@revenexx/studio-integrations 2.2.0 → 2.3.0

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @revenexx/studio-integrations
 
+## 2.3.0
+
+### Minor Changes
+
+- 95d8a13: A run somebody terminated is no longer offered a resume from its row (PO-355). The studio shows a terminated run as failed, and the row's actions menu offered it **Resume**, which the platform refuses: it resumes only a run that failed on its own. The row now asks the platform's own status word, as the run's record already did, so the resume appears only where it can work. The run still reads as failed, and a retry is still offered. `WorkflowRun` gains an optional `apiStatus` carrying that word.
+
+### Patch Changes
+
+- 903b632: A credential form no longer dies on a list option meaning "no choice" (PO-424). A system that offered an option with an empty value in one of its lists stopped that list opening, in the New credential dialog (from the credentials list or from a node's credential setting) and in a credential's detail view, and nothing in the dialog could be closed afterwards. Those lists now carry their values the way a node's settings have since PO-422: the option is offered and can be chosen like any other, and the credential stores what the system declared.
+- 76ec989: A template's description can no longer run script in the studio (PO-524). The "About" section of a template's page rendered the registry's Markdown as whatever HTML it carried, so an image with an `onerror` handler or a `javascript:` link in a description ran inside the tenant's session. The description is now sanitised with DOMPurify after it is rendered: headings, lists, emphasis, code, links and images still show, while script, event handlers, script links, style sheets, inline styles and form controls are removed. A task-list checkbox in a description now shows as its text alone. The module gains `dompurify` as a runtime dependency.
+- 1231fcc: PO-552: the Linear nodes draw their own icons instead of an empty box.
+
+  Create Issue, Get Issue and Add Comment named icons the studio's table did not
+  know, so all three showed the generic box under Linear → Issues. They now draw a
+  ticket with a plus, a ticket and a speech bubble with text, and List Projects,
+  new in the same package, draws a folder.
+
+- 1070ae7: The blank form of the New workflow dialog opens with empty fields (PO-562): the example name and description are gone, so nothing reads as already filled in. The name is marked as required from the start, with the same red asterisk the node settings use.
+- 44ced2f: A node icon declared as a Lucide name (`lucide:<kebab-name>`) is drawn as named, without the studio's translation table, so a new node package shows its icons without a studio change (PO-566). The `mdi:*` names older packages declare are still translated; that table takes no new entries. A template's flow preview now draws node icons the same way as the canvas and the palette — it used to skip the table and draw most of them as a box.
+
 ## 2.2.0
 
 ### Minor Changes

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@revenexx/studio-integrations",
   "configKey": "studioIntegrations",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "unknown"

package/dist/runtime/components/Integrations/CredentialCreateDialog.vue

@@ -20,6 +20,7 @@ import {
 } from "@revenexx/studio";
 import { toast } from "vue-sonner";
 import { resolveLocalized } from "../../utils/localize";
+import { fromModelValue, toItemValue, toModelValue } from "../../utils/selectOptions";
 import { errorReason } from "../../utils/apiError";
 const props = defineProps({
   open: { type: Boolean, required: true },
@@ -89,7 +90,7 @@ function buildConfigPayload() {
   const out = {};
   for (const f of fieldsOf(pickedType.value)) {
     const v = form.config[f.key];
-    if (v !== void 0 && v !== "") out[f.key] = v;
+    if (v !== void 0) out[f.key] = v;
   }
   return out;
 }
@@ -217,14 +218,14 @@ async function submit() {
           </div>
           <Select
             v-else-if="f.type === 'select'"
-            :model-value="form.config[f.key] ?? ''"
-            @update:model-value="(v) => form.config[f.key] = v"
+            :model-value="toModelValue(form.config[f.key], f.options)"
+            @update:model-value="(v) => form.config[f.key] = fromModelValue(v)"
           >
             <SelectTrigger :id="`create-field-${f.key}`" class="bg-white">
               <SelectValue :placeholder="t('integration.credentials.shared.field.select.placeholder')" />
             </SelectTrigger>
             <SelectContent>
-              <SelectItem v-for="opt in f.options ?? []" :key="String(opt.value)" :value="String(opt.value)">
+              <SelectItem v-for="opt in f.options ?? []" :key="String(opt.value)" :value="toItemValue(opt.value)">
                 {{ resolveLocalized(opt.label) }}
               </SelectItem>
             </SelectContent>

