@giancarlosgza/blog-layer 0.1.2 → 0.2.0

package/README.md

@@ -63,6 +63,9 @@ Blog pages use the site's `default` layout; set `blog.layout` to use another one
 - **`blog.layout`** (`nuxt.config`, optional): layout for the blog pages.
 - **Brand:** override `blog.*` in the site's `app/app.config.ts`. Every key is documented in this
   package's `app/app.config.ts`. `settings/general` in Firestore overrides the name and description.
+- **Models and helpers:** add `@giancarlosgza/blog-core` to the site's own dependencies when site code
+  imports its types (e.g. `WidgetDescriptor`) or calls its auto-imported helpers; with pnpm a layer's
+  dependencies are not visible to the site.
 - **Widgets:** posts can embed `<div data-blog-widget="key" data-props='{...}'>`. A site registers
   widgets by providing `blogWidgets` (`{ [key]: { descriptor, component } }`) from a plugin; without
   one, placeholders render an "unavailable" fallback.
@@ -71,4 +74,5 @@ Blog pages use the site's `default` layout; set `blog.layout` to use another one
   `app/assets/css/material-symbols.generated.css` in the site.
 
 Inside the layer, files import each other through the `#blog/...` alias: `~` and `#shared` resolve
-to the site.
+to the site. Shared models and helpers come from `@giancarlosgza/blog-core`; its helpers (`toBlogUrl`,
+`toDateMs`, `resolvePostSeo`...) are auto-imported in app and server code.

package/app/blog-pages/author.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import type { IAuthor } from '#blog/shared/models/author'
+import type { IAuthor } from '@giancarlosgza/blog-core'
 import type { IAuthorPageResponse } from '#blog/shared/types/api'
 
 /** Head */

package/app/components/blog/BlogPostArticle.vue

@@ -1,6 +1,5 @@
 <script setup lang="ts">
-import type { IAuthor } from '#blog/shared/models/author'
-import type { IPost } from '#blog/shared/models/post'
+import type { IAuthor, IPost } from '@giancarlosgza/blog-core'
 import type { IPostSeries } from '#blog/shared/types/api'
 import type { IPostHeading } from '#blog/shared/utils/post-headings'
 import { useClipboard, useIntersectionObserver, useShare } from '@vueuse/core'

package/app/components/blog/BlogPostCard.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import type { IPost } from '#blog/shared/models/post'
+import type { IPost } from '@giancarlosgza/blog-core'
 
 /** Interfaces */
 interface IProps {

package/app/components/blog/BlogPostList.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import type { IPost } from '#blog/shared/models/post'
+import type { IPost } from '@giancarlosgza/blog-core'
 import { NuxtLink } from '#components'
 
 /** Interfaces */

package/app/composables/useBlogSettings.ts

@@ -1,4 +1,4 @@
-import type { ISettings } from '#blog/shared/models/settings'
+import type { ISettings } from '@giancarlosgza/blog-core'
 import type { ISettingsResponse } from '#blog/shared/types/api'
 
 /**

package/app/composables/useBlogWidgets.ts

@@ -1,5 +1,5 @@
+import type { WidgetDescriptor } from '@giancarlosgza/blog-core'
 import type { Component } from 'vue'
-import type { WidgetDescriptor } from '#blog/shared/widgets/types'
 
 /** An embeddable post widget: its schema (for props coercion) and the component that renders it. */
 export interface IBlogWidget {

package/app/composables/useDateValue.ts

@@ -1,5 +1,5 @@
-import type { IFirestoreDateValue } from '#blog/shared/models/date'
-import { toDateMs } from '#blog/shared/utils/date'
+import type { IFirestoreDateValue } from '@giancarlosgza/blog-core'
+import { toDateMs } from '@giancarlosgza/blog-core'
 
 /** Normalize Date, Firestore Timestamp, serialized timestamps, and strings to milliseconds. */
 export function useDateValue() {

package/app/composables/usePaginatedPosts.ts

@@ -1,4 +1,4 @@
-import type { IPost } from '#blog/shared/models/post'
+import type { IPost } from '@giancarlosgza/blog-core'
 import type { IPostListResponse } from '#blog/shared/types/api'
 
