@tylertech/forge-ai 0.13.5 → 0.13.6

package/dist/utils/index.mjs

@@ -1,6 +1,7 @@
 import { DeleteThreadController } from "./delete-thread-controller.mjs";
 import { InfiniteScrollController } from "./infinite-scroll-controller.mjs";
 import { KeyboardNavigationController } from "./keyboard-navigation-controller.mjs";
+import { renderInlineMarkdown, renderMarkdown } from "./markdown.mjs";
 import { buildCSVContent, downloadCSV, escapeCSVCell, sanitizeFilename } from "./csv-utils.mjs";
 export {
   DeleteThreadController,
@@ -9,5 +10,7 @@ export {
   buildCSVContent,
   downloadCSV,
   escapeCSVCell,
+  renderInlineMarkdown,
+  renderMarkdown,
   sanitizeFilename
 };

package/dist/utils/markdown.d.ts

@@ -0,0 +1,34 @@
+export interface RenderMarkdownOptions {
+    /**
+     * Whether the content is still being streamed. Streaming content (the
+     * default) is run through markdown-completion repairs that finish partial
+     * syntax as tokens arrive. Complete content (e.g. finalized user messages)
+     * should set this to `false` so those repairs don't mangle intentional text
+     * such as `[text](` into incomplete-link placeholders.
+     */
+    streaming?: boolean;
+}
+/**
+ * Renders markdown content to sanitized HTML.
+ * Handles incomplete syntax in streaming content, and sanitizes the output to remove unsafe tags and attributes.
+ *
+ * Block-level tables and code blocks are wrapped as keyboard-focusable, labeled
+ * horizontal scroll containers (`role="group"` + `tabindex="0"` + `aria-label`)
+ * so keyboard and screen-reader users can reach and scroll overflowing content.
+ * The `role="group"` ensures the `aria-label` is reliably announced. The focus
+ * ring and scrollbar only appear when the content actually overflows (handled in CSS).
+ * @param content The markdown content to render.
+ * @param options Options for rendering, including whether the content is streaming.
+ * @returns The sanitized HTML string.
+ */
+export declare function renderMarkdown(content: string, { streaming }?: RenderMarkdownOptions): string;
+/**
+ * Renders a single line of markdown to sanitized inline HTML (no block-level
+ * wrapping such as `<p>`). Used where the agent may emit bare URLs/emails or
+ * raw `<a>` anchors that should render as clickable links, while leaving
+ * plain values (IDs, codes, formulas) untouched. Sanitization strips unsafe
+ * protocols (e.g. `javascript:`) and disallowed tags/attributes.
+ * @param content The markdown content to render.
+ * @returns The sanitized inline HTML string.
+ */
+export declare function renderInlineMarkdown(content: string): string;

package/dist/utils/markdown.mjs

@@ -0,0 +1,45 @@
+import { marked } from "marked";
+import DOMPurify from "dompurify";
+import remend from "remend";
+const COMPLETE_CONTENT_REMEND_OPTIONS = { links: false, images: false };
+const DOMPURIFY_CONFIG = {
+  FORBID_TAGS: ["script", "style", "iframe", "object", "embed"],
+  FORBID_ATTR: ["onerror", "onload", "onclick", "onmouseover"],
+  ADD_ATTR: ["target", "rel"]
+};
+DOMPurify.addHook("afterSanitizeAttributes", (node) => {
+  if (node.nodeName === "A") {
+    node.setAttribute("target", "_blank");
+    node.setAttribute("rel", "noreferrer noopener");
+  }
+});
+function renderMarkdown(content, { streaming = true } = {}) {
+  const completedMarkdown = remend(content, streaming ? void 0 : COMPLETE_CONTENT_REMEND_OPTIONS);
+  const renderer = new marked.Renderer();
+  const renderTable = renderer.table.bind(renderer);
+  renderer.table = (token) => `<div data-scroll-region="table" role="group" tabindex="0" aria-label="Tabular data">${renderTable(token)}</div>`;
+  const renderCode = renderer.code.bind(renderer);
+  renderer.code = (token) => renderCode(token).replace(
+    /^<pre/,
+    '<pre data-scroll-region="code" role="group" tabindex="0" aria-label="Code block"'
+  );
+  const rawHtml = marked.parse(completedMarkdown, {
+    async: false,
+    gfm: true,
+    breaks: true,
+    renderer
+  });
+  return DOMPurify.sanitize(rawHtml, DOMPURIFY_CONFIG);
+}
+function renderInlineMarkdown(content) {
+  const rawHtml = marked.parseInline(content, {
+    async: false,
+    gfm: true,
+    breaks: true
+  });
+  return DOMPurify.sanitize(rawHtml, DOMPURIFY_CONFIG);
+}
+export {
+  renderInlineMarkdown,
+  renderMarkdown
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tylertech/forge-ai",
-  "version": "0.13.5",
+  "version": "0.13.6",
   "description": "A library of Tyler Forge™ AI chat interface web components.",
   "license": "Apache-2.0",
   "author": "Tyler Technologies, Inc.",