purifai 2.0.2 → 3.0.0

package/dist/src/api.d.ts

@@ -0,0 +1,7 @@
+import { type ConversionResult, type ConvertOptions, type PurifaiTextTransform, type ToTextOptions } from './contracts.js';
+export { PurifaiLimitError } from './contracts.js';
+export type { ConversionLimits, ConversionReport, ConversionResult, ConvertOptions, ImageMode, LayoutMode, LimitKind, LinkMode, OverflowMode, PurifaiTextTransform, ToTextOptions, } from './contracts.js';
+export declare function toText(html: string, options?: ToTextOptions): string;
+export declare function convert(html: string, options?: ConvertOptions): ConversionResult;
+export declare function createTextTransform(options?: ToTextOptions): PurifaiTextTransform;
+export declare function escapeHtmlText(text: string): string;

package/dist/src/config.d.ts

@@ -0,0 +1,18 @@
+import type { ConvertOptions, ImageMode, LayoutMode, LinkMode, OverflowMode, ToTextOptions } from './contracts.js';
+export interface ValidatedLimits {
+    readonly input: number;
+    readonly output: number;
+    readonly depth: number;
+    readonly token: number;
+}
+export interface ValidatedConfig {
+    readonly layout: LayoutMode;
+    readonly links: LinkMode;
+    readonly images: ImageMode;
+    readonly baseUrl: URL | null;
+    readonly limits: ValidatedLimits;
+    readonly overflow: OverflowMode;
+}
+export declare function validateToTextOptions(options: ToTextOptions | undefined): ValidatedConfig;
+export declare function validateConvertOptions(options: ConvertOptions | undefined): ValidatedConfig;
+export declare function displayUrl(raw: string, baseUrl: URL | null): string | null;

package/dist/src/contracts.d.ts

@@ -0,0 +1,40 @@
+export type LayoutMode = 'readable' | 'compact';
+export type LinkMode = 'label' | 'label-and-url' | 'drop';
+export type ImageMode = 'alt' | 'drop';
+export type OverflowMode = 'throw' | 'truncate';
+export type LimitKind = 'input' | 'output' | 'depth' | 'token';
+export interface ConversionLimits {
+    input?: number;
+    output?: number;
+    depth?: number;
+    token?: number;
+}
+export interface ToTextOptions {
+    layout?: LayoutMode;
+    links?: LinkMode;
+    images?: ImageMode;
+    baseUrl?: string | URL;
+    limits?: ConversionLimits;
+}
+export interface ConvertOptions extends ToTextOptions {
+    overflow?: OverflowMode;
+}
+export interface ConversionReport {
+    truncatedBy: LimitKind | null;
+    scanComplete: boolean;
+    consumedInputCodeUnits: number;
+    outputCodeUnits: number;
+    droppedContainers: Readonly<Record<string, number>>;
+}
+export interface ConversionResult extends ConversionReport {
+    text: string;
+}
+export interface PurifaiTextTransform extends TransformStream<string, string> {
+    readonly result: Promise<ConversionReport>;
+}
+export declare class PurifaiLimitError extends RangeError {
+    readonly kind: LimitKind;
+    readonly limit: number;
+    readonly observed: number;
+    constructor(kind: LimitKind, limit: number, observed: number);
+}

package/dist/src/entities.d.ts

@@ -0,0 +1,15 @@
+export type ReferenceContext = 'data' | 'attribute';
+export type ReferenceDecision = {
+    readonly kind: 'match';
+    readonly consumed: number;
+    readonly examined: number;
+    readonly value: string;
+} | {
+    readonly kind: 'literal';
+    readonly consumed: 1;
+    readonly examined: number;
+    readonly value: '&';
+} | {
+    readonly kind: 'need-more';
+};
+export declare function decodeReference(source: string, ampersandOffset: number, context: ReferenceContext, final: boolean): ReferenceDecision;

