@scrider/formatter 1.6.1 → 1.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.cts CHANGED
@@ -143,6 +143,26 @@ declare function isTextNode(node: DOMNode): boolean;
143
143
  * - embed: non-text content (image, video, formula...)
144
144
  */
145
145
  type FormatScope = 'inline' | 'block' | 'embed';
146
+ /**
147
+ * Cross-origin iframe isolation options for Delta → HTML (Phase 8 Part 3.5).
148
+ *
149
+ * Passed via `deltaToHtml({ embed: … })` and forwarded to embed `render()`.
150
+ * Default: both off — standard third-party iframes load with browser cookies
151
+ * (CodePen, YouTube). Enable when the host page is cross-origin-isolated
152
+ * (COOP + COEP) and needs StackBlitz WebContainer live preview.
153
+ */
154
+ interface EmbedIsolationOptions {
155
+ /** Add `credentialless` on cross-origin iframe embeds. @default false */
156
+ credentialless?: boolean;
157
+ /** Add `allow="…; cross-origin-isolated"` on codeWidget iframes. @default false */
158
+ crossOriginIsolated?: boolean;
159
+ }
160
+ /**
161
+ * Optional context passed to Format.render() during conversion.
162
+ */
163
+ interface FormatRenderContext {
164
+ embed?: EmbedIsolationOptions;
165
+ }
146
166
  /**
147
167
  * Result returned by Format.match() when an HTML element is recognized.
148
168
  */
@@ -199,9 +219,10 @@ interface Format<T = unknown> {
199
219
  *
200
220
  * @param value - The embed value (e.g. URL string)
201
221
  * @param attributes - Op-level attributes (alt, width, height, etc.)
222
+ * @param context - Render options (e.g. embed isolation for iframe embeds)
202
223
  * @returns HTML string
203
224
  */
204
- render?(value: T, attributes?: AttributeMap): string;
225
+ render?(value: T, attributes?: AttributeMap, context?: FormatRenderContext): string;
205
226
  /**
206
227
  * Match an HTML element and extract Delta embed value.
207
228
  *
@@ -1011,11 +1032,16 @@ declare const blockFormat: Format<Record<string, unknown>>;
1011
1032
  *
1012
1033
  * Markdown: ![Widget](url)
1013
1034
  * HTML: <iframe data-code-widget src="<embed-url>" frameborder="0" allowfullscreen
1014
- * allow="…; cross-origin-isolated">
1035
+ * [allow="…; cross-origin-isolated"] [credentialless]>
1036
+ *
1037
+ * Isolation attrs (`allow="…; cross-origin-isolated"`, `credentialless`) are
1038
+ * opt-in via `deltaToHtml({ embed: { crossOriginIsolated, credentialless } })`.
1039
+ * Default off — public embeds (CodePen) load with browser cookies.
1015
1040
  *
1016
1041
  * The `allow="…; cross-origin-isolated"` list (see CODE_WIDGET_IFRAME_ALLOW)
1017
1042
  * delegates the cross-origin-isolated capability so StackBlitz WebContainer
1018
- * embeds can boot SharedArrayBuffer; without it those embeds render blank.
1043
+ * embeds can boot SharedArrayBuffer when the host is cross-origin-isolated.
1044
+ * `credentialless` keeps the frame loadable under COEP on such a host.
1019
1045
  *
1020
1046
  * The src is run through `toCodeWidgetEmbedUrl` at render time, which is
1021
1047
  * idempotent, so resize/float attributes and the Delta ↔ HTML round-trip stay
@@ -1503,6 +1529,12 @@ interface DeltaToHtmlOptions {
1503
1529
  * Office/HTML export and clipboard. Does not change Delta.
1504
1530
  */
1505
1531
  documentPresentation?: DocumentPresentation;
1532
+ /**
1533
+ * Cross-origin iframe isolation for embed formats (codeWidget, video iframe).
1534
+ * Default: both off — standard third-party iframes load with browser cookies.
1535
+ * Enable when the host page is cross-origin-isolated (COOP + COEP).
