@kortix/ui 0.0.0-stage → 0.14.4

package/dist/markdown/genui/index.js

@@ -0,0 +1,11 @@
+/**
+ * @kortix/ui/genui — Typed UI blocks inside assistant markdown: the block renderer, the
+ * component set, telemetry and copy-as-text.
+ */
+export { GenuiFenceBoundary } from '../code/markdown-code.js';
+export { GenuiTelemetryContext } from './block-telemetry.js';
+export { GenuiPending, webGenuiComponents as genuiComponents } from './components/index.js';
+export { default as GenuiMessageBlock } from './genui-message-block.js';
+export { GenuiBlock } from './sdk.js';
+export { copyGenuiText, genuiCopyText, mayHoldGenui, useGenuiCopyMessages } from './to-markdown.js';
+export { GenuiForceEnabledContext, useGenuiEnabled } from './use-genui-enabled.js';

package/dist/markdown/genui/sdk.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The one apps/web import of `@kortix/sdk/genui/react`. It loads `@openuidev/*`
+ * and `zod`, so it lives only in this feature, which `markdown-code.tsx` reaches
+ * through `lazy()`: the weight stays out of the main bundle. Listed in
+ * CANONICAL_SDK_ENTRIES (`scripts/sdk-boundary.mjs`).
+ */
+import { GenuiBlock, type GenuiBlockEvent, type GenuiComponentMap, type GenuiComponentProps } from '@kortix/sdk/genui/react';
+export { GenuiBlock };
+export type { GenuiBlockEvent, GenuiComponentMap, GenuiComponentProps };
+export type GenuiNode = GenuiComponentProps['node'];

package/dist/markdown/genui/sdk.js

@@ -0,0 +1,9 @@
+/**
+ * The one apps/web import of `@kortix/sdk/genui/react`. It loads `@openuidev/*`
+ * and `zod`, so it lives only in this feature, which `markdown-code.tsx` reaches
+ * through `lazy()`: the weight stays out of the main bundle. Listed in
+ * CANONICAL_SDK_ENTRIES (`scripts/sdk-boundary.mjs`).
+ */
+// eslint-disable-next-line no-restricted-imports -- the generative UI renderer, loaded only in this lazy feature
+import { GenuiBlock } from '@kortix/sdk/genui/react';
+export { GenuiBlock };

package/dist/markdown/genui/to-markdown.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The text a copy or an export writes: every generative UI block replaced by
+ * its markdown, never OpenUI source. The `@kortix/sdk/genui` barrel loads
+ * `@openuidev/*` and `zod`, so it is a dynamic import: text without the word
+ * "openui" returns unchanged and loads nothing, and the session chunk stays
+ * light. Documented beside CANONICAL_SDK_ENTRIES (`scripts/sdk-boundary.mjs`).
+ */
+export declare function genuiCopyText(text: string): Promise<string>;
+/** One block as markdown, for a host that cannot render it (`GenuiFenceBoundary`). Same lazy barrel. */
+export declare function genuiBlockText(code: string, version: number, options: {
+    streaming: boolean;
+}): Promise<string>;
+/**
+ * True when `text` may hold a generative UI block, the only case `genuiCopyText`
+ * changes. The regex mirrors the early return of `genuiToMarkdown` in
+ * `packages/sdk/src/genui/markdown.ts`: keep the two identical.
+ */
+export declare function mayHoldGenui(text: string): boolean;
+/**
+ * Copies `text` as markdown. The clipboard write starts inside the user gesture:
+ * Safari rejects a write that starts after an await, so a block goes through a
+ * `ClipboardItem` whose content resolves once the converter has loaded.
+ */
+export declare function copyGenuiText(text: string): Promise<void>;
+interface CopyPart {
+    type: string;
+    text?: string;
+}
+/**
+ * `messages` with every text part's blocks converted to markdown, each part on its own: a fence one
+ * message never closed ends with that message. Converted as one transcript string, it ran on into
+ * the next turn and took that turn with it. Same lazy barrel as `genuiCopyText`.
+ */
+export declare function genuiCopyMessages<M extends {
+    parts: CopyPart[];
+}>(messages: M[]): Promise<M[]>;
+/**
+ * `messages` converted by `genuiCopyMessages`, for a copy or download that must be ready before the
+ * click. Messages without a block are returned on the first render. Messages with a block are null
+ * until the converter answers, so the caller keeps its actions disabled and never writes OpenUI
+ * source. `onError` runs when the converter fails to load; the result then stays null.
+ */
+export declare function useGenuiCopyMessages<M extends {
+    parts: CopyPart[];
+}>(messages: M[], onError: () => void): M[] | null;
+export {};