package/dist/src/formatter.d.ts

@@ -0,0 +1,36 @@
+import { type ValidatedConfig } from './config.js';
+import { type SelectedAttributes, type SemanticTag } from './policy.js';
+export declare function isHtmlWhitespace(value: string): boolean;
+export declare function splitOutputChunk(value: string, maximum: number): [string, string];
+export declare class ReaderFormatter {
+    private readonly config;
+    private readonly writeOutput;
+    private readonly frames;
+    private readonly lists;
+    private readonly tables;
+    private readonly preInitialLineFeeds;
+    private pendingWhitespace;
+    private pendingBreaks;
+    private pendingTab;
+    private pendingListPrefix;
+    private quoteDepth;
+    private suppressedLinkDepth;
+    private hasOutput;
+    private atLineStart;
+    private trailingNewlines;
+    private serial;
+    constructor(config: ValidatedConfig, writeOutput: (value: string, splittable: boolean) => void);
+    text(value: string, mode: 'normal' | 'pre'): void;
+    start(tag: SemanticTag, attributes: SelectedAttributes): void;
+    end(tag: SemanticTag): void;
+    finish(): void;
+    private listPrefix;
+    private image;
+    private appendUrl;
+    private boundary;
+    private takeSeparator;
+    private takePrefixes;
+    private emitNormal;
+    private emitPre;
+    private write;
+}

package/dist/src/generated/entities.d.ts

@@ -0,0 +1,3 @@
+export declare const ENTITY_MAP: Readonly<Record<string, string>>;
+export declare const LEGACY_ENTITY_PREFIX_MAP: Readonly<Record<string, string | null>>;
+export declare const MAX_ENTITY_KEY_LENGTH = 32;

package/dist/src/policy.d.ts

@@ -0,0 +1,15 @@
+export type TagKind = 'void' | 'inline' | 'block' | 'list' | 'table' | 'pre' | 'raw-preserve' | 'raw-drop' | 'ordinary-drop' | 'head' | 'foreign-drop';
+export type SemanticTag = 'a' | 'abbr' | 'address' | 'article' | 'aside' | 'audio' | 'b' | 'bdi' | 'bdo' | 'blockquote' | 'body' | 'br' | 'button' | 'canvas' | 'caption' | 'cite' | 'code' | 'col' | 'colgroup' | 'data' | 'dd' | 'del' | 'details' | 'dfn' | 'dialog' | 'div' | 'dl' | 'dt' | 'em' | 'fieldset' | 'figcaption' | 'figure' | 'footer' | 'form' | 'h1' | 'h2' | 'h3' | 'h4' | 'h5' | 'h6' | 'head' | 'header' | 'hgroup' | 'hr' | 'html' | 'i' | 'img' | 'input' | 'ins' | 'kbd' | 'label' | 'legend' | 'li' | 'main' | 'mark' | 'menu' | 'nav' | 'object' | 'ol' | 'option' | 'p' | 'pre' | 'q' | 'rp' | 'rt' | 'ruby' | 's' | 'samp' | 'section' | 'select' | 'slot' | 'small' | 'span' | 'strong' | 'sub' | 'summary' | 'sup' | 'table' | 'tbody' | 'td' | 'textarea' | 'tfoot' | 'th' | 'thead' | 'time' | 'tr' | 'u' | 'ul' | 'var' | 'video' | 'wbr' | 'xmp' | 'plaintext' | DroppedTag;
+export type DroppedTag = 'applet' | 'base' | 'embed' | 'frameset' | 'iframe' | 'link' | 'math' | 'meta' | 'noembed' | 'noframes' | 'noscript' | 'param' | 'script' | 'source' | 'style' | 'svg' | 'template' | 'title' | 'track';
+export interface SelectedAttributes {
+    href?: string;
+    alt?: string;
+    start?: string;
+    value?: string;
+}
+export interface TagPolicy {
+    readonly name: SemanticTag;
+    readonly kind: TagKind;
+}
+export declare function getTagPolicy(name: string): TagPolicy | null;
+export declare function createsBlockBoundary(tag: SemanticTag): boolean;

