basalt-ui 1.11.0 → 1.13.0

package/dist/content/markdown.d.ts

@@ -5,15 +5,26 @@
  * `agent/**` deliberately ships no renderer of its own, since `agent/** -> content` is
  * lint-blocked by design.
  *
- * LAZY-LOADED: react-markdown and remark-gfm are OPTIONAL peers, loaded via `React.lazy` + dynamic
- * `import()` (mirrors `agent/streaming-markdown.tsx` and `./highlighter`) — importing
- * `basalt-ui/content` never eagerly resolves them. Without them installed, `Markdown` renders the
- * raw string as plain text.
+ * LAZY-LOADED: react-markdown, remark-gfm, rehype-sanitize and remend are all OPTIONAL peers,
+ * loaded via `React.lazy` / dynamic `import()` (mirrors `agent/streaming-markdown.tsx` and
+ * `./highlighter`) — importing `basalt-ui/content` never eagerly resolves any of them. Without
+ * react-markdown or remark-gfm, `Markdown` renders the raw string as plain text; without
+ * rehype-sanitize the sanitize pass is skipped (dev-warned once); without remend the streaming
+ * tail renders unrepaired.
+ *
+ * SANITIZATION: basalt appends its own `rehype-sanitize` pass AFTER the consumer's `rehypePlugins`
+ * — plugin order in unified is registration order, so last is the only position nothing can
+ * outrun. `sanitizeSchema` is an ADDITIONS-only extension merged over `BASALT_SANITIZE_SCHEMA`
+ * (see `./sanitize`); removing a default allowance is deliberately not expressible.
+ *
+ * TRUST vs STREAMING: `streaming` is a rendering mode (the text is still arriving); `contentTrust`
+ * is the security input (where the text came from). They are independent — a FINISHED agent message
+ * is settled AND untrusted. Only `contentTrust` selects the image allowlist default.
  *
  * Default element overrides:
  *  - `h1`..`h6` — slugged + hover-anchored (`./heading-components`).
- *  - fenced code (`pre`) — `CodeBlock`, or `MermaidDiagram` for a settled ` ```mermaid ` fence
- *    (`./fence-block`).
+ *  - fenced code (`pre`) — the fence-renderer registry (`./fence-block`): `fenceRenderers[lang]`,
+ *    then the built-ins (a settled ` ```mermaid ` fence → `MermaidDiagram`), then `CodeBlock`.
  *  - `blockquote` — a GFM alert marker (`[!NOTE]` etc.) renders as `Callout`; otherwise passes
  *    through (`./callout-alert`).
  *  - `a`/`img` — hardened via `allowedLinkPrefixes`/`allowedImagePrefixes`/`defaultOrigin`
@@ -32,12 +43,23 @@
  * import { Markdown } from 'basalt-ui/content'
  *
  * <Markdown>{articleMarkdown}</Markdown>
- * <Markdown density="chat" streaming allowedLinkPrefixes={['https://']}>{streamedText}</Markdown>
+ * <Markdown density="chat" streaming contentTrust="untrusted">{streamedText}</Markdown>
+ * <Markdown fenceRenderers={{ vega: settledOnly(({ code }) => <VegaChart spec={code} />) }}>
  */
 import type { CSSProperties, JSX } from 'react';
 import type { Components } from 'react-markdown';
+import type { FenceRenderers } from './fence-block.js';
 import type { ProseDensity } from './prose.js';
+import type { SanitizeSchemaExtension, SanitizeSchemaInput } from './sanitize.js';
 export type MarkdownComponents = Components;
+export { settledOnly } from './fence-block.js';
+export type { FenceRenderContext, FenceRenderer, FenceRenderers } from './fence-block.js';
+/**
+ * Provenance of a `Markdown` body — the ONLY input to the image-allowlist default. Deliberately not
+ * a boolean: `contentTrust="untrusted"` says at the call site what it means, where `untrusted` /
+ * `!trusted` would not.
+ */
+export type MarkdownContentTrust = 'trusted' | 'untrusted';
 export type MarkdownProps = {
     /** The markdown string to render. Safe to update on every character during streaming. */
     readonly children: string;
@@ -45,24 +67,89 @@ export type MarkdownProps = {
     readonly density?: ProseDensity;
     /** `Prose`'s measure cap. Defaults to `true` for `'article'` density, `false` for `'chat'`. */
     readonly measure?: boolean;
-    /** AI-stream mode — block-split + memoize + `remend`-repair the in-flight tail. Default `false`. */
+    /** AI-stream mode — block-split + memoize + `remend`-repair the in-flight tail. Default `false`.
+     * Purely a RENDERING mode: it says the text is still arriving, NOT that it is untrusted. Use
+     * `contentTrust` for the security policy. */
     readonly streaming?: boolean;
-    /** Per-element overrides merged OVER the defaults (only the keys you supply are replaced). */
+    /**
+     * Where `children` came from — the input to the image policy, independent of `streaming`.