package/dist/runtime/components/Integrations/CredentialDetailDialog.vue

@@ -36,6 +36,7 @@ import { relativeTime } from "../../utils/relativeTime";
 import { useNow } from "../../composables/useNow";
 import { hasRevenexxSource } from "../../utils/revenexxCredentialSource";
 import { resolveLocalized } from "../../utils/localize";
+import { fromModelValue, toItemValue, toModelValue } from "../../utils/selectOptions";
 const props = defineProps({
   open: { type: Boolean, required: true },
   credential: { type: [Object, null], required: true },
@@ -305,14 +306,14 @@ async function connect() {
                 </div>
                 <Select
                   v-else-if="f.type === 'select'"
-                  :model-value="form.config[f.key] ?? ''"
-                  @update:model-value="(v) => form.config[f.key] = v"
+                  :model-value="toModelValue(form.config[f.key], f.options)"
+                  @update:model-value="(v) => form.config[f.key] = fromModelValue(v)"
                 >
                   <SelectTrigger :id="`detail-field-${f.key}`" class="bg-white" v-bind="configFieldAria(f.key)">
                     <SelectValue :placeholder="t('integration.credentials.shared.field.select.placeholder')" />
                   </SelectTrigger>
                   <SelectContent>
-                    <SelectItem v-for="opt in f.options ?? []" :key="String(opt.value)" :value="String(opt.value)">
+                    <SelectItem v-for="opt in f.options ?? []" :key="String(opt.value)" :value="toItemValue(opt.value)">
                       {{ resolveLocalized(opt.label) }}
                     </SelectItem>
                   </SelectContent>

package/dist/runtime/components/Integrations/RunActionsMenu.vue

@@ -11,6 +11,7 @@ import {
 } from "@revenexx/studio";
 import { toast } from "vue-sonner";
 import { errorReason } from "../../utils/apiError";
+import { acceptsResume } from "../../utils/runFeedQuery";
 const props = defineProps({
   run: { type: Object, required: true }
 });
@@ -27,7 +28,7 @@ function viewReplay() {
 const hasExecution = computed(() => !!props.run.temporalRunId);
 const isActive = computed(() => (props.run.status === "running" || props.run.status === "queued") && hasExecution.value);
 const isTerminal = computed(() => ["succeeded", "failed", "cancelled"].includes(props.run.status));
-const canResume = computed(() => props.run.status === "failed" && hasExecution.value);
+const canResume = computed(() => acceptsResume(props.run.apiStatus, props.run.status) && hasExecution.value);
 const hasAny = computed(() => isActive.value || isTerminal.value);
 const busy = ref(false);
 function actionLabel(a) {

package/dist/runtime/components/Integrations/RunDetailPanel.vue

@@ -7,6 +7,7 @@ import { IntegrationsApiError, errorReason } from "../../utils/apiError";
 import { createPollBudget, SAFETY_POLL_MS } from "../../utils/pollBudget";
 import { formatDuration } from "../../utils/formatDuration";
 import { unwrapRun } from "../../utils/runEnvelope";
+import { acceptsResume } from "../../utils/runFeedQuery";
 import { splitRunOutputs } from "../../utils/runOutputs";
 const props = defineProps({
   run: { type: Object, required: true },
@@ -527,8 +528,7 @@ const apiStatusRaw = computed(() => pickStr(runData.value, ["status"]));
 const isActive = computed(() => !isTerminal.value);
 const canStop = computed(() => isActive.value && hasTemporal.value);
 const canResume = computed(() => {
-  const failed = apiStatusRaw.value ? apiStatusRaw.value === "failed" : props.run.status === "failed";
-  return failed && hasTemporal.value;
+  return acceptsResume(apiStatusRaw.value || props.run.apiStatus, props.run.status) && hasTemporal.value;
 });
 const hasActions = computed(() => canStop.value || canResume.value);
 const armed = ref(null);

