@atmo-dev/kit 0.7.0 → 0.7.1

package/README.md

@@ -121,6 +121,8 @@ The event UI formerly in `@atmo-dev/events-ui` lives in this package:
 - `@atmo-dev/kit/events-data`: structural event types, adapter contracts, conference/date helpers, URL helpers, theme values, linked-record types and thumbnail selection. This entry is safe in plain Node and server routes: no Svelte, CSS, maps or players are loaded. Browser helpers such as `compressImage` only access browser APIs when called.
 - `@atmo-dev/kit/events/editor`: `buildEventRecord` and `buildThumbnailMedia` for hosts that need explicit record construction. This separate entry includes browser-oriented thumbnail code; it is not part of the pure data API.
 
+Event descriptions are plain text with AT Protocol facets, rendered by the shared `RichText` component using Svelte text and links—not HTML. Markdown and raw HTML are displayed literally; existing records are not rewritten. Line breaks are preserved. Facet mentions link to local profiles, hashtags use the viewer's preferred social client, and link facets accept only HTTP(S) URLs without credentials. Malformed, overlapping or invalid UTF-8 facet ranges are ignored without dropping text. Descriptions without facets detect plain-text links, mentions and hashtags, with no network requests or Markdown interpretation. There is no sanitizer or asynchronous browser-only fallback.
+
 Event cards and covers prefer native `media` images, then an HTTPS `poster.url`, then a URI named `Event Image` (laugh.town compatibility). `getEventExternalImage(event)` from `events-data` returns `{ url, alt, aspectRatio? }` or `null`, validating URLs and optional poster dimensions. It performs no IO; apps must apply their own allowlist/redirect policy before fetching an external image server-side.
 
 Apps implement `EditorAdapter` for authentication prompts, repository IO, uploads, save/delete navigation, and optional linked-record transport/indexing notifications. Keep sessions, Cloudflare bindings, app routes, server endpoints, caching and moderation in the app. The editor/view never imports a consumer's app state. Existing `EventView` page-data shape and RSVP behavior are preserved in this migration.
@@ -192,6 +194,26 @@ For now, `createGrainXrpcClient(fetchImpl?)` provides the Grain.social implement
 
 Use `blueskyPostToPostData(postView)` to convert public AppView posts, including `repostCount`. `PostContent` supports images, galleries, external link cards, HLS video, quoted posts (including their embeds), record-with-media combinations, feeds, lists, starter packs, and moderation-service cards. Missing, blocked, and detached quotes have readable placeholders; unknown embed variants show an unavailable fallback. Quote nesting is capped at three levels. Non-post record cards use Bluesky routes, since other clients may not implement them. Apps still own fetching and moderation.
 
+### Plain text and facets
+
+`RichText` is the text renderer shared by posts and event descriptions:
+
+```svelte
+<script lang="ts">
+	import { RichText } from '@atmo-dev/kit';
+</script>
+
+<RichText
+	text={description}
+	{facets}
+	{socialClient}
+	mentionUrl={(actor) => `/p/${encodeURIComponent(actor)}`}
+	detectLinks
+/>
+```
+
+Only `text` is required. By default, only explicit facets become links. `detectLinks` enables plain-text URL, mention and hashtag detection when no facets are supplied. `socialClient` selects mention/hashtag destinations; `mentionUrl` overrides mention routing with an app-owned HTTP(S) URL or root-relative path. Local links stay in the same tab; external links use `noopener noreferrer nofollow ugc`. The component renders a paragraph, preserves whitespace, wraps long text, and accepts `class`. Text is never parsed as HTML or Markdown. Post text retains Bluesky facet destinations by default.
+
 ### Special link embeds
 
 External links use an ordered provider registry. YouTube watch, short, live, embed, and `youtu.be` links get a click-to-load, privacy-enhanced player. No YouTube iframe or SDK is loaded before activation; the preview uses only the supplied AppView thumbnail. Klipy's `static.klipy.com/ii/...` media links render GIFs or looping, muted video using Bluesky's media proxy, preserving the GIF description as alt text. Klipy media autoplays and loops without native video controls or a caption row. A small corner-overlay pause/play button controls the animation; pausing video preserves its current frame. With reduced motion enabled, it stays on the preview until explicitly played. Ordinary Klipy page links without a usable media URL remain link cards; no metadata API or API key is needed. Unknown URLs and playback failures fall back to the original link card.

