hazo_blog 0.2.0 → 0.3.3

package/CHANGE_LOG.md

@@ -3,6 +3,54 @@
 All notable changes are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## 0.3.3 — 2026-07-06
+
+**`sanitizeMdx` hardened against raw WordPress HTML**
+
+Extends the sanitizer beyond HTML comments to cover three more parser-breaking patterns commonly
+found in imported WordPress post bodies. All run on the code-masked string, so fenced/inline code
+spans stay byte-for-byte untouched, and the transform remains idempotent.
+
+- **`<script>` / `<style>` blocks** — dropped entirely. Their bodies (JSON-LD, inline CSS) contain
+  raw `{ }` that MDX parses as a JS expression, throwing "Could not parse expression with acorn".
+  They carry no visible prose, so removing them never changes rendered output.
+- **HTML void elements** (`<img>`, `<br>`, `<hr>`, `<input>`, …) — normalized to self-closing
+  (`<img src="x" />`). Un-self-closed voids throw "Expected a closing tag" in MDX/JSX.
+- **String-valued `style="..."` / `style='...'` attributes** — dropped. Valid HTML but invalid JSX
+  (React requires the object form `style={{...}}`), else "The style prop expects a mapping … not a
+  string" at render. The JSX object form is deliberately left untouched.
+
+No API change — same `sanitizeMdx(mdx: string): string` signature. **Consumer note:** `^0.3.0`
+resolves to `0.3.3` (caret allows patch/minor within the same pre-1.0 minor).
+
+## 0.3.0 — 2026-06-12
+
+**Build resilience: sanitizer + async try/catch guard against malformed MDX**
+
+- `sanitizeMdx(mdx: string): string` — new public utility in `src/lib/text`. Converts HTML
+  comments (`<!-- ... -->`) to MDX comments (`{/* ... */}`) and escapes stray `<!` that are not
+  comment openers, leaving fenced and inline code blocks untouched. Idempotent. This is the
+  primary protection layer against the known crash class (HTML comments in post body that caused
+  `next build` to 500 site-wide on gotimer).
+- `BlogContent` is now an async server component. It calls `MDXRemote` directly with `await`
+  and wraps it in `try/catch`: a single malformed post logs an error and renders a "could not
+  be displayed" fallback instead of failing the whole SSG build.
+- `MdxErrorBoundary` — new exported client error boundary (`src/next/mdx-error-boundary.tsx`).
+  Available for consumers who want an additional client-side defence layer.
+- Write-time sanitize: `upsertBySlug` in `src/service` now runs `sanitizeMdx` before persisting,
+  so newly-saved posts are normalized at ingestion.
+- **Consumer note:** `^0.2.0` does not auto-resolve to `0.3.0` (pre-1.0 caret pins the minor).
+  Bump your dependency range to `^0.3.0` to receive this fix.
+
+## 0.2.0 — 2026-06-04
+
+**SQLite driver unification (breaking internal change; API unchanged)**
+
+Unified on native `better-sqlite3` (dropping `sql.js` fallback). Fixes the dual-engine 401
+auth bug where a fresh, uncheckpointed WAL key was invisible to the sql.js reader. Consumers
+who were using the `sql.js` adapter via `sqlite_driver` env-var are unaffected if they set
+`sqlite_driver=better-sqlite3` (now the only valid option). Config option removed.
+
 ## 0.1.0 — 2026-06-01
 
 Initial release. SEO-first blogging package extracted from gotimer.

package/README.md

@@ -204,13 +204,27 @@ const nextConfig = {
   the package's classes are compiled. The admin editor's styles load automatically
   via `hazo_ui`'s `MarkdownEditor`.
 
