@molecule/app-markdown 1.0.0

package/LICENSE

@@ -0,0 +1,115 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work.
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship.
+
+      "Contribution" shall mean any work of authorship, including the
+      original version of the Work and any modifications or additions
+      to that Work, that is intentionally submitted to the Licensor for
+      inclusion in the Work by the copyright owner or by an individual or
+      Legal Entity authorized to submit on behalf of the copyright owner.
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      patent license to make, have made, use, offer to sell, sell, import,
+      and otherwise transfer the Work.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND.
+
+   8. Limitation of Liability. In no event and under no legal theory shall
+      any Contributor be liable to You for damages.
+
+   9. Accepting Warranty or Additional Liability.
+
+   Copyright 2026 Molecule Dev, Inc.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/dist/index.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Markdown rendering core interface for molecule.dev.
+ *
+ * Provides a standardized API for rendering markdown content into HTML,
+ * with support for GFM and table of contents extraction.
+ * Bond a provider (e.g. `@molecule/app-markdown-react-markdown`) to supply
+ * the concrete implementation.
+ *
+ * @example
+ * ```typescript
+ * import { requireProvider, setProvider } from '@molecule/app-markdown'
+ * import { provider } from '@molecule/app-markdown-react-markdown'
+ *
+ * setProvider(provider) // once, at startup (bonds.ts)
+ *
+ * const result = requireProvider().render('# Hello World', { gfm: true })
+ * console.log(result.html) // sanitized HTML string
+ * ```
+ *
+ * @remarks
+ * - **Wire a bond at startup** — {@link requireProvider} throws until
+ *   `setProvider(provider)` has been called.
+ * - **`sanitize` defaults to `true` and is the XSS gate.** The result is an
+ *   HTML STRING you inject via your framework's raw-HTML mechanism — that is
+ *   only safe because it was sanitized. NEVER pass `sanitize: false` for
+ *   user-supplied or model-generated markdown (chat replies, comments, notes);
+ *   reserve it for fully trusted, app-authored content.
+ * - Options are per-call (`gfm`, `breaks`, `linkTarget`); `result.toc` carries
+ *   extracted headings when the provider supports it. Syntax highlighting is a
+ *   provider concern — e.g. the react-markdown bond wires a rehype highlighter
+ *   via its `rehypePlugins` config rather than a generic option.
+ *
+ * @e2e
+ * Integration checklist — drive the real UI (live preview, no mocks), adapt
+ * each item to this app's actual screens/flows, and check every box off one
+ * by one. A box you can't check is an integration bug to fix — not a skip:
+ * - [ ] Common markdown renders as real HTML wherever the app shows it (chat
+ *   reply, comment, note, README preview): `#`..`######` become `<h1>`..`<h6>`,
+ *   `**bold**` a `<strong>`, `*italic*` an `<em>`, `-`/`1.` lists become
+ *   `<ul>`/`<ol>` of `<li>`, `[text](url)` an `<a>` anchor, and a fenced code
+ *   block a `<pre><code>` — not the raw `*`/backticks shown as literal text.
+ * - [ ] GFM extras render when enabled (`gfm`, default on): a pipe table
+ *   `| a | b |` becomes a real `<table>` with header + rows, and `![alt](src)`
+ *   an `<img>`.
+ * - [ ] The output tracks the source: editing the markdown updates the preview
+ *   live — change a heading's text and its `<h#>` updates; add a list item and
+ *   a new `<li>` appears. No stale or one-shot render.
+ * - [ ] SECURITY (XSS) — user- or model-supplied markdown is sanitized
+ *   (`sanitize`, default on, the XSS gate): markdown containing a raw
+ *   `<script>alert(1)</script>`, an `<img src=x onerror=alert(1)>`, or a
+ *   `[click](javascript:alert(1))` link must NOT execute and must NOT produce
+ *   active markup — the script is stripped, the `onerror` is gone, and the
+ *   link's `href` is neutralized. Verify in the browser: no alert fires, and
+ *   DevTools shows no `<script>`, `onerror`, or `javascript:` in the rendered
+ *   DOM. Never render untrusted content with `sanitize: false`.
+ * - [ ] Malformed markdown degrades gracefully — an unclosed `**`, a broken
+ *   `[link](`, or a half-open code fence renders as readable text and never
+ *   throws, blanks the view, or breaks the surrounding page.
+ *
+ * @module
+ */
+export * from './provider.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,cAAc,eAAe,CAAA;AAC7B,cAAc,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,63 @@
+/**
+ * Markdown rendering core interface for molecule.dev.
+ *
+ * Provides a standardized API for rendering markdown content into HTML,
+ * with support for GFM and table of contents extraction.
+ * Bond a provider (e.g. `@molecule/app-markdown-react-markdown`) to supply
+ * the concrete implementation.
+ *
+ * @example
+ * ```typescript
+ * import { requireProvider, setProvider } from '@molecule/app-markdown'
+ * import { provider } from '@molecule/app-markdown-react-markdown'
+ *
+ * setProvider(provider) // once, at startup (bonds.ts)
+ *
+ * const result = requireProvider().render('# Hello World', { gfm: true })
+ * console.log(result.html) // sanitized HTML string
+ * ```
+ *
+ * @remarks
+ * - **Wire a bond at startup** — {@link requireProvider} throws until
+ *   `setProvider(provider)` has been called.
+ * - **`sanitize` defaults to `true` and is the XSS gate.** The result is an
+ *   HTML STRING you inject via your framework's raw-HTML mechanism — that is
+ *   only safe because it was sanitized. NEVER pass `sanitize: false` for
+ *   user-supplied or model-generated markdown (chat replies, comments, notes);
+ *   reserve it for fully trusted, app-authored content.
+ * - Options are per-call (`gfm`, `breaks`, `linkTarget`); `result.toc` carries
+ *   extracted headings when the provider supports it. Syntax highlighting is a
+ *   provider concern — e.g. the react-markdown bond wires a rehype highlighter
+ *   via its `rehypePlugins` config rather than a generic option.
+ *
+ * @e2e
+ * Integration checklist — drive the real UI (live preview, no mocks), adapt
+ * each item to this app's actual screens/flows, and check every box off one
+ * by one. A box you can't check is an integration bug to fix — not a skip:
+ * - [ ] Common markdown renders as real HTML wherever the app shows it (chat
+ *   reply, comment, note, README preview): `#`..`######` become `<h1>`..`<h6>`,
+ *   `**bold**` a `<strong>`, `*italic*` an `<em>`, `-`/`1.` lists become
+ *   `<ul>`/`<ol>` of `<li>`, `[text](url)` an `<a>` anchor, and a fenced code
+ *   block a `<pre><code>` — not the raw `*`/backticks shown as literal text.
+ * - [ ] GFM extras render when enabled (`gfm`, default on): a pipe table
+ *   `| a | b |` becomes a real `<table>` with header + rows, and `![alt](src)`
+ *   an `<img>`.
+ * - [ ] The output tracks the source: editing the markdown updates the preview
+ *   live — change a heading's text and its `<h#>` updates; add a list item and
+ *   a new `<li>` appears. No stale or one-shot render.
+ * - [ ] SECURITY (XSS) — user- or model-supplied markdown is sanitized
+ *   (`sanitize`, default on, the XSS gate): markdown containing a raw
+ *   `<script>alert(1)</script>`, an `<img src=x onerror=alert(1)>`, or a
+ *   `[click](javascript:alert(1))` link must NOT execute and must NOT produce
+ *   active markup — the script is stripped, the `onerror` is gone, and the
+ *   link's `href` is neutralized. Verify in the browser: no alert fires, and
+ *   DevTools shows no `<script>`, `onerror`, or `javascript:` in the rendered
+ *   DOM. Never render untrusted content with `sanitize: false`.
+ * - [ ] Malformed markdown degrades gracefully — an unclosed `**`, a broken
+ *   `[link](`, or a half-open code fence renders as readable text and never
+ *   throws, blanks the view, or breaks the surrounding page.
+ *
+ * @module
+ */
+export * from './provider.js';
+export * from './types.js';