 /** Interfaces */

package/app/composables/usePostFeed.ts

@@ -1,4 +1,4 @@
-import type { IPost } from '#blog/shared/models/post'
+import type { IPost } from '@giancarlosgza/blog-core'
 import type { IFeaturedPostsResponse, IPostListResponse, ITagsResponse } from '#blog/shared/types/api'
 
 /** Interfaces */

package/app/utils/widget-props.ts

@@ -1,4 +1,4 @@
-import type { WidgetDescriptor } from '#blog/shared/widgets/types'
+import type { WidgetDescriptor } from '@giancarlosgza/blog-core'
 
 /** Safely parse a widget's `data-props` JSON into a plain object. Never throws. */
 export function safeParseProps(raw: string | null | undefined): Record<string, unknown> {

package/blog-module.ts

@@ -1,6 +1,6 @@
 import type { NuxtPage } from 'nuxt/schema'
+import { joinBlogPath, normalizeBasePath } from '@giancarlosgza/blog-core'
 import { addServerHandler, createResolver, defineNuxtModule, extendPages } from 'nuxt/kit'
-import { joinBlogPath, normalizeBasePath } from './shared/utils/blog-path'
 
 export interface BlogModuleOptions {
   /** Where the blog mounts: `/` for a standalone blog, e.g. `/blog` inside another site. Build time. */

package/nuxt.config.ts

@@ -4,6 +4,12 @@ import blogModule from './blog-module'
 
 const layerDir = dirname(fileURLToPath(import.meta.url))
 
+// blog-core helpers, auto-imported like the layer's own utils
+const coreImports = [{
+  from: '@giancarlosgza/blog-core',
+  imports: ['htmlToExcerpt', 'joinBlogPath', 'normalizeBasePath', 'resolveAuthorName', 'resolvePostSeo', 'SEO_DESCRIPTION_MAX', 'SEO_TITLE_MAX', 'toBlogUrl', 'toDateMs', 'toSlug']
+}]
+
 /** Blog Layer */
 export default defineNuxtConfig({
   compatibilityDate: '2026-01-01',
@@ -16,7 +22,14 @@ export default defineNuxtConfig({
     basePath: '/'
   },
 
+  imports: {
+    presets: coreImports
+  },
+
   nitro: {
+    imports: {
+      presets: [...coreImports, { from: '@giancarlosgza/blog-core/sanitize', imports: ['sanitizeBlogHtml'] }]
+    },
     devStorage: {
       cache: { driver: 'memory' }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@giancarlosgza/blog-layer",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Nuxt layer that adds a Firestore-backed blog to a site under a configurable base path: pages, cached API, RSS, sitemap and SEO",
   "author": "Giancarlos Garza <giancarlosgza@gmail.com> (https://github.com/giancarlosgza)",
   "type": "module",
@@ -32,16 +32,15 @@
     "@shikijs/langs": "4.5.0",
     "@shikijs/themes": "4.5.0",
     "@takumi-rs/core": "2.14.0",
-    "@types/sanitize-html": "2.16.2",
     "@vueuse/components": "14.4.0",
     "@vueuse/core": "14.4.0",
     "@vueuse/nuxt": "14.4.0",
     "firebase-admin": "13.10.0",
     "floating-vue": "5.4.0",
     "nuxt-og-image": "6.10.3",
-    "sanitize-html": "2.18.0",
     "sass": "1.105.1",
     "shiki": "4.5.0",
-    "subset-font": "2.9.0"
+    "subset-font": "2.9.0",
+    "@giancarlosgza/blog-core": "^0.2.0"
   }
 }

package/server/api/blog/posts/[slug].get.ts

@@ -1,5 +1,4 @@
-import type { IAuthor } from '#blog/shared/models/author'
-import type { IPost } from '#blog/shared/models/post'
+import type { IAuthor, IPost } from '@giancarlosgza/blog-core'
 import type { IPostPageResponse, IPostSeries } from '#blog/shared/types/api'
 import { getFirestore } from 'firebase-admin/firestore'
 

