@zeropress/build-core 0.6.13 → 0.7.1

package/src/assets/asset-processor.js

@@ -1,19 +1,6 @@
 import { createHash } from 'node:crypto';
 
 export class AssetProcessor {
-  async processCSS(css) {
-    return css
-      .replace(/\/\*[\s\S]*?\*\//g, '')
-      .replace(/\s+/g, ' ')
-      .replace(/\s*([{}:;,>+~])\s*/g, '$1')
-      .replace(/;}/g, '}')
-      .trim();
-  }
-
-  async processJavaScript(js) {
-    return js;
-  }
-
   generateAssetHash(content) {
     const hash = createHash('sha256');
     hash.update(content);

package/src/index.d.ts

@@ -1,4 +1,4 @@
-import type { PreviewDataV06 } from '@zeropress/preview-data-validator';
+import type { PreviewDataV07 } from '@zeropress/preview-data-validator';
 import type { ThemeManifest } from '@zeropress/theme-validator';
 
 export interface ThemePackage {
@@ -24,17 +24,55 @@ export interface BuildOptions {
   assetHashing?: boolean;
   favicon?: {
     icon?: string;
+    icon_dark?: string;
     svg?: string;
     png?: string;
     apple_touch_icon?: string;
   };
   sitemapStylesheetHref?: string;
-  generateSpecialFiles?: boolean;
   generateFeed?: boolean;
   generateRobotsTxt?: boolean;
-  writeManifest?: boolean;
+  reservedOutputPaths?: readonly string[];
 }
 
+export interface DisabledThemeCommentsContext {
+  enabled: false;
+}
+
+export interface ThemeCommentsThreadingContext {
+  enabled: boolean;
+  max_depth: number;
+}
+
+export interface ZeroPressThemeCommentsContext {
+  enabled: true;
+  target_type: 'post' | 'page';
+  target_public_id: number;
+  provider: 'zeropress';
+  api_base_url: string;
+  per_page: number;
+  order: 'asc' | 'desc';
+  threading: ThemeCommentsThreadingContext;
+  request_token: string;
+}
+
+export interface WordPressThemeCommentsContext {
+  enabled: true;
+  target_type: 'post' | 'page';
+  target_public_id: number;
+  provider: 'wordpress';
+  api_base_url: string;
+  per_page: number;
+  order: 'asc' | 'desc';
+  threading: ThemeCommentsThreadingContext;
+  request_token?: never;
+}
+
+export type ThemeCommentsContext =
+  | DisabledThemeCommentsContext
+  | ZeroPressThemeCommentsContext
+  | WordPressThemeCommentsContext;
+
 export interface BuildSummaryFile {
   path: string;
   contentType: string;
@@ -42,25 +80,19 @@ export interface BuildSummaryFile {
   sha256: string;
 }
 
-export interface BuildManifest {
-  generatedAt: string;
-  files: BuildSummaryFile[];
-}
-
 export interface BuildSiteResult {
   files: BuildSummaryFile[];
-  manifest?: BuildManifest;
 }
 
 export function buildSite(input: {
-  previewData: PreviewDataV06;
+  previewData: PreviewDataV07;
   themePackage: ThemePackage;
   writer: BuildWriter;
   options?: BuildOptions;
 }): Promise<BuildSiteResult>;
 
 export function buildSiteFromThemeDir(input: {
-  previewData: PreviewDataV06;
+  previewData: PreviewDataV07;
   themeDir: string;
   writer: BuildWriter;
   options?: BuildOptions;

package/src/render/content-renderer.js

@@ -1,6 +1,7 @@
 import MarkdownIt from 'markdown-it';
 import hljs from 'highlight.js';
 import anchor from 'markdown-it-anchor';
+import sanitizeHtmlParser from 'sanitize-html';
 
