@flowview/runtime 0.1.2 → 0.2.1

package/README.md

@@ -0,0 +1,28 @@
+# @flowview/runtime
+
+The runtime contains the small HTML escaping and value helpers used by
+FlowView-generated render functions. It does not parse templates, compile code,
+or provide a sanitizer.
+
+```ts
+import {
+  renderValue,
+  renderAttributeValue,
+  renderRawValue,
+} from "@flowview/runtime";
+
+renderValue("<script>"); // &lt;script&gt;
+renderRawValue("<b>trusted</b>"); // <b>trusted</b>
+```
+
+FlowView templates are trusted source. Ordinary interpolation (`{{ value }}`)
+escapes HTML by default. Raw interpolation (`{{{ value }}}`) is explicit and
+must receive an already trusted or sanitized string. Passing untrusted markup
+to it can cause cross-site scripting. `@flowview/runtime` is not a sanitizer.
+
+Mixed static text plus interpolation in one attribute value is unsupported by
+the compiler. The optional `track` expression is accepted but has no rendering
+effect; the compiler reports warning `FV0015`.
+
+See the root [FlowView guide](../../README.md) and
+[security model](../../SECURITY.md).

package/dist/index.d.ts

@@ -1,6 +1,20 @@
 declare function escapeHtml(value: unknown): string;
 
 declare function renderValue(value: unknown): string;
+declare function renderAttributeValue(value: unknown): string;
+/**
+ * Insert an already-trusted HTML fragment verbatim. Backs `{{{ expression }}}`.
+ *
+ * This performs NO escaping and NO sanitization: the template author asserts
+ * the value is trusted or already sanitized HTML. Passing user-supplied markup
+ * here is a cross-site scripting vulnerability.
+ *
+ * Deliberately narrow contract: only strings are inserted. `null`, `undefined`
+ * and `false` render as an empty string (like {@link renderValue}). Every
+ * other value throws a `TypeError` rather than being stringified, so a number,
+ * array or object never turns into markup by accident.
+ */
+declare function renderRawValue(value: unknown): string;
 
 /**
  * Generic shape of the context object passed to a generated render function.
@@ -11,4 +25,4 @@ type RenderContext = Record<string, unknown>;
  */
 type RenderFunction<C extends RenderContext = RenderContext> = (context: C) => string;
 
-export { type RenderContext, type RenderFunction, escapeHtml, renderValue };
+export { type RenderContext, type RenderFunction, escapeHtml, renderAttributeValue, renderRawValue, renderValue };

