purifai 2.0.2 → 2.0.3

package/dist/index.js

@@ -1,173 +1,239 @@
 // index.ts
-var DANGEROUS_TAGS_WITH_CONTENT = /<(script|style|iframe|frame|object|embed|applet|meta|link|form|svg|math|base)(?:\s[^>]*)?>[\s\S]*?<\/\1>|<(script|style|iframe|frame|object|embed|applet|meta|link|form|svg|math|base)(?:\s[^>]*)?\/?>|<\/(script|style|iframe|frame|object|embed|applet|meta|link|form|svg|math|base)>/gi;
-var EVENT_HANDLERS_ENHANCED = /\s*o\s*n\s*[a-z]+\s*=\s*["']?[^"'>]+["']?/gi;
-var DANGEROUS_PROTOCOLS_ENHANCED = /(?:href|src|action|formaction|data|background|poster|code|cite|longdesc|usemap|itemtype|ping|manifest|archive|classid|codebase|datasrc|dynsrc|lowsrc|srcset)\s*=\s*["']?\s*(?:j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\s*:|javascript\s*:|vbscript\s*:|data:text\/html|data:image\/svg\+xml(?:[^"'>]*script)?|filesystem:|chrome-extension:|blob:|about:|res:|ie:|ms-its:|mk:|mhtml:|file:|jar:|hcp:|ms-help:|disk:|vnd\.ms-|shell:|lynxcgi:|lynxexec:|news:|nntp:|telnet:|gopher:|wais:|prospero:|webcal:|ldap:|ldaps:|ftp:|ftps:|sftp:|ssh:|ircs?:|mailto:|xmpp:|sms:|smsto:|mms:|mmsto:|tel:|fax:|modem:|payto:|bitcoin:|ethereum:|magnet:)[^"'\s>]*/gi;
-var DANGEROUS_ATTRIBUTES = /(?:expression|@import|javascript:|vbscript:|livescript:|mocha:|behavior:|constructor)\s*\(/gi;
-var TEMPLATE_INJECTION = /\{\{[\s\S]*?\}\}|<%[\s\S]*?%>|<\?[\s\S]*?\?>|\${[\s\S]*?}|#\{[\s\S]*?}/g;
-var DANGEROUS_FUNCTIONS = /\b(?:alert|eval|expression|Function|constructor|prototype|__proto__|document\.write|document\.writeln|window\.location|document\.location|setTimeout|setInterval|setImmediate|execScript|msSetImmediate|range\.createContextualFragment|range\.insertNode|insertAdjacentHTML|outerHTML)\s*\(/gi;
 var NULL_CONTROL_CHARS = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F]/g;
-var POLYGLOT_JAVASCRIPT = /j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t\s*:/gi;
-var POLYGLOT_EVENTS = /o\s*n\s*[a-z]+\s*(?:=|alert)/gi;
-var ENCODED_TAGS = /\\x3c|\\x3e|%3c|%3e/gi;
-var SUSPICIOUS_PATTERNS = /<|>|javascript:|vbscript:|\bon[a-z]+\s*=|@import|\{\{|<%|<\?|\${|#\{/i;
-var DANGEROUS_PROTOCOL_TOKEN = /(?:j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t|v\s*b\s*s\s*c\s*r\s*i\s*p\s*t|l\s*i\s*v\s*e\s*s\s*c\s*r\s*i\s*p\s*t|m\s*o\s*c\s*h\s*a)\s*:|data\s*:\s*text\/html/i;
-var HAS_TEXT_CONTENT = /[a-z0-9]/i;
-var HTML_TAG = /<\/?[a-zA-Z][^>]*>/g;
+var HAS_CONTROL_CHARS = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F-\x9F]/;
+var ENCODED_SYNTAX = /%3[ce]|\\u[0-9a-f]{4}|\\x[0-9a-f]{2}|&#(?:\d+|x[0-9a-f]+);/i;
+var DANGEROUS_CONTAINER_PATTERN = /<\s*\/?\s*(?:script|style|iframe|object|applet|svg|math|form|template|noscript|noframes|xmp|plaintext|head|title|textarea|frameset)\b/i;
+var EVENT_HANDLER_PATTERN = /\bo\s*n\s*(?:abort|afterprint|animationend|animationiteration|animationstart|beforeinput|beforeprint|beforeunload|begin|blur|canplay|change|click|close|contextmenu|copy|cut|dblclick|drag|drop|durationchange|ended|error|focus|focusin|focusout|hashchange|input|invalid|keydown|keypress|keyup|load|loadeddata|loadedmetadata|loadstart|message|mousedown|mouseenter|mouseleave|mousemove|mouseout|mouseover|mouseup|offline|online|open|pagehide|pageshow|paste|pause|play|playing|popstate|progress|ratechange|reset|resize|scroll|search|seeked|seeking|select|show|stalled|start|storage|submit|suspend|timeupdate|toggle|touchcancel|touchend|touchmove|touchstart|transitionend|unload|volumechange|waiting|wheel)\s*=/i;
