@aparte/plugin-streaming-markdown 0.2.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 aparté
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,23 @@
+# @aparte/plugin-streaming-markdown
+
+Incremental (token-by-token) Markdown rendering for [aparté](https://github.com/apartejs/aparte) via
+[`streaming-markdown`](https://github.com/thetarnav/streaming-markdown). Parses only the new text and
+**appends** DOM nodes per streamed chunk — no per-token re-parse or `innerHTML` rebuild.
+
+```bash
+npm install @aparte/plugin-streaming-markdown @aparte/core streaming-markdown
+```
+
+```ts
+import { setupStreamingMarkdownProvider } from '@aparte/plugin-streaming-markdown';
+
+setupStreamingMarkdownProvider();
+```
+
+`@aparte/core` and `streaming-markdown` are **peer dependencies**. Pair it with a one-shot provider
+(e.g. `@aparte/plugin-marked`) for finished / re-rendered messages.
+
+**Security**: the streaming path writes DOM directly, bypassing the one-shot sanitizer, so it enforces
+the URL policy live — a streamed `[x](javascript:…)` never produces a clickable `javascript:` link.
+
+> ESM-only. Part of the aparté monorepo.

package/dist/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Register `streaming-markdown` as aparté's incremental (streaming) Markdown
+ * renderer.
+ *
+ * Once registered, the chat bubble feeds each streamed token chunk to a
+ * persistent incremental parser that parses only the new text and APPENDS DOM
+ * nodes — O(n) over the whole message, with no per-token re-parse or
+ * `innerHTML` rebuild. Finished / re-rendered messages still go through the
+ * one-shot `setMarkdownProvider` (e.g. `@aparte/plugin-marked`).
+ *
+ * Framework-agnostic — vanilla DOM, no framework imports.
+ *
+ * **Security**: the streaming path writes DOM nodes directly and therefore
+ * bypasses the one-shot `AparteConfig.sanitizeHtml`. To keep the same URL policy
+ * live (an attacker-controlled `[x](javascript:…)` streamed token would produce
+ * a clickable `javascript:` link before the final re-render sanitises it), the
+ * renderer's `set_attr` is wrapped to drop any `href`/`src` whose scheme fails
+ * {@link isSafeUrl}. The one-shot re-render at `end()` remains the full-fidelity
+ * re-sanitisation.
+ *
+ * Call once at application startup.
+ */
+export declare function setupStreamingMarkdownProvider(): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAerD"}

