@abraca/nuxt 1.9.1 → 2.0.1

package/dist/runtime/utils/lucideIcons.js

@@ -0,0 +1,451 @@
+export const LUCIDE_ICON_NAMES = [
+  // ── activity & general ────────────────────────────────────────────────────
+  "activity",
+  "airplay",
+  "alarm-clock",
+  "album",
+  "alert-circle",
+  "alert-octagon",
+  "alert-triangle",
+  "align-center",
+  "align-justify",
+  "align-left",
+  "align-right",
+  "anchor",
+  "aperture",
+  "archive",
+  "arrow-down",
+  "arrow-down-circle",
+  "arrow-left",
+  "arrow-left-circle",
+  "arrow-right",
+  "arrow-right-circle",
+  "arrow-up",
+  "arrow-up-circle",
+  "asterisk",
+  "at-sign",
+  "award",
+  // ── B ──────────────────────────────────────────────────────────────────────
+  "baby",
+  "backpack",
+  "badge",
+  "badge-check",
+  "banknote",
+  "bar-chart",
+  "bar-chart-2",
+  "bar-chart-3",
+  "battery",
+  "battery-charging",
+  "battery-full",
+  "battery-low",
+  "beaker",
+  "bed",
+  "bell",
+  "bell-off",
+  "bike",
+  "binary",
+  "bird",
+  "bluetooth",
+  "bold",
+  "book",
+  "book-open",
+  "bookmark",
+  "box",
+  "briefcase",
+  "brush",
+  "bug",
+  "building",
+  "building-2",
+  // ── C ──────────────────────────────────────────────────────────────────────
+  "calculator",
+  "calendar",
+  "calendar-check",
+  "calendar-clock",
+  "calendar-days",
+  "calendar-range",
+  "calendar-x",
+  "camera",
+  "camera-off",
+  "car",
+  "cast",
+  "check",
+  "check-circle",
+  "check-circle-2",
+  "check-square",
+  "chevron-down",
+  "chevron-left",
+  "chevron-right",
+  "chevron-up",
+  "chevrons-down",
+  "chevrons-left",
+  "chevrons-right",
+  "chevrons-up",
+  "circle",
+  "clipboard",
+  "clipboard-check",
+  "clipboard-copy",
+  "clock",
+  "cloud",
+  "cloud-download",
+  "cloud-off",
+  "cloud-upload",
+  "code",
+  "code-2",
+  "codepen",
+  "coffee",
+  "cog",
+  "columns",
+  "command",
+  "compass",
+  "contact",
+  "copy",
+  "copyright",
+  "cpu",
+  "credit-card",
+  "crop",
+  "cross",
+  "crosshair",
+  "crown",
+  "currency",
+  // ── D ──────────────────────────────────────────────────────────────────────
+  "database",
+  "delete",
+  "diamond",
+  "dice-1",
+  "disc",
+  "divide",
+  "dollar-sign",
+  "download",
+  "download-cloud",
+  "droplet",
+  "droplets",
+  // ── E ──────────────────────────────────────────────────────────────────────
+  "edit",
+  "edit-2",
+  "edit-3",
+  "egg",
+  "equal",
+  "eraser",
+  "euro",
+  "expand",
+  "external-link",
+  "eye",
+  "eye-off",
+  // ── F ──────────────────────────────────────────────────────────────────────
+  "feather",
+  "figma",
+  "file",
+  "file-audio",
+  "file-check",