+     * `'untrusted'` (model-generated or third-party markdown) drops the `allowedImagePrefixes`
+     * default to same-origin `['/']`; `'trusted'` (your own authored content) keeps
+     * `['https://', '/']`. An explicit `allowedImagePrefixes` always wins over both.
+     *
+     * Default: `'untrusted'` when `streaming` is set, `'trusted'` otherwise. That default only
+     * preserves the pre-1.12 fail-safe — it is NOT the policy. Settledness has nothing to do with
+     * trust: a FINISHED agent message is still model-generated, so any surface rendering agent text
+     * must pin `contentTrust="untrusted"` explicitly rather than lean on `streaming`.
+     */
+    readonly contentTrust?: MarkdownContentTrust;
+    /**
+     * Per-element overrides merged OVER the defaults (only the keys you supply are replaced).
+     *
+     * A CUSTOM tag admitted via `sanitizeSchema.tagNames` (e.g. `'x-callout'`) cannot be given an
+     * override here: react-markdown's `Components` type is a mapped type over `JSX.IntrinsicElements`,
+     * which only has entries for real HTML/SVG tags — a made-up tag name is not a valid key of it, so
+     * there is no override slot for it to occupy. Style such a tag with CSS (element/attribute
+     * selectors) or a wrapping component instead of trying to intercept it here.
+     */
     readonly components?: MarkdownComponents;
+    /**
+     * Fence renderers keyed by language, consulted BEFORE the built-in mermaid/`CodeBlock` dispatch.
+     * Wrap a heavyweight renderer in `settledOnly` to keep it off the still-streaming tail. Pass a
+     * referentially stable object — it participates in the streaming memoization.
+     */
+    readonly fenceRenderers?: FenceRenderers;
+    /**
+     * ADDITIONS merged into `BASALT_SANITIZE_SCHEMA` over rehype-sanitize's `defaultSchema`.
+     * Removals are not expressible — a schema handed to `rehype-sanitize` directly would replace the
+     * defaults wholesale (hast-util-sanitize merges with a shallow top-level spread), which is
+     * exactly the footgun this shape removes.
+     */
+    readonly sanitizeSchema?: SanitizeSchemaExtension;
     /** Allowed `href` prefixes. Default `['https://', 'mailto:', '#', '/']`. */
     readonly allowedLinkPrefixes?: readonly string[];
-    /** Allowed `img src` prefixes. Default `['https://', '/']`; in `streaming` mode `['/']`
-     * (same-origin only) — auto-fetched images are the classic prompt-injection exfiltration
-     * channel, so remote origins must be opted in explicitly for model-generated content. */
+    /** Allowed `img src` prefixes. Default `['https://', '/']` for trusted content, `['/']`
+     * (same-origin only) when `contentTrust` resolves to `'untrusted'` — auto-fetched images are the
+     * classic prompt-injection exfiltration channel, so remote origins must be opted in explicitly
+     * for model-generated content. */
     readonly allowedImagePrefixes?: readonly string[];
     /** Resolves a relative `href`/`src` to an absolute URL before the allowlist check's result is used. */
     readonly defaultOrigin?: string;
     /** Escape hatch — appended after `remark-gfm`. */
     readonly remarkPlugins?: readonly unknown[];
-    /** Escape hatch — appended after react-markdown's defaults. */
+    /**
+     * Escape hatch — appended after react-markdown's defaults, and BEFORE basalt's sanitize pass
+     * (which always runs last, so nothing supplied here can outrun it).
+     *
+     * react-markdown does NOT parse raw HTML in the markdown SOURCE by default (no `rehype-raw` is
+     * included here or by react-markdown itself) — a literal `<script>...</script>` typed into
+     * `children` never becomes a hast element; it stays inert text and the sanitize pass never even
+     * sees it. Concretely: a test that types a raw `<script>` tag into `children` and asserts it never
+     * renders is NOT exercising the sanitize pass — it would pass identically with the pass removed
+     * entirely, because the string was never a node the sanitizer could act on in the first place. The
+     * sanitize pass only ever sees elements produced by remark/rehype PLUGINS (`remarkPlugins`,
+     * `rehypePlugins`, or `rehype-raw` if a consumer adds it here) — that is the surface worth testing
+     * against unsafe markup, not raw source text.
+     */
     readonly rehypePlugins?: readonly unknown[];
     readonly className?: string;
     readonly style?: CSSProperties;
 };
-export declare function Markdown({ children, density, measure, streaming, components, allowedLinkPrefixes, allowedImagePrefixes, defaultOrigin, remarkPlugins, rehypePlugins, className, style, }: MarkdownProps): JSX.Element;
+/** The resolved sanitize peer: its plugin plus the `defaultSchema` it re-exports. */
+type MarkdownSanitizer = {
+    readonly plugin: unknown;
+    readonly baseSchema: SanitizeSchemaInput;
+};
+/**
+ * Consumer plugins first, basalt's sanitize pass LAST — "everything after rehype-sanitize could be
+ * unsafe", so last is the only position nothing supplied through the escape hatch can outrun.
+ *
+ * Exported for the ordering test only; `./index.ts` deliberately does not re-export it.
