@wdprlib/ast 2.3.0 → 4.0.0

package/README.md

@@ -20,6 +20,21 @@ const tree: SyntaxTree = {
 };
 ```
 
+## Security-sensitive settings
+
+`createSettings(mode)` supplies safe defaults for parser and renderer capabilities. In every mode,
+including `"page"`, `allowStyleElements` defaults to `false` because `[[module CSS]]` affects the
+entire host page. Callers may override it to `true` only for trusted CSS:
+
+```ts
+import { createSettings } from "@wdprlib/ast";
+
+const settings = {
+  ...createSettings("page"),
+  allowStyleElements: true,
+};
+```
+
 ## Exports
 
 Types: `SyntaxTree`, `Element`, `ElementName`, `ContainerType`, `AttributeMap`, `LinkType`, `ListType`, `Module`, etc.

package/dist/index.cjs

@@ -54,6 +54,7 @@ __export(exports_src, {
   container: () => container,
   bold: () => bold,
   STYLE_SLOT_PREFIX: () => STYLE_SLOT_PREFIX,
+  STYLE_ANCHOR_PREFIX: () => STYLE_ANCHOR_PREFIX,
   DEFAULT_SETTINGS: () => DEFAULT_SETTINGS,
   CSS_LENGTH_UNITS: () => CSS_LENGTH_UNITS
 });
@@ -254,6 +255,7 @@ function isParagraphSafe(element) {
 }
 // packages/ast/src/constants.ts
 var STYLE_SLOT_PREFIX = "\x00__IFTAGS_SLOT__";
+var STYLE_ANCHOR_PREFIX = "\x00__STYLE_ANCHOR__";
 // packages/ast/src/css.ts
 var CSS_LENGTH_UNITS = [
   "cqmax",
@@ -704,7 +706,7 @@ function createSettings(mode) {
         enablePageSyntax: true,
         allowLocalPaths: true,
         useTrueIds: true,
-        allowStyleElements: true,
+        allowStyleElements: false,
         allowHtmlBlocks: true
       };
     case "draft":

package/dist/index.d.cts

@@ -1233,6 +1233,13 @@ interface ParseResult {
 */
 declare const STYLE_SLOT_PREFIX = "\0__IFTAGS_SLOT__";
 /**
+* Sentinel prefix for invisible style-position anchors retained in the AST.
+*
+* The suffix is the previously collected CSS text. Renderers must not emit
+* these synthetic style elements.
+*/
+declare const STYLE_ANCHOR_PREFIX = "\0__STYLE_ANCHOR__";
+/**
 * Context-dependent settings for the Wikidot parser and renderer.
 *
 * Wikidot content appears in several different contexts — full wiki pages,
@@ -1255,7 +1262,7 @@ declare const STYLE_SLOT_PREFIX = "\0__IFTAGS_SLOT__";
 *
 * | Mode               | Page syntax | Local paths | True IDs | Style elements | HTML blocks |
 * |--------------------|:-----------:|:-----------:|:--------:|:--------------:|:-----------:|
-* | `"page"`           | yes         | yes         | yes      | yes            | yes         |
+* | `"page"`           | yes         | yes         | yes      | no             | yes         |
 * | `"draft"`          | yes         | yes         | no       | no             | no          |
 * | `"forum-post"`     | no          | no          | no       | no             | no          |
 * | `"direct-message"` | no          | no          | no       | no             | no          |
@@ -1304,9 +1311,9 @@ interface WikitextSettings {
 	/**
 	* Whether `[[module CSS]]` blocks are rendered as `<style>` tags.
 	*
-	* User-authored CSS can break page layout, so it is allowed only on
-	* full wiki pages. In draft previews, forum posts, and direct messages
-	* the CSS module is silently ignored.
+	* User-authored CSS can break page layout and leak page data, so it is
+	* disabled by default in every mode. Callers may explicitly enable it
+	* only for trusted CSS.
