@reblu/site-blocks 0.4.3 → 0.4.4

package/CHANGELOG.md

@@ -0,0 +1,679 @@
+# @reblu/site-blocks
+
+## 0.4.4
+
+### Patch Changes
+
+- 9f54c58: REB-774 — ship `CHANGELOG.md` inside the published npm tarball for every
+  `@reblu/site-*` package (verified via `pnpm pack`: it was previously absent,
+  since `"files": ["dist"]` limited the tarball to `dist/` and npm only
+  auto-includes `README.md`, `LICENSE` and `package.json`). Consumers can now
+  read the changelog for the version they installed straight from
+  `node_modules/@reblu/<pkg>/CHANGELOG.md`.
+- 9f54c58: REB-774 — widen `@reblu/site-client`'s and `@reblu/site-blocks`' internal
+  `@reblu/site-*` dependency ranges from `workspace:*` to `workspace:^`, which
+  pnpm publishes as a caret range (e.g. `^1.0.0`) instead of an exact pin.
+  Verified against the packed tarballs: `site-client`'s `@reblu/site-contracts`
+  peerDependency and devDependency, and `site-blocks`' `@reblu/site-contracts`
+  and `@reblu/site-ui` dependencies, now publish as `^1.0.0` / `^0.5.0`. A
+  consuming SITE on a caret range for those packages no longer risks two copies
+  of the same dependency in its tree, or an unmet peer, the next time
+  `site-contracts` or `site-ui` ships an additive release.
+- Updated dependencies [9f54c58]
+  - @reblu/site-contracts@1.0.1
+  - @reblu/site-ui@0.5.1
+
+## 0.4.3
+
+### Patch Changes
+
+- Updated dependencies [340db30]
+  - @reblu/site-contracts@1.0.0
+
+## 0.4.2
+
+### Patch Changes
+
+- e91b35e: Correct what the docs promise about `hidden`.
+
+  `0.4.0`'s changelog said a block marked `hidden` "stays unpublished instead of
+  appearing on the live page". The first half is true and the second is not: the
+  element is not rendered and not announced to a screen reader, but it is still
+  present in the HTML the server sends. Anyone who views source reads it, and so
+  does a crawler working on raw HTML.
+
+  That is precisely what the HTML specification says `hidden` means, so nothing in
+  the renderer changes here — only the documentation, which described a stronger
+  guarantee than the attribute gives. Measured against the published package:
+
+  ```
+  IN : <p hidden>Unpublished draft</p><p>Published</p>
+  OUT: <p hidden="" class="…">Unpublished draft</p><p class="…">Published</p>
+  ```
+
+  The distinction matters because these are tenant-authored legal pages that
+  nobody on the platform side proofreads. An author who reads "not-for-publication"
+  and leaves half a draft clause behind `hidden` has published it — invisibly, but
+  published. The README's authoring notes now say so, and say what to do instead:
+  to keep text unpublished, keep it out of the page.
+
+  Found by the `reblu-site-dermamedicin` session, measuring the installed package
+  rather than trusting the changelog.
+
+- Updated dependencies [65e124a]
+  - @reblu/site-ui@0.5.0
+
+## 0.4.1
+
+### Patch Changes
+
+- abf1ab1: Stop `MarkdownRenderer` from silently renumbering an ordered list, and keep the rest of
+  what an author wrote about a document's meaning.
+
+  A privacy policy written as
+
+  ```md
+  4. The data controller may …
+  ```
+
+  rendered a list starting at **1**. Prose elsewhere on the page saying "as established in
+  clause 4" then pointed at the wrong clause. The Markdown pipeline was never at fault —
+  `markdownToSafeHtml` emits `<ol start="4">` and `sanitizeHtml` preserves it — but the
+  renderer's component map rebuilds each element to apply the tenant's design tokens, and
+  it re-emitted only `className`. Everything else the author wrote was dropped on the floor.
+  Legal pages are tenant-authored and nobody on the platform side proofreads them, so this
+  reached visitors unseen.
+
+  The map now forwards the authored attributes that change what a document **says**:
+  - `start` and `type` on `<ol>`, `value` and `type` on `<li>` — list numbering.
+  - `id` — in-document links (`see <a href="#clause-4">`) resolve to a real target again.
+  - `hidden` — a block the author marked as not-for-publication stays unpublished instead
+    of appearing on the live page.
+  - `lang` and `dir` — a passage in another language is announced in that language.
+  - `title`, `role`, every `aria-*` and every `data-*`.
+
+  Deliberately still dropped: `class` and `style`, because presentation belongs to the
+  tenant's theme rather than the document body; and `target`/`rel` on links, which the
+  renderer sets itself so an external link is always `noopener noreferrer` — an author
+  cannot weaken that through this path.
+
+  `reversed` on `<ol>` remains unavailable: the sanitiser does not allow it, and this
+  release does **not** widen the sanitiser's allowlist to change that. Number a descending
+  list explicitly with `value` on each `<li>`.
+
+  Also documented, unchanged behaviour worth knowing about: a single newline inside a
+  paragraph is a soft break (whitespace), not a `<br>`. That is standard CommonMark, and it
+  is what this renderer has done since it replaced the earlier non-standard one — but text
+  typed on consecutive lines under the old behaviour, such as addresses and signature
+  blocks, reads differently now. The package README's new "Authoring notes" section shows
+  how to write a hard break.