 const TOC_LEVELS = new Set([2, 3, 4]);
 const ALERT_TYPES = new Map([
@@ -19,6 +20,57 @@ const ADMONITION_CONTAINER_TYPES = new Map([
   ['CAUTION', { className: 'caution', title: 'Caution' }],
   ['DANGER', { className: 'caution', title: 'Danger' }],
 ]);
+const CONTENT_ALLOWED_TAGS = [
+  'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
+  'p', 'br', 'hr',
+  'strong', 'b', 'em', 'u', 's', 'sup', 'sub', 'code', 'pre',
+  'a', 'img',
+  'ul', 'ol', 'li',
+  'blockquote', 'aside',
+  'figure', 'figcaption', 'picture', 'source',
+  'video', 'audio', 'track',
+  'table', 'thead', 'tbody', 'tr', 'th', 'td',
+  'div', 'span', 'nav',
+  'iframe', 'input',
+];
+const CONTENT_ALLOWED_ATTRIBUTES = {
+  a: ['href', 'title', 'class', 'id', 'target', 'rel'],
+  aside: ['role', 'class', 'id'],
+  img: ['src', 'srcset', 'sizes', 'alt', 'title', 'class', 'id', 'width', 'height', 'loading', 'decoding'],
+  iframe: ['src', 'width', 'height', 'frameborder', 'allowfullscreen', 'class', 'title'],
+  input: ['type', 'checked', 'disabled', 'class', 'id', 'aria-label'],
+  source: ['src', 'srcset', 'sizes', 'type', 'media', 'width', 'height', 'class', 'id'],
+  th: ['rowspan', 'colspan', 'align', 'class', 'id'],
+  td: ['rowspan', 'colspan', 'align', 'class', 'id'],
+  video: ['src', 'controls', 'controlslist', 'autoplay', 'loop', 'muted', 'playsinline', 'poster', 'preload', 'width', 'height', 'class', 'id', 'title'],
+  audio: ['src', 'controls', 'controlslist', 'autoplay', 'loop', 'muted', 'preload', 'class', 'id', 'title'],
+  track: ['src', 'kind', 'srclang', 'label', 'default', 'class', 'id'],
+  '*': ['class', 'id'],
+};
+const CONTENT_SANITIZER_OPTIONS = {
+  allowedTags: CONTENT_ALLOWED_TAGS,
+  allowedAttributes: CONTENT_ALLOWED_ATTRIBUTES,
+  allowedSchemes: ['http', 'https'],
+  allowedSchemesByTag: {
+    a: ['http', 'https', 'mailto', 'tel'],
+  },
+  allowedSchemesAppliedToAttributes: ['href', 'src', 'poster'],
+  allowProtocolRelative: false,
+  allowIframeRelativeUrls: true,
+  parseStyleAttributes: false,
+  selfClosing: ['img', 'br', 'hr', 'input', 'source', 'track'],
+  nonTextTags: ['script', 'style', 'textarea', 'option', 'xmp'],
+  transformTags: {
+    a: transformAnchor,
+    th: transformTableCell,
+    td: transformTableCell,
+    video: transformNativeMedia,
+    audio: transformNativeMedia,
+  },
+  exclusiveFilter(frame) {
+    return frame.tag === 'input' && frame.attribs.type !== 'checkbox';
+  },
+};
 
 export function renderDocumentContent(content, documentType = 'markdown') {
   return renderDocument(content, documentType).html;
@@ -429,178 +481,68 @@ function escapeHtml(value) {
 }
 
