nuxt-og-image 6.10.3 → 7.0.0

package/dist/runtime/server/og-image/takumi/renderer.js

@@ -1,11 +1,11 @@
 import { defu } from "defu";
 import { withBase } from "ufo";
-import compatibility from "#og-image/compatibility";
 import { logger } from "../../../logger.js";
 import { fetchLocalAsset } from "../../util/fetchLocalAsset.js";
 import { getFetchTimeout } from "../../util/fetchTimeout.js";
 import { fetchWithRedirectValidation, isBlockedUrl } from "../../util/ssrf.js";
 import { withTimeout } from "../../util/withTimeout.js";
+import { TAKUMI_FORMATS } from "../font-source.js";
 import { buildSubsetFamilyChain, extractCodepoints, getDefaultFontFamily, loadFontsForRenderer, resolveSubsetChain } from "../fonts.js";
 import { getExtractResourceUrls, getTakumi } from "./instances.js";
 import { createTakumiNodes } from "./nodes.js";
@@ -17,8 +17,6 @@ async function getTakumiState(event) {
   const Renderer = await getTakumi();
   nitro._takumiState = {
     renderer: new Renderer(),
-    loadedFontKeys: /* @__PURE__ */ new Set(),
-    loadedFamilies: /* @__PURE__ */ new Set(),
     lock: Promise.resolve()
   };
   return nitro._takumiState;
@@ -40,8 +38,6 @@ function withTakumiLock(state, timeoutMs, fn, onLockTimeout) {
       try {
         const Renderer = await getTakumi();
         state.renderer = new Renderer();
-        state.loadedFontKeys.clear();
-        state.loadedFamilies.clear();
       } catch (resetErr) {
         logger.warn(`failed to reset takumi renderer after lock timeout: ${resetErr?.message || resetErr}`);
       }
@@ -106,39 +102,15 @@ function toUint8Array(data) {
     return new Uint8Array(data);
   return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
 }
-function createFontDescriptor(entry, includeKey = false) {
+function createFontDescriptor(entry) {
   return {
-    ...includeKey ? { key: entry.binaryKey } : {},
+    key: entry.binaryKey,
     name: entry.family,
     data: toUint8Array(entry.data),
     ...entry.weight !== void 0 ? { weight: entry.weight } : {},
     ...entry.style ? { style: entry.style } : {}
   };
 }
-function addLoadedFamilies(state, entry, registeredFamilies) {
-  if (Array.isArray(registeredFamilies) && registeredFamilies.length) {
-    for (const family of registeredFamilies) {
-      const name = family?.name;
-      if (typeof name === "string")
-        state.loadedFamilies.add(name);
-    }
-  } else {
-    state.loadedFamilies.add(entry.family);
-  }
-}
-async function loadFontsIntoRenderer(state, entries) {
-  for (const entry of entries) {
-    if (state.loadedFontKeys.has(entry.binaryKey))
-      continue;
-    try {
-      const registeredFamilies = await state.renderer.loadFont(createFontDescriptor(entry));
-      addLoadedFamilies(state, entry, registeredFamilies);
-    } catch (err) {
-      logger.warn(`Failed to load font "${entry.family}" with takumi renderer: ${err.message}`);
-    }
-    state.loadedFontKeys.add(entry.binaryKey);
-  }
-}
 function normalizeImageSources(images) {
   return (images || []).map((image) => ({
     src: image.src,
@@ -183,11 +155,10 @@ function rewriteFontFamilies(node, loadedFamilies, subsetChains) {
 }
 async function createImage(event, format) {
   const { options, timings } = event;
-  const isTakumiV2 = compatibility.takumiVersion === 2;