+
+## 0.4.0
+
+### Minor Changes
+
+- e5cda17: Make `@reblu/site-blocks` importable in a React Server Component, make its CommonJS entry
+  render, and replace the "RSC-safe" comments with gates that fail when the claim stops
+  being true.
+
+  A consuming SITE was stuck between two mutually exclusive configurations. Bundled, its
+  `next build` failed collecting `/condiciones`:
+
+  ```
+  TypeError: H.createContext is not a function
+  ```
+
+  Externalized through `serverExternalPackages` — the documented remedy — it built, then
+  returned HTTP 500 with `ERR_REQUIRE_ESM: require() of ES Module … domhandler … from
+html-react-parser` on `/blog` **and on `/`**. There was no consumer-side setting that
+  satisfied both, so the site shipped a plain-text interim renderer and its legal pages
+  displayed raw Markdown (`##`, `**`) to visitors. Three defects, one release.
+
+  ## 1. Radix Slot in the Server Component graph
+
+  `_page-parts.tsx` — reachable from the RSC-safe root entry, and the module that calls
+  `sanitizeHtml`, which must run server-side (REB-613) — rendered
+  `<Button asChild><a …/></Button>`. `Button` imports `@radix-ui/react-slot`, and
+  `@radix-ui/react-slot@1.3.1` opens with `var SlotContext = React.createContext(mergeProps)`
+  at module scope. React's `react-server` build exports no `createContext`, so the entry
+  throws on import, before rendering anything.
+
+  `asChild` was doing exactly one job here: paint a link with the button's class list.
+  `buttonVariants` does that with no React and no Radix in its graph, so `SectionCta` emits
+  the anchor directly. The rendered element is unchanged — `organisms.test.tsx` builds the
+  reference from `Button` itself and asserts attribute-for-attribute equality, so a future
+  change to the Button's `data-*` set or classes fails rather than silently drifting.
+
+  **No public API changed.** `Button` still ships from `@reblu/site-ui`'s root.
+
+  ## 2. Two new `@reblu/site-ui` subpaths (minor, additive)
+
+  Seven of the eight component files in `@reblu/site-blocks` imported **only** `cn` — four
+  lines of `clsx` + `tailwind-merge` — and had to take the root barrel to get it, resolving
+  `@radix-ui/react-slot` and `class-variance-authority` along the way. There was no import
+  that avoided it.
+
+  | subpath                          | exports          | imports                    |
+  | -------------------------------- | ---------------- | -------------------------- |
+  | `@reblu/site-ui/utils`           | `cn`             | `clsx`, `tailwind-merge`   |
+  | `@reblu/site-ui/button-variants` | `buttonVariants` | `class-variance-authority` |
+
+  Neither imports React. Both remain exported from the root, so this is additive:
+  `import { cn } from '@reblu/site-ui'` keeps working. This is the fourth time the answer to
+  a barrel dragging UI into a server surface has been an isolated subpath (REB-469's
+  `./cache`, REB-622's JSON-LD entry, and now these two) — worth stating as a package rule.
+
+  `@radix-ui/react-slot` is also pinned EXACTLY (`1.2.4`, previously `^1.2.4`). `1.2.4` is
+  what this repo already resolved and what every test here is green on, so the pin changes
+  no behaviour; it removes a consumer's ability to resolve 1.3.1 for a package whose
+  server-evaluability we are asserting.
+
+  ## 3. `html-react-parser` pinned to `5.2.17` (exact), and its CommonJS entry fixed
+
+  The whole 6.x line depends on `domhandler@6`, which is `"type": "module"` with no
+  `require` condition. `^6.1.5` resolved to `6.1.7` — the range, not the resolution, was the
+  defect, and the production trace names `html-react-parser@6.1.7` in the failing path, so
+  moving forward inside 6.x was never an available fix. `5.2.17` pins `domhandler` to
+  exactly `5.0.3` and `html-dom-parser` to exactly `5.1.8`, both of which ship a `require`
+  condition. The pin is exact because an external SITE resolves this range on its own
+  machine, where our CI cannot see it.
+
+  **What the downgrade gives up.** An earlier draft of this changeset called 5.2.17 "an
+  identical parser API", and that was not true. 6.0.0's breaking changes were indeed only
+  those dependency majors plus an `es5` → `es2016` target, but 6.1.x added two things that
+  do not exist in 5.2.17:
+
+  | lost                        | added in | what it is                                                                                                                                    |
+  | --------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
+  | `options.trustedTypePolicy` | 6.1.0    | Trusted Types / CSP support. Unused here.                                                                                                     |
+  | `normalizeDOMNodes`         | 6.1.1    | `Object.setPrototypeOf(node, DomHandlerElement.prototype)` before iterating, so `node instanceof Element` survives a duplicated `domhandler`. |
+
+  The second one is not academic. `markdown-renderer.tsx` gates its **entire** component map
+  on `if (!(node instanceof Element)) return undefined`. If that ever returned false there
+  would be no crash — just silently unstyled default HTML: no heading offset (a duplicate
+  `<h1>` per post), no `loading="lazy"`, and no `rel="noopener noreferrer"` on external
+  links. A silent, security-relevant degradation on tenant-authored content.