 	*/
 	allowStyleElements: boolean;
 	/**
@@ -1394,6 +1401,28 @@ declare function formatExprValue(n: number): string;
 * @returns A success result with a numeric value, or an error result with a message.
 */
 declare function evaluateExpression(expr: string): ExprResult;
+/** Attachment metadata used by page-contextual gallery rendering. */
+interface WikitextPageFile {
+	name: string;
+	createdAt?: number;
+}
+/**
+* Page data shared by high-level parser and renderer APIs.
+*
+* `fullName` is the category-qualified Wikidot page name. `unixName`, when
+* available, is the separately named URL-safe page identifier.
+*/
+interface WikitextPageContext {
+	fullName: string;
+	unixName?: string;
+	tags: string[];
+	urlPath?: string;
+	site?: string;
+	domain?: string;
+	siteDomains?: Record<string, string>;
+	resolveSiteDomain?: (site: string) => string | null | undefined;
+	files?: WikitextPageFile[];
+}
 /**
 * Identifies the source markup dialect.
 *
@@ -1403,4 +1432,4 @@ declare function evaluateExpression(expr: string): ExprResult;
 * @group Core
 */
 type Version = "wikidot";
-export { text, paragraph, listItemSubList, listItemElements, list, link, lineBreak, italics, isTruthy, isStringContainerType, isParagraphSafe, isHeaderType, isContainerTypeParagraphSafe, isAlignType, horizontalRule, heading, formatExprValue, evaluateExpression, createSettings, createPosition, createPoint, container, bold, WikitextSettings, WikitextMode, Version, VariableMap, UserData, TocEntry, TableRow, TableOfContentsData, TableData, TableCell, TabData, SyntaxTree, StringContainerType, STYLE_SLOT_PREFIX, Position, Point, ParseResult, PageRef, Module, MathInlineData, MathData, ListType, ListItem, ListData, LinkType, LinkLocation, LinkLabel, LinkData, IncludeData, ImageSource, ImageData, IframeData, IfTagsData, IfExprData, IfCondData, HtmlData, HeadingLevel, Heading, HeaderType, GallerySize, GalleryOrder, GalleryItem, GalleryData, GalleryContent, FootnoteBlockData, FloatAlignment, ExprResult, ExprData, EmbedBlockData, Embed, ElementOf, ElementName, ElementDataMap, ElementData, Element, DiagnosticSeverity, Diagnostic, DefinitionListItem, DateItem, DateData, DEFAULT_SETTINGS, CssLengthUnit, ContainerType, ContainerData, ColorData, CollapsibleData, CodeBlockData, ClearFloat, CSS_LENGTH_UNITS, BibliographyCiteData, BibliographyBlockData, AttributeMap, AnchorTarget, AnchorData, Alignment, AlignType };
+export { text, paragraph, listItemSubList, listItemElements, list, link, lineBreak, italics, isTruthy, isStringContainerType, isParagraphSafe, isHeaderType, isContainerTypeParagraphSafe, isAlignType, horizontalRule, heading, formatExprValue, evaluateExpression, createSettings, createPosition, createPoint, container, bold, WikitextSettings, WikitextPageFile, WikitextPageContext, WikitextMode, Version, VariableMap, UserData, TocEntry, TableRow, TableOfContentsData, TableData, TableCell, TabData, SyntaxTree, StringContainerType, STYLE_SLOT_PREFIX, STYLE_ANCHOR_PREFIX, Position, Point, ParseResult, PageRef, Module, MathInlineData, MathData, ListType, ListItem, ListData, LinkType, LinkLocation, LinkLabel, LinkData, IncludeData, ImageSource, ImageData, IframeData, IfTagsData, IfExprData, IfCondData, HtmlData, HeadingLevel, Heading, HeaderType, GallerySize, GalleryOrder, GalleryItem, GalleryData, GalleryContent, FootnoteBlockData, FloatAlignment, ExprResult, ExprData, EmbedBlockData, Embed, ElementOf, ElementName, ElementDataMap, ElementData, Element, DiagnosticSeverity, Diagnostic, DefinitionListItem, DateItem, DateData, DEFAULT_SETTINGS, CssLengthUnit, ContainerType, ContainerData, ColorData, CollapsibleData, CodeBlockData, ClearFloat, CSS_LENGTH_UNITS, BibliographyCiteData, BibliographyBlockData, AttributeMap, AnchorTarget, AnchorData, Alignment, AlignType };

package/dist/index.d.ts

@@ -1233,6 +1233,13 @@ interface ParseResult {
 */
 declare const STYLE_SLOT_PREFIX = "\0__IFTAGS_SLOT__";
 /**
+* Sentinel prefix for invisible style-position anchors retained in the AST.
