@designcrowd/library.brand-page 6.1.1-json-prereq-3 → 6.1.1

package/src/brand-page-maker/utils/rte-render-parity.test.ts

@@ -1,164 +0,0 @@
-import { describe, it, expect, afterEach } from 'vitest';
-import type { Editor } from '@tiptap/vue-3';
-import { useExternalRichTextEditor } from '../composables/rich-text-editor/useRichTextEditor';
-import {
-  renderRteToHtml,
-  toRteJson,
-  getRteJsonPlainText,
-} from './rte-render.util';
-import {
-  COMPLEX_RTE_HTML,
-  THEME_TOKEN_REF,
-} from '../__fixtures__/complex-rte.fixture';
-
-/**
- * BP-5787 — golden-master render-parity baseline.
- *
- * Captured on the CURRENT (HTML) pipeline. These committed snapshots are the
- * frozen reference for the HTML→JSON migration:
- *
- *   - `editor-normalized-html` is what the editor renders the fixture to today.
- *     After the migration, `htmlFromJson(getJSON())` MUST equal this snapshot —
- *     i.e. the JSON pipeline reproduces identical rendered output (no drift).
- *
- *   - `editor-json` freezes the RAW editor output (`getJSON()`), pre-sanitise. It
- *     is expected to change exactly once, intentionally, when storage flips to JSON
- *     (see "expected vs forbidden drift" in docs/plans/BP-5787-...html). NOTE: this
- *     is not the persisted form — the stored doc runs through `sanitizeRteJson`
- *     first, which (for links) keeps href only; target/rel are render-derived and
- *     stripped from storage. The persisted link shape is pinned in
- *     rte-sanitize-json.test.ts, not here.
- *
- * The headless editor uses the SAME extension set as the live editor
- * (useExternalRichTextEditor), so it is a faithful stand-in for the renderer.
- */
-describe('BP-5787 RTE render parity (golden master)', () => {
-  let editor: Editor;
-
-  const makeEditor = (): Editor => {
-    editor = useExternalRichTextEditor().externalEditor;
-
-    return editor;
-  };
-
-  afterEach(() => {
-    editor?.destroy();
-  });
-
-  it('T1 — editor renders the complex fixture to the frozen HTML baseline', () => {
-    const ed = makeEditor();
-
-    ed.commands.setContent(COMPLEX_RTE_HTML);
-
-    // The golden master. The JSON pipeline must reproduce this exactly.
-    expect(ed.getHTML()).toMatchSnapshot('editor-normalized-html');
-  });
-
-  it('T1 — round-trip is idempotent (html → json → html === json → html)', () => {
-    const ed = makeEditor();
-
-    ed.commands.setContent(COMPLEX_RTE_HTML);
-    const pass1 = ed.getHTML();
-    const json = ed.getJSON();
-
-    // Re-seed from the JSON the migration will store, render again.
-    ed.commands.setContent(json);
-    const pass2 = ed.getHTML();
-
-    expect(pass2).toEqual(pass1);
-  });
-
-  it('T6 — freezes the RAW editor JSON (pre-sanitise; not the persisted form)', () => {
-    // getJSON() is the editor's raw output: link marks still carry the parsed
-    // target/rel/class/title. The persisted form runs through sanitizeRteJson
-    // (href-only links) — pinned in rte-sanitize-json.test.ts, not here.
-    const ed = makeEditor();
-
-    ed.commands.setContent(COMPLEX_RTE_HTML);
-
-    expect(ed.getJSON()).toMatchSnapshot('editor-json');
-  });
-
-  it('T2 — theme token ref survives the round-trip (NOT flattened to rgb)', () => {
-    const ed = makeEditor();
-
-    ed.commands.setContent(COMPLEX_RTE_HTML);
-
-    // Today the editor preserves var(--…) in marks; the migration must keep it.