+var DANGEROUS_PROTOCOL_PATTERN = /(?:j\s*a\s*v\s*a\s*s\s*c\s*r\s*i\s*p\s*t|v\s*b\s*s\s*c\s*r\s*i\s*p\s*t|l\s*i\s*v\s*e\s*s\s*c\s*r\s*i\s*p\s*t|m\s*o\s*c\s*h\s*a)\s*:|data\s*:\s*(?:text\/html|image\/svg\+xml)/i;
+var DANGEROUS_CODE_PATTERN = /(?:\b(?:eval|expression|Function|constructor|document\.write|insertAdjacentHTML)\s*\(|@import\b|\{\{|<%|<\?|\${|#\{)/i;
+var DROP_BODY_TAGS = /* @__PURE__ */ new Set([
+  "applet",
+  "form",
+  "frameset",
+  "head",
+  "iframe",
+  "math",
+  "noframes",
+  "noscript",
+  "object",
+  "plaintext",
+  "script",
+  "style",
+  "svg",
+  "template",
+  "textarea",
+  "title",
+  "xmp"
+]);
+var SAFE_URL_PROTOCOLS = /* @__PURE__ */ new Set(["http", "https", "mailto"]);
 function escapeAngleBrackets(str) {
   return str.replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
-function stateless(pattern) {
-  return new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, ""));
-}
-var DETECT_DANGEROUS_TAGS = stateless(DANGEROUS_TAGS_WITH_CONTENT);
-var DETECT_EVENT_HANDLERS = stateless(EVENT_HANDLERS_ENHANCED);
-var DETECT_DANGEROUS_PROTOCOLS = stateless(DANGEROUS_PROTOCOLS_ENHANCED);
-var DETECT_DANGEROUS_ATTRIBUTES = stateless(DANGEROUS_ATTRIBUTES);
-var DETECT_TEMPLATE_INJECTION = stateless(TEMPLATE_INJECTION);
-var DETECT_POLYGLOT_JAVASCRIPT = stateless(POLYGLOT_JAVASCRIPT);
-var DETECT_POLYGLOT_EVENTS = stateless(POLYGLOT_EVENTS);
 var DEFAULT_OPTIONS = {
   maxLength: 1e6,
   // 1MB
   allowedProtocols: ["http", "https", "mailto"],
   aggressiveMode: true
 };
-var VERSION = "2.0.2";
-var MAX_FILTER_PASSES = 5;
+var VERSION = "2.0.3";
+function isDisallowedScalar(codePoint) {
+  return !Number.isInteger(codePoint) || codePoint <= 0 || codePoint > 1114111 || codePoint >= 55296 && codePoint <= 57343 || codePoint < 32 && codePoint !== 9 && codePoint !== 10 && codePoint !== 13 || codePoint >= 127 && codePoint <= 159;
+}
+function scalarFromDigits(digits, radix) {
+  const codePoint = Number.parseInt(digits, radix);
+  return isDisallowedScalar(codePoint) ? "\uFFFD" : String.fromCodePoint(codePoint);
+}
 function decodeEncodingBypasses(str) {
-  let result = str;
-  try {
-    result = decodeURIComponent(result);
-  } catch {
+  return str.replace(/%3c/gi, "<").replace(/%3e/gi, ">").replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => scalarFromDigits(hex, 16)).replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => scalarFromDigits(hex, 16)).replace(/&#(\d+);/g, (_, digits) => scalarFromDigits(digits, 10)).replace(/&#x([0-9a-fA-F]+);/gi, (_, digits) => scalarFromDigits(digits, 16));
+}
+function isAsciiLetter(char) {
+  if (!char) return false;
+  const code = char.charCodeAt(0);
+  return code >= 65 && code <= 90 || code >= 97 && code <= 122;
+}
+function isAsciiWhitespace(char) {
+  return char === " " || char === "	" || char === "\n" || char === "\r" || char === "\f";
+}
+function isTagNameChar(char) {
+  if (!char) return false;
+  const code = char.charCodeAt(0);
+  return isAsciiLetter(char) || code >= 48 && code <= 57 || char === ":" || char === "-";
+}
+var INCOMPLETE_TAG = /* @__PURE__ */ Symbol("incomplete-tag");
