basalt-ui 1.10.0 → 1.12.0

package/dist/content/fence-block.d.ts

@@ -1,19 +1,46 @@
+import type { ReactNode } from 'react';
+import type { Element } from 'hast';
+export type FenceRenderContext = {
+    /** The fence body, without the surrounding fence markers. */
+    readonly code: string;
+    /** The info string's first word (` ```ts title="x" ` → `'ts'`), absent on a bare fence. */
+    readonly language?: string;
+    /** Raw meta string after the language on the opening fence line (`'title="x"'` above). */
+    readonly meta?: string;
+    /** Parsed `title="…"` out of `meta` — the filename tab `CodeBlock` renders. */
+    readonly title?: string;
+    /** `false` only for the in-flight tail block of a streaming message. Monotone: never true→false. */
+    readonly settled: boolean;
+};
 /**
- * FenceBlock — renders a fenced code block's hast `pre` node as `CodeBlock` or `MermaidDiagram`
- * (docs/CONTENT-SPEC.md §2 decision 4 / §6). Shared by every `pre` override `./markdown` builds
- * (one per streamed block, each with its own `settled` flag).
+ * `undefined` DECLINES — the fence falls back to the default `CodeBlock` rendering, no different
+ * from an unclaimed language. `null` is NOT a decline; it is a deliberate "render nothing" result
+ * and is used as-is. A renderer that THROWS is also contained and falls back to `CodeBlock` (see the
+ * module doc above) — no renderer needs its own try/parse/fallback scaffolding to survive malformed,
+ * model-authored fence bodies.
+ */
+export type FenceRenderer = (ctx: FenceRenderContext) => ReactNode;
+/** Fence renderers keyed by language. */
+export type FenceRenderers = Readonly<Record<string, FenceRenderer>>;
+/**
+ * Wraps a renderer that is only worth running on finished text: renders the plain `CodeBlock`
+ * while the fence is still streaming, then `render` once its block settles. The built-in `mermaid`
+ * entry IS this — a consumer's own heavyweight fence (a chart spec, a diagram DSL) wants the same
+ * deal.
  *
- * `mermaid` fences render as a plain `CodeBlock` while `settled` is `false` (the in-flight
- * streaming tail) and upgrade to `MermaidDiagram` once the fence's block settles — no flicker, no
- * wasted parse pass on a still-changing diagram. Every other fenced language hides its copy
- * action while unsettled for the same reason (copying a still-streaming block is misleading).
+ * @example
+ * import { settledOnly } from 'basalt-ui/content'
  *
- * Not part of the public surface.
+ * <Markdown fenceRenderers={{ vega: settledOnly(({ code }) => <VegaChart spec={code} />) }}>
  */
-import type { Element } from 'hast';
+export declare function settledOnly(render: FenceRenderer): FenceRenderer;
+/** basalt's own fence renderers. A consumer entry for the same key wins over these. */
+export declare const BUILT_IN_FENCE_RENDERERS: FenceRenderers;
 export type FenceBlockProps = {
     readonly node?: Element;
     readonly settled: boolean;
+    /** Consumer overrides, consulted BEFORE `BUILT_IN_FENCE_RENDERERS`. */
+    readonly renderers?: FenceRenderers;
 };
-export declare function FenceBlock({ node, settled }: FenceBlockProps): import("react").JSX.Element | null;
+export declare function FenceBlock({ node, settled, renderers }: FenceBlockProps): import("react").JSX.Element | null;
 //# sourceMappingURL=fence-block.d.ts.map