+  "file-code",
+  "file-image",
+  "file-input",
+  "file-output",
+  "file-text",
+  "file-video",
+  "files",
+  "film",
+  "filter",
+  "fingerprint",
+  "flag",
+  "flame",
+  "flask-conical",
+  "flower",
+  "folder",
+  "folder-open",
+  "folder-plus",
+  "forward",
+  "frame",
+  "framer",
+  "frown",
+  "fuel",
+  "function-square",
+  // ── G ──────────────────────────────────────────────────────────────────────
+  "gamepad",
+  "gamepad-2",
+  "gauge",
+  "gem",
+  "ghost",
+  "gift",
+  "git-branch",
+  "git-commit",
+  "git-fork",
+  "git-merge",
+  "git-pull-request",
+  "github",
+  "gitlab",
+  "glasses",
+  "globe",
+  "globe-2",
+  "graduation-cap",
+  "grid",
+  "grip",
+  "grip-horizontal",
+  "grip-vertical",
+  // ── H ──────────────────────────────────────────────────────────────────────
+  "hammer",
+  "hand",
+  "handshake",
+  "hard-drive",
+  "hash",
+  "headphones",
+  "heart",
+  "help-circle",
+  "hexagon",
+  "highlighter",
+  "history",
+  "home",
+  // ── I ──────────────────────────────────────────────────────────────────────
+  "image",
+  "image-off",
+  "image-plus",
+  "inbox",
+  "indent",
+  "infinity",
+  "info",
+  "italic",
+  // ── K-L ────────────────────────────────────────────────────────────────────
+  "key",
+  "keyboard",
+  "lamp",
+  "laptop",
+  "layers",
+  "layout",
+  "layout-dashboard",
+  "layout-grid",
+  "layout-list",
+  "leaf",
+  "library",
+  "lifebuoy",
+  "lightbulb",
+  "link",
+  "link-2",
+  "list",
+  "list-checks",
+  "list-todo",
+  "loader",
+  "loader-2",
+  "locate",
+  "lock",
+  "log-in",
+  "log-out",
+  // ── M ──────────────────────────────────────────────────────────────────────
+  "mail",
+  "mail-open",
+  "map",
+  "map-pin",
+  "map-pin-off",
+  "martini",
+  "maximize",
+  "maximize-2",
+  "medal",
+  "megaphone",
+  "meh",
+  "menu",
+  "message-circle",
+  "message-square",
+  "mic",
+  "mic-off",
+  "minimize",
+  "minimize-2",
+  "minus",
+  "minus-circle",
+  "monitor",
+  "moon",
+  "more-horizontal",
+  "more-vertical",
+  "mountain",
+  "mouse",
+  "mouse-pointer",
+  "move",
+  "music",
+  // ── N-O ────────────────────────────────────────────────────────────────────
+  "navigation",
+  "newspaper",
+  "octagon",
+  "option",
+  // ── P ──────────────────────────────────────────────────────────────────────
+  "package",
+  "paint-bucket",
+  "paintbrush",
+  "palette",
+  "paperclip",
+  "parking-circle",
+  "pause",
+  "pause-circle",
+  "pen",
+  "pen-tool",
+  "pencil",
+  "percent",
+  "phone",
+  "phone-call",
+  "phone-off",
+  "pie-chart",
+  "pin",
+  "pin-off",
+  "play",
+  "play-circle",
+  "plug",
