@proveanything/smartlinks 2.0.11 → 2.0.12

package/dist/docs/host-dependency-contract.md

@@ -32,7 +32,8 @@ export default defineConfig({
         'react', 'react-dom', 'react/jsx-runtime',
         '@proveanything/smartlinks',
         'react-router-dom', '@tanstack/react-query',
-        'lucide-react', 'date-fns', 'liquidjs', 'marked', 'class-variance-authority',
+        'lucide-react', 'date-fns', 'liquidjs', 'marked', 'dompurify', 'clsx', 'tailwind-merge',
+        'class-variance-authority',
         '@radix-ui/react-slot', '@radix-ui/react-dialog', '@radix-ui/react-popover',
         '@radix-ui/react-tooltip', '@radix-ui/react-tabs', '@radix-ui/react-accordion',
         '@radix-ui/react-select', '@radix-ui/react-scroll-area', '@radix-ui/react-label',
@@ -44,7 +45,8 @@ export default defineConfig({
           '@proveanything/smartlinks': 'SL',
           'react-router-dom': 'ReactRouterDOM', '@tanstack/react-query': 'ReactQuery',
           'lucide-react': 'LucideReact', 'date-fns': 'dateFns', 'liquidjs': 'LiquidJS',
-          'marked': 'marked', 'class-variance-authority': 'CVA',
+          'marked': 'marked', 'dompurify': 'DOMPurify', 'clsx': 'clsx',
+          'tailwind-merge': 'tailwindMerge', 'class-variance-authority': 'CVA',
           '@radix-ui/react-slot': 'RadixSlot', '@radix-ui/react-dialog': 'RadixDialog',
           '@radix-ui/react-popover': 'RadixPopover', '@radix-ui/react-tooltip': 'RadixTooltip',
           '@radix-ui/react-tabs': 'RadixTabs', '@radix-ui/react-accordion': 'RadixAccordion',
@@ -72,6 +74,9 @@ export default defineConfig({
 | `date-fns` | `dateFns` | 4.4 |
 | `liquidjs` | `LiquidJS` | 10.27+ |
 | `marked` | `marked` | 12+ |
+| `dompurify` | `DOMPurify` | 3+ |
+| `clsx` | `clsx` | 2+ |
+| `tailwind-merge` | `tailwindMerge` | 3+ |
 | `class-variance-authority` | `CVA` | 0.7 |
 | `@radix-ui/react-slot` | `RadixSlot` | 1.2.4 |
 | `@radix-ui/react-dialog` | `RadixDialog` | 1.1.23 |
@@ -86,10 +91,15 @@ export default defineConfig({
 | `@radix-ui/react-progress` | `RadixProgress` | 1.1.8 |
 | `@radix-ui/react-avatar` | `RadixAvatar` | 1.1.11 |
 
-`liquidjs` and `marked` are **host-provided** — externalise them, don't ship a second copy
-(frequently missed). `marked` is new in **contract v6**: the portal and hub render markdown in the
-container, so an app should use the host's renderer rather than bundling its own. `marked` does not
-sanitise HTML — if you render untrusted markdown, sanitise the output (e.g. DOMPurify) yourself.
+`liquidjs`, `marked`, `dompurify`, `clsx` and `tailwind-merge` are **host-provided** — externalise
+them, don't ship a second copy (frequently missed). `marked` arrived in **v6**; `dompurify`, `clsx`
+and `tailwind-merge` in **v7**. The portal and hub render markdown in the container, so use the
+host's `marked` rather than bundling your own. `marked` does not sanitise HTML — pair it with the
+shared `dompurify`: `el.innerHTML = DOMPurify.sanitize(marked.parse(md))`. `window.DOMPurify` is the
+**configured instance** (callable, `.sanitize()`), so `import DOMPurify from 'dompurify'` behaves
+exactly like a bundled default import. `clsx` + `tailwind-merge` are the standard `cn()` pair
+(`import { clsx } from 'clsx'; import { twMerge } from 'tailwind-merge'`) — keep your local `cn()`
+helper if you like, it just stops paying the bundle cost.
 
 ## Backwards compatibility
 
@@ -115,7 +125,8 @@ app ships the Tailwind 4 CSS-first layout as the default; see its README.)
 
 React **19.3** · Vite **8.3** · react-router-dom **7.18** · Tailwind **4.3** (CSS-first) ·
 TypeScript **6.0** · ESLint **10.11** · `@proveanything/smartlinks` **2.0.5** ·
-`@proveanything/smartlinks-utils-ui` **1.16.4** · liquidjs **10.29** · marked **12+**.
+`@proveanything/smartlinks-utils-ui` **1.16.4** · liquidjs **10.29** · marked **12+** ·
+dompurify **3+** · clsx **2+** · tailwind-merge **3+**.
 