1536
+ */
1537
+ embed?: EmbedIsolationOptions;
1506
1538
  }
1507
1539
  /**
1508
1540
  * Convert a Delta to an HTML string
@@ -1596,6 +1628,12 @@ interface ParserContext$1 {
1596
1628
  */
1597
1629
  declare function htmlToDelta(html: string, options?: HtmlToDeltaOptions): Delta;
1598
1630
 
1631
+ /**
1632
+ * HTML ↔ Delta Mapping Configuration
1633
+ *
1634
+ * Defines the mapping between HTML elements/attributes and Delta attributes.
1635
+ */
1636
+
1599
1637
  /**
1600
1638
  * Escape HTML special characters
1601
1639
  */
@@ -1988,4 +2026,4 @@ declare function isTableNewlineOp(op: Op | undefined): boolean;
1988
2026
  */
1989
2027
  declare function extractTableRegion(ops: readonly Op[], hintOpIdx: number): TableRegion | null;
1990
2028
 
1991
- export { ALERT_TYPES, type AlertBlockData, type AlertType, type AlignType, BOX_FLOAT_VALUES, BOX_OVERFLOW_VALUES, type BlockContext, type BlockHandler, BlockHandlerRegistry, type BlockRenderOptions, type BoxBlockData, type BoxFloat, type BoxOpAttributes, type BoxOverflow, BrowserDOMAdapter, type CellAlign, type CellData, type ColumnsBlockData, type DOMAdapter, type DOMDocument, type DOMDocumentFragment, type DOMElement, type DOMNode, type DOMNodeList, type DeltaToHtmlOptions, type DeltaToMarkdownOptions, type DocumentPresentation, type FootnotesBlockData, type Format, type FormatDefinition, type FormatMatchResult, type FormatScope, type HtmlToDeltaOptions, LINE_HEIGHT_BLOCK_TAGS, type ListType, type MarkdownToDeltaOptions, NODE_TYPE, NodeDOMAdapter, PARAGRAPH_SPACING_BLOCK_TAGS, Registry, type ResolvedDocumentPresentation, type ResolvedTablePresentation, SCRIDER_LINE_HEIGHT_KEY, SCRIDER_MARGIN_AFTER_KEY, SCRIDER_MARGIN_BEFORE_KEY, type SanitizeOptions, type TableBlockData, type TableCellAlign, type TableColAlignType, type TablePresentation, type TableRegion, alertBlockHandler, alignFormat, backgroundFormat, blockFormat, blockLineHeightStyleParts, blockMarginAfterStyleParts, blockMarginBeforeStyleParts, blockParagraphMarginStyleParts, blockPresentationStyleParts, blockquoteFormat, boldFormat, boxBlockHandler, browserAdapter, cloneDelta, codeBlockFormat, codeFormat, codeWidgetFormat, colorFormat, columnsBlockHandler, createDefaultBlockHandlers, createDefaultRegistry, defaultBlockFormats, defaultEmbedFormats, defaultFormats, defaultInlineFormats, deltaToHtml, deltaToMarkdown, dividerFormat, documentPresentationStyleParts, escapeHtml, extractBoxOpAttributes, extractTableRegion, fontFormat, footnoteRefFormat, footnotesBlockHandler, formulaFormat, getAdapter, getNamedColors, headerFormat, headerIdFormat, htmlToDelta, imageFormat, indentFormat, isAdapterAvailable, isElement, isRemarkAvailable, isTableNewlineOp, isTextNode, isValidColor, isValidHexColor, isZebraBodyRow, italicFormat, kbdFormat, linkFormat, listFormat, markFormat, markdownToDelta, markdownToDeltaSync, nodeAdapter, normalizeDelta, parseScriderLineHeightMultiplier, parseScriderMarginAfterEm, parseScriderMarginBeforeEm, parseScriderMarginEm, preloadRemark, resolveDocumentPresentation, resolveTablePresentation, sanitizeDelta, sizeFormat, slugify, slugifyWithDedup, softBreakFormat, strikeFormat, subscriptFormat, superscriptFormat, tableBlockHandler, tableColAlignFormat, tableColFormat, tableHeaderFormat, tableRowFormat, toCodeWidgetEmbedUrl, toHexColor, underlineFormat, unescapeHtml, validateDelta, videoFormat };
2029