+function parseTag(input, start) {
+  if (input[start] !== "<") return null;
+  let cursor = start + 1;
+  let closing = false;
+  if (input[cursor] === "/") {
+    closing = true;
+    cursor++;
+    while (isAsciiWhitespace(input[cursor])) cursor++;
   }
-  try {
-    result = result.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) => {
-      return String.fromCharCode(parseInt(hex, 16));
-    });
-    result = result.replace(/\\x([0-9a-fA-F]{2})/g, (_, hex) => {
-      return String.fromCharCode(parseInt(hex, 16));
-    });
-    result = result.replace(/&#(\d+);/g, (_, num) => {
-      return String.fromCharCode(parseInt(num, 10));
-    });
-    result = result.replace(/&#x([0-9a-fA-F]+);/g, (_, hex) => {
-      return String.fromCharCode(parseInt(hex, 16));
-    });
-  } catch {
+  if (!isAsciiLetter(input[cursor])) return null;
+  const nameStart = cursor;
+  while (isTagNameChar(input[cursor])) cursor++;
+  const name = input.slice(nameStart, cursor).toLowerCase();
+  const boundary = input[cursor];
+  if (boundary === void 0) return INCOMPLETE_TAG;
+  if (boundary !== ">" && boundary !== "/" && !isAsciiWhitespace(boundary)) return null;
+  if (isAsciiWhitespace(boundary)) {
+    let next = cursor;
+    while (isAsciiWhitespace(input[next])) next++;
+    if (input[next] === "&") return null;
+  }
+  let quote = "";
+  let selfClosing = false;
+  for (; cursor < input.length; cursor++) {
+    const char = input[cursor];
+    if (quote) {
+      if (char === quote) quote = "";
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (char === ">") {
+      let before = cursor - 1;
+      while (before > start && isAsciiWhitespace(input[before])) before--;
+      selfClosing = input[before] === "/";
+      return { closing, end: cursor + 1, name, selfClosing };
+    }
+  }
+  return INCOMPLETE_TAG;
+}
+function skipCommentOrDeclaration(input, start) {
+  if (input.startsWith("<!--", start)) {
+    const end = input.indexOf("-->", start + 4);
+    return end === -1 ? input.length : end + 3;
+  }
+  if (input.startsWith("<!", start) || input.startsWith("<?", start)) {
+    const end = input.indexOf(">", start + 2);
+    return end === -1 ? input.length : end + 1;
   }
-  return result;
+  return null;
 }
-function removeDangerousTagsWithContent(str) {
-  return str.replace(DANGEROUS_TAGS_WITH_CONTENT, "");
+function skipContainerBody(input, cursor, containerName) {
+  let depth = 1;
+  while (cursor < input.length) {
+    const nextOpen = input.indexOf("<", cursor);
+    if (nextOpen === -1) return input.length;
+    const specialEnd = skipCommentOrDeclaration(input, nextOpen);
+    if (specialEnd !== null) {
+      cursor = specialEnd;
+      continue;
+    }
+    const tag = parseTag(input, nextOpen);
+    if (tag === INCOMPLETE_TAG) return input.length;
+    if (!tag) {
+      cursor = nextOpen + 1;
+      continue;
+    }
+    cursor = tag.end;
+    if (tag.name !== containerName) continue;
+    if (tag.closing) {
+      depth--;
+      if (depth === 0) return cursor;
+    } else if (!tag.selfClosing) {
+      depth++;
+    }
+  }
+  return input.length;
+}
+function stripToText(input) {
+  const output = [];
+  let textStart = 0;
+  let cursor = 0;
+  while (cursor < input.length) {
