@memberjunction/templates 6.2.0-edge.3 → 6.2.0-edge.4

package/README.md

@@ -124,6 +124,68 @@ The engine provides built-in filters for JSON operations:
 {% set parsed = jsonString | jsonparse %}
 ```
 
+### Template Sandbox
+
+Users can edit stored templates, so the engine guards nunjucks when this package loads
+(`HardenNunjucksRuntime()`). The guard is process-wide: it also covers nunjucks environments that
+other packages create, and templates loaded through `include` and `import`. It checks templates at
+two points.
+
+**Before a template compiles.** The nunjucks compiler copies names from the template into the code it
+generates, so `AssertTemplateTreeIsSafe()` checks every parsed template first:
+
+- Variable, filter, loop, `set`, macro, import and block names must be plain names: letters,
+  combining marks, digits, connector characters such as `_`, and `$`. A filter name can also contain
+  dots.
+- A test name (`is defined`, `is none`) and an extension's registered name and method must not
+  contain a quote, a backslash or a line break.
+- A name that every object inherits (a member of `Object.prototype`, such as `toString`,
+  `hasOwnProperty` or `constructor`), or `prototype`, must not be used as a dictionary key, a keyword
+  argument, a macro or call-block argument, a `set`, loop, import, macro or block name, or a filter or
+  test name. The code generator also refuses such a name as a dictionary key or keyword argument. Bare
+  names and member reads are not in this rule: `{{ constructor }}` reads only an own key of the render
+  data, and a member read such as `obj.constructor` or `value.toLocaleString()` goes through the
+  render-time member check (see below).
+- The name of a called member, such as `obj["key"]()`, must not contain a backslash or a line break.
+- A loop variable must not reuse an identifier that the generated loop code uses, such as `context`,
+  `frame`, `runtime`, `env`, `cb`, `next`, `tasks` or `undefined`. A unit test compiles every kind of
+  loop body with nunjucks 3.2.4, including loops inside macros and blocks, and checks this list against
+  the generated code, so a nunjucks upgrade that adds an identifier fails the test.
+- The parse tree may hold only nunjucks nodes, plain values and regular expression literals. This
+  matters only for extensions, which build their own nodes.
+
+**While a template renders.**
+
+- A filter, test or global resolves only to a name that the environment registered itself, never to a
+  member that every object inherits. This also covers the test names that the `select` and `reject`
+  filters receive while the template renders. Such a name must be text, a number or another simple
+  value such as `none`; an object, a function or a symbol is refused.
+- The member names `constructor`, `prototype` and the `__define/lookup Getter/Setter__` accessors read
+  as empty unless they hold an object's own data that is not a function. `__proto__` always reads as
+  empty. This applies to a literal member name (`obj.name`, `obj["name"]`) and to one computed while
+  the template renders (`obj[key]`) alike.
+- A bare name such as `{{ user }}` resolves only to a template variable, an own key of the render data,
+  or an own environment global. It never resolves to a property that the data or the globals inherit,
+  such as `valueOf`.
+- A macro or call-block argument that a call leaves out is filled only from a keyword argument of the
+  same name that the call itself passes, never from a member that the keyword arguments inherit, so
+  otherwise it reads as empty. Keyword arguments written at a call site must be a plain object literal
+  with ordinary names; keyword arguments passed as a value (from render data, for example) are read
+  through a copy of their own keys.
+- A template must not read a member of the render context, an environment, a loader, a frame, a
+  template or a nunjucks module. A lookup or call that would return one of them fails.
+- A template must not reach `Function` (or its async and generator variants), `eval`, `Object`,
+  `Reflect`, `globalThis` or `process`.
+
+A template that breaks one of these rules fails with a `TemplateSandboxError`.
+
+The guard blocks reflection and code injection, not ordinary methods. Pass templates plain data, not
+objects whose methods reach the database or the file system (for example `BaseEntity` instances).
+
+The `RunTemplate` mutation and the `Template.Run` remote operation also apply
+`GetTemplateRunRefusal()` before they load anything: they refuse scope-limited sessions and callers
+without read permission on `MJ: Templates` and `MJ: Template Contents`.
+
 ### Template Extensions
 
 Extensions are registered via the MJ class factory:

package/dist/InheritedMemberNames.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview The one list of names that the template sandbox refuses wherever a template names something.