package/dist/markdown/genui/to-markdown.js

@@ -0,0 +1,86 @@
+import { useEffect, useRef, useState } from 'react';
+/**
+ * The text a copy or an export writes: every generative UI block replaced by
+ * its markdown, never OpenUI source. The `@kortix/sdk/genui` barrel loads
+ * `@openuidev/*` and `zod`, so it is a dynamic import: text without the word
+ * "openui" returns unchanged and loads nothing, and the session chunk stays
+ * light. Documented beside CANONICAL_SDK_ENTRIES (`scripts/sdk-boundary.mjs`).
+ */
+export async function genuiCopyText(text) {
+    if (!mayHoldGenui(text))
+        return text;
+    const { genuiToMarkdown } = await import('@kortix/sdk/genui');
+    return genuiToMarkdown(text);
+}
+/** One block as markdown, for a host that cannot render it (`GenuiFenceBoundary`). Same lazy barrel. */
+export async function genuiBlockText(code, version, options) {
+    const { genuiBlockToMarkdown } = await import('@kortix/sdk/genui');
+    return genuiBlockToMarkdown(code, version, options);
+}
+/**
+ * True when `text` may hold a generative UI block, the only case `genuiCopyText`
+ * changes. The regex mirrors the early return of `genuiToMarkdown` in
+ * `packages/sdk/src/genui/markdown.ts`: keep the two identical.
+ */
+export function mayHoldGenui(text) {
+    return /openui/i.test(text);
+}
+/**
+ * Copies `text` as markdown. The clipboard write starts inside the user gesture:
+ * Safari rejects a write that starts after an await, so a block goes through a
+ * `ClipboardItem` whose content resolves once the converter has loaded.
+ */
+export function copyGenuiText(text) {
+    if (!mayHoldGenui(text))
+        return navigator.clipboard.writeText(text);
+    if (typeof ClipboardItem !== 'undefined' && navigator.clipboard.write) {
+        const blob = genuiCopyText(text).then((md) => new Blob([md], { type: 'text/plain' }));
+        return navigator.clipboard.write([new ClipboardItem({ 'text/plain': blob })]);
+    }
+    return genuiCopyText(text).then((md) => navigator.clipboard.writeText(md));
+}
+const holdsGenui = (message) => message.parts.some((part) => part.type === 'text' && mayHoldGenui(part.text ?? ''));
+/**
+ * `messages` with every text part's blocks converted to markdown, each part on its own: a fence one
+ * message never closed ends with that message. Converted as one transcript string, it ran on into
+ * the next turn and took that turn with it. Same lazy barrel as `genuiCopyText`.
+ */
+export async function genuiCopyMessages(messages) {
+    if (!messages.some(holdsGenui))
+        return messages;
+    const { genuiToMarkdown } = await import('@kortix/sdk/genui');
+    const convert = (part) => part.type === 'text' && part.text && mayHoldGenui(part.text) ? { ...part, text: genuiToMarkdown(part.text) } : part;
+    return messages.map((message) => (holdsGenui(message) ? { ...message, parts: message.parts.map(convert) } : message));
+}
+/**
+ * `messages` converted by `genuiCopyMessages`, for a copy or download that must be ready before the
+ * click. Messages without a block are returned on the first render. Messages with a block are null
+ * until the converter answers, so the caller keeps its actions disabled and never writes OpenUI
+ * source. `onError` runs when the converter fails to load; the result then stays null.
+ */
+export function useGenuiCopyMessages(messages, onError) {
+    const [converted, setConverted] = useState(null);
+    const onErrorRef = useRef(onError);
+    useEffect(() => {
+        onErrorRef.current = onError;
+    });
+    const needed = messages.some(holdsGenui);
+    useEffect(() => {
+        if (!needed)
+            return;
+        let cancelled = false;
+        genuiCopyMessages(messages).then((result) => {
+            if (!cancelled)
+                setConverted({ source: messages, result });
+        }, () => {
+            if (!cancelled)
+                onErrorRef.current();
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [messages, needed]);
+    if (!needed)
+        return messages;
+    return converted?.source === messages ? converted.result : null;
+}