+*
+* The suffix is the previously collected CSS text. Renderers must not emit
+* these synthetic style elements.
+*/
+declare const STYLE_ANCHOR_PREFIX = "\0__STYLE_ANCHOR__";
+/**
 * Context-dependent settings for the Wikidot parser and renderer.
 *
 * Wikidot content appears in several different contexts — full wiki pages,
@@ -1255,7 +1262,7 @@ declare const STYLE_SLOT_PREFIX = "\0__IFTAGS_SLOT__";
 *
 * | Mode               | Page syntax | Local paths | True IDs | Style elements | HTML blocks |
 * |--------------------|:-----------:|:-----------:|:--------:|:--------------:|:-----------:|
-* | `"page"`           | yes         | yes         | yes      | yes            | yes         |
+* | `"page"`           | yes         | yes         | yes      | no             | yes         |
 * | `"draft"`          | yes         | yes         | no       | no             | no          |
 * | `"forum-post"`     | no          | no          | no       | no             | no          |
 * | `"direct-message"` | no          | no          | no       | no             | no          |
@@ -1304,9 +1311,9 @@ interface WikitextSettings {
 	/**
 	* Whether `[[module CSS]]` blocks are rendered as `<style>` tags.
 	*
-	* User-authored CSS can break page layout, so it is allowed only on
-	* full wiki pages. In draft previews, forum posts, and direct messages
-	* the CSS module is silently ignored.
+	* User-authored CSS can break page layout and leak page data, so it is
+	* disabled by default in every mode. Callers may explicitly enable it
+	* only for trusted CSS.
 	*/
 	allowStyleElements: boolean;
 	/**
@@ -1394,6 +1401,28 @@ declare function formatExprValue(n: number): string;
 * @returns A success result with a numeric value, or an error result with a message.
 */
 declare function evaluateExpression(expr: string): ExprResult;
+/** Attachment metadata used by page-contextual gallery rendering. */
+interface WikitextPageFile {
+	name: string;
+	createdAt?: number;
+}
+/**
+* Page data shared by high-level parser and renderer APIs.
+*
+* `fullName` is the category-qualified Wikidot page name. `unixName`, when
+* available, is the separately named URL-safe page identifier.
+*/
+interface WikitextPageContext {
+	fullName: string;
+	unixName?: string;
+	tags: string[];
+	urlPath?: string;
+	site?: string;
+	domain?: string;
+	siteDomains?: Record<string, string>;
+	resolveSiteDomain?: (site: string) => string | null | undefined;
+	files?: WikitextPageFile[];
+}
 /**
 * Identifies the source markup dialect.