+ */
+export declare function composeRehypePlugins({ sanitizer, consumerPlugins, sanitizeSchema, }: {
+    readonly sanitizer: MarkdownSanitizer | null;
+    readonly consumerPlugins?: readonly unknown[];
+    readonly sanitizeSchema?: SanitizeSchemaExtension;
+}): readonly unknown[];
+export declare function Markdown({ children, density, measure, streaming, contentTrust, components, fenceRenderers, sanitizeSchema, allowedLinkPrefixes, allowedImagePrefixes, defaultOrigin, remarkPlugins, rehypePlugins, className, style, }: MarkdownProps): JSX.Element;
 //# sourceMappingURL=markdown.d.ts.map

package/dist/content/markdown.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/content/markdown.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAG/C,OAAO,KAAK,EACV,UAAU,EAIX,MAAM,gBAAgB,CAAA;AAMvB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAO3C,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAA;AAE3C,MAAM,MAAM,aAAa,GAAG;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,oGAAoG;IACpG,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;IACxC,4EAA4E;IAC5E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChD;;6FAEyF;IACzF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjD,uGAAuG;IACvG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAA;CAC/B,CAAA;AAyND,wBAAgB,QAAQ,CAAC,EACvB,QAAQ,EACR,OAAmB,EACnB,OAAO,EACP,SAAiB,EACjB,UAAU,EACV,mBAA2C,EAC3C,oBAAoF,EACpF,aAAa,EACb,aAAa,EACb,aAAa,EACb,SAAS,EACT,KAAK,GACN,EAAE,aAAa,eA+Bf"}
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/content/markdown.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAE/C,OAAO,KAAK,EACV,UAAU,EAIX,MAAM,gBAAgB,CAAA;AAGvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAInD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAE3C,OAAO,KAAK,EAAkB,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAO9F,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAA;AAK3C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAEtF;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,WAAW,CAAA;AAE1D,MAAM,MAAM,aAAa,GAAG;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAA;IAC/B,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B;;iDAE6C;IAC7C,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAA;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAA;IACxC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAA;IACxC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAA;IACjD,4EAA4E;IAC5E,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChD;;;sCAGkC;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjD,uGAAuG;IACvG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,kDAAkD;IAClD,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC3C;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC3C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAA;CAC/B,CAAA;AAqED,qFAAqF;AACrF,KAAK,iBAAiB,GAAG;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,mBAAmB,CAAA;CACzC,CAAA;AA8ED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,SAAS,EACT,eAAe,EACf,cAAc,GACf,EAAE;IACD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,uBAAuB,CAAA;CAClD,GAAG,SAAS,OAAO,EAAE,CAKrB;AA2RD,wBAAgB,QAAQ,CAAC,EACvB,QAAQ,EACR,OAAmB,EACnB,OAAO,EACP,SAAiB,EAIjB,YAAkD,EAClD,UAAU,EACV,cAAc,EACd,cAAc,EACd,mBAA2C,EAC3C,oBAA0D,EAC1D,aAAa,EACb,aAAa,EACb,aAAa,EACb,SAAS,EACT,KAAK,GACN,EAAE,aAAa,eAiCf"}

package/dist/content/markdown.js

@@ -1,18 +1,19 @@
 import { jsx } from "react/jsx-runtime";
-import { lazy, memo, Suspense, useMemo } from "react";
-import remend from "remend";
+import { lazy, memo, Suspense, useEffect, useMemo, useState } from "react";
 import { ALERT_CALLOUT_KIND, ALERT_TITLE, detectAlert, stripAlertMarker } from "./callout-alert.js";
 import { FenceBlock } from "./fence-block.js";
 import { createHeadingComponents } from "./heading-components.js";
 import { Callout } from "./callout.js";
 import { Prose } from "./prose.js";
+import { BASALT_SANITIZE_SCHEMA, mergeSanitizeSchema } from "./sanitize.js";
 import { SlugTracker } from "./slug.js";
 import { blockSplit } from "./block-split.js";
 import { createUrlTransform } from "./url-hardening.js";
-function LinkRenderer({ href, children }) {
-  if (href === void 0) return /* @__PURE__ */ jsx("span", { children });
+import { settledOnly } from "./fence-block.js";
