@wdprlib/render 0.1.4 → 1.0.0-rc.0

package/dist/index.d.cts

@@ -1,6 +1,24 @@
 import { SyntaxTree as SyntaxTree2 } from "@wdprlib/ast";
 import { Element } from "@wdprlib/ast";
 /**
+* Allowlist entry for embed content validation
+* Each entry specifies a host pattern and optional path prefix
+*/
+interface EmbedAllowlistEntry {
+	/** Host pattern. Supports wildcard prefix '*.' (e.g., '*.youtube.com') */
+	host: string;
+	/** Optional path prefix that must match (e.g., '/embed/') */
+	pathPrefix?: string;
+}
+/**
+* Default allowlist for embed content (ported from Wikidot's default.php)
+* Only iframes with src matching these host+path patterns will be rendered.
+*
+* Note: Set to null to allow any HTTPS iframe (Wikidot's 'anyiframe' behavior).
+* DOMPurify still enforces HTTPS-only and blocks dangerous attributes.
+*/
+declare const DEFAULT_EMBED_ALLOWLIST: EmbedAllowlistEntry[] | null;
+/**
 * Page context for resolving links, images, etc.
 */
 interface PageContext {
@@ -12,6 +30,8 @@ interface PageContext {
 	domain?: string;
 	/** Check if a page exists (for "newpage" class on links) */
 	pageExists?: (page: string) => boolean;
+	/** Page tags for [[iftags]] conditional rendering */
+	tags?: string[];
 }
 /**
 * Resolved user information for rendering
@@ -23,6 +43,8 @@ interface ResolvedUser {
 	url?: string;
 	/** Avatar image URL. If not provided, no avatar is rendered */
 	avatarUrl?: string;
+	/** Karma image URL for avatar background (Wikidot-specific feature) */
+	karmaUrl?: string;
 }
 /**
 * Resolver functions for dynamic content
@@ -65,9 +87,17 @@ interface RenderOptions {
 	* - Allow scripts: htmlBlockSandbox: "allow-scripts allow-same-origin"
 	*/
 	htmlBlockSandbox?: string | null;
+	/**
+	* Allowlist for [[embed]] content with host and optional path validation.
+	* - undefined: Uses default allowlist (YouTube, Vimeo, etc. with path restrictions)
+	* - EmbedAllowlistEntry[]: Custom allowlist with host patterns and optional path prefixes
+	* - []: Block all embeds
+	* - null: Allow any HTTPS iframe (Wikidot's 'anyiframe' behavior)
+	*/
+	embedAllowlist?: EmbedAllowlistEntry[] | null;
 }
 /**
 * Render a SyntaxTree to HTML string
 */
 declare function renderToHtml(tree: SyntaxTree2, options?: RenderOptions): string;
-export { renderToHtml, ResolvedUser, RenderResolvers, RenderOptions, PageContext };
+export { renderToHtml, ResolvedUser, RenderResolvers, RenderOptions, PageContext, DEFAULT_EMBED_ALLOWLIST };

package/dist/index.d.ts

@@ -1,6 +1,24 @@
 import { SyntaxTree as SyntaxTree2 } from "@wdprlib/ast";
 import { Element } from "@wdprlib/ast";
 /**
+* Allowlist entry for embed content validation
+* Each entry specifies a host pattern and optional path prefix
+*/
+interface EmbedAllowlistEntry {
+	/** Host pattern. Supports wildcard prefix '*.' (e.g., '*.youtube.com') */
+	host: string;
+	/** Optional path prefix that must match (e.g., '/embed/') */
+	pathPrefix?: string;
+}
+/**
+* Default allowlist for embed content (ported from Wikidot's default.php)
+* Only iframes with src matching these host+path patterns will be rendered.
+*
+* Note: Set to null to allow any HTTPS iframe (Wikidot's 'anyiframe' behavior).
+* DOMPurify still enforces HTTPS-only and blocks dangerous attributes.
+*/
+declare const DEFAULT_EMBED_ALLOWLIST: EmbedAllowlistEntry[] | null;
+/**
 * Page context for resolving links, images, etc.
 */
 interface PageContext {
@@ -12,6 +30,8 @@ interface PageContext {
 	domain?: string;
 	/** Check if a page exists (for "newpage" class on links) */
 	pageExists?: (page: string) => boolean;
+	/** Page tags for [[iftags]] conditional rendering */
+	tags?: string[];
 }
 /**
 * Resolved user information for rendering
@@ -23,6 +43,8 @@ interface ResolvedUser {
 	url?: string;
 	/** Avatar image URL. If not provided, no avatar is rendered */
 	avatarUrl?: string;
+	/** Karma image URL for avatar background (Wikidot-specific feature) */
+	karmaUrl?: string;
 }
 /**
 * Resolver functions for dynamic content
@@ -65,9 +87,17 @@ interface RenderOptions {
 	* - Allow scripts: htmlBlockSandbox: "allow-scripts allow-same-origin"
 	*/
 	htmlBlockSandbox?: string | null;
+	/**
+	* Allowlist for [[embed]] content with host and optional path validation.
+	* - undefined: Uses default allowlist (YouTube, Vimeo, etc. with path restrictions)
+	* - EmbedAllowlistEntry[]: Custom allowlist with host patterns and optional path prefixes
+	* - []: Block all embeds
+	* - null: Allow any HTTPS iframe (Wikidot's 'anyiframe' behavior)
+	*/
+	embedAllowlist?: EmbedAllowlistEntry[] | null;
 }
 /**
 * Render a SyntaxTree to HTML string
 */
 declare function renderToHtml(tree: SyntaxTree2, options?: RenderOptions): string;
-export { renderToHtml, ResolvedUser, RenderResolvers, RenderOptions, PageContext };
+export { renderToHtml, ResolvedUser, RenderResolvers, RenderOptions, PageContext, DEFAULT_EMBED_ALLOWLIST };