feat: add JSON export filtering and robust boolean coercion

CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## Unreleased
 
+### New Features
+
+- feat: Add `json-include` whitelist of dot-separated paths to keep in the JSON export.
+- feat: Add `json-exclude` blacklist of dot-separated paths to drop from the JSON export.
+- feat: Add `json-exclude-sensitive` option (default `true`) to redact host filesystem paths (`quarto.doc.input_file`, `quarto.doc.output_file`, `quarto.project.directory`, `quarto.project.output_directory`, `pandoc.PANDOC_SCRIPT_FILE`).
+- feat: Add `json-warn-on-server` option (default `true`) to warn when JSON export is enabled in CI or server contexts.
+
+### Bug Fixes
+
+- fix: Coerce boolean metadata robustly, accepting raw Lua booleans, Pandoc `MetaBool`, and the strings `'true'`/`'false'` (case-insensitive).
+- fix: Reset module-level configuration state at the start of each `Meta` pass to prevent cross-document leakage in batch renders.
+
+### Documentation
+
+- docs: Document the JSON export schema, filtering options, and example coverage for the new filter behaviour.
+
 ## 1.4.1 (2026-04-15)
 
 ### Refactoring

README.md

@@ -79,7 +79,70 @@ extensions:
     json: "custom-path.json"  # Exports to "custom-path.json"
 ```
 
-The JSON file will contain all the LUA environment metadata collected during document rendering.
+The boolean toggle accepts raw YAML booleans (`true`, `false`), their quoted string forms (`"true"`, `"false"`), and a path string for custom filenames.
+
+### JSON export schema
+
+The exported JSON has two top-level keys, `pandoc` and `quarto`, that mirror the live Pandoc/Quarto Lua objects:
+
+```json
+{
+  "pandoc": {
+    "FORMAT": "html",
+    "PANDOC_API_VERSION": "1.23",
+    "PANDOC_VERSION": "3.6.3",
+    "PANDOC_READER_OPTIONS": { },
+    "PANDOC_WRITER_OPTIONS": { },
+    "PANDOC_STATE": { }
+  },
+  "quarto": {
+    "version": [1, 7, 32],
+    "doc": { },
+    "project": { },
+    "log": { },
+    "json": { }
+  }
+}
+```
+
+Functions and userdata values are dropped.
+Empty branches are pruned.
+
+### Filtering the export
+
+Four sibling options control what ends up in the JSON file:
+
+- `json-include`: array of dot-separated paths to keep (e.g. `pandoc.FORMAT`).
+  Everything outside the listed paths is omitted.
+  Omit to keep every non-excluded path.
+- `json-exclude`: array of dot-separated paths to drop.
+  Applied after the include whitelist.
+- `json-exclude-sensitive` (default `true`): redacts built-in sensitive paths that expose host filesystem layout.
+  The redacted paths are `quarto.doc.input_file`, `quarto.doc.output_file`, `quarto.project.directory`, `quarto.project.output_directory`, and `pandoc.PANDOC_SCRIPT_FILE`.
+  Set to `false` to include them.
+- `json-warn-on-server` (default `true`): emits a warning when JSON export is enabled in a CI or server context (`CI`, `GITHUB_ACTIONS`, `GITLAB_CI`, `CIRCLECI`, `TRAVIS`, `JENKINS_URL`, `BUILDKITE`, `TF_BUILD`).
+  Set to `false` to silence the warning.
+
+Example, keeping only the active format and Quarto version:
+
+```yaml
+extensions:
+  lua-env:
+    json: true
+    json-include:
+      - pandoc.FORMAT
+      - quarto.version
+```
+
+Example, removing a noisy branch while keeping everything else:
+
+```yaml
+extensions:
+  lua-env:
+    json: true
+    json-exclude:
+      - quarto._quarto
+```
 
 ## Example
 

_extensions/lua-env/_extension.yml

@@ -5,5 +5,5 @@ quarto-required: ">=1.4.459"
 contributes:
   shortcodes:
     - lua-env-shortcode.lua
-  filters: 
+  filters:
     - lua-env-filter.lua

_extensions/lua-env/_schema.yml

@@ -1,27 +1,47 @@
-# _schema.yml for "lua-env" filter and shortcode extension
+# Schema for the lua-env extension
 # Describes options and shortcode arguments for IDE tooling and runtime validation.
 
 # Extension-level metadata options.
 # Configured in _quarto.yml, _metadata.yml, or document front matter:
 #   extensions:
 #     lua-env:
 #       json: true
+#       json-include: ["pandoc.FORMAT", "quarto.version"]
+#       json-exclude: ["quarto._quarto"]
+#       json-exclude-sensitive: true
+#       json-warn-on-server: true
 
-$schema: https://m.canouil.dev/quarto-wizard/assets/schema/v1/extension-schema.json
+$schema: https://m.canouil.dev/quarto-wizard/assets/schema/v2/extension-schema.json
 
 options:
   json:
     type: [boolean, string]
     default: false
-    description: "Export the Lua environment metadata to a JSON file. Set to true for 'lua-env.json', false to disable, or a custom file path."
+    description: "Export the Lua environment metadata to a JSON file, using true for 'lua-env.json', false to disable, or a custom file path."
+  json-include:
+    type: [string, array]
+    default: null
+    description: "Whitelist of dot-separated paths to include in the JSON export, omitting anything outside the listed paths."
+  json-exclude:
+    type: [string, array]
+    default: null
+    description: "Blacklist of dot-separated paths to omit from the JSON export, applied after the include whitelist."
+  json-exclude-sensitive:
+    type: boolean
+    default: true
+    description: "Redact built-in sensitive paths that expose host filesystem layout, set to false to include them."
+  json-warn-on-server:
+    type: boolean
+    default: true
+    description: "Emit a warning when JSON export is enabled in a CI or server context, set to false to silence the warning."
 
 # Per-shortcode schemas.
 # Describes positional arguments for {{< lua-env >}}.
 shortcodes:
   lua-env:
-    description: "Outputs the value of a Lua environment variable from the collected metadata."
+    description: "Output the value of a Lua environment variable from the collected metadata."
     arguments:
       - name: variable
         type: string
         required: true
-        description: "Dot-separated path to the variable (e.g., 'quarto.version', 'pandoc.PANDOC_VERSION')."
+        description: "Dot-separated path to the variable, such as 'quarto.version' or 'pandoc.PANDOC_VERSION'."