package/dist/content/fence-block.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fence-block.d.ts","sourceRoot":"","sources":["../../src/content/fence-block.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAKnC,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,wBAAgB,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,eAAe,sCAgB5D"}
+{"version":3,"file":"fence-block.d.ts","sourceRoot":"","sources":["../../src/content/fence-block.tsx"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAA;AACtC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAOnC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,+EAA+E;IAC/E,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,oGAAoG;IACpG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,kBAAkB,KAAK,SAAS,CAAA;AAElE,yCAAyC;AACzC,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;AAYpE;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,aAAa,CAEhE;AAED,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,EAAE,cAEtC,CAAA;AAiBD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,uEAAuE;IACvE,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAA;CACpC,CAAA;AA2HD,wBAAgB,UAAU,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,eAAe,sCA2BvE"}

package/dist/content/fence-block.js

@@ -1,23 +1,89 @@
 import { jsx } from "react/jsx-runtime";
+import { Component, useRef } from "react";
 import { CodeBlock } from "./code-block.js";
 import { extractFenceInfo } from "./markdown-hast.js";
 import { MermaidDiagram } from "./mermaid.js";
-function FenceBlock({ node, settled }) {
-  const fence = node ? extractFenceInfo(node) : void 0;
-  if (!fence) return null;
-  if (fence.language === "mermaid" && settled) {
-    return /* @__PURE__ */ jsx(MermaidDiagram, { code: fence.code });
+const defaultFenceRenderer = ({ code, language, title, settled }) => /* @__PURE__ */ jsx(
+  CodeBlock,
+  {
+    code,
+    showCopy: settled,
+    ...language !== void 0 && { language },
+    ...title !== void 0 && { title }
   }
-  return /* @__PURE__ */ jsx(
-    CodeBlock,
-    {
-      code: fence.code,
-      showCopy: settled,
-      ...fence.language !== void 0 && { language: fence.language },
-      ...fence.title !== void 0 && { title: fence.title }
-    }
+);
+function settledOnly(render) {
+  return (ctx) => ctx.settled ? render(ctx) : defaultFenceRenderer(ctx);
+}
+const BUILT_IN_FENCE_RENDERERS = {
+  mermaid: settledOnly(({ code }) => /* @__PURE__ */ jsx(MermaidDiagram, { code }))
+};
+function extractFenceMeta(preNode) {
+  const codeNode = preNode.children.find(
+    (child) => child.type === "element" && child.tagName === "code"
   );
+  const data = codeNode?.data;
+  return data?.meta;
+}
+function lookupFenceRenderer(registry, language) {
+  if (registry === void 0 || !Object.hasOwn(registry, language)) return void 0;
+  const candidate = registry[language];
+  return typeof candidate === "function" ? candidate : void 0;
+}
+function warnFenceRendererThrew(warned, error) {
+  if (warned.current) return;
+  warned.current = true;
+  if (process.env["NODE_ENV"] !== "production") {
+    console.warn(
+      "[basalt] FenceBlock: a fence renderer threw \u2014 falling back to the default CodeBlock rendering.",
+      error
+    );
+  }
+}
+function renderFenceSafely(render, ctx, warned) {
+  let rendered;
+  try {
+    rendered = render(ctx);
+  } catch (error) {
+    warnFenceRendererThrew(warned, error);
+    return defaultFenceRenderer(ctx);
+  }
+  return rendered === void 0 ? defaultFenceRenderer(ctx) : rendered;
+}
+class FenceRenderBoundary extends Component {
+  constructor(props) {
+    super(props);
+    this.state = { hasError: false };
+  }
+  static getDerivedStateFromError() {
+    return { hasError: true };
+  }
+  componentDidCatch(error) {
+    warnFenceRendererThrew(this.props.warned, error);
+  }
+  render() {
+    return this.state.hasError ? defaultFenceRenderer(this.props.ctx) : this.props.children;
+  }
+}
+function FenceBlock({ node, settled, renderers }) {
+  const warned = useRef(false);
+  const fence = node ? extractFenceInfo(node) : void 0;
+  if (!fence) return null;
+  const meta = node ? extractFenceMeta(node) : void 0;
+  const ctx = {
+    code: fence.code,
+    settled,
+    ...fence.language !== void 0 && { language: fence.language },
+    ...fence.title !== void 0 && { title: fence.title },
+    ...meta !== void 0 && { meta }
+  };
+  const language = fence.language;
+  const render = language === void 0 ? void 0 : lookupFenceRenderer(renderers, language) ?? lookupFenceRenderer(BUILT_IN_FENCE_RENDERERS, language);
+  const active = render ?? defaultFenceRenderer;
+  return /* @__PURE__ */ jsx(FenceRenderBoundary, { ctx, warned, children: renderFenceSafely(active, ctx, warned) }, ctx.code);
 }
 export {
-  FenceBlock
+  BUILT_IN_FENCE_RENDERERS,
+  FenceBlock,
+  settledOnly
 };