+### Build resilience
+
+`BlogContent` (≥ 0.3.0) is an async server component that catches MDX compilation errors with
+`try/catch`, so a single malformed post renders a graceful fallback instead of failing the whole
+`next build`. It also pre-sanitizes content with `sanitizeMdx` before passing it to the compiler.
+The sanitizer fixes the common ways raw WordPress HTML trips the MDX/acorn parser: converts HTML
+comments → MDX comments (and escapes stray `<!`), strips `<script>`/`<style>` blocks whose bodies
+break parsing, self-closes HTML void elements (`<img>`, `<br>`, …), and drops string-valued
+`style="..."` attributes (invalid JSX; the object form `style={{...}}` is left untouched). Fenced
+and inline code spans are left byte-for-byte untouched, and the transform is idempotent. The
+sanitizer is also available as a standalone export from `hazo_blog/lib` for custom rendering
+pipelines.
+
 ## Exports
 
 | Entry | Contents |
 |---|---|
 | `hazo_blog` | server: `createBlogService`, `createBlogRepository`, SEO builders, **route-handler factories** (React-free), types |
 | `hazo_blog/client` | client components: `PostCard`, `PostHero`, `AuthorBio`, `FaqSection`, `TableOfContents`, `RelatedPosts`, `BlogSearch`, `PostForm`, MDX components, `trackBlogEvent` |
-| `hazo_blog/next` | sealed page factories: public (`createBlogIndexPage`, `createBlogPostPage`, `createBlogTagPage`) + admin (`createBlogAdminListPage`, `createBlogAdminNewPage`, `createBlogAdminEditPage`) + `BlogContent` |
+| `hazo_blog/next` | sealed page factories: public (`createBlogIndexPage`, `createBlogPostPage`, `createBlogTagPage`) + admin (`createBlogAdminListPage`, `createBlogAdminNewPage`, `createBlogAdminEditPage`) + `BlogContent` + `MdxErrorBoundary` |
+| `hazo_blog/lib` | pure text utilities: `sanitizeMdx`, `mdxToPlainText`, `buildExcerpt`, `slugify`, `calculateReadingTime`, `extractToc` |
 | `hazo_blog/seo` | `buildBlogPostingJsonLd`, `buildBreadcrumbJsonLd`, `buildFaqJsonLd`, `getBlogSitemapEntries`, `getBlogRobotsRules`, `getBlogRssXml` |
 | `hazo_blog/config` | `BlogConfig` types + `resolveConfig` |
 

package/dist/lib/text.d.ts

@@ -22,4 +22,34 @@ export interface TocHeading {
     id: string;
 }
 export declare function extractToc(mdx: string): TocHeading[];
+/**
+ * Make raw MDX safe to compile. Raw WordPress HTML stored as post content
+ * trips the MDX/acorn parser in a handful of unambiguously-fixable ways:
+ *
+ * 1. HTML comments — MDX has none, so a bare `<!--` makes the parser expect
+ *    a JSX tag name after `<` and throw "Unexpected character `!` before
+ *    name". Converted to MDX comments ({/*…*\/}, equally non-rendering).
+ * 2. `<script>`/`<style>` blocks — their bodies (JSON-LD, inline CSS)
+ *    contain raw `{ }` that MDX parses as a JS expression, throwing "Could
+ *    not parse expression with acorn". They carry no visible prose (SEO
+ *    metadata / global CSS handle those concerns elsewhere), so dropping the
+ *    whole block is safe and never changes rendered output.
+ * 3. HTML void elements (`<img>`, `<br>`, …) written un-self-closed — MDX/JSX
+ *    requires them self-closed; `<img src="x">` alone throws "Expected a
+ *    closing tag". Normalized to `<img src="x" />` regardless of whether a
+ *    stray slash was already present.
+ * 4. String-valued `style="..."` / `style='...'` attributes — valid HTML but
+ *    invalid JSX/MDX (React requires `style={{...}}`, an object, never a
+ *    string); left alone, they compile fine but throw "The style prop
+ *    expects a mapping ... not a string" at render time. Always broken, so
+ *    the attribute is dropped outright. Only the quoted-string form is
+ *    matched (`style="`/`style='`) — the legitimate JSX object form
+ *    (`style={{...}}`) never matches and is left untouched.
+ *
+ * All four run on the code-MASKED string, so fenced/inline code spans are
+ * left byte-for-byte untouched (they are literal in MDX, never error, and
+ * may legitimately show a comment, a `<script>` sample, or a bare `<img>` in
+ * a code sample). Idempotent: running this twice yields the same output.
+ */
+export declare function sanitizeMdx(mdx: string): string;
 //# sourceMappingURL=text.d.ts.map