package/dist/markdown/genui/use-genui-enabled.d.ts

@@ -0,0 +1,4 @@
+/** true renders blocks as UI whatever the preference says. Only the /debug/genui page provides it. */
+export declare const GenuiForceEnabledContext: import("react").Context<boolean>;
+/** The viewer's generative UI preference. Default on. */
+export declare function useGenuiEnabled(): boolean;

package/dist/markdown/genui/use-genui-enabled.js

@@ -0,0 +1,10 @@
+import { createContext, useContext } from 'react';
+import { useUserPreferencesStore } from '../../internal/stores/user-preferences-store.js';
+/** true renders blocks as UI whatever the preference says. Only the /debug/genui page provides it. */
+export const GenuiForceEnabledContext = createContext(false);
+/** The viewer's generative UI preference. Default on. */
+export function useGenuiEnabled() {
+    const forced = useContext(GenuiForceEnabledContext);
+    const preferred = useUserPreferencesStore((s) => s.preferences.genuiEnabled ?? true);
+    return forced || preferred;
+}

package/dist/markdown/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Unified Markdown System
+ *
+ * Single source of truth for all markdown rendering. Every caller states who
+ * wrote the text (`trust`) and, for a markdown file, `variant="document"`;
+ * `markdownPolicy` turns those two facts into what the renderer allows.
+ */
+export { markdownPolicy } from './markdown-policy.js';
+export type { MarkdownPolicy, MarkdownTrust, MarkdownVariant } from './markdown-policy.js';
+export { UnifiedMarkdown } from './unified-markdown.js';
+export type { UnifiedMarkdownProps } from './unified-markdown.js';
+export { CopyOverlay } from './code/index.js';
+export { HighlightedCode } from './code/code-block.js';
+export { CopyButton } from './copy-button.js';
+export { MarkdownWithFrontmatter } from './markdown-frontmatter.js';
+export { languageLabel, normalizeLanguage } from './unified-markdown-utils.js';

package/dist/markdown/index.js

@@ -0,0 +1,14 @@
+/**
+ * Unified Markdown System
+ *
+ * Single source of truth for all markdown rendering. Every caller states who
+ * wrote the text (`trust`) and, for a markdown file, `variant="document"`;
+ * `markdownPolicy` turns those two facts into what the renderer allows.
+ */
+export { markdownPolicy } from './markdown-policy.js';
+export { UnifiedMarkdown } from './unified-markdown.js';
+export { CopyOverlay } from './code/index.js';
+export { HighlightedCode } from './code/code-block.js';
+export { CopyButton } from './copy-button.js';
+export { MarkdownWithFrontmatter } from './markdown-frontmatter.js';
+export { languageLabel, normalizeLanguage } from './unified-markdown-utils.js';

package/dist/markdown/katex-block.d.ts

@@ -0,0 +1,4 @@
+import 'katex/dist/katex.min.css';
+export declare function KaTeXBlock({ math }: {
+    math: string;
+}): import("react").JSX.Element;

