@urbicon-ui/blocks 6.35.0 → 6.37.0

package/dist/components/Chat/markdown/repair.js

@@ -0,0 +1,337 @@
+/**
+ * Streaming tail repair — the "remend" step for the incremental markdown engine.
+ *
+ * The incremental parser calls {@link repairMarkdownTail} on the *unsettled tail*
+ * of the stream before parsing it, so half-arrived syntax renders as its settled
+ * form instead of flickering (a dangling `**bold` shows as bold immediately, not
+ * as two literal asterisks that vanish on the next chunk).
+ *
+ * Hard invariant: on text that already ends in complete syntax the function is an
+ * exact no-op (returns the input unchanged). That is what keeps the streamed end
+ * state identical to a one-shot parse of the full source. The function is also
+ * idempotent — `repairMarkdownTail(repairMarkdownTail(x)) === repairMarkdownTail(x)`.
+ *
+ * Scope: this operates on the CommonMark/GFM subset the engine renders. Raw HTML
+ * is plain text here (no tag balancing), and `$$` math is ordinary text — neither
+ * is repaired. Open fenced code blocks are left entirely untouched so the block
+ * parser can keep rendering them as an open code block.
+ */
+// ── Character classes ────────────────────────────────────────────────────────
+function isWs(ch) {
+    // Undefined = start/end of string, which flanking rules treat as whitespace.
+    return (ch === undefined ||
+        ch === ' ' ||
+        ch === '\t' ||
+        ch === '\n' ||
+        ch === '\r' ||
+        ch === '\f' ||
+        ch === '\v');
+}
+/** ASCII punctuation (the CommonMark flanking set; sufficient for this subset). */
+function isPunct(ch) {
+    if (ch === undefined)
+        return false;
+    const c = ch.charCodeAt(0);
+    return ((c >= 0x21 && c <= 0x2f) ||
+        (c >= 0x3a && c <= 0x40) ||
+        (c >= 0x5b && c <= 0x60) ||
+        (c >= 0x7b && c <= 0x7e));
+}
+function runLength(s, i, ch) {
+    let n = 0;
+    while (s[i + n] === ch)
+        n++;
+    return n;
+}
+// ── Fenced code blocks ───────────────────────────────────────────────────────
+const FENCE_OPEN = /^ {0,3}(`{3,}|~{3,})/;
+const FENCE_CLOSE = /^ {0,3}(`{3,}|~{3,})[ \t]*$/;
+/**
+ * Whether the text ends inside an open fenced code block. When it does, the tail
+ * is left verbatim: no marker repair inside the fence, and the fence is not
+ * closed (the block parser renders it as an open code block until the closing
+ * fence streams in).
+ */
+function endsInsideOpenFence(text) {
+    const lines = text.split('\n');
+    let open = null;
+    for (const line of lines) {
+        if (open === null) {
+            const m = FENCE_OPEN.exec(line);
+            if (m)
+                open = { char: m[1][0], len: m[1].length };
+        }
+        else {
+            const m = FENCE_CLOSE.exec(line);
+            if (m && m[1][0] === open.char && m[1].length >= open.len)
+                open = null;
+        }
+    }
+    return open !== null;
+}
+// ── Inline code spans ────────────────────────────────────────────────────────
+/** Index of the next backtick run of *exactly* `len` (a code-span closer), or -1. */
+function findClosingBacktick(s, from, len) {
+    let i = from;
+    while (i < s.length) {
+        if (s[i] === '`') {
+            const run = runLength(s, i, '`');
+            if (run === len)
+                return i;
+            i += run;
+        }
+        else {
+            i++;
+        }
+    }
+    return -1;
+}
+// ── Link / image detection ───────────────────────────────────────────────────
+/** Match the `(` at `open` against its closing `)`, honouring nested parens. */
+function findMatchingParen(s, open) {
+    let depth = 0;
+    for (let i = open; i < s.length; i++) {
+        const c = s[i];
+        if (c === '\\') {
+            i++;
+            continue;
+        }
+        if (c === '(')
+            depth++;
+        else if (c === ')') {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+/** Match the `[` at `open` against its closing `]`, honouring nested brackets. */
+function findClosingBracket(s, open) {
+    let depth = 0;
+    for (let i = open; i < s.length; i++) {
+        const c = s[i];
+        if (c === '\\') {
+            i++;
+            continue;
+        }
+        if (c === '[')
+            depth++;
+        else if (c === ']') {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+function makeDangling(s, bracket) {
+    // A blank line inside the candidate means it is settled literal text (a link
+    // label cannot span a paragraph break), not a half-streamed link.