 *
@@ -1403,4 +1432,4 @@ declare function evaluateExpression(expr: string): ExprResult;
 * @group Core
 */
 type Version = "wikidot";
-export { text, paragraph, listItemSubList, listItemElements, list, link, lineBreak, italics, isTruthy, isStringContainerType, isParagraphSafe, isHeaderType, isContainerTypeParagraphSafe, isAlignType, horizontalRule, heading, formatExprValue, evaluateExpression, createSettings, createPosition, createPoint, container, bold, WikitextSettings, WikitextMode, Version, VariableMap, UserData, TocEntry, TableRow, TableOfContentsData, TableData, TableCell, TabData, SyntaxTree, StringContainerType, STYLE_SLOT_PREFIX, Position, Point, ParseResult, PageRef, Module, MathInlineData, MathData, ListType, ListItem, ListData, LinkType, LinkLocation, LinkLabel, LinkData, IncludeData, ImageSource, ImageData, IframeData, IfTagsData, IfExprData, IfCondData, HtmlData, HeadingLevel, Heading, HeaderType, GallerySize, GalleryOrder, GalleryItem, GalleryData, GalleryContent, FootnoteBlockData, FloatAlignment, ExprResult, ExprData, EmbedBlockData, Embed, ElementOf, ElementName, ElementDataMap, ElementData, Element, DiagnosticSeverity, Diagnostic, DefinitionListItem, DateItem, DateData, DEFAULT_SETTINGS, CssLengthUnit, ContainerType, ContainerData, ColorData, CollapsibleData, CodeBlockData, ClearFloat, CSS_LENGTH_UNITS, BibliographyCiteData, BibliographyBlockData, AttributeMap, AnchorTarget, AnchorData, Alignment, AlignType };
+export { text, paragraph, listItemSubList, listItemElements, list, link, lineBreak, italics, isTruthy, isStringContainerType, isParagraphSafe, isHeaderType, isContainerTypeParagraphSafe, isAlignType, horizontalRule, heading, formatExprValue, evaluateExpression, createSettings, createPosition, createPoint, container, bold, WikitextSettings, WikitextPageFile, WikitextPageContext, WikitextMode, Version, VariableMap, UserData, TocEntry, TableRow, TableOfContentsData, TableData, TableCell, TabData, SyntaxTree, StringContainerType, STYLE_SLOT_PREFIX, STYLE_ANCHOR_PREFIX, Position, Point, ParseResult, PageRef, Module, MathInlineData, MathData, ListType, ListItem, ListData, LinkType, LinkLocation, LinkLabel, LinkData, IncludeData, ImageSource, ImageData, IframeData, IfTagsData, IfExprData, IfCondData, HtmlData, HeadingLevel, Heading, HeaderType, GallerySize, GalleryOrder, GalleryItem, GalleryData, GalleryContent, FootnoteBlockData, FloatAlignment, ExprResult, ExprData, EmbedBlockData, Embed, ElementOf, ElementName, ElementDataMap, ElementData, Element, DiagnosticSeverity, Diagnostic, DefinitionListItem, DateItem, DateData, DEFAULT_SETTINGS, CssLengthUnit, ContainerType, ContainerData, ColorData, CollapsibleData, CodeBlockData, ClearFloat, CSS_LENGTH_UNITS, BibliographyCiteData, BibliographyBlockData, AttributeMap, AnchorTarget, AnchorData, Alignment, AlignType };

package/dist/index.js

@@ -193,6 +193,7 @@ function isParagraphSafe(element) {
 }
 // packages/ast/src/constants.ts
 var STYLE_SLOT_PREFIX = "\x00__IFTAGS_SLOT__";
+var STYLE_ANCHOR_PREFIX = "\x00__STYLE_ANCHOR__";
 // packages/ast/src/css.ts
 var CSS_LENGTH_UNITS = [
   "cqmax",
@@ -643,7 +644,7 @@ function createSettings(mode) {
         enablePageSyntax: true,
         allowLocalPaths: true,
         useTrueIds: true,
-        allowStyleElements: true,
+        allowStyleElements: false,
         allowHtmlBlocks: true
       };
     case "draft":
@@ -693,6 +694,7 @@ export {
   container,
   bold,
   STYLE_SLOT_PREFIX,
+  STYLE_ANCHOR_PREFIX,
   DEFAULT_SETTINGS,
   CSS_LENGTH_UNITS
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wdprlib/ast",
-  "version": "2.3.0",
+  "version": "4.0.0",
   "description": "AST types for Wikidot markup",
   "keywords": [
     "ast",

package/src/constants.ts

@@ -10,3 +10,11 @@
  * A null-byte prefix ensures no collision with valid CSS content.