+    const nextOpen = input.indexOf("<", cursor);
+    if (nextOpen === -1) break;
+    const specialEnd = skipCommentOrDeclaration(input, nextOpen);
+    if (specialEnd !== null) {
+      output.push(input.slice(textStart, nextOpen));
+      cursor = specialEnd;
+      textStart = cursor;
+      continue;
+    }
+    const tag = parseTag(input, nextOpen);
+    if (tag === INCOMPLETE_TAG) {
+      output.push(input.slice(textStart));
+      textStart = input.length;
+      cursor = input.length;
+      break;
+    }
+    if (!tag) {
+      cursor = nextOpen + 1;
+      continue;
+    }
+    output.push(input.slice(textStart, nextOpen));
+    cursor = tag.end;
+    if (!tag.closing && !tag.selfClosing && DROP_BODY_TAGS.has(tag.name)) {
+      cursor = skipContainerBody(input, cursor, tag.name);
+    }
+    textStart = cursor;
+  }
+  if (textStart < input.length) output.push(input.slice(textStart));
+  const text = output.join("").replace(/\s+/g, " ").trim();
+  return text.includes("<") || text.includes(">") ? escapeAngleBrackets(text) : text;
 }
-function handlePolyglotAttacks(str) {
-  let result = str;
+function coerceInput(input) {
+  if (input === null || input === void 0) return "";
   try {
-    result = result.replace(POLYGLOT_JAVASCRIPT, "");
-    result = result.replace(POLYGLOT_EVENTS, "");
-    result = result.replace(ENCODED_TAGS, "");
-    result = result.replace(/javascript\s*:\s*\/\*[\s\S]*?\*\//gi, "");
-    result = result.replace(/javascript\s*:\s*\/\*[^*]*\*\/[^>]*/gi, "");
-    result = result.replace(/<form[^>]*>[\s\S]*?<\/form>/gi, "");
-    result = result.replace(/<math[^>]*>[\s\S]*?<\/math>/gi, "");
-    result = result.replace(/%0[AD]/gi, "");
-    if (/svg|sVg|\x3c|\\\w{3}/i.test(result)) {
-      result = result.replace(/svg[^>]*>/gi, "");
-      result = result.replace(/sVg[^>]*>/gi, "");
-      result = result.replace(/\\x\w{2}/gi, "");
-      result = result.replace(/<\/[^>]*>/gi, "");
-      result = result.replace(/<[^>]*>/gi, "");
+    if (typeof input === "string") return input;
+    if (typeof input === "object") {
+      const serialized = JSON.stringify(input);
+      return typeof serialized === "string" ? serialized : "";
     }
+    return String(input);
   } catch {
-    result = result.replace(/<[^>]*>/g, "").replace(/[<>]/g, "");
+    return "";
   }
-  return result;
+}
+function resolveMaxLength(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : DEFAULT_OPTIONS.maxLength;
 }
 function assessThreatLevel(input) {
   if (!input) return "none";
-  if (/<script/i.test(input) || /javascript\s*:/i.test(input) || /\bon[a-z]+\s*=/i.test(input)) {
+  if (/<\s*\/?\s*script\b/i.test(input) || DANGEROUS_PROTOCOL_PATTERN.test(input) || EVENT_HANDLER_PATTERN.test(input)) {
     return "critical";
   }
-  if (/<(iframe|object|embed|form|svg|math)/i.test(input) || /eval\s*\(/i.test(input)) {
+  if (DANGEROUS_CONTAINER_PATTERN.test(input) || /\beval\s*\(/i.test(input)) {
     return "high";
   }
-  if (/<(style|link|meta)/i.test(input) || /expression\s*\(/i.test(input)) {
+  if (DANGEROUS_CODE_PATTERN.test(input) || /<\s*(?:link|meta|base)\b/i.test(input)) {
     return "medium";
   }
-  if (/<[^>]*>/i.test(input)) {
-    return "low";
-  }
   return "none";
 }