+
+  This is accepted, not dismissed. 5.2.17 and its `html-dom-parser@5.1.8` both pin
+  `domhandler` to exactly `5.0.3`, so a second 5.x copy needs a third package to introduce
+  one. Not reproduced, and not fixed here — but a maintainer reading this must not be
+  surprised by it later.
+
+  **What the trace does and does not say.** 54 occurrences on 2026-09-09, `bundler:
+turbopack`, and `routes=/blog.rsc, /` — the home page was affected too, so the blast
+  radius was wider than the issue recorded. The outer frame is Turbopack's external-module
+  wrapper, which reads `raw = await import(id)` inside a try/catch that re-throws: it
+  _reports_ the failure, it does not cause it. The `require()` that fails is Node's own,
+  inside `html-react-parser`'s CommonJS graph loading `domhandler`. **Why `require(esm)` was
+  not in effect on that lambda is still open** — Node 24 has it on by default, and the
+  project's `nodeVersion: "24.x"` is what it declares today, not necessarily what ran on
+  2026-09-09. That question is deliberately left open rather than written closed, which is
+  the same discipline the rest of this change is about. What does not depend on the answer:
+  a package whose graph reaches an ESM-only module is loadable only where `require(esm)`
+  happens to be available, and `dependencies` is the one place we can remove the
+  "happens to".
+
+  Building the gate for that surfaced a **second, independent defect, present on 6.1.5 too**:
+  `dist/index.cjs` could never render Markdown at all. `html-react-parser`'s CommonJS build
+  is `tsc` output (`exports.default = …`, `__esModule` set, `module.exports` left as the
+  exports object), and Node's CJS→ESM interop binds a default import to `module.exports`
+  itself — so `import parse from 'html-react-parser'` resolved to that object and calling it
+  threw `TypeError: (0, import_html_react_parser.default) is not a function` on first render.
+  `dist/index.js` (ESM) was fine, because it resolves the package's `esm/` build. Every
+  consumer on the CommonJS entry — which is precisely what `serverExternalPackages` selects
+  — had a `MarkdownRenderer` and a `SafeHtml` that threw. `MarkdownRenderer` now composes
+  the named exports `htmlToDOM` + `domToReact`, which survive that interop identically in
+  both formats and are what the default export calls internally.
+
+  ## How this is guarded
+
+  `packages/site-ui/test/rsc-safety.test.ts` and `packages/site-blocks/test/rsc-safety.test.ts`
+  build through the real tsup config and load each RSC-safe entry in a child process started
+  with `--conditions=react-server`, then render the exported components there. Each child
+  first asserts `React.createContext === undefined`, so a lost flag is a red test rather than
+  a silent downgrade to the ordinary client React the rest of the suite already exercises.
+
+  That behavioural layer alone would **not** have caught this, and saying so is the point.
+  The module that threw was `@radix-ui/react-slot@1.3.1`; this repo's lockfile resolves
+  1.2.4. A child process here loads the graph _we_ resolved, not the graph the SITE
+  installed, so it would have stayed green for the entire outage. A distributable cannot
+  verify a property that depends on a consumer's resolution — the property has to be made
+  resolution-independent. So a second layer asserts, from the emitted artifact, that the
+  RSC-safe entries reach for no `@radix-ui/*` package, and that the only `@reblu/site-ui`
+  entries they take are the two `site-ui`'s own gate certifies free of React and Radix
+  (`./utils`, `./button-variants`). That holds whichever Slot anyone installs.
+
+  That second assertion is an **allowlist over the whole `@reblu/site-ui/*` namespace**, and
+  not by accident. Banning the root barrel alone bans one specifier: `@reblu/site-ui/tabs`,
+  `/form`, `/label` and `/next` all passed it. `./tabs` pulls `@radix-ui/react-tabs`, whose
+  module body calls `React.createContext` unconditionally in every version; `./form` and
+  `./label` reach a `@radix-ui/react-slot` copy that `site-ui`'s exact pin does not govern,
+  because it hangs off `@radix-ui/react-label` → `@radix-ui/react-primitive`. Verified by
+  mutation: importing `@reblu/site-ui/label` into `_page-parts.tsx` leaves the `@radix-ui/*`
+  assertion, both `react-server` render gates and all fifteen `'use client'` smoke tests
+  green — and fails only this one.
+
+  A third layer, `test/dependency-pins.test.ts` in each package, asserts that the specifiers
+  this all rests on are still exact (`/^\d+\.\d+\.\d+$/`) by reading the real `package.json`.
+  Nothing else could: every other gate exercises the graph _this_ checkout resolved, so
+  `pnpm up` or Renovate with `rangeStrategy: bump` could turn `"1.2.4"` back into `"^1.3.3"`
+  and leave the whole suite green while the published manifest handed the caret — the actual
+  defect — straight back to the consumer.
+
+  `test/use-client-smoke.test.ts` previously carried a written exemption saying
+  `dist/index.cjs` could not be gated, because the ESM-only chain was "a property of a
+  first-class React dependency this package does not control" and was "fine on every runtime
+  this repo targets". Both halves were wrong, and both are removed: the entry is now loaded
+  AND rendered in a child process under `--no-experimental-require-module`.
+
+  The `'use client'` smoke test could not have covered any of this. It asserts the
+  _directive_ is absent from the root entry — an entry can be directive-free and still be
+  impossible to evaluate in a Server Component. The directive is a declaration; the module
+  graph is the fact.
