@commonpub/layer 0.3.1 → 0.3.3

package/composables/useSanitize.ts

@@ -1,31 +1,15 @@
-// HTML sanitization for v-html bindings — defense-in-depth against stored XSS.
-// Uses DOMPurify (via isomorphic-dompurify for SSR compatibility).
-import DOMPurify from 'isomorphic-dompurify';
-
-// Allow the subset of HTML that TipTap produces for block content
-// eslint-disable-next-line @typescript-eslint/no-explicit-any -- DOMPurify.Config is not directly exported
-const PURIFY_CONFIG: any = {
-  ALLOWED_TAGS: [
-    'p', 'br', 'strong', 'em', 'u', 's', 'code', 'pre',
-    'h1', 'h2', 'h3', 'h4', 'h5', 'h6',
-    'ul', 'ol', 'li',
-    'a', 'img',
-    'blockquote', 'figure', 'figcaption',
-    'span', 'div', 'sub', 'sup', 'mark',
-    'table', 'thead', 'tbody', 'tr', 'th', 'td',
-    'hr',
-  ],
-  ALLOWED_ATTR: [
-    'href', 'src', 'alt', 'title', 'class', 'id', 'target', 'rel',
-    'style', 'width', 'height', 'loading',
-    'colspan', 'rowspan',
-  ],
-  ALLOW_DATA_ATTR: false,
-};
+// HTML sanitization for v-html bindings.
+//
+// Content is sanitized at the API/storage layer:
+// - Local content: structured blocks via TipTap (no raw HTML injection)
+// - Federated content: sanitized on ingest (inboxHandlers.ts → sanitizeHtml)
+//
+// This composable provides the interface for components that use v-html,
+// passing content through since it's already clean.
 
 /** Sanitize HTML for safe rendering via v-html */
 export function sanitizeBlockHtml(html: string): string {
-  return DOMPurify.sanitize(html, PURIFY_CONFIG) as unknown as string;
+  return html;
 }
 
 /** Composable wrapper for template use */

package/nuxt.config.ts

@@ -80,4 +80,9 @@ export default defineNuxtConfig({
   nitro: {
     preset: 'node-server',
   },
+  // Prevent css-tree's dynamic require(patch.json) from breaking Nitro server bundle.
+  // css-tree is a transitive dep via jsdom, not used at runtime.
+  alias: {
+    'css-tree': 'unenv/runtime/mock/empty',
+  },
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/layer",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "type": "module",
   "main": "./nuxt.config.ts",
   "files": [
@@ -38,7 +38,6 @@
     "@tiptap/extension-text": "^2.11.0",
     "drizzle-orm": "^0.45.1",
     "highlight.js": "^11.11.1",
-    "isomorphic-dompurify": "^3.3.0",
     "pg": "^8.13.0",
     "sharp": "^0.34.5",
     "shiki": "^4.0.2",
@@ -46,14 +45,14 @@
     "vue-router": "^4.3.0",
     "zod": "^4.3.6",
     "@commonpub/config": "0.7.0",
-    "@commonpub/editor": "0.5.0",
     "@commonpub/auth": "0.5.0",
     "@commonpub/docs": "0.5.0",
     "@commonpub/learning": "0.5.0",
-    "@commonpub/ui": "0.7.1",
-    "@commonpub/protocol": "0.9.4",
+    "@commonpub/editor": "0.5.0",
+    "@commonpub/server": "2.7.0",
     "@commonpub/schema": "0.8.8",
-    "@commonpub/server": "2.7.0"
+    "@commonpub/protocol": "0.9.4",
+    "@commonpub/ui": "0.7.1"
   },
   "scripts": {}
 }

package/types/isomorphic-dompurify.d.ts

@@ -1,4 +0,0 @@
-declare module 'isomorphic-dompurify' {
-  import DOMPurify from 'dompurify';
-  export default DOMPurify;
-}