package/dist/markdown/katex-block.js

@@ -0,0 +1,25 @@
+'use client';
+import { jsx as _jsx } from "react/jsx-runtime";
+import { KATEX_RENDER_OPTIONS } from './katex-markdown.js';
+import katex from 'katex';
+import 'katex/dist/katex.min.css';
+import { useMemo } from 'react';
+// KaTeX for ```latex / ```tex / ```katex fences (rehype-katex only handles ```math).
+export function KaTeXBlock({ math }) {
+    const rendered = useMemo(() => {
+        try {
+            const html = katex.renderToString(math.trim(), {
+                ...KATEX_RENDER_OPTIONS,
+                displayMode: true,
+            });
+            return { html, error: null };
+        }
+        catch {
+            return { html: null, error: math.trim() };
+        }
+    }, [math]);
+    if (!rendered.html) {
+        return (_jsx("pre", { className: "katex-math-block border-border bg-muted text-muted-foreground my-5 overflow-x-auto rounded-md border px-4 py-3 font-mono text-sm tracking-tight", children: rendered.error }));
+    }
+    return (_jsx("div", { className: "katex-math-block my-5 overflow-x-auto py-3 [&_.katex-display]:!mx-0 [&_.katex-display]:!my-0", dangerouslySetInnerHTML: { __html: rendered.html } }));
+}

package/dist/markdown/katex-markdown.d.ts

@@ -0,0 +1,24 @@
+import type { PluggableList } from 'unified';
+export { escapeCurrencyDollars, KATEX_FENCE_LANGUAGES, normalizeLatexDelimiters, prepareMarkdownForKatex, } from '../_vendor/shared/markdown-math.js';
+/**
+ * Remark plugins for UnifiedMarkdown.
+ * Inline `$…$` math is on; currency amounts are escaped upstream via prepareMarkdownForMath().
+ */
+export declare const katexRemarkPlugins: PluggableList;
+export declare const KATEX_RENDER_OPTIONS: {
+    throwOnError: boolean;
+    errorColor: string;
+    strict: "ignore";
+    maxSize: number;
+    maxExpand: number;
+};
+/**
+ * Build rehype plugins with sanitize BEFORE katex so KaTeX output is not stripped.
+ * Streamdown default order is raw → katex → sanitize → harden (broken for fractions/sqrt).
+ */
+export declare function buildKatexRehypePlugins(includeRaw: boolean): PluggableList;
+export declare const katexRehypePlugins: PluggableList;
+export declare const katexRehypePluginsNoRaw: PluggableList;
+export declare function normalizeClassName(className?: string | string[]): string;
+/** True when a hast/react node belongs to KaTeX output — must not get prose Tailwind overrides. */
+export declare function isKatexClassName(className?: string | string[]): boolean;

