@jxsuite/parser 0.34.0 → 0.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jxsuite/parser",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "Jx markdown parser and external class integration",
   "license": "MIT",
   "repository": {
@@ -17,6 +17,7 @@
     ".": "./src/md.ts",
     "./content": "./src/content.ts",
     "./markdown": "./src/markdown.ts",
+    "./md-html": "./src/md-html.ts",
     "./csv": "./src/csv.ts",
     "./serialize": "./src/serialize.ts",
     "./ContentCollection.class.json": "./src/ContentCollection.class.json",
@@ -46,6 +47,7 @@
     "hast-util-whitespace": "^3.0.0",
     "mdast-util-to-string": "^4.0.0",
     "property-information": "^7.2.0",
+    "rehype-sanitize": "^6.0.0",
     "rehype-stringify": "^10.0.1",
     "remark-directive": "^4.0.0",
     "remark-frontmatter": "^5.0.0",
@@ -60,7 +62,7 @@
   },
   "devDependencies": {
     "@happy-dom/global-registrator": "^20.10.6",
-    "@jxsuite/runtime": "^0.34.0",
+    "@jxsuite/runtime": "^0.34.1",
     "@types/hast": "^3.0.4",
     "@types/mdast": "^4.0.4"
   }

package/src/md-html.ts

@@ -0,0 +1,49 @@
+/**
+ * Md-html — browser-safe markdown → sanitized HTML string
+ *
+ * Small display pipeline for rendering untrusted markdown (e.g. LLM chat output) as
+ * HTML: remark-parse + remark-gfm → remark-rehype (raw HTML disabled) → rehype-sanitize
+ * (default schema: strips scripts, event handlers, javascript:/data: URLs) → stringify.
+ *
+ * Unlike `./md.ts` this module has no node-only imports, so it is safe for the studio
+ * bundle. It intentionally produces an HTML *string*, not Jx nodes — use
+ * `@jxsuite/parser/markdown` for markdown → Jx document transpilation.
+ *
+ * @module @jxsuite/parser/md-html
+ * @license MIT
+ */
+
+import rehypeSanitize from "rehype-sanitize";
+import rehypeStringify from "rehype-stringify";
+import remarkGfm from "remark-gfm";
+import remarkParse from "remark-parse";
+import remarkRehype from "remark-rehype";
+import { unified } from "unified";
+
+/**
+ * Minimal structural surface of the unified processor used here — same rationale as
+ * `UnifiedProcessor` in ./types.ts (oxlint sees the ESM-only unified types as `any`), plus
+ * `processSync` which the shared type doesn't carry.
+ */
+interface MdHtmlProcessor {
+  use: (plugin: unknown, ...options: unknown[]) => MdHtmlProcessor;
+  processSync: (source: string) => { toString: () => string };
+}
+
+const processor = (unified as unknown as () => MdHtmlProcessor)()
+  .use(remarkParse)
+  .use(remarkGfm)
+  .use(remarkRehype)
+  .use(rehypeSanitize)
+  .use(rehypeStringify);
+
+/**
+ * Convert markdown source to a sanitized HTML string (GFM tables/strikethrough/task lists
+ * supported). Raw HTML in the source is dropped, not passed through.
+ *
+ * @param {string} markdown
+ * @returns {string}
+ */
+export function markdownToHtml(markdown: string): string {
+  return String(processor.processSync(markdown));
+}