   const { fontFamilyOverride, defaultFont } = getDefaultFontFamily(options);
   const nodes = await createTakumiNodes(event);
   const codepoints = extractCodepoints(nodes);
-  const fonts = await timings.measure("font-load", () => loadFontsForRenderer(event, { supportedFormats: /* @__PURE__ */ new Set(["ttf", "woff2"]), component: options.component, fontFamilyOverride: fontFamilyOverride || defaultFont, codepoints }));
+  const fonts = await timings.measure("font-load", () => loadFontsForRenderer(event, { supportedFormats: TAKUMI_FORMATS, component: options.component, fontFamilyOverride: fontFamilyOverride || defaultFont, codepoints }));
   const fontEntries = dedupeFontsByBinary(fonts);
   const hookTimeout = event.runtimeConfig.security?.renderTimeout ?? 15e3;
   await withTimeout(
@@ -200,11 +171,9 @@ async function createImage(event, format) {
   const extractResourceUrls = await timings.measure("takumi-extract-init", () => getExtractResourceUrls());
   const resourceUrls = await extractResourceUrls(nodes);
   const baseURL = event.runtimeConfig.app.baseURL;
-  const { images: optionImages, fetchedResources: optionFetchedResources, persistentImages, ...takumiOptions } = options.takumi || {};
+  const { images: optionImages, ...takumiOptions } = options.takumi || {};
   const images = [
-    ...normalizeImageSources(optionImages),
-    ...normalizeImageSources(optionFetchedResources),
-    ...normalizeImageSources(persistentImages)
+    ...normalizeImageSources(optionImages)
   ];
   if (resourceUrls.length) {
     const fetchTimeout = getFetchTimeout(event.runtimeConfig);
@@ -245,7 +214,7 @@ async function createImage(event, format) {
     width: Math.min(Number(options.width) * dpr, maxDim),
     height: Math.min(Number(options.height) * dpr, maxDim),
     format,
-    ...isTakumiV2 ? { images } : { fetchedResources: images },
+    images,
     devicePixelRatio: dpr
   });
   const lockTimeout = event.runtimeConfig.security?.renderTimeout ?? 15e3;
@@ -253,14 +222,9 @@ async function createImage(event, format) {
   return await withTakumiLock(state, lockTimeout, () => {
     endLockWait();
     return timings.measure("render-takumi", async () => {
-      let loadedFamilies = state.loadedFamilies;
-      if (isTakumiV2) {
-        loadedFamilies = new Set(fontEntries.map((entry) => entry.family));
-        renderOptions.fonts = fontEntries.map((entry) => createFontDescriptor(entry, true));
-        renderOptions.fontFamilies = [...loadedFamilies];
-      } else {
-        await loadFontsIntoRenderer(state, fontEntries);
-      }
+      const loadedFamilies = new Set(fontEntries.map((entry) => entry.family));
+      renderOptions.fonts = fontEntries.map((entry) => createFontDescriptor(entry));
+      renderOptions.fontFamilies = [...loadedFamilies];
       const rootStyle = nodes.style ?? {};
       if (fontFamilyOverride) {
         const chain = subsetChains.get(fontFamilyOverride);
@@ -293,7 +257,7 @@ const TakumiRenderer = {
   async debug(e) {
     const [vnodes, fonts] = await Promise.all([
       createTakumiNodes(e),
-      loadFontsForRenderer(e, { supportedFormats: /* @__PURE__ */ new Set(["ttf", "woff2"]), component: e.options.component })
+      loadFontsForRenderer(e, { supportedFormats: TAKUMI_FORMATS, component: e.options.component })
     ]);
     return {
       vnodes,