 function isDangerous(input) {
   if (!input) return false;
-  try {
-    return DETECT_DANGEROUS_TAGS.test(input) || DETECT_EVENT_HANDLERS.test(input) || DETECT_DANGEROUS_PROTOCOLS.test(input) || DETECT_DANGEROUS_ATTRIBUTES.test(input) || DETECT_TEMPLATE_INJECTION.test(input) || DETECT_POLYGLOT_JAVASCRIPT.test(input) || DETECT_POLYGLOT_EVENTS.test(input) || DANGEROUS_PROTOCOL_TOKEN.test(input);
-  } catch {
-    return true;
-  }
+  return DANGEROUS_CONTAINER_PATTERN.test(input) || EVENT_HANDLER_PATTERN.test(input) || DANGEROUS_PROTOCOL_PATTERN.test(input) || DANGEROUS_CODE_PATTERN.test(input);
 }
 function sanitize(input, options) {
   const config = { ...DEFAULT_OPTIONS, ...options };
-  if (input === null || input === void 0) return "";
-  let str;
-  try {
-    if (typeof input === "string") {
-      str = input;
-    } else if (typeof input === "object") {
-      str = JSON.stringify(input);
-    } else {
-      str = String(input);
-    }
-  } catch {
-    return "";
-  }
-  if (str.length > config.maxLength) {
-    str = str.substring(0, config.maxLength);
+  let str = coerceInput(input);
+  const maxLength = resolveMaxLength(config.maxLength);
+  if (str.length > maxLength) str = str.slice(0, maxLength);
+  if (!str) return "";
+  if (!str.includes("<") && !str.includes(">") && !HAS_CONTROL_CHARS.test(str) && !ENCODED_SYNTAX.test(str)) {
+    return str.replace(/\s+/g, " ").trim();
   }
-  if (!str.trim()) return "";
-  let result = str.replace(NULL_CONTROL_CHARS, "");
   try {
-    result = decodeEncodingBypasses(result);
-    const dangerous = isDangerous(str) || isDangerous(result);
-    if (!dangerous) {
-      const benign = removeDangerousTagsWithContent(result).replace(HTML_TAG, "").replace(DANGEROUS_ATTRIBUTES, "").replace(TEMPLATE_INJECTION, "").replace(DANGEROUS_FUNCTIONS, "");
-      return escapeAngleBrackets(benign).replace(/\s+/g, " ").trim();
-    }
-    result = removeDangerousTagsWithContent(result);
-    result = handlePolyglotAttacks(result);
-    let previous;
-    let passes = 0;
-    do {
-      previous = result;
-      result = result.replace(DANGEROUS_TAGS_WITH_CONTENT, "").replace(EVENT_HANDLERS_ENHANCED, "").replace(DANGEROUS_PROTOCOLS_ENHANCED, (match) => {
-        const safeProtocols = config.allowedProtocols.join("|");
-        return match.match(new RegExp(`^(?:href|src)\\s*=\\s*["']?\\s*(?:${safeProtocols}):\\/\\/`, "i")) ? match : "";
-      }).replace(DANGEROUS_ATTRIBUTES, "").replace(TEMPLATE_INJECTION, "").replace(DANGEROUS_FUNCTIONS, "");
-      passes++;
-    } while (result !== previous && passes < MAX_FILTER_PASSES);
-    if (config.aggressiveMode && SUSPICIOUS_PATTERNS.test(result)) {
-      const tempCheck = result.replace(/<[^>]*>/g, "");
-      if (SUSPICIOUS_PATTERNS.test(tempCheck)) {
-        result = result.replace(/<[^>]*>/g, "").replace(/[<>]/g, "").replace(/javascript|vbscript/gi, "").replace(/\bon[a-z]+\s*=/gi, "").replace(/svg|SVG|sVg/gi, "").replace(/script|SCRIPT/gi, "").replace(/alert|eval/gi, "").replace(/\\x\w{2}/gi, "").replace(/[(){}[\]]/g, "");
-      }
-    }
-    result = result.replace(/\s+/g, " ").trim();
-    if (config.aggressiveMode && !HAS_TEXT_CONTENT.test(result)) {
-      return "";
-    }
-    return escapeAngleBrackets(result);