+ export { ALERT_TYPES, type AlertBlockData, type AlertType, type AlignType, BOX_FLOAT_VALUES, BOX_OVERFLOW_VALUES, type BlockContext, type BlockHandler, BlockHandlerRegistry, type BlockRenderOptions, type BoxBlockData, type BoxFloat, type BoxOpAttributes, type BoxOverflow, BrowserDOMAdapter, type CellAlign, type CellData, type ColumnsBlockData, type DOMAdapter, type DOMDocument, type DOMDocumentFragment, type DOMElement, type DOMNode, type DOMNodeList, type DeltaToHtmlOptions, type DeltaToMarkdownOptions, type DocumentPresentation, type EmbedIsolationOptions, type FootnotesBlockData, type Format, type FormatDefinition, type FormatMatchResult, type FormatRenderContext, type FormatScope, type HtmlToDeltaOptions, LINE_HEIGHT_BLOCK_TAGS, type ListType, type MarkdownToDeltaOptions, NODE_TYPE, NodeDOMAdapter, PARAGRAPH_SPACING_BLOCK_TAGS, Registry, type ResolvedDocumentPresentation, type ResolvedTablePresentation, SCRIDER_LINE_HEIGHT_KEY, SCRIDER_MARGIN_AFTER_KEY, SCRIDER_MARGIN_BEFORE_KEY, type SanitizeOptions, type TableBlockData, type TableCellAlign, type TableColAlignType, type TablePresentation, type TableRegion, alertBlockHandler, alignFormat, backgroundFormat, blockFormat, blockLineHeightStyleParts, blockMarginAfterStyleParts, blockMarginBeforeStyleParts, blockParagraphMarginStyleParts, blockPresentationStyleParts, blockquoteFormat, boldFormat, boxBlockHandler, browserAdapter, cloneDelta, codeBlockFormat, codeFormat, codeWidgetFormat, colorFormat, columnsBlockHandler, createDefaultBlockHandlers, createDefaultRegistry, defaultBlockFormats, defaultEmbedFormats, defaultFormats, defaultInlineFormats, deltaToHtml, deltaToMarkdown, dividerFormat, documentPresentationStyleParts, escapeHtml, extractBoxOpAttributes, extractTableRegion, fontFormat, footnoteRefFormat, footnotesBlockHandler, formulaFormat, getAdapter, getNamedColors, headerFormat, headerIdFormat, htmlToDelta, imageFormat, indentFormat, isAdapterAvailable, isElement, isRemarkAvailable, isTableNewlineOp, isTextNode, isValidColor, isValidHexColor, isZebraBodyRow, italicFormat, kbdFormat, linkFormat, listFormat, markFormat, markdownToDelta, markdownToDeltaSync, nodeAdapter, normalizeDelta, parseScriderLineHeightMultiplier, parseScriderMarginAfterEm, parseScriderMarginBeforeEm, parseScriderMarginEm, preloadRemark, resolveDocumentPresentation, resolveTablePresentation, sanitizeDelta, sizeFormat, slugify, slugifyWithDedup, softBreakFormat, strikeFormat, subscriptFormat, superscriptFormat, tableBlockHandler, tableColAlignFormat, tableColFormat, tableHeaderFormat, tableRowFormat, toCodeWidgetEmbedUrl, toHexColor, underlineFormat, unescapeHtml, validateDelta, videoFormat };
package/dist/index.d.ts CHANGED
@@ -143,6 +143,26 @@ declare function isTextNode(node: DOMNode): boolean;
143
143
  * - embed: non-text content (image, video, formula...)
144
144
  */
145
145
  type FormatScope = 'inline' | 'block' | 'embed';
146
+ /**
147
+ * Cross-origin iframe isolation options for Delta → HTML (Phase 8 Part 3.5).
148
+ *
149
+ * Passed via `deltaToHtml({ embed: … })` and forwarded to embed `render()`.
150
+ * Default: both off — standard third-party iframes load with browser cookies
151
+ * (CodePen, YouTube). Enable when the host page is cross-origin-isolated
152
+ * (COOP + COEP) and needs StackBlitz WebContainer live preview.
153
+ */
154
+ interface EmbedIsolationOptions {
155
+ /** Add `credentialless` on cross-origin iframe embeds. @default false */
156
+ credentialless?: boolean;
157
+ /** Add `allow="…; cross-origin-isolated"` on codeWidget iframes. @default false */
158
+ crossOriginIsolated?: boolean;
159
+ }
160
+ /**
161
+ * Optional context passed to Format.render() during conversion.