package/dist/runtime/server/og-image/utils/css.d.ts

@@ -6,9 +6,4 @@
  */
 export declare function splitCssDeclarations(style: string): string[];
 export declare const GRADIENT_COLOR_SPACE_RE: RegExp;
-/**
- * Strip gradient color interpolation methods (e.g. `in oklab`, `in oklch`)
- * from CSS gradient values. Image renderers (Satori, Takumi) don't support them.
- */
-export declare function stripGradientColorSpace(value: string): string;
 export declare function resolveColorMix(value: string): string;

package/dist/runtime/server/og-image/utils/css.js

@@ -29,11 +29,6 @@ export function splitCssDeclarations(style) {
   return declarations;
 }
 export const GRADIENT_COLOR_SPACE_RE = /\s+in\s+(?:oklab|oklch|srgb(?:-linear)?|display-p3|a98-rgb|prophoto-rgb|rec2020|xyz(?:-d(?:50|65))?|hsl|hwb|lab|lch)/g;
-export function stripGradientColorSpace(value) {
-  if (typeof value !== "string")
-    return value;
-  return value.replace(GRADIENT_COLOR_SPACE_RE, "");
-}
 const COLOR_MIX_HEX_RE = /color-mix\(in\s+\w+,\s*#([0-9a-fA-F]{3,8})\s+([\d.]+%?)\s*,\s*transparent\s*\)/g;
 const COLOR_MIX_RGBA_RE = /color-mix\(in\s+\w+,\s*rgba?\((\d+)[\x09-\x0D\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\uFEFF]*(?: |(?: \s*)?,)\s*(\d+)[\x09-\x0D\xA0\u1680\u2000-\u200A\u2028\u2029\u202F\u205F\u3000\uFEFF]*(?: |(?: \s*)?,)\s*(\d+)(?:\s*[/,]\s*[\d.]+)?\)\s+([\d.]+%?)\s*,\s*transparent\s*\)/g;
 function hexToRgb(hex) {

package/dist/runtime/server/plugins/auto-eject-nitro3.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/plugins/auto-eject-nitro3.js

@@ -0,0 +1,9 @@
+import { defineNitroPlugin } from "#nuxtseo/nitro";
+import { collectAutoEjectTemplates, ejectCollectedTemplates } from "../util/auto-eject-lifecycle.js";
+export default defineNitroPlugin((nitro) => {
+  if (!import.meta.dev)
+    return;
+  const hooks = nitro.hooks;
+  hooks.hook("render:html", (html, { event }) => collectAutoEjectTemplates(html, event));
+  hooks.hook("response", (_response, event) => ejectCollectedTemplates(event));
+});

package/dist/runtime/server/plugins/auto-eject.js

@@ -1,36 +1,8 @@
-import { parse } from "devalue";
 import { defineNitroPlugin } from "#nuxtseo/nitro";
-import { autoEjectCommunityTemplate } from "../util/auto-eject.js";
-import { normaliseOptions } from "../util/options.js";
-import { useOgImageRuntimeConfig } from "../utils.js";
-const PAYLOAD_REGEX = /<script.+id="nuxt-og-image-options"[^>]*>(.+?)<\/script>/;
+import { collectAutoEjectTemplates, ejectCollectedTemplates } from "../util/auto-eject-lifecycle.js";
 export default defineNitroPlugin((nitro) => {
   if (!import.meta.dev)
     return;
-  nitro.hooks.hook("render:html", (html, ctx) => {
-    const payload = [...html.head, ...html.bodyAppend].join("\n").match(PAYLOAD_REGEX)?.[1];
-    if (!payload)
-      return;
-    for (const options of parse(payload)) {
-      if (!options?.component)
-        continue;
-      const normalised = (() => {
-        try {
-          return normaliseOptions({ ...options });
-        } catch {
-          return null;
-        }
-      })();
-      if (normalised?.component?.category === "community")
-        (ctx.event.context._ogImageAutoEject ||= []).push(normalised.component);
-    }
-  });
-  nitro.hooks.hook("afterResponse", (event) => {
-    const components = event.context._ogImageAutoEject;
-    if (!components?.length)
-      return;
-    const runtimeConfig = useOgImageRuntimeConfig(event);
-    for (const component of components)
-      autoEjectCommunityTemplate(component, runtimeConfig);
-  });
+  nitro.hooks.hook("render:html", (html, { event }) => collectAutoEjectTemplates(html, event));
+  nitro.hooks.hook("afterResponse", ejectCollectedTemplates);
 });

