## Problem/Motivation `js/ai_answers.markdown.js` is a ~240-line hand-rolled Markdown-to-HTML converter built entirely out of regexes (escaping, inline code/bold/italic/links, block-level headings/lists/tables/fences). It grew ad hoc — table support was bolted on after the fact in #3615744 — and every new Markdown feature request (blockquotes, nested lists, footnotes) means writing and reviewing another regex pass by hand. This is exactly the kind of parsing problem a maintained library already solves correctly. ## Proposed resolution Vendor `markdown-it` (pinned 15.0.1, MIT) and `DOMPurify` (pinned 3.4.15, MIT/Apache) as minified UMD builds under `js/vendor/`, declared as a new `markdown_vendor` library that `answer` depends on. Rewrite `js/ai_answers.markdown.js` on top of them, keeping its exact public API (`Drupal.aiAnswers.markdownToHtml`, `Drupal.aiAnswers.markdownToBlocks`) so `ai_answers.answer.js` needs no changes. Two independent layers preserve the current safety guarantees: - markdown-it parses with `html: false`, so raw HTML in the model's answer is escaped to inert text rather than parsed as markup. - The rendered HTML is then run through `DOMPurify.sanitize()` with an explicit tag allowlist (`h1`–`h6`, `p`, `br`, `strong`, `em`, `code`, `pre`, `ul`, `ol`, `li`, `a`, `table`/`thead`/`tbody`/`tr`/`th`/`td`), an attribute allowlist (`href`, `data-align`), and a URI allowlist restricted to `http(s):`, `mailto:`, and relative/fragment URLs — matching the previous hand-rolled `sanitizeHref()` allowlist exactly. `markdownToBlocks()` keeps the streaming tail-diff behaviour `renderStreamingBlocks()` in `answer.js` depends on: it groups markdown-it's own block token stream into top-level blocks by nesting depth (a block ends when depth returns to 0), renders and sanitizes each group independently, and returns one HTML string per block — the same shape the caller already reconciles against. Table alignment: markdown-it emits `style="text-align:…"` for aligned columns; that gets converted to `data-align="…"` before sanitizing, same as the current converter, so a strict `style-src` CSP doesn't drop it. I checked the rest of the `ai`-family modules before picking this approach. `ai_context` renders Markdown server-side via `league/commonmark` + `Xss::filter()` — doesn't fit here, since this needs to update the DOM token-by-token as the SSE stream arrives. `ai_chatbot`'s `form-stream.js` already vendors Showdown.js client-side, but calls `.makeHtml()` with no sanitization step at all — worth a separate issue against that module, but not a precedent to copy here. Manually verified against fixtures covering headings/bold/italic/code, ordered/unordered lists, GFM tables with alignment, fenced code blocks (no inline parsing inside), safe/relative/fragment/mailto links, `javascript:`/raw-`<script>`/`<img onerror>` injection attempts (all correctly neutralized), bare `[n]` citation markers (left untouched for `answer.js`'s own linkify pass), and the streaming block-diff path across three growing input snapshots. ## Remaining tasks - File this issue, review the diff on the branch, push. - No automated test coverage exists for this file today (it's streaming/DOM-dependent); consider a `FunctionalJavascript` or standalone JS test as follow-up. ## User interface changes None — same rendered output for equivalent Markdown input. ## API changes None. `Drupal.aiAnswers.markdownToHtml()`/`markdownToBlocks()` keep their signatures. ## Data model changes None.