package/dist/provider.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Markdown provider wiring.
+ *
+ * Delegates to the shared `@molecule/app-bond` registry under the `'markdown'`
+ * category, so `setProvider(provider)` and `bond('markdown', provider)` write
+ * the same slot — either bonds the provider. Bond packages call `setProvider()`
+ * during setup; application code calls `getProvider()` / `requireProvider()` at
+ * runtime.
+ *
+ * @module
+ */
+import type { MarkdownProvider } from './types.js';
+/**
+ * Registers a markdown provider as the active singleton.
+ *
+ * @param provider - The markdown provider implementation to bond.
+ */
+export declare function setProvider(provider: MarkdownProvider): void;
+/**
+ * Retrieves the bonded markdown provider, or `null` if none is bonded.
+ *
+ * @returns The active markdown provider, or `null`.
+ */
+export declare function getProvider(): MarkdownProvider | null;
+/**
+ * Checks whether a markdown provider has been bonded.
+ *
+ * @returns `true` if a markdown provider is available.
+ */
+export declare function hasProvider(): boolean;
+/**
+ * Retrieves the bonded markdown provider, throwing if none is configured.
+ *
+ * @returns The active markdown provider.
+ * @throws {Error} if no provider has been bonded.
+ */
+export declare function requireProvider(): MarkdownProvider;
+//# sourceMappingURL=provider.d.ts.map

package/dist/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAIlD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,CAE5D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,gBAAgB,GAAG,IAAI,CAErD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,OAAO,CAErC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAMlD"}

