nuxt-og-image 6.7.8 → 6.9.0

package/dist/chunks/tw4.mjs

@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
 import { resolveModulePath } from 'exsolve';
 import { dirname, join } from 'pathe';
-import { e as extractVariantBaseClasses, r as resolveVariantPrefixes, h as resolveExtractedVars, l as resolveVarsDeep, s as simplifyCss, p as postProcessStyles, m as loadLightningCss, a as extractCssVars, c as extractUniversalVars, d as extractPerClassVars, g as extractVarsFromCss, f as extractClassStyles } from '../shared/nuxt-og-image.BMHzg1Vz.mjs';
+import { e as extractVariantBaseClasses, r as resolveVariantPrefixes, h as resolveExtractedVars, l as resolveVarsDeep, s as simplifyCss, p as postProcessStyles, m as loadLightningCss, a as extractCssVars, c as extractUniversalVars, d as extractPerClassVars, g as extractVarsFromCss, f as extractClassStyles } from '../shared/nuxt-og-image.CTD0ZPNd.mjs';
 import 'node:crypto';
 import 'node:fs';
 import '@nuxt/kit';
@@ -12,6 +12,7 @@ import 'nuxt-site-config/kit';
 import 'nuxtseo-shared/kit';
 import 'pkg-types';
 import 'std-env';
+import 'magic-string';
 import 'oxc-walker';
 import '../../dist/runtime/logger.js';
 import 'chrome-launcher';
@@ -20,7 +21,6 @@ import 'nuxtseo-shared/devtools';
 import 'unstorage';
 import 'unstorage/drivers/fs-lite';
 import '../../dist/runtime/server/og-image/utils/css.js';
-import 'magic-string';
 import 'strip-literal';
 import 'ufo';
 import 'unplugin';

package/dist/chunks/uno.mjs

@@ -1,8 +1,8 @@
 import { readFile } from 'node:fs/promises';
 import { defu } from 'defu';
 import { logger } from '../../dist/runtime/logger.js';
-import { e as extractVariantBaseClasses, s as simplifyCss, a as extractCssVars, b as extractPropertyInitialValues, c as extractUniversalVars, d as extractPerClassVars, f as extractClassStyles, p as postProcessStyles, r as resolveVariantPrefixes, i as importOptionalPeer, g as extractVarsFromCss, h as resolveExtractedVars } from '../shared/nuxt-og-image.BMHzg1Vz.mjs';
-export { j as importResolvedModule, k as resolveOptionalModulePath } from '../shared/nuxt-og-image.BMHzg1Vz.mjs';
+import { e as extractVariantBaseClasses, s as simplifyCss, a as extractCssVars, b as extractPropertyInitialValues, c as extractUniversalVars, d as extractPerClassVars, f as extractClassStyles, p as postProcessStyles, r as resolveVariantPrefixes, i as importOptionalPeer, g as extractVarsFromCss, h as resolveExtractedVars } from '../shared/nuxt-og-image.CTD0ZPNd.mjs';
+export { j as importResolvedModule, k as resolveOptionalModulePath } from '../shared/nuxt-og-image.CTD0ZPNd.mjs';
 import 'node:crypto';
 import 'node:fs';
 import 'node:url';
@@ -13,14 +13,15 @@ import 'nuxtseo-shared/kit';
 import 'pathe';
 import 'pkg-types';
 import 'std-env';
+import 'magic-string';
 import 'oxc-walker';
+import 'exsolve';
 import 'chrome-launcher';
 import 'nypm';
 import 'nuxtseo-shared/devtools';
 import 'unstorage';
 import 'unstorage/drivers/fs-lite';
 import '../../dist/runtime/server/og-image/utils/css.js';
-import 'magic-string';
 import 'strip-literal';
 import 'ufo';
 import 'unplugin';
@@ -28,7 +29,6 @@ import '@vue/compiler-sfc';
 import 'ofetch';
 import 'ultrahtml';
 import '../../dist/runtime/server/og-image/core/transforms/emojis/emoji-utils.js';
-import 'exsolve';
 import '../shared/nuxt-og-image.CJa2KCie.mjs';
 import 'magicast';
 import 'magicast/helpers';