162
+ */
163
+ interface FormatRenderContext {
164
+ embed?: EmbedIsolationOptions;
165
+ }
146
166
  /**
147
167
  * Result returned by Format.match() when an HTML element is recognized.
148
168
  */
@@ -199,9 +219,10 @@ interface Format<T = unknown> {
199
219
  *
200
220
  * @param value - The embed value (e.g. URL string)
201
221
  * @param attributes - Op-level attributes (alt, width, height, etc.)
222
+ * @param context - Render options (e.g. embed isolation for iframe embeds)
202
223
  * @returns HTML string
203
224
  */
204
- render?(value: T, attributes?: AttributeMap): string;
225
+ render?(value: T, attributes?: AttributeMap, context?: FormatRenderContext): string;
205
226
  /**
206
227
  * Match an HTML element and extract Delta embed value.
207
228
  *
@@ -1011,11 +1032,16 @@ declare const blockFormat: Format<Record<string, unknown>>;
1011
1032
  *
1012
1033
  * Markdown: ![Widget](url)
1013
1034
  * HTML: <iframe data-code-widget src="<embed-url>" frameborder="0" allowfullscreen
1014
- * allow="…; cross-origin-isolated">
1035
+ * [allow="…; cross-origin-isolated"] [credentialless]>
1036
+ *
1037
+ * Isolation attrs (`allow="…; cross-origin-isolated"`, `credentialless`) are
1038
+ * opt-in via `deltaToHtml({ embed: { crossOriginIsolated, credentialless } })`.
1039
+ * Default off — public embeds (CodePen) load with browser cookies.
1015
1040
  *
1016
1041
  * The `allow="…; cross-origin-isolated"` list (see CODE_WIDGET_IFRAME_ALLOW)
1017
1042
  * delegates the cross-origin-isolated capability so StackBlitz WebContainer
1018
- * embeds can boot SharedArrayBuffer; without it those embeds render blank.
1043
+ * embeds can boot SharedArrayBuffer when the host is cross-origin-isolated.
1044
+ * `credentialless` keeps the frame loadable under COEP on such a host.
1019
1045
  *
1020
1046
  * The src is run through `toCodeWidgetEmbedUrl` at render time, which is
1021
1047
  * idempotent, so resize/float attributes and the Delta ↔ HTML round-trip stay
@@ -1503,6 +1529,12 @@ interface DeltaToHtmlOptions {
1503
1529
  * Office/HTML export and clipboard. Does not change Delta.
1504
1530
  */
1505
1531
  documentPresentation?: DocumentPresentation;
1532
+ /**
1533
+ * Cross-origin iframe isolation for embed formats (codeWidget, video iframe).
1534
+ * Default: both off — standard third-party iframes load with browser cookies.
1535
+ * Enable when the host page is cross-origin-isolated (COOP + COEP).
1536
+ */
1537
+ embed?: EmbedIsolationOptions;
1506
1538
  }
1507
1539
  /**
1508
1540
  * Convert a Delta to an HTML string
@@ -1596,6 +1628,12 @@ interface ParserContext$1 {
1596
1628
  */
1597
1629
  declare function htmlToDelta(html: string, options?: HtmlToDeltaOptions): Delta;
1598
1630
 
1631
+ /**
1632
+ * HTML ↔ Delta Mapping Configuration
1633
+ *
1634
+ * Defines the mapping between HTML elements/attributes and Delta attributes.