+    if (s.indexOf('\n\n', bracket) !== -1)
+        return null;
+    const isImage = bracket >= 1 && s[bracket - 1] === '!' && !(bracket >= 2 && s[bracket - 2] === '\\');
+    return { bracket, isImage, markStart: isImage ? bracket - 1 : bracket };
+}
+/**
+ * Find an incomplete link/image whose syntax runs to the end of the text. A
+ * construct is complete once its `](url)` or `][ref]` (or a bare closed `[...]`)
+ * has arrived; anything short of that is dangling.
+ */
+function findDanglingConstruct(s) {
+    let i = 0;
+    let lastOpen = -1;
+    const n = s.length;
+    while (i < n) {
+        const c = s[i];
+        if (c === '\\') {
+            i += 2;
+            continue;
+        }
+        if (c === '`') {
+            const run = runLength(s, i, '`');
+            const close = findClosingBacktick(s, i + run, run);
+            if (close === -1)
+                break; // open code span owns the rest of the string
+            i = close + run;
+            continue;
+        }
+        if (c === '[') {
+            lastOpen = i;
+            i++;
+            continue;
+        }
+        if (c === ']' && lastOpen !== -1) {
+            const j = i + 1;
+            const next = s[j];
+            if (next === '(') {
+                const cp = findMatchingParen(s, j);
+                if (cp === -1)
+                    return makeDangling(s, lastOpen); // `[label](url…`
+                i = cp + 1;
+                lastOpen = -1;
+                continue;
+            }
+            if (next === '[') {
+                const cb = findClosingBracket(s, j);
+                if (cb === -1)
+                    return makeDangling(s, lastOpen); // `[label][ref…`
+                i = cb + 1;
+                lastOpen = -1;
+                continue;
+            }
+            // Closed bracket with no link/ref continuation → complete/plain `[...]`.
+            lastOpen = -1;
+            i = j;
+            continue;
+        }
+        i++;
+    }
+    return lastOpen === -1 ? null : makeDangling(s, lastOpen);
+}
+function extractLabel(s, bracket) {
+    const close = findClosingBracket(s, bracket);
+    return close === -1 ? s.slice(bracket + 1) : s.slice(bracket + 1, close);
+}
+/**
+ * Strip a trailing incomplete link/image. Links keep their label text (which is
+ * then marker-repaired downstream); images are removed whole, since a broken
+ * image placeholder is worse than nothing.
+ */
+function stripDanglingLinkOrImage(text) {
+    const found = findDanglingConstruct(text);
+    if (found === null)
+        return text;
+    if (found.isImage)
+        return text.slice(0, found.markStart);
+    return text.slice(0, found.bracket) + extractLabel(text, found.bracket);
+}
+function flanking(char, before, after) {
+    const leftFlanking = !isWs(after) && (!isPunct(after) || isWs(before) || isPunct(before));
+    const rightFlanking = !isWs(before) && (!isPunct(before) || isWs(after) || isPunct(after));
+    if (char === '_') {
+        // Underscore cannot open/close intra-word (so `snake_case` stays literal).