package/dist/markdown/katex-markdown.js

@@ -0,0 +1,163 @@
+import { defaultSchema } from 'rehype-sanitize';
+import { defaultRehypePlugins, defaultRemarkPlugins } from 'streamdown';
+// ---------------------------------------------------------------------------
+// KaTeX / LaTeX markdown support for Streamdown
+// ---------------------------------------------------------------------------
+// Streamdown ships remark-math + rehype-katex but:
+//  1. Standard `\(…\)` and `\[…\]` delimiters need normalization to remark-math delimiters.
+//  2. singleDollarTextMath is enabled for `$E = mc^2$` inline math; currency like `$4M` /
+//     `$50K` is escaped to `\$4M` / `\$50K` in prepareMarkdownForMath() before parsing.
+//  3. Default rehype order (raw → katex → sanitize) lets sanitize strip KaTeX SVG/MathML.
+//  4. rehype-sanitize's GitHub schema strips KaTeX output if order regresses.
+// ---------------------------------------------------------------------------
+/** MathML tags KaTeX may emit (keep in sync with KaTeX output, not hand-picked subset). */
+const KATEX_MATHML_TAG_NAMES = [
+    'math',
+    'semantics',
+    'annotation',
+    'mrow',
+    'mi',
+    'mo',
+    'mn',
+    'ms',
+    'mtext',
+    'mspace',
+    'mstyle',
+    'msup',
+    'msub',
+    'msubsup',
+    'mmultiscripts',
+    'mprescripts',
+    'mfrac',
+    'mover',
+    'munder',
+    'munderover',
+    'msqrt',
+    'mroot',
+    'mtable',
+    'mtr',
+    'mtd',
+    'mlabeledtr',
+    'menclose',
+    'merror',
+    'mpadded',
+    'mphantom',
+    'mfenced',
+    'mglyph',
+    'maction',
+    'maligngroup',
+    'malignmark',
+    // SVG elements for sqrt signs, fraction bars, stretchy delimiters, etc.
+    'svg',
+    'path',
+    'line',
+    'g',
+    'rect',
+];
+const katexSanitizeSchema = {
+    ...defaultSchema,
+    // Streamdown's `remend` closes a link whose URL is still streaming as
+    // `[label](streamdown:incomplete-link)`. GitHub's href allowlist strips that
+    // scheme, and rehype-harden then prints `label [blocked]` until the URL
+    // arrives. The `a` renderers turn this one scheme into plain label text
+    // (`isStreamingLinkPlaceholder`), so it never becomes an anchor.
+    protocols: {
+        ...defaultSchema.protocols,
+        href: [...(defaultSchema.protocols?.href || []), 'streamdown'],
+    },
+    tagNames: [...(defaultSchema.tagNames || []), ...KATEX_MATHML_TAG_NAMES],
+    attributes: {
+        ...defaultSchema.attributes,
+        // Raw HTML keeps structure and text, never presentation. This schema is the
+        // only gate on raw HTML from content no Kortix user wrote (scraped pages,
+        // connector tool output, public share transcripts), and a `style` or class
+        // name from that content can place an element over the app. KaTeX output
+        // and code highlighting are produced AFTER this step (`buildKatexRehypePlugins`),
+        // so neither needs `className` or `style` here.
+        '*': [...(defaultSchema.attributes?.['*'] || []), 'aria-hidden'],
+        // The classes remark-math puts on math nodes, which rehype-katex reads
+        // after sanitize, plus GitHub's `language-*` for fenced code.
+        code: [['className', /^language-./, 'math-inline', 'math-display']],
+        math: ['xmlns', 'display'],
+        annotation: ['encoding'],
+        svg: ['xmlns', 'width', 'height', 'viewBox', 'preserveAspectRatio', 'fill', 'stroke'],
+        path: ['d', 'fill', 'stroke', 'strokeWidth', 'stroke-width'],
+        line: ['x1', 'y1', 'x2', 'y2', 'stroke', 'strokeWidth', 'stroke-width'],
+        g: ['fill', 'stroke'],
+        rect: ['x', 'y', 'width', 'height', 'fill', 'stroke'],
+    },
+};
+// Delimiter preparation and math fence languages are shared with apps/mobile.
+export { escapeCurrencyDollars, KATEX_FENCE_LANGUAGES, normalizeLatexDelimiters, prepareMarkdownForKatex, } from '../_vendor/kortix-shared.js';
+/**
+ * Remark plugins for UnifiedMarkdown.
+ * Inline `$…$` math is on; currency amounts are escaped upstream via prepareMarkdownForMath().
+ */
+export const katexRemarkPlugins = Object.entries(defaultRemarkPlugins).map(([key, plugin]) => {
+    if (key === 'math' && Array.isArray(plugin)) {
+        const [mathPlugin, mathOpts] = plugin;
+        return [
+            mathPlugin,
+            { ...(mathOpts || {}), singleDollarTextMath: true },
+        ];
+    }
+    return plugin;
+});
+export const KATEX_RENDER_OPTIONS = {
+    throwOnError: false,
+    errorColor: 'var(--color-muted-foreground)',
+    strict: 'ignore',
+    // Agent-authored math: bound `\rule{99999em}{1em}` and macro blow-ups.
+    maxSize: 20,
+    maxExpand: 200,
+};
+/**
+ * Build rehype plugins with sanitize BEFORE katex so KaTeX output is not stripped.
+ * Streamdown default order is raw → katex → sanitize → harden (broken for fractions/sqrt).
+ */
+export function buildKatexRehypePlugins(includeRaw) {
+    const byKey = {};
+    for (const [key, plugin] of Object.entries(defaultRehypePlugins)) {
+        if (key === 'sanitize' && Array.isArray(plugin)) {
+            byKey[key] = [plugin[0], katexSanitizeSchema];
+        }
+        else if (key === 'katex' && Array.isArray(plugin)) {
+            byKey[key] = [plugin[0], {
+                    ...plugin[1],
+                    maxSize: KATEX_RENDER_OPTIONS.maxSize,
+                    maxExpand: KATEX_RENDER_OPTIONS.maxExpand,
+                }];
+        }
+        else {
+            byKey[key] = plugin;
+        }
+    }
+    const ordered = [];
+    for (const key of ['raw', 'sanitize', 'katex', 'harden']) {
+        if (key === 'raw' && !includeRaw) {
+            delete byKey[key];
+            continue;
+        }
+        if (byKey[key]) {
+            ordered.push(byKey[key]);
+            delete byKey[key];
+        }
+    }
+    for (const plugin of Object.values(byKey))
+        ordered.push(plugin);
+    return ordered;
+}
+export const katexRehypePlugins = buildKatexRehypePlugins(true);
+export const katexRehypePluginsNoRaw = buildKatexRehypePlugins(false);
+export function normalizeClassName(className) {
+    if (!className)
+        return '';
+    return Array.isArray(className) ? className.join(' ') : className;
+}
+/** True when a hast/react node belongs to KaTeX output — must not get prose Tailwind overrides. */
+export function isKatexClassName(className) {
+    const cls = normalizeClassName(className);
+    if (!cls)
+        return false;
+    return /\b(katex|katex-display|katex-html|katex-mathml|katex-error|math-inline|math-display)\b/.test(cls);
+}