package/dist/content/heading-components.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"heading-components.d.ts","sourceRoot":"","sources":["../../src/content/heading-components.tsx"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,gBAAgB,CAAA;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAqCzC,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CASjF"}
+{"version":3,"file":"heading-components.d.ts","sourceRoot":"","sources":["../../src/content/heading-components.tsx"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,gBAAgB,CAAA;AAC5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AA8CzC,yFAAyF;AACzF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CASjF"}

package/dist/content/heading-components.js

@@ -18,11 +18,14 @@ function headingText(node) {
 }
 function createHeadingRenderer(level, tracker) {
   const Tag = HEADING_TAGS[level];
-  return function HeadingRenderer({ children }) {
-    const id = tracker.slug(headingText(children));
-    return /* @__PURE__ */ jsxs(Tag, { id, children: [
+  return function HeadingRenderer({ id, children, node: _node, ...rest }) {
+    if (id !== void 0) {
+      return /* @__PURE__ */ jsx(Tag, { id, ...rest, children });
+    }
+    const slug = tracker.slug(headingText(children));
+    return /* @__PURE__ */ jsxs(Tag, { id: slug, ...rest, children: [
       children,
-      /* @__PURE__ */ jsx(HeadingAnchor, { id })
+      /* @__PURE__ */ jsx(HeadingAnchor, { id: slug })
     ] });
   };
 }

package/dist/content/heading-components.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=heading-components.test.d.ts.map

package/dist/content/heading-components.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"heading-components.test.d.ts","sourceRoot":"","sources":["../../src/content/heading-components.test.tsx"],"names":[],"mappings":""}

package/dist/content/index.d.ts

@@ -4,7 +4,8 @@
  * Mantine-coupled (like `./forms`/`./notifications`/`./data`): prose typography, a shiki-backed
  * code block (optional peer, lazy singleton), a semantic callout, a scroll-spy TOC rail, a
  * scroll-driven reading-progress bar, a streaming-aware `Markdown` renderer (react-markdown +
- * remark-gfm, optional peers), `MermaidDiagram` (beautiful-mermaid, optional peer), the MDX
+ * remark-gfm + rehype-sanitize + remend, all optional peers) with its fence-renderer registry,
+ * `MermaidDiagram` (beautiful-mermaid, optional peer), the MDX
  * component map, the docs-page frame (`ArticleLayout`), overview cards (`ArticleCard`/
  * `ArticleGrid`), and the contextual-help drawer (`GuideLink`/`GuideDrawer`). See
  * `agent/rules/basalt-content.md` for the full doctrine + the content-collections recipe.
@@ -23,8 +24,10 @@ export { headingSlug, readingTime, SlugTracker } from './slug.js';
 export type { ReadingTime } from './slug.js';
 export { HeadingAnchor } from './heading-anchor.js';
 export type { HeadingAnchorProps } from './heading-anchor.js';
-export { Markdown } from './markdown.js';
-export type { MarkdownComponents, MarkdownProps } from './markdown.js';
+export { Markdown, settledOnly } from './markdown.js';
+export type { FenceRenderContext, FenceRenderer, FenceRenderers, MarkdownComponents, MarkdownContentTrust, MarkdownProps, } from './markdown.js';
+export { BASALT_SANITIZE_SCHEMA, mergeSanitizeSchema } from './sanitize.js';
+export type { SanitizePropertyDefinition, SanitizeSchema, SanitizeSchemaExtension, SanitizeSchemaInput, } from './sanitize.js';
 export { MermaidDiagram } from './mermaid.js';
 export type { MermaidDiagramProps } from './mermaid.js';
 export { blockSplit } from './block-split.js';