package/dist/runtime/server/plugins/prerender.js

@@ -1,12 +1,16 @@
 import { parse } from "devalue";
-import { parseURL, withoutBase } from "ufo";
+import { joinURL, parseURL, withoutBase, withQuery } from "ufo";
 import { appendResponseHeader } from "#nuxtseo/h3";
-import { defineNitroPlugin, useRuntimeConfig } from "#nuxtseo/nitro";
+import { defineNitroPlugin, useRuntimeConfig, useStorage } from "#nuxtseo/nitro";
 import { prerenderOptionsCache } from "#og-image-cache";
+import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
 import { createSitePathResolver } from "#site-config/server/composables/utils";
+import { logger } from "../../logger.js";
 import { isInternalRoute } from "../../shared.js";
+import { getPublishKey, publishImage } from "../og-image/cache/publish.js";
 import { resolvePathCacheKey } from "../og-image/context.js";
 import { createNitroRouteRuleMatcher } from "../util/kit.js";
+import { useOgImageRuntimeConfig } from "../utils.js";
 const PAYLOAD_REGEX = /<script.+id="nuxt-og-image-options"[^>]*>(.+?)<\/script>/;
 const RE_SCRIPT_OPTIONS = /<script id="nuxt-og-image-options" type="application\/json">[\s\S]*?<\/script>/;
 const RE_SCRIPT_OVERRIDES = /<script id="nuxt-og-image-overrides" type="application\/json">[\s\S]*?<\/script>/;
@@ -14,10 +18,21 @@ function getPayloadFromHtml(html) {
   const match = String(html).match(PAYLOAD_REGEX);
   return match ? String(match[1]) : null;
 }
+function replaceImageUrls(head, path, resolve) {
+  return head.map((entry) => entry.replace(/(<meta\b[^>]+\bcontent=")([^"]*)("[^>]*>)/g, (tag, start, url, end) => {
+    if (!/\b(?:property|name)="(?:og:image(?::url|:secure_url)?|twitter:image(?::src)?)"/.test(tag))
+      return tag;
+    const source = url.replace(/&amp;/g, "&");
+    const urlPath = parseURL(source).pathname;
+    return urlPath?.replace(/,/g, "%2C") === path ? `${start}${resolve(source).replace(/&/g, "&amp;")}${end}` : tag;
+  }));
+}
 export default defineNitroPlugin(async (nitro) => {
   if (!import.meta.prerender)
     return;
   const routeRuleMatcher = createNitroRouteRuleMatcher();
+  const publishingPages = /* @__PURE__ */ new Set();
+  let publishWarningShown = false;
   nitro.hooks.hook("render:html", async (html, ctx) => {
     const { head, bodyAppend } = html;
     const path = parseURL(ctx.event.path).pathname;
@@ -45,7 +60,58 @@ export default defineNitroPlugin(async (nitro) => {
     }
     const prerenderPaths = ctx.event.context._ogImagePrerenderPaths;
     if (prerenderPaths) {
+      const config = useOgImageRuntimeConfig(ctx.event);
+      const publish = config.publish;
+      if (publish && !publishingPages.has(path)) {
+        publishingPages.add(path);
+        try {
+          for (const [ogKey, prerenderPath] of prerenderPaths) {
+            const extension = prerenderPath.split(".").pop();
+            if (!prerenderPath.includes("/_og/s/") || extension !== "png" && extension !== "jpeg" && extension !== "jpg" && extension !== "webp")
+              continue;
+            const opt = payloads.find(([key2]) => key2 === ogKey)?.[1];
+            if (!opt)
+              continue;
+            const result = await publishImage({
+              storage: useStorage(),
+              mount: publish.storage,
+              baseURL: publish.baseURL,
+              key: getPublishKey(new URL(prerenderPath, getSiteConfig(ctx.event).url).href, config.defaults, publish.cacheVersion),
+              extension,
+              maxAgeSeconds: Number(opt.cacheMaxAgeSeconds ?? config.defaults.cacheMaxAgeSeconds),
+              timeoutMs: config.security.renderTimeout,
+              now: Date.now,
+              render: async () => {
+                if (opt.component === "PageScreenshot") {
+                  opt._prerenderHtml = `<!DOCTYPE html><html ${(html.htmlAttrs || []).join(" ")}><head>${html.head.join("")}</head><body ${(html.bodyAttrs || []).join(" ")}>${[...html.bodyPrepend || [], ...html.body || [], ...html.bodyAppend].join("")}</body></html>`;
+                  await prerenderOptionsCache.setItem(key, payloads);
+                  if (opt._hash)
+                    await prerenderOptionsCache.setItem(`hash:${opt._hash}`, { ...opt, _path: pagePath });
+                }
+                const response = await nitro.localFetch(opt._query ? withQuery(prerenderPath, { _query: opt._query }) : prerenderPath);
+                if (!response.ok || !response.headers.get("content-type")?.startsWith("image/"))
+                  throw new Error(`Image render failed: ${response.status}. ${(await response.text()).slice(0, 1e3)}`);
+                return new Uint8Array(await response.arrayBuffer());
+              }
+            });
+            if (result._tag === "Published") {
+              html.head = replaceImageUrls(html.head, prerenderPath, () => result.url);
+              prerenderPaths.delete(ogKey);
+            } else if (!publishWarningShown) {
+              publishWarningShown = true;
+              logger.warn("[Nuxt OG Image] Publish storage is unavailable. Using local image URLs.", result.reason);
+            }
+          }
+        } finally {
+          publishingPages.delete(path);
+        }
+      }
+      const app = useRuntimeConfig(ctx.event).app;
       for (const prerenderPath of prerenderPaths.values()) {
+        if (app.cdnURL && prerenderPath.includes("/_og/s/")) {
+          const imageURL = joinURL(app.cdnURL, withoutBase(prerenderPath, app.baseURL));
+          html.head = replaceImageUrls(html.head, prerenderPath, (source) => `${imageURL}${parseURL(source).search || ""}`);
+        }
         appendResponseHeader(ctx.event, "x-nitro-prerender", prerenderPath);
       }
     }