package/dist/lib/text.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../src/lib/text.ts"],"names":[],"mappings":"AAGA,6CAA6C;AAC7C,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAS7C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAalD;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,SAAM,GAAG,MAAM,CAG9E;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,SAAM,GAAG,MAAM,CAMhE;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAYpD"}
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../src/lib/text.ts"],"names":[],"mappings":"AAGA,6CAA6C;AAC7C,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAS7C;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAalD;AAED,0CAA0C;AAC1C,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,SAAM,GAAG,MAAM,CAG9E;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,SAAM,GAAG,MAAM,CAMhE;AAED,qFAAqF;AACrF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,CAYpD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA+B/C"}

package/dist/lib/text.js

@@ -67,3 +67,61 @@ export function extractToc(mdx) {
     }
     return headings;
 }
+/**
+ * Make raw MDX safe to compile. Raw WordPress HTML stored as post content
+ * trips the MDX/acorn parser in a handful of unambiguously-fixable ways:
+ *
+ * 1. HTML comments — MDX has none, so a bare `<!--` makes the parser expect
+ *    a JSX tag name after `<` and throw "Unexpected character `!` before
+ *    name". Converted to MDX comments ({/*…*\/}, equally non-rendering).
+ * 2. `<script>`/`<style>` blocks — their bodies (JSON-LD, inline CSS)
+ *    contain raw `{ }` that MDX parses as a JS expression, throwing "Could
+ *    not parse expression with acorn". They carry no visible prose (SEO
+ *    metadata / global CSS handle those concerns elsewhere), so dropping the
+ *    whole block is safe and never changes rendered output.
+ * 3. HTML void elements (`<img>`, `<br>`, …) written un-self-closed — MDX/JSX
+ *    requires them self-closed; `<img src="x">` alone throws "Expected a
+ *    closing tag". Normalized to `<img src="x" />` regardless of whether a
+ *    stray slash was already present.
+ * 4. String-valued `style="..."` / `style='...'` attributes — valid HTML but
+ *    invalid JSX/MDX (React requires `style={{...}}`, an object, never a
+ *    string); left alone, they compile fine but throw "The style prop
+ *    expects a mapping ... not a string" at render time. Always broken, so
+ *    the attribute is dropped outright. Only the quoted-string form is
+ *    matched (`style="`/`style='`) — the legitimate JSX object form
+ *    (`style={{...}}`) never matches and is left untouched.
+ *
+ * All four run on the code-MASKED string, so fenced/inline code spans are
+ * left byte-for-byte untouched (they are literal in MDX, never error, and
+ * may legitimately show a comment, a `<script>` sample, or a bare `<img>` in
+ * a code sample). Idempotent: running this twice yields the same output.
+ */
+export function sanitizeMdx(mdx) {
+    const stash = [];
+    // U+E000 (Private Use Area) sentinel — cannot occur in markdown, so the
+    // restore step never collides with real text like "90 seconds".
+    const keep = (m) => {
+        stash.push(m);
+        return `${stash.length - 1}`;
+    };
+    // Mask fenced code blocks (multiline) first, then inline code spans.
+    let masked = mdx
+        .replace(/```[\s\S]*?```/g, keep)
+        .replace(/~~~[\s\S]*?~~~/g, keep)
+        .replace(/`[^`\n]*`/g, keep);
+    masked = masked
+        // Strip <script>/<style> blocks entirely — see rationale above.
+        .replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, "")
+        .replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, "")
+        // Comment body: neutralize any `*/` so it can't close the MDX comment early.
+        .replace(/<!--([\s\S]*?)-->/g, (_, body) => `{/*${body.replace(/\*\//g, "* /")}*/}`)
+        .replace(/<!(?!--)/g, "&lt;!")
+        // Strip string-valued `style="..."` attributes — see rationale above.
+        // Deliberately does NOT match `style={` (the valid JSX object form).
+        .replace(/\sstyle=("[^"]*"|'[^']*')/gi, "")
+        // Self-close HTML void elements — see rationale above. Emits `/>`
+        // whether or not a slash was already present, so a second pass is a
+        // no-op (idempotent).
+        .replace(/<(img|br|hr|input|source|meta|link|col|area|base|embed|param|track|wbr)\b([^>]*?)\s*\/?>/gi, "<$1$2 />");
+    return masked.replace(/(\d+)/g, (_, i) => stash[Number(i)]);
+}