package/dist/src/scanner.d.ts

@@ -0,0 +1,71 @@
+import { type DroppedTag, type SelectedAttributes, type SemanticTag } from './policy.js';
+export interface ScannerHost {
+    retainToken(units: number): void;
+    releaseToken(units: number): void;
+    probeToken(units: number): void;
+    pushDepth(): void;
+    popDepth(count: number): void;
+    text(value: string, mode: 'normal' | 'pre'): void;
+    start(tag: SemanticTag, attributes: SelectedAttributes): void;
+    end(tag: SemanticTag): void;
+    dropped(tag: DroppedTag): void;
+}
+export declare class HtmlScanner {
+    private readonly host;
+    private readonly frames;
+    private readonly topByName;
+    private readonly referenceCache;
+    private state;
+    private token;
+    private quote;
+    private commentTail;
+    private referenceBuffer;
+    private pendingCarriageReturn;
+    private preDepth;
+    private raw;
+    private ordinaryDrop;
+    private specialReference;
+    private inHead;
+    private finished;
+    constructor(host: ScannerHost);
+    write(chunk: string): void;
+    finish(): void;
+    private consume;
+    private consumeData;
+    private consumeTagOpen;
+    private consumeEndTagOpen;
+    private consumeTag;
+    private consumeMarkupProbe;
+    private consumeComment;
+    private consumeCommentSpan;
+    private consumeDataSpan;
+    private consumeDroppedRawSpan;
+    private consumeReferenceSpan;
+    private consumeTagSpan;
+    private startToken;
+    private appendToken;
+    private appendTokenValue;
+    private releaseTokenBuffer;
+    private retainReference;
+    private resolveReference;
+    private consumeResolvedRemainder;
+    private emitToken;
+    private emitParsedTag;
+    private openTag;
+    private openVisibleTag;
+    private closeTag;
+    private closeFramesTo;
+    private emitText;
+    private handleHeadTag;
+    private exitHead;
+    private consumeRaw;
+    private consumeRawCandidate;
+    private failRawCandidate;
+    private closeRawState;
+    private retainSpecialReference;
+    private resolveSpecialReference;
+    private consumeOrdinaryDrop;
+    private finishSpecialState;
+    private emitRawLiteral;
+    private decodeReference;
+}

package/dist/src/session.d.ts

@@ -0,0 +1,27 @@
+import type { ValidatedConfig } from './config.js';
+import { type ConversionReport } from './contracts.js';
+export declare class ConversionSession {
+    private readonly config;
+    private readonly emit;
+    private readonly droppedContainers;
+    private readonly scanner;
+    private readonly formatter;
+    private consumedInput;
+    private outputLength;
+    private retainedToken;
+    private depth;
+    private outputBuffer;
+    private stoppedBy;
+    private finished;
+    constructor(config: ValidatedConfig, emit: (chunk: string) => void);
+    write(chunk: string): void;
+    finish(): ConversionReport;
+    private appendOutput;
+    private retainToken;
+    private probeToken;
+    private pushDepth;
+    private recordDropped;
+    private exceed;
+    private flushFullChunks;
+    private flushAll;
+}