 function sanitizeHtml(html) {
-  const allowedTags = new Set([
-    'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
-    'p', 'br', 'hr',
-    'strong', 'b', 'em', 'u', 's', 'sup', 'sub', 'code', 'pre',
-    'a', 'img',
-    'ul', 'ol', 'li',
-    'blockquote', 'aside',
-    'figure', 'figcaption', 'picture', 'source',
-    'video', 'audio', 'track',
-    'table', 'thead', 'tbody', 'tr', 'th', 'td',
-    'div', 'span', 'nav',
-    'iframe', 'input',
-  ]);
-
-  const allowedAttributes = {
-    a: new Set(['href', 'title', 'class', 'id', 'target', 'rel']),
-    aside: new Set(['role', 'class', 'id']),
-    img: new Set(['src', 'srcset', 'sizes', 'alt', 'title', 'class', 'id', 'width', 'height', 'loading', 'decoding']),
-    iframe: new Set(['src', 'width', 'height', 'frameborder', 'allowfullscreen', 'class', 'title']),
-    input: new Set(['type', 'checked', 'disabled', 'class', 'id', 'aria-label']),
-    source: new Set(['src', 'srcset', 'sizes', 'type', 'media', 'width', 'height', 'class', 'id']),
-    th: new Set(['rowspan', 'colspan', 'align', 'class', 'id']),
-    td: new Set(['rowspan', 'colspan', 'align', 'class', 'id']),
-    video: new Set(['src', 'controls', 'controlslist', 'autoplay', 'loop', 'muted', 'playsinline', 'poster', 'preload', 'width', 'height', 'class', 'id', 'title']),
-    audio: new Set(['src', 'controls', 'controlslist', 'autoplay', 'loop', 'muted', 'preload', 'class', 'id', 'title']),
-    track: new Set(['src', 'kind', 'srclang', 'label', 'default', 'class', 'id']),
-    '*': new Set(['class', 'id']),
-  };
-
-  const safeUriPattern = /^(?:(?:https?|mailto|tel):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i;
-
-  const stripped = html
-    .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, '')
-    .replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, '');
-
-  const sanitized = stripped.replace(/<\/?([a-zA-Z][a-zA-Z0-9]*)\b([^>]*)?\/?>/g, (match, tag, attributeString) => {
-    const normalizedTag = tag.toLowerCase();
-
-    if (match.startsWith('</')) {
-      return allowedTags.has(normalizedTag) ? `</${normalizedTag}>` : '';
-    }
-
-    if (!allowedTags.has(normalizedTag)) {
-      return '';
-    }
-
-    const tagAllowedAttributes = allowedAttributes[normalizedTag] || new Set();
-    const globalAllowedAttributes = allowedAttributes['*'];
-    const filteredAttributes = [];
-    let anchorTarget = '';
-    let anchorRel = '';
-    let tableCellAlignClass = '';
-
-    if (attributeString) {
-      const attributePattern = /([a-zA-Z][a-zA-Z0-9-]*)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|(\S+)))?/g;
-      let attributeMatch;
-
-      while ((attributeMatch = attributePattern.exec(attributeString)) !== null) {
-        const attributeName = attributeMatch[1].toLowerCase();
-        const attributeValue = attributeMatch[2] ?? attributeMatch[3] ?? attributeMatch[4] ?? '';
-
-        if (!tagAllowedAttributes.has(attributeName) && !globalAllowedAttributes.has(attributeName)) {
-          continue;
-        }
-
-        if ((attributeName === 'href' || attributeName === 'src' || attributeName === 'poster') && !safeUriPattern.test(attributeValue)) {
-          continue;
-        }
-
-        if (normalizedTag === 'a' && attributeName === 'target') {
-          const target = sanitizeAnchorTarget(attributeValue);
-          if (!target) {
-            continue;
-          }
-          anchorTarget = target;
-          continue;
-        }
-
-        if (normalizedTag === 'a' && attributeName === 'rel') {
-          const rel = sanitizeRelList(attributeValue);
-          if (!rel) {
-            continue;
-          }
-          anchorRel = rel;
-          continue;
-        }
-
-        if (attributeName === 'srcset' && !isSafeSrcset(attributeValue, safeUriPattern)) {
-          continue;
-        }
-
-        if (attributeName === 'controlslist') {
-          const controlsList = sanitizeControlsList(attributeValue);
-          if (!controlsList) {
-            continue;
-          }
-          filteredAttributes.push(`${attributeName}="${controlsList}"`);
-          continue;
-        }
+  return sanitizeHtmlParser(html, CONTENT_SANITIZER_OPTIONS);
+}
 
-        if ((normalizedTag === 'th' || normalizedTag === 'td') && (attributeName === 'rowspan' || attributeName === 'colspan')) {
-          const span = sanitizePositiveIntegerAttribute(attributeValue);
-          if (!span) {
-            continue;
-          }
-          filteredAttributes.push(`${attributeName}="${span}"`);
-          continue;
-        }
+function transformAnchor(tagName, attributes) {
+  const transformed = { ...attributes };
+  const target = sanitizeAnchorTarget(transformed.target);
+  const rel = sanitizeRelList(transformed.rel);
 
-        if ((normalizedTag === 'th' || normalizedTag === 'td') && attributeName === 'align') {
-          const alignment = sanitizeTableAlignment(attributeValue);
-          if (!alignment) {
-            continue;
-          }
-          tableCellAlignClass = `zp-align-${alignment}`;
-          continue;
-        }
+  if (target) {
+    transformed.target = target;
+  } else {
+    delete transformed.target;
+  }
 