package/dist/components/PostContent.svelte

@@ -5,7 +5,8 @@
 	import { socialPostUrl } from '../social/urls.js';
 	import { focus } from '../styles.js';
 	import Icon from './Icon.svelte';
-	import { richTextSegments, safeWebUrl } from '../social/richtext.js';
+	import { safeWebUrl } from '../social/richtext.js';
+	import RichText from './RichText.svelte';
 	import type { ExternalEmbedProvider } from '../social/external-embeds.js';
 	import ExternalEmbed from './ExternalEmbed.svelte';
 	import PostVideo from './PostVideo.svelte';
@@ -28,15 +29,7 @@
 	};
 </script>
 
-{#if post.text}<p class="text-sm leading-relaxed break-words whitespace-pre-wrap text-ink">
-		{#each richTextSegments(post.text, post.facets) as segment, index (index)}{#if segment.href}<a
-					href={segment.href}
-					target="_blank"
-					rel="noopener noreferrer nofollow"
-					class="text-action underline decoration-action/40 underline-offset-2 hover:decoration-action"
-					>{segment.text}</a
-				>{:else}{segment.text}{/if}{/each}
-	</p>{/if}
+{#if post.text}<RichText text={post.text} facets={post.facets} class="text-sm" />{/if}
 {#each post.embeds ?? [] as embed, index (index)}
 	<div class="mt-3">
 		{#if embed.type === 'external'}<ExternalEmbed {embed} providers={embedProviders} />

package/dist/components/RichText.svelte

@@ -0,0 +1,33 @@
+<script lang="ts">
+	import { richTextSegments, type RichTextOptions } from '../social/richtext.js';
+	import { cn } from '../utils.js';
+
+	export type RichTextProps = RichTextOptions & {
+		text: string;
+		/** Public record data is validated at runtime, including malformed facets. */
+		facets?: unknown;
+		class?: string;
+	};
+
+	let {
+		text,
+		facets,
+		socialClient,
+		mentionUrl,
+		detectLinks = false,
+		class: className
+	}: RichTextProps = $props();
+	let segments = $derived(
+		richTextSegments(text, facets, { socialClient, mentionUrl, detectLinks })
+	);
+</script>
+
+<p class={cn('leading-relaxed wrap-anywhere whitespace-pre-wrap text-ink', className)}>
+	{#each segments as segment, index (index)}{#if segment.href}<a
+				href={segment.href}
+				target={segment.href.startsWith('/') ? undefined : '_blank'}
+				rel={segment.href.startsWith('/') ? undefined : 'noopener noreferrer nofollow ugc'}
+				class="text-action underline decoration-action/40 underline-offset-2 hover:decoration-action"
+				>{segment.text}</a
+			>{:else}{segment.text}{/if}{/each}
+</p>

package/dist/components/RichText.svelte.d.ts

@@ -0,0 +1,10 @@
+import { type RichTextOptions } from '../social/richtext.js';
+export type RichTextProps = RichTextOptions & {
+    text: string;
+    /** Public record data is validated at runtime, including malformed facets. */
+    facets?: unknown;
+    class?: string;
+};
+declare const RichText: import("svelte").Component<RichTextProps, {}, "">;
+type RichText = ReturnType<typeof RichText>;
+export default RichText;

package/dist/events/EventView.svelte

@@ -31,7 +31,8 @@
 	import { eventStreamLink, parseGrainLink } from './linked-records.js';
 	import AddToCalendarButton from './event-view/AddToCalendarButton.svelte';
 	import ExternalRsvpNotice from './event-view/ExternalRsvpNotice.svelte';
-	import { buildDescriptionHtml } from './event-view/format';
+	import RichText from '../components/RichText.svelte';
+	import { getLocalProfileUrl } from './profile-url.js';
 	import { getLocations, resolveGeoLocation, type GeoLocation } from './event-view/locations.js';
 