package/dist/runtime/server/plugins/publish.d.ts

@@ -0,0 +1,2 @@
+declare const _default: any;
+export default _default;

package/dist/runtime/server/plugins/publish.js

@@ -0,0 +1,44 @@
+import { parseURL, withoutBase } from "ufo";
+import { defineNitroPlugin } from "#nuxtseo/nitro";
+import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
+import { logger } from "../../logger.js";
+import { isInternalRoute } from "../../shared.js";
+import { getPublishKey } from "../og-image/cache/publish.js";
+import { getPublishedImageCache, getPublishedImageCacheKey } from "../og-image/cache/published.js";
+import { useOgImageRuntimeConfig } from "../utils.js";
+const IMAGE_META = /<meta\b[^>]+\b(?:property|name)="(?:og:image(?::url|:secure_url)?|twitter:image(?::src)?)"[^>]*>/g;
+const CONTENT = /\bcontent="([^"]+)"/;
+export default defineNitroPlugin((nitro) => {
+  if (import.meta.dev || import.meta.prerender)
+    return;
+  nitro.hooks.hook("render:html", (html, { event }) => {
+    if (isInternalRoute(parseURL(event.path).pathname))
+      return;
+    const config = useOgImageRuntimeConfig(event);
+    const publish = config.publish;
+    if (!publish)
+      return;
+    const siteURL = new URL(getSiteConfig(event).url);
+    const replacements = /* @__PURE__ */ new Map();
+    const urls = new Set(html.head.flatMap((entry) => [...entry.matchAll(IMAGE_META)].map((match) => match[0].match(CONTENT)?.[1]).filter((url) => !!url)));
+    const cache = getPublishedImageCache(nitro);
+    for (const source of urls) {
+      try {
+        const url = new URL(source.replace(/&amp;/g, "&"), siteURL);
+        const path = withoutBase(url.pathname, config.app.baseURL);
+        if (url.origin !== siteURL.origin || !path.startsWith("/_og/d/"))
+          continue;
+        const extension = path.split(".").pop();
+        if (extension !== "png" && extension !== "jpeg" && extension !== "jpg" && extension !== "webp")
+          continue;
+        const key = getPublishedImageCacheKey(publish, getPublishKey(url.href, config.defaults, publish.cacheVersion), extension);
+        const result = cache.get(key, Date.now());
+        if (result)
+          replacements.set(source, result.url.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;"));
+      } catch (err) {
+        logger.debug("[Nuxt OG Image] Published URL lookup failed. Keeping the app image URL.", err);
+      }
+    }
+    html.head = html.head.map((entry) => entry.replace(IMAGE_META, (tag) => tag.replace(CONTENT, (content, source) => replacements.has(source) ? `content="${replacements.get(source)}"` : content)));
+  });
+});

package/dist/runtime/server/routes/debug.json.d.ts

@@ -1,2 +1,11 @@
-declare const _default: any;
+declare const _default: import("nuxt/server").EventHandler<Promise<{
+    siteConfigUrl: string;
+    origin: string;
+    componentNames: any;
+    runtimeConfig: import("../../types.js").OgImageRuntimeConfig;
+    compatibility: any;
+    resolvedFonts: any;
+    availableFonts: any;
+    fontRequirements: any;
+}>>;
 export default _default;

