@nifrajs/content 5.5.0 → 5.6.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @nifrajs/content
 
+## 5.6.0
+
+### Patch Changes
+
+- 9ebcb1f: Every `nifra mcp` project tool carries MCP tool annotations, so a host can tell the tools that only read the project from the ones that write files or run project code and ask before those. A tool that writes only under a flag, such as `nifra_review` with `fix` and `write`, is marked as a writer. A tool that imports the project's config or backend runs its top-level code, so `nifra_routes`, `nifra_context`, `nifra_openapi`, `nifra_diff`, `nifra_prove` and the `nifra_db_*` tools are marked as running project code. Each tool's input fields that had no description now have one. The `nifra --help` line for `nifra docs-mcp` names all six tools that server offers.
+  
+  `entry.html` from `@nifrajs/content` is documented as unsanitized Markdown output: render it with `trustHtml(entry.html)` for content you wrote, or run it through `sanitizeHtml(entry.html, yourSanitizer)` when contributors or a CMS write it. The `<Content>` examples in the React, Preact and Solid adapters show the `trustHtml` call.
+
+## 5.5.1
+
+No changes in this release.
+
 ## 5.5.0
 
 ### Patch Changes

package/README.md

@@ -10,6 +10,21 @@ Part of the **[nifra](https://nifra.dev)** full-stack TypeScript framework - one
 bun add @nifrajs/content
 ```
 
+## Rendering an entry
+
+`entry.html` is `marked` output, unsanitized: raw HTML and `javascript:` links in the Markdown pass
+through. That is right for content you author. Mark it trusted for an adapter's `<Content>`:
+
+```tsx
+import { trustHtml } from "@nifrajs/web"
+import { Content } from "@nifrajs/web-react/content"
+
+<Content html={trustHtml(entry.html)} />
+```
+
+For a collection that contributors or a CMS write, pass `sanitizeHtml(entry.html, sanitizer)` with an
+allowlist sanitizer you choose instead.
+
 ## Docs
 
 - Reference: <https://nifra.dev/docs>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/content",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "Typed, schema-validated content collections for nifra - Markdown + frontmatter, framework-agnostic.",
   "keywords": [
     "bun",

package/src/index.ts

@@ -52,7 +52,12 @@ export interface Entry<Frontmatter> {
   readonly slug: string
   /** Frontmatter, validated + typed by the collection's schema. */
   readonly frontmatter: Frontmatter
-  /** The body rendered to HTML (Markdown → HTML). */
+  /**
+   * The body rendered to HTML (Markdown → HTML), unsanitized: raw HTML and `javascript:` links in the
+   * Markdown pass through. Render it as-is only for content you author, with
+   * `<Content html={trustHtml(entry.html)} />`; run anything contributors or a CMS write through
+   * `sanitizeHtml(entry.html, yourSanitizer)` (both from `@nifrajs/web`).
+   */
   readonly html: string
   /** The raw Markdown body, with the frontmatter block stripped. */
   readonly body: string