-    expect(ed.getHTML()).toContain(THEME_TOKEN_REF);
-    expect(JSON.stringify(ed.getJSON())).toContain(THEME_TOKEN_REF);
-  });
-
-  it('T1 — render-from-JSON (DOM-less renderer) produces equivalent HTML', () => {
-    // renderRteToHtml serialises JSON → HTML via @tiptap/static-renderer from the
-    // extension schema (no editor/DOM, so it works on the server). Output is
-    // semantically identical to the editor's — the Playwright visual golden-master
-    // is the authority on pixel parity; here we freeze the renderer output and
-    // assert structure.
-    const viaJson = renderRteToHtml(toRteJson(COMPLEX_RTE_HTML));
-
-    expect(viaJson).toMatchSnapshot('serializer-html');
-
-    // marks/nodes preserved
-    expect(viaJson).toContain('<strong>bold</strong>');
-    expect(viaJson).toContain('<em>italic</em>');
-    expect(viaJson).toContain('<u>underline</u>');
-    expect(viaJson).toContain('<s>strike</s>');
-    expect(viaJson).toContain('font-family: Montserrat');
-    expect(viaJson).toContain('font-size: 1.5em');
-    // theme token ref preserved (the crux of BP-5787)
-    expect(viaJson).toContain('color: var(--logo-text-color)');
-    // links + alignment
-    expect(viaJson).toContain('href="/about"');
-    expect(viaJson).toContain('href="https://example.com"');
-    expect(viaJson).toContain('text-align: center');
-    expect(viaJson).toContain('text-align: right');
-  });
-
-  it('T4 — legacy HTML strings render unchanged (back-compat passthrough)', () => {
-    expect(renderRteToHtml(COMPLEX_RTE_HTML)).toEqual(COMPLEX_RTE_HTML);
-  });
-
-  it('T8 — getRteJsonPlainText extracts visible text only (for fraud/translate)', () => {
-    const json = toRteJson(COMPLEX_RTE_HTML)!;
-    const text = getRteJsonPlainText(json);
-
-    expect(text).toContain('Themed heading');
-    expect(text).toContain('bold');
-    expect(text).toContain('external link');
-    // no markup or token refs leak into the extracted text
-    expect(text).not.toContain('<');
-    expect(text).not.toContain('var(--');
-    expect(text).not.toContain('font-size');
-  });
-
-  it('T1 — preserves every mark/node in the fixture', () => {
-    const ed = makeEditor();
-
-    ed.commands.setContent(COMPLEX_RTE_HTML);
-    const html = ed.getHTML();
-
-    // bold / italic / underline / strike
-    expect(html).toContain('<strong>');
-    expect(html).toContain('<em>');
-    expect(html).toContain('<u>');
-    expect(html).toContain('<s>');
-    // textStyle attrs
-    expect(html).toContain('font-family: Montserrat');
-    expect(html).toContain('font-size: 1.5em');
-    expect(html).toContain('letter-spacing: 0.05em');
-    expect(html).toContain('line-height: 1.4');
-    // highlight: data-color keeps the hex; the rendered style is normalised to rgb()
-    expect(html).toContain('data-color="#ffe08a"');
-    expect(html).toContain('background-color: rgb(255, 224, 138)');
-    // literal hex colour is normalised to rgb() by the editor...
-    expect(html).toContain('color: rgb(255, 0, 0)');
-    // ...but the THEME TOKEN ref is preserved verbatim (the crux of BP-5787)
-    expect(html).toContain('color: var(--logo-text-color)');
-    expect(html).toContain('text-align: center');
-    expect(html).toContain('text-align: right');
-    // links
-    expect(html).toContain('href="/about"');
-    expect(html).toContain('href="https://example.com"');
-  });
-});

package/src/brand-page-maker/utils/rte-render.util.ts

@@ -1,165 +0,0 @@
-import { getSchema } from '@tiptap/core';
-import { DOMParser as ProseMirrorDOMParser } from '@tiptap/pm/model';
-import type { JSONContent } from '@tiptap/vue-3';
-import { renderToHTMLString } from '@tiptap/static-renderer/pm/html-string';
-import { getRteExtensions } from '../composables/rich-text-editor/getRteExtensions';
-import { isTiptapDocument, getRteJsonPlainText } from './rich-text-editor.util';
-
-export { isTiptapDocument, getRteJsonPlainText };
-
-/**
- * BP-5787 — the boundary plumbing for storing RTE as Tiptap JSON.