package/dist/provider.js

@@ -0,0 +1,50 @@
+/**
+ * Markdown provider wiring.
+ *
+ * Delegates to the shared `@molecule/app-bond` registry under the `'markdown'`
+ * category, so `setProvider(provider)` and `bond('markdown', provider)` write
+ * the same slot — either bonds the provider. Bond packages call `setProvider()`
+ * during setup; application code calls `getProvider()` / `requireProvider()` at
+ * runtime.
+ *
+ * @module
+ */
+import { bond, get, isBonded } from '@molecule/app-bond';
+const BOND_TYPE = 'markdown';
+/**
+ * Registers a markdown provider as the active singleton.
+ *
+ * @param provider - The markdown provider implementation to bond.
+ */
+export function setProvider(provider) {
+    bond(BOND_TYPE, provider);
+}
+/**
+ * Retrieves the bonded markdown provider, or `null` if none is bonded.
+ *
+ * @returns The active markdown provider, or `null`.
+ */
+export function getProvider() {
+    return get(BOND_TYPE) ?? null;
+}
+/**
+ * Checks whether a markdown provider has been bonded.
+ *
+ * @returns `true` if a markdown provider is available.
+ */
+export function hasProvider() {
+    return isBonded(BOND_TYPE);
+}
+/**
+ * Retrieves the bonded markdown provider, throwing if none is configured.
+ *
+ * @returns The active markdown provider.
+ * @throws {Error} if no provider has been bonded.
+ */
+export function requireProvider() {
+    const provider = get(BOND_TYPE);
+    if (!provider) {
+        throw new Error('Markdown provider not configured. Bond a markdown provider first.');
+    }
+    return provider;
+}

package/dist/types.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Markdown rendering types for molecule.dev.
+ *
+ * Defines the provider interface and configuration options for
+ * rendering markdown content into HTML with optional features
+ * like GFM support and table of contents extraction.
+ *
+ * @module
+ */
+/**
+ * Table of contents entry extracted from markdown headings.
+ */
+export interface TocEntry {
+    /** Unique identifier for the heading (slug). */
+    id: string;
+    /** Text content of the heading. */
+    text: string;
+    /** Heading level (1-6). */
+    level: number;
+}
+/**
+ * Result of rendering markdown content.
+ */
+export interface RenderedMarkdown {
+    /** The rendered HTML string. */
+    html: string;
+    /** Optional table of contents extracted from headings. */
+    toc?: TocEntry[];
+}
+/**
+ * Options for markdown rendering.
+ */
+export interface MarkdownOptions {
+    /** Whether to sanitize the rendered HTML to prevent XSS. Defaults to `true`. */
+    sanitize?: boolean;
+    /** Whether to enable GitHub Flavored Markdown extensions. Defaults to `true`. */
+    gfm?: boolean;
+    /** Whether to convert line breaks to `<br>` elements. Defaults to `false`. */
+    breaks?: boolean;
+    /** Custom component overrides keyed by HTML element name. */
+    components?: Record<string, unknown>;
+    /** Target attribute for rendered links. */
+    linkTarget?: '_blank' | '_self';
+}
+/**
+ * Markdown rendering provider interface.
+ *
+ * All markdown providers must implement this interface to render
+ * markdown strings into HTML output with optional features.
+ */
+export interface MarkdownProvider {
+    /** Provider name identifier. */
+    readonly name: string;
+    /**
+     * Renders a markdown string into HTML.
+     *
+     * @param markdown - The markdown source string to render.
+     * @param options - Optional rendering configuration.
+     * @returns The rendered HTML and optional table of contents.
+     */
+    render(markdown: string, options?: MarkdownOptions): RenderedMarkdown;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAA;IAEV,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAA;IAEZ,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAA;IAEZ,0DAA0D;IAC1D,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,OAAO,CAAA;IAElB,iFAAiF;IACjF,GAAG,CAAC,EAAE,OAAO,CAAA;IAEb,8EAA8E;IAC9E,MAAM,CAAC,EAAE,OAAO,CAAA;IAEhB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAEpC,2CAA2C;IAC3C,UAAU,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB;;;;;;OAMG;IACH,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,gBAAgB,CAAA;CACtE"}

package/dist/types.js

@@ -0,0 +1,10 @@
+/**
+ * Markdown rendering types for molecule.dev.
+ *
+ * Defines the provider interface and configuration options for
+ * rendering markdown content into HTML with optional features
+ * like GFM support and table of contents extraction.
+ *
+ * @module
+ */
+export {};

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@molecule/app-markdown",
+  "version": "1.0.0",
+  "description": "",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "molecule",
+    "markdown"
+  ],
+  "license": "Apache-2.0",
+  "peerDependencies": {
+    "@molecule/app-bond": "^1.0.0"
+  },
+  "devDependencies": {
+    "@molecule/app-bond": "1.0.0",
+    "@types/node": "26.1.2",
+    "typescript": "6.0.3",
+    "vitest": "4.1.10"
+  }
+}