package/dist/cli.mjs

@@ -1211,7 +1211,7 @@ async function runCreate(name, args2) {
       message: "Add defineOgImage to a page? (relative path from pages/, leave empty to skip)",
       placeholder: "index.vue"
     });
-    if (!p.isCancel(pageInput) && pageInput && pageInput.trim()) {
+    if (typeof pageInput === "string" && pageInput.trim()) {
       let pagePath = pageInput.trim();
       if (!pagePath.endsWith(".vue"))
         pagePath += ".vue";

package/dist/devtools/nuxt.config.ts

@@ -1,6 +1,9 @@
+import { fileURLToPath } from 'node:url'
 import { resolve } from 'pathe'
 
+const currentDir = fileURLToPath(new URL('.', import.meta.url))
+
 // Nuxt SEO devtools panel, shipped as a layer (Model C). Components flat-registered.
 export default defineNuxtConfig({
-  components: [{ path: resolve(__dirname, './components'), pathPrefix: false }],
+  components: [{ path: resolve(currentDir, './components'), pathPrefix: false }],
 })

package/dist/module.d.mts

@@ -118,6 +118,16 @@ interface ModuleOptions {
      * @default 60 * 60 * 24 * 3 (3 days)
      */
     cacheMaxAgeSeconds?: number;
+    /**
+     * Include Twitter card meta tags (`twitter:card`, `twitter:image`, etc)
+     * alongside the Open Graph image tags.
+     *
+     * Set to `false` to only emit `og:image` tags. When unset, the module respects
+     * `seo.automaticTwitterTags` (nuxt-seo-kit) before defaulting to `true`.
+     *
+     * @default true
+     */
+    includeTwitter?: boolean;
     /**
      * Font subsets to download when resolving missing font families via fontless.
      *

package/dist/module.d.ts

@@ -118,6 +118,16 @@ interface ModuleOptions {
      * @default 60 * 60 * 24 * 3 (3 days)
      */
     cacheMaxAgeSeconds?: number;
+    /**
+     * Include Twitter card meta tags (`twitter:card`, `twitter:image`, etc)
+     * alongside the Open Graph image tags.
+     *
+     * Set to `false` to only emit `og:image` tags. When unset, the module respects
+     * `seo.automaticTwitterTags` (nuxt-seo-kit) before defaulting to `true`.
+     *
+     * @default true
+     */
+    includeTwitter?: boolean;
     /**
      * Font subsets to download when resolving missing font families via fontless.
      *

package/dist/module.json

@@ -4,7 +4,7 @@
     "nuxt": ">=3.16.0"
   },
   "configKey": "ogImage",
-  "version": "6.7.8",
+  "version": "6.9.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -10,16 +10,17 @@ import 'nuxtseo-shared/kit';
 import 'pathe';
 import 'pkg-types';
 import 'std-env';
-export { n as default } from './shared/nuxt-og-image.BMHzg1Vz.mjs';
+export { n as default } from './shared/nuxt-og-image.CTD0ZPNd.mjs';
 import '../dist/runtime/logger.js';
+import 'magic-string';
 import 'oxc-walker';
+import 'exsolve';
 import 'chrome-launcher';
 import 'nypm';
 import 'nuxtseo-shared/devtools';
 import 'unstorage';
 import 'unstorage/drivers/fs-lite';
 import '../dist/runtime/server/og-image/utils/css.js';
-import 'magic-string';
 import 'strip-literal';
 import 'ufo';
 import 'unplugin';
@@ -27,7 +28,6 @@ import '@vue/compiler-sfc';
 import 'ofetch';
 import 'ultrahtml';
 import '../dist/runtime/server/og-image/core/transforms/emojis/emoji-utils.js';
-import 'exsolve';
 import './shared/nuxt-og-image.CJa2KCie.mjs';
 import 'magicast';
 import 'magicast/helpers';