 > **TypeScript 7** (the native/Go compiler) is **deliberately deferred** — tooling hasn't settled.
 > Target **TS 6** for R5; it compiles existing code with no source changes.
@@ -142,8 +153,8 @@ never drift:
 
 ```ts
 import {
-  SHARED_DEPENDENCY_CONTRACT_VERSION, // 'v6'
-  SHARED_DEPENDENCIES,                // [{ specifier, globalName, minVersion, importMapPath }, …] (26)
+  SHARED_DEPENDENCY_CONTRACT_VERSION, // 'v7'
+  SHARED_DEPENDENCIES,                // [{ specifier, globalName, minVersion, importMapPath }, …] (29)
   SHARED_DEPENDENCY_SPECIFIERS,       // bare specifiers — drop straight into a bundler `external` list
   getHostSharedDependencies,          // what the live host advertises at runtime, or null
 } from '@proveanything/smartlinks'

package/dist/shared-dependencies.d.ts

@@ -1,5 +1,5 @@
 /** Current contract revision. Bumped when the entry list or host versions change. */
-export declare const SHARED_DEPENDENCY_CONTRACT_VERSION: "v6";
+export declare const SHARED_DEPENDENCY_CONTRACT_VERSION: "v7";
 export interface SharedDependency {
     /** Bare import specifier the app writes, e.g. `react-dom/client`. */
     specifier: string;
@@ -13,8 +13,8 @@ export interface SharedDependency {
 /**
  * Canonical import-map path for a specifier: drop the leading `@` scope marker and
  * turn every `/` into `-`.
- *   'react-dom/client'      -> '/sl-shared/v6/react-dom-client.js'
- *   '@radix-ui/react-slot'  -> '/sl-shared/v6/radix-ui-react-slot.js'
+ *   'react-dom/client'      -> '/sl-shared/v7/react-dom-client.js'
+ *   '@radix-ui/react-slot'  -> '/sl-shared/v7/radix-ui-react-slot.js'
  * Hosts MUST serve shims at these paths so the map the SDK advertises resolves.
  */
 export declare function importMapPathFor(specifier: string, version?: string): string;

package/dist/shared-dependencies.js

@@ -11,22 +11,24 @@
 //
 // See docs/host-dependency-contract.md.
 /** Current contract revision. Bumped when the entry list or host versions change. */
-export const SHARED_DEPENDENCY_CONTRACT_VERSION = 'v6';
+export const SHARED_DEPENDENCY_CONTRACT_VERSION = 'v7';
 /**
  * Canonical import-map path for a specifier: drop the leading `@` scope marker and
  * turn every `/` into `-`.
- *   'react-dom/client'      -> '/sl-shared/v6/react-dom-client.js'
- *   '@radix-ui/react-slot'  -> '/sl-shared/v6/radix-ui-react-slot.js'
+ *   'react-dom/client'      -> '/sl-shared/v7/react-dom-client.js'
+ *   '@radix-ui/react-slot'  -> '/sl-shared/v7/radix-ui-react-slot.js'
  * Hosts MUST serve shims at these paths so the map the SDK advertises resolves.
  */
 export function importMapPathFor(specifier, version = SHARED_DEPENDENCY_CONTRACT_VERSION) {
     const slug = specifier.replace(/^@/, '').replace(/\//g, '-');
     return `/sl-shared/${version}/${slug}.js`;
 }
-// The 26-entry v6 contract: the v5 set plus `marked` (host-provided markdown
-// renderer, so apps stop bundling their own ~30KB copy — portal & hub render it in
-// the container). minVersion follows the R5 host baseline (React 19, Router 7.18.4
-// security floor, LiquidJS 10.27+, current Radix majors).
+// The 29-entry v7 contract: the v6 set plus `dompurify` (HTML sanitizer — pairs with
+// the shared `marked` so output apps sanitize instead of each bundling their own),
+// `clsx` + `tailwind-merge` (the standard `cn()` pair the portal/hub already ship, now
+// exposed to apps). All small, version-stable, ubiquitous — apps stop bundling copies.
+// minVersion follows the R5 host baseline (React 19, Router 7.18.4 security floor,
+// LiquidJS 10.27+, current Radix majors).
 const CONTRACT = [
     { specifier: 'react', globalName: 'React', minVersion: '19.0.0' },
     { specifier: 'react-dom', globalName: 'ReactDOM', minVersion: '19.0.0' },
@@ -41,6 +43,12 @@ const CONTRACT = [
     { specifier: 'date-fns', globalName: 'dateFns', minVersion: '4.0.0' },
     { specifier: 'liquidjs', globalName: 'LiquidJS', minVersion: '10.27.0' },
     { specifier: 'marked', globalName: 'marked', minVersion: '12.0.0' },
+    // `window.DOMPurify` is the CONFIGURED instance (callable, `.sanitize()`), exactly as
+    // dompurify's own UMD build exposes it — so `import DOMPurify from 'dompurify'`
+    // resolves to the same instance a bundled default import would.
+    { specifier: 'dompurify', globalName: 'DOMPurify', minVersion: '3.0.0' },
+    { specifier: 'clsx', globalName: 'clsx', minVersion: '2.0.0' },
+    { specifier: 'tailwind-merge', globalName: 'tailwindMerge', minVersion: '3.0.0' },
     { specifier: 'class-variance-authority', globalName: 'CVA', minVersion: '0.7.0' },
     { specifier: '@radix-ui/react-slot', globalName: 'RadixSlot', minVersion: '1.2.0' },
     { specifier: '@radix-ui/react-dialog', globalName: 'RadixDialog', minVersion: '1.1.0' },

package/dist/types/appManifest.d.ts

@@ -417,7 +417,7 @@ export interface AppManifest {
          */
         moduleFormat?: 'umd' | 'esm' | 'dual';
         /**
-         * Shared-dependency contract version this bundle was built against, e.g. `"v6"`
+         * Shared-dependency contract version this bundle was built against, e.g. `"v7"`
          * (see `SHARED_DEPENDENCY_CONTRACT_VERSION`). The host uses it to select a
          * compatible import map for the ESM load path.
          */

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.11  |  Generated: 2026-09-21T19:28:09.956Z
+Version: 2.0.12  |  Generated: 2026-09-21T22:28:25.241Z
 
 This is a concise summary of all available API functions and types.