 	let {
@@ -108,13 +109,11 @@
 	let canSetEventComments = $state(false);
 	let isHost = $derived(!!viewer.did && viewer.did === did);
 	let hasComments = $derived(!!eventData.bskyPostRef?.showComments && !!eventData.bskyPostRef?.uri);
-	let descriptionHtml = $derived(
-		buildDescriptionHtml(eventData.description, eventData.facets, viewer.preferredSocialClient)
-	);
+	let hasDescription = $derived(!!eventData.description);
 	let aboutCommentsTab = $state<string>('about');
 	let photoLinks = $derived(eventData.uris?.filter((link) => parseGrainLink(link.uri)) ?? []);
 	let contentTabs = $derived([
-		...(descriptionHtml ? [{ value: 'about', label: 'About' }] : []),
+		...(hasDescription ? [{ value: 'about', label: 'About' }] : []),
 		...(hasComments ? [{ value: 'comments', label: 'Comments' }] : []),
 		...(photoLinks.length ? [{ value: 'photos', label: 'Photos' }] : [])
 	]);
@@ -390,13 +389,14 @@
 							</p>
 						{/if}
 						{#if activeTab === 'about'}
-							<div
-								class="prose dark:prose-invert prose-a:text-accent-600 dark:prose-a:text-accent-400 prose-a:hover:underline prose-a:no-underline max-w-none leading-relaxed wrap-break-word text-base-700 dark:text-base-300"
-							>
-								<!-- HTML is sanitized by buildDescriptionHtml before rendering. -->
-								<!-- eslint-disable-next-line svelte/no-at-html-tags -->
-								{@html descriptionHtml}
-							</div>
+							<RichText
+								text={eventData.description ?? ''}
+								facets={eventData.facets}
+								mentionUrl={getLocalProfileUrl}
+								socialClient={viewer.preferredSocialClient}
+								detectLinks
+								class="text-base-700 dark:text-base-300"
+							/>
 						{:else if activeTab === 'comments' && eventData.bskyPostRef?.uri}
 							<EventComments
 								postUri={eventData.bskyPostRef.uri}

package/dist/events/event-view/format.d.ts

@@ -1,4 +1,3 @@
-import { type PreferredSocialClient } from '../../social.js';
 export declare function formatMonth(date: Date): string;
 export declare function formatDay(date: Date): number;
 export declare function formatWeekday(date: Date): string;
@@ -7,4 +6,3 @@ export declare function formatTime(date: Date): string;
 export declare function getModeLabel(mode: string): string;
 /** Optional local accent class for an event mode. */
 export declare function getModeColor(mode: string): string;
-export declare function buildDescriptionHtml(description: string | undefined, facets: unknown, socialClient?: PreferredSocialClient | null): string | null;