+        return {
+            canOpen: leftFlanking && (!rightFlanking || isPunct(before)),
+            canClose: rightFlanking && (!leftFlanking || isPunct(after))
+        };
+    }
+    return { canOpen: leftFlanking, canClose: rightFlanking };
+}
+/**
+ * Tokenize inline markers, skipping escapes and closed code spans. `openCode` is
+ * the length of a trailing unclosed backtick run (0 if none); when set, scanning
+ * stops there — everything after an unclosed run is code, not markup.
+ */
+function scanInline(s) {
+    const tokens = [];
+    let openCode = 0;
+    let i = 0;
+    const n = s.length;
+    while (i < n) {
+        const c = s[i];
+        if (c === '\\') {
+            i += 2; // escaped char is literal — the marker after `\` does not count
+            continue;
+        }
+        if (c === '`') {
+            const run = runLength(s, i, '`');
+            const close = findClosingBacktick(s, i + run, run);
+            if (close === -1) {
+                // Only close a backtick that plausibly opens a still-streaming span:
+                // its content is non-empty and on the same line (a lone trailing
+                // backtick, or one with a full prose line after it, is literal in
+                // CommonMark — closing it would break the no-op invariant). Content
+                // ending in a backtick is skipped too, so the appended closer cannot
+                // merge into the run and defeat idempotency.
+                const content = s.slice(i + run);
+                if (content.length > 0 && !content.includes('\n') && content[content.length - 1] !== '`') {
+                    openCode = run;
+                }
+                break;
+            }
+            i = close + run;
+            continue;
+        }
+        if (c === '*' || c === '_' || c === '~') {
+            const run = runLength(s, i, c);
+            // A lone `~` is not a marker — only `~~` is strikethrough.
+            if (c === '~' && run < 2) {
+                i += run;
+                continue;
+            }
+            const { canOpen, canClose } = flanking(c, s[i - 1], s[i + run]);
+            // Normalize `~` runs to a single strike delimiter (length 2).
+            tokens.push({ char: c, len: c === '~' ? 2 : run, canOpen, canClose });
+            i += run;
+            continue;
+        }
+        i++;
+    }
+    return { tokens, openCode };
+}
+/**
+ * Reduce the delimiter run list to the openers still unmatched at the end
+ * (bottom-of-stack first). Closers without a matching opener are left as literal
+ * text; only genuinely open markers are reported.
+ */
+function resolveOpenMarkers(tokens) {
+    const stack = [];
+    for (const tok of tokens) {
+        let remaining = tok.len;
+        if (tok.canClose) {
+            while (remaining > 0) {
+                let idx = -1;
+                for (let k = stack.length - 1; k >= 0; k--) {
+                    if (stack[k].char === tok.char) {
+                        idx = k;
+                        break;
+                    }
+                }
+                if (idx === -1)
+                    break;
+                // Openers stacked above the match cannot pair with this closer.
+                stack.length = idx + 1;
+                const opener = stack[idx];
+                let use = tok.char === '~' ? 2 : opener.remaining >= 2 && remaining >= 2 ? 2 : 1;
+                use = Math.min(use, opener.remaining, remaining);
+                opener.remaining -= use;
+                remaining -= use;
+                if (opener.remaining === 0)
+                    stack.pop();
+            }
+        }
+        if (tok.canOpen && remaining > 0)
+            stack.push({ char: tok.char, remaining });
+    }
+    return stack;
+}
+// ── Public API ───────────────────────────────────────────────────────────────
+function repairInline(text) {
+    const stripped = stripDanglingLinkOrImage(text);
+    const { tokens, openCode } = scanInline(stripped);
+    const openMarkers = resolveOpenMarkers(tokens);
+    if (openCode === 0 && openMarkers.length === 0)
+        return stripped;
+    let out = stripped;
+    // Innermost first: an open code span sits inside any open emphasis, and the
+    // emphasis stack is innermost-at-top.
