import { SourceConstructor_1 } from "../../../types/constructor.types.js"; /** * Per-call HTML parsing options for `construct_source_1.fromHtml()`. */ export interface HtmlSourceOptions { /** Per-call override for HTML sanitization. * * SAFE pipeline (`pipelineOptions.unsafe === false`): * - `sanitize !== false` → DOMPurify via `parse_external_html`. * - `sanitize === false` → raw HTML via `parse_html` (no DOMPurify). * * UNSAFE pipeline (`pipelineOptions.unsafe === true`): * - This flag is ignored; HTML is always parsed via `parse_html`. */ sanitize?: boolean; } /** * Unified Hson source constructor (NEW). * * This is stage 1 of the NEW pipeline: * - It accepts *source formats* (HTML / JSON / Hson / DOM / IR), * - Normalizes them into a single HsonNode frame, * - Then hands that frame to `construct_output_2` (stage 2). * * It does **not** attach anything to the DOM. * * Trust model: * - `pipelineOptions.unsafe === false` (SAFE pipeline): * - HTML sources are sanitized by default (DOMPurify via `parse_external_html`). * - You may override per-call with `{ sanitize: false }` if the HTML is * truly internal / trusted. Doing that on untrusted content is a security risk. * * - `pipelineOptions.unsafe === true` (UNSAFE pipeline): * - HTML sources bypass sanitization and go through `parse_html` verbatim. * - Intended only for trusted, developer-authored content (fixtures, demos). * * Non-HTML sources (JSON / Hson / Node): * - Are treated as *structural* inputs. * - Are **not** passed through DOMPurify here. * - If they encode HTML AST and you want HTML-style sanitization, you must do * that explicitly later (e.g. Node → HTML → DOMPurify → Node). * * @param pipelineOptions - Pipeline configuration (safe vs unsafe parsing). * @returns Stage-1 constructor API for creating a normalized Hson frame. */ export declare function construct_source_1(pipelineOptions?: { unsafe: boolean; }): SourceConstructor_1; //# sourceMappingURL=construct-source-1.d.ts.map