package/dist/runtime/app/client-utils.js

@@ -63,6 +63,7 @@ export function clientProcessOgImageOptions(input, route, basePath) {
   const baseURL = rc.app.baseURL;
   const publicCfg = rc.public?.["nuxt-og-image"] || {};
   const defaults = publicCfg.defaults || {};
+  const metaOptions = { includeTwitter: publicCfg.includeTwitter };
   const paths = [];
   for (const rawInput of inputs) {
     const resolved = resolveReactiveOptions(rawInput);
@@ -78,13 +79,13 @@ export function clientProcessOgImageOptions(input, route, basePath) {
     const ogKey = validOptions.key || "og";
     if (validOptions.url) {
       const url = validOptions.url;
-      registerClientOgHead(ogKey, { meta: generateMeta(url, validOptions) }, { tagPriority: "high" });
+      registerClientOgHead(ogKey, { meta: generateMeta(url, validOptions, metaOptions) }, { tagPriority: "high" });
       paths.push(url);
       continue;
     }
     if (publicCfg.hasServerRuntime) {
       const finalUrl2 = buildResolverUrl(baseURL, basePath, ogKey, route.query);
-      registerClientOgHead(ogKey, { meta: generateMeta(finalUrl2, validOptions) }, { tagPriority: 35 });
+      registerClientOgHead(ogKey, { meta: generateMeta(finalUrl2, validOptions, metaOptions) }, { tagPriority: 35 });
       paths.push(finalUrl2);
       continue;
     }
@@ -98,7 +99,7 @@ export function clientProcessOgImageOptions(input, route, basePath) {
     const result = buildOgImageUrl(urlOpts, extension, true, defaults, void 0);
     const resolvedUrl = joinURL("/", baseURL, result.url);
     const finalUrl = opts._query && Object.keys(opts._query).length ? withQuery(resolvedUrl, { _query: opts._query }) : resolvedUrl;
-    registerClientOgHead(ogKey, { meta: generateMeta(finalUrl, opts) }, { processTemplateParams: true, tagPriority: 35 });
+    registerClientOgHead(ogKey, { meta: generateMeta(finalUrl, opts, metaOptions) }, { processTemplateParams: true, tagPriority: 35 });
     paths.push(finalUrl);
   }
   return paths;

package/dist/runtime/app/utils.js

@@ -53,7 +53,8 @@ export function setHeadOgImagePrebuilt(input) {
   const url = input.url;
   if (!url)
     return;
-  const meta = generateMeta(url, input);
+  const { includeTwitter } = useOgImageRuntimeConfig();
+  const meta = generateMeta(url, input, { includeTwitter });
   useHead({ meta }, { tagPriority: "high" });
 }
 export function createOgImageMeta(src, input, ssrContext, pagePath, head) {
@@ -117,7 +118,7 @@ export function createOgImageMeta(src, input, ssrContext, pagePath, head) {
             prerenderPaths.set(ogKey, (finalUrl.split("?")[0] || finalUrl).replace(/,/g, "%2C"));
           }
         }
-        return generateMeta(finalUrl, opts);
+        return generateMeta(finalUrl, opts, { includeTwitter: ogImageConfig.includeTwitter });
       });
     }
   }, {

package/dist/runtime/server/nitro.d.ts

@@ -0,0 +1,9 @@
+import type { H3Event } from '#nuxtseo/h3';
+import type { OgImageOptionsInternal } from '../types.js';
+type Options = Partial<OgImageOptionsInternal>;
+/**
+ * Build the absolute OG image URL for a page. Without a page path, uses the current request path.
+ */
+export declare function getOgImageUrl(event: H3Event, options?: Options): string;
+export declare function getOgImageUrl(event: H3Event, pagePath: string, options?: Options): string;
+export {};