+
+  ## Why `@reblu/site-blocks` is a minor and not a patch
+
+  Two independent reasons, and the first would settle it on its own.
+
+  **Additive public API.** `@reblu/site-ui` gains two subpath exports (`./utils`,
+  `./button-variants`). New public surface is a minor by definition, and `@reblu/site-blocks`
+  ships in the same release. Nothing here ends up over-versioned.
+
+  **The parser downgrade.** Under strict semver a `patch` is defensible: no exported symbol
+  of `@reblu/site-blocks` changed signature or behaviour, and a dependency range is not
+  public API. It is still the wrong call, for a reason specific to this package.
+
+  `html-react-parser` is **externalized** — that is the whole point of the pin — so it is
+  resolved from the consumer's tree rather than bundled into ours. The strongest consequence
+  has nothing to do with anyone else's dependency graph: it changes **which parser runs
+  inside `@reblu/site-blocks`' own output**, for every consumer, whether or not they use
+  `html-react-parser` themselves. `MarkdownRenderer` and `SafeHtml` go from 6.1.7 to 5.2.17
+  underneath, losing `normalizeDOMNodes`. That is a change in what this package renders,
+  arriving through a version bump.
+
+  The narrower exposure is the **hoisted** case: a consumer with no direct dependency,
+  reading a flattened `node_modules`, now finds 5.2.17 at the top level where 6.1.7 used to
+  be. A consumer that _does_ declare `html-react-parser` itself is largely insulated — pnpm
+  gives it its own isolated copy, and under npm's hoisting its own direct dependency wins at
+  the top level. That case is deliberately **not** part of the argument.
+
+  **And the process half, which is the one that does not depend on any of the above.**
+  `patch` is what auto-merge and Renovate's default rules wave through unattended. `minor`
+  puts a two-major downgrade of a runtime dependency in front of a human. That is the point
+  of choosing it: not that semver forbids `patch`, but that this is a decision someone should
+  have to look at.
+
+### Patch Changes
+
+- Updated dependencies [e5cda17]
+- Updated dependencies [7dcfb4f]
+  - @reblu/site-ui@0.4.0
+  - @reblu/site-contracts@0.5.0
+
+## 0.3.1
+
+### Patch Changes
+
+- Updated dependencies [eef13bf]
+  - @reblu/site-contracts@0.4.0
+
+## 0.3.0
+
+### Minor Changes
+
+- 1b0151b: Replace `isomorphic-dompurify` with `hast-util-sanitize` in `sanitizeHtml` /
+  `markdownToSafeHtml`. `isomorphic-dompurify` pulls in `jsdom`, whose transitive
+  `html-encoding-sniffer` → `@exodus/bytes` chain is ESM-only and fails to
+  `require()` under Vercel's Node runtime (`ERR_REQUIRE_ESM`) — every route
+  rendering tenant HTML (`/[slug]`, `/services/[slug]`, and any route reachable
+  through the catch-all) 500'd in production since 2026-08-06 while CI stayed
+  green, because Vitest's jsdom test environment papered over the very module that
+  fails to load in prod.
+
+  The replacement is `parse5` → `hast-util-from-parse5` → `hast-util-sanitize` →
+  `hast-util-to-html`, called directly rather than through `unified`/`rehype-*`.
+  That is deliberate: `unified().processSync` builds a `VFile`, whose constructor
+  calls `process.cwd()`, which makes the bundle acquire bare `path`/`process`/`url`
+  imports and reproduces REB-606's exact shape (a build-invisible, runtime-only
+  module failure) in a different runtime. `marked` is bundled for the same reason
+  (see "Operational"). The published artifact now imports **nothing** outside this
+  package's declared runtime surface, in both formats:
+
+  | entry                     | runtime imports                                            |
+  | ------------------------- | ---------------------------------------------------------- |
+  | `dist/index.js`           | `@reblu/site-ui`, `html-react-parser`, `react/jsx-runtime` |
+  | `dist/index.cjs`          | `@reblu/site-ui`, `html-react-parser`, `react/jsx-runtime` |
+  | `dist/client.js` / `.cjs` | `@reblu/site-ui`, `react`, `react/jsx-runtime`             |
+
+  `packages/site-blocks/test/use-client-smoke.test.ts` guards that behaviourally,
+  not by pinning the list above — see "How the regression is guarded".
+
+  ## Read this before taking 0.3.0
+
+  `hast-util-sanitize`'s `defaultSchema` is GitHub's markdown-comment policy, which
+  is meaningfully _stricter_ — and in a number of places _wider_ — than
+  `isomorphic-dompurify`'s unconfigured default. The schema in this change restores
+  DOMPurify's default profile wherever that carries no new injection surface, but
+  it is **not** a byte-for-byte reproduction. Everything below was measured by
+  differential sweep of both built bundles against `isomorphic-dompurify@3.21.0`,
+  not inferred from intent. If tenant `customHtml` (authored via the nexus HTML
+  editor, stored per-tenant, not visible from this codebase) relies on anything in
+  the "removed" lists, it will render differently after this upgrade — hence
+  `minor`.
+
+  ### Restored (parity with the last month of production)
+  - `class`, `style`, `target`, `rel`, `loading`, and `class` specifically on
+    `a`/`code`/`h2`/`li`/`ol`/`section`/`ul`, where `defaultSchema` value-restricts
+    it per tag and it would otherwise be wiped to `class=""`.