- *
- * An RTE field is either a legacy inline-HTML string (pre-migration, or a
- * not-yet-migrated published site) or a Tiptap JSON document (post-migration).
- * These helpers let every consumer treat the two uniformly:
- *
- *   - isTiptapDocument — the canonical discriminator (object with type 'doc').
- *   - renderRteToHtml  — render either form to final HTML for display.
- *   - toRteJson        — normalise either form to JSON for storage.
- *
- * The schema-driven core of both directions is Tiptap/ProseMirror, fed by the
- * single-source-of-truth extension set (getRteExtensions) — so the mapping lives
- * in the extensions' schema, not a hand-maintained copy that drifts:
- *
- *   - renderRteToHtml uses @tiptap/static-renderer (renderToHTMLString). It is
- *     DOM-less, so it runs on the server (SSR/publish/preview), not just the
- *     browser, and needs no Editor instance.
- *   - toRteJson turns an HTML string into a DOM node with an INJECTED parser and
- *     feeds it to ProseMirror's schema-driven DOMParser. The HTML→DOM step needs
- *     a DOM parser; rather than read the global `window.DOMParser` (as Tiptap's
- *     `generateJSON` does — unusable on a pure-node server and fragile across SSR
- *     execution contexts), the parser is supplied by the caller: the native
- *     `DOMParser` in the browser, a jsdom `DOMParser` *instance* on the server
- *     (see resolveHtmlParser). No global is ever mutated, so the conversion is
- *     fully isomorphic regardless of how the SSR host bundles/executes this code.
- */
-export type RichTextValue = string | JSONContent;
-
-// One extension set shared by both directions (render + parse). Schema knowledge
-// lives here, once — Tiptap/extension upgrades propagate to both automatically.
-const RTE_EXTENSIONS = getRteExtensions();
-
-// ProseMirror schema derived once from the shared extension set. This is the
-// schema-driven heart of HTML→JSON (no drift); only the HTML→DOM step is injected.
-const RTE_SCHEMA = getSchema(RTE_EXTENSIONS);
-
-/**
- * A `DOMParser`-compatible object: turns an HTML string into a Document whose
- * `body` is a DOM node ProseMirror can parse. The browser's native `DOMParser`
- * and jsdom's `DOMParser` both satisfy this, so the DOM dependency is injected
- * rather than read from a global.
- */
-export interface HtmlParser {
-  parseFromString(html: string, type: 'text/html'): Document;
-}
-
-/**
- * Render an RTE value to final HTML. Legacy HTML strings pass through untouched
- * (they are already HTML); Tiptap JSON is serialised by @tiptap/static-renderer
- * from the extension schema — no editor, no DOM — so it works on the server
- * (SSR/publish), not just the browser.
- */
-export const renderRteToHtml = (
-  value: RichTextValue | null | undefined,
-): string => {
-  if (value == null || value === '') return '';
-
-  if (typeof value === 'string') return value;
-
-  return renderToHTMLString({ content: value, extensions: RTE_EXTENSIONS });
-};
-
-// Tiptap's elementFromString strips whitespace-only text nodes (pretty-print
-// indentation between tags) before parsing; replicate it so injected-parser
-// output stays identical to the previous generateJSON-based conversion.