package/dist/events/event-view/format.js

@@ -1,8 +1,3 @@
-import { marked } from 'marked';
-import { tokenize } from '@atcute/bluesky-richtext-parser';
-import { sanitize } from '../cal/sanitize.js';
-import { getLocalProfileUrl } from '../profile-url.js';
-import { socialHashtagUrl } from '../../social.js';
 export function formatMonth(date) {
     return date.toLocaleDateString('en-US', { month: 'short' }).toUpperCase();
 }
@@ -41,72 +36,3 @@ export function getModeColor(mode) {
         return 'amber';
     return '';
 }
-const renderer = new marked.Renderer();
-renderer.link = ({ href, text }) => {
-    const attributes = href.startsWith('/')
-        ? ''
-        : ' target="_blank" rel="noopener noreferrer nofollow"';
-    const safeHref = href.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;');
-    return `<a${attributes} href="${safeHref}" class="text-accent-600 dark:text-accent-400 hover:underline">${text}</a>`;
-};
-function renderDescription(text, facets, socialClient) {
-    let result = text;
-    // Imported descriptions may have no facets. Keep existing Markdown links and
-    // code intact; only turn detected standalone mentions and hashtags into links.
-    if (!facets?.length) {
-        result = tokenize(text)
-            .map((token) => {
-            if (token.type === 'mention')
-                return `[${token.raw}](${getLocalProfileUrl(token.handle)})`;
-            if (token.type === 'topic')
-                return `[${token.raw}](<${socialHashtagUrl(token.name, socialClient)}>)`;
-            return token.raw;
-        })
-            .join('');
-    }
-    if (facets && facets.length > 0) {
-        const encoded = new TextEncoder().encode(text);
-        const decoder = new TextDecoder();
-        const sorted = [...facets].sort((a, b) => a.index.byteStart - b.index.byteStart);
-        const parts = [];
-        let cursor = 0;
-        for (const facet of sorted) {
-            const feature = facet.features?.[0];
-            if (!feature)
-                continue;
-            if (facet.index.byteStart < cursor)
-                continue;
-            const segmentText = decoder.decode(encoded.slice(facet.index.byteStart, facet.index.byteEnd));
-            let mdLink = null;
-            switch (feature.$type) {
-                case 'app.bsky.richtext.facet#mention': {
-                    const handle = segmentText.startsWith('@') ? segmentText.slice(1) : segmentText;
-                    mdLink = `[${segmentText}](${getLocalProfileUrl(feature.did || handle)})`;
-                    break;
-                }
-                case 'app.bsky.richtext.facet#link':
-                    mdLink = `[${segmentText}](${feature.uri})`;
-                    break;
-                case 'app.bsky.richtext.facet#tag':
-                    if (feature.tag)
-                        mdLink = `[${segmentText}](<${socialHashtagUrl(feature.tag, socialClient)}>)`;
-                    break;
-            }
-            if (mdLink) {
-                parts.push(decoder.decode(encoded.slice(cursor, facet.index.byteStart)));
-                parts.push(mdLink);
-                cursor = facet.index.byteEnd;
-            }
-        }
-        parts.push(decoder.decode(encoded.slice(cursor)));
-        result = parts.join('');
-    }
-    return marked.parse(result, { renderer });
-}
-export function buildDescriptionHtml(description, facets, socialClient) {
-    if (!description)
-        return null;
-    return sanitize(renderDescription(description, facets, socialClient), {
-        ADD_ATTR: ['target']
-    });
-}

package/dist/index.d.ts

@@ -76,13 +76,15 @@ export { default as InlineEditor } from './components/InlineEditor.svelte';
 export { default as PostComposer } from './components/PostComposer.svelte';
 export { default as NestedComments } from './components/NestedComments.svelte';
 export { default as PostContent } from './components/PostContent.svelte';
+export { default as RichText } from './components/RichText.svelte';
+export type { RichTextProps } from './components/RichText.svelte';
 export { default as ExternalEmbed } from './components/ExternalEmbed.svelte';
 export { defaultExternalEmbedProviders, youtubeEmbedProvider, klipyEmbedProvider, resolveExternalEmbed } from './social/external-embeds.js';
 export type { ExternalPostEmbed, ExternalEmbedProvider, ExternalEmbedPlayer } from './social/external-embeds.js';
 export { blueskyPostToPostData } from './social/posts.js';
 export type { PostData, PostEmbed, BlueskyPostView } from './social/posts.js';
 export { editorJsonToBlueskyPost, textToDoc, graphemeLength } from './social/richtext.js';
-export type { Facet } from './social/richtext.js';
+export type { Facet, RichTextOptions, RichTextSegment } from './social/richtext.js';
 export type { Editor, JSONContent } from '@tiptap/core';
 export { launchConfetti } from './confetti.js';
 export { cn } from './utils.js';

package/dist/index.js

@@ -51,6 +51,7 @@ export { default as InlineEditor } from './components/InlineEditor.svelte';
 export { default as PostComposer } from './components/PostComposer.svelte';
 export { default as NestedComments } from './components/NestedComments.svelte';
 export { default as PostContent } from './components/PostContent.svelte';
+export { default as RichText } from './components/RichText.svelte';
 export { default as ExternalEmbed } from './components/ExternalEmbed.svelte';
 export { defaultExternalEmbedProviders, youtubeEmbedProvider, klipyEmbedProvider, resolveExternalEmbed } from './social/external-embeds.js';
 export { blueskyPostToPostData } from './social/posts.js';