1635
+ */
1636
+
1599
1637
  /**
1600
1638
  * Escape HTML special characters
1601
1639
  */
@@ -1988,4 +2026,4 @@ declare function isTableNewlineOp(op: Op | undefined): boolean;
1988
2026
  */
1989
2027
  declare function extractTableRegion(ops: readonly Op[], hintOpIdx: number): TableRegion | null;
1990
2028
 
1991
- export { ALERT_TYPES, type AlertBlockData, type AlertType, type AlignType, BOX_FLOAT_VALUES, BOX_OVERFLOW_VALUES, type BlockContext, type BlockHandler, BlockHandlerRegistry, type BlockRenderOptions, type BoxBlockData, type BoxFloat, type BoxOpAttributes, type BoxOverflow, BrowserDOMAdapter, type CellAlign, type CellData, type ColumnsBlockData, type DOMAdapter, type DOMDocument, type DOMDocumentFragment, type DOMElement, type DOMNode, type DOMNodeList, type DeltaToHtmlOptions, type DeltaToMarkdownOptions, type DocumentPresentation, type FootnotesBlockData, type Format, type FormatDefinition, type FormatMatchResult, type FormatScope, type HtmlToDeltaOptions, LINE_HEIGHT_BLOCK_TAGS, type ListType, type MarkdownToDeltaOptions, NODE_TYPE, NodeDOMAdapter, PARAGRAPH_SPACING_BLOCK_TAGS, Registry, type ResolvedDocumentPresentation, type ResolvedTablePresentation, SCRIDER_LINE_HEIGHT_KEY, SCRIDER_MARGIN_AFTER_KEY, SCRIDER_MARGIN_BEFORE_KEY, type SanitizeOptions, type TableBlockData, type TableCellAlign, type TableColAlignType, type TablePresentation, type TableRegion, alertBlockHandler, alignFormat, backgroundFormat, blockFormat, blockLineHeightStyleParts, blockMarginAfterStyleParts, blockMarginBeforeStyleParts, blockParagraphMarginStyleParts, blockPresentationStyleParts, blockquoteFormat, boldFormat, boxBlockHandler, browserAdapter, cloneDelta, codeBlockFormat, codeFormat, codeWidgetFormat, colorFormat, columnsBlockHandler, createDefaultBlockHandlers, createDefaultRegistry, defaultBlockFormats, defaultEmbedFormats, defaultFormats, defaultInlineFormats, deltaToHtml, deltaToMarkdown, dividerFormat, documentPresentationStyleParts, escapeHtml, extractBoxOpAttributes, extractTableRegion, fontFormat, footnoteRefFormat, footnotesBlockHandler, formulaFormat, getAdapter, getNamedColors, headerFormat, headerIdFormat, htmlToDelta, imageFormat, indentFormat, isAdapterAvailable, isElement, isRemarkAvailable, isTableNewlineOp, isTextNode, isValidColor, isValidHexColor, isZebraBodyRow, italicFormat, kbdFormat, linkFormat, listFormat, markFormat, markdownToDelta, markdownToDeltaSync, nodeAdapter, normalizeDelta, parseScriderLineHeightMultiplier, parseScriderMarginAfterEm, parseScriderMarginBeforeEm, parseScriderMarginEm, preloadRemark, resolveDocumentPresentation, resolveTablePresentation, sanitizeDelta, sizeFormat, slugify, slugifyWithDedup, softBreakFormat, strikeFormat, subscriptFormat, superscriptFormat, tableBlockHandler, tableColAlignFormat, tableColFormat, tableHeaderFormat, tableRowFormat, toCodeWidgetEmbedUrl, toHexColor, underlineFormat, unescapeHtml, validateDelta, videoFormat };
2029
+ export { ALERT_TYPES, type AlertBlockData, type AlertType, type AlignType, BOX_FLOAT_VALUES, BOX_OVERFLOW_VALUES, type BlockContext, type BlockHandler, BlockHandlerRegistry, type BlockRenderOptions, type BoxBlockData, type BoxFloat, type BoxOpAttributes, type BoxOverflow, BrowserDOMAdapter, type CellAlign, type CellData, type ColumnsBlockData, type DOMAdapter, type DOMDocument, type DOMDocumentFragment, type DOMElement, type DOMNode, type DOMNodeList, type DeltaToHtmlOptions, type DeltaToMarkdownOptions, type DocumentPresentation, type EmbedIsolationOptions, type FootnotesBlockData, type Format, type FormatDefinition, type FormatMatchResult, type FormatRenderContext, type FormatScope, type HtmlToDeltaOptions, LINE_HEIGHT_BLOCK_TAGS, type ListType, type MarkdownToDeltaOptions, NODE_TYPE, NodeDOMAdapter, PARAGRAPH_SPACING_BLOCK_TAGS, Registry, type