@aparte/plugin-streaming-markdown 0.7.1 → 0.9.0

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+import { type AparteConfig } from '@aparte/core';
 /**
  * Register `streaming-markdown` as aparté's incremental (streaming) Markdown
  * renderer.
@@ -11,7 +12,7 @@
  * Framework-agnostic — vanilla DOM, no framework imports.
  *
  * **Security**: the streaming path writes DOM nodes directly and therefore
- * bypasses the one-shot `AparteConfig.sanitizeHtml`. To keep the same URL policy
+ * bypasses the one-shot `aparteGlobalConfig.sanitizeHtml`. To keep the same URL policy
  * live (an attacker-controlled `[x](javascript:…)` streamed token would produce
  * a clickable `javascript:` link before the final re-render sanitises it), the
  * renderer's `set_attr` is wrapped to drop any `href`/`src` whose scheme fails
@@ -20,5 +21,5 @@
  *
  * Call once at application startup.
  */
-export declare function setupStreamingMarkdownProvider(): void;
+export declare function setupStreamingMarkdownProvider(config?: AparteConfig): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,IAAI,IAAI,CAerD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,YAAY,EAAC,MAAM,cAAc,CAAC;AAGhF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,GAAE,YAAiC,GAAG,IAAI,CAe9F"}

package/dist/index.js

@@ -1,7 +1,7 @@
-import { AparteConfig, isSafeUrl } from "@aparte/core";
+import { aparteGlobalConfig, isSafeUrl } from "@aparte/core";
 import { default_renderer, HREF, SRC, parser, parser_end, parser_write } from "streaming-markdown";
-function setupStreamingMarkdownProvider() {
-  AparteConfig.setStreamingMarkdownProvider((target) => {
+function setupStreamingMarkdownProvider(config = aparteGlobalConfig) {
+  config.setStreamingMarkdownProvider((target) => {
     const renderer = default_renderer(target);
     const originalSetAttr = renderer.set_attr;
     renderer.set_attr = (data, type, value) => {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../src/index.ts"],"sourcesContent":["import { AparteConfig, isSafeUrl } from '@aparte/core';\nimport { parser, parser_write, parser_end, default_renderer, HREF, SRC } from 'streaming-markdown';\n\n/**\n * Register `streaming-markdown` as aparté's incremental (streaming) Markdown\n * renderer.\n *\n * Once registered, the chat bubble feeds each streamed token chunk to a\n * persistent incremental parser that parses only the new text and APPENDS DOM\n * nodes — O(n) over the whole message, with no per-token re-parse or\n * `innerHTML` rebuild. Finished / re-rendered messages still go through the\n * one-shot `setMarkdownProvider` (e.g. `@aparte/plugin-marked`).\n *\n * Framework-agnostic — vanilla DOM, no framework imports.\n *\n * **Security**: the streaming path writes DOM nodes directly and therefore\n * bypasses the one-shot `AparteConfig.sanitizeHtml`. To keep the same URL policy\n * live (an attacker-controlled `[x](javascript:…)` streamed token would produce\n * a clickable `javascript:` link before the final re-render sanitises it), the\n * renderer's `set_attr` is wrapped to drop any `href`/`src` whose scheme fails\n * {@link isSafeUrl}. The one-shot re-render at `end()` remains the full-fidelity\n * re-sanitisation.\n *\n * Call once at application startup.\n */\nexport function setupStreamingMarkdownProvider(): void {\n    AparteConfig.setStreamingMarkdownProvider((target: HTMLElement) => {\n        const renderer = default_renderer(target);\n        const originalSetAttr = renderer.set_attr;\n        renderer.set_attr = (data, type, value) => {\n            if (type === HREF && !isSafeUrl(value, 'a')) return;\n            if (type === SRC && !isSafeUrl(value, 'img')) return;\n            originalSetAttr(data, type, value);\n        };\n        const p = parser(renderer);\n        return {\n            write: (chunk: string): void => { parser_write(p, chunk); },\n            end: (): void => { parser_end(p); },\n        };\n    });\n}\n"],"names":[],"mappings":";;AAyBO,SAAS,iCAAuC;AACnD,eAAa,6BAA6B,CAAC,WAAwB;AAC/D,UAAM,WAAW,iBAAiB,MAAM;AACxC,UAAM,kBAAkB,SAAS;AACjC,aAAS,WAAW,CAAC,MAAM,MAAM,UAAU;AACvC,UAAI,SAAS,QAAQ,CAAC,UAAU,OAAO,GAAG,EAAG;AAC7C,UAAI,SAAS,OAAO,CAAC,UAAU,OAAO,KAAK,EAAG;AAC9C,sBAAgB,MAAM,MAAM,KAAK;AAAA,IACrC;AACA,UAAM,IAAI,OAAO,QAAQ;AACzB,WAAO;AAAA,MACH,OAAO,CAAC,UAAwB;AAAE,qBAAa,GAAG,KAAK;AAAA,MAAG;AAAA,MAC1D,KAAK,MAAY;AAAE,mBAAW,CAAC;AAAA,MAAG;AAAA,IAAA;AAAA,EAE1C,CAAC;AACL;"}