package/dist/content/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/content/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAA;AACvC,YAAY,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAE9D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAC9D,YAAY,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AACrC,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAEnE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,YAAY,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAE1C,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAC1D,YAAY,EAAE,0BAA0B,EAAE,MAAM,OAAO,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE/F,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACzD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAExE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACjF,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAEjE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/content/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAElD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,OAAO,CAAA;AACvC,YAAY,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAE9D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAC9D,YAAY,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,YAAY,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAClD,YAAY,EACV,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,GACd,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AACxE,YAAY,EACV,0BAA0B,EAC1B,cAAc,EACd,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAC1C,YAAY,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAE1C,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,OAAO,CAAA;AAC1D,YAAY,EAAE,0BAA0B,EAAE,MAAM,OAAO,CAAA;AAEvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAE/F,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACzD,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAExE,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AACjF,YAAY,EAAE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAEhF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAEjE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAChD,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA"}

package/dist/content/index.js

@@ -5,7 +5,8 @@ import { TableOfContents } from "./toc.js";
 import { ReadingProgress } from "./reading-progress.js";
 import { headingSlug, readingTime, SlugTracker } from "./slug.js";
 import { HeadingAnchor } from "./heading-anchor.js";
-import { Markdown } from "./markdown.js";
+import { Markdown, settledOnly } from "./markdown.js";
+import { BASALT_SANITIZE_SCHEMA, mergeSanitizeSchema } from "./sanitize.js";
 import { MermaidDiagram } from "./mermaid.js";
 import { blockSplit } from "./block-split.js";
 import { createMdxComponents, mdxComponents } from "./mdx.js";
@@ -20,6 +21,7 @@ export {
   ArticleFilterBar,
   ArticleGrid,
   ArticleLayout,
+  BASALT_SANITIZE_SCHEMA,
   Callout,
   CodeBlock,
   GuideDrawer,
@@ -37,7 +39,9 @@ export {
   formatArticleDate,
   headingSlug,
   mdxComponents,
+  mergeSanitizeSchema,
   readingTime,
+  settledOnly,
   sortArticles,
   toArticleActions
 };