  */
 export const STYLE_SLOT_PREFIX = "\0__IFTAGS_SLOT__";
+
+/**
+ * Sentinel prefix for invisible style-position anchors retained in the AST.
+ *
+ * The suffix is the previously collected CSS text. Renderers must not emit
+ * these synthetic style elements.
+ */
+export const STYLE_ANCHOR_PREFIX = "\0__STYLE_ANCHOR__";

package/src/index.ts

@@ -113,7 +113,7 @@ export {
 export type { Diagnostic, DiagnosticSeverity, ParseResult } from "./diagnostic";
 
 // Constants
-export { STYLE_SLOT_PREFIX } from "./constants";
+export { STYLE_ANCHOR_PREFIX, STYLE_SLOT_PREFIX } from "./constants";
 
 // CSS value definitions
 export type { CssLengthUnit } from "./css";
@@ -126,3 +126,6 @@ export type { WikitextMode, WikitextSettings } from "./settings";
 export { evaluateExpression, isTruthy, formatExprValue } from "./expr-eval";
 export type { ExprResult } from "./expr-eval";
 export { createSettings, DEFAULT_SETTINGS } from "./settings";
+
+// Shared high-level pipeline page context
+export type { WikitextPageContext, WikitextPageFile } from "./page-context";

package/src/page-context.ts

@@ -0,0 +1,23 @@
+/** Attachment metadata used by page-contextual gallery rendering. */
+export interface WikitextPageFile {
+  name: string;
+  createdAt?: number;
+}
+
+/**
+ * Page data shared by high-level parser and renderer APIs.
+ *
+ * `fullName` is the category-qualified Wikidot page name. `unixName`, when
+ * available, is the separately named URL-safe page identifier.
+ */
+export interface WikitextPageContext {
+  fullName: string;
+  unixName?: string;
+  tags: string[];
+  urlPath?: string;
+  site?: string;
+  domain?: string;
+  siteDomains?: Record<string, string>;
+  resolveSiteDomain?: (site: string) => string | null | undefined;
+  files?: WikitextPageFile[];
+}

package/src/settings.ts

@@ -22,7 +22,7 @@
  *
  * | Mode               | Page syntax | Local paths | True IDs | Style elements | HTML blocks |
  * |--------------------|:-----------:|:-----------:|:--------:|:--------------:|:-----------:|
- * | `"page"`           | yes         | yes         | yes      | yes            | yes         |
+ * | `"page"`           | yes         | yes         | yes      | no             | yes         |
  * | `"draft"`          | yes         | yes         | no       | no             | no          |
  * | `"forum-post"`     | no          | no          | no       | no             | no          |
  * | `"direct-message"` | no          | no          | no       | no             | no          |
@@ -76,9 +76,9 @@ export interface WikitextSettings {
   /**
    * Whether `[[module CSS]]` blocks are rendered as `<style>` tags.
    *
-   * User-authored CSS can break page layout, so it is allowed only on
-   * full wiki pages. In draft previews, forum posts, and direct messages
-   * the CSS module is silently ignored.
+   * User-authored CSS can break page layout and leak page data, so it is
+   * disabled by default in every mode. Callers may explicitly enable it
+   * only for trusted CSS.
    */
   allowStyleElements: boolean;
 
@@ -121,7 +121,7 @@ export function createSettings(mode: WikitextMode): WikitextSettings {
         enablePageSyntax: true,
         allowLocalPaths: true,
         useTrueIds: true,
-        allowStyleElements: true,
+        allowStyleElements: false,
         allowHtmlBlocks: true,
       };
     case "draft":