package/dist/runtime/server/nitro.js

@@ -0,0 +1,10 @@
+import { parseURL, withoutBase } from "ufo";
+import { useRuntimeConfig } from "#nuxtseo/nitro";
+import { withSiteUrl } from "#site-config/server/composables/utils";
+import { getOgImagePath } from "./utils.js";
+export function getOgImageUrl(event, pathOrOptions, maybeOptions) {
+  const pagePath = typeof pathOrOptions === "string" ? pathOrOptions : withoutBase(parseURL(event.path).pathname, useRuntimeConfig(event).app.baseURL) || "/";
+  const options = typeof pathOrOptions === "string" ? maybeOptions : pathOrOptions;
+  const { path } = getOgImagePath(event, pagePath, options);
+  return withSiteUrl(event, path, { canonical: !import.meta.dev });
+}

package/dist/runtime/server/og-image/bindings/fetch/node.d.ts

@@ -0,0 +1,2 @@
+import type { GuardedFetchInit } from './web.js';
+export declare function guardedFetch(url: string, { headers, signal, isBlockedAddress }: GuardedFetchInit): Promise<Response>;

package/dist/runtime/server/og-image/bindings/fetch/node.js

@@ -0,0 +1,42 @@
+import { lookup as dnsLookup } from "node:dns";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { Readable } from "node:stream";
+function guardedLookup(isBlocked) {
+  return (hostname, options, callback) => {
+    dnsLookup(hostname, { ...options, all: true }, (err, addresses) => {
+      if (err)
+        return callback(err, "", 0);
+      const blocked = addresses.find((a) => isBlocked(a.address));
+      if (blocked)
+        return callback(new Error(`[Nuxt OG Image] ${hostname} resolves to blocked address ${blocked.address}.`), "", 0);
+      if (options.all)
+        return callback(null, addresses);
+      callback(null, addresses[0].address, addresses[0].family);
+    });
+  };
+}
+export function guardedFetch(url, { headers, signal, isBlockedAddress }) {
+  const request = url.startsWith("https:") ? httpsRequest : httpRequest;
+  return new Promise((resolve, reject) => {
+    const req = request(url, {
+      // Match the defaults that `fetch` sent before this transport existed.
+      headers: { "accept": "*/*", "user-agent": "node", ...headers },
+      signal,
+      lookup: guardedLookup(isBlockedAddress ?? (() => false)),
+      // A fresh socket per hop: never reuse a connection nobody checked.
+      agent: false
+    }, (res) => {
+      const status = res.statusCode ?? 0;
+      const responseHeaders = new Headers();
+      for (const [name, value] of Object.entries(res.headers)) {
+        for (const v of [value ?? []].flat())
+          responseHeaders.append(name, v);
+      }
+      const body = status === 204 || status === 304 ? null : Readable.toWeb(res);
+      resolve(new Response(body, { status, headers: responseHeaders }));
+    });
+    req.on("error", reject);
+    req.end();
+  });
+}

package/dist/runtime/server/og-image/bindings/fetch/web.d.ts

@@ -0,0 +1,7 @@
+export interface GuardedFetchInit {
+    headers?: Record<string, string>;
+    signal: AbortSignal;
+    /** Rejects the connection when a resolved address matches. Node only. */
+    isBlockedAddress?: (address: string) => boolean;
+}
+export declare function guardedFetch(url: string, { headers, signal }: GuardedFetchInit): Promise<Response>;

package/dist/runtime/server/og-image/bindings/fetch/web.js

@@ -0,0 +1,3 @@
+export function guardedFetch(url, { headers, signal }) {
+  return fetch(url, { redirect: "manual", headers, signal });
+}

package/dist/runtime/server/og-image/bindings/font-assets/external-url.d.ts

@@ -12,17 +12,6 @@ export declare function isDataFontUrl(path: string): boolean;
  * Check `isDataFontUrl` first — `data:` is non-http and would report true here.
  */
 export declare function isExternalFontUrl(path: string): boolean;
-/**
- * Resolve an authority-bearing font URL to the href to fetch, but only when it
- * is same-origin with the configured site URL. Returns null otherwise.
- *
- * Runtime external font URLs are unsupported — `@nuxt/fonts` is the only
- * supported way to load custom fonts, and it serves them same-origin. The single
- * allowed exception is the site's own origin, gated on an explicitly configured
- * site URL. Resolving against that origin also collapses canonicalization
- * bypasses (a crafted " //127.0.0.1" resolves cross-origin → rejected).
- */
-export declare function resolveSameOriginFontUrl(path: string, siteUrl: string | undefined): string | null;
 /**
  * Fetch a `data:` or authority-bearing font URL. `data:` is decoded directly
  * (no network). An external URL is fetched only when same-origin with the site