+ * @module @memberjunction/templates
+ */
+/**
+ * True for a name that a template may not use as a dictionary key, a keyword argument, a macro or call-block
+ * argument, a variable, macro or block name, or a filter or test name. nunjucks reads and writes such names
+ * on plain objects, where they reach inherited members or the object's prototype.
+ * @param name the name as nunjucks uses it
+ */
+export declare function IsInheritedMemberName(name: string): boolean;
+//# sourceMappingURL=InheritedMemberNames.d.ts.map

package/dist/InheritedMemberNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InheritedMemberNames.d.ts","sourceRoot":"","sources":["../src/InheritedMemberNames.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/InheritedMemberNames.js

@@ -0,0 +1,19 @@
+/**
+ * @fileoverview The one list of names that the template sandbox refuses wherever a template names something.
+ * @module @memberjunction/templates
+ */
+/**
+ * The members of `Object.prototype`, which every plain object inherits (such as `constructor`, `toString`
+ * and `__proto__`), and `prototype`, which leads from a constructor to what its instances inherit.
+ */
+const INHERITED_MEMBER_NAMES = new Set([...Object.getOwnPropertyNames(Object.prototype), 'prototype']);
+/**
+ * True for a name that a template may not use as a dictionary key, a keyword argument, a macro or call-block
+ * argument, a variable, macro or block name, or a filter or test name. nunjucks reads and writes such names
+ * on plain objects, where they reach inherited members or the object's prototype.
+ * @param name the name as nunjucks uses it
+ */
+export function IsInheritedMemberName(name) {
+    return INHERITED_MEMBER_NAMES.has(name);
+}
+//# sourceMappingURL=InheritedMemberNames.js.map

package/dist/InheritedMemberNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InheritedMemberNames.js","sourceRoot":"","sources":["../src/InheritedMemberNames.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AAE5H;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAC9C,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC"}

package/dist/NunjucksCompileGuard.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Checks a parsed nunjucks template, and throws a {@link TemplateSandboxError} if a name in it could
+ * change the code the compiler generates:
+ * - every variable, filter, loop, `set`, macro, import and block name must be a plain name (letters,
+ *   combining marks, digits, connector punctuation such as `_`, and `$`); a filter name can also contain dots
+ * - a test name, and an extension's registered name and method, must not contain a quote, a backslash or a line break
+ * - a name that every object inherits (`toString`, `hasOwnProperty`, ...), or `prototype`, must not be a
+ *   dictionary key, a keyword argument, a macro or call-block argument, a `set`, loop, import, macro or
+ *   block name, or a filter or test name
+ * - the name of a called member must not contain a backslash or a line break
+ * - a loop variable must not reuse an identifier that the generated loop code uses (`context`, `frame`,
+ *   `runtime`, `tasks`, `undefined`, ...)
+ * - the tree must hold only nunjucks nodes, plain values and regular expression literals
+ * @param tree the root node the nunjucks parser returns
+ */
+export declare function AssertTemplateTreeIsSafe(tree: unknown): void;
+//# sourceMappingURL=NunjucksCompileGuard.d.ts.map

package/dist/NunjucksCompileGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NunjucksCompileGuard.d.ts","sourceRoot":"","sources":["../src/NunjucksCompileGuard.ts"],"names":[],"mappings":"AA6DA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,CAE5D"}

package/dist/NunjucksCompileGuard.js

@@ -0,0 +1,273 @@
+/**
+ * @fileoverview Refuses nunjucks templates whose names could change the code nunjucks compiles.
+ *
+ * The nunjucks 3.2.4 compiler copies template-controlled names into the JavaScript it generates
+ * without escaping them. That covers variable, filter, test and loop names; the names that `set`,
+ * `macro`, `import` and `from` bind; and the name of a called member. The generated code runs when
+ * the template renders, so the runtime guard in `NunjucksSandbox.ts` never sees it. nunjucks also
+ * reads and writes template names as keys of plain objects, so a name that every object inherits is
+ * refused as a key, an argument or a binding. Bare names and member reads are left to the runtime guard.
+ * {@link AssertTemplateTreeIsSafe} checks a parsed template before it compiles.