package/dist/runtime/components/Integrations/TemplateFlowPreview.vue

@@ -1,6 +1,6 @@
 <script setup>
 import { computed, onMounted } from "vue";
-import * as Lucide from "lucide-vue-next";
+import { nodeIcon } from "../../data/nodeIcons";
 import { triggerGlyph } from "../../data/triggerGlyphs";
 import { findManifest, NODE_CATEGORIES, TRIGGER_TEMPLATES } from "../../data/integrationNodeCatalog";
 import { resolveLocalized } from "../../utils/localize";
@@ -64,7 +64,7 @@ const boxes = computed(() => {
       label: manifest ? resolveLocalized(manifest.name) : prettify(n.nodeSlug),
       subtitle: groups[groups.length - 1] ?? "",
       manifest,
-      icon: iconFor(manifest?.icon),
+      icon: nodeIcon(manifest?.icon),
       categoryColor: NODE_CATEGORIES.find((c) => c.key === manifest?.category)?.color ?? "bg-muted text-foreground"
     });
   });
@@ -74,11 +74,6 @@ function prettify(slug) {
   const tail = slug.includes(":") ? slug.split(":").pop() : slug;
   return tail.split("-").map((s) => s.charAt(0).toUpperCase() + s.slice(1)).join(" ");
 }
-function iconFor(name) {
-  if (!name) return Lucide.Box;
-  const cleaned = (name.includes(":") ? name.split(":").pop() : name).split("-").map((s) => s.charAt(0).toUpperCase() + s.slice(1)).join("");
-  return Lucide[cleaned] || Lucide.Box;
-}
 function stepPath(x1, y1, x2, y2) {
   if (y1 === y2) return `M ${x1} ${y1} L ${x2} ${y2}`;
   if (x2 - x1 >= 48) {

package/dist/runtime/components/Integrations/WorkflowCreateDialog.vue

@@ -161,8 +161,13 @@ async function installed(id) {
       <form v-if="mode === 'blank'" class="-m-1 max-h-[65vh] space-y-3 overflow-y-auto p-1" @submit.prevent="submit">
         <!-- Two-column rows: label rail left, field right. -->
         <div class="grid grid-cols-[130px_1fr] items-center gap-x-4">
-          <Label for="wf-name">{{ t("integration.workflows.create.field.name.label") }}</Label>
-          <Input id="wf-name" v-model="name" :placeholder="t('integration.workflows.create.field.name.placeholder')" class="bg-white" />
+          <!-- The asterisk sits beside the label, not in it: it is for the eye,
+               aria-required says it to everyone else, and the field's name stays "Name". -->
+          <div class="flex items-center">
+            <Label for="wf-name">{{ t("integration.workflows.create.field.name.label") }}</Label>
+            <span class="text-sm text-rose-500" aria-hidden="true" :title="t('integration.nodeConfig.field.requiredMark')">&nbsp;*</span>
+          </div>
+          <Input id="wf-name" v-model="name" aria-required="true" class="bg-white" />
         </div>
 
         <div class="grid grid-cols-[130px_1fr] items-start gap-x-4">
@@ -171,7 +176,6 @@ async function installed(id) {
             id="wf-desc"
             v-model="description"
             rows="2"
-            :placeholder="t('integration.workflows.create.field.description.placeholder')"
             class="bg-white"
           />
         </div>

package/dist/runtime/composables/useIntegrationsRuns.js

@@ -49,6 +49,9 @@ export function useIntegrationsRuns() {
       workflowId: r.workflow_id,
       workflowName: r.workflow_name ?? workflowName,
       status: mapRunStatus(r.status),
+      // Kept beside the mapped word, because the mapping folds `terminated` into
+      // `failed` and the platform resumes only the literal `failed` (PO-355).
+      apiStatus: r.status,
       temporalRunId: r.temporal_run_id ?? null,
       triggerId: r.trigger_handle ?? "",
       // The platform reports what started the run. This was hardcoded to

