@commonpub/layer 0.3.9 → 0.3.10

package/composables/useMirrorContent.ts

@@ -61,7 +61,7 @@ export function useMirrorContent(fedContent: Ref<Record<string, unknown> | null>
       previewToken: null,
       parts: Array.isArray(meta?.parts) ? meta.parts as ContentViewData['parts'] : null,
       sections: null,
-      viewCount: 0,
+      viewCount: (fc.localViewCount as number) ?? 0,
       likeCount: (fc.localLikeCount as number) ?? 0,
       commentCount: (fc.localCommentCount as number) ?? 0,
       forkCount: 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonpub/layer",
-  "version": "0.3.9",
+  "version": "0.3.10",
   "type": "module",
   "main": "./nuxt.config.ts",
   "files": [
@@ -44,15 +44,15 @@
     "vue": "^3.4.0",
     "vue-router": "^4.3.0",
     "zod": "^4.3.6",
-    "@commonpub/config": "0.7.0",
     "@commonpub/auth": "0.5.0",
-    "@commonpub/docs": "0.5.2",
     "@commonpub/editor": "0.5.0",
-    "@commonpub/server": "2.9.0",
+    "@commonpub/learning": "0.5.0",
     "@commonpub/schema": "0.8.10",
-    "@commonpub/protocol": "0.9.4",
     "@commonpub/ui": "0.7.1",
-    "@commonpub/learning": "0.5.0"
+    "@commonpub/config": "0.7.0",
+    "@commonpub/protocol": "0.9.4",
+    "@commonpub/server": "2.9.0",
+    "@commonpub/docs": "0.5.2"
   },
   "scripts": {}
 }

package/pages/federated-hubs/[id]/index.vue

@@ -202,7 +202,7 @@ async function handleDiscPost(): Promise<void> {
 // --- Instance mirror status (not user-level follow) ---
 const mirrorStatus = computed(() => hub.value?.followStatus ?? 'pending');
 
-const remoteFollowRef = ref<InstanceType<typeof RemoteFollowDialog> | null>(null);
+const remoteFollowRef = ref<{ show: () => void } | null>(null);
 
 // --- Like state tracking ---
 const likedPostIds = ref<Set<string>>(new Set());

package/pages/mirror/[id].vue

@@ -18,7 +18,7 @@ const {
 const { user } = useAuth();
 const following = ref(false);
 const followState = ref<'idle' | 'sent' | 'error'>('idle');
-const remoteFollowRef = ref<InstanceType<typeof RemoteFollowDialog> | null>(null);
+const remoteFollowRef = ref<{ show: () => void } | null>(null);
 
 async function followAuthor(): Promise<void> {
   const uri = actor.value?.actorUri as string | undefined;
@@ -43,6 +43,11 @@ if (originUrl.value) {
   });
 }
 
+/** Strip HTML tags from remote actor bio (unsanitized — XSS risk with v-html) */
+function stripHtml(html: string): string {
+  return html.replace(/<[^>]*>/g, '').trim();
+}
+
 // Track view
 onMounted(() => {
   $fetch(`/api/federation/content/${id}/view`, { method: 'POST' }).catch(() => {});
@@ -109,7 +114,7 @@ useSeoMeta({
             <strong>{{ transformedContent.author.displayName }}</strong>
             <span v-if="authorHandle" class="cpub-mirror-handle">{{ authorHandle }}</span>
             <span v-if="transformedContent.author.followerCount" class="cpub-mirror-handle">&middot; {{ transformedContent.author.followerCount }} followers</span>
-            <p v-if="transformedContent.author.bio" class="cpub-mirror-bio" v-html="transformedContent.author.bio" />
+            <p v-if="transformedContent.author.bio" class="cpub-mirror-bio">{{ stripHtml(transformedContent.author.bio) }}</p>
           </div>
         </div>
         <div v-if="typeof transformedContent.content === 'string'" class="cpub-mirror-body prose" v-html="transformedContent.content" />