// JSON.stringify leaves `<` alone, so a user-written bio or description containing
// `</script>` would close the tag and run whatever follows. escaping these keeps the
// output valid JSON that parses to the same value
const UNSAFE: Record<string, string> = {
	"<": "\\u003c",
	">": "\\u003e",
	"&": "\\u0026",
	"\u2028": "\\u2028",
	"\u2029": "\\u2029"
};

export const serializeJsonLd = (schema: unknown): string =>
	JSON.stringify(schema).replace(/[<>&\u2028\u2029]/g, (char) => UNSAFE[char]);