+    if (openCode > 0)
+        out += '`'.repeat(openCode);
+    for (let k = openMarkers.length - 1; k >= 0; k--) {
+        out += openMarkers[k].char.repeat(openMarkers[k].remaining);
+    }
+    return out;
+}
+/**
+ * Repair the unsettled tail of a streamed markdown source: close unpaired inline
+ * markers and drop half-arrived links/images. A no-op on complete syntax.
+ */
+export function repairMarkdownTail(text) {
+    if (text.length === 0)
+        return text;
+    // Inside an open fence, everything is code — leave it exactly as-is.
+    if (endsInsideOpenFence(text))
+        return text;
+    return repairInline(text);
+}

package/dist/components/Chat/markdown/streaming-harness.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Chunking strategies for the streaming-parser invariant suite.
+ *
+ * Each strategy slices the *same* source text into an append-only chunk
+ * sequence. The union of all strategies is designed to stress the parser's
+ * boundary handling: `per-code-unit` deliberately splits UTF-16 surrogate pairs
+ * (the hardest case — a chunk boundary can land inside a single emoji), while
+ * the seeded strategies exercise arbitrary mid-token cuts reproducibly.
+ *
+ * Determinism is a hard requirement: no `Math.random`, no `Date.now`. The
+ * seeded strategies use a tiny inline LCG so every run produces byte-identical
+ * chunk boundaries.
+ */
+export interface Chunking {
+    name: string;
+    chunks: string[];
+}
+/**
+ * Produce every chunking of `text`. Each strategy self-checks the fundamental
+ * invariant `chunks.join('') === text` before it is returned, so a bug in the
+ * harness surfaces here rather than as a confusing parser mismatch downstream.
+ */
+export declare function chunkings(text: string): Chunking[];

package/dist/components/Chat/markdown/streaming-harness.js

@@ -0,0 +1,62 @@
+/**
+ * Chunking strategies for the streaming-parser invariant suite.
+ *
+ * Each strategy slices the *same* source text into an append-only chunk
+ * sequence. The union of all strategies is designed to stress the parser's
+ * boundary handling: `per-code-unit` deliberately splits UTF-16 surrogate pairs
+ * (the hardest case — a chunk boundary can land inside a single emoji), while
+ * the seeded strategies exercise arbitrary mid-token cuts reproducibly.
+ *
+ * Determinism is a hard requirement: no `Math.random`, no `Date.now`. The
+ * seeded strategies use a tiny inline LCG so every run produces byte-identical
+ * chunk boundaries.
+ */
+/**
+ * Numerical-Recipes LCG. Returns a float in [0, 1). Pure and seedable, so the
+ * "random" chunk sizes are fixed across runs and machines.
+ */
+function makeRng(seed) {
+    let state = seed >>> 0;
+    return () => {
+        state = (Math.imul(state, 1664525) + 1013904223) >>> 0;
+        return state / 0x100000000;
+    };
+}
+/** Split into fixed-size code-unit windows sized by `rng` within [min, max]. */
+function seededChunks(text, min, max, seed) {
+    const rng = makeRng(seed);
+    const chunks = [];
+    let i = 0;
+    const span = max - min + 1;
+    while (i < text.length) {
+        const size = min + Math.floor(rng() * span);
+        chunks.push(text.slice(i, i + size));
+        i += size;
+    }
+    return chunks;
+}
+/** Split at `\n` boundaries, keeping each newline attached to its line. */
+function perLine(text) {
+    const parts = text.split('\n');
+    return parts.map((part, idx) => (idx < parts.length - 1 ? `${part}\n` : part));
+}
+/**
+ * Produce every chunking of `text`. Each strategy self-checks the fundamental
+ * invariant `chunks.join('') === text` before it is returned, so a bug in the
+ * harness surfaces here rather than as a confusing parser mismatch downstream.