package/dist/social/richtext.d.ts

@@ -1,4 +1,5 @@
 import type { JSONContent } from '@tiptap/core';
+import type { PreferredSocialClient } from './preferred-client.js';
 export type Facet = {
     index: {
         byteStart: number;
@@ -11,15 +12,24 @@ export type Facet = {
         tag?: string;
     }[];
 };
-export declare function safeWebUrl(url: string | undefined): string | undefined;
+export declare function safeWebUrl(url: unknown): string | undefined;
 export declare function textToDoc(text: string): JSONContent;
 /** Serialize mention nodes first, then detect links/tags using UTF-8 byte offsets. */
 export declare function editorJsonToBlueskyPost(doc: JSONContent): {
     text: string;
     facets: Facet[];
 };
-export declare function richTextSegments(text: string, facets?: Facet[]): {
+export type RichTextOptions = {
+    socialClient?: PreferredSocialClient | null;
+    /** App-owned mention destination; defaults to the selected social client. */
+    mentionUrl?: (identifier: string) => string;
+    /** Detect plain-text links, mentions and hashtags only when there are no facets. */
+    detectLinks?: boolean;
+};
+export type RichTextSegment = {
     text: string;
     href?: string;
-}[];
+};
+/** Plain text and validated links, never HTML or Markdown. Invalid facets leave text intact. */
+export declare function richTextSegments(text: string, facets?: unknown, options?: RichTextOptions): RichTextSegment[];
 export declare function graphemeLength(text: string): number;

package/dist/social/richtext.js

@@ -1,11 +1,14 @@
 import { tokenize } from '@atcute/bluesky-richtext-parser';
-import { blueskyProfileUrl } from './urls.js';
+import { isDid } from '@atcute/lexicons/syntax';
+import { socialHashtagUrl, socialProfileUrl } from './urls.js';
 export function safeWebUrl(url) {
-    if (!url)
+    if (typeof url !== 'string' || !url)
         return undefined;
     try {
         const parsed = new URL(url);
-        return ['https:', 'http:'].includes(parsed.protocol) ? parsed.href : undefined;
+        return ['https:', 'http:'].includes(parsed.protocol) && !parsed.username && !parsed.password
+            ? parsed.href
+            : undefined;
     }
     catch {
         return undefined;
@@ -67,27 +70,76 @@ export function editorJsonToBlueskyPost(doc) {
     }
     return { text, facets: facets.sort((a, b) => a.index.byteStart - b.index.byteStart) };
 }
-export function richTextSegments(text, facets = []) {
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** Only app-relative paths or HTTP(S), including for app-owned mention callbacks. */
+function safeMentionUrl(identifier, options) {
+    const href = options.mentionUrl?.(identifier) ?? socialProfileUrl(identifier, options.socialClient);
+    if (typeof href !== 'string' ||
+        Array.from(href).some((char) => char === '\\' || char.charCodeAt(0) <= 0x20 || char.charCodeAt(0) === 0x7f))
+        return undefined;
+    if (href.startsWith('/') && !href.startsWith('//'))
+        return href;
+    return safeWebUrl(href);
+}
+function featureUrl(feature, options) {
+    if (!record(feature))
+        return undefined;
+    switch (feature.$type) {
+        case 'app.bsky.richtext.facet#mention':
+            return typeof feature.did === 'string' && isDid(feature.did)
+                ? safeMentionUrl(feature.did, options)
+                : undefined;
+        case 'app.bsky.richtext.facet#link':
+            return safeWebUrl(feature.uri);
+        case 'app.bsky.richtext.facet#tag':
+            return typeof feature.tag === 'string' && feature.tag && feature.tag.isWellFormed()
+                ? socialHashtagUrl(feature.tag, options.socialClient)
+                : undefined;
+    }
+}
+/** Plain text and validated links, never HTML or Markdown. Invalid facets leave text intact. */
+export function richTextSegments(text, facets = [], options = {}) {
+    if ((!Array.isArray(facets) || !facets.length) && options.detectLinks) {
+        return Array.from(tokenize(text), (token) => ({
+            text: token.raw,
+            href: token.type === 'autolink'
+                ? safeWebUrl(token.url)
+                : token.type === 'mention'
+                    ? safeMentionUrl(token.handle, options)
+                    : token.type === 'topic'
+                        ? socialHashtagUrl(token.name, options.socialClient)
+                        : undefined
+        }));
+    }
     const encoded = new TextEncoder().encode(text);
     const decoder = new TextDecoder();
     const segments = [];
-    let cursor = 0;
-    for (const facet of [...facets].sort((a, b) => a.index.byteStart - b.index.byteStart)) {
+    const valid = [];
+    // UTF-8 continuation bytes cannot start/end a facet.
+    const boundary = (offset) => offset === encoded.length || (encoded[offset] & 0xc0) !== 0x80;
+    for (const facet of Array.isArray(facets) ? facets : []) {
+        if (!record(facet) || !record(facet.index) || !Array.isArray(facet.features))
+            continue;
         const { byteStart, byteEnd } = facet.index;
-        if (!Number.isInteger(byteStart) ||
-            !Number.isInteger(byteEnd) ||
-            byteStart < cursor ||
+        if (typeof byteStart !== 'number' ||
+            typeof byteEnd !== 'number' ||
+            !Number.isSafeInteger(byteStart) ||
+            !Number.isSafeInteger(byteEnd) ||
+            byteStart < 0 ||
             byteEnd <= byteStart ||
-            byteEnd > encoded.length)
+            byteEnd > encoded.length ||
+            !boundary(byteStart) ||
+            !boundary(byteEnd))
+            continue;
+        valid.push({ byteStart, byteEnd, features: facet.features });
+    }
+    let cursor = 0;
+    for (const { byteStart, byteEnd, features } of valid.sort((a, b) => a.byteStart - b.byteStart)) {
+        if (byteStart < cursor)
             continue;
-        const feature = facet.features?.[0];
-        const href = feature?.did
-            ? blueskyProfileUrl(feature.did)
-            : feature?.uri
-                ? safeWebUrl(feature.uri)
-                : feature?.tag
-                    ? `https://bsky.app/hashtag/${encodeURIComponent(feature.tag)}`
-                    : undefined;
+        const href = features.map((feature) => featureUrl(feature, options)).find(Boolean);
         segments.push({ text: decoder.decode(encoded.slice(cursor, byteStart)) });
         segments.push({ text: decoder.decode(encoded.slice(byteStart, byteEnd)), href });
         cursor = byteEnd;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atmo-dev/kit",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "The shared UI foundation for Atmo apps.",
   "license": "MIT",
   "repository": {
@@ -134,11 +134,9 @@
     "@atcute/tid": "^1.1.4",
     "@internationalized/date": "^3.12.4",
     "@number-flow/svelte": "^0.4.2",
-    "dompurify": "^3.4.17",
     "esm-env": "^1.2.2",
     "h3-js": "^4.5.0",
     "i18n-iso-countries": "^7.14.0",
-    "marked": "^18.1.2",
     "svelte-boring-avatars": "^1.2.6",
     "valibot": "^1.5.0",
     "@atcute/lexicons": "^2.1.1",