+ * @module @memberjunction/templates
+ */
+import nunjucks from 'nunjucks';
+import { IsInheritedMemberName } from './InheritedMemberNames.js';
+import { TemplateSandboxError } from './TemplateSandboxError.js';
+const NUNJUCKS = nunjucks;
+/**
+ * Letters, combining marks, decimal digits, connector punctuation (such as `_`) and `$`. Each one is safe
+ * inside a JavaScript string. In a raw identifier, a character that cannot start it (a digit, a mark, or
+ * connector punctuation other than `_`) or cannot appear in it at all (U+2E2F) only makes the generated
+ * code fail with a SyntaxError.
+ */
+const PLAIN_NAME = /^[\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}$]+$/u;
+/** A filter name can also contain dots (`{{ x | ns.filter }}`). */
+const PLAIN_FILTER_NAME = /^[\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}$]+(?:\.[\p{L}\p{Mn}\p{Mc}\p{Nd}\p{Pc}$]+)*$/u;
+/** Characters that end a double-quoted JavaScript string, or escape out of it. */
+const UNSAFE_STRING_CHARACTERS = /["\\\r\n\u2028\u2029]/;
+/** The compiler escapes `"` in a called member's name, so only these characters can end that string. */
+const UNSAFE_CALL_NAME_CHARACTERS = /[\\\r\n\u2028\u2029]/;
+/**
+ * Identifiers that the generated code of a loop body uses (nunjucks 3.2.4). An async loop binds its loop
+ * variables as raw function parameters, so a loop variable with one of these names shadows them.
+ * `NunjucksCompileGuard.test.ts` compiles every kind of loop body and checks this list against the
+ * generated code.
+ */
+const RESERVED_LOOP_NAMES = new Set([
+    'env', 'context', 'frame', 'runtime', 'cb', 'next', 'lineno', 'colno', 'output', 'tasks',
+    'parentTemplate', 'callerFrame', 'kwargs', 'Object', 'Math', 'Error', 'undefined', 'Infinity',
+]);
+/** Prefixes of generated identifiers: temporaries (`t_3`, `macro_t_3`, `hole_0`), blocks (`b_`), macro arguments (`l_`). */
+const RESERVED_LOOP_NAME_PREFIX = /^(?:t|macro_t|hole|b|l)_/;
+/**
+ * Checks a parsed nunjucks template, and throws a {@link TemplateSandboxError} if a name in it could
+ * change the code the compiler generates:
+ * - every variable, filter, loop, `set`, macro, import and block name must be a plain name (letters,
+ *   combining marks, digits, connector punctuation such as `_`, and `$`); a filter name can also contain dots
+ * - a test name, and an extension's registered name and method, must not contain a quote, a backslash or a line break
+ * - a name that every object inherits (`toString`, `hasOwnProperty`, ...), or `prototype`, must not be a
+ *   dictionary key, a keyword argument, a macro or call-block argument, a `set`, loop, import, macro or
+ *   block name, or a filter or test name
+ * - the name of a called member must not contain a backslash or a line break
+ * - a loop variable must not reuse an identifier that the generated loop code uses (`context`, `frame`,
+ *   `runtime`, `tasks`, `undefined`, ...)
+ * - the tree must hold only nunjucks nodes, plain values and regular expression literals
+ * @param tree the root node the nunjucks parser returns
+ */
+export function AssertTemplateTreeIsSafe(tree) {
+    new TemplateTreeCheck().Visit(tree);
+}
+/**
+ * One pass over a parse tree. It visits every own property of every node, not only the fields
+ * nunjucks lists, because the parser stores some compiled parts outside them (the body of a `set` block).
+ */
+class TemplateTreeCheck {
+    constructor() {
+        this.visited = new WeakSet();
+        this.filterNames = new WeakSet();
+    }
+    /**
+     * Checks a value of the tree and everything under it.