+  - Structural/formatting tags: `figure`, `figcaption`, `article`, `aside`, `nav`,
+    `header`, `footer`, `main`, `hgroup`, `address`, `small`, `cite`, `mark`,
+    `time`, `data`, `abbr`, `acronym`, `dfn`, `bdi`, `bdo`, `caption`, `col`,
+    `colgroup`, `center`, `font`, `big`, `u`, `wbr`.
+  - `<video>`, `<audio>`, `<track>` — with `src`/`poster` protocol-gated. A
+    self-hosted clinic testimonial video would otherwise be silently unwrapped.
+  - URL schemes `tel:`, `callto:`, `sms:`, `ftp:`, `ftps:`, `cid:`, `matrix:` on
+    `href`. `defaultSchema.protocols.href` omits them, so a `<a href="tel:…">`
+    phone CTA lost its `href` and became inert text. (`mailto:` is in both lists,
+    which is exactly why a spot check misses this.)
+  - Global attributes `hidden`, `download`, `sizes`, `draggable`, `spellcheck`,
+    `translate`, `slot`, `part`, `popover`, `inert`, `autocapitalize`,
+    `enterkeyhint`. **`hidden` is not a styling nit**: without it, a tenant block
+    authored as `<p hidden>` is published visible on deploy.
+  - `type` on `<ol>`/`<li>` (list numbering) — restored **per tag** and
+    value-restricted to the marker enum (`1 a A i I disc square circle`), not globally.
+    `hast-util-sanitize` falls back to the `'*'` list whenever the tag-specific
+    value check returns undefined, so a global `type` would silently unpin
+    `defaultSchema`'s `input: [['type','checkbox']]` coercion.
+  - `role` + the standard `aria-*` set, and arbitrary `data-*`.
+  - `id`/`name` are no longer clobber-prefixed, so tenant anchor links keep working.
+  - **Uppercase URL schemes.** `hast-util-sanitize` compares the scheme
+    case-_sensitively_; DOMPurify's regex is `/i`. `<a href="HTTP://example.com/">`
+    silently lost its `href` — and a mixed-case scheme is exactly what a
+    Word/Outlook paste produces. The scheme is now lowercased before sanitising.
+    This cannot launder a disallowed scheme: `JaVaScRiPt:` normalises to
+    `javascript:` and is still rejected. A scheme with leading whitespace or an
+    embedded newline is left untouched and keeps failing the allowlist.
+
+  ### Removed relative to `isomorphic-dompurify` — complete list
+
+  Tags no longer rendered (**unwrapped**: the element is dropped, its text content
+  kept):
+  - Media/graphics: `canvas`, `map`, `area`.
+  - Form controls: `form`, `button`, `select`, `textarea`, `label`, `legend`,
+    `fieldset`, `option`, `optgroup`, `datalist`, `output`, `progress`, `meter`.
+  - Structural: `dialog`, `menu`, `search`.
+  - Shadow-DOM plumbing: `slot`, `content`, `shadow`, `element`, `decorator`.
+  - Obsolete: `dir`, `marquee`, `nobr`, `spacer`, `blink`, `menuitem`.
+
+  `<input>` is **removed outright, not unwrapped**, unless it is
+  `type="checkbox"` — and a surviving checkbox is forced `disabled`. This is the
+  GFM task-list marker and the only reason `input` is in the allowlist at all.
+  Spelling it out because the mechanism is a trap: `defaultSchema.required` is
+  `{input: {disabled: true, type: 'checkbox'}}`, and `required` does **not**
+  filter — it FORCES values onto elements that survive. Without an explicit
+  removal, `<input type="text" name="q">` came out as
+  `<input name="q" disabled type="checkbox">`, and a `<input type="hidden">` field
+  a tenant contact form had carried invisibly for a month rendered as a **visible**
+  orphan checkbox. Not a security hole (the checkbox is inert) — a content
+  regression, and now it does not happen.
+
+  `<svg>`, `<math>` and everything inside them are **removed with their content**,
+  not unwrapped. DOMPurify allowed both namespaces by default, so an inline SVG
+  logo or a pasted MathML equation rendered before this release and does not now.
+  This is the same decision as before (SVG/MathML are a recurring source of
+  real-world sanitiser bypasses via `foreignObject` / namespace confusion), but it
+  is now actually implemented: unwrapping dropped the tags and dumped the inner
+  text into the page as body copy, which was neither rendering the graphic nor
+  removing it. It is also what stops `sanitizeHtml` from THROWING — see
+  "Foreign content no longer crashes the render".
+
+  `object`, `embed`, `html`, `head` and `body` were listed here in an earlier draft.
+  That was wrong and is corrected: DOMPurify's default allowlist never contained
+  `object`/`embed`, and `html`/`head`/`body` are unwrapped by both sanitisers.
+  There is no delta on any of the five.
+
+  Content-holding elements are removed **with** their content rather than
+  unwrapped, matching DOMPurify's `DEFAULT_FORBID_CONTENTS`: `style`, `script`,
+  `template`, plus `title`, `xmp`, `noembed`, `noframes`, `plaintext`,
+  `selectedcontent`, `desc`, `foreignobject`, `annotation-xml`, `mi`, `mn`, `mo`,
+  `ms`, `mtext`. Unwrapping these is a content leak, not a sanitisation:
+  `<title>Documento interno</title>` — exactly what a Word / LibreOffice "save as
+  HTML" paste carries — was being published as a stray paragraph of tenant body
+  copy.
