@flowview/runtime 0.1.2 → 0.2.0

package/dist/index.d.ts

@@ -1,6 +1,20 @@
 declare function escapeHtml(value: unknown): string;
 
 declare function renderValue(value: unknown): string;
+declare function renderAttributeValue(value: unknown): string;
+/**
+ * Insert an already-trusted HTML fragment verbatim. Backs `{{{ expression }}}`.
+ *
+ * This performs NO escaping and NO sanitization: the template author asserts
+ * the value is trusted or already sanitized HTML. Passing user-supplied markup
+ * here is a cross-site scripting vulnerability.
+ *
+ * Deliberately narrow contract: only strings are inserted. `null`, `undefined`
+ * and `false` render as an empty string (like {@link renderValue}). Every
+ * other value throws a `TypeError` rather than being stringified, so a number,
+ * array or object never turns into markup by accident.
+ */
+declare function renderRawValue(value: unknown): string;
 
 /**
  * Generic shape of the context object passed to a generated render function.
@@ -11,4 +25,4 @@ type RenderContext = Record<string, unknown>;
  */
 type RenderFunction<C extends RenderContext = RenderContext> = (context: C) => string;
 
-export { type RenderContext, type RenderFunction, escapeHtml, renderValue };
+export { type RenderContext, type RenderFunction, escapeHtml, renderAttributeValue, renderRawValue, renderValue };

package/dist/index.js

@@ -21,8 +21,28 @@ function escapeHtml(value) {
 function renderValue(value) {
   return escapeHtml(value);
 }
+function renderAttributeValue(value) {
+  if (value === null || value === void 0) {
+    return "";
+  }
+  return escapeHtml(String(value));
+}
+function renderRawValue(value) {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (value === null || value === void 0 || value === false) {
+    return "";
+  }
+  const kind = Array.isArray(value) ? "array" : typeof value;
+  throw new TypeError(
+    `Raw interpolation {{{ }}} requires a string, null, undefined or false, but received a value of type ${kind}.`
+  );
+}
 export {
   escapeHtml,
+  renderAttributeValue,
+  renderRawValue,
   renderValue
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/escape-html.ts","../src/render-value.ts"],"sourcesContent":["const HTML_ESCAPE_REPLACEMENTS: Record<string, string> = {\n  \"&\": \"&amp;\",\n  \"<\": \"&lt;\",\n  \">\": \"&gt;\",\n  '\"': \"&quot;\",\n  \"'\": \"&#39;\",\n};\n\nconst HTML_ESCAPE_PATTERN = /[&<>\"']/g;\n\nexport function escapeHtml(value: unknown): string {\n  if (value === null || value === undefined || value === false) {\n    return \"\";\n  }\n\n  return String(value).replace(\n    HTML_ESCAPE_PATTERN,\n    (character) => HTML_ESCAPE_REPLACEMENTS[character],\n  );\n}\n","import { escapeHtml } from \"./escape-html\";\n\nexport function renderValue(value: unknown): string {\n  return escapeHtml(value);\n}\n"],"mappings":";AAAA,IAAM,2BAAmD;AAAA,EACvD,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AAEA,IAAM,sBAAsB;AAErB,SAAS,WAAW,OAAwB;AACjD,MAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,OAAO;AAC5D,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,KAAK,EAAE;AAAA,IACnB;AAAA,IACA,CAAC,cAAc,yBAAyB,SAAS;AAAA,EACnD;AACF;;;ACjBO,SAAS,YAAY,OAAwB;AAClD,SAAO,WAAW,KAAK;AACzB;","names":[]}
+{"version":3,"sources":["../src/escape-html.ts","../src/render-value.ts"],"sourcesContent":["const HTML_ESCAPE_REPLACEMENTS: Record<string, string> = {\n  \"&\": \"&amp;\",\n  \"<\": \"&lt;\",\n  \">\": \"&gt;\",\n  '\"': \"&quot;\",\n  \"'\": \"&#39;\",\n};\n\nconst HTML_ESCAPE_PATTERN = /[&<>\"']/g;\n\nexport function escapeHtml(value: unknown): string {\n  if (value === null || value === undefined || value === false) {\n    return \"\";\n  }\n\n  return String(value).replace(\n    HTML_ESCAPE_PATTERN,\n    (character) => HTML_ESCAPE_REPLACEMENTS[character],\n  );\n}\n","import { escapeHtml } from \"./escape-html\";\n\nexport function renderValue(value: unknown): string {\n  return escapeHtml(value);\n}\n\nexport function renderAttributeValue(value: unknown): string {\n  if (value === null || value === undefined) {\n    return \"\";\n  }\n\n  return escapeHtml(String(value));\n}\n\n/**\n * Insert an already-trusted HTML fragment verbatim. Backs `{{{ expression }}}`.\n *\n * This performs NO escaping and NO sanitization: the template author asserts\n * the value is trusted or already sanitized HTML. Passing user-supplied markup\n * here is a cross-site scripting vulnerability.\n *\n * Deliberately narrow contract: only strings are inserted. `null`, `undefined`\n * and `false` render as an empty string (like {@link renderValue}). Every\n * other value throws a `TypeError` rather than being stringified, so a number,\n * array or object never turns into markup by accident.\n */\nexport function renderRawValue(value: unknown): string {\n  if (typeof value === \"string\") {\n    return value;\n  }\n\n  if (value === null || value === undefined || value === false) {\n    return \"\";\n  }\n\n  const kind = Array.isArray(value) ? \"array\" : typeof value;\n  throw new TypeError(\n    `Raw interpolation {{{ }}} requires a string, null, undefined or false, but received a value of type ${kind}.`,\n  );\n}\n"],"mappings":";AAAA,IAAM,2BAAmD;AAAA,EACvD,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AAEA,IAAM,sBAAsB;AAErB,SAAS,WAAW,OAAwB;AACjD,MAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,OAAO;AAC5D,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,KAAK,EAAE;AAAA,IACnB;AAAA,IACA,CAAC,cAAc,yBAAyB,SAAS;AAAA,EACnD;AACF;;;ACjBO,SAAS,YAAY,OAAwB;AAClD,SAAO,WAAW,KAAK;AACzB;AAEO,SAAS,qBAAqB,OAAwB;AAC3D,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;AAAA,EACT;AAEA,SAAO,WAAW,OAAO,KAAK,CAAC;AACjC;AAcO,SAAS,eAAe,OAAwB;AACrD,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AAEA,MAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,OAAO;AAC5D,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,UAAU,OAAO;AACrD,QAAM,IAAI;AAAA,IACR,uGAAuG,IAAI;AAAA,EAC7G;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowview/runtime",
-  "version": "0.1.2",
+  "version": "0.2.0",
   "description": "Tiny runtime for flowview-generated render functions.",
   "license": "MIT",
   "type": "module",