+  "plus",
+  "plus-circle",
+  "plus-square",
+  "pocket",
+  "podcast",
+  "power",
+  "printer",
+  "puzzle",
+  // ── Q-R ────────────────────────────────────────────────────────────────────
+  "qr-code",
+  "quote",
+  "radio",
+  "redo",
+  "redo-2",
+  "refresh-ccw",
+  "refresh-cw",
+  "repeat",
+  "reply",
+  "rewind",
+  "rocket",
+  "rotate-ccw",
+  "rotate-cw",
+  "rss",
+  "ruler",
+  // ── S ──────────────────────────────────────────────────────────────────────
+  "save",
+  "scale",
+  "scan",
+  "school",
+  "scissors",
+  "screen-share",
+  "search",
+  "send",
+  "separator-horizontal",
+  "separator-vertical",
+  "server",
+  "settings",
+  "settings-2",
+  "share",
+  "share-2",
+  "shield",
+  "shield-alert",
+  "shield-check",
+  "shield-off",
+  "ship",
+  "shopping-bag",
+  "shopping-cart",
+  "shrink",
+  "shuffle",
+  "sidebar",
+  "sigma",
+  "signal",
+  "skip-back",
+  "skip-forward",
+  "slack",
+  "slash",
+  "sliders",
+  "smartphone",
+  "smile",
+  "snowflake",
+  "sofa",
+  "sort-asc",
+  "sort-desc",
+  "soup",
+  "space",
+  "sparkles",
+  "speaker",
+  "spline",
+  "split",
+  "square",
+  "star",
+  "sticker",
+  "sticky-note",
+  "stop-circle",
+  "store",
+  "strikethrough",
+  "subscript",
+  "sun",
+  "sunrise",
+  "sunset",
+  "superscript",
+  "swords",
+  "syringe",
+  // ── T ──────────────────────────────────────────────────────────────────────
+  "table",
+  "tablet",
+  "tag",
+  "tags",
+  "target",
+  "tent",
+  "terminal",
+  "text",
+  "thermometer",
+  "thumbs-down",
+  "thumbs-up",
+  "ticket",
+  "timer",
+  "toggle-left",
+  "toggle-right",
+  "tornado",
+  "tower-control",
+  "trash",
+  "trash-2",
+  "tree-deciduous",
+  "tree-pine",
+  "trello",
+  "trending-down",
+  "trending-up",
+  "triangle",
+  "trophy",
+  "truck",
+  "tv",
+  "twitch",
+  "twitter",
+  "type",
+  // ── U-V ────────────────────────────────────────────────────────────────────
+  "umbrella",
+  "underline",
+  "undo",
+  "undo-2",
+  "unlock",
+  "upload",
+  "upload-cloud",
+  "usb",
+  "user",
+  "user-check",
+  "user-minus",
+  "user-plus",
+  "user-x",
+  "users",
+  "utensils",
+  "verified",
+  "vibrate",
+  "video",
+  "video-off",
+  "voicemail",
+  "volume",
+  "volume-1",
+  "volume-2",
+  "volume-x",
+  // ── W-Z ────────────────────────────────────────────────────────────────────
+  "wallet",
+  "wand",
+  "wand-2",
+  "watch",
+  "waves",
+  "webcam",
+  "wifi",
+  "wifi-off",
+  "wind",
+  "wine",
+  "workflow",
+  "wrap-text",
+  "x",
+  "x-circle",
+  "x-octagon",
+  "x-square",
+  "youtube",
+  "zap",
+  "zap-off",
+  "zoom-in",
+  "zoom-out"
+].sort();