package/dist/events/cal/sanitize.d.ts

@@ -1,3 +0,0 @@
-export declare function sanitize(dirty: string, config?: {
-    ADD_ATTR?: string[];
-}): string;

package/dist/events/cal/sanitize.js

@@ -1,25 +0,0 @@
-import { BROWSER } from 'esm-env';
-// Lightweight regex-based sanitizer for SSR where DOMPurify is not available.
-// Strips common XSS vectors.
-function regexSanitize(html) {
-    return html
-        .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script\s*>/gi, '')
-        .replace(/<iframe\b[^<]*(?:(?!<\/iframe>)<[^<]*)*<\/iframe\s*>/gi, '')
-        .replace(/<object\b[^<]*(?:(?!<\/object>)<[^<]*)*<\/object\s*>/gi, '')
-        .replace(/<embed\b[^>]*\/?>/gi, '')
-        .replace(/<style\b[^<]*(?:(?!<\/style>)<[^<]*)*<\/style\s*>/gi, '')
-        .replace(/\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, '')
-        .replace(/href\s*=\s*["']?\s*javascript\s*:/gi, 'href="')
-        .replace(/src\s*=\s*["']?\s*javascript\s*:/gi, 'src="');
-}
-let _purify = null;
-if (BROWSER) {
-    import('dompurify').then((mod) => {
-        _purify = (html, config) => mod.default.sanitize(html, config);
-    });
-}
-export function sanitize(dirty, config) {
-    if (_purify)
-        return _purify(dirty, config);
-    return regexSanitize(dirty);
-}