package/docs/benchmarks/v3.md

@@ -0,0 +1,92 @@
+# Purifai v3 category benchmark
+
+Purifai is benchmarked for its deliberately narrow category: bounded streaming conversion of untrusted HTML into readable plain text. This report does not claim that Purifai is the fastest HTML tool for every job.
+
+Raw measurements: [benchmark/results/v3.json](../../benchmark/results/v3.json)
+
+## Reproduce
+
+```sh
+pnpm run bench
+pnpm run bench:check
+```
+
+- Run date: 2026-08-02T17:49:35.986Z
+- Runtime: v24.18.0
+- Platform: darwin arm64
+- CPU: Apple M1 (8 logical cores)
+- Memory: 8192.00 MiB
+- Packages: purifai 3.0.0, striptags 3.2.0, html-to-text 10.0.0
+- Corpus SHA-256: `fe131490fda5dfb290654d3ff7f6f126471362e6debe47e2f0aced0dbad7b4d5`
+
+The throughput path uses already-materialized strings for every implementation. Each worker calibrates a batch to at least 100 ms, performs 10 warmup batches, then records 40 batches with `process.hrtime.bigint()`. Median and p95 are nearest-rank values per conversion. Each package/corpus pair runs in a fresh process.
+
+The memory path is different by design: Purifai streaming receives lazily generated chunks of at most 16,384 code units, while one-shot tools receive the same logical document after materialization. Each mode runs alone under `node --expose-gc` in 7 fresh processes. The table gates the nearest-rank median of those process peak-RSS values and retains every raw sample in JSON. Purifai one-shot memory is reported separately and is not presented as streaming memory.
+
+Artifact: 23,689 bytes for the complete minified ESM runtime at gzip level 9; 68,592 bytes for the npm tarball.
+
+## Release gates
+
+| Gate | Result | Evidence |
+| --- | --- | --- |
+| reviewed readability fixtures | PASS | Purifai 8/8; striptags 0/8 |
+| non-reader body removal | PASS | Purifai 5/5; striptags script calibration leak observed |
+| hostile-tags hostile p95 | PASS | Purifai 2.651 ms; html-to-text 3.052 ms |
+| hostile-comments hostile p95 | PASS | Purifai 0.987 ms; html-to-text 1.524 ms |
+| hostile-entities hostile p95 | PASS | Purifai 2.362 ms; html-to-text 2.876 ms |
+| hostile-raw hostile p95 | PASS | Purifai 2.022 ms; html-to-text 2.163 ms |
+| readable-large streaming RSS | PASS | Purifai 66.80 MiB; html-to-text 82.47 MiB |
+| hostile-tags streaming RSS | PASS | Purifai 61.09 MiB; html-to-text 62.59 MiB |
+| hostile-comments streaming RSS | PASS | Purifai 58.34 MiB; html-to-text 63.56 MiB |
+| hostile-entities streaming RSS | PASS | Purifai 60.05 MiB; html-to-text 66.64 MiB |
+| hostile-raw streaming RSS | PASS | Purifai 60.47 MiB; html-to-text 62.88 MiB |
+
+## Throughput
+
+| Corpus | Package | Median ms | p95 ms | Conversions/sample |
+| --- | --- | ---: | ---: | ---: |
+| readable-small | purifai | 0.019 | 0.020 | 16384–16384 |
+| readable-small | html-to-text | 0.185 | 0.188 | 2048–2048 |
+| readable-small | striptags | 0.009 | 0.009 | 32768–32768 |
+| readable-large | purifai | 8.736 | 8.886 | 32–32 |
+| readable-large | html-to-text | 13.164 | 13.537 | 16–16 |
+| readable-large | striptags | 4.166 | 4.249 | 64–64 |
+| hostile-tags | purifai | 2.630 | 2.651 | 128–128 |
+| hostile-tags | html-to-text | 2.999 | 3.052 | 64–64 |
+| hostile-tags | striptags | 2.275 | 2.308 | 128–128 |
+| hostile-comments | purifai | 0.965 | 0.987 | 256–256 |
+| hostile-comments | html-to-text | 1.489 | 1.524 | 256–256 |
+| hostile-comments | striptags | 2.269 | 2.329 | 128–128 |
+| hostile-entities | purifai | 2.320 | 2.362 | 128–128 |
+| hostile-entities | html-to-text | 2.824 | 2.876 | 128–128 |
+| hostile-entities | striptags | 2.440 | 2.479 | 128–128 |
+| hostile-raw | purifai | 1.996 | 2.022 | 128–128 |
+| hostile-raw | html-to-text | 2.120 | 2.163 | 128–128 |
+| hostile-raw | striptags | 1.722 | 1.743 | 128–128 |
+
+## Peak memory
+
+| Corpus | Mode | Max RSS MiB | Retained heap MiB |
+| --- | --- | ---: | ---: |
+| readable-large | purifai-stream | 66.80 | 1.04 |
+| readable-large | purifai-one-shot | 67.55 | 1.86 |
+| readable-large | html-to-text | 82.47 | 2.48 |
+| hostile-tags | purifai-stream | 61.09 | 0.92 |
+| hostile-tags | purifai-one-shot | 60.84 | 0.87 |
+| hostile-tags | html-to-text | 62.59 | 2.21 |
+| hostile-comments | purifai-stream | 58.34 | 0.90 |
+| hostile-comments | purifai-one-shot | 58.81 | 0.99 |
+| hostile-comments | html-to-text | 63.56 | 2.23 |
+| hostile-entities | purifai-stream | 60.05 | 0.95 |
+| hostile-entities | purifai-one-shot | 61.41 | 1.99 |
+| hostile-entities | html-to-text | 66.64 | 2.68 |
+| hostile-raw | purifai-stream | 60.47 | 0.94 |
+| hostile-raw | purifai-one-shot | 61.00 | 0.91 |
+| hostile-raw | html-to-text | 62.88 | 2.21 |
+
+## Interpretation and limits
+
+- `striptags` is a minimal tag remover. Its inclusion calibrates readability and dropped-body behavior; it is not the hostile-throughput gate.
+- `html-to-text` offers a broader formatting feature set. Purifai intentionally does less, which is why hostile one-shot latency and streaming memory are compared directly while advanced table fidelity is not claimed.
+- Purifai preserves simple rows and cells, but it does not attempt rowspan/colspan layout, visual CSS reconstruction, or browser-equivalent error recovery.
+- Results are machine-, runtime-, and corpus-specific. The checked claim is the set of release gates above, not an uncategorized “fastest” claim.