package/dist/runtime/server/og-image/bindings/font-assets/external-url.js

@@ -1,4 +1,4 @@
-import { fetchWithRedirectValidation } from "../../../util/ssrf.js";
+import { fetchWithRedirectValidation, resolveSameOriginUrl } from "../../../util/ssrf.js";
 const SENTINEL_ORIGIN = "http://font-asset.invalid/";
 const SENTINEL_HOST = "font-asset.invalid";
 export function isDataFontUrl(path) {
@@ -13,23 +13,6 @@ export function isExternalFontUrl(path) {
   }
   return resolved.protocol !== "http:" || resolved.host !== SENTINEL_HOST;
 }
-export function resolveSameOriginFontUrl(path, siteUrl) {
-  if (!siteUrl)
-    return null;
-  let siteOrigin;
-  try {
-    siteOrigin = new URL(siteUrl).origin;
-  } catch {
-    return null;
-  }
-  let target;
-  try {
-    target = new URL(path, siteOrigin);
-  } catch {
-    return null;
-  }
-  return target.origin === siteOrigin ? target.href : null;
-}
 export async function fetchSpecialFontUrl(path, siteUrl, timeout) {
   if (isDataFontUrl(path)) {
     const res = await fetch(path.trimStart(), { signal: AbortSignal.timeout(timeout) }).catch(() => {
@@ -39,7 +22,7 @@ export async function fetchSpecialFontUrl(path, siteUrl, timeout) {
       return Buffer.from(await res.arrayBuffer());
     throw new Error("[Nuxt OG Image] Invalid data: font URL.");
   }
-  const href = resolveSameOriginFontUrl(path, siteUrl);
+  const href = resolveSameOriginUrl(path, siteUrl);
   if (!href)
     throw new Error("[Nuxt OG Image] External font URLs are not supported. Load custom fonts via @nuxt/fonts.");
   const ab = await fetchWithRedirectValidation(href, { timeout });

package/dist/runtime/server/og-image/bindings/satori/harfbuzz.d.ts

@@ -0,0 +1,4 @@
+declare const _default: {
+    readonly then: <TResult1 = unknown, TResult2 = never>(onfulfilled?: ((value: unknown) => TResult1 | PromiseLike<TResult1>) | null | undefined, onrejected?: ((reason: any) => TResult2 | PromiseLike<TResult2>) | null | undefined) => Promise<TResult1 | TResult2>;
+};
+export default _default;

package/dist/runtime/server/og-image/bindings/satori/harfbuzz.js

@@ -0,0 +1,33 @@
+import wrapHarfBuzz from "#og-image/harfbuzz-adapter";
+import callbackModules from "#og-image/harfbuzz-callbacks";
+import createHarfBuzz from "#og-image/harfbuzz-factory";
+function loadHarfBuzz() {
+  return import("#og-image/harfbuzz-wasm").then(async ({ default: importedWasm }) => {
+    const wasm = await importedWasm;
+    const callbacks = callbackModules && Object.fromEntries(await Promise.all(
+      Object.entries(callbackModules).map(async ([signature, module]) => [signature, await module])
+    ));
+    return new Promise((resolve, reject) => {
+      createHarfBuzz({
+        ...callbacks && {
+          convertJsFunctionToWasm(callback, signature) {
+            return new WebAssembly.Instance(callbacks[signature], { e: { f: callback } }).exports.f;
+          }
+        },
+        instantiateWasm(imports, receiveInstance) {
+          Promise.resolve().then(() => typeof wasm === "function" ? wasm(imports) : new WebAssembly.Instance(wasm, imports)).then((result) => {
+            receiveInstance("instance" in result ? result.instance : result);
+          }).catch(reject);
+          return {};
+        }
+      }).then(wrapHarfBuzz).then(resolve, reject);
+    });
+  });
+}
+let runtime;
+export default {
+  get then() {
+    const promise = runtime ||= loadHarfBuzz();
+    return promise.then.bind(promise);
+  }
+};