package/dist/runtime/server/routes/debug.json.js

@@ -1,18 +1,18 @@
-import { defineEventHandler, setHeader } from "#nuxtseo/h3";
+import { defineEventHandler } from "nuxt/server";
 import { componentNames } from "#og-image-virtual/component-names.mjs";
 import compatibility from "#og-image/compatibility";
 import { fontRequirements } from "#og-image/font-requirements";
 import resolvedFonts from "#og-image/fonts";
 import availableFonts from "#og-image/fonts-available";
-import { getNitroOrigin } from "#site-config/server/composables";
 import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
+import { getOgImageOrigin } from "../util/origin.js";
 import { useOgImageRuntimeConfig } from "../utils.js";
 export default defineEventHandler(async (e) => {
-  setHeader(e, "Content-Type", "application/json");
+  e.res.headers.set("Content-Type", "application/json");
   const runtimeConfig = useOgImageRuntimeConfig(e);
   return {
     siteConfigUrl: getSiteConfig(e).url,
-    origin: getNitroOrigin(e),
+    origin: getOgImageOrigin(e),
     componentNames,
     runtimeConfig,
     compatibility,

package/dist/runtime/server/routes/static-font.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("nuxt/server").EventHandler<Promise<Response>>;
+export default _default;

package/dist/runtime/server/routes/static-font.js

@@ -0,0 +1,22 @@
+import { readFile } from "node:fs/promises";
+import { createError, defineEventHandler, getRequestURL, useRuntimeConfig } from "nuxt/server";
+import { join } from "pathe";
+import { withoutBase } from "ufo";
+import { staticFontCacheDir } from "#og-image-virtual/build-dir.mjs";
+import resolvedFonts from "#og-image/fonts";
+import availableFonts from "#og-image/fonts-available";
+export default defineEventHandler(async (event) => {
+  const path = withoutBase(getRequestURL(event).pathname, useRuntimeConfig().app.baseURL);
+  const font = [...resolvedFonts, ...availableFonts].find((face) => face.src === path || face.satoriSrc === path);
+  if (!font)
+    throw createError({ status: 404, statusText: "Not Found" });
+  const file = path === font.src && font.absolutePath ? font.absolutePath : join(staticFontCacheDir, path.slice("/_og-static-fonts/".length));
+  const data = await readFile(file);
+  return new Response(new Uint8Array(data), {
+    headers: {
+      "Content-Type": "application/octet-stream",
+      "Cache-Control": "no-store",
+      "Access-Control-Allow-Origin": "*"
+    }
+  });
+});

package/dist/runtime/server/signing-secret.d.ts

@@ -0,0 +1,8 @@
+import type { RequestEvent } from 'nuxt/server';
+export declare const OG_IMAGE_SECRET_PURPOSE = "nuxt-og-image:url-signing";
+/** Resolve once per request before synchronous app and server URL helpers run. */
+export declare function initializeOgImageSigning(event: Pick<RequestEvent, 'context'>): Promise<void>;
+/** Only the image endpoints need the secret. Every other request can render without it. */
+export declare function isOgImageEndpointPath(pathname: string, baseURL: string): boolean;
+/** Log a missing or invalid secret once per server instance, with the fix. */
+export declare function reportSigningFailure(failure: unknown): void;