package/dist/content/markdown.d.ts

@@ -5,15 +5,26 @@
  * `agent/**` deliberately ships no renderer of its own, since `agent/** -> content` is
  * lint-blocked by design.
  *
- * LAZY-LOADED: react-markdown and remark-gfm are OPTIONAL peers, loaded via `React.lazy` + dynamic
- * `import()` (mirrors `agent/streaming-markdown.tsx` and `./highlighter`) — importing
- * `basalt-ui/content` never eagerly resolves them. Without them installed, `Markdown` renders the
- * raw string as plain text.
+ * LAZY-LOADED: react-markdown, remark-gfm, rehype-sanitize and remend are all OPTIONAL peers,
+ * loaded via `React.lazy` / dynamic `import()` (mirrors `agent/streaming-markdown.tsx` and
+ * `./highlighter`) — importing `basalt-ui/content` never eagerly resolves any of them. Without
+ * react-markdown or remark-gfm, `Markdown` renders the raw string as plain text; without
+ * rehype-sanitize the sanitize pass is skipped (dev-warned once); without remend the streaming
+ * tail renders unrepaired.
+ *
+ * SANITIZATION: basalt appends its own `rehype-sanitize` pass AFTER the consumer's `rehypePlugins`
+ * — plugin order in unified is registration order, so last is the only position nothing can
+ * outrun. `sanitizeSchema` is an ADDITIONS-only extension merged over `BASALT_SANITIZE_SCHEMA`
+ * (see `./sanitize`); removing a default allowance is deliberately not expressible.
+ *
+ * TRUST vs STREAMING: `streaming` is a rendering mode (the text is still arriving); `contentTrust`
+ * is the security input (where the text came from). They are independent — a FINISHED agent message
+ * is settled AND untrusted. Only `contentTrust` selects the image allowlist default.
  *
  * Default element overrides:
  *  - `h1`..`h6` — slugged + hover-anchored (`./heading-components`).
- *  - fenced code (`pre`) — `CodeBlock`, or `MermaidDiagram` for a settled ` ```mermaid ` fence
- *    (`./fence-block`).
+ *  - fenced code (`pre`) — the fence-renderer registry (`./fence-block`): `fenceRenderers[lang]`,
+ *    then the built-ins (a settled ` ```mermaid ` fence → `MermaidDiagram`), then `CodeBlock`.
  *  - `blockquote` — a GFM alert marker (`[!NOTE]` etc.) renders as `Callout`; otherwise passes
  *    through (`./callout-alert`).
  *  - `a`/`img` — hardened via `allowedLinkPrefixes`/`allowedImagePrefixes`/`defaultOrigin`
@@ -32,12 +43,23 @@
  * import { Markdown } from 'basalt-ui/content'
  *
  * <Markdown>{articleMarkdown}</Markdown>
- * <Markdown density="chat" streaming allowedLinkPrefixes={['https://']}>{streamedText}</Markdown>
+ * <Markdown density="chat" streaming contentTrust="untrusted">{streamedText}</Markdown>
+ * <Markdown fenceRenderers={{ vega: settledOnly(({ code }) => <VegaChart spec={code} />) }}>
  */
 import type { CSSProperties, JSX } from 'react';
 import type { Components } from 'react-markdown';
+import type { FenceRenderers } from './fence-block.js';
 import type { ProseDensity } from './prose.js';
+import type { SanitizeSchemaExtension, SanitizeSchemaInput } from './sanitize.js';
 export type MarkdownComponents = Components;
+export { settledOnly } from './fence-block.js';
+export type { FenceRenderContext, FenceRenderer, FenceRenderers } from './fence-block.js';
+/**
+ * Provenance of a `Markdown` body — the ONLY input to the image-allowlist default. Deliberately not
+ * a boolean: `contentTrust="untrusted"` says at the call site what it means, where `untrusted` /
+ * `!trusted` would not.
+ */
+export type MarkdownContentTrust = 'trusted' | 'untrusted';
 export type MarkdownProps = {
     /** The markdown string to render. Safe to update on every character during streaming. */
     readonly children: string;
@@ -45,24 +67,89 @@ export type MarkdownProps = {
     readonly density?: ProseDensity;
     /** `Prose`'s measure cap. Defaults to `true` for `'article'` density, `false` for `'chat'`. */
     readonly measure?: boolean;
-    /** AI-stream mode — block-split + memoize + `remend`-repair the in-flight tail. Default `false`. */
+    /** AI-stream mode — block-split + memoize + `remend`-repair the in-flight tail. Default `false`.
+     * Purely a RENDERING mode: it says the text is still arriving, NOT that it is untrusted. Use
+     * `contentTrust` for the security policy. */
     readonly streaming?: boolean;
-    /** Per-element overrides merged OVER the defaults (only the keys you supply are replaced). */
+    /**
+     * Where `children` came from — the input to the image policy, independent of `streaming`.
+     * `'untrusted'` (model-generated or third-party markdown) drops the `allowedImagePrefixes`
+     * default to same-origin `['/']`; `'trusted'` (your own authored content) keeps
+     * `['https://', '/']`. An explicit `allowedImagePrefixes` always wins over both.
+     *
+     * Default: `'untrusted'` when `streaming` is set, `'trusted'` otherwise. That default only
+     * preserves the pre-1.12 fail-safe — it is NOT the policy. Settledness has nothing to do with
+     * trust: a FINISHED agent message is still model-generated, so any surface rendering agent text
+     * must pin `contentTrust="untrusted"` explicitly rather than lean on `streaming`.