-        if (normalizedTag === 'input' && attributeName === 'type' && attributeValue !== 'checkbox') {
-          continue;
-        }
+  const safeRel = target === '_blank' ? ensureBlankTargetRel(rel) : rel;
+  if (safeRel) {
+    transformed.rel = safeRel;
+  } else {
+    delete transformed.rel;
+  }
 
-        filteredAttributes.push(`${attributeName}="${attributeValue}"`);
-      }
-    }
+  return { tagName, attribs: transformed };
+}
 
-    if (tableCellAlignClass) {
-      appendClassAttribute(filteredAttributes, tableCellAlignClass);
-    }
+function transformTableCell(tagName, attributes) {
+  const transformed = { ...attributes };
 
-    if (normalizedTag === 'a') {
-      if (anchorTarget) {
-        filteredAttributes.push(`target="${anchorTarget}"`);
-      }
-      if (anchorTarget === '_blank') {
-        anchorRel = ensureBlankTargetRel(anchorRel);
-      }
-      if (anchorRel) {
-        filteredAttributes.push(`rel="${anchorRel}"`);
-      }
+  for (const attributeName of ['rowspan', 'colspan']) {
+    const value = sanitizePositiveIntegerAttribute(transformed[attributeName]);
+    if (value) {
+      transformed[attributeName] = value;
+    } else {
+      delete transformed[attributeName];
     }
+  }
 
-    const isSelfClosing = match.endsWith('/>') || normalizedTag === 'br' || normalizedTag === 'hr' || normalizedTag === 'img' || normalizedTag === 'input' || normalizedTag === 'source' || normalizedTag === 'track';
-    const attributeSuffix = filteredAttributes.length > 0 ? ` ${filteredAttributes.join(' ')}` : '';
-    return isSelfClosing ? `<${normalizedTag}${attributeSuffix} />` : `<${normalizedTag}${attributeSuffix}>`;
-  });
-
-  return sanitized
-    .split(/(<[^>]+>)/g)
-    .map((part) => {
-      if (part.startsWith('<') && part.endsWith('>')) {
-        return part;
-      }
+  const alignment = sanitizeTableAlignment(transformed.align);
+  delete transformed.align;
+  if (alignment) {
+    transformed.class = appendClassName(transformed.class, `zp-align-${alignment}`);
+  }
 
-      return part.replace(/&(?!(?:[a-zA-Z]+|#\d+|#x[0-9a-fA-F]+);)/g, '&amp;');
-    })
-    .join('');
+  return { tagName, attribs: transformed };
 }
 
-function appendClassAttribute(attributes, className) {
-  const classIndex = attributes.findIndex((attribute) => attribute.startsWith('class="'));
-  if (classIndex === -1) {
-    attributes.push(`class="${className}"`);
-    return;
+function transformNativeMedia(tagName, attributes) {
+  const transformed = { ...attributes };
+  const controlsList = sanitizeControlsList(transformed.controlslist);
+  if (controlsList) {
+    transformed.controlslist = controlsList;
+  } else {
+    delete transformed.controlslist;
   }
+  return { tagName, attribs: transformed };
+}
 
-  const existingValue = attributes[classIndex].slice('class="'.length, -1);
-  const classes = existingValue.split(/\s+/).filter(Boolean);
+function appendClassName(value, className) {
+  const classes = String(value || '').split(/\s+/).filter(Boolean);
   if (!classes.includes(className)) {
     classes.push(className);
   }
-  attributes[classIndex] = `class="${classes.join(' ')}"`;
+  return classes.join(' ');
 }
 
 function sanitizePositiveIntegerAttribute(value) {
@@ -668,18 +610,6 @@ function sanitizeControlsList(value) {
   return tokens.join(' ');
 }
 
-function isSafeSrcset(value, safeUriPattern) {
-  const candidates = String(value)
-    .split(',')
-    .map((candidate) => candidate.trim())
-    .filter(Boolean);
-
-  return candidates.length > 0 && candidates.every((candidate) => {
-    const [url] = candidate.split(/\s+/);
-    return Boolean(url) && safeUriPattern.test(url);
-  });
-}
-
 function slugify(value) {
   return String(value || '')
     .toLowerCase()