package/dist/markdown/markdown-frontmatter.d.ts

@@ -0,0 +1,31 @@
+import React from 'react';
+/**
+ * Minimal YAML frontmatter rendering for markdown files (opencode-style agent
+ * and skill definitions, but generic). The parser handles flat key/value pairs
+ * plus a single level of nested objects — enough for the patterns documented
+ * at https://opencode.ai/docs/agents/ and similar conventions.
+ */
+export type FrontmatterValue = string | Record<string, string>;
+export interface ParsedMarkdown {
+    frontmatter: Record<string, FrontmatterValue> | null;
+    body: string;
+}
+/** Extract a leading `---\n…\n---` frontmatter block. Returns the parsed
+ *  object plus the markdown body. If no block is found, returns the original
+ *  content untouched. */
+export declare function parseFrontmatter(content: string): ParsedMarkdown;
+/**
+ * Render markdown content; if a leading YAML frontmatter block is present, it
+ * renders as a small metadata card above the prose. Used for opencode-style
+ * agent / skill markdown files (and any other frontmatter-prefixed `.md`).
+ */
+export declare function MarkdownWithFrontmatter({ content, className, documentPath, }: {
+    content: string;
+    className?: string;
+    /** The file being rendered, so its relative links resolve against its directory. */
+    documentPath?: string;
+}): React.JSX.Element;
+export declare function MarkdownFrontmatterCard({ data, className, }: {
+    data: Record<string, FrontmatterValue>;
+    className?: string;
+}): React.JSX.Element | null;