package/dist/runtime/data/nodeIcons.d.ts

@@ -1,11 +1,14 @@
 /**
  * Node manifest icon → Lucide component.
  *
- * Authors declare icons as `mdi:*` names (the node SDK's convention), but the
- * studio renders Lucide. The naive PascalCase lookup almost never hits a
- * Lucide export, so every node degraded to the generic Box. This curated map
- * covers the registry's actual vocabulary; unmapped names still try the
- * PascalCase lookup before falling back to Box.
+ * Node icons are the studio's one deliberate Lucide exception (`docs/icons.md`):
+ * a package declares `lucide:<kebab-name>`, and that name is drawn as declared —
+ * no table, no studio change for a new package (PO-566).
+ *
+ * `MDI_TO_LUCIDE` is for packages still published with `mdi:*` names, the
+ * convention before PO-566. It is frozen: a missing name is fixed by the package
+ * declaring its Lucide name, not by a new entry here. Unmapped names still try
+ * the PascalCase lookup before falling back to Box.
  *
  * Exported for its test, which checks every entry against Lucide's exports: a
  * test that found the entries by reading this file's text stopped seeing every

package/dist/runtime/data/nodeIcons.js

@@ -24,6 +24,7 @@ export const MDI_TO_LUCIDE = {
   "code-brackets": "Brackets",
   "code-json": "Braces",
   "code-tags": "Code",
+  "comment-text-outline": "MessageSquareText",
   "compare-horizontal": "ArrowLeftRight",
   "content-duplicate": "Copy",
   "currency-eur": "Euro",
@@ -51,6 +52,7 @@ export const MDI_TO_LUCIDE = {
   filter: "Filter",
   "find-replace": "Replace",
   "folder-download-outline": "FolderDown",
+  "folder-outline": "Folder",
   "folder-plus-outline": "FolderPlus",
   "folder-search-outline": "FolderSearch",
   "folder-upload-outline": "FolderUp",
@@ -93,6 +95,8 @@ export const MDI_TO_LUCIDE = {
   "tag-multiple-outline": "Tags",
   "tag-plus-outline": "Tag",
   telegram: "Send",
+  "ticket-confirmation-outline": "TicketPlus",
+  "ticket-outline": "Ticket",
   "timeline-text-outline": "Activity",
   transfer: "ArrowRightLeft",
   translate: "Languages",
@@ -107,7 +111,7 @@ export const MDI_TO_LUCIDE = {
 export function nodeIcon(name) {
   if (!name) return Lucide.Box;
   const bare = name.includes(":") ? name.split(":").pop() : name;
-  const mapped = MDI_TO_LUCIDE[bare];
+  const mapped = name.startsWith("lucide:") ? void 0 : MDI_TO_LUCIDE[bare];
   if (mapped && Lucide[mapped]) {
     return Lucide[mapped];
   }

package/dist/runtime/i18n/messages/de.json

@@ -1201,11 +1201,9 @@
   "integration.workflows.create.executionMode.syncOnly.hint": "Wartet auf das Ergebnis.",
   "integration.workflows.create.executionMode.syncOnly.label": "Nur synchron",
   "integration.workflows.create.field.description.label": "Beschreibung",
-  "integration.workflows.create.field.description.placeholder": "Optional: Was dieser Workflow macht und warum es ihn gibt.",
   "integration.workflows.create.field.executionMode.label": "Ausführungsmodus",
   "integration.workflows.create.field.icon.label": "Symbol",
   "integration.workflows.create.field.name.label": "Name",
-  "integration.workflows.create.field.name.placeholder": "Nächtliche Bestellsynchronisierung",
   "integration.workflows.create.field.tags.label": "Tags",
   "integration.workflows.create.field.trigger.label": "Trigger",
   "integration.workflows.create.tab.blank": "Leer starten",

package/dist/runtime/i18n/messages/en.json

@@ -1201,11 +1201,9 @@
   "integration.workflows.create.executionMode.syncOnly.hint": "Waits for the result.",
   "integration.workflows.create.executionMode.syncOnly.label": "Sync only",
   "integration.workflows.create.field.description.label": "Description",
-  "integration.workflows.create.field.description.placeholder": "Optional: what this workflow does and why it exists.",
   "integration.workflows.create.field.executionMode.label": "Execution mode",
   "integration.workflows.create.field.icon.label": "Icon",
   "integration.workflows.create.field.name.label": "Name",
-  "integration.workflows.create.field.name.placeholder": "Sync orders nightly",
   "integration.workflows.create.field.tags.label": "Tags",
   "integration.workflows.create.field.trigger.label": "Trigger",
   "integration.workflows.create.tab.blank": "Start blank",

