Give rich text one policy instead of two mirrored copies

[playforge-coding]

Fourth extraction layer. Stacked on #19. This one touches a security boundary — worth reading the diff rather than the summary.

What was actually wrong

Both files opened with a comment telling the reader to keep them in sync by hand, and the flattening function had already drifted in name — richTextToPlain on the Worker, richTextToPlainText in the browser — while staying byte-identical in body. The drift had a visible failure mode: the editor's character counter and the Worker's length limit must measure the same thing, or the editor shows "498/500" for a comment the server then rejects.

The sanitizers stay separate

This does not merge them, and couldn't. HTMLRewriter is the Workers runtime's native streaming parser; DOMPurify needs a real DOM. Neither runs where the other does, and the two-pass design (Worker on write, browser on render) is deliberate — the render path uses dangerouslySetInnerHTML, so a reader's safety shouldn't depend on every stored row having been written by the current server code.

What moved

Shared	Why it must not drift
RICH_TEXT_TAGS	the 15-tag allow-list — was duplicated exactly
MEDIA_TAGS	the "no embedded media" product rule
SAFE_LINK_PROTOCOLS	http/https/mailto
isSafeLink	incl. stripping control chars, so java\tscript: can't pass a prefix check
LINK_TARGET / LINK_REL	what a surviving link is rewritten to carry
richTextToPlain + helpers	the counter/limit parity above

richTextToPlain is the surviving name — richTextToPlainText had no callers outside its own module, so adopting it cost nothing.

One deliberate behaviour change

The browser's FORBID_TAGS is now composed from the shared media list. Verified to be a strict superset of what it was: nothing lost, gains track and math, aligning it with the Worker. (It was already documented as "redundant given the allow-list" — the allow-list is the real enforcement either way.)

Verification

The Worker's 20 sanitizer tests — media smuggling, <scr<script>ipt>, onerror=, javascript:, java\tscript:, protocol-relative hrefs — are unchanged and still pass. That suite is what actually guards this change; I did not touch it.

Adds 18 core tests covering link safety and the browser-side helpers (richTextToLine, isRichTextHtml, richTextLength), which had no tests at all while they lived in apps/web.

pnpm run lint, pnpm run build, pnpm run build:docs pass; core 33, api 27, mcp 14.

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0880afe3-d6bb-45d0-99f5-bd7f259d51fe

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}