package/dist/markdown/markdown-frontmatter.js

@@ -0,0 +1,118 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Badge } from '../primitives/badge.js';
+import { FadedScrollArea } from '../primitives/faded-scroll-area.js';
+import { useTranslations } from '../i18n/index.js';
+import { cn } from '../lib/utils.js';
+import React, { useCallback, useEffect, useLayoutEffect, useRef, useState } from 'react';
+import { UnifiedMarkdown } from './unified-markdown.js';
+/** Extract a leading `---\n…\n---` frontmatter block. Returns the parsed
+ *  object plus the markdown body. If no block is found, returns the original
+ *  content untouched. */
+export function parseFrontmatter(content) {
+    const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
+    if (!match)
+        return { frontmatter: null, body: content };
+    const yaml = match[1];
+    const body = match[2];
+    const result = {};
+    let currentParent = null;
+    for (const rawLine of yaml.split(/\r?\n/)) {
+        // `trimEnd` drops what `/\s+$/` did; the regex retried a whitespace run
+        // inside the line from every position in it (quadratic on V8).
+        const line = rawLine.trimEnd();
+        if (!line.trim() || line.trim().startsWith('#'))
+            continue;
+        // A nested key may be QUOTED, and in the opencode permission idiom it
+        // usually is — `"*": allow`. Matching only [\w.-] dropped that line, left
+        // the parent an empty object, and printed a bare em-dash where the
+        // permissions belong. Wildcards and path-ish keys are accepted bare too.
+        const nested = line.match(/^\s+(?:"([^"]+)"|'([^']+)'|([\w.*/-]+))\s*:\s*(.*)$/);
+        if (nested && currentParent && typeof result[currentParent] === 'object') {
+            const key = nested[1] ?? nested[2] ?? nested[3];
+            result[currentParent][key] = nested[4].trim();
+            continue;
+        }
+        const top = line.match(/^([\w.-]+)\s*:\s*(.*)$/);
+        if (top) {
+            const [, key, value] = top;
+            const trimmed = value.trim();
+            if (!trimmed) {
+                result[key] = {};
+                currentParent = key;
+            }
+            else {
+                result[key] = trimmed;
+                currentParent = null;
+            }
+        }
+    }
+    // Empty nested objects → render as blank string so they don't print "{}"
+    for (const k of Object.keys(result)) {
+        if (typeof result[k] === 'object' && Object.keys(result[k]).length === 0) {
+            result[k] = '';
+        }
+    }
+    return { frontmatter: result, body };
+}
+const VALUE_COLLAPSED_MAX_H = 'max-h-24';
+function ScalarValue({ value }) {
+    // Strip surrounding quotes for display
+    const v = value.replace(/^['"](.*)['"]$/, '$1');
+    return _jsx("span", { className: "text-foreground/90", children: v || '—' });
+}
+function NestedTable({ data }) {
+    const tI18nComplete = useTranslations('hardcodedUi.i18nComplete');
+    const entries = Object.entries(data);
+    if (entries.length === 0)
+        return _jsx("span", { className: "text-muted-foreground/60", children: "\u2014" });
+    return (_jsx("div", { className: "inline-flex flex-wrap gap-x-3 gap-y-1", children: entries.map(([k, v]) => (_jsxs(Badge, { size: "sm", variant: "secondary", className: "gap-1", children: [_jsx("span", { className: "text-muted-foreground/70", children: k }), _jsx("span", { className: "text-muted-foreground/30", children: tI18nComplete.raw('text3b9453dad42b') }), _jsx(ScalarValue, { value: v })] }, k))) }));
+}
+/**
+ * Value cell: capped at `VALUE_COLLAPSED_MAX_H` + fade while collapsed,
+ * with Show more / Show less once the content overflows the cap.
+ */
+function FrontmatterValueBody({ value }) {
+    const tI18nComplete = useTranslations('hardcodedUi.i18nComplete');
+    const [expanded, setExpanded] = useState(false);
+    const [canExpand, setCanExpand] = useState(false);
+    const scrollRef = useRef(null);
+    const body = typeof value === 'string' ? _jsx(ScalarValue, { value: value }) : _jsx(NestedTable, { data: value });
+    const checkOverflow = useCallback(() => {
+        const el = scrollRef.current;
+        if (!el || expanded)
+            return;
+        setCanExpand(el.scrollHeight > el.clientHeight + 1);
+    }, [expanded]);
+    useLayoutEffect(() => {
+        checkOverflow();
+    }, [checkOverflow, value]);
+    useEffect(() => {
+        const el = scrollRef.current;
+        if (!el)
+            return;
+        const ro = new ResizeObserver(checkOverflow);
+        ro.observe(el);
+        window.addEventListener('resize', checkOverflow);
+        return () => {
+            ro.disconnect();
+            window.removeEventListener('resize', checkOverflow);
+        };
+    }, [checkOverflow, value, expanded]);
+    return (_jsxs("div", { className: "min-w-0", children: [expanded ? (_jsx("div", { className: "break-words", children: body })) : (_jsx(FadedScrollArea, { ref: scrollRef, fadeColor: "from-sidebar", rootClassName: cn('h-auto min-w-0', VALUE_COLLAPSED_MAX_H), className: cn('break-words', VALUE_COLLAPSED_MAX_H), children: body })), canExpand ? (_jsx("button", { type: "button", "aria-expanded": expanded, onClick: () => setExpanded((v) => !v), className: cn('text-muted-foreground hover:text-foreground mt-1 inline-flex cursor-pointer items-center', 'origin-left text-xs font-medium transition-[color,transform] duration-150 ease-out active:scale-[0.96]', 'focus-visible:ring-ring/50 rounded-sm focus-visible:ring-2 focus-visible:outline-none'), children: expanded ? tI18nComplete.raw('text94ea9b1d33a0') : tI18nComplete.raw('textf5c9bd131486') })) : null] }));
+}
+/**
+ * Render markdown content; if a leading YAML frontmatter block is present, it
+ * renders as a small metadata card above the prose. Used for opencode-style
+ * agent / skill markdown files (and any other frontmatter-prefixed `.md`).
+ */
+export function MarkdownWithFrontmatter({ content, className, documentPath, }) {
+    const { frontmatter, body } = parseFrontmatter(content);
+    return (_jsxs("div", { className: className, children: [frontmatter && _jsx(MarkdownFrontmatterCard, { data: frontmatter }), _jsx(UnifiedMarkdown, { content: body, trust: "agent", variant: "document", documentPath: documentPath })] }));
+}
+export function MarkdownFrontmatterCard({ data, className, }) {
+    const entries = Object.entries(data);
+    if (entries.length === 0)
+        return null;
+    return (_jsx("div", { className: cn('not-prose border-border bg-sidebar mb-6 rounded-md border px-4 py-3', className), children: _jsx("div", { className: "grid grid-cols-[max-content_1fr] gap-x-4 gap-y-1.5 text-xs leading-relaxed", children: entries.map(([key, value]) => (_jsxs(React.Fragment, { children: [_jsx("span", { className: "text-muted-foreground/70 select-none", children: key }), _jsx(FrontmatterValueBody, { value: value })] }, key))) }) }));
+}