+ */
+export function chunkings(text) {
+    const strategies = [
+        { name: 'per-code-unit', chunks: text.split('') },
+        { name: 'tiny-seeded', chunks: seededChunks(text, 2, 8, 0x9e3779b9) },
+        { name: 'medium-seeded', chunks: seededChunks(text, 16, 64, 0x85ebca6b) },
+        { name: 'per-line', chunks: perLine(text) },
+        { name: 'single', chunks: [text] }
+    ];
+    for (const strategy of strategies) {
+        if (strategy.chunks.join('') !== text) {
+            throw new Error(`chunking "${strategy.name}" is not lossless — join !== source`);
+        }
+    }
+    return strategies;
+}

package/dist/components/Chat/markdown/types.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Shared contracts for the streaming markdown engine (AI-Kit P0).
+ *
+ * The engine is a zero-dependency CommonMark/GFM *subset* parser that renders
+ * to a component tree — never to an HTML string. Raw HTML in the source is
+ * treated as plain text by design (see AI-KIT plan, decision A2).
+ *
+ * Streaming model: `createIncrementalParser()` accepts append-only chunks.
+ * Settled blocks keep object identity across appends (Svelte's keyed `{#each}`
+ * then skips re-rendering them); only the unsettled tail is re-parsed per
+ * append, after running `repairMarkdownTail` over it.
+ */
+export type InlineNode = {
+    kind: 'text';
+    text: string;
+} | {
+    kind: 'strong';
+    children: InlineNode[];
+} | {
+    kind: 'em';
+    children: InlineNode[];
+} | {
+    kind: 'strike';
+    children: InlineNode[];
+} | {
+    kind: 'code';
+    text: string;
+} | {
+    kind: 'link';
+    /** Empty string when `blocked` is true — the original URL never reaches the DOM. */
+    href: string;
+    title?: string;
+    children: InlineNode[];
+    /** Set when the URL failed the `MarkdownUrlPolicy`; render as inert text. */
+    blocked?: boolean;
+} | {
+    kind: 'image';
+    /** Empty string when `blocked` is true. */
+    src: string;
+    alt: string;
+    title?: string;
+    blocked?: boolean;
+} | {
+    /** `[id]` / `【id】` citation marker; emitted only for ids in `MarkdownParseOptions.citationIds`. */
+    kind: 'citation';
+    id: string;
+} | {
+    kind: 'break';
+};
+export interface ListItem {
+    children: BlockNode[];
+    /** Task-list state; undefined for ordinary items. */
+    checked?: boolean;
+}
+export type BlockNode = {
+    kind: 'paragraph';
+    children: InlineNode[];
+} | {
+    kind: 'heading';
+    level: 1 | 2 | 3 | 4 | 5 | 6;
+    children: InlineNode[];
+} | {
+    kind: 'code-block';
+    lang?: string;
+    code: string;
+    /** True while the closing fence has not streamed in yet. */
+    open?: boolean;
+} | {
+    kind: 'list';
+    ordered: boolean;
+    start?: number;
+    items: ListItem[];
+} | {
+    kind: 'blockquote';
+    children: BlockNode[];
+} | {
+    kind: 'table';
+    align: ('left' | 'center' | 'right' | null)[];
+    header: InlineNode[][];
+    rows: InlineNode[][][];
+} | {
+    kind: 'hr';
+};
+/**
+ * Top-level block with a stable identity for keyed `{#each}`. Settled blocks
+ * additionally keep referential identity (`===`) across `append()` calls.
+ */
+export type MarkdownBlock = BlockNode & {
+    key: number;
+};
+export interface MarkdownDocument {
+    blocks: MarkdownBlock[];
+    /** Link-reference definitions (`[label]: url "title"`), keys lowercased. */
+    linkRefs: ReadonlyMap<string, {
+        href: string;
+        title?: string;
+    }>;
+}
+export interface MarkdownUrlPolicy {
+    /**
+     * Allowed link protocols (with trailing colon). Relative URLs are always
+     * allowed for links. @default ['http:', 'https:', 'mailto:', 'tel:']
+     */
+    allowedLinkProtocols?: string[];
+    /**
+     * Prefix allowlist for image sources, matched against the normalized
+     * absolute URL. Empty (the default) blocks every external image; relative
+     * sources are allowed. Prefer deep, specific prefixes — broad ones are
+     * open-redirect bait. `data:` images are blocked unless a `data:` prefix
+     * is listed explicitly.