ResolvedDocumentPresentation, type ResolvedTablePresentation, SCRIDER_LINE_HEIGHT_KEY, SCRIDER_MARGIN_AFTER_KEY, SCRIDER_MARGIN_BEFORE_KEY, type SanitizeOptions, type TableBlockData, type TableCellAlign, type TableColAlignType, type TablePresentation, type TableRegion, alertBlockHandler, alignFormat, backgroundFormat, blockFormat, blockLineHeightStyleParts, blockMarginAfterStyleParts, blockMarginBeforeStyleParts, blockParagraphMarginStyleParts, blockPresentationStyleParts, blockquoteFormat, boldFormat, boxBlockHandler, browserAdapter, cloneDelta, codeBlockFormat, codeFormat, codeWidgetFormat, colorFormat, columnsBlockHandler, createDefaultBlockHandlers, createDefaultRegistry, defaultBlockFormats, defaultEmbedFormats, defaultFormats, defaultInlineFormats, deltaToHtml, deltaToMarkdown, dividerFormat, documentPresentationStyleParts, escapeHtml, extractBoxOpAttributes, extractTableRegion, fontFormat, footnoteRefFormat, footnotesBlockHandler, formulaFormat, getAdapter, getNamedColors, headerFormat, headerIdFormat, htmlToDelta, imageFormat, indentFormat, isAdapterAvailable, isElement, isRemarkAvailable, isTableNewlineOp, isTextNode, isValidColor, isValidHexColor, isZebraBodyRow, italicFormat, kbdFormat, linkFormat, listFormat, markFormat, markdownToDelta, markdownToDeltaSync, nodeAdapter, normalizeDelta, parseScriderLineHeightMultiplier, parseScriderMarginAfterEm, parseScriderMarginBeforeEm, parseScriderMarginEm, preloadRemark, resolveDocumentPresentation, resolveTablePresentation, sanitizeDelta, sizeFormat, slugify, slugifyWithDedup, softBreakFormat, strikeFormat, subscriptFormat, superscriptFormat, tableBlockHandler, tableColAlignFormat, tableColFormat, tableHeaderFormat, tableRowFormat, toCodeWidgetEmbedUrl, toHexColor, underlineFormat, unescapeHtml, validateDelta, videoFormat };
package/dist/index.js CHANGED
@@ -1875,7 +1875,7 @@ var EMBED_RENDERERS = {
1875
1875
  const float = floatVal != null && typeof floatVal === "string" && floatVal !== "none" ? ` data-float="${escapeHtml(floatVal)}"` : "";
1876
1876
  return `<img src="${escapeHtml(src)}"${alt}${width}${height}${float}>`;
1877
1877
  },
1878
- video: (value, attrs) => {
1878
+ video: (value, attrs, context) => {
1879
1879
  const src = typeof value === "string" ? value : "";
1880
1880
  const floatVal = attrs?.float;
1881
1881
  const widthVal = attrs?.width;
@@ -1893,11 +1893,11 @@ var EMBED_RENDERERS = {
1893
1893
  const style = styles.length > 0 ? ` style="${styles.join("; ")}"` : "";
1894
1894
  const embedSrc = toVideoEmbedUrl(src);
1895
1895
  if (embedSrc) {
1896
- return `<iframe src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen${float}${style}></iframe>`;
1896
+ return `<iframe src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen${renderEmbedIframeIsolationAttrs(context, "video")}${float}${style}></iframe>`;
1897
1897
  }
1898
1898
  return `<video src="${escapeHtml(src)}" controls${float}${style}></video>`;
1899
1899
  },
1900
- codeWidget: (value, attrs) => {
1900
+ codeWidget: (value, attrs, context) => {
1901
1901
  const src = typeof value === "string" ? value : "";
1902
1902
  const floatVal = attrs?.float;
1903
1903
  const widthVal = attrs?.width;
@@ -1914,7 +1914,7 @@ var EMBED_RENDERERS = {
1914
1914
  }
1915
1915
  const style = styles.length > 0 ? ` style="${styles.join("; ")}"` : "";
1916
1916
  const embedSrc = toCodeWidgetEmbedUrl(src);
1917
- return `<iframe data-code-widget src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen allow="${CODE_WIDGET_IFRAME_ALLOW}"${float}${style}></iframe>`;
1917
+ return `<iframe data-code-widget src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen${renderEmbedIframeIsolationAttrs(context, "codeWidget")}${float}${style}></iframe>`;
1918
1918
  },
1919
1919
  formula: (value) => {