package/dist/runtime/pages/integrations/credentials.vue

@@ -35,6 +35,7 @@ import { apiRefusal, errorReason } from "../../utils/apiError";
 import { CREDENTIAL_STATES, credentialState, credentialStateLabel, providerStepWord } from "../../utils/credentialState";
 import { hasRevenexxSource } from "../../utils/revenexxCredentialSource";
 import { resolveLocalized } from "../../utils/localize";
+import { fromModelValue, toItemValue, toModelValue } from "../../utils/selectOptions";
 const t = useIntegrationsT();
 useHead({ title: () => t("integration.credentials.list.head.title") });
 const { credentials, loading, error, load, create, update, remove, testInline, test, oauthAuthorizeUrl } = useIntegrationsCredentials();
@@ -422,14 +423,14 @@ async function confirmDelete() {
             <!-- select -->
             <Select
               v-else-if="f.type === 'select'"
-              :model-value="form.config[f.key] ?? ''"
-              @update:model-value="(v) => form.config[f.key] = v"
+              :model-value="toModelValue(form.config[f.key], f.options)"
+              @update:model-value="(v) => form.config[f.key] = fromModelValue(v)"
             >
               <SelectTrigger :id="`cred-field-${f.key}`" class="bg-white" v-bind="configFieldAria(f.key)">
                 <SelectValue :placeholder="t('integration.credentials.shared.field.select.placeholder')" />
               </SelectTrigger>
               <SelectContent>
-                <SelectItem v-for="opt in f.options ?? []" :key="String(opt.value)" :value="String(opt.value)">
+                <SelectItem v-for="opt in f.options ?? []" :key="String(opt.value)" :value="toItemValue(opt.value)">
                   {{ resolveLocalized(opt.label) }}
                 </SelectItem>
               </SelectContent>

package/dist/runtime/pages/integrations/templates/[slug].vue

@@ -1,6 +1,5 @@
 <script setup>
 import { computed, ref } from "vue";
-import { marked } from "marked";
 import { AltArrowRight as Chevron, CheckCircle as CheckCircle2, Key, RefreshCircle as Loader2, Shield as ShieldAlert, User } from "#solar-icons";
 import { triggerGlyph as glyphForTrigger } from "../../../data/triggerGlyphs";
 import {
@@ -18,6 +17,7 @@ import LoadingAnnouncement from "../../../components/Integrations/LoadingAnnounc
 import NodeMark from "../../../components/Integrations/NodeMark.vue";
 import { templateCategoryLabel, templatePackageLabel } from "../../../data/integrationTemplates";
 import { describeCron } from "../../../utils/schedule";
+import { renderTemplateDescription } from "../../../utils/templateDescription";
 const t = useIntegrationsT();
 const route = useRoute();
 const router = useRouter();
@@ -34,12 +34,7 @@ onMounted(async () => {
   await Promise.all([fetchDetail(slug.value), loadNodeCatalog(), loadCredentials(), loadSecrets()]);
   reqs.value = await requirements(slug.value);
 });
-const descriptionHtml = computed(() => {
-  const md = tpl.value?.descriptionMd ?? "";
-  if (!md.trim()) return "";
-  const withoutH1 = md.replace(/^#\s[^\n]*\n+/, "");
-  return marked.parse(withoutH1);
-});
+const descriptionHtml = computed(() => renderTemplateDescription(tpl.value?.descriptionMd));
 const steps = computed(() => {
   const blob = tpl.value?.blob;
   if (!blob?.nodes.length) return [];
@@ -221,10 +216,12 @@ function levelDot(level) {
               class="rounded-lg border border-black/[0.06] bg-white p-4"
             >
               <h3 id="tpl-about-heading" class="text-sm font-semibold mb-2">{{ t("integration.templates.detail.about.title") }}</h3>
+              <!-- eslint-disable vue/no-v-html -- renderTemplateDescription sanitises marked's output with DOMPurify (PO-524) -->
               <div
                 class="text-sm leading-relaxed text-foreground/90 space-y-2 [&_h1]:text-sm [&_h1]:font-semibold [&_h2]:text-sm [&_h2]:font-semibold [&_h3]:text-sm [&_h3]:font-semibold [&_ol]:list-decimal [&_ol]:pl-5 [&_ul]:list-disc [&_ul]:pl-5 [&_li]:mt-1 [&_code]:rounded [&_code]:bg-slate-100 [&_code]:px-1 [&_code]:py-px [&_code]:font-mono [&_code]:text-[13px] [&_a]:text-primary [&_a]:underline [&_strong]:font-semibold"
                 v-html="descriptionHtml"
               />
+              <!-- eslint-enable vue/no-v-html -->
             </div>
 