+function LinkRenderer({ href, children, node: _node, ...rest }) {
+  if (href === void 0) return /* @__PURE__ */ jsx("span", { ...rest, children });
   const external = href.startsWith("http://") || href.startsWith("https://");
-  return /* @__PURE__ */ jsx("a", { href, ...external && { target: "_blank", rel: "noreferrer noopener" }, children });
+  return /* @__PURE__ */ jsx("a", { href, ...rest, ...external && { target: "_blank", rel: "noreferrer noopener" }, children });
 }
 function ImageRenderer({ src, alt }) {
   if (typeof src !== "string" || src === "") return /* @__PURE__ */ jsx("span", { "aria-label": alt });
@@ -23,45 +24,92 @@ function BlockquoteRenderer({ children }) {
   if (!alert) return /* @__PURE__ */ jsx("blockquote", { children });
   return /* @__PURE__ */ jsx(Callout, { kind: ALERT_CALLOUT_KIND[alert.kind], title: ALERT_TITLE[alert.kind], children: stripAlertMarker(children, alert.marker) });
 }
-function createPreRenderer(settled) {
+function createPreRenderer(settled, fenceRenderers) {
   return function PreRenderer({ node }) {
-    return /* @__PURE__ */ jsx(FenceBlock, { settled, ...node !== void 0 && { node } });
+    return /* @__PURE__ */ jsx(
+      FenceBlock,
+      {
+        settled,
+        ...node !== void 0 && { node },
+        ...fenceRenderers !== void 0 && { renderers: fenceRenderers }
+      }
+    );
   };
 }
-function buildMarkdownComponents(tracker, settled) {
+function buildMarkdownComponents(tracker, settled, fenceRenderers) {
   return {
     ...createHeadingComponents(tracker),
-    pre: createPreRenderer(settled),
+    pre: createPreRenderer(settled, fenceRenderers),
     blockquote: BlockquoteRenderer,
     a: LinkRenderer,
     img: ImageRenderer
   };
 }
+let sanitizerPromise = null;
+function loadSanitizer() {
+  sanitizerPromise ??= import("rehype-sanitize").then((mod) => ({
+    plugin: mod.default,
+    // No cast: `SanitizeSchemaInput` mirrors hast-util-sanitize's `Schema` INCLUDING its
+    // `| null | undefined` field arms, so `defaultSchema` assigns straight across;
+    // `mergeSanitizeSchema` normalizes the nulls away and hands back a `SanitizeSchema`.
+    baseSchema: mod.defaultSchema
+  })).catch(() => {
+    if (process.env["NODE_ENV"] !== "production") {
+      console.warn(
+        '[basalt] Markdown: optional peer "rehype-sanitize" is not installed \u2014 the sanitize pass is skipped. react-markdown does not parse raw HTML by default, so this only opens a hole if a rehypePlugin (rehype-raw and friends) puts untrusted nodes into the tree. Install it with: bun add rehype-sanitize'
+      );
+    }
+    return null;
+  });
+  return sanitizerPromise;
+}
+function withSingleClobberLayer(schema) {
+  return { ...schema, clobberPrefix: "" };
+}
+function composeRehypePlugins({
+  sanitizer,
+  consumerPlugins,
+  sanitizeSchema
+}) {
+  const consumer = consumerPlugins ?? [];
+  if (sanitizer === null) return consumer;
+  const merged = mergeSanitizeSchema(sanitizer.baseSchema, BASALT_SANITIZE_SCHEMA, sanitizeSchema);
+  return [...consumer, [sanitizer.plugin, withSingleClobberLayer(merged)]];
+}
 function PlainTextFallback({ text }) {
   return /* @__PURE__ */ jsx("span", { style: { whiteSpace: "pre-wrap" }, children: text });
 }
 const LazyReactMarkdown = lazy(
-  () => Promise.all([import("react-markdown"), import("remark-gfm")]).then(([{ default: ReactMarkdown }, { default: remarkGfm }]) => {
+  () => Promise.all([import("react-markdown"), import("remark-gfm"), loadSanitizer()]).then(([{ default: ReactMarkdown }, { default: remarkGfm }, sanitizer]) => {
     function Bridge({
       text,
       components,
       urlTransform,
       remarkPlugins,
-      rehypePlugins
+      rehypePlugins,
+      sanitizeSchema
     }) {
       const remarkPluginsList = [
         remarkGfm,
         ...remarkPlugins ?? []
       ];
+      const rehypePluginsList = useMemo(
+        () => composeRehypePlugins({
+          sanitizer,
+          ...rehypePlugins !== void 0 && { consumerPlugins: rehypePlugins },
+          ...sanitizeSchema !== void 0 && { sanitizeSchema }
+        }),
+        // `sanitizer` is a constant of the enclosing load closure — resolved once, before this
+        // component exists, so it is deliberately not a dependency.