package/server/utils/blog-data.ts

@@ -1,8 +1,4 @@
-import type { IAuthor } from '#blog/shared/models/author'
-import type { IPost } from '#blog/shared/models/post'
-import type { ISeries } from '#blog/shared/models/series'
-import type { ISettings } from '#blog/shared/models/settings'
-import type { ITag } from '#blog/shared/models/tag'
+import type { IAuthor, IPost, ISeries, ISettings, ITag } from '@giancarlosgza/blog-core'
 import type { IPostSeries, IPostSeriesPart } from '#blog/shared/types/api'
 import { Buffer } from 'node:buffer'
 

package/server/utils/blog-firestore.ts

@@ -1,6 +1,5 @@
+import type { IPost, ISeries } from '@giancarlosgza/blog-core'
 import type { Query } from 'firebase-admin/firestore'
-import type { IPost } from '#blog/shared/models/post'
-import type { ISeries } from '#blog/shared/models/series'
 import { getFirestore } from 'firebase-admin/firestore'
 
 /**

package/server/utils/rss.ts

@@ -1,9 +1,6 @@
-import type { IFirestoreDateValue } from '#blog/shared/models/date'
-import type { IPost } from '#blog/shared/models/post'
-import { htmlToExcerpt, resolveAuthorName } from '#blog/shared/utils/blog'
-import { toBlogUrl } from '#blog/shared/utils/blog-path'
-import { toDateMs } from '#blog/shared/utils/date'
-import { sanitizeBlogHtml } from '#blog/shared/utils/sanitize'
+import type { IFirestoreDateValue, IPost } from '@giancarlosgza/blog-core'
+import { htmlToExcerpt, resolveAuthorName, toBlogUrl, toDateMs } from '@giancarlosgza/blog-core'
+import { sanitizeBlogHtml } from '@giancarlosgza/blog-core/sanitize'
 
 /**
  * Pure RSS 2.0 builders for `server/handlers/rss.xml.ts`: XML escaping, CDATA, RFC 822 dates,

package/server/utils/sitemap.ts

@@ -1,8 +1,5 @@
-import type { IAuthor } from '#blog/shared/models/author'
-import type { IPost } from '#blog/shared/models/post'
-import type { ISeries } from '#blog/shared/models/series'
-import type { ITag } from '#blog/shared/models/tag'
-import { joinBlogPath } from '#blog/shared/utils/blog-path'
+import type { IAuthor, IPost, ISeries, ITag } from '@giancarlosgza/blog-core'
+import { joinBlogPath } from '@giancarlosgza/blog-core'
 
 /**
  * Pure sitemap URL builder for `/api/blog/_sitemap-urls` (Firestore reads live in the route).

package/shared/types/api.ts

@@ -1,8 +1,4 @@
-import type { IAuthor } from '../models/author'
-import type { IPost } from '../models/post'
-import type { ISeries } from '../models/series'
-import type { ISettings } from '../models/settings'
-import type { ITag } from '../models/tag'
+import type { IAuthor, IPost, ISeries, ISettings, ITag } from '@giancarlosgza/blog-core'
 import type { IPostHeading } from '../utils/post-headings'
 
 /**

package/shared/utils/blog.ts

@@ -1,20 +1,3 @@
-import type { IPost } from '../models/post'
-
-/** Convert an arbitrary string to a URL-safe slug. */
-export function toSlug(value: string): string {
-  return value
-    .toLowerCase()
-    .trim()
-    .replace(/[^\w\s-]/g, '')
-    .replace(/[\s_-]+/g, '-')
-    .replace(/^-+|-+$/g, '')
-}
-
-/** Resolve the best available author display name for a post (prefers new fields, then legacy, then `fallback`). */
-export function resolveAuthorName(post: Pick<IPost, 'authorName' | 'author'>, fallback = ''): string {
-  return post.authorName || post.author || fallback
-}
-
 /** Add the `.text-link` class to every prose `<a>` (merges existing classes; idempotent). */
 export function decorateBlogLinks(html: string): string {
   if (!html)
@@ -30,16 +13,3 @@ export function decorateBlogLinks(html: string): string {
     return `<a class="text-link"${attrs}>`
   })
 }
-
-/** Strip HTML tags and collapse whitespace to build a plain-text excerpt. */
-export function htmlToExcerpt(html: string, maxLength = 160): string {
-  const text = (html || '')
-    .replace(/<[^>]+>/g, ' ')
-    .replace(/\s+/g, ' ')
-    .trim()
-
-  if (text.length <= maxLength)
-    return text
-
-  return `${text.slice(0, maxLength - 1).trimEnd()}…`
-}