+
+  One residual difference is disclosed rather than fixed. A **bare** SVG or MathML
+  element name written with no `<svg>`/`<math>` parent is parsed as an unknown HTML
+  element, so `dropForeignContent` does not see it and the strip list above does not
+  name it; this module unwraps it and emits its escaped text, where DOMPurify
+  force-removed it. Not XSS — the serialiser escapes text and the tag is gone. The
+  complete measured set is `altglyph`, `altglyphdef`, `altglyphitem`,
+  `animatecolor`, `animatemotion`, `animatetransform`, `circle`, `clippath`,
+  `defs`, `ellipse`, `filter`, `g`, `glyph`, `glyphref`, `hkern`, `line`,
+  `lineargradient`, `marker`, `mask`, `menclose`, `merror`, `metadata`, `mfenced`,
+  `mfrac`, `mglyph`, `mlabeledtr`, `mmultiscripts`, `mover`, `mpadded`, `mpath`,
+  `mphantom`, `mprescripts`, `mroot`, `mrow`, `mspace`, `msqrt`, `mstyle`, `msub`,
+  `msubsup`, `msup`, `mtable`, `mtd`, `mtr`, `munder`, `munderover`, `path`,
+  `pattern`, `polygon`, `polyline`, `radialgradient`, `rect`, `stop`, `switch`,
+  `symbol`, `text`, `textpath`, `tref`, `tspan`, `view`, `vkern` — plus
+  `part`, `inputmode`, `enterkeyhint` and `exportparts`, which are attribute names
+  rather than real elements but behave the same way when written as tags.
+
+  Attributes no longer emitted on ordinary elements: `background` (a URL sink
+  DOMPurify allowed), `bgcolor`, `face`, `high`, `low`, `optimum`, `pubdate`,
+  `crossorigin`, `decoding`, `integrity`, `nonce`, `exportparts`, `popovertarget`,
+  `popovertargetaction`, `command`, `commandfor`, `capture`, `inputmode`, `list`,
+  `pattern`, `placeholder`, `min`, `max`, `step`, `minlength`, `required`,
+  `novalidate`, `reversed`, `radiogroup`, `autocomplete`, `wrap`, `xmlns`,
+  `disabled` (outside the pinned task-list checkbox), `autopictureinpicture`,
+  `disablepictureinpicture`, `disableremoteplayback`, `controlslist`, `type` on
+  anything other than `ol`/`li`/`source`, and `is`. `is` is called out separately:
+  DOMPurify allows it, and it is the only one of this group that changes an
+  element's _behaviour_ (it binds markup to a registered custom-element class)
+  rather than its presentation. Media-specific attributes (`controls`, `autoplay`,
+  `loop`, `muted`, `preload`, `playsinline`, `poster`, `kind`, `srclang`,
+  `default`, `media`) survive on the media tags listed above, and only there.
+
+  `data:` image URIs are dropped: `<img src="data:image/png;base64,…">` becomes
+  `<img alt="…">`. This is a deliberate decision, not an oversight. DOMPurify
+  restricts `data:` to a tag list (`img`/`video`/`audio`/`source`/`track`);
+  `hast-util-sanitize`'s `protocols` are attribute-scoped, not tag-scoped, so
+  allowing `data:` on `src` would allow it on **every** `src`-bearing tag. If inline
+  base64 images turn out to be used, the fix is a per-tag gate, not a protocol
+  entry.
+
+  `srcset` is dropped everywhere — including on `<source>`, which is where
+  `defaultSchema` actually puts it (`source: ['srcSet']`, with `source`/`picture`
+  both in `tagNames`). `protocols` validates only a single leading scheme, and
+  `srcset` is a comma-separated candidate list, so this schema model cannot gate it
+  at all; left inherited it would have been the only completely ungated URL sink in
+  the policy. Calibrated honestly: that is **not** proven XSS — browsers do not
+  execute `javascript:` from an image source — it is an arbitrary tenant-authored
+  third-party request carrying a visitor's IP, UA and Referer. Responsive
+  `<picture>`/`<source>` art direction stops working; the `<img>` fallback still
+  renders.
+
+  ### Narrowed relative to `defaultSchema` (i.e. this release does not silently widen)
+
+  `defaultSchema` allows seventeen attributes DOMPurify's default profile drops.
+  All seventeen are removed rather than inherited, so this release adds nothing
+  that has not been rendering for the last month. The set was measured by rendering
+  every `(tag, attribute)` pair in `defaultSchema.attributes` through both
+  sanitisers, and it is pinned by test:
+  - `longdesc` on `<img>` — the one that is not cosmetic. It is a **URL-bearing**
+    attribute DOMPurify dropped, and inheriting it would have added a
+    tenant-authored outbound-request sink gated by nothing but `http`/`https`,
+    paragraphs below the argument for removing `srcset` on exactly that ground.
+  - `accesskey` — lets tenant content steal a browser/AT keyboard shortcut.