+        [rehypePlugins, sanitizeSchema]
+      );
       return /* @__PURE__ */ jsx(
         ReactMarkdown,
         {
           components,
           urlTransform,
           remarkPlugins: remarkPluginsList,
-          ...rehypePlugins !== void 0 && {
-            rehypePlugins
-          },
+          rehypePlugins: rehypePluginsList,
           children: text
         }
       );
@@ -73,14 +121,16 @@ function BlockRenderer({
   text,
   settled,
   components,
+  fenceRenderers,
   urlTransform,
   remarkPlugins,
-  rehypePlugins
+  rehypePlugins,
+  sanitizeSchema
 }) {
   const tracker = useMemo(() => new SlugTracker(), [text]);
   const componentsMap = useMemo(
-    () => ({ ...buildMarkdownComponents(tracker, settled), ...components }),
-    [tracker, settled, components]
+    () => ({ ...buildMarkdownComponents(tracker, settled, fenceRenderers), ...components }),
+    [tracker, settled, fenceRenderers, components]
   );
   return /* @__PURE__ */ jsx(
     LazyReactMarkdown,
@@ -89,16 +139,53 @@ function BlockRenderer({
       components: componentsMap,
       urlTransform,
       ...remarkPlugins !== void 0 && { remarkPlugins },
-      ...rehypePlugins !== void 0 && { rehypePlugins }
+      ...rehypePlugins !== void 0 && { rehypePlugins },
+      ...sanitizeSchema !== void 0 && { sanitizeSchema }
     }
   );
 }
 const MemoizedBlock = memo(BlockRenderer);
+let remendPromise = null;
+let resolvedRemend = null;
+function loadRemend() {
+  remendPromise ??= import("remend").then((mod) => {
+    resolvedRemend = mod.default;
+    return resolvedRemend;
+  }).catch(() => null);
+  return remendPromise;
+}
+function useRemend() {
+  const [repair, setRepair] = useState(() => resolvedRemend);
+  useEffect(() => {
+    if (repair !== null) return;
+    let cancelled = false;
+    loadRemend().then((loaded) => {
+      if (!cancelled && loaded !== null) setRepair(() => loaded);
+      return void 0;
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [repair]);
+  return repair;
+}
 function StreamingTailBlock(props) {
-  const repaired = useMemo(() => remend(props.text), [props.text]);
+  const repair = useRemend();
+  const repaired = useMemo(
+    () => repair === null ? props.text : repair(props.text),
+    [repair, props.text]
+  );
   return /* @__PURE__ */ jsx(BlockRenderer, { ...props, text: repaired, settled: false });
 }
-function SettledBody({ text, components, urlTransform, remarkPlugins, rehypePlugins }) {
+function SettledBody({
+  text,
+  components,
+  fenceRenderers,
+  urlTransform,
+  remarkPlugins,
+  rehypePlugins,
+  sanitizeSchema
+}) {
   return /* @__PURE__ */ jsx(Suspense, { fallback: /* @__PURE__ */ jsx(PlainTextFallback, { text }), children: /* @__PURE__ */ jsx(
     BlockRenderer,
     {
@@ -106,17 +193,21 @@ function SettledBody({ text, components, urlTransform, remarkPlugins, rehypePlug
       settled: true,
       urlTransform,
       ...components !== void 0 && { components },
+      ...fenceRenderers !== void 0 && { fenceRenderers },
       ...remarkPlugins !== void 0 && { remarkPlugins },
-      ...rehypePlugins !== void 0 && { rehypePlugins }
+      ...rehypePlugins !== void 0 && { rehypePlugins },
+      ...sanitizeSchema !== void 0 && { sanitizeSchema }
     }
   ) });
 }
 function StreamingBody({
   text,
   components,
+  fenceRenderers,
   urlTransform,
   remarkPlugins,
-  rehypePlugins
+  rehypePlugins,
+  sanitizeSchema
 }) {
   const blocks = useMemo(() => blockSplit(text), [text]);
   const lastIndex = blocks.length - 1;
@@ -125,23 +216,41 @@ function StreamingBody({
       text: block,
       urlTransform,
       ...components !== void 0 && { components },
+      ...fenceRenderers !== void 0 && { fenceRenderers },
       ...remarkPlugins !== void 0 && { remarkPlugins },
-      ...rehypePlugins !== void 0 && { rehypePlugins }
+      ...rehypePlugins !== void 0 && { rehypePlugins },
+      ...sanitizeSchema !== void 0 && { sanitizeSchema }
     };
     return index === lastIndex ? /* @__PURE__ */ jsx(StreamingTailBlock, { ...shared }, index) : /* @__PURE__ */ jsx(MemoizedBlock, { ...shared, settled: true }, index);
   }) });
 }
 const DEFAULT_LINK_PREFIXES = ["https://", "mailto:", "#", "/"];
-const DEFAULT_IMAGE_PREFIXES = ["https://", "/"];
-const STREAMING_IMAGE_PREFIXES = ["/"];
+const TRUSTED_IMAGE_PREFIXES = ["https://", "/"];
+const UNTRUSTED_IMAGE_PREFIXES = ["/"];
+const IMAGE_PREFIXES_BY_TRUST = {
+  trusted: TRUSTED_IMAGE_PREFIXES,
+  untrusted: UNTRUSTED_IMAGE_PREFIXES
+};
+function isKnownContentTrust(value) {
+  return Object.hasOwn(IMAGE_PREFIXES_BY_TRUST, value);
+}
+function imagePrefixesForTrust(contentTrust) {
+  return isKnownContentTrust(contentTrust) ? IMAGE_PREFIXES_BY_TRUST[contentTrust] : UNTRUSTED_IMAGE_PREFIXES;
+}
 function Markdown({
   children,
   density = "article",
   measure,
   streaming = false,
+  // `streaming` as the trust DEFAULT is backward compatibility only (pre-1.12 the image policy was
+  // read straight off `streaming`, so dropping it would silently widen every existing streaming
+  // call site). It is a floor, never the policy — see the prop's JSDoc.
