markdown-rendering

name	markdown-rendering
description	Markdown/HTML rendering in the AMC web repo — always go through the MarkdownText component (marked + dompurify); never render unsanitized HTML. Read before displaying markdown or remote HTML.

Markdown Rendering (marked + dompurify)

• All markdown rendering goes through src/lib/ui/MarkdownText/MarkdownText.svelte, which parses with marked and sanitizes with dompurify.
• Never use {@html …} with user-supplied or remote content outside this component — that's an XSS hole. If you need new rendering behavior, extend MarkdownText, don't bypass it.

Related: [[codebase-patterns]], [[project-structure]]