-const stripIndentationTextNodes = (node: Node): Node => {
-  const children = node.childNodes;
-
-  for (let i = children.length - 1; i >= 0; i -= 1) {
-    const child = children[i];
-
-    if (
-      child.nodeType === 3 &&
-      child.nodeValue &&
-      /^(\n\s\s|\n)$/.test(child.nodeValue)
-    ) {
-      node.removeChild(child);
-    } else if (child.nodeType === 1) {
-      stripIndentationTextNodes(child);
-    }
-  }
-
-  return node;
-};
-
-const htmlToRteJson = (html: string, parser: HtmlParser): JSONContent => {
-  const body = parser.parseFromString(`<body>${html}</body>`, 'text/html').body;
-  const dom = stripIndentationTextNodes(body);
-
-  return ProseMirrorDOMParser.fromSchema(RTE_SCHEMA).parse(dom).toJSON();
-};
-
-let serverParserPromise: Promise<HtmlParser> | null = null;
-
-/**
- * Resolve an HtmlParser for the current runtime: the native `DOMParser` in the
- * browser (and jsdom-based test envs), or a jsdom `DOMParser` INSTANCE on a
- * pure-node server — created and returned directly, never assigned to a global,
- * so it is immune to SSR execution-context differences. The jsdom specifier is
- * assembled at runtime so no bundler follows it into a browser build. Memoised
- * on the server (JSDOM construction is relatively expensive).
- */
-export const resolveHtmlParser = async (): Promise<HtmlParser> => {
-  if (typeof DOMParser !== 'undefined') return new DOMParser();
-
-  if (!serverParserPromise) {
-    const jsdomModuleId = ['js', 'dom'].join('');
-
-    serverParserPromise = import(/* @vite-ignore */ jsdomModuleId)
-      .then((mod) => {
-        const { JSDOM } = mod as {
-          JSDOM: new (html?: string) => {
-            window: { DOMParser: new () => HtmlParser };
-          };
-        };
-        const { DOMParser: JsdomDOMParser } = new JSDOM('').window;
-
-        return new JsdomDOMParser();
-      })
-      .catch((error) => {
-        // Don't cache the failure — let a later call retry the import.
-        serverParserPromise = null;
-
-        throw error;
-      });
-  }
-
-  return serverParserPromise;
-};
-
-const getDefaultParser = (): HtmlParser => {
-  if (typeof DOMParser !== 'undefined') return new DOMParser();
-
-  throw new Error(
-    'toRteJson: no global DOMParser in this environment. On the server, pass an ' +
-      'explicit parser as the second argument (see resolveHtmlParser).',
-  );
-};
-
-/**
- * Normalise an RTE value to a Tiptap JSON document. HTML strings are parsed with
- * `parser` (defaults to the browser's native DOMParser); JSON documents pass
- * through unchanged. Returns undefined for empty/blank input so callers can omit
- * empty fields.
- */
-export const toRteJson = (
-  value: RichTextValue | null | undefined,
-  parser?: HtmlParser,
-): JSONContent | undefined => {
-  if (value == null || value === '') return undefined;
-
-  if (isTiptapDocument(value)) return value;
-
-  return htmlToRteJson(value, parser ?? getDefaultParser());
-};

package/src/brand-page-maker/utils/rte-sanitize-json.test.ts

@@ -1,172 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { sanitizeRteJson } from './rte-sanitize.util';
-import { toRteJson } from './rte-render.util';
-import { COMPLEX_RTE_HTML } from '../__fixtures__/complex-rte.fixture';
-
-/**
- * BP-5787 — native JSON sanitiser (T5). Operates on the Tiptap tree directly
- * (no editor, no HTML, no DOMPurify). Mirrors the HTML allowlist's guarantees.