package/src/render/control-flow-renderer.js

@@ -229,6 +229,9 @@ export class ControlFlowRenderer {
 
       if (token.startsWith('/')) {
         const tagName = token.slice(1).trim();
+        if (COMPARISON_BLOCK_TAGS.has(tagName)) {
+          throw new Error(`Named conditional closing tag {{/${tagName}}} is not supported; use {{/if}}`);
+        }
         if (!stopTags.has(tagName)) {
           throw new Error(`Unexpected closing tag /${tagName}`);
         }
@@ -370,8 +373,8 @@ export class ControlFlowRenderer {
     let alternate = [];
     let nextIndex = startIndex;
     let currentBranch = initialBranch;
-    const comparisonStopTags = new Set(['else', 'if', tagName, ...COMPARISON_ELSE_IF_TAGS]);
-    const comparisonCloseTags = new Set(['if', tagName]);
+    const comparisonStopTags = new Set(['else', 'if', ...COMPARISON_ELSE_IF_TAGS]);
+    const comparisonCloseTags = new Set(['if']);
 
     while (true) {
       const branchResult = this.parseNodes(source, nextIndex, comparisonStopTags, partialArgScope);

package/src/render/variable-resolver.js

@@ -94,7 +94,12 @@ export class VariableResolver {
       }
     }
 
-    if (variablePath === 'data' || variablePath.startsWith('data.') || variablePath.includes('.data.')) {
+    if (
+      variablePath === 'data'
+      || variablePath.startsWith('data.')
+      || variablePath.includes('.data.')
+      || variablePath.includes('.meta.')
+    ) {
       return false;
     }
 

package/src/render/zeropress-engine.js

@@ -1,3 +1,4 @@
+import { DEFAULT_RUNTIME } from '@zeropress/theme-validator';
 import { SlotResolver } from './slot-resolver.js';
 import { VariableResolver } from './variable-resolver.js';
 import { ControlFlowRenderer } from './control-flow-renderer.js';
@@ -46,11 +47,12 @@ export class ZeroPressEngine {
       site: context.site,
       currentUrl: context.currentUrl,
       language: context.language,
+      comments: context.comments,
     };
   }
 
   renderTemplate(template, data) {
-    if (this.themePackage?.metadata?.runtime !== '0.6') {
+    if (this.themePackage?.metadata?.runtime !== DEFAULT_RUNTIME) {
       throw new Error(`Unsupported theme runtime: ${this.themePackage?.metadata?.runtime || 'unknown'}`);
     }
 

package/src/theme/format-theme-validation.js

@@ -0,0 +1,54 @@
+export function formatThemeValidationFailure(validation) {
+  const blocks = [
+    [
+      'Theme validation failed',
+      `Errors: ${validation.errors.length}`,
+      `Checked files: ${validation.checkedFiles}`,
+    ].join('\n'),
+    ...validation.errors.map((issue) => formatThemeValidationIssue(issue)),
+  ];
+  return blocks.join('\n\n');
+}
+
+function formatThemeValidationIssue(issue) {
+  if (!issue) {
+    return 'Reason: Unknown error';
+  }
+
+  const lines = [`ERROR ${issue.code || 'THEME_VALIDATION_ERROR'}`];
+  const location = splitIssuePath(issue.path);
+  if (location.file) {
+    lines.push(`File: ${location.file}`);
+  }
+  if (location.path) {
+    lines.push(`Path: ${location.path}`);
+  }
+  if (Number.isInteger(issue.line) && Number.isInteger(issue.column)) {
+    lines.push(`Line: ${issue.line}, Column: ${issue.column}`);
+  }
+  if (issue.category) {
+    lines.push(`Category: ${issue.category}`);
+  }
+  lines.push(`Reason: ${issue.message || 'Unknown error'}`);
+  if (issue.snippet) {
+    const lineLabel = Number.isInteger(issue.line) ? String(issue.line) : '';
+    lines.push('', `${lineLabel} | ${issue.snippet.line}`, `${' '.repeat(lineLabel.length)} | ${issue.snippet.pointer}`);
+  }
+  if (issue.hint) {
+    lines.push('', 'Hint:', issue.hint);
+  }
+
+  return lines.join('\n');
+}
+
+function splitIssuePath(issuePath) {
+  const normalizedPath = String(issuePath || '');
+  if (normalizedPath.startsWith('theme.json.')) {
+    return {
+      file: 'theme.json',
+      path: normalizedPath.slice('theme.json.'.length),
+    };
+  }
+
+  return { file: normalizedPath, path: '' };
+}