+  contentTrust = streaming ? "untrusted" : "trusted",
   components,
+  fenceRenderers,
+  sanitizeSchema,
   allowedLinkPrefixes = DEFAULT_LINK_PREFIXES,
-  allowedImagePrefixes = streaming ? STREAMING_IMAGE_PREFIXES : DEFAULT_IMAGE_PREFIXES,
+  allowedImagePrefixes = imagePrefixesForTrust(contentTrust),
   defaultOrigin,
   remarkPlugins,
   rehypePlugins,
@@ -161,8 +270,10 @@ function Markdown({
     text: children,
     urlTransform,
     ...components !== void 0 && { components },
+    ...fenceRenderers !== void 0 && { fenceRenderers },
     ...remarkPlugins !== void 0 && { remarkPlugins },
-    ...rehypePlugins !== void 0 && { rehypePlugins }
+    ...rehypePlugins !== void 0 && { rehypePlugins },
+    ...sanitizeSchema !== void 0 && { sanitizeSchema }
   };
   return /* @__PURE__ */ jsx(
     Prose,
@@ -176,5 +287,7 @@ function Markdown({
   );
 }
 export {
-  Markdown
+  Markdown,
+  composeRehypePlugins,
+  settledOnly
 };

package/dist/content/markdown.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=markdown.test.d.ts.map

package/dist/content/markdown.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.test.d.ts","sourceRoot":"","sources":["../../src/content/markdown.test.tsx"],"names":[],"mappings":""}

package/dist/content/prose.module.css.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=prose.module.css.test.d.ts.map

package/dist/content/prose.module.css.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prose.module.css.test.d.ts","sourceRoot":"","sources":["../../src/content/prose.module.css.test.ts"],"names":[],"mappings":""}

package/dist/content/sanitize.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Sanitize-schema composition for `Markdown` (docs/AGENT-CHAT-SPEC.md §7). Owns three things: the
+ * additions-only extension type a consumer hands to `Markdown`'s `sanitizeSchema` prop, basalt's
+ * own additions layer, and the additive deep merge that composes both over `rehype-sanitize`'s
+ * `defaultSchema`.
+ *
+ * WHY A DATA EXTENSION, NOT A `(base) => Schema` CALLBACK: a callback can return `{}` and silently
+ * disable sanitization, and a "never replace" comment is not enforcement. `SanitizeSchemaExtension`
+ * makes removal UNREPRESENTABLE — there is no code path in `mergeSanitizeSchema` that shrinks the
+ * base. That, plus `./markdown` appending its sanitize pass AFTER the consumer's `rehypePlugins`,
+ * is what keeps the baseline un-defeatable from outside the package.
+ *
+ * The `Schema` shape is MIRRORED here rather than imported from `hast-util-sanitize`, so the
+ * content layer's types never depend on an optional peer. `rehype-sanitize` is dynamically imported
+ * by `./markdown`, which composes the effective schema at load time:
+ *
+ *     mergeSanitizeSchema(defaultSchema, BASALT_SANITIZE_SCHEMA, props.sanitizeSchema)
+ *
+ * THE TRAP THIS MODULE EXISTS TO AVOID: `hast-util-sanitize` merges a supplied schema with a
+ * shallow top-level spread (`{...defaultSchema, ...options}`). Passing an `attributes` object
+ * therefore REPLACES every default attribute allowance rather than adding to it — one consumer
+ * addition would silently strip `href` from links, `className` from code fences, and the whole
+ * `'*'` fallback. Upstream's answer is the third-party `deepmerge` package; basalt owns the small
+ * merge below instead of taking the dependency.
+ *
+ * "ADDITIONS ONLY" IS A STATEMENT ABOUT THE SANITIZER'S BEHAVIOUR, NOT ABOUT THE SCHEMA'S SHAPE.
+ * A merge that only ever grows arrays still removes allowances, because of three things
+ * `hast-util-sanitize@5` does when it CONSUMES the schema (`lib/index.js`, verified against the
+ * installed copy). Each is load-bearing for the code below:
+ *
+ *  1. `clobberPrefix` is gated on TRUTHINESS — `schema.clobber && schema.clobberPrefix &&
+ *     schema.clobber.includes(key)`. ANY falsy prefix (`''`, but equally `null`, `0`, `false`,
+ *     `NaN` — whatever an untyped caller or a cast smuggles through) therefore turns clobber
+ *     protection OFF entirely and emits `id`/`name`/`ariaLabelledBy`/`ariaDescribedBy` unprefixed,
+ *     which is the DOM-clobbering hole `user-content-` exists to close. See `adoptClobberPrefix`.
+ *  2. The `'*'` fallback is consulted ONLY when the tag-specific lookup yields `null`/`undefined`.
+ *     For an ARRAY-valued property (`className`, `headers`, …) a matching tag-specific entry
+ *     returns `[]` — neither — so the fallback is skipped. Introducing a tag-specific entry for a
+ *     property the base only allowed via `'*'` therefore DELETES that allowance. See
+ *     `rescueWildcardDefinitions`.