- */
-const doc = (content: unknown[]): unknown => ({ type: 'doc', content });
-const para = (content: unknown[]) => ({ type: 'paragraph', content });
-const text = (t: string, marks?: unknown[]) => ({
-  type: 'text',
-  text: t,
-  marks,
-});
-const json = (v: unknown) => JSON.stringify(v);
-
-describe('sanitizeRteJson (native)', () => {
-  it('drops unknown node types but keeps their valid text siblings', () => {
-    const out = sanitizeRteJson(
-      doc([
-        para([text('keep me')]),
-        { type: 'image', attrs: { src: 'x', onerror: 'alert(1)' } },
-        { type: 'script', content: [text('alert(1)')] },
-      ]),
-    );
-
-    expect(json(out)).toContain('keep me');
-    expect(json(out)).not.toContain('image');
-    expect(json(out)).not.toContain('script');
-    expect(json(out)).not.toContain('alert(1)');
-  });
-
-  it('drops unknown mark types, keeps allow-listed ones', () => {
-    const out = sanitizeRteJson(
-      doc([
-        para([
-          text('bold', [{ type: 'bold' }]),
-          text('evil', [{ type: 'onclick', attrs: { js: 'alert(1)' } }]),
-        ]),
-      ]),
-    );
-
-    expect(json(out)).toContain('"type":"bold"');
-    expect(json(out)).not.toContain('onclick');
-    expect(json(out)).not.toContain('alert(1)');
-  });
-
-  it('strips javascript: / data: hrefs from link marks (drops the mark)', () => {
-    const out = sanitizeRteJson(
-      doc([
-        para([
-          // eslint-disable-next-line no-script-url
-          text('click', [
-            { type: 'link', attrs: { href: 'javascript:alert(1)' } },
-          ]),
-        ]),
-      ]),
-    );
-
-    expect(json(out)).toContain('click'); // text kept
-    expect(json(out)).not.toContain('javascript:');
-    expect(json(out)).not.toContain('"type":"link"');
-  });
-
-  it('keeps safe links but stores href only (target/rel are render-derived)', () => {
-    // The persisted link shape is a one-way-door contract published sites depend
-    // on. The sanitiser validates the href and drops everything else: target/rel
-    // are NOT stored — they are derived from the href at render time in the Link
-    // mark's renderHTML (see getRteExtensions.ts). Incoming target/rel (e.g. from
-    // a legacy site) must be stripped here so the stored form stays canonical.
-    const out = sanitizeRteJson(
-      doc([
-        para([
-          text('site', [
-            {
-              type: 'link',
-              attrs: {
-                href: 'https://example.com',
-                target: '_blank',
-                rel: 'noopener noreferrer nofollow',
-              },
-            },
-          ]),
-        ]),
-      ]),
-    ) as { content: [{ content: [{ marks: unknown[] }] }] };
-
-    const linkMark = out.content[0].content[0].marks[0];
-
-    expect(linkMark).toEqual({
-      type: 'link',
-      attrs: { href: 'https://example.com' },
-    });
-  });
-
-  it('keeps safe textStyle attrs incl. theme token, drops injection values', () => {
-    const out = sanitizeRteJson(
-      doc([
-        para([
-          text('ok', [
-            {
-              type: 'textStyle',
-              attrs: {
-                color: 'var(--logo-text-color)',
-                fontFamily: 'Open Sans',
-                fontSize: '1.5em',
-              },
-            },
-          ]),
-          text('bad', [
-            {
-              type: 'textStyle',
-              attrs: {
-                color: 'red; position: fixed; top: 0',
-                fontSize: '1em" onload="x',
-              },
-            },
-          ]),
-        ]),
-      ]),
-    );
-
-    const s = json(out);
-
-    expect(s).toContain('var(--logo-text-color)');
-    expect(s).toContain('Open Sans');
-    expect(s).toContain('1.5em');