package/dist/runtime/server/og-image/browser/screenshot.js

@@ -5,6 +5,7 @@ import { getNitroOrigin } from "#site-config/server/composables";
 import { buildOgImageUrl } from "../../../shared.js";
 import { getFetchTimeout } from "../../util/fetchTimeout.js";
 import { logger } from "../../util/logger.js";
+import { resolveSameOriginUrl } from "../../util/ssrf.js";
 import { useOgImageRuntimeConfig } from "../../utils.js";
 function isPlaywrightPage(page) {
   return typeof page.setViewportSize === "function";
@@ -101,7 +102,9 @@ export async function createScreenshot({ basePath, e, options, extension, timing
         await page.setContent(html, { waitUntil: "networkidle0" });
       }
     } else {
-      const url = isPlaywrightPage(page) ? withQuery(path, options.props || {}) : `${getNitroOrigin(e)}${withQuery(path, options.props || {})}`;
+      const url = resolveSameOriginUrl(withQuery(path, options.props || {}), getNitroOrigin(e));
+      if (!url)
+        throw new Error("[Nuxt OG Image] The browser renderer can only navigate to a same-origin path.");
       await gotoWithIdle(page, url, 1e4);
     }
     const screenshotOptions = {

package/dist/runtime/server/og-image/context.js

@@ -13,6 +13,7 @@ import { autoEjectCommunityTemplate } from "../util/auto-eject.js";
 import { createNitroRouteRuleMatcher } from "../util/kit.js";
 import { normaliseOptions } from "../util/options.js";
 import { getEventQuery } from "../util/query.js";
+import { parseSameOriginPath } from "../util/ssrf.js";
 import { createTimings, TIMING_CTX_KEY } from "../util/timings.js";
 import { withTimeout } from "../util/withTimeout.js";
 import { useOgImageRuntimeConfig } from "../utils.js";
@@ -120,7 +121,14 @@ export async function resolveContext(e) {
     delete queryParams.html;
     queryParams = separateProps(queryParams);
   }
-  const basePath = withoutTrailingSlash(urlOptions._path || "/");
+  const rawPath = urlOptions._path ?? "/";
+  const basePath = parseSameOriginPath(typeof rawPath === "string" ? withoutTrailingSlash(rawPath) : rawPath);
+  if (!basePath) {
+    return createError({
+      statusCode: 400,
+      statusMessage: "[Nuxt OG Image] The _path option must be a same-origin path."
+    });
+  }
   const componentHash = urlOptions._componentHash || "";
   delete urlOptions._path;
   delete urlOptions._hash;

package/dist/runtime/server/og-image/font-subsets.d.ts

@@ -1,20 +1,12 @@
 import type { RuntimeFontConfig } from '../../types.js';
 /**
- * Rename unicode-range subset fonts so renderers can fall back between them.
- *
- * Both Satori and Takumi pick the first loaded font file for a given family
- * name and don't fall back to other font files for missing glyphs. When CJK
- * fonts like "Noto Sans SC" are split into 100+ unicode-range subsets by
- * fontsource, each covering ~200 characters, this means only one subset's
- * glyphs render while the rest show as .notdef boxes.
- *
- * Fix: rename each subset to "Family__N" and use font-family fallback chains
- * so renderers try each subset in order per character.
+ * Give subsets stable names so renderers can fall back between their glyphs.
+ * Renderers cache registrations by name across renders with different filtered subsets.
  */
 export declare function renameSubsetFonts(fonts: RuntimeFontConfig[]): RuntimeFontConfig[];
 /**
  * Build a mapping from original family names to their renamed subset chain.
- * E.g., "Noto Sans SC" → ["Noto Sans SC__0", "Noto Sans SC__1", ...]
+ * E.g., "Noto Sans SC" → ["Noto Sans SC__<hash-a>", "Noto Sans SC__<hash-b>", ...]
  */
 export declare function buildSubsetFamilyChain(fonts: RuntimeFontConfig[]): Map<string, string[]>;
 /**