package/dist/runtime/utils/sanitizeSvg.d.ts

@@ -0,0 +1,19 @@
+/**
+ * sanitizeSvg — modular SVG sanitizer.
+ *
+ * Tries to use DOMPurify (if the consumer installed it) for industry-grade
+ * sanitization. Falls back to a strict built-in allowlist that strips:
+ *   - <script>, <foreignObject>, <iframe>, <embed>, <object>
+ *   - `on*` event-handler attributes
+ *   - `href` / `xlink:href` values that aren't `#anchor` (blocks `javascript:`)
+ *
+ * The built-in is intentionally conservative — it errs on the side of
+ * removing benign content rather than allowing risky content through.
+ * Apps that need more permissive sanitization (CSS classes, animations,
+ * external refs they own) should install DOMPurify and configure it.
+ */
+/**
+ * Sanitize an SVG string. Async because DOMPurify is loaded lazily.
+ * Returns the safe SVG markup, or empty string if nothing safe remained.
+ */
+export declare function sanitizeSvg(svg: string): Promise<string>;

package/dist/runtime/utils/sanitizeSvg.js

@@ -0,0 +1,87 @@
+let domPurifyCache = null;
+let loadingPromise = null;
+let warnedMissing = false;
+async function tryLoadDomPurify() {
+  if (domPurifyCache) return domPurifyCache;
+  if (loadingPromise) return loadingPromise;
+  loadingPromise = (async () => {
+    try {
+      const pkg = "dompurify";
+      const mod = await import(
+        /* @vite-ignore */
+        pkg
+      );
+      domPurifyCache = mod?.default ?? mod;
+      return domPurifyCache;
+    } catch {
+      if (import.meta.dev && !warnedMissing) {
+        warnedMissing = true;
+        console.warn(
+          "[abracadabra] svg-embed: `dompurify` peer dependency not installed. Falling back to a strict built-in SVG sanitizer. Install with `pnpm add dompurify` for richer SVG support (CSS, animations, etc.)."
+        );
+      }
+      return null;
+    } finally {
+      loadingPromise = null;
+    }
+  })();
+  return loadingPromise;
+}
+const DANGEROUS_TAGS = /* @__PURE__ */ new Set([
+  "script",
+  "foreignobject",
+  "iframe",
+  "embed",
+  "object",
+  "meta",
+  "link"
+]);
+const ALLOWED_PROTOCOL_PREFIXES = ["#", "data:image/"];
+function strictBuiltinSanitize(svg) {
+  const stripped = svg.replace(/<\?xml[^?]*\?>/gi, "").replace(/<!DOCTYPE[^>]*>/gi, "").trim();
+  if (!stripped) return "";
+  if (typeof DOMParser === "undefined") {
+    return "";
+  }
+  const doc = new DOMParser().parseFromString(stripped, "image/svg+xml");
+  if (doc.querySelector("parsererror")) return "";
+  const walker = doc.createTreeWalker(doc.documentElement, NodeFilter.SHOW_ELEMENT);
+  const toRemove = [];
+  let node = doc.documentElement;
+  while (node) {
+    if (DANGEROUS_TAGS.has(node.tagName.toLowerCase())) {
+      toRemove.push(node);
+    } else {
+      for (const attr of Array.from(node.attributes)) {
+        const name = attr.name.toLowerCase();
+        if (name.startsWith("on")) {
+          node.removeAttribute(attr.name);
+          continue;
+        }
+        if (name === "href" || name === "xlink:href") {
+          const v = attr.value.trim().toLowerCase();
+          if (!ALLOWED_PROTOCOL_PREFIXES.some((p) => v.startsWith(p))) {
+            node.removeAttribute(attr.name);
+          }
+        }
+      }
+    }
+    node = walker.nextNode();
+  }
+  for (const el of toRemove) el.remove();
+  return doc.documentElement.outerHTML;
+}
+export async function sanitizeSvg(svg) {
+  if (!svg) return "";
+  const purify = await tryLoadDomPurify();
+  if (purify) {
+    const stripped = svg.replace(/<\?xml[^?]*\?>/gi, "").replace(/<!DOCTYPE[^>]*>/gi, "").trim();
+    return purify.sanitize(stripped, {
+      USE_PROFILES: { svg: true, svgFilters: true },
+      ADD_TAGS: ["use", "style"],
+      FORBID_TAGS: ["script", "foreignObject", "iframe", "embed", "object"],
+      FORBID_ATTR: ["onload", "onerror", "onclick", "onmouseover", "onfocus", "onblur"]
+    });
+  }
+  return strictBuiltinSanitize(svg);
+}

package/dist/runtime/utils/time.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Coerce a timestamp of unknown JS type into a millisecond number.
+ *
+ * Yjs deserialises values written as Rust `Any::BigInt` into JS `bigint`,
+ * not `number`. The natural `typeof v === 'number'` filter silently drops
+ * those, breaking comparisons (read-cursor "delivered → read") and sort
+ * orders (notification ordering).
+ *
+ * The Abracadabra server now emits ts fields as `Any::Number` for new
+ * writes, but historical data and any non-canonical server may still send
+ * `bigint`. Always route server-stamped ts values through this helper.
+ *
+ * Returns null when the value isn't a usable timestamp.
+ */
+export declare function tsToMs(value: unknown): number | null;

package/dist/runtime/utils/time.js

@@ -0,0 +1,5 @@
+export function tsToMs(value) {
+  if (typeof value === "number") return Number.isFinite(value) ? value : null;
+  if (typeof value === "bigint") return Number(value);
+  return null;
+}

package/dist/types.d.mts

@@ -12,6 +12,10 @@ export { type ParsedMessage, type TextSegment, type parseMessageContent, type pr
 
 export { type DupEntry, type duplicateDocContent, type duplicateDocTree } from '../dist/runtime/utils/duplicateDocContent.js'
 