             <!-- Step by step, humanized from the actual nodes -->

package/dist/runtime/types/integrations.d.ts

@@ -695,6 +695,12 @@ export interface WorkflowRun {
     workflowId: number;
     workflowName: string;
     status: RunStatus;
+    /**
+     * The platform's own status word, as it sent it (`failed`, `terminated`, …).
+     * For deciding what the platform will accept (`acceptsResume`), never for
+     * drawing the outcome — that is `status`, which folds several of these into one.
+     */
+    apiStatus?: string;
     /** Temporal run id for this execution; null when the row predates Temporal. */
     temporalRunId?: string | null;
     triggerId: string;

package/dist/runtime/utils/runFeedQuery.d.ts

@@ -47,6 +47,20 @@ export declare const API_RUN_STATUSES: readonly ["pending", "running", "complete
  * are deliberate, and only the table is shared.
  */
 export declare function mapRunStatus(status: string): RunStatus;
+/**
+ * Would the platform accept a resume of this run? Its own status word decides,
+ * not the studio's.
+ *
+ * `mapRunStatus` folds `terminated` into the studio's `failed`, which is right for
+ * the outcome a row draws and wrong for this question: the platform resumes only a
+ * run whose stored status is literally `failed`, and answers a terminated one with
+ * a 409 (PO-355). So the platform's word is read where it is known, and the
+ * studio's only as the fallback for a run that arrived without one.
+ *
+ * Whether there is an execution to resume from is a separate condition, which each
+ * caller already asks in its own terms (specs/run-row.md AC-12).
+ */
+export declare function acceptsResume(apiStatus: string | null | undefined, status: RunStatus): boolean;
 /**
  * The platform statuses behind the studio's words.
  *

package/dist/runtime/utils/runFeedQuery.js

@@ -11,6 +11,9 @@ export function mapRunStatus(status) {
   const word = normalisedRunStatus(status);
   return isRunStatusWord(word) ? word : "failed";
 }
+export function acceptsResume(apiStatus, status) {
+  return apiStatus ? apiStatus === "failed" : status === "failed";
+}
 export function apiStatusesFor(words) {
   if (!words.length) return [];
   return API_RUN_STATUSES.filter((status) => words.includes(mapRunStatus(status)));

package/dist/runtime/utils/templateDescription.d.ts

@@ -0,0 +1 @@
+export declare function renderTemplateDescription(md: string | null | undefined): string;

package/dist/runtime/utils/templateDescription.js

@@ -0,0 +1,38 @@
+import DOMPurify from "dompurify";
+import { marked } from "marked";
+const ALLOWED_TAGS = [
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "p",
+  "br",
+  "hr",
+  "strong",
+  "em",
+  "del",
+  "code",
+  "pre",
+  "blockquote",
+  "ul",
+  "ol",
+  "li",
+  "table",
+  "thead",
+  "tbody",
+  "tr",
+  "th",
+  "td",
+  "a",
+  "img"
+];
+const ALLOWED_ATTR = ["href", "title", "src", "alt", "align", "start"];
+export function renderTemplateDescription(md) {
+  if (!md?.trim()) return "";
+  if (!DOMPurify.isSupported) return "";
+  const withoutH1 = md.replace(/^#\s[^\n]*\n+/, "");
+  const html = marked.parse(withoutH1, { async: false });
+  return DOMPurify.sanitize(html, { ALLOWED_TAGS, ALLOWED_ATTR });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revenexx/studio-integrations",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "type": "module",
   "description": "Integration Studio (core: workflows, node editor, runs, schedules, credentials, secrets, audit) as a standalone, publishable Nuxt module.",
   "repository": {
@@ -29,6 +29,7 @@
     "@revenexx/studio-shared": "^0.3.2",
     "@solar-icons/nuxt": "^1.2.0",
     "@solar-icons/vue": "^1.2.0",
+    "dompurify": "^3.4.16",
     "marked": "^18.0.5"
   },
   "peerDependencies": {