package/dist/runtime/server/og-image/font-subsets.js

@@ -1,44 +1,67 @@
+import { fnv1a64Base36 } from "fnv1a-64";
 export function renameSubsetFonts(fonts) {
   const groups = /* @__PURE__ */ new Map();
-  for (const f of fonts) {
-    const key = `${f.family}\0${f.weight}\0${f.style}`;
-    const arr = groups.get(key);
-    if (arr)
-      arr.push(f);
+  for (const font of fonts) {
+    const members = groups.get(font.family);
+    if (members)
+      members.push(font);
     else
-      groups.set(key, [f]);
+      groups.set(font.family, [font]);
   }
-  const result = [];
-  let changed = false;
+  const aliases = /* @__PURE__ */ new Map();
   for (const members of groups.values()) {
-    const needsRename = members.length > 1 && new Set(members.map((f) => f.cacheKey)).size > 1;
-    if (!needsRename) {
-      result.push(...members);
-      continue;
+    const faces = /* @__PURE__ */ new Map();
+    for (const font of members) {
+      const face = `${font.weight}\0${font.style}`;
+      const subsets = faces.get(face);
+      if (subsets)
+        subsets.push(font);
+      else
+        faces.set(face, [font]);
     }
-    changed = true;
-    for (let i = 0; i < members.length; i++) {
-      const f = members[i];
-      result.push({
-        ...f,
-        originalFamily: f.originalFamily || f.family,
-        family: `${f.family}__${i}`
+    const needsRename = members.some((font) => font.unicodeRange) || [...faces.values()].some((subsets) => new Set(subsets.map((font) => font.cacheKey)).size > 1);
+    if (!needsRename)
+      continue;
+    const slots = [];
+    for (const subsets of faces.values()) {
+      const binaries = /* @__PURE__ */ new Map();
+      for (const font of subsets) {
+        const source = font.src || font.localPath || font.cacheKey;
+        const entries = binaries.get(source);
+        if (entries)
+          entries.push(font);
+        else
+          binaries.set(source, [font]);
+      }
+      const ordered = [...binaries.values()].sort((a, b) => {
+        const left = `${a[0].unicodeRange || ""}\0${a[0].src || a[0].localPath || a[0].cacheKey}`;
+        const right = `${b[0].unicodeRange || ""}\0${b[0].src || b[0].localPath || b[0].cacheKey}`;
+        return left < right ? -1 : left > right ? 1 : 0;
       });
+      for (const [index, entries] of ordered.entries())
+        (slots[index] ||= []).push(...entries);
+    }
+    for (const slot of slots) {
+      const identities = [...new Set(slot.map((font) => JSON.stringify([
+        font.weight,
+        font.style,
+        font.src || font.localPath || font.cacheKey
+      ])))].sort();
+      const alias = `${slot[0].family}__${fnv1a64Base36(JSON.stringify(identities))}`;
+      for (const font of slot)
+        aliases.set(font, alias);
     }
   }
-  return changed ? result : fonts;
+  return aliases.size ? fonts.map((font) => aliases.has(font) ? { ...font, originalFamily: font.originalFamily || font.family, family: aliases.get(font) } : font) : fonts;
 }
 export function buildSubsetFamilyChain(fonts) {
   const chains = /* @__PURE__ */ new Map();
   for (const f of fonts) {
-    if (!f.originalFamily)
-      continue;
-    const arr = chains.get(f.originalFamily);
-    if (arr)
-      arr.push(f.family);
-    else
-      chains.set(f.originalFamily, [f.family]);
+    if (f.originalFamily)
+      chains.set(f.originalFamily, []);
   }
+  for (const f of fonts)
+    chains.get(f.originalFamily || f.family)?.push(f.family);
   return chains;
 }
 export function resolveSubsetChain(family, chains) {