+export { type AuditLogEntry, type AuditQueryOpts, type AuditVerifyResult, type DocSearchHit, type ReadyzStatus } from '@abraca/dabra'
+
+export { type ServerTrashEntry } from '../dist/runtime/composables/useServerTrash.js'
+
 export { type SlugMap, type SlugMapEntry, type buildSlugMap, type isUUID, type slugify } from '../dist/runtime/utils/slugify.js'
 
 export { type avatarBorderStyle, type avatarGradient, type avatarStyleFromName } from '../dist/runtime/utils/avatarStyle.js'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abraca/nuxt",
-  "version": "1.9.1",
+  "version": "2.0.1",
   "description": "First-class Nuxt module for the Abracadabra CRDT collaboration platform",
   "repository": "abracadabra/abracadabra-nuxt",
   "license": "MIT",
@@ -42,16 +42,17 @@
     "test:types": "vue-tsc --noEmit && cd playground && vue-tsc --noEmit"
   },
   "dependencies": {
-    "@nuxt/kit": "^4.4.2",
-    "@vueuse/core": "^14.2.1",
+    "@nuxt/kit": "^4.4.4",
+    "@vueuse/core": "^14.3.0",
     "defu": "^6.1.7",
     "nanoevents": "^9.1.0"
   },
   "peerDependencies": {
-    "@abraca/dabra": "^1.5.0",
+    "@abraca/dabra": "^2.0.0",
     "@noble/ed25519": "~2.3.0",
     "@noble/hashes": "^1.8.0",
     "@nuxt/ui": "^3.0.0",
+    "@tanstack/vue-virtual": "^3.10.0",
     "@tiptap/core": "^3.0.0",
     "@tiptap/extension-collaboration": "^3.0.0",
     "@tiptap/extension-collaboration-caret": "^3.0.0",
@@ -64,6 +65,9 @@
     "yjs": "^13.0.0"
   },
   "peerDependenciesMeta": {
+    "@tanstack/vue-virtual": {
+      "optional": true
+    },
     "d3-force": {
       "optional": true
     },
@@ -86,34 +90,40 @@
       "optional": false
     }
   },
+  "dependenciesMeta": {
+    "@abraca/dabra": {
+      "injected": true
+    }
+  },
   "devDependencies": {
-    "@abraca/dabra": "1.9.1",
+    "@abraca/dabra": "^2.0.1",
+    "@iconify-json/lucide": "^1.2.105",
     "@noble/ed25519": "~2.3.0",
     "@noble/hashes": "^1.8.0",
     "@nuxt/eslint-config": "^1.15.2",
     "@nuxt/module-builder": "^1.0.2",
-    "@nuxt/schema": "^4.4.2",
-    "@nuxt/test-utils": "^4.0.2",
-    "@nuxt/ui": "^4.6.1",
+    "@nuxt/schema": "^4.4.4",
+    "@nuxt/test-utils": "^4.0.3",
+    "@nuxt/ui": "^4.7.1",
     "@playwright/test": "^1.59.1",
-    "@tiptap/core": "^3.22.4",
-    "@tiptap/extension-collaboration": "^3.22.4",
-    "@tiptap/extension-collaboration-caret": "^3.22.4",
-    "@tiptap/vue-3": "^3.22.4",
+    "@tiptap/core": "^3.22.5",
+    "@tiptap/extension-collaboration": "^3.22.5",
+    "@tiptap/extension-collaboration-caret": "^3.22.5",
+    "@tiptap/vue-3": "^3.22.5",
     "@types/d3-force": "^3.0.10",
     "@types/node": "latest",
     "@types/ws": "^8.18.1",
-    "@vue/test-utils": "^2.4.6",
+    "@vue/test-utils": "^2.4.10",
     "changelogen": "^0.6.2",
     "d3-force": "^3.0.0",
-    "eslint": "^10.2.1",
+    "eslint": "^10.3.0",
     "happy-dom": "^20.9.0",
-    "nuxt": "^4.4.2",
+    "nuxt": "^4.4.4",
     "tslib": "^2.8.1",
     "typescript": "~6.0.3",
     "vitest": "^4.1.5",
     "vue": "^3.5.33",
-    "vue-tsc": "^3.2.7",
+    "vue-tsc": "^3.2.8",
     "ws": "^8.20.0",
     "yjs": "^13.6.30"
   },