@zeropress/build-core 0.7.3 → 0.7.4

package/README.md

@@ -121,6 +121,9 @@ Loads a theme directory from disk and renders it using the same core pipeline.
 
 This is useful for local tooling that wants filesystem theme loading but still uses the same deterministic core renderer.
 
+Theme validation failures from either build entry point carry `error.code === 'THEME_VALIDATION_FAILED'`.
+Their messages preserve report and hint line breaks while escaping terminal control characters in diagnostic values such as paths, messages, and source snippets. CLI consumers can preserve the layout of these reports while escaping arbitrary errors as single-line text.
+
 ## Writers
 
 ### `MemoryWriter`
@@ -171,7 +174,7 @@ Theme CSS and JavaScript assets are emitted byte-for-byte as provided. `custom_c
 
 User-defined scalar metadata under `site.meta`, `post.meta`, `page.meta`, and item `meta` is always HTML-escaped during template interpolation. Names ending in `_html` or `_url` do not opt metadata into raw rendering; use the explicit content and custom HTML contracts for trusted raw markup.
 
-Post/Page HTML, Markdown raw HTML, and text-widget HTML pass through a parser-based explicit allowlist. Safe structural, media, table, task-list, and alert markup is retained; event handlers and unsafe URL schemes are removed. Links permit relative URLs, HTTP(S), `mailto:`, and `tel:`. Media and iframe URLs permit relative URLs or HTTP(S), and protocol-relative URLs are rejected. Each `srcset` candidate is checked independently. This sanitizer boundary does not include trusted `custom_html` slots or `standalone_html`, which remain intentionally unchanged.
+Post/Page HTML, Markdown raw HTML, and text-widget HTML pass through a parser-based explicit allowlist. Safe structural, media, table, task-list, and alert markup is retained; event handlers and unsafe URL schemes are removed. Inline presentation is limited to `text-align: left | center | right | justify` on paragraphs/headings and bounded CSS `color` values on spans; every other inline style is removed. Links permit relative URLs, HTTP(S), `mailto:`, and `tel:`. Media and iframe URLs permit relative URLs or HTTP(S), and protocol-relative URLs are rejected. Each `srcset` candidate is checked independently. This sanitizer boundary does not include trusted `custom_html` slots or `standalone_html`, which remain intentionally unchanged.
 
 Build-core derives:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeropress/build-core",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Shared ZeroPress build core",
   "type": "module",
   "license": "MIT",
@@ -33,12 +33,12 @@
     "node": ">=22.22.0"
   },
   "dependencies": {
-    "@zeropress/slug-policy": "0.2.1",
+    "@zeropress/slug-policy": "0.2.2",
     "@zeropress/preview-data-validator": "0.7.3",
     "@zeropress/theme-validator": "0.7.3",
     "highlight.js": "11.12.0",
-    "markdown-it": "15.0.0",
-    "markdown-it-anchor": "9.2.1",
+    "markdown-it": "15.0.2",
+    "markdown-it-anchor": "10.0.0",
     "sanitize-html": "2.17.7"
   }
 }

package/src/api/build-site.js

@@ -5,7 +5,7 @@ import { validateThemeFiles } from '@zeropress/theme-validator';
 import sanitizeHtml from 'sanitize-html';
 import { AssetProcessor } from '../assets/asset-processor.js';
 import { renderDocument, renderDocumentContent } from '../render/content-renderer.js';
-import { formatThemeValidationFailure } from '../theme/format-theme-validation.js';
+import { createThemeValidationError } from '../theme/format-theme-validation.js';
 import { ZeroPressEngine } from '../render/zeropress-engine.js';
 
 const DEFAULT_OPTIONS = {
@@ -2248,7 +2248,7 @@ async function normalizeAndValidateThemePackage(themePackage) {
 
   const validation = await validateThemeFiles(fileMap);
   if (!validation.ok) {
-    throw new Error(formatThemeValidationFailure(validation));
+    throw createThemeValidationError(validation);
   }
 
   if (!validation.manifest) {

package/src/render/content-renderer.js

@@ -34,6 +34,14 @@ const CONTENT_ALLOWED_TAGS = [
   'iframe', 'input',
 ];
 const CONTENT_ALLOWED_ATTRIBUTES = {
+  h1: ['style'],
+  h2: ['style'],
+  h3: ['style'],
+  h4: ['style'],
+  h5: ['style'],
+  h6: ['style'],
+  p: ['style'],
+  span: ['style'],
   a: ['href', 'title', 'class', 'id', 'target', 'rel'],
   aside: ['role', 'class', 'id'],
   img: ['src', 'srcset', 'sizes', 'alt', 'title', 'class', 'id', 'width', 'height', 'loading', 'decoding'],
@@ -47,6 +55,8 @@ const CONTENT_ALLOWED_ATTRIBUTES = {
   track: ['src', 'kind', 'srclang', 'label', 'default', 'class', 'id'],
   '*': ['class', 'id'],
 };
+const CONTENT_COLOR_STYLE_PATTERN = /^(?:#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})|[a-z]{1,32}|(?:rgb|rgba|hsl|hsla)\((?:[-+.\d%,/\s]|deg|rad|grad|turn)+\))$/i;
+const CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN = /^(?:left|center|right|justify)$/i;
 const CONTENT_SANITIZER_OPTIONS = {
   allowedTags: CONTENT_ALLOWED_TAGS,
   allowedAttributes: CONTENT_ALLOWED_ATTRIBUTES,
@@ -57,7 +67,17 @@ const CONTENT_SANITIZER_OPTIONS = {
   allowedSchemesAppliedToAttributes: ['href', 'src', 'poster'],
   allowProtocolRelative: false,
   allowIframeRelativeUrls: true,
-  parseStyleAttributes: false,
+  allowedStyles: {
+    h1: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    h2: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    h3: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    h4: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    h5: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    h6: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    p: { 'text-align': [CONTENT_TEXT_ALIGNMENT_STYLE_PATTERN] },
+    span: { color: [CONTENT_COLOR_STYLE_PATTERN] },
+  },
+  parseStyleAttributes: true,
   selfClosing: ['img', 'br', 'hr', 'input', 'source', 'track'],
   nonTextTags: ['script', 'style', 'template', 'noscript', 'textarea', 'option', 'xmp'],
   transformTags: {