package/dist/runtime/server/og-image/fonts.d.ts

@@ -51,7 +51,7 @@ export interface LoadFontsForRendererOptions extends LoadFontsOptions {
  *
  * When a font family has multiple unicode-range subsets loaded (e.g., CJK fonts
  * split into many small chunks), renames each subset to a unique family name
- * (e.g., "Noto Sans SC__0", "Noto Sans SC__1") so renderers use font-family
+ * (e.g., "Noto Sans SC__<stable hash per binary>") so renderers use font-family
  * fallback chains for per-character glyph coverage. Without this, both Satori
  * and Takumi pick the first font file and show .notdef for characters in other subsets.
  */

package/dist/runtime/server/routes/resolve.js

@@ -4,6 +4,7 @@ import { fetchWithEvent } from "#nuxtseo/nitro";
 import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
 import { isInternalRoute } from "../../shared.js";
 import { getEventQuery } from "../util/query.js";
+import { parseSameOriginPath } from "../util/ssrf.js";
 import { useOgImageRuntimeConfig } from "../utils.js";
 const RE_META_TAG = /<meta\b[^>]*>/gi;
 const RE_META_KEY = /\b(?:property|name)\s*=\s*(?:"([^"]+)"|'([^']+)')/i;
@@ -11,7 +12,6 @@ const RE_META_CONTENT = /\bcontent\s*=\s*(?:"([^"]*)"|'([^']*)')/i;
 const MAX_RESOLVE_PATH_LENGTH = 2048;
 const RE_STRIP_PREFIX = /^.*?\/_og\/r/;
 const RE_IMAGE_EXT = /\.(?:png|jpe?g|webp|svg)$/i;
-const RE_DOUBLE_LEADING_SLASH = /^\/{2,}/;
 function extractMeta(html, key) {
   for (const tagMatch of html.matchAll(RE_META_TAG)) {
     const tag = tagMatch[0];
@@ -78,7 +78,7 @@ export default defineEventHandler(async (event) => {
       statusMessage: `[Nuxt OG Image] Target path exceeds ${MAX_RESOLVE_PATH_LENGTH} characters.`
     });
   }
-  if (targetPath.includes("://") || RE_DOUBLE_LEADING_SLASH.test(targetPath)) {
+  if (targetPath.includes("://") || !parseSameOriginPath(targetPath)) {
     throw createError({
       statusCode: 400,
       statusMessage: "[Nuxt OG Image] Target path must be a same-origin path."

package/dist/runtime/server/util/cloudflare.js

@@ -7,11 +7,11 @@ export function getCloudflareEnv(event) {
   const runtimeEnv = toRecord(runtimeCloudflare?.env);
   if (runtimeEnv)
     return runtimeEnv;
-  const contextCloudflare = toRecord(event?.context.cloudflare);
+  const contextCloudflare = toRecord(event?.context?.cloudflare);
   const contextEnv = toRecord(contextCloudflare?.env);
   if (contextEnv)
     return contextEnv;
-  const platform = toRecord(event?.context._platform);
+  const platform = toRecord(event?.context?._platform);
   const platformCloudflare = toRecord(platform?.cloudflare);
   return toRecord(platformCloudflare?.env);
 }

package/dist/runtime/server/util/eventHandlers.js

@@ -1,4 +1,4 @@
-import { createError, getRequestHost, H3Error, setHeader } from "#nuxtseo/h3";
+import { appendResponseHeader, createError, getRequestHost, H3Error, setHeader } from "#nuxtseo/h3";
 import { getSiteConfig } from "#site-config/server/composables/getSiteConfig";
 import { logger } from "../../logger.js";
 import { getBuildCachedImage, setBuildCachedImage } from "../og-image/cache/buildCache.js";
@@ -22,8 +22,8 @@ export async function imageEventHandler(e) {
   } finally {
     timings.record("total", performance.now() - reqStart);
     const header = timings.header();
-    if (header)
-      setHeader(e, "Server-Timing", header);
+    if (header && !e.node?.res?.headersSent)
+      appendResponseHeader(e, "Server-Timing", header);
   }
 }
 async function renderOgImage(e, ctx) {