+     * @default []
+     */
+    allowedImagePrefixes?: string[];
+    /** Observability hook — fires once per blocked URL occurrence. */
+    onBlocked?: (kind: 'link' | 'image', url: string) => void;
+}
+export interface MarkdownParseOptions {
+    urlPolicy?: MarkdownUrlPolicy;
+    /**
+     * Ids for which `[id]` / `【id】` markers become `citation` nodes. Markers
+     * with unknown ids stay plain text (so `[1]` in prose is not mangled).
+     */
+    citationIds?: ReadonlySet<string>;
+    /** Recognize bare `https://…` autolinks (GFM-style). @default false */
+    autolink?: boolean;
+}
+export interface IncrementalMarkdownParser {
+    /**
+     * Append a chunk and get the current document. Settled blocks are the same
+     * objects as in the previous call; the tail is freshly parsed from
+     * `repairMarkdownTail(tail)`.
+     */
+    append(chunk: string): MarkdownDocument;
+    /** Current document (same value the last `append` returned). */
+    readonly document: MarkdownDocument;
+    /** Full text received so far. */
+    readonly source: string;
+    reset(): void;
+}

package/dist/components/Chat/markdown/types.js

@@ -0,0 +1,13 @@
+/**
+ * Shared contracts for the streaming markdown engine (AI-Kit P0).
+ *
+ * The engine is a zero-dependency CommonMark/GFM *subset* parser that renders
+ * to a component tree — never to an HTML string. Raw HTML in the source is
+ * treated as plain text by design (see AI-KIT plan, decision A2).
+ *
+ * Streaming model: `createIncrementalParser()` accepts append-only chunks.
+ * Settled blocks keep object identity across appends (Svelte's keyed `{#each}`
+ * then skips re-rendering them); only the unsettled tail is re-parsed per
+ * append, after running `repairMarkdownTail` over it.
+ */
+export {};

package/dist/components/Chat/markdown/url-policy.d.ts

@@ -0,0 +1,33 @@
+import type { MarkdownUrlPolicy } from './types.js';
+/**
+ * URL policy enforcement (decision A4 — strict by default).
+ *
+ * LLM output is untrusted input: prompt-injected markdown links/images are a
+ * proven data-exfiltration channel (query-param payloads to attacker hosts)
+ * even without any script execution. Policy therefore runs on every URL the
+ * parser emits, and blocked URLs never reach the produced node tree — a
+ * blocked link/image carries `blocked: true` and an empty href/src.
+ *
+ * Checks run against the *normalized* absolute URL (WHATWG `URL`), so scheme
+ * tricks (`JaVaScRiPt:`, embedded tabs/newlines, `https:\\host`, `/../`
+ * path escapes against a prefix) are neutralized before matching.
+ */
+export declare const DEFAULT_LINK_PROTOCOLS: string[];
+export type UrlCheck = {
+    ok: true;
+    href: string;
+} | {
+    ok: false;
+};
+/**
+ * Check a link destination. Relative references are always allowed; absolute
+ * URLs must carry an allowed protocol.
+ */
+export declare function checkLinkUrl(raw: string, policy: MarkdownUrlPolicy | undefined): UrlCheck;
+/**
+ * Check an image source. Relative references are allowed (same-origin is not
+ * an exfiltration sink); absolute URLs must match an allowlisted prefix on
+ * the normalized href. The default empty allowlist blocks every external
+ * image — the CamoLeak lesson, and the posture ChatGPT/Copilot converged on.
+ */
+export declare function checkImageUrl(raw: string, policy: MarkdownUrlPolicy | undefined): UrlCheck;