package/docs/migration-v3.md

@@ -0,0 +1,95 @@
+# Migrating to Purifai v3
+
+Purifai v3 is a clean-break HTML-to-readable-text converter. There is no compatibility layer.
+The v2 class, threat-scoring helpers, batch helpers, and context encoders are not
+carried forward. The smaller API makes conversion, resource limits, and output
+sink responsibilities explicit.
+
+## Export and option mapping
+
+| V2 surface | V3 decision |
+| --- | --- |
+| `Purifai.sanitize / sanitize` | Purifai.sanitize / sanitize → toText |
+| `escape` | escape → escapeHtmlText (HTML text context only) |
+| `analyze` | analyze → removed; use convert for conversion metadata |
+| `sanitizeBatch` | sanitizeBatch → removed; map toText explicitly |
+| `isDangerous` | isDangerous → removed; Purifai does not classify intent |
+| `escapeAttribute / escapeUrl` | escapeAttribute / escapeUrl → removed; use a context-specific library or platform API |
+| `getVersion / getStats` | getVersion / getStats → removed; use package metadata and published benchmarks |
+| `aggressiveMode / allowedProtocols` | aggressiveMode / allowedProtocols → removed; fixed policy |
+| `maxLength` | maxLength → limits.input; overflow is explicit |
+
+## One-shot conversion
+
+```js
+// v2
+const text = sanitize(html, { maxLength: 10_000 });
+
+// v3: throws PurifaiLimitError when the input is too large
+const text = toText(html, { limits: { input: 10_000 } });
+```
+
+If a bounded prefix is a valid product result, opt in through `convert`:
+
+```js
+const result = convert(html, {
+  limits: { input: 10_000, output: 2_000 },
+  overflow: 'truncate',
+});
+
+if (result.truncatedBy !== null) {
+  console.log(`Stopped at the ${result.truncatedBy} limit`);
+}
+```
+
+`toText` and `createTextTransform` never truncate silently.
+
+## Batch conversion
+
+Batching is ordinary application control flow in v3, so scheduling and error
+handling remain visible:
+
+```js
+const texts = htmlItems.map((html) => toText(html));
+```
+
+## Conversion metadata
+
+`convert` reports mechanical conversion facts: completion, input consumed,
+output produced, truncation, and dropped-container counts. It does not assign a
+threat score or infer whether content or a user is malicious.
+
+## Output contexts
+
+V3 only provides `escapeHtmlText`, for placing plain text in an HTML text-node
+context. Prefer assigning `textContent` directly. Attribute, URL, JavaScript,
+CSS, and template contexts need policies and encoders designed for those exact
+sinks.
+
+## Fixed policy changes
+
+V3 deliberately has no mutable protocol allow-list or aggressive mode. Display
+URLs accept absolute HTTP(S) and `mailto`, and resolve relative URLs only when an
+HTTP(S) `baseUrl` is supplied. A displayed URL is text, not authorization to use
+it as an active destination.
+
+Markup is never preserved. Source and non-reader bodies are removed; visible
+reader structure is converted to text. Applications that need safe HTML should
+remain on a markup-preserving sanitizer.
+
+## Streaming
+
+Node stream adapters were not carried forward. Use the Web Streams API available
+in modern Node, Bun, Deno, Workers, and browsers:
+
+```js
+const transform = createTextTransform();
+const textStream = byteStream
+  .pipeThrough(new TextDecoderStream())
+  .pipeThrough(transform);
+const report = await transform.result;
+```
+
+When a stream limit fails, some output may already have reached the reader. Treat
+that output as partial and discard it unless your application explicitly accepts
+partial records.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "purifai",
-  "version": "2.0.2",
-  "description": "Zero-dependency strip-to-text HTML sanitizer with contextual output encoding (HTML, attribute, URL). ~4.1KB gzipped, no DOM required - runs in Node, browsers and edge runtimes.",
+  "version": "3.0.0",
+  "description": "Bounded streaming conversion from untrusted HTML to readable plain text, with zero dependencies and no DOM.",
   "main": "dist/index.js",
   "module": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,46 +14,59 @@
   },
   "files": [
     "dist",
+    "benchmark/results/v3.json",
+    "docs/benchmarks/v3.md",
+    "docs/migration-v3.md",
     "README.md",
     "LICENSE"