+{"version":3,"file":"index.js","sources":["../src/index.ts"],"sourcesContent":["import { aparteGlobalConfig, isSafeUrl , type AparteConfig} from '@aparte/core';\nimport { parser, parser_write, parser_end, default_renderer, HREF, SRC } from 'streaming-markdown';\n\n/**\n * Register `streaming-markdown` as aparté's incremental (streaming) Markdown\n * renderer.\n *\n * Once registered, the chat bubble feeds each streamed token chunk to a\n * persistent incremental parser that parses only the new text and APPENDS DOM\n * nodes — O(n) over the whole message, with no per-token re-parse or\n * `innerHTML` rebuild. Finished / re-rendered messages still go through the\n * one-shot `setMarkdownProvider` (e.g. `@aparte/plugin-marked`).\n *\n * Framework-agnostic — vanilla DOM, no framework imports.\n *\n * **Security**: the streaming path writes DOM nodes directly and therefore\n * bypasses the one-shot `aparteGlobalConfig.sanitizeHtml`. To keep the same URL policy\n * live (an attacker-controlled `[x](javascript:…)` streamed token would produce\n * a clickable `javascript:` link before the final re-render sanitises it), the\n * renderer's `set_attr` is wrapped to drop any `href`/`src` whose scheme fails\n * {@link isSafeUrl}. The one-shot re-render at `end()` remains the full-fidelity\n * re-sanitisation.\n *\n * Call once at application startup.\n */\nexport function setupStreamingMarkdownProvider(config: AparteConfig = aparteGlobalConfig): void {\n    config.setStreamingMarkdownProvider((target: HTMLElement) => {\n        const renderer = default_renderer(target);\n        const originalSetAttr = renderer.set_attr;\n        renderer.set_attr = (data, type, value) => {\n            if (type === HREF && !isSafeUrl(value, 'a')) return;\n            if (type === SRC && !isSafeUrl(value, 'img')) return;\n            originalSetAttr(data, type, value);\n        };\n        const p = parser(renderer);\n        return {\n            write: (chunk: string): void => { parser_write(p, chunk); },\n            end: (): void => { parser_end(p); },\n        };\n    });\n}\n"],"names":[],"mappings":";;AAyBO,SAAS,+BAA+B,SAAuB,oBAA0B;AAC5F,SAAO,6BAA6B,CAAC,WAAwB;AACzD,UAAM,WAAW,iBAAiB,MAAM;AACxC,UAAM,kBAAkB,SAAS;AACjC,aAAS,WAAW,CAAC,MAAM,MAAM,UAAU;AACvC,UAAI,SAAS,QAAQ,CAAC,UAAU,OAAO,GAAG,EAAG;AAC7C,UAAI,SAAS,OAAO,CAAC,UAAU,OAAO,KAAK,EAAG;AAC9C,sBAAgB,MAAM,MAAM,KAAK;AAAA,IACrC;AACA,UAAM,IAAI,OAAO,QAAQ;AACzB,WAAO;AAAA,MACH,OAAO,CAAC,UAAwB;AAAE,qBAAa,GAAG,KAAK;AAAA,MAAG;AAAA,MAC1D,KAAK,MAAY;AAAE,mBAAW,CAAC;AAAA,MAAG;AAAA,IAAA;AAAA,EAE1C,CAAC;AACL;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aparte/plugin-streaming-markdown",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "description": "Incremental (token-by-token) Markdown rendering for aparté via streaming-markdown, with a live URL-scheme guard.",
   "type": "module",
   "sideEffects": false,
@@ -24,15 +24,14 @@
     "node": ">=18"
   },
   "peerDependencies": {
-    "@aparte/core": ">=0.5.0-alpha.0 <1.0.0",
+    "@aparte/core": ">=0.7.0 <1.0.0",
     "streaming-markdown": "^0.2.15"
   },
   "devDependencies": {
     "streaming-markdown": "^0.2.15",
     "typescript": "^5.4.0",
     "vite": "^6.0.0",
-    "vite-plugin-dts": "^4.5.4",
-    "@aparte/core": "0.7.1"
+    "@aparte/core": "0.9.0"
   },
   "keywords": [
     "aparte",