+     * @param owner the node whose field holds the value
+     * @param field the name of that field
+     */
+    Visit(value, owner, field) {
+        if (Array.isArray(value)) {
+            asArray(value).forEach((item) => this.Visit(item, owner, field));
+            return;
+        }
+        if (!isNode(value)) {
+            if (!isPlainValue(value) && !isPatternLiteral(value, owner, field)) {
+                throw refusal('Template parse trees may only hold nunjucks nodes, plain values and regular expressions', owner);
+            }
+            return;
+        }
+        if (this.visited.has(value)) {
+            return;
+        }
+        this.visited.add(value);
+        this.checkNode(value);
+        for (const key of Object.keys(value)) {
+            this.Visit(property(value, key), value, key);
+        }
+    }
+    checkNode(node) {
+        switch (node.typename) {
+            case 'Symbol':
+                return this.checkName(node, node, this.filterNames.has(node) ? PLAIN_FILTER_NAME : PLAIN_NAME);
+            case 'Pair':
+                return this.refuseInheritedName(nameValue(property(node, 'key')), node, 'a dictionary key or keyword argument');
+            case 'Filter':
+            case 'FilterAsync':
+                return this.checkFilterName(node);
+            case 'Is':
+                return this.checkTestName(node);
+            case 'FunCall':
+                return this.checkCallName(node);
+            case 'Set':
+                return asArray(property(node, 'targets')).forEach((target) => this.checkBindingName(target, node));
+            case 'For':
+            case 'AsyncEach':
+            case 'AsyncAll':
+                return this.checkLoopNames(node);
+            case 'Macro':
+            case 'Caller':
+                return this.checkMacroNames(node);
+            case 'Import':
+                return this.checkBindingName(property(node, 'target'), node);
+            case 'FromImport':
+                return this.checkImportedNames(node);
+            case 'Block':
+                return this.checkBindingName(property(node, 'name'), node);
+            case 'Super':
+                return this.checkName(property(node, 'blockName'), node);
+            case 'CallExtension':
+            case 'CallExtensionAsync':
+                return this.checkExtensionCall(node);
+            default:
+                return;
+        }
+    }
+    /** A name the compiler copies as written: a symbol or a quoted string that is a plain name. */
+    checkName(nameNode, owner, pattern = PLAIN_NAME) {
+        const name = nameValue(nameNode);
+        if (name === undefined || !pattern.test(name)) {
+            throw refusal('Templates may only use plain names (letters, marks, digits, _ and $)', owner);
+        }
+    }
+    /** The one rule for every position that names something: a name that `IsInheritedMemberName` matches is refused. */
+    refuseInheritedName(name, owner, position) {
+        if (name !== undefined && IsInheritedMemberName(name)) {
+            throw refusal(`Templates may not use "${name}" as ${position}`, owner);
+        }
+    }
+    /** A name that `set`, a loop, `import`, `from` or `macro` binds as a variable, or a block name. */
+    checkBindingName(nameNode, owner) {
+        this.checkName(nameNode, owner);
+        this.refuseInheritedName(nameValue(nameNode), owner, 'a variable, macro or block name');
+    }
+    /** nunjucks finds a filter in a plain object, so a name it inherits would resolve to the inherited member. */
+    checkFilterName(node) {
+        const name = property(node, 'name');
+        if (isNode(name)) {
+            this.filterNames.add(name);
+        }
+        this.checkName(name, node, PLAIN_FILTER_NAME);
+        this.refuseInheritedName(nameValue(name), node, 'a filter or test name');
+    }
+    /** The compiler writes the test name into a double-quoted string, as text and without escaping it. */
+    checkTestName(node) {
+        const name = testName(node);
+        if (UNSAFE_STRING_CHARACTERS.test(name)) {
+            throw refusal('Templates may not use a test name that contains a quote, a backslash or a line break', node);
+        }
+        this.refuseInheritedName(name, node, 'a filter or test name');
+    }
+    /** The compiler writes the called expression's name, built by its own `_getNodeName`, into a string. */
+    checkCallName(node) {
+        let name;
+        try {
+            const compiler = NUNJUCKS.compiler.Compiler.prototype;
+            name = compiler._getNodeName.call(compiler, property(node, 'name'));
+        }
+        catch {
+            name = undefined;
+        }
+        if (typeof name !== 'string' || UNSAFE_CALL_NAME_CHARACTERS.test(name)) {
+            throw refusal('Templates may not call a member whose name contains a backslash or a line break', node);
+        }
+    }
+    checkLoopNames(node) {
+        const name = property(node, 'name');
+        const loopNames = isNode(name) && name.typename === 'Array' ? asArray(property(name, 'children')) