humanspeak / svelte-markdown / 29267490866

95%

main: 95%

push

github

feat(extensions): shiki syntax highlighting, streaming-compatible (#361)

* feat(extensions): spike streaming-compatible shiki code highlighting

Renderer-level prototype (no tokenizer, no walkTokens): ShikiCode slots
into the standard renderers prop, highlighting synchronously via
createHighlighterCoreSync + the JS regex engine, so streaming stays
enabled. Unregistered or adversarial lang values degrade to escaped
fallback markup — the {@html} sink only ever receives library-generated
or escaped content. Highlighting is memoized by (text, lang) so
unchanged blocks are not re-highlighted mid-stream.

Deliberately unshipped: no exports-map entry, no barrel export, no docs.
shiki is a devDependency for the spike only. Includes a tree-shaking
gate (core bundle stays shiki-free), 16 tests (injection, memoization
spy, streaming parity, fallback), a diagnostic demo route at
/test/shiki-spike, and the design report with measured numbers and a
ship checklist.

Executed from plan 004 (bigger-faster-stronger batch).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: reconcile CLAUDE.md with shipped sanitizer defaults and CI matrix (#362)

CLAUDE.md contradicted the codebase in three security/tooling-relevant
places flagged by the improve audit:

- Non-Goals and Security Considerations claimed "no built-in HTML
  sanitization" while sanitize.ts defaults (URL protocol allowlist,
  on*/srcdoc stripping) ship wired as prop defaults; the genuine
  non-goal is a bundled full DOM sanitizer
- CI claim of Node 20/22/24 corrected to 22/24 (engines: >=22)
- markdown-parser.js references corrected to .ts; structure tree gains
  sanitize.ts and incremental-parser.ts

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* feat(extensions): ship shiki — exports, barrel, peer dep, README, docs

Graduates the spike to a first-class extension:

- package.json: ./extensions/shiki exports entry; shiki >=4.0.0 as
  optional peer dependency (mirrors katex/mermaid)
-... (continued)

880 of 973 branches covered (90.44%)

Branch coverage included in aggregate %.

24 of 25 new or added lines in 3 files covered. (96.0%)

1444 of 1478 relevant lines covered (97.7%)

4644.02 hits per line