packages/unhead/test/unit/plugins/capo.test.ts (1)

161-228: Exercise the new object/textContent path in these cases.

These ordering tests still pass pre-serialized innerHTML, so they won’t catch regressions in the new normalization/typing path this PR adds. Swapping one importmap/speculationrules fixture to raw object textContent (or raw object innerHTML) would cover the user-facing API more directly.

🧪 Suggested coverage tweak

   head.push({
     script: [{
       type: 'importmap',
-      innerHTML: JSON.stringify({ imports: { '#entry': '/entry.js' } }),
+      textContent: { imports: { '#entry': '/entry.js' } },
     }],
   })
@@
   head.push({
     script: [{
       type: 'speculationrules',
-      innerHTML: JSON.stringify({ prefetch: [{ source: 'list', urls: ['/next'] }] }),
+      textContent: { prefetch: [{ source: 'list', urls: ['/next'] }] },
     }],
   })

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/unhead/test/unit/plugins/capo.test.ts` around lines 161 - 228, The
tests 'importmap precedes modulepreload and module scripts' and
'speculationrules sorts late alongside prefetch/prerender' currently pass
pre-serialized JSON strings via innerHTML; update each push that creates the
importmap/speculationrules script to use the raw object path by replacing
innerHTML: JSON.stringify(...) with textContent: { ... } (i.e. pass the object
literal for imports/prefetch) so the new object/textContent normalization path
is exercised (look for the script pushes in those two it blocks and update the
innerHTML fields to textContent objects).

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

packages/unhead/src/utils/resolve.ts:90

• sanitizeTags only applies the \u003C escaping logic when innerHTML is present. For type="importmap" / type="speculationrules" (and existing JSON types), the recommended path is often textContent, which currently bypasses this normalization and can lead to inconsistent SSR output depending on whether callers use textContent vs innerHTML. Consider applying the same normalization/escaping to textContent for these JSON-like script types (or normalizing to a single content field before rendering).

    if (tag === 'script' && innerHTML) {
      const type = String(props.type)
      t.innerHTML = type.endsWith('json') || type === 'importmap' || type === 'speculationrules'
        ? (typeof innerHTML === 'string' ? innerHTML : JSON.stringify(innerHTML)).replace(LT_RE, '\\u003C')
        : typeof innerHTML === 'string' ? innerHTML.replace(SCRIPT_END_RE, '<\\/script') : innerHTML
      t._d = dedupeKey(t)
    }

packages/unhead/src/server/sort.ts:46

• capoTagWeight classifies inline sync scripts using tag.innerHTML, but inline scripts can also be provided via textContent (per the schema types). As written, <script textContent="..."> will fall through to the default weight (100) instead of the sync-script bucket, making ordering depend on whether callers chose innerHTML vs textContent. Update the sync-script condition to treat textContent the same as innerHTML for inline scripts.

    else if (isTruthy(tag.props.async))
      weight = CAPO_WEIGHTS.script.async
    else if ((tag.props.src && !isTruthy(tag.props.defer) && !isTruthy(tag.props.async) && type !== 'module' && !type.endsWith('json')) || (tag.innerHTML && !type.endsWith('json')))
      weight = CAPO_WEIGHTS.script.sync
    else if ((isTruthy(tag.props.defer) && tag.props.src && !isTruthy(tag.props.async)) || type === 'module')
      weight = CAPO_WEIGHTS.script.defer

packages/unhead/src/utils/resolve.ts (1)

85-86: Normalize script type before JSON-like matching.

Line 85 uses raw props.type, so mixed-case values (e.g. Application/LD+JSON, ImportMap) won’t take the JSON-like escape path. Normalize once before checks to keep behavior consistent.

Suggested patch

-      const type = String(props.type)
+      const type = String(props.type || '').trim().toLowerCase()
       const isJsonLike = type.endsWith('json') || type === 'importmap' || type === 'speculationrules'

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/unhead/src/utils/resolve.ts` around lines 85 - 86, The JSON-like
detection uses the raw props.type so mixed-case values slip through; normalize
the type string to a consistent case (e.g. lower-case) before performing checks.
In resolve.ts update the handling around the type constant and isJsonLike (the
String(props.type) assignment and the isJsonLike check) to use a normalized
value (e.g. assign const type = String(props.type).toLowerCase() or create a
separate normalizedType variable) and then match against 'json', 'importmap',
and 'speculationrules' on that normalized value.

packages/unhead/test/unit/server/xss.test.ts (1)

354-380: Optional: assert script type in both new XSS tests for clearer diagnostics.

These tests are good; adding type="importmap" / type="speculationrules" assertions would make regressions easier to pinpoint if rendering behavior changes.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@packages/unhead/test/unit/server/xss.test.ts` around lines 354 - 380, Add
explicit assertions that the rendered script tag includes the correct type
attribute in each new XSS test to improve diagnostics: in the "importmap
textContent is escaped like JSON types" test, assert that ctx.headTags contains
type="importmap"; and in the "speculationrules textContent is escaped like JSON
types" test, assert that ctx.headTags contains type="speculationrules". Locate
the checks after calling renderSSRHead(head) (functions
createServerHeadWithContext and renderSSRHead) and add the type assertions
alongside the existing checks for '\\u003C' and absence of the raw
closing-script pattern.