package/shared/utils/post-headings.ts

@@ -1,4 +1,4 @@
-import { toSlug } from './blog'
+import { toSlug } from '@giancarlosgza/blog-core'
 
 export interface IPostHeading {
   id: string

package/shared/models/author.ts

@@ -1,19 +0,0 @@
-import type { IFirestoreDateValue } from './date'
-
-/**
- * `authors/{uid}` — author profile. Document ID is the Firebase Auth UID.
- */
-export interface IAuthor {
-  id?: string
-  uid?: string
-  name: string
-  /** URL slug for the author's public page (e.g. used by the blog's sitemap/author routes). */
-  slug?: string
-  description?: string
-  photoURL?: string
-  profileLink?: string
-  /** Legacy handle shown on the author page; not managed by blog-admin. */
-  username?: string
-  createdAt?: IFirestoreDateValue
-  updatedAt?: IFirestoreDateValue
-}

package/shared/models/date.ts

@@ -1,11 +0,0 @@
-export interface ISerializedTimestamp {
-  seconds: number
-  nanoseconds?: number
-}
-
-export interface IDateWithToDate {
-  toDate: () => Date
-}
-
-/** Firestore `Timestamp`s (client or Admin SDK) match `IDateWithToDate` / `ISerializedTimestamp` structurally. */
-export type IFirestoreDateValue = ISerializedTimestamp | IDateWithToDate | number | Date | string | null | undefined

package/shared/models/post.ts

@@ -1,114 +0,0 @@
-import type { IFirestoreDateValue } from './date'
-
-/**
- * Editorial workflow state. `isPublished` stays the public-visibility flag (the blog and the
- * rules read it): only a publish sets it true, so a live post can still be `review`/`changes`
- * while its next revision is worked on. Legacy docs have no `status` (see resolvePostStatus).
- */
-export type PostStatus = 'draft' | 'review' | 'changes' | 'scheduled' | 'published'
-
-/** Who performed a workflow step; `{ uid: 'system', name: 'Scheduler' }` for the scheduled publisher. */
-export interface IPostActor {
-  uid: string
-  name: string
-}
-
-/** The current review cycle, written only by the server routes. */
-export interface IPostReview {
-  /** 1 on the first submit, +1 on every resubmit after changes were requested. */
-  round: number
-  submittedAt: IFirestoreDateValue
-  submittedBy: IPostActor
-  /** Latest note in the thread: the submitter's note, then the reviewer's change request. */
-  note?: string
-  requestedAt?: IFirestoreDateValue
-  requestedBy?: IPostActor
-  reasons?: string[]
-  /** The author marked the change request as addressed. */
-  resolved?: boolean
-}
-
-/**
- * `posts/{slug}` — post metadata. Document ID is the URL slug.
- * `createdAt`/`updatedAt` are stored as Unix-ms numbers in the migrated data,
- * but the type tolerates legacy Firestore Timestamp shapes too.
- */
-export interface IPost {
-  id?: string
-  slug?: string
-  title: string
-  shortText?: string
-  isPublished: boolean
-  status?: PostStatus
-  /** When a `scheduled` post goes live (the scheduled Cloud Function publishes it). */
-  publishAt?: IFirestoreDateValue
-  review?: IPostReview
-  createdAt?: IFirestoreDateValue
-  updatedAt?: IFirestoreDateValue
-  authorName?: string
-  authorUuid?: string
-  /** Denormalized from the author doc so the public blog avoids a per-card author read. */
-  authorPhotoURL?: string
-  /** Denormalized author slug for linking to the author's public page. */
-  authorSlug?: string
-  /** Legacy field: author display name on older documents. */
-  author?: string
-  imageAlt?: string
-  imagePath?: string
-  imageURL?: string
-  /** Accent color for the post (used for the list icon and public theming). */
-  color?: string
-  tags?: string[]
-  /** Search/social title override; falls back to `title` (see resolvePostSeo). */
-  seoTitle?: string
-  /** Meta description override; falls back to `shortText`, then a body excerpt. */
-  seoDescription?: string
-  /** Social share image override; falls back to the cover, then the generated OG image. */
-  ogImageURL?: string
-  /** Absolute canonical URL override for republished content; defaults to the post URL. */
-  canonicalURL?: string
-  /** Hides the post from search engines and the sitemap while keeping it public. */
-  noindex?: boolean
-  /** Slug (document ID) of the `series/{slug}` this post belongs to. */
-  seriesSlug?: string
-  /** 1-based part number within the series. */
-  seriesOrder?: number
-  /** Shown in the blog home hero (published posts only). */
-  featured?: boolean
-  /** Hero order among featured posts, lower first; ties fall back to newest first. */
-  featuredOrder?: number
-}
-
-/**
- * `postContents/{slug}` (published body) and `postDrafts/{slug}` (working body).
- * `contents` is an HTML string.
- */
-export interface IPostContent {
-  id?: string
-  contents: string
-  updatedAt?: IFirestoreDateValue
-}
-
-export type PostEventType
-  = | 'created'
-    | 'submitted'
-    | 'withdrawn'
-    | 'changes_requested'
-    | 'resolved'
-    | 'resubmitted'
-    | 'approved'
-    | 'scheduled'
-    | 'published'
-    | 'unpublished'
-
-/** `posts/{slug}/events/{autoId}` — workflow history, written by the server only. */
-export interface IPostEvent {
-  id?: string
-  type: PostEventType
-  from?: PostStatus
-  to?: PostStatus
-  note?: string
-  reasons?: string[]
-  actor: IPostActor
-  at: IFirestoreDateValue
-}