package/dist/next/blog-content.d.ts

@@ -3,5 +3,5 @@ export interface BlogContentProps {
     source: string;
     config: ResolvedBlogConfig;
 }
-export declare function BlogContent({ source, config }: BlogContentProps): import("react/jsx-runtime").JSX.Element;
+export declare function BlogContent({ source, config }: BlogContentProps): Promise<import("react/jsx-runtime").JSX.Element>;
 //# sourceMappingURL=blog-content.d.ts.map

package/dist/next/blog-content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"blog-content.d.ts","sourceRoot":"","sources":["../../src/next/blog-content.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,wBAAgB,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,gBAAgB,2CAW/D"}
+{"version":3,"file":"blog-content.d.ts","sourceRoot":"","sources":["../../src/next/blog-content.tsx"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAS5D,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,wBAAsB,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,gBAAgB,oDAiBrE"}

package/dist/next/blog-content.js

@@ -1,10 +1,29 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 // Server component that renders raw MDX to HTML at build/ISR time via
 // next-mdx-remote/rsc, merging the default embed registry with host overrides.
+// Calls MDXRemote as an async function so compilation errors are caught server-
+// side with try/catch before they can fail the SSG build for the whole page.
 import { MDXRemote } from "next-mdx-remote/rsc";
 import remarkGfm from "remark-gfm";
 import { defaultMdxComponents } from "../components/mdx/index.js";
-export function BlogContent({ source, config }) {
+import { sanitizeMdx } from "../lib/text.js";
+// MDXRemote is an async RSC but TypeScript surfaces it as ComponentType via
+// React 18 JSX types. Cast to the actual async-function signature so we can
+// call it with await + try/catch to prevent one broken post from failing the
+// entire SSG build.
+const renderMDX = MDXRemote;
+export async function BlogContent({ source, config }) {
     const components = { ...defaultMdxComponents, ...(config.mdxComponents ?? {}) };
-    return (_jsx("div", { className: "prose prose-zinc max-w-none dark:prose-invert", children: _jsx(MDXRemote, { source: source, components: components, options: { mdxOptions: { remarkPlugins: [remarkGfm] } } }) }));
+    try {
+        const content = await renderMDX({
+            source: sanitizeMdx(source),
+            components,
+            options: { mdxOptions: { remarkPlugins: [remarkGfm] } },
+        });
+        return _jsx("div", { className: "prose prose-zinc max-w-none dark:prose-invert", children: content });
+    }
+    catch (error) {
+        console.error("[hazo_blog] MDX compile failed:", error);
+        return (_jsx("div", { className: "prose prose-zinc max-w-none dark:prose-invert", children: _jsx("p", { className: "text-muted-foreground", children: "This content could not be displayed." }) }));
+    }
 }

package/dist/next/index.d.ts

@@ -1,5 +1,6 @@
 export { createBlogIndexPage, createBlogPostPage, createBlogTagPage, createBlogAdminListPage, createBlogAdminNewPage, createBlogAdminEditPage, } from "./pages.js";
 export { BlogContent, type BlogContentProps } from "./blog-content.js";
+export { MdxErrorBoundary } from "./mdx-error-boundary.js";
 export { resolveConfig } from "../service/index.js";
 export type { BlogConfig, ResolvedBlogConfig } from "../types/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/next/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAOvE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/next/index.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAO3D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/next/index.js