package/dist/index.js

@@ -0,0 +1,26 @@
+import { AparteConfig, isSafeUrl } from "@aparte/core";
+import { default_renderer, HREF, SRC, parser, parser_end, parser_write } from "streaming-markdown";
+function setupStreamingMarkdownProvider() {
+  AparteConfig.setStreamingMarkdownProvider((target) => {
+    const renderer = default_renderer(target);
+    const originalSetAttr = renderer.set_attr;
+    renderer.set_attr = (data, type, value) => {
+      if (type === HREF && !isSafeUrl(value, "a")) return;
+      if (type === SRC && !isSafeUrl(value, "img")) return;
+      originalSetAttr(data, type, value);
+    };
+    const p = parser(renderer);
+    return {
+      write: (chunk) => {
+        parser_write(p, chunk);
+      },
+      end: () => {
+        parser_end(p);
+      }
+    };
+  });
+}
+export {
+  setupStreamingMarkdownProvider
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../src/index.ts"],"sourcesContent":["import { AparteConfig, isSafeUrl } from '@aparte/core';\nimport { parser, parser_write, parser_end, default_renderer, HREF, SRC } from 'streaming-markdown';\n\n/**\n * Register `streaming-markdown` as aparté's incremental (streaming) Markdown\n * renderer.\n *\n * Once registered, the chat bubble feeds each streamed token chunk to a\n * persistent incremental parser that parses only the new text and APPENDS DOM\n * nodes — O(n) over the whole message, with no per-token re-parse or\n * `innerHTML` rebuild. Finished / re-rendered messages still go through the\n * one-shot `setMarkdownProvider` (e.g. `@aparte/plugin-marked`).\n *\n * Framework-agnostic — vanilla DOM, no framework imports.\n *\n * **Security**: the streaming path writes DOM nodes directly and therefore\n * bypasses the one-shot `AparteConfig.sanitizeHtml`. To keep the same URL policy\n * live (an attacker-controlled `[x](javascript:…)` streamed token would produce\n * a clickable `javascript:` link before the final re-render sanitises it), the\n * renderer's `set_attr` is wrapped to drop any `href`/`src` whose scheme fails\n * {@link isSafeUrl}. The one-shot re-render at `end()` remains the full-fidelity\n * re-sanitisation.\n *\n * Call once at application startup.\n */\nexport function setupStreamingMarkdownProvider(): void {\n    AparteConfig.setStreamingMarkdownProvider((target: HTMLElement) => {\n        const renderer = default_renderer(target);\n        const originalSetAttr = renderer.set_attr;\n        renderer.set_attr = (data, type, value) => {\n            if (type === HREF && !isSafeUrl(value, 'a')) return;\n            if (type === SRC && !isSafeUrl(value, 'img')) return;\n            originalSetAttr(data, type, value);\n        };\n        const p = parser(renderer);\n        return {\n            write: (chunk: string): void => { parser_write(p, chunk); },\n            end: (): void => { parser_end(p); },\n        };\n    });\n}\n"],"names":[],"mappings":";;AAyBO,SAAS,iCAAuC;AACnD,eAAa,6BAA6B,CAAC,WAAwB;AAC/D,UAAM,WAAW,iBAAiB,MAAM;AACxC,UAAM,kBAAkB,SAAS;AACjC,aAAS,WAAW,CAAC,MAAM,MAAM,UAAU;AACvC,UAAI,SAAS,QAAQ,CAAC,UAAU,OAAO,GAAG,EAAG;AAC7C,UAAI,SAAS,OAAO,CAAC,UAAU,OAAO,KAAK,EAAG;AAC9C,sBAAgB,MAAM,MAAM,KAAK;AAAA,IACrC;AACA,UAAM,IAAI,OAAO,QAAQ;AACzB,WAAO;AAAA,MACH,OAAO,CAAC,UAAwB;AAAE,qBAAa,GAAG,KAAK;AAAA,MAAG;AAAA,MAC1D,KAAK,MAAY;AAAE,mBAAW,CAAC;AAAA,MAAG;AAAA,IAAA;AAAA,EAE1C,CAAC;AACL;"}

package/package.json

@@ -0,0 +1,61 @@
+{
+  "name": "@aparte/plugin-streaming-markdown",
+  "version": "0.2.0-alpha.0",
+  "description": "Incremental (token-by-token) Markdown rendering for aparté via streaming-markdown, with a live URL-scheme guard.",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "@aparte-workspace/source": "./src/index.ts",
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "peerDependencies": {
+    "streaming-markdown": "^0.2.15",
+    "@aparte/core": "0.2.0-alpha.0"
+  },
+  "devDependencies": {
+    "streaming-markdown": "^0.2.15",
+    "typescript": "^5.4.0",
+    "vite": "^6.0.0",
+    "vite-plugin-dts": "^4.5.4",
+    "@aparte/core": "0.2.0-alpha.0"
+  },
+  "keywords": [
+    "aparte",
+    "plugin",
+    "markdown",
+    "streaming",
+    "incremental"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/apartejs/aparte.git",
+    "directory": "packages/plugins/streaming-markdown"
+  },
+  "bugs": {
+    "url": "https://github.com/apartejs/aparte/issues"
+  },
+  "scripts": {
+    "dev": "vite",
+    "build": "vite build && tsc -b --emitDeclarationOnly --force",
+    "preview": "vite preview",
+    "test": "vitest",
+    "test:run": "vitest run",
+    "test:coverage": "vitest run --coverage"
+  }
+}