package/shared/models/series.ts

@@ -1,14 +0,0 @@
-import type { IFirestoreDateValue } from './date'
-
-/**
- * `series/{slug}` — an ordered set of posts. The document ID is the URL slug.
- * Posts join a series through `posts.seriesSlug` and are ordered by `posts.seriesOrder`.
- */
-export interface ISeries {
-  id?: string
-  name: string
-  slug: string
-  description?: string
-  createdAt?: IFirestoreDateValue
-  updatedAt?: IFirestoreDateValue
-}

package/shared/models/settings.ts

@@ -1,12 +0,0 @@
-/**
- * `settings/general` — site-wide branding and SEO metadata.
- */
-export interface ISettings {
-  blogName: string
-  blogDescription?: string
-  blogKeywords?: string
-  blogURL?: string
-  logoURL?: string
-  primaryColor?: string
-  backgroundColor?: string
-}

package/shared/models/tag.ts

@@ -1,15 +0,0 @@
-import type { IFirestoreDateValue } from './date'
-
-/**
- * `tags/{name}` — blog tag. The document ID is the display name (e.g. "CSS").
- * Posts reference tags by this name (`posts.tags` is a string[] of names).
- * `count` is the number of posts using the tag.
- */
-export interface ITag {
-  id?: string
-  name: string
-  slug?: string
-  count?: number
-  createdAt?: IFirestoreDateValue
-  updatedAt?: IFirestoreDateValue
-}

package/shared/utils/blog-path.ts

@@ -1,23 +0,0 @@
-/**
- * Blog URL helpers. The blog mounts under `blog.basePath` (nuxt.config): `/` for a standalone blog,
- * e.g. `/blog` when it is embedded in another site. Shared by pages, RSS, sitemap and SEO.
- */
-
-/** `''` for the site root, otherwise `/segment(s)` with a leading and no trailing slash. */
-export function normalizeBasePath(base?: string | null): string {
-  const trimmed = (base ?? '').trim().replace(/^\/+|\/+$/g, '')
-  return trimmed ? `/${trimmed}` : ''
-}
-
-/** Blog-relative path → site path: (`/blog`, `/tags/css`) → `/blog/tags/css`; the root home is `/`. */
-export function joinBlogPath(base: string | null | undefined, path = '/'): string {
-  const relative = path.replace(/^\/+/, '')
-  return `${normalizeBasePath(base)}${relative ? `/${relative}` : ''}` || '/'
-}
-
-/** Absolute blog URL. The root home is the bare origin (`https://blog.example.com`, no trailing slash). */
-export function toBlogUrl(siteUrl: string, base: string | null | undefined, path = '/'): string {
-  const origin = siteUrl.replace(/\/+$/, '')
-  const sitePath = joinBlogPath(base, path)
-  return sitePath === '/' ? origin : `${origin}${sitePath}`
-}