package/dist/runtime/server/signing-secret.js

@@ -0,0 +1,75 @@
+import { createError, deriveSecret, useRuntimeConfig } from "nuxt/server";
+import { joinURL } from "ufo";
+import { getCloudflareEnv } from "./util/cloudflare.js";
+export const OG_IMAGE_SECRET_PURPOSE = "nuxt-og-image:url-signing";
+let observed;
+let warnedLegacy = false;
+export async function initializeOgImageSigning(event) {
+  const config = useRuntimeConfig();
+  const security = config["nuxt-og-image"].security;
+  if (security.secret === false || import.meta.prerender && !security.strict)
+    return;
+  const cloudflareEnv = getCloudflareEnv(event);
+  const configRoot = config.appSecret;
+  const processRoot = globalThis.process?.env?.NUXT_OG_IMAGE_SECRET;
+  if (cloudflareEnv !== void 0) {
+    const root2 = resolveLegacyRoot(
+      cloudflareEnv.NUXT_APP_SECRET === void 0 ? configRoot : cloudflareEnv.NUXT_APP_SECRET,
+      cloudflareEnv.NUXT_OG_IMAGE_SECRET
+    );
+    const secret = observed !== void 0 && observed.root === root2 ? observed.secret : root2 === configRoot ? await deriveSecret(OG_IMAGE_SECRET_PURPOSE) : await deriveRootSecret(root2);
+    observed = { root: root2, configRoot, processRoot, secret };
+    event.context._ogImageSigningSecret = secret;
+    return;
+  }
+  if (observed !== void 0 && configRoot === observed.configRoot && processRoot === observed.processRoot) {
+    event.context._ogImageSigningSecret = observed.secret;
+    return;
+  }
+  const root = resolveLegacyRoot(configRoot, processRoot);
+  if (root !== configRoot) {
+    event.context._ogImageSigningSecret = await deriveRootSecret(root);
+    return;
+  }
+  event.context._ogImageSigningSecret = await deriveSecret(OG_IMAGE_SECRET_PURPOSE);
+}
+export function isOgImageEndpointPath(pathname, baseURL) {
+  return pathname.startsWith("/_og/") || pathname.startsWith(joinURL(baseURL, "_og/"));
+}
+let reportedFailure = false;
+export function reportSigningFailure(failure) {
+  if (reportedFailure)
+    return;
+  reportedFailure = true;
+  const cause = failure instanceof Error ? failure.message : String(failure);
+  console.error([
+    "[nuxt-og-image] URL signing has no valid secret. OG image requests return 500 until you fix this. Pages still render.",
+    "Run `npx nuxt-og-image generate-secret`, then set NUXT_APP_SECRET in the production environment.",
+    "The secret must have at least 32 characters. To turn off signing, set `ogImage.security.secret` to false.",
+    `Cause: ${cause}`
+  ].join("\n"));
+}
+function resolveLegacyRoot(root, legacy) {
+  if ((root === void 0 || root === "") && legacy !== void 0 && legacy !== "") {
+    if (!warnedLegacy) {
+      warnedLegacy = true;
+      console.warn("[nuxt-og-image] NUXT_OG_IMAGE_SECRET is deprecated. Rename it to NUXT_APP_SECRET. Existing signed URLs must be refreshed.");
+    }
+    return legacy;
+  }
+  return root;
+}
+async function deriveRootSecret(root) {
+  if (typeof root !== "string" || root.length < 32) {
+    throw createError({ status: 500, message: "Set NUXT_APP_SECRET to a string with at least 32 characters." });
+  }
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey("raw", encoder.encode(root), "HKDF", false, ["deriveBits"]);
+  const bits = await crypto.subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: encoder.encode("nuxt"),
+    info: encoder.encode(OG_IMAGE_SECRET_PURPOSE)
+  }, key, 256);
+  return Array.from(new Uint8Array(bits), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/runtime/server/util/auto-eject-lifecycle.d.ts

@@ -0,0 +1,13 @@
+import type { RequestEvent } from 'nuxt/server';
+import type { OgImageComponent } from '../../types.js';
+export interface AutoEjectEvent {
+    context: RequestEvent['context'] & {
+        _ogImageAutoEject?: OgImageComponent[];
+    };
+}
+export interface AutoEjectHtml {
+    head: string[];
+    bodyAppend: string[];
+}
+export declare function collectAutoEjectTemplates(html: AutoEjectHtml, event: AutoEjectEvent): void;
+export declare function ejectCollectedTemplates(event: AutoEjectEvent): void;

package/dist/runtime/server/util/auto-eject-lifecycle.js

@@ -0,0 +1,31 @@
+import { parse } from "devalue";
+import { useOgImageRuntimeConfig } from "../utils.js";
+import { autoEjectCommunityTemplate } from "./auto-eject.js";
+import { normaliseOptions } from "./options.js";
+const PAYLOAD_REGEX = /<script.+id="nuxt-og-image-options"[^>]*>(.+?)<\/script>/;
+export function collectAutoEjectTemplates(html, event) {
+  const payload = [...html.head, ...html.bodyAppend].join("\n").match(PAYLOAD_REGEX)?.[1];
+  if (!payload)
+    return;
+  for (const options of parse(payload)) {
+    if (!options?.component)
+      continue;
+    const normalised = (() => {
+      try {
+        return normaliseOptions({ ...options });
+      } catch {
+        return null;
+      }
+    })();
+    if (normalised?.component?.category === "community")
+      (event.context._ogImageAutoEject ||= []).push(normalised.component);
+  }
+}
+export function ejectCollectedTemplates(event) {
+  const components = event.context._ogImageAutoEject;
+  if (!components?.length)
+    return;
+  const runtimeConfig = useOgImageRuntimeConfig(event);
+  for (const component of components)
+    autoEjectCommunityTemplate(component, runtimeConfig);
+}