+    const decoded = decodeEncodingBypasses(str.replace(NULL_CONTROL_CHARS, "")).replace(NULL_CONTROL_CHARS, "");
+    return stripToText(decoded);
   } catch {
-    return str.replace(NULL_CONTROL_CHARS, "").replace(/<[^>]*>/g, "").replace(/[<>]/g, "").replace(/javascript|vbscript|eval|alert/gi, "").replace(/\bon[a-z]+\s*=/gi, "").replace(/\s+/g, " ").trim();
+    return escapeAngleBrackets(str.replace(NULL_CONTROL_CHARS, "")).replace(/\s+/g, " ").trim();
   }
 }
 function analyze(input, options) {
   const startTime = performance.now();
-  const originalStr = String(input ?? "");
-  const sanitized = sanitize(input, options);
+  const config = { ...DEFAULT_OPTIONS, ...options };
+  const originalStr = coerceInput(input).slice(0, resolveMaxLength(config.maxLength));
+  const sanitized = sanitize(originalStr, options);
   const processingTime = performance.now() - startTime;
-  const hadThreats = sanitized !== originalStr;
-  const threatLevel = assessThreatLevel(originalStr);
+  const decodedForAnalysis = decodeEncodingBypasses(originalStr.replace(NULL_CONTROL_CHARS, ""));
+  const threatLevel = assessThreatLevel(decodedForAnalysis);
+  const hadThreats = isDangerous(originalStr) || isDangerous(decodedForAnalysis);
   return {
     content: sanitized,
     hadThreats,
@@ -211,14 +277,17 @@ function escapeUrl(input, options) {
   const str = (typeof input === "string" ? input : String(input)).trim();
   if (!str) return "";
   const normalized = str.replace(/[\x00-\x20\x7F-\x9F]/g, "");
+  if (normalized.startsWith("//") || normalized.startsWith("\\\\")) return "";
+  const configuredProtocols = Array.isArray(config.allowedProtocols) ? config.allowedProtocols : [];
+  const requestedProtocols = new Set(
+    configuredProtocols.filter((protocol) => typeof protocol === "string").map((protocol) => protocol.toLowerCase()).filter((protocol) => SAFE_URL_PROTOCOLS.has(protocol))
+  );
   const colon = normalized.indexOf(":");
   if (colon !== -1) {
     const beforeColon = normalized.slice(0, colon);
     if (!/[/?#]/.test(beforeColon)) {
       const protocol = beforeColon.toLowerCase();
-      if (!config.allowedProtocols.map((p) => p.toLowerCase()).includes(protocol)) {
-        return "";
-      }
+      if (!requestedProtocols.has(protocol)) return "";
     }
   }
   return escapeAttribute(normalized);
@@ -229,17 +298,17 @@ function getVersion() {
 function getStats() {
   return {
     version: getVersion(),
-    securityLevel: "100% XSS Protection",
-    performance: "Optimized for high-throughput"
+    securityLevel: "Plain-text output with contextual encoders",
+    performance: "Measure with the included benchmark on your target runtime"
   };
 }
 var Purifai = class {
   /**
-   * Sanitize input with maximum security protection
+   * Convert HTML-like input to plain text
    *
    * @param input - Content to sanitize (string, object, or any type)
    * @param options - Optional configuration
-   * @returns Sanitized string safe for HTML output
+   * @returns Plain-text string; render it through normal text interpolation
    *
    * @example
    * ```typescript
@@ -364,11 +433,11 @@ export {
   sanitizeBatch
 };
 /**
- * 🛡️ PURIFAI - Ultra-Secure HTML Sanitizer
+ * PURIFAI - bounded strip-to-text sanitizer and contextual encoders.
