·
Last changedVersion:
No hardening report available.
Integrate the appropriate Markstream package into an existing application without installing unnecessary optional dependencies or weakening its security defaults.
Read references/scenarios.md before choosing packages or peers.
If references/scenarios.md is not present in the repository, use the framework-specific package names listed in Step 2 and ask the user to confirm the correct package for their framework before running any install command.
Use this skill when the user asks to:
Before changing dependencies, inspect:
package.json;Do not assume the Vue package is correct merely because the source repository is named markstream-vue. Select the framework-specific package from the scenario table.
Install exactly one framework package using --ignore-scripts. Add optional peers only when the requested UI uses their feature.
Examples:
Equivalent forms for other package managers:
Preserve the repository's existing package manager. Do not install every optional peer preemptively.
Import application resets before Markstream styles. Import package CSS explicitly; do not rely on component imports to inject it.
For Tailwind or UnoCSS, use the relevant package subpath in a component layer:
Use the matching package name for React, Svelte, Angular, or Vue 2. If math rendering is enabled, also import:
Vue CLI 4 and other Webpack 4-based Vue 2 applications cannot resolve package export maps. In those projects, import the published file directly:
Prefer content for static documents and most streaming chat interfaces. Markstream's built-in smooth streaming can pace irregular token delivery without requiring the host to maintain an AST.
For Vue 3 chat surfaces, start with:
For completed chat history, keep the same renderer mode and switch pacing off:
In React, Svelte, and Angular, use the equivalent camelCase or framework binding syntax. Keep smoothStreaming="auto", fade=false, and typewriter=true while streaming; use smoothStreaming=false and typewriter=false for completed history.
Use nodes plus final only when a worker, shared AST store, custom transform, or another application layer already owns parsing.
markstream-react entry inside a 'use client' component for live SSE or WebSocket streams. Use markstream-react/next for SSR-first HTML with hydration, or markstream-react/server for server-only rendering.markstream-svelte only with Svelte 5.markstream-angular version requirement.mode="chat" for AI chat, mode="docs" for rich documents, and mode="minimal" for lightweight non-chat surfaces.HTML policy defaults to safe, and Mermaid uses strict mode. Do not broaden either setting unless the user explicitly names the specific component that requires the exception and acknowledges the XSS risk. Scope any exception to that named component only, not globally, and record the component name and the user's acknowledgement in the validation report produced in Step 7.
Run exactly one of the following, selecting the smallest applicable. Do not infer or invoke any package.json script not listed below.
npx tsc --noEmit — typecheck only, preferred when no build or test target is requirednpm run build / yarn build / pnpm run build — build onlynpm run test / yarn test / pnpm run test — only if a test suite is confirmed present in package.jsonnpm audit / yarn audit / pnpm audit — always run after installConfirm:
npm audit (or yarn audit / pnpm audit) reports no critical or high advisories for the newly added packages.Report the selected package, added peers, CSS location, streaming input choice, and validation command.
Need this version hardened?
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
—
—
MIT
HARDENING.md
LICENSE
SKILL.md
references/scenarios.md