+  - `itemprop` (on `'*'`) and `itemscope` / `itemtype` (on `div`) — microdata in
+    the page's structured-data graph. Dropping only `itemprop` would leave the
+    microdata ROOT with its properties stripped.
+  - Inert legacy attributes: `abbr`, `accept-charset`, `axis`, `char`, `charoff`,
+    `charset`, `compact`, `hspace`, `for` (`htmlFor`), `nohref`, `prompt`, `rules`.
+
+  An earlier draft of this changeset claimed `for` was "one inherited widening
+  knowingly kept" and that it was the only one. Both halves were wrong; there were
+  thirteen more, and `for` is now removed with the rest.
+
+  ### Foreign content no longer crashes the render
+
+  `hast-util-from-parse5` branches on `tagName === 'template'` alone
+  (`lib/index.js:197`) and then recurses into `reference.content`. In foreign
+  content `parse5` creates that `template` in the MathML/SVG namespace, where there
+  is **no** `.content` DocumentFragment, so the recursion dereferences
+  `undefined.nodeName` and throws. `'<math><template>'`, `'<svg><template>'` and
+  their variants therefore threw a `TypeError` out of `sanitizeHtml` — before the
+  sanitiser ran, and with no `try`/`catch` anywhere on the call path
+  (`apps/demo-site/src/app/[slug]/page.tsx`, `services/[slug]/page.tsx`,
+  `packages/site-blocks/src/components/_page-parts.tsx`, `MarkdownRenderer`). An
+  uncaught throw in a Server Component render is a 500 on that route — REB-606's
+  own failure mode through a different door. The trigger is realistic: pasted
+  Word/LibreOffice/MathML output and inline SVG sprites are where `<math>`/`<svg>`
+  wrappers come from. `isomorphic-dompurify` returned `"<math></math>"` for the same
+  input, so this was a regression introduced by the migration, not a pre-existing
+  bug.
+
+  Two things fix it. Foreign content is removed from the `parse5` tree before it is
+  converted, so no foreign `<template>` ever reaches the conversion; and a
+  `<template>` with no `.content` is removed by name as well, so a future change to
+  the namespace rule cannot silently re-open the 500.
+
+  **What a parse failure does now, deliberately.** Everything up to `fromParse5`
+  runs before the sanitiser, so a throw there cannot be caught downstream.
+  `sanitizeHtml` therefore fails **closed**: it returns `''` and reports through
+  `console.error`. Propagating would turn one malformed block inside one tenant's
+  page into a 500 for the whole route, which is the incident this module exists to
+  end; returning the input (escaped or not) would emit unsanitised content, which
+  the function's contract forbids; returning `''` silently would hide tenant content
+  with no signal. A dropped block plus a server-log line is recoverable, a 500 is
+  not.
+
+  ### How the regression is guarded
+
+  An earlier draft pinned the emitted runtime specifier set to a hardcoded list.
+  That does not guard, and it fails silently. Move `hast-util-sanitize` to
+  `dependencies` (a reasonable-looking move — it IS a runtime import), delete it
+  from `tsup.config.ts`'s `noExternal` (which described itself as "currently
+  redundant"), and CI goes red on the exact-match pin; the only sanctioned repair
+  is to add the specifier to the expected list, after which the suite is green with
+  `require("hast-util-sanitize")` in the shipped CJS, against a package with no
+  CommonJS entry point. A "declared dependencies only" layer does not help either:
+  step one made it declared.
+
+  The gate is now three derived layers with nothing to edit:
+  1. Every emitted specifier must be a declared dependency/peer and not a Node
+     builtin — this is what catches the `unified`/`vfile` pipeline's bare
+     `path`/`process`/`url` imports.
+  2. Every specifier the CommonJS artifacts `require()` must resolve, under the
+     `require` condition, to a module Node loads as CommonJS. This is the layer the
+     laundering sequence above trips, and it has no list to append to.
+  3. The sanitiser pipeline — built to CommonJS through the real `tsup` config — is
+     loaded in a child process started with `--no-experimental-require-module`, and
+     has to load AND sanitise. That flag disables `require(esm)`, which is what makes
+     the original failure reproducible on any machine rather than only on Vercel:
+     `require("isomorphic-dompurify")` under it fails with the exact production
+     chain (`ERR_REQUIRE_ESM … @exodus/bytes/encoding-lite.js from …
+html-encoding-sniffer.js`) and loads fine without it. Unlike layer 2 this is
+     transitive, so it also catches a revert to `isomorphic-dompurify`, whose own
+     entry point is CommonJS.
+
+  `dist/index.cjs` as a whole cannot carry layer 3, and the exemption is stated
+  rather than assumed: `html-react-parser@6` → `html-dom-parser@8` → `domhandler@6`
+  is ESM-only, so the full entry needs `require(esm)` regardless of anything this
+  package does. That is a property of a first-class React dependency, it is fine on
+  every runtime this repo targets (`engines.node: 24.x`; `require(esm)` has been
+  unflagged since Node 20.19/22.12), and `demo-site` resolves the ESM entry anyway.
+  Bundling `html-react-parser` is not the fix — its `browser`/`node` conditional
+  exports would be collapsed to a single branch at build time, breaking the other.