+     */
+    readonly contentTrust?: MarkdownContentTrust;
+    /**
+     * Per-element overrides merged OVER the defaults (only the keys you supply are replaced).
+     *
+     * A CUSTOM tag admitted via `sanitizeSchema.tagNames` (e.g. `'x-callout'`) cannot be given an
+     * override here: react-markdown's `Components` type is a mapped type over `JSX.IntrinsicElements`,
+     * which only has entries for real HTML/SVG tags — a made-up tag name is not a valid key of it, so
+     * there is no override slot for it to occupy. Style such a tag with CSS (element/attribute
+     * selectors) or a wrapping component instead of trying to intercept it here.
+     */
     readonly components?: MarkdownComponents;
+    /**
+     * Fence renderers keyed by language, consulted BEFORE the built-in mermaid/`CodeBlock` dispatch.
+     * Wrap a heavyweight renderer in `settledOnly` to keep it off the still-streaming tail. Pass a
+     * referentially stable object — it participates in the streaming memoization.
+     */
+    readonly fenceRenderers?: FenceRenderers;
+    /**
+     * ADDITIONS merged into `BASALT_SANITIZE_SCHEMA` over rehype-sanitize's `defaultSchema`.
+     * Removals are not expressible — a schema handed to `rehype-sanitize` directly would replace the
+     * defaults wholesale (hast-util-sanitize merges with a shallow top-level spread), which is
+     * exactly the footgun this shape removes.
+     */
+    readonly sanitizeSchema?: SanitizeSchemaExtension;
     /** Allowed `href` prefixes. Default `['https://', 'mailto:', '#', '/']`. */
     readonly allowedLinkPrefixes?: readonly string[];
-    /** Allowed `img src` prefixes. Default `['https://', '/']`; in `streaming` mode `['/']`
-     * (same-origin only) — auto-fetched images are the classic prompt-injection exfiltration
-     * channel, so remote origins must be opted in explicitly for model-generated content. */
+    /** Allowed `img src` prefixes. Default `['https://', '/']` for trusted content, `['/']`
+     * (same-origin only) when `contentTrust` resolves to `'untrusted'` — auto-fetched images are the
+     * classic prompt-injection exfiltration channel, so remote origins must be opted in explicitly
+     * for model-generated content. */
     readonly allowedImagePrefixes?: readonly string[];
     /** Resolves a relative `href`/`src` to an absolute URL before the allowlist check's result is used. */
     readonly defaultOrigin?: string;
     /** Escape hatch — appended after `remark-gfm`. */
     readonly remarkPlugins?: readonly unknown[];
-    /** Escape hatch — appended after react-markdown's defaults. */
+    /**
+     * Escape hatch — appended after react-markdown's defaults, and BEFORE basalt's sanitize pass
+     * (which always runs last, so nothing supplied here can outrun it).
+     *
+     * react-markdown does NOT parse raw HTML in the markdown SOURCE by default (no `rehype-raw` is
+     * included here or by react-markdown itself) — a literal `<script>...</script>` typed into
+     * `children` never becomes a hast element; it stays inert text and the sanitize pass never even
+     * sees it. Concretely: a test that types a raw `<script>` tag into `children` and asserts it never
+     * renders is NOT exercising the sanitize pass — it would pass identically with the pass removed
+     * entirely, because the string was never a node the sanitizer could act on in the first place. The
+     * sanitize pass only ever sees elements produced by remark/rehype PLUGINS (`remarkPlugins`,
+     * `rehypePlugins`, or `rehype-raw` if a consumer adds it here) — that is the surface worth testing
+     * against unsafe markup, not raw source text.
+     */
     readonly rehypePlugins?: readonly unknown[];
     readonly className?: string;
     readonly style?: CSSProperties;
 };
-export declare function Markdown({ children, density, measure, streaming, components, allowedLinkPrefixes, allowedImagePrefixes, defaultOrigin, remarkPlugins, rehypePlugins, className, style, }: MarkdownProps): JSX.Element;
+/** The resolved sanitize peer: its plugin plus the `defaultSchema` it re-exports. */
+type MarkdownSanitizer = {
+    readonly plugin: unknown;
+    readonly baseSchema: SanitizeSchemaInput;
+};
+/**
+ * Consumer plugins first, basalt's sanitize pass LAST — "everything after rehype-sanitize could be
+ * unsafe", so last is the only position nothing supplied through the escape hatch can outrun.
+ *
+ * Exported for the ordering test only; `./index.ts` deliberately does not re-export it.
+ */
+export declare function composeRehypePlugins({ sanitizer, consumerPlugins, sanitizeSchema, }: {
+    readonly sanitizer: MarkdownSanitizer | null;
+    readonly consumerPlugins?: readonly unknown[];
+    readonly sanitizeSchema?: SanitizeSchemaExtension;
+}): readonly unknown[];
+export declare function Markdown({ children, density, measure, streaming, contentTrust, components, fenceRenderers, sanitizeSchema, allowedLinkPrefixes, allowedImagePrefixes, defaultOrigin, remarkPlugins, rehypePlugins, className, style, }: MarkdownProps): JSX.Element;
 //# sourceMappingURL=markdown.d.ts.map