-    // injection values dropped
-    expect(s).not.toContain('position: fixed');
-    expect(s).not.toContain('onload');
-  });
-
-  it('clamps heading level and keeps valid textAlign', () => {
-    const out: any = sanitizeRteJson(
-      doc([
-        {
-          type: 'heading',
-          attrs: { level: 99, textAlign: 'center' },
-          content: [text('H')],
-        },
-        {
-          type: 'paragraph',
-          attrs: { textAlign: 'evil' },
-          content: [text('P')],
-        },
-      ]),
-    );
-
-    expect(out.content[0].attrs.level).toBe(1);
-    expect(out.content[0].attrs.textAlign).toBe('center');
-    expect(out.content[1].attrs?.textAlign).toBeUndefined();
-  });
-
-  it('passes the clean complex fixture through unchanged (idempotent)', () => {
-    const clean = toRteJson(COMPLEX_RTE_HTML);
-    const once = sanitizeRteJson(clean);
-    const twice = sanitizeRteJson(once);
-
-    expect(twice).toEqual(once);
-    // legitimate content preserved
-    expect(json(once)).toContain('var(--logo-text-color)');
-    expect(json(once)).toContain('Montserrat');
-    expect(json(once)).toContain('https://example.com');
-  });
-
-  it('returns an empty doc for non-document input', () => {
-    expect(sanitizeRteJson(null)).toEqual({ type: 'doc', content: [] });
-    expect(sanitizeRteJson('<p>x</p>')).toEqual({ type: 'doc', content: [] });
-  });
-});

package/src/brand-page-maker/utils/rte-sanitize.util.ts

@@ -1,192 +0,0 @@
-import type { JSONContent } from '@tiptap/vue-3';
-import { validateAndSanitizeHref } from './rich-text-editor.util';
-
-/**
- * BP-5787 — native JSON sanitiser for RTE content.
- *
- * Operates directly on the Tiptap document tree: no editor instantiation, no
- * HTML round-trip, no DOMPurify. This is the hot path (runs on every editor
- * update and on the server sanitise gate), so it is a single, allocation-light
- * recursive walk.
- *
- * Security model (mirrors the HTML allowlist it replaces):
- *  - only allow-listed node and mark types survive; everything else is dropped;
- *  - textStyle / highlight attrs are restricted to known keys whose values must
- *    be "safe CSS values" (no quotes/angle-brackets/extra declarations/url()/
- *    expression()), preventing CSS-injection when the value is later rendered
- *    into a `style="…"` attribute;
- *  - link hrefs go through the same validateAndSanitizeHref used by the HTML
- *    sanitiser; unsafe links lose their href (and the mark);
- *  - heading levels are clamped to 1–6.
- */
-
-// ProseMirror node types the editor schema can legitimately produce.
-const ALLOWED_NODE_TYPES = new Set([
-  'doc',
-  'paragraph',
-  'heading',
-  'text',
-  'hardBreak',
-  'bulletList',
-  'orderedList',
-  'listItem',
-  'blockquote',
-  'codeBlock',
-  'horizontalRule',
-]);
-
-// Inline mark types the editor produces (strong/em/u/s/code/span/mark/a).
-const ALLOWED_MARK_TYPES = new Set([
-  'bold',
-  'italic',
-  'underline',
-  'strike',
-  'code',
-  'textStyle',
-  'highlight',
-  'link',
-]);
-
-// textStyle attrs map to the allow-listed CSS properties (font-weight →
-// bold mark, text-decoration → underline/strike, text-align → node attr,
-// background-color → highlight, so they are intentionally not here).
-const ALLOWED_TEXT_STYLE_ATTRS = new Set([
-  'color',
-  'fontFamily',
-  'fontSize',
-  'letterSpacing',
-  'lineHeight',
-]);
-
-type Mark = { type?: string; attrs?: Record<string, unknown> };
-
-/**
- * A safe CSS value is a short string free of characters that could inject an
- * extra declaration or escape the attribute, and free of the url()/expression()
- * vectors. Legitimate values — `rgb(255, 0, 0)`, `#FF0000`,
- * `var(--logo-text-color)`, `Open Sans`, `1.5em` — all pass.
