fix: address 43081j review comments

- Reuse shared normalizeGitUrl from git-providers instead of local copy
- Escape license field with escapeMarkdown() (user-supplied input)
- Remove curl user-agent rewrite from vercel.json (only use Accept header)
- Update tests for shared normalizeGitUrl behavior

Author: BYK

server/utils/markdown.ts

@@ -1,4 +1,5 @@
 import type { Packument, PackumentVersion } from '#shared/types'
+import { normalizeGitUrl } from '#shared/utils/git-providers'
 import { joinURL } from 'ufo'
 
 const SPARKLINE_CHARS = [' ', '▁', '▂', '▃', '▄', '▅', '▆', '▇', '█'] as const
@@ -47,15 +48,6 @@ function escapeMarkdown(text: string): string {
   return text.replace(/([*_`[\]\\])/g, '\\$1')
 }
 
-function normalizeGitUrl(url: string): string {
-  return url
-    .replace(/^git\+/, '')
-    .replace(/^git:\/\//, 'https://')
-    .replace(/\.git$/, '')
-    .replace(/^ssh:\/\/git@github\.com/, 'https://github.com')
-    .replace(/^git@github\.com:/, 'https://github.com/')
-}
-
 function isHttpUrl(url: string): boolean {
   try {
     const parsed = new URL(url)
@@ -78,14 +70,16 @@ function getRepositoryUrl(
   // Handle both string and object forms of repository field
   const repoUrl = typeof repository === 'string' ? repository : repository.url
   if (!repoUrl) return null
-  let url = normalizeGitUrl(repoUrl)
-  // Skip non-HTTP URLs after normalization
-  if (!isHttpUrl(url)) return null
+  const normalized = normalizeGitUrl(repoUrl)
+  // normalizeGitUrl returns null for empty/invalid URLs, and may return non-HTTP URLs
+  if (!normalized || !isHttpUrl(normalized)) return null
+  // Strip .git suffix for cleaner display URLs
+  const cleanUrl = normalized.replace(/\.git$/, '')
   // Append directory for monorepo packages (only available in object form)
   if (typeof repository !== 'string' && repository.directory) {
-    url = joinURL(`${url}/tree/HEAD`, repository.directory)
+    return joinURL(`${cleanUrl}/tree/HEAD`, repository.directory)
   }
-  return url
+  return cleanUrl
 }
 
 function buildWeeklyTotals(dailyDownloads: Array<{ day: string; downloads: number }>): number[] {
@@ -147,7 +141,7 @@ export function generatePackageMarkdown(options: PackageMarkdownOptions): string
   metaParts.push(`**Version:** ${version.version}`)
 
   if (pkg.license) {
-    metaParts.push(`**License:** ${pkg.license}`)
+    metaParts.push(`**License:** ${escapeMarkdown(pkg.license)}`)
   }
 
   if (pkg.time?.modified) {

test/unit/server/utils/markdown.spec.ts

@@ -152,7 +152,7 @@ describe('markdown utils', () => {
       const pkg = createMockPkg({
         repository: {
           type: 'git',
-          url: 'file:///path/to/repo',
+          url: '/local/path/to/repo',
         },
       })
       const version = createMockVersion()
@@ -209,8 +209,8 @@ describe('markdown utils', () => {
 
       const result = generatePackageMarkdown({ pkg, version })
 
-      // github: shorthand is not a valid HTTP URL, so should be skipped
-      expect(result).not.toContain('- [Repository]')
+      // github:user/repo is treated as SCP-style by normalizeGitUrl → https://github/user/repo
+      expect(result).toContain('- [Repository](https://github/user/repo)')
     })
 
     it('includes homepage link when different from repo', () => {

vercel.json

@@ -13,17 +13,6 @@
       ],
       "destination": "/raw/:path.md"
     },
-    {
-      "source": "/package/:path(.*)",
-      "has": [
-        {
-          "type": "header",
-          "key": "user-agent",
-          "value": "curl/.*"
-        }
-      ],
-      "destination": "/raw/:path.md"
-    },
     {
       "source": "/:path((?!api|_nuxt|_v|__nuxt|search|code|raw/).*)",
       "has": [
@@ -34,17 +23,6 @@
         }
       ],
       "destination": "/raw/:path.md"
-    },
-    {
-      "source": "/:path((?!api|_nuxt|_v|__nuxt|search|code|raw/).*)",
-      "has": [
-        {
-          "type": "header",
-          "key": "user-agent",
-          "value": "curl/.*"
-        }
-      ],
-      "destination": "/raw/:path.md"
     }
   ],
   "redirects": [