+ *  3. `findDefinition` returns the FIRST entry whose name matches, so any later entry for the same
+ *     property name is dead code (it also treats a `'data*'` entry as the fallback for any
+ *     `data`-prefixed key). Concatenating a consumer's entry after the base's is a silent no-op.
+ *     See `unionDefinitions`, which collapses to ONE entry per property name.
+ */
+/**
+ * One entry in an `attributes` allow-list. A bare string allows any value for that property; the
+ * tuple form allow-lists specific values (a `RegExp` matches a value, e.g. `['className',
+ * /^language-./]`). A ONE-element tuple (`['className']`) also allows any value — upstream only
+ * treats an entry as an allow-list when `definition.length > 1`.
+ *
+ * The `null`/`undefined` arms mirror upstream's `PropertyDefinition` exactly (its rest element is
+ * `Exclude<Properties[keyof Properties], Array<any>> | RegExp`, which includes both). They are
+ * inert: a sanitized value is always a boolean, number or string, so `allowed === value` can never
+ * match one.
+ */
+export type SanitizePropertyDefinition = string | readonly [string, ...ReadonlyArray<boolean | number | string | RegExp | null | undefined>];
+/**
+ * Structural mirror of `hast-util-sanitize`'s `Schema`, defined here rather than imported so the
+ * content layer never depends on an OPTIONAL peer's types. This is the OUTPUT shape: no `null`
+ * arms, so nothing downstream has to re-check a field the merge already normalized away.
+ */
+export type SanitizeSchema = {
+    readonly allowComments?: boolean;
+    readonly allowDoctypes?: boolean;
+    readonly ancestors?: Readonly<Record<string, readonly string[]>>;
+    readonly attributes?: Readonly<Record<string, readonly SanitizePropertyDefinition[]>>;
+    readonly clobber?: readonly string[];
+    readonly clobberPrefix?: string;
+    readonly protocols?: Readonly<Record<string, readonly string[]>>;
+    readonly required?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
+    readonly strip?: readonly string[];
+    readonly tagNames?: readonly string[];
+};
+/**
+ * INPUT shape for `mergeSanitizeSchema`'s base — `SanitizeSchema` with upstream's `| null |
+ * undefined` on every field (and on every `protocols` value), so `rehype-sanitize`'s own
+ * `defaultSchema` assigns to it directly with NO cast at the call site.
+ *
+ * It is deliberately separate from `SanitizeSchema` rather than a widening of it: the null arms
+ * belong to what callers may HAND IN, not to what the merge HANDS BACK. `normalizeSchemaInput`
+ * drops them, so no `null` ever reaches the exported output type.
+ */
+export type SanitizeSchemaInput = {
+    readonly allowComments?: boolean | null | undefined;
+    readonly allowDoctypes?: boolean | null | undefined;
+    readonly ancestors?: Readonly<Record<string, readonly string[]>> | null | undefined;
+    readonly attributes?: Readonly<Record<string, readonly SanitizePropertyDefinition[]>> | null | undefined;
+    readonly clobber?: readonly string[] | null | undefined;
+    readonly clobberPrefix?: string | null | undefined;
+    readonly protocols?: Readonly<Record<string, readonly string[] | null | undefined>> | null | undefined;
+    readonly required?: Readonly<Record<string, Readonly<Record<string, unknown>>>> | null | undefined;
+    readonly strip?: readonly string[] | null | undefined;
+    readonly tagNames?: readonly string[] | null | undefined;
+};
+/**
+ * ADDITIONS ONLY — the four fields it is safe to widen from outside the package. Removal is
+ * deliberately not expressible: there is no way to shrink `tagNames`, drop an attribute allowance,
+ * narrow `protocols`, or clear `strip`/`clobber`/`ancestors`/`required`.
+ *
+ * `clobberPrefix` is the one replace-valued field. Upstream's actual gate is `schema.clobberPrefix`
+ * read for TRUTHINESS (`lib/index.js`), not `=== ''` — so `null`, `0`, `false`, `NaN`, and `''` are
+ * ALL disarming values, and only a genuine non-empty string keeps the guard live. TypeScript cannot
+ * express "a non-empty string" on a plain data field (and the declared `string` type is a
+ * compile-time claim a JS caller or an `as` cast can defeat), so `adoptClobberPrefix` re-checks
+ * `typeof` at runtime and treats anything that is not a non-empty string as a disarm attempt —
+ * ignored with a dev warning, never applied.
+ */
+export type SanitizeSchemaExtension = {
+    readonly tagNames?: readonly string[];
+    readonly attributes?: Readonly<Record<string, readonly SanitizePropertyDefinition[]>>;
+    readonly protocols?: Readonly<Record<string, readonly string[]>>;
+    readonly clobberPrefix?: string;
+};
+/**
+ * basalt's own element allowances, layered over `rehype-sanitize`'s `defaultSchema`.