package/shared/utils/date.ts

@@ -1,26 +0,0 @@
-import type { IFirestoreDateValue } from '../models/date'
-
-/** Below this, a number is Unix seconds rather than milliseconds. */
-const MIN_SECONDS_TIMESTAMP = 10_000_000_000
-
-/** Firestore-ish date value (Date, Timestamp, `{ seconds }`, seconds/ms number, ISO string) → Unix ms, or `null`. */
-export function toDateMs(value: IFirestoreDateValue): number | null {
-  if (value == null || value === '')
-    return null
-
-  let ms: number
-  if (value instanceof Date)
-    ms = value.getTime()
-  else if (typeof value === 'number')
-    ms = value < MIN_SECONDS_TIMESTAMP ? value * 1000 : value
-  else if (typeof value === 'string')
-    ms = Date.parse(value)
-  else if ('toDate' in value && typeof value.toDate === 'function')
-    ms = value.toDate().getTime()
-  else if ('seconds' in value && typeof value.seconds === 'number')
-    ms = value.seconds * 1000
-  else
-    return null
-
-  return Number.isFinite(ms) && ms > 0 ? ms : null
-}

package/shared/utils/post-seo.ts

@@ -1,58 +0,0 @@
-import type { IPost } from '../models/post'
-import { toBlogUrl } from './blog-path'
-
-/**
- * Per-post SEO resolution shared by blog-admin (editor previews) and the public blog
- * (post page meta). DUPLICATED byte-identically into blog/shared/utils/post-seo.ts so the
- * editor preview always matches what the blog outputs.
- */
-
-/** Constants */
-export const SEO_TITLE_MAX = 60
-export const SEO_DESCRIPTION_MAX = 160
-
-/** Interfaces */
-export type IPostSeoSource = Pick<IPost, 'slug' | 'id' | 'title' | 'shortText' | 'imageURL' | 'imageAlt' | 'seoTitle' | 'seoDescription' | 'ogImageURL' | 'canonicalURL' | 'noindex'>
-
-export interface IPostSeoOptions {
-  /** Public site origin, e.g. https://blog.colorffy.com */
-  siteUrl: string
-  /** Where the blog mounts on that site (`blog.basePath`); defaults to the root. */
-  basePath?: string
-  /** Plain-text excerpt of the body, used when neither seoDescription nor shortText is set. */
-  bodyExcerpt?: string
-  /** Generated OG image URL, used when the post has no custom social image or cover. */
-  generatedImage?: string | null
-}
-
-export interface IResolvedPostSeo {
-  title: string
-  description: string
-  image: string | null
-  imageAlt: string
-  canonical: string
-  robots: 'index,follow' | 'noindex,follow'
-  noindex: boolean
-}
-
-/** Helpers */
-function clean(value: string | null | undefined): string {
-  return (value ?? '').replace(/\s+/g, ' ').trim()
-}
-
-export function resolvePostSeo(post: IPostSeoSource, options: IPostSeoOptions): IResolvedPostSeo {
-  const slug = clean(post.slug) || clean(post.id)
-  const title = clean(post.seoTitle) || clean(post.title) || 'Article'
-  const noindex = post.noindex === true
-
-  return {
-    title,
-    description: clean(post.seoDescription) || clean(post.shortText) || clean(options.bodyExcerpt),
-    // Custom social image beats the cover; the generated card is only a fallback.
-    image: clean(post.ogImageURL) || clean(post.imageURL) || clean(options.generatedImage) || null,
-    imageAlt: clean(post.imageAlt) || clean(post.title),
-    canonical: clean(post.canonicalURL) || toBlogUrl(options.siteUrl, options.basePath, `/${slug}`),
-    robots: noindex ? 'noindex,follow' : 'index,follow',
-    noindex
-  }
-}