package/dist/runtime/server/util/cache.d.ts

@@ -7,5 +7,6 @@ export declare function useOgImageBufferCache(ctx: OgImageRenderEventContext, op
 }): Promise<void | H3Error | {
     cachedItem: false | BufferSource;
     enabled: boolean;
+    expiresAt: number;
     update: (image: BufferSource | Buffer | Uint8Array) => Promise<void>;
 }>;

package/dist/runtime/server/util/cache.js

@@ -21,12 +21,13 @@ function warnCacheBackendUnreachable(ctx, baseCacheKey, e) {
 }
 export async function useOgImageBufferCache(ctx, options) {
   const maxAge = Number(options.cacheMaxAgeSeconds);
-  const intentionallyEnabled = !import.meta.dev && !import.meta.prerender && maxAge > 0;
+  const intentionallyEnabled = options.baseCacheKey !== false && !import.meta.dev && !import.meta.prerender && maxAge > 0;
   let enabled = intentionallyEnabled;
-  const cache = prefixStorage(useStorage(), withTrailingSlash(options.baseCacheKey || "/"));
+  const cache = options.baseCacheKey === false ? void 0 : prefixStorage(useStorage(), withTrailingSlash(options.baseCacheKey));
   const key = ctx.key;
   let cachedItem = false;
-  if (enabled) {
+  let cacheExpiresAt = 0;
+  if (enabled && cache) {
     const hasItem = await cache.hasItem(key).catch((e) => {
       enabled = false;
       warnCacheBackendUnreachable(ctx, options.baseCacheKey, e);
@@ -51,6 +52,7 @@ export async function useOgImageBufferCache(ctx, options) {
           void err;
         });
       } else if (expiresAt > Date.now()) {
+        cacheExpiresAt = expiresAt;
         cachedItem = Buffer.from(value, "base64");
         if (handleCacheHeaders(ctx.e, {
           modifiedTime: new Date(headers["last-modified"]),
@@ -76,11 +78,15 @@ export async function useOgImageBufferCache(ctx, options) {
   return {
     enabled,
     cachedItem,
+    get expiresAt() {
+      return cacheExpiresAt;
+    },
     async update(item) {
       setHeader(ctx.e, "X-OG-Cache", enabled ? "MISS" : "DISABLED");
-      if (!enabled)
+      if (!enabled || !cache)
         return;
       const value = Buffer.from(item).toString("base64");
+      cacheExpiresAt = Date.now() + maxAge * 1e3;
       const headers = {
         // avoid multi-tenancy cache issues
         "Vary": "accept-encoding, host",
@@ -92,8 +98,8 @@ export async function useOgImageBufferCache(ctx, options) {
       await cache.setItem(key, {
         value,
         headers,
-        expiresAt: Date.now() + maxAge * 1e3
-      }).catch((err) => logger.warn(`[Nuxt OG Image] Failed to write cache for key "${key}": ${err?.message || err}`));
+        expiresAt: cacheExpiresAt
+      }, { ttl: Math.max(maxAge, 60) }).catch((err) => logger.warn(`[Nuxt OG Image] Failed to write cache for key "${key}": ${err?.message || err}`));
     }
   };
 }

package/dist/runtime/server/util/cloudflare.d.ts

@@ -1,3 +1,3 @@
-import type { H3Event } from '#nuxtseo/h3';
+import type { RequestEvent } from 'nuxt/server';
 export type CloudflareEnv = Record<string, unknown>;
-export declare function getCloudflareEnv(event?: H3Event): CloudflareEnv | undefined;
+export declare function getCloudflareEnv(event?: Pick<RequestEvent, 'context'>): CloudflareEnv | undefined;