const lastmod = entry.lastmod
-      ? `\n    <lastmod>${entry.lastmod.toISOString()}</lastmod>`
+      ? `\n    <lastmod>${formatUtcIsoSeconds(entry.lastmod)}</lastmod>`
       : '';
     return `  <url>\n    <loc>${loc}</loc>${lastmod}\n    <changefreq>${entry.changefreq}</changefreq>\n    <priority>${entry.priority.toFixed(1)}</priority>\n  </url>`;
   }).join('\n');
@@ -1118,7 +1149,7 @@ function buildMetaJson(site, emitted, generatedAt) {
   ];
 
   return JSON.stringify({
-    generated: generatedAt.toISOString(),
+    generated: formatUtcIsoSeconds(generatedAt),
     site: {
       title: site.title,
       description: site.description,
@@ -1199,6 +1230,14 @@ function toDate(value) {
   return value ? new Date(value) : new Date();
 }
 
+function formatUtcIsoSeconds(value) {
+  return toDate(value).toISOString().replace(/\.\d{3}Z$/, 'Z');
+}
+
+function normalizeIsoTimestamp(value) {
+  return value ? formatUtcIsoSeconds(value) : '';
+}
+
 function escapeXml(str) {
   return String(str || '')
     .replace(/&/g, '&amp;')

package/src/index.d.ts

@@ -1,4 +1,4 @@
-import type { PreviewDataV04 } from '@zeropress/preview-data-validator';
+import type { PreviewDataV05 } from '@zeropress/preview-data-validator';
 
 export interface ThemePackage {
   metadata: {
@@ -62,14 +62,14 @@ export interface BuildSiteResult {
 }
 
 export function buildSite(input: {
-  previewData: PreviewDataV04;
+  previewData: PreviewDataV05;
   themePackage: ThemePackage;
   writer: BuildWriter;
   options?: BuildOptions;
 }): Promise<BuildSiteResult>;
 
 export function buildSelectedRoutes(input: {
-  previewData: PreviewDataV04;
+  previewData: PreviewDataV05;
   themePackage: ThemePackage;
   writer: BuildWriter;
   selection: BuildSelection;
@@ -77,7 +77,7 @@ export function buildSelectedRoutes(input: {
 }): Promise<BuildSiteResult>;
 
 export function buildSiteFromThemeDir(input: {
-  previewData: PreviewDataV04;
+  previewData: PreviewDataV05;
   themeDir: string;
   writer: BuildWriter;
   options?: BuildOptions;

package/src/render/content-renderer.js

@@ -0,0 +1,156 @@
+import MarkdownIt from 'markdown-it';
+import hljs from 'highlight.js';
+import anchor from 'markdown-it-anchor';
+
+const markdown = new MarkdownIt({
+  html: true,
+  linkify: true,
+  typographer: true,
+  breaks: true,
+  highlight(value, language) {
+    if (language && hljs.getLanguage(language)) {
+      try {
+        return hljs.highlight(value, { language }).value;
+      } catch {
+        return value;
+      }
+    }
+
+    try {
+      return hljs.highlightAuto(value).value;
+    } catch {
+      return value;
+    }
+  },
+});
+
+markdown.use(anchor, {
+  permalink: anchor.permalink.headerLink(),
+  slugify: slugify,
+});
+
+export function renderDocumentContent(content, documentType = 'markdown') {
+  const normalizedContent = typeof content === 'string' ? content : '';
+  const normalizedType = normalizeDocumentType(documentType);
+
+  if (normalizedType === 'plaintext') {
+    return transformPlaintext(normalizedContent);
+  }
+
+  if (normalizedType === 'html') {
+    return sanitizeHtml(normalizedContent);
+  }
+
+  return sanitizeHtml(markdown.render(normalizedContent));
+}
+
+function normalizeDocumentType(value) {
+  return value === 'plaintext' || value === 'html' ? value : 'markdown';
+}
+
+function transformPlaintext(content) {
+  const escaped = content
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+
+  const paragraphs = escaped
+    .split(/\n\s*\n/)
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+
+  if (paragraphs.length === 0) {
+    return '';
+  }
+
+  return paragraphs.map((entry) => `<p>${entry}</p>`).join('\n');
+}
+
+function sanitizeHtml(html) {
+  const allowedTags = new Set([
+    'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+    'p', 'br', 'hr',
+    'strong', 'em', 'u', 's', 'code', 'pre',
+    'a', 'img',
+    'ul', 'ol', 'li',
+    'blockquote',
+    'table', 'thead', 'tbody', 'tr', 'th', 'td',
+    'div', 'span', 'nav',
+    'iframe',
+  ]);
+
+  const allowedAttributes = {
+    a: new Set(['href', 'title', 'class', 'id']),
+    img: new Set(['src', 'alt', 'title', 'class', 'id', 'width', 'height']),
+    iframe: new Set(['src', 'width', 'height', 'frameborder', 'allowfullscreen', 'class']),
+    '*': new Set(['class', 'id']),
+  };
+
+  const safeUriPattern = /^(?:(?:https?|mailto|tel):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i;
+
+  const stripped = html
+    .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, '')
+    .replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, '');
+
+  const sanitized = stripped.replace(/<\/?([a-zA-Z][a-zA-Z0-9]*)\b([^>]*)?\/?>/g, (match, tag, attributeString) => {
+    const normalizedTag = tag.toLowerCase();
+
+    if (match.startsWith('</')) {
+      return allowedTags.has(normalizedTag) ? `</${normalizedTag}>` : '';
+    }
+
+    if (!allowedTags.has(normalizedTag)) {
+      return '';
+    }
+
+    const tagAllowedAttributes = allowedAttributes[normalizedTag] || new Set();
+    const globalAllowedAttributes = allowedAttributes['*'];
+    const filteredAttributes = [];
+
+    if (attributeString) {
+      const attributePattern = /([a-zA-Z][a-zA-Z0-9-]*)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|(\S+)))?/g;
+      let attributeMatch;
+
+      while ((attributeMatch = attributePattern.exec(attributeString)) !== null) {
+        const attributeName = attributeMatch[1].toLowerCase();
+        const attributeValue = attributeMatch[2] ?? attributeMatch[3] ?? attributeMatch[4] ?? '';
+
+        if (!tagAllowedAttributes.has(attributeName) && !globalAllowedAttributes.has(attributeName)) {
+          continue;
+        }
+
+        if ((attributeName === 'href' || attributeName === 'src') && !safeUriPattern.test(attributeValue)) {
+          continue;
+        }
+
+        filteredAttributes.push(`${attributeName}="${attributeValue}"`);
+      }
+    }
+
+    const isSelfClosing = match.endsWith('/>') || normalizedTag === 'br' || normalizedTag === 'hr' || normalizedTag === 'img';
+    const attributeSuffix = filteredAttributes.length > 0 ? ` ${filteredAttributes.join(' ')}` : '';
+    return isSelfClosing ? `<${normalizedTag}${attributeSuffix} />` : `<${normalizedTag}${attributeSuffix}>`;
+  });
+
+  return sanitized
+    .split(/(<[^>]+>)/g)
+    .map((part) => {
+      if (part.startsWith('<') && part.endsWith('>')) {
+        return part;
+      }
+
+      return part.replace(/&(?!(?:[a-zA-Z]+|#\d+|#x[0-9a-fA-F]+);)/g, '&amp;');
+    })
+    .join('');
+}
+
+function slugify(value) {
+  return String(value || '')
+    .toLowerCase()
+    .trim()
+    .replace(/[^\w\s-]/g, '')
+    .replace(/[\s_-]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+}