package/shared/utils/sanitize.ts

@@ -1,80 +0,0 @@
-import sanitizeHtml from 'sanitize-html'
-
-/**
- * Server-side clean for post bodies shown with `v-html` (the post API only; the client
- * never imports it). Same allowlist as blog-admin's
- * `server/utils/sanitizePostHtml.ts` (the publish-time pass), so published markup survives untouched:
- * code blocks keep `language-xxx`, widget placeholders keep `data-blog-widget` + `data-props`,
- * external links get `rel="noopener nofollow"` + `target="_blank"` and images `img-fluid`.
- * Only addition: `id` on h2/h3, so heading ids already in the stored markup are kept for the TOC.
- */
-export function sanitizeBlogHtml(html: string): string {
-  if (!html)
-    return ''
-
-  return sanitizeHtml(html, {
-    allowedTags: [
-      'p',
-      'br',
-      'hr',
-      'div',
-      'span',
-      'h1',
-      'h2',
-      'h3',
-      'h4',
-      'h5',
-      'h6',
-      'strong',
-      'b',
-      'em',
-      'i',
-      's',
-      'u',
-      'code',
-      'pre',
-      'blockquote',
-      'ul',
-      'ol',
-      'li',
-      'a',
-      'img',
-      'figure',
-      'figcaption',
-      'table',
-      'thead',
-      'tbody',
-      'tr',
-      'th',
-      'td'
-    ],
-    allowedAttributes: {
-      '*': ['class'],
-      'a': ['href', 'name', 'target', 'rel'],
-      'img': ['src', 'alt', 'title', 'width', 'height'],
-      'div': ['data-blog-widget', 'data-props'],
-      'h2': ['id'],
-      'h3': ['id'],
-      'td': ['colspan', 'rowspan'],
-      'th': ['colspan', 'rowspan']
-    },
-    allowedSchemes: ['http', 'https', 'mailto'],
-    transformTags: {
-      a: (tagName, attribs) => {
-        const href = attribs.href ?? ''
-        if (/^https?:\/\//i.test(href)) {
-          attribs.rel = 'noopener nofollow'
-          attribs.target = '_blank'
-        }
-        return { tagName, attribs }
-      },
-      img: (tagName, attribs) => {
-        const classes = (attribs.class ?? '').split(/\s+/).filter(Boolean)
-        if (!classes.includes('img-fluid'))
-          classes.push('img-fluid')
-        attribs.class = classes.join(' ')
-        return { tagName, attribs }
-      }
-    }
-  })
-}

package/shared/widgets/types.ts

@@ -1,41 +0,0 @@
-/**
- * Interactive blog widget contract.
- *
- * This file is the single source of truth for widget metadata and is DUPLICATED
- * byte-identically into blog-admin/shared/widgets/ (two independent repos). Keep it
- * free of Vue/runtime imports so both the public renderer and the admin editor can
- * consume it. The public site maps each `key` to an actual Vue component separately
- * (app/widgets/component-map.ts).
- */
-export type WidgetPropType = 'string' | 'number' | 'boolean' | 'color' | 'enum'
-
-export interface WidgetPropOption {
-  value: string
-  label: string
-}
-
-export interface WidgetPropSchema {
-  type: WidgetPropType
-  label: string
-  default: string | number | boolean
-  required?: boolean
-  help?: string
-  /** enum only */
-  options?: WidgetPropOption[]
-  /** number only */
-  min?: number
-  max?: number
-  step?: number
-}
-
-export interface WidgetDescriptor {
-  /** Stored verbatim in the `data-blog-widget` attribute. */
-  key: string
-  name: string
-  description: string
-  /** Material Symbols HTML entity code point, e.g. `` (optional). */
-  icon?: string
-  /** px reserved by the placeholder before hydration, to avoid layout shift. */
-  minHeight?: number
-  props: Record<string, WidgetPropSchema>
-}