   ],
   "type": "module",
+  "sideEffects": false,
+  "packageManager": "pnpm@11.4.0",
   "scripts": {
-    "build": "tsup index.ts --format cjs,esm --clean && pnpm run build:dts",
+    "build": "tsup index.ts --format cjs,esm --minify --clean && pnpm run build:dts",
     "build:dts": "tsc -p tsconfig.dts.json && node -e \"require('fs').copyFileSync('dist/index.d.ts','dist/index.d.cts')\"",
-    "test": "pnpm run build && node test/security-test.js && node test/regression-test.js && node test/fuzz-test.js && node test/fair-benchmark.js",
-    "test:fuzz": "node test/fuzz-test.js",
-    "test:security": "node test/security-test.js",
-    "test:regression": "node test/regression-test.js",
-    "test:bench": "node test/comprehensive-test.js",
-    "test:fair": "node test/fair-benchmark.js",
-    "test:perf": "node test/verify-performance.js",
-    "benchmark": "pnpm run build && node test/fair-benchmark.js && node test/verify-performance.js",
-    "prepublishOnly": "pnpm run test",
-    "dev": "tsup index.ts --format cjs,esm --watch",
+    "test": "pnpm run test:core",
+    "test:unit": "pnpm run build && node --test test/v3/api.test.js test/v3/entities.test.js test/v3/entities-exhaustive.test.js test/v3/scanner.test.js test/v3/readability.test.js test/v3/special-elements.test.js test/v3/links-images.test.js test/v3/limits.test.js test/v3/stream.test.js",
+    "test:core": "pnpm run entities:check && pnpm run typecheck && pnpm run test:unit && pnpm run test:fuzz && pnpm run test:sinks && node test/package-smoke.mjs",
+    "test:fuzz": "pnpm run build && node --test test/v3/fuzz.test.js",
+    "test:sinks": "pnpm run build && node --test test/v3/sinks.test.js",
+    "test:package": "node test/package-smoke.mjs",
+    "test:runtimes": "pnpm run build && node scripts/test-runtimes.mjs",
+    "test:cloudflare": "pnpm run build && node scripts/test-cloudflare.mjs",
+    "test:browsers": "pnpm run build && node test/browser/run.mjs",
+    "bench": "pnpm run build && node benchmark/run.mjs",
+    "bench:check": "pnpm run build && node benchmark/run.mjs --check",
+    "test:size": "pnpm run build && node scripts/verify-size.mjs",
+    "test:scaling": "pnpm run build && node scripts/verify-scaling.mjs",
+    "test:docs": "pnpm run build && node test/docs.test.mjs",
+    "test:release": "node scripts/verify-release.mjs",
+    "prepublishOnly": "pnpm run test:release",
+    "dev": "tsup index.ts --format cjs,esm --minify --watch",
     "typecheck": "tsc --noEmit",
-    "test:browser": "node test/browser-verify.js"
+    "entities:update": "node scripts/update-entities.mjs && node scripts/generate-entities.mjs",
+    "entities:generate": "node scripts/generate-entities.mjs",
+    "entities:check": "node scripts/generate-entities.mjs --check"
   },
   "keywords": [
-    "sanitizer",
-    "xss",
-    "security",
+    "html-to-text",
+    "streaming",
+    "plain-text",
     "html",
-    "sanitize",
+    "reader-text",
     "polyglot",
     "typescript",
     "zero-dependencies",
     "lightweight",
     "fast",
     "secure",
-    "anti-xss",
-    "html-sanitizer",
-    "xss-protection",
-    "sanitization",
+    "transform-stream",
+    "bounded-memory",
     "frontend",
     "backend",
     "nodejs",
-    "browser"
+    "browser",
+    "edge-runtime"
   ],
   "author": "Purifai Team <it@worksonmy.dev>",
   "license": "MIT",
@@ -66,26 +79,17 @@
     "url": "https://github.com/moji2002/purifai/issues"
   },
   "engines": {
-    "node": ">=14.0.0"
+    "node": ">=22.0.0"
   },
   "devDependencies": {
+    "@cloudflare/vitest-pool-workers": "^0.20.1",
     "@types/node": "^26.0.0",
-    "chalk": "^6.0.0",
-    "cli-table3": "^0.6.5",
-    "entities": "^8.0.0",
-    "escape-html": "^1.0.3",
-    "he": "^1.2.0",
-    "html-entities": "^2.6.0",
-    "isomorphic-dompurify": "^3.19.0",
+    "html-to-text": "10.0.0",
     "jsdom": "^29.1.1",
-    "playwright-core": "^1.62.0",
-    "rehype": "^13.0.2",
-    "rehype-sanitize": "^6.0.0",
-    "sanitize-html": "^2.17.6",
-    "striptags": "^3.2.0",
+    "playwright": "^1.62.1",
+    "striptags": "3.2.0",
     "tsup": "^8.5.1",
     "typescript": "^7.0.2",
-    "validator": "^13.15.35",
-    "xss": "^1.0.15"
+    "vitest": "^4.1.10"
   }
 }