- */
-const isSafeCssValue = (value: unknown): value is string =>
-  typeof value === 'string' &&
-  value.length > 0 &&
-  value.length <= 200 &&
-  !/[<>"';]/.test(value) &&
-  !/url\s*\(/i.test(value) &&
-  !/expression\s*\(/i.test(value);
-
-const sanitizeTextStyleAttrs = (
-  attrs: Record<string, unknown>,
-): Record<string, unknown> | null => {
-  const clean: Record<string, unknown> = {};
-
-  for (const key of Object.keys(attrs)) {
-    if (!ALLOWED_TEXT_STYLE_ATTRS.has(key)) continue;
-
-    const value = attrs[key];
-
-    // Tiptap emits '' for unset textStyle slots — preserve them.
-    if (value === '' || value == null) {
-      clean[key] = '';
-    } else if (isSafeCssValue(value)) {
-      clean[key] = value;
-    }
-    // else: drop the unsafe value
-  }
-
-  return Object.keys(clean).length ? clean : null;
-};
-
-const sanitizeMark = (mark: Mark): Mark | null => {
-  const type = mark?.type;
-
-  if (!type || !ALLOWED_MARK_TYPES.has(type)) return null;
-
-  const attrs = mark.attrs;
-
-  if (type === 'link') {
-    const href =
-      typeof attrs?.href === 'string'
-        ? validateAndSanitizeHref(attrs.href)
-        : null;
-
-    if (!href) return null; // drop links with unsafe/empty href
-
-    // href only — the sanitiser validates, it does not enrich. target/rel are
-    // a render-time policy derived from the href in the Link mark's renderHTML
-    // (see getRteExtensions.ts), so they are neither stored nor re-added here.
-    return { type, attrs: { href } };
-  }
-
-  if (type === 'textStyle') {
-    const clean = attrs ? sanitizeTextStyleAttrs(attrs) : null;
-
-    return clean ? { type, attrs: clean } : null;
-  }
-
-  if (type === 'highlight') {
-    return isSafeCssValue(attrs?.color)
-      ? { type, attrs: { color: attrs!.color } }
-      : { type };
-  }
-
-  // Plain marks (bold/italic/underline/strike/code) carry no attrs.
-  return { type };
-};
-
-const ALIGN_VALUES = new Set(['left', 'center', 'right', 'justify']);
-
-const sanitizeNode = (node: JSONContent): JSONContent | null => {
-  const type = node?.type;
-
-  if (!type || !ALLOWED_NODE_TYPES.has(type)) return null;
-
-  const clean: JSONContent = { type };
-  const attrs: Record<string, unknown> = {};
-
-  if (type === 'heading') {
-    const level = Number((node.attrs as { level?: unknown })?.level);
-
-    attrs.level = level >= 1 && level <= 6 ? level : 1;
-  }
-
-  if (type === 'heading' || type === 'paragraph') {
-    const align = (node.attrs as { textAlign?: unknown })?.textAlign;
-
-    if (typeof align === 'string' && ALIGN_VALUES.has(align)) {
-      attrs.textAlign = align;
-    }
-  }
-
-  if (Object.keys(attrs).length) clean.attrs = attrs;
-
-  if (typeof node.text === 'string') clean.text = node.text;
-
-  if (Array.isArray(node.marks)) {
-    const marks = node.marks
-      .map((m) => sanitizeMark(m as Mark))
-      .filter(Boolean) as JSONContent['marks'];
-
-    if (marks && marks.length) clean.marks = marks;
-  }
-
-  if (Array.isArray(node.content)) {
-    const content = node.content
-      .map(sanitizeNode)
-      .filter(Boolean) as JSONContent[];
-
-    if (content.length) clean.content = content;
-  }
-
-  return clean;
-};
-
-/**
- * Sanitise a Tiptap JSON document (returns a new clean doc). Returns a minimal
- * empty doc if the input isn't a usable document.
- */
-export const sanitizeRteJson = (doc: unknown): JSONContent => {
-  const clean =
-    doc && typeof doc === 'object' ? sanitizeNode(doc as JSONContent) : null;
-
-  return clean && clean.type === 'doc' ? clean : { type: 'doc', content: [] };
-};