@@ -6,8 +6,10 @@
 //   createBlogManageRoutes, createBlogAdminRoutes, createBlogSearchRoute,
 //   createBlogFeedRoute, createBlogSitemapRoute
 // Server MDX renderer: BlogContent
+// Error boundary: MdxErrorBoundary
 export { createBlogIndexPage, createBlogPostPage, createBlogTagPage, createBlogAdminListPage, createBlogAdminNewPage, createBlogAdminEditPage, } from "./pages.js";
 export { BlogContent } from "./blog-content.js";
+export { MdxErrorBoundary } from "./mdx-error-boundary.js";
 // NOTE: route-handler factories (createBlogAdminRoutes, createBlogManageRoutes,
 // createBlogSearchRoute, createBlogFeedRoute, createBlogSitemapRoute) are exported
 // from the main `hazo_blog` entry — they are React-free, so API routes import them

package/dist/next/mdx-error-boundary.d.ts

@@ -0,0 +1,16 @@
+import { Component, type ReactNode } from "react";
+interface Props {
+    children: ReactNode;
+    fallback: ReactNode;
+}
+interface State {
+    hasError: boolean;
+}
+export declare class MdxErrorBoundary extends Component<Props, State> {
+    state: State;
+    static getDerivedStateFromError(): State;
+    componentDidCatch(error: unknown): void;
+    render(): ReactNode;
+}
+export {};
+//# sourceMappingURL=mdx-error-boundary.d.ts.map

package/dist/next/mdx-error-boundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mdx-error-boundary.d.ts","sourceRoot":"","sources":["../../src/next/mdx-error-boundary.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AAElD,UAAU,KAAK;IAAG,QAAQ,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,SAAS,CAAC;CAAE;AAC7D,UAAU,KAAK;IAAG,QAAQ,EAAE,OAAO,CAAC;CAAE;AAEtC,qBAAa,gBAAiB,SAAQ,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC;IAC3D,KAAK,EAAE,KAAK,CAAuB;IACnC,MAAM,CAAC,wBAAwB,IAAI,KAAK;IACxC,iBAAiB,CAAC,KAAK,EAAE,OAAO;IAGhC,MAAM;CAGP"}

package/dist/next/mdx-error-boundary.js

@@ -0,0 +1,15 @@
+"use client";
+import { Component } from "react";
+export class MdxErrorBoundary extends Component {
+    constructor() {
+        super(...arguments);
+        this.state = { hasError: false };
+    }
+    static getDerivedStateFromError() { return { hasError: true }; }
+    componentDidCatch(error) {
+        console.error("[hazo_blog] MDX render failed:", error);
+    }
+    render() {
+        return this.state.hasError ? this.props.fallback : this.props.children;
+    }
+}

package/dist/service/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,SAAS,EACf,MAAM,wBAAwB,CAAC;AAGhC,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB,CAQpE;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,+EAA+E;IAC/E,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,OAAO,CACL,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,EACvC,GAAG,CAAC,EAAE,OAAO,GACZ,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzC,WAAW,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,aAAa,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChE,eAAe,CACb,IAAI,EAAE,qBAAqB,EAC3B,KAAK,CAAC,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,OAAO,GACZ,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CACvF;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,UAAU,GAAG,WAAW,CA6GpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/service/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,UAAU,EACV,UAAU,EACV,QAAQ,EACR,qBAAqB,EACrB,cAAc,EACd,kBAAkB,EAClB,eAAe,EAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,SAAS,EACf,MAAM,wBAAwB,CAAC;AAGhC,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,kBAAkB,CAQpE;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,kBAAkB,CAAC;IAC3B,+EAA+E;IAC/E,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACrE,OAAO,CACL,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,EACvC,GAAG,CAAC,EAAE,OAAO,GACZ,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IACzC,WAAW,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5E,YAAY,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,aAAa,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChE,eAAe,CACb,IAAI,EAAE,qBAAqB,EAC3B,KAAK,CAAC,EAAE,MAAM,EACd,GAAG,CAAC,EAAE,OAAO,GACZ,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;CACvF;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,UAAU,GAAG,WAAW,CA+GpE"}