1920
1920
  const latex = typeof value === "string" ? value : "";
@@ -2035,6 +2035,17 @@ function appendQueryParam(url, key, value) {
2035
2035
  return `${base}${next}${hash}`;
2036
2036
  }
2037
2037
  var CODE_WIDGET_IFRAME_ALLOW = "accelerometer; camera; encrypted-media; geolocation; gyroscope; microphone; midi; payment; usb; vr; xr-spatial-tracking; cross-origin-isolated";
2038
+ function renderEmbedIframeIsolationAttrs(context, kind) {
2039
+ const opts = context?.embed;
2040
+ const parts = [];
2041
+ if (kind === "codeWidget" && opts?.crossOriginIsolated) {
2042
+ parts.push(`allow="${CODE_WIDGET_IFRAME_ALLOW}"`);
2043
+ }
2044
+ if (opts?.credentialless) {
2045
+ parts.push("credentialless");
2046
+ }
2047
+ return parts.length ? ` ${parts.join(" ")}` : "";
2048
+ }
2038
2049
  function toCodeWidgetEmbedUrl(url) {
2039
2050
  const u = typeof url === "string" ? url.trim() : "";
2040
2051
  if (!u) return "";
@@ -2086,7 +2097,7 @@ var codeWidgetFormat = {
2086
2097
  return false;
2087
2098
  }
2088
2099
  },
2089
- render(value, attributes) {
2100
+ render(value, attributes, context) {
2090
2101
  const src = typeof value === "string" ? value : "";
2091
2102
  const floatVal = attributes?.float;
2092
2103
  const widthVal = attributes?.width;
@@ -2103,7 +2114,7 @@ var codeWidgetFormat = {
2103
2114
  }
2104
2115
  const style = styles.length > 0 ? ` style="${styles.join("; ")}"` : "";
2105
2116
  const embedSrc = toCodeWidgetEmbedUrl(src);
2106
- return `<iframe data-code-widget src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen allow="${CODE_WIDGET_IFRAME_ALLOW}"${float}${style}></iframe>`;
2117
+ return `<iframe data-code-widget src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen${renderEmbedIframeIsolationAttrs(context, "codeWidget")}${float}${style}></iframe>`;
2107
2118
  },
2108
2119
  match(element) {
2109
2120
  if (element.tagName.toLowerCase() !== "iframe") return null;
@@ -2349,7 +2360,7 @@ var videoFormat = {
2349
2360
  return false;
2350
2361
  }
2351
2362
  },
2352
- render(value, attributes) {
2363
+ render(value, attributes, context) {
2353
2364
  const src = typeof value === "string" ? value : "";
2354
2365
  const floatVal = attributes?.float;
2355
2366
  const widthVal = attributes?.width;
@@ -2367,7 +2378,7 @@ var videoFormat = {
2367
2378
  const style = styles.length > 0 ? ` style="${styles.join("; ")}"` : "";
2368
2379
  const embedSrc = toVideoEmbedUrl(src);
2369
2380
  if (embedSrc) {
2370
- return `<iframe src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen${float}${style}></iframe>`;
2381
+ return `<iframe src="${escapeHtml(embedSrc)}" frameborder="0" allowfullscreen${renderEmbedIframeIsolationAttrs(context, "video")}${float}${style}></iframe>`;
2371
2382
  }
2372
2383
  return `<video src="${escapeHtml(src)}" controls${float}${style}></video>`;
2373
2384
  },
@@ -3372,16 +3383,17 @@ function renderEmbed(value, attributes, renderers, blockHandlers, options) {
3372
3383
  return "";
3373
3384
  }
3374
3385
  const embedValue = value[embedType];
3386
+ const embedContext = options?.embed != null ? { embed: options.embed } : {};
3375
3387
  const registry = options?.registry;
3376
3388
  if (registry) {
3377
3389
  const format = registry.get(embedType);
3378
3390
  if (format?.render) {
3379
- return format.render(embedValue, attributes);
3391
+ return format.render(embedValue, attributes, embedContext);
3380
3392
  }
3381
3393
  }
3382
3394
  const renderer = renderers[embedType];
3383
3395
  if (renderer) {
3384
- return renderer(embedValue, attributes);
3396
+ return renderer(embedValue, attributes, embedContext);
3385
3397
  }
3386
3398
  return `<span data-embed="${escapeHtml(embedType)}" data-value="${escapeHtml(String(embedValue))}"></span>`;
3387
3399
  }