package/dist/markdown/markdown-policy.d.ts

@@ -0,0 +1,48 @@
+/**
+ * What the markdown renderer lets a piece of content do, decided by who wrote
+ * it and how it is shown. `UnifiedMarkdown` reads this and nothing else, so
+ * every caller states both facts and no rendering rule lives at a call site.
+ */
+/**
+ * Who wrote the text. Every caller names one; there is no default.
+ *
+ * - `trusted` — Kortix wrote it: bundled product and marketing copy.
+ * - `agent` — the project's agent or a project member wrote it: messages,
+ *   questions, `show` cards, project files, change-request descriptions.
+ * - `untrusted` — a third party wrote it: scraped pages, tool and connector
+ *   output, marketplace listings from a registry.
+ */
+export type MarkdownTrust = 'trusted' | 'agent' | 'untrusted';
+/**
+ * How the text is shown.
+ *
+ * - `message` — prose. Embedded HTML is parsed (through the sanitizer).
+ * - `document` — a markdown file. Embedded HTML is not parsed: its tags are
+ *   dropped and its text stays, so markup in a file never becomes live DOM.
+ */
+export type MarkdownVariant = 'message' | 'document';
+/**
+ * `load` fetches every image as it renders. `click-to-load` shows a button in
+ * place of an image hosted outside this app and fetches it only on click, so
+ * rendering third-party content never sends a request to a host that content
+ * chose.
+ */
+export type MarkdownRemoteImages = 'load' | 'click-to-load';
+export interface MarkdownPolicy {
+    /** Parse embedded HTML into (sanitized) DOM. */
+    rawHtml: boolean;
+    remoteImages: MarkdownRemoteImages;
+    /**
+     * Turn an agent-minted setup link (`/secret-intake/<token>`,
+     * `/connect/<token>`) into the in-app setup card. Off, it stays a plain link
+     * to the same page.
+     */
+    setupLinks: boolean;
+    /**
+     * Turn a link to a workspace file (`sandbox:/workspace/a.docx`,
+     * `file:///…`, `out/a.docx`) into a file-preview control. Messages only:
+     * in a markdown document a relative link is relative to that file.
+     */
+    fileLinks: boolean;
+}
+export declare function markdownPolicy(trust: MarkdownTrust, variant?: MarkdownVariant): Readonly<MarkdownPolicy>;