package/dist/service/index.js

@@ -2,7 +2,7 @@
 // repository per request, and owns business logic (slug/reading-time/publish
 // rules, author resolution, FAQ serialization). Server-only.
 import { createBlogRepository, } from "../repository/index.js";
-import { buildExcerpt, calculateReadingTime, slugify } from "../lib/text.js";
+import { buildExcerpt, calculateReadingTime, sanitizeMdx, slugify } from "../lib/text.js";
 /** Apply defaults to a host-supplied BlogConfig. */
 export function resolveConfig(config) {
     return {
@@ -46,6 +46,7 @@ export function createBlogService(rawConfig) {
         },
         async upsertBySlug(input, req) {
             const repo = await repository(req);
+            const content = sanitizeMdx(input.content);
             const slug = input.slug?.trim() ? slugify(input.slug) : slugify(input.title);
             const status = input.status ?? "draft";
             // Resolve category from name when an id isn't supplied.
@@ -68,13 +69,13 @@ export function createBlogService(rawConfig) {
             const row = {
                 slug,
                 title: input.title,
-                content: input.content,
-                excerpt: buildExcerpt(input.content),
-                reading_time: calculateReadingTime(input.content),
+                content,
+                excerpt: buildExcerpt(content),
+                reading_time: calculateReadingTime(content),
                 category_id: categoryId,
                 author_id: input.author_id ?? null,
                 meta_title: input.meta_title ?? "",
-                meta_description: input.meta_description ?? buildExcerpt(input.content),
+                meta_description: input.meta_description ?? buildExcerpt(content),
                 canonical_url: input.canonical_url ?? null,
                 og_image: input.og_image ?? null,
                 featured_image: input.featured_image ?? null,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_blog",
-  "version": "0.2.0",
+  "version": "0.3.3",
   "description": "SEO-optimized blogging package: posts, categories, tags, MDX content, and GA4/GSC/Bing-ready SEO.",
   "type": "module",
   "module": "./dist/index.js",
@@ -44,14 +44,14 @@
     "build:test-app": "npm run build && cd test-app && npm run build"
   },
   "peerDependencies": {
-    "hazo_core": "^1.0.1",
-    "hazo_connect": "^3.1.0",
-    "hazo_api": "^2.1.1",
-    "hazo_files": "^3.0.0",
-    "hazo_ui": "^3.2.0",
-    "hazo_images": "^1.2.0",
-    "hazo_jobs": "^0.12.0",
-    "hazo_auth": "^9.0.1",
+    "hazo_core": "^1.2.1",
+    "hazo_connect": "^3.9.0",
+    "hazo_api": "^2.5.1",
+    "hazo_files": "^3.1.1",
+    "hazo_ui": "^4.8.0",
+    "hazo_images": "^1.7.0",
+    "hazo_jobs": "^0.14.0",
+    "hazo_auth": "^10.5.0",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
     "next": "^14.0.0 || ^16.0.0"
@@ -83,11 +83,11 @@
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "next": "^16.0.10",
-    "hazo_core": "^1.0.1",
-    "hazo_connect": "^3.1.0",
-    "hazo_api": "^2.1.1",
-    "hazo_files": "^3.0.0",
-    "hazo_ui": "^3.2.1",
+    "hazo_core": "^1.2.1",
+    "hazo_connect": "^3.9.0",
+    "hazo_api": "^2.5.1",
+    "hazo_files": "^3.1.1",
+    "hazo_ui": "^4.8.0",
     "tailwindcss": "^4.2.4",
     "@tailwindcss/postcss": "^4.2.4",
     "postcss": "^8.4.49"