package/dist/index.js

@@ -21,8 +21,28 @@ function escapeHtml(value) {
 function renderValue(value) {
   return escapeHtml(value);
 }
+function renderAttributeValue(value) {
+  if (value === null || value === void 0) {
+    return "";
+  }
+  return escapeHtml(String(value));
+}
+function renderRawValue(value) {
+  if (typeof value === "string") {
+    return value;
+  }
+  if (value === null || value === void 0 || value === false) {
+    return "";
+  }
+  const kind = Array.isArray(value) ? "array" : typeof value;
+  throw new TypeError(
+    `Raw interpolation {{{ }}} requires a string, null, undefined or false, but received a value of type ${kind}.`
+  );
+}
 export {
   escapeHtml,
+  renderAttributeValue,
+  renderRawValue,
   renderValue
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/escape-html.ts","../src/render-value.ts"],"sourcesContent":["const HTML_ESCAPE_REPLACEMENTS: Record<string, string> = {\n  \"&\": \"&amp;\",\n  \"<\": \"&lt;\",\n  \">\": \"&gt;\",\n  '\"': \"&quot;\",\n  \"'\": \"&#39;\",\n};\n\nconst HTML_ESCAPE_PATTERN = /[&<>\"']/g;\n\nexport function escapeHtml(value: unknown): string {\n  if (value === null || value === undefined || value === false) {\n    return \"\";\n  }\n\n  return String(value).replace(\n    HTML_ESCAPE_PATTERN,\n    (character) => HTML_ESCAPE_REPLACEMENTS[character],\n  );\n}\n","import { escapeHtml } from \"./escape-html\";\n\nexport function renderValue(value: unknown): string {\n  return escapeHtml(value);\n}\n"],"mappings":";AAAA,IAAM,2BAAmD;AAAA,EACvD,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AAEA,IAAM,sBAAsB;AAErB,SAAS,WAAW,OAAwB;AACjD,MAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,OAAO;AAC5D,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,KAAK,EAAE;AAAA,IACnB;AAAA,IACA,CAAC,cAAc,yBAAyB,SAAS;AAAA,EACnD;AACF;;;ACjBO,SAAS,YAAY,OAAwB;AAClD,SAAO,WAAW,KAAK;AACzB;","names":[]}
+{"version":3,"sources":["../src/escape-html.ts","../src/render-value.ts"],"sourcesContent":["const HTML_ESCAPE_REPLACEMENTS: Record<string, string> = {\n  \"&\": \"&amp;\",\n  \"<\": \"&lt;\",\n  \">\": \"&gt;\",\n  '\"': \"&quot;\",\n  \"'\": \"&#39;\",\n};\n\nconst HTML_ESCAPE_PATTERN = /[&<>\"']/g;\n\nexport function escapeHtml(value: unknown): string {\n  if (value === null || value === undefined || value === false) {\n    return \"\";\n  }\n\n  return String(value).replace(\n    HTML_ESCAPE_PATTERN,\n    (character) => HTML_ESCAPE_REPLACEMENTS[character],\n  );\n}\n","import { escapeHtml } from \"./escape-html\";\n\nexport function renderValue(value: unknown): string {\n  return escapeHtml(value);\n}\n\nexport function renderAttributeValue(value: unknown): string {\n  if (value === null || value === undefined) {\n    return \"\";\n  }\n\n  return escapeHtml(String(value));\n}\n\n/**\n * Insert an already-trusted HTML fragment verbatim. Backs `{{{ expression }}}`.\n *\n * This performs NO escaping and NO sanitization: the template author asserts\n * the value is trusted or already sanitized HTML. Passing user-supplied markup\n * here is a cross-site scripting vulnerability.\n *\n * Deliberately narrow contract: only strings are inserted. `null`, `undefined`\n * and `false` render as an empty string (like {@link renderValue}). Every\n * other value throws a `TypeError` rather than being stringified, so a number,\n * array or object never turns into markup by accident.\n */\nexport function renderRawValue(value: unknown): string {\n  if (typeof value === \"string\") {\n    return value;\n  }\n\n  if (value === null || value === undefined || value === false) {\n    return \"\";\n  }\n\n  const kind = Array.isArray(value) ? \"array\" : typeof value;\n  throw new TypeError(\n    `Raw interpolation {{{ }}} requires a string, null, undefined or false, but received a value of type ${kind}.`,\n  );\n}\n"],"mappings":";AAAA,IAAM,2BAAmD;AAAA,EACvD,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AAEA,IAAM,sBAAsB;AAErB,SAAS,WAAW,OAAwB;AACjD,MAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,OAAO;AAC5D,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,KAAK,EAAE;AAAA,IACnB;AAAA,IACA,CAAC,cAAc,yBAAyB,SAAS;AAAA,EACnD;AACF;;;ACjBO,SAAS,YAAY,OAAwB;AAClD,SAAO,WAAW,KAAK;AACzB;AAEO,SAAS,qBAAqB,OAAwB;AAC3D,MAAI,UAAU,QAAQ,UAAU,QAAW;AACzC,WAAO;AAAA,EACT;AAEA,SAAO,WAAW,OAAO,KAAK,CAAC;AACjC;AAcO,SAAS,eAAe,OAAwB;AACrD,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO;AAAA,EACT;AAEA,MAAI,UAAU,QAAQ,UAAU,UAAa,UAAU,OAAO;AAC5D,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,UAAU,OAAO;AACrD,QAAM,IAAI;AAAA,IACR,uGAAuG,IAAI;AAAA,EAC7G;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowview/runtime",
-  "version": "0.1.2",
+  "version": "0.2.1",
   "description": "Tiny runtime for flowview-generated render functions.",
   "license": "MIT",
   "type": "module",