package/src/theme/format-theme-validation.js

@@ -1,9 +1,17 @@
+const UNSAFE_TERMINAL_CHARACTER_REGEX = /[\u0000-\u001f\u007f-\u009f\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/gu;
+
+export function createThemeValidationError(validation) {
+  return Object.assign(new Error(formatThemeValidationFailure(validation)), {
+    code: 'THEME_VALIDATION_FAILED',
+  });
+}
+
 export function formatThemeValidationFailure(validation) {
   const blocks = [
     [
       'Theme validation failed',
       `Errors: ${validation.errors.length}`,
-      `Checked files: ${validation.checkedFiles}`,
+      `Checked files: ${toTerminalSafeText(validation.checkedFiles)}`,
     ].join('\n'),
     ...validation.errors.map((issue) => formatThemeValidationIssue(issue)),
   ];
@@ -15,32 +23,38 @@ function formatThemeValidationIssue(issue) {
     return 'Reason: Unknown error';
   }
 
-  const lines = [`ERROR ${issue.code || 'THEME_VALIDATION_ERROR'}`];
+  const lines = [`ERROR ${toTerminalSafeText(issue.code || 'THEME_VALIDATION_ERROR')}`];
   const location = splitIssuePath(issue.path);
   if (location.file) {
-    lines.push(`File: ${location.file}`);
+    lines.push(`File: ${toTerminalSafeText(location.file)}`);
   }
   if (location.path) {
-    lines.push(`Path: ${location.path}`);
+    lines.push(`Path: ${toTerminalSafeText(location.path)}`);
   }
   if (Number.isInteger(issue.line) && Number.isInteger(issue.column)) {
     lines.push(`Line: ${issue.line}, Column: ${issue.column}`);
   }
   if (issue.category) {
-    lines.push(`Category: ${issue.category}`);
+    lines.push(`Category: ${toTerminalSafeText(issue.category)}`);
   }
-  lines.push(`Reason: ${issue.message || 'Unknown error'}`);
+  lines.push(`Reason: ${toTerminalSafeText(issue.message || 'Unknown error')}`);
   if (issue.snippet) {
     const lineLabel = Number.isInteger(issue.line) ? String(issue.line) : '';
-    lines.push('', `${lineLabel} | ${issue.snippet.line}`, `${' '.repeat(lineLabel.length)} | ${issue.snippet.pointer}`);
+    lines.push('', `${lineLabel} | ${toTerminalSafeText(issue.snippet.line)}`, `${' '.repeat(lineLabel.length)} | ${toTerminalSafeText(issue.snippet.pointer)}`);
   }
   if (issue.hint) {
-    lines.push('', 'Hint:', issue.hint);
+    lines.push('', 'Hint:', String(issue.hint).split('\n').map(toTerminalSafeText).join('\n'));
   }
 
   return lines.join('\n');
 }
 
+function toTerminalSafeText(value) {
+  return String(value ?? '').replace(UNSAFE_TERMINAL_CHARACTER_REGEX, (character) => (
+    `\\u${character.codePointAt(0).toString(16).toUpperCase().padStart(4, '0')}`
+  ));
+}
+
 function splitIssuePath(issuePath) {
   const normalizedPath = String(issuePath || '');
   if (normalizedPath.startsWith('theme.json.')) {

package/src/theme/load-theme-dir.js

@@ -2,7 +2,7 @@ import {
   validateThemeFiles,
   validateThemePackageLimits,
 } from '@zeropress/theme-validator';
-import { formatThemeValidationFailure } from './format-theme-validation.js';
+import { createThemeValidationError } from './format-theme-validation.js';
 
 const TEXT_FILE_EXTENSIONS = new Set(['.html', '.json', '.css', '.js', '.txt', '.svg', '.xml']);
 
@@ -47,7 +47,7 @@ export async function loadThemePackageFromDir(themeDir) {
     pathEntries: packageState.pathEntries,
   });
   if (!validation.ok) {
-    throw new Error(formatThemeValidationFailure(validation));
+    throw createThemeValidationError(validation);
   }
 
   const rawThemeJson = String(fileMap.get('theme.json'));
@@ -174,7 +174,7 @@ async function readThemeDir(fs, fsConstants, path, rootDir, currentDir, fileMap,
 }
 
 function createThemePathError(code, filePath, message, checkedFiles) {
-  return new Error(formatThemeValidationFailure({
+  return createThemeValidationError({
     errors: [{
       code,
       path: filePath,
@@ -183,7 +183,7 @@ function createThemePathError(code, filePath, message, checkedFiles) {
       category: 'theme_package_paths',
     }],
     checkedFiles,
-  }));
+  });
 }
 
 function assertThemePackageLimits(packageState) {
@@ -194,10 +194,10 @@ function assertThemePackageLimits(packageState) {
     return;
   }
 
-  throw new Error(formatThemeValidationFailure({
+  throw createThemeValidationError({
     errors,
     checkedFiles: packageState.fileSizes.size,
-  }));
+  });
 }
 
 function toUint8Array(value) {