package/dist/content/markdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/content/markdown.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAG/C,OAAO,KAAK,EACV,UAAU,EAIX,MAAM,gBAAgB,CAAA;AAMvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAO3C,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAA;AAE3C,MAAM,MAAM,aAAa,GAAG;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChD;;6FAEyF;IACzF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjD,uGAAuG;IACvG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAA;CAC/B,CAAA;AAyND,wBAAgB,QAAQ,CAAC,EACvB,QAAQ,EACR,OAAmB,EACnB,OAAO,EACP,SAAiB,EACjB,UAAU,EACV,mBAA2C,EAC3C,oBAAoF,EACpF,aAAa,EACb,aAAa,EACb,aAAa,EACb,SAAS,EACT,KAAK,GACN,EAAE,aAAa,eA+Bf"}
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/content/markdown.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAE/C,OAAO,KAAK,EACV,UAAU,EAIX,MAAM,gBAAgB,CAAA;AAGvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAInD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE3C,OAAO,KAAK,EAAkB,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAO9F,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAA;AAK3C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEtF;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,WAAW,CAAA;AAE1D,MAAM,MAAM,aAAa,GAAG;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B;;iDAE6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAA;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;IACxC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAA;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChD;;;sCAGkC;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjD,uGAAuG;IACvG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC3C;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAA;CAC/B,CAAA;AAqED,qFAAqF;AACrF,KAAK,iBAAiB,GAAG;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAA;CACzC,CAAA;AA8ED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,SAAS,EACT,eAAe,EACf,cAAc,GACf,EAAE;IACD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAA;CAClD,GAAG,SAAS,OAAO,EAAE,CAKrB;AA2RD,wBAAgB,QAAQ,CAAC,EACvB,QAAQ,EACR,OAAmB,EACnB,OAAO,EACP,SAAiB,EAIjB,YAAkD,EAClD,UAAU,EACV,cAAc,EACd,cAAc,EACd,mBAA2C,EAC3C,oBAA0D,EAC1D,aAAa,EACb,aAAa,EACb,aAAa,EACb,SAAS,EACT,KAAK,GACN,EAAE,aAAa,eAiCf"}