+ *
+ * THIS IS THE ADDITIONS LAYER, NOT THE FULL BASELINE. It is deliberately NOT a materialized
+ * `defaultSchema + basalt` schema: `defaultSchema` lives in `rehype-sanitize`, an OPTIONAL peer, so
+ * materializing it at module scope would require a static import that hard-requires the peer for
+ * every consumer of `basalt-ui/content` — and vendoring a copy would silently drift from upstream's
+ * GitHub-grade baseline, which for a security default is worse. The effective schema is composed
+ * where the peer is dynamically imported (see the module JSDoc).
+ *
+ * IT IS EMPTY, AND THAT IS THE HONEST ANSWER — everything basalt's markdown pipeline emits into the
+ * hast tree is already permitted by `defaultSchema`, verified entry by entry:
+ *  - fenced code — `pre` > `code` with a `language-*` class: `defaultSchema.attributes.code` is
+ *    `[['className', /^language-./]]`, which covers `language-mermaid` too. The fence's title comes
+ *    from the `code` node's `data.meta`, and `data` is preserved by the sanitizer verbatim.
+ *  - headings — plain `h1`..`h6`; the slug `id` and the hover anchor are added by basalt's React
+ *    renderers AFTER sanitization, so they never pass through the schema.
+ *  - GFM alerts — an ordinary `blockquote` whose first paragraph carries a `[!NOTE]`-style text
+ *    marker; `Callout` is chosen in the renderer, again downstream of the hast tree.
+ *  - GFM tables / task lists / footnotes / strikethrough — `table`+`align`, `input[type=checkbox]
+ *    [disabled]`, `.task-list-item`, `section[data-footnotes]`, `del` are all explicit
+ *    `defaultSchema` allowances.
+ *  - links/images — `href`/`src` survive the schema and are then narrowed further by
+ *    `./url-hardening`'s prefix allowlist.
+ *
+ * So: do not "fill this in". Every entry added here widens the security baseline for every consumer
+ * and must be justified by output basalt actually emits. `style`, event handlers, and new protocols
+ * are out of bounds; an app-specific need belongs in that app's `sanitizeSchema` prop.
+ */
+export declare const BASALT_SANITIZE_SCHEMA: SanitizeSchemaExtension;
+/**
+ * Deep-merges additions into a base schema. Additive ONLY — and "additive" is measured by what the
+ * SANITIZER then allows, not by array lengths (see the module JSDoc for the three upstream lookup
+ * rules this has to model):
+ *
+ *  - `tagNames` and `protocols` are concatenated per key, de-duplicated.
+ *  - `attributes` are merged per tag into ONE entry per property name whose allow-list is the union
+ *    of base and addition — and a tag gaining its first entry for a property keeps whatever `'*'`
+ *    granted it, so a widening never shadows the wildcard off.
+ *  - `clobberPrefix` is the single replace-valued field (a later extension wins; an omitted one
+ *    leaves the previous value intact) — except the empty string, which is ignored.
+ *
+ * Never removes anything from `base`: keys no extension mentions (`strip`, `clobber`, `ancestors`,
+ * `required`, `allowComments`, `allowDoctypes`) pass through untouched.
+ *
+ * The `base` parameter takes the nullable `SanitizeSchemaInput` so `rehype-sanitize`'s own
+ * `defaultSchema` assigns with no cast; the RETURN type stays non-null.
+ *
+ * Pure and order-stable: no input is mutated, and the output ordering is a deterministic function
+ * of the inputs, so snapshots don't churn.
+ *
+ * @example
+ * mergeSanitizeSchema(defaultSchema, BASALT_SANITIZE_SCHEMA, { tagNames: ['hermes-badge'] })
+ */
+export declare function mergeSanitizeSchema(base: SanitizeSchemaInput, ...extensions: readonly (SanitizeSchemaExtension | undefined)[]): SanitizeSchema;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/content/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/content/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAIH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,0BAA0B,GAClC,MAAM,GACN,SAAS,CAAC,MAAM,EAAE,GAAG,aAAa,CAAC,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,CAAA;AAE9F;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAA;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAChE,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,0BAA0B,EAAE,CAAC,CAAC,CAAA;IACrF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IAC/E,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC,CAAA;AACD;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,CAAA;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAA;IACnF,QAAQ,CAAC,UAAU,CAAC,EAChB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,0BAA0B,EAAE,CAAC,CAAC,GAC/D,IAAI,GACJ,SAAS,CAAA;IACb,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,CAAA;IACvD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAClD,QAAQ,CAAC,SAAS,CAAC,EACf,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GAC9D,IAAI,GACJ,SAAS,CAAA;IACb,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,CAAA;IAClG,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,CAAA;IACrD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,CAAA;CACzD,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,0BAA0B,EAAE,CAAC,CAAC,CAAA;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAChE,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAChC,CAAA;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,sBAAsB,EAAE,uBAA4B,CAAA;AAySjE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,mBAAmB,EACzB,GAAG,UAAU,EAAE,SAAS,CAAC,uBAAuB,GAAG,SAAS,CAAC,EAAE,GAC9D,cAAc,CA0BhB"}