  *
- * Advanced XSS protection with polyglot attack resistance.
- * Blocks sophisticated obfuscation techniques that bypass other sanitizers.
+ * `sanitize()` removes markup; it does not preserve safe HTML. Use `escape()`,
+ * `escapeAttribute()`, or `escapeUrl()` when the destination context is known.
  *
- * @version 2.0.2
+ * @version 2.0.3
  * @license MIT
  */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "purifai",
-  "version": "2.0.2",
-  "description": "Zero-dependency strip-to-text HTML sanitizer with contextual output encoding (HTML, attribute, URL). ~4.1KB gzipped, no DOM required - runs in Node, browsers and edge runtimes.",
+  "version": "2.0.3",
+  "description": "Zero-dependency strip-to-text HTML sanitizer with contextual output encoding (HTML, attribute, URL). ~4.5KB gzipped, no DOM required - runs in Node, browsers and edge runtimes.",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -21,14 +21,16 @@
   "scripts": {
     "build": "tsup index.ts --format cjs,esm --clean && pnpm run build:dts",
     "build:dts": "tsc -p tsconfig.dts.json && node -e \"require('fs').copyFileSync('dist/index.d.ts','dist/index.d.cts')\"",
-    "test": "pnpm run build && node test/security-test.js && node test/regression-test.js && node test/fuzz-test.js && node test/fair-benchmark.js",
+    "test": "pnpm run build && node test/security-test.js && node test/regression-test.js && node --test test/consumer-example.test.mjs && node test/fuzz-test.js && node test/fair-benchmark.js",
     "test:fuzz": "node test/fuzz-test.js",
     "test:security": "node test/security-test.js",
     "test:regression": "node test/regression-test.js",
+    "test:example": "pnpm run build && node --test test/consumer-example.test.mjs",
     "test:bench": "node test/comprehensive-test.js",
     "test:fair": "node test/fair-benchmark.js",
     "test:perf": "node test/verify-performance.js",
-    "benchmark": "pnpm run build && node test/fair-benchmark.js && node test/verify-performance.js",
+    "test:size": "node test/bundle-size-comparison.js",
+    "benchmark": "pnpm run build && node test/fair-benchmark.js && node test/verify-performance.js && node test/bundle-size-comparison.js",
     "prepublishOnly": "pnpm run test",
     "dev": "tsup index.ts --format cjs,esm --watch",
     "typecheck": "tsc --noEmit",
@@ -72,7 +74,9 @@
     "@types/node": "^26.0.0",
     "chalk": "^6.0.0",
     "cli-table3": "^0.6.5",
+    "dompurify": "^3.4.12",
     "entities": "^8.0.0",
+    "esbuild": "^0.27.7",
     "escape-html": "^1.0.3",
     "he": "^1.2.0",
     "html-entities": "^2.6.0",