+
+  ### Scope: which consumers these guarantees reach
+
+  All of the above describes the STRING `sanitizeHtml` returns. It reaches the page
+  unchanged only on the `dangerouslySetInnerHTML` consumers — `page.customHtml` /
+  `section.contentHtml` in `apps/demo-site/src/app/[slug]/page.tsx` and
+  `services/[slug]/page.tsx`, which is the surface this fix is about.
+  `MarkdownRenderer` re-parses that string into a token-styled component map, and
+  that map rebuilds most elements from scratch, so on the blog-body path author
+  `class`/`id`/`hidden`/`style`/`data-*`/`aria-*` are dropped **downstream of the
+  sanitiser** regardless of what the schema allows. That is pre-existing renderer
+  behaviour, unchanged here; widening its attribute forwarding is a separate change.
+
+  ### Unchanged, and worth stating plainly
+
+  The `style` **attribute** is kept, exactly as `isomorphic-dompurify` kept it, and
+  it is **not** validated. `<p style="background:url(https://third-party/x)">`
+  still issues an outbound request, and `style="…"` remains an unvalidated CSS
+  sink. This is DOMPurify parity, not a regression introduced here; closing it
+  needs a CSS-property allowlist and is a separate decision. The `<style>`
+  _element_ is a different, wider primitive — a tenant stylesheet applies to the
+  whole document and can read values out of markup this sanitiser never saw — and
+  stays removed.
+
+  ### Operational
+  - **Bundle size**: `dist/index.js` 19,094 B → 475,101 B (`dist/index.cjs`
+    479,434 B). The growth is `parse5`, `property-information` and `marked`: the
+    previous artifact was small only because `isomorphic-dompurify`/`jsdom` were
+    resolved at runtime instead of bundled — which is precisely the bug.
+    `treeshake` stays off (it strips the `'use client'` prologue), so this is
+    untreeshaken.
+  - `marked` moves from `dependencies` to `devDependencies` and is bundled
+    (~54 KB of the growth above). It was the last ESM-only specifier the sanitiser's
+    own module graph reached for — `marked@16` is `"type": "module"` with no
+    `require` condition — so while it stayed external the CommonJS artifact could
+    not be loaded without `require(esm)`, and the guard in layer 3 above would have
+    needed an exemption nobody could justify later. The module already builds its
+    own `new Marked()` instance rather than sharing the global singleton, so
+    nothing is lost by not sharing the copy with a consumer's `marked`.
+  - `apps/demo-site` now carries **two** copies of `hast-util-sanitize`: one
+    bundled here, one from its own `rehype-sanitize` dependency
+    (`src/components/blog/post-content.tsx`, `packages/ui/src/editor/markdown-viewer.tsx`).
+    Deduplicating means converging those call sites on this package's
+    `sanitizeHtml`; not done here.
+  - MIT-licensed third-party code (`parse5`, `marked`, the `hast-*`/`unist-*`
+    utilities) is now inlined into this Apache-2.0 published artifact with no
+    `NOTICE` file. Flagged, not solved in this change.
+
+### Patch Changes
+
+- Updated dependencies [495d32d]
+  - @reblu/site-contracts@0.3.0
+
+## 0.2.3
+
+### Patch Changes
+
+- Updated dependencies [d081f12]
+  - @reblu/site-contracts@0.2.0
+
+## 0.2.2
+
+### Patch Changes
+
+- Updated dependencies [33da822]
+  - @reblu/site-ui@0.3.1
+
+## 0.2.1
+
+### Patch Changes
+
+- Updated dependencies [b0cbc4c]
+  - @reblu/site-ui@0.3.0
+
+## 0.2.0
+
+### Minor Changes
+
+- 3b7c958: Scaffold `@reblu/site-blocks` — data-driven, token-driven presentational
+  organisms for Reblu SITEs (the layer above `@reblu/site-ui` atoms):
+  - `useCollection` — headless filterable / sortable / paginated collection hook
+    (facets, category, tag, search) shared by page and blog indexes.
+  - `Collection` — token-driven presentational grid over `useCollection`.
+  - `MarkdownRenderer` — canonical Blog renderer (`marked` → DOMPurify sanitize →
+    component map) with a YouTube-domain allowlist and no `dangerouslySetInnerHTML`.
+  - Helpers: `readingTime`, `formatPrice`, `buildShareUrls`.
+  - `ShareButtons` and the presentational organisms `Treatment`, `Specialty`,
+    `ProfileCard`, `ProductCard`.
+
+### Patch Changes
+
+- Updated dependencies [356e04d]
+  - @reblu/site-contracts@0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reblu/site-blocks",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Data-driven presentational organisms for Reblu SITEs (Collection, MarkdownRenderer, Treatment, Specialty, ProfileCard, ProductCard) — clean, token-driven, white-label.",
   "license": "Apache-2.0",
   "author": "Reblu — Adolfo Unturbe",
@@ -26,7 +26,8 @@
   "type": "module",
   "sideEffects": false,
   "files": [
-    "dist"
+    "dist",
+    "CHANGELOG.md"
   ],
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
@@ -59,8 +60,8 @@
   "dependencies": {
     "class-variance-authority": "^0.7.1",
     "html-react-parser": "5.2.17",
-    "@reblu/site-contracts": "1.0.0",
-    "@reblu/site-ui": "0.5.0"
+    "@reblu/site-contracts": "^1.0.1",
+    "@reblu/site-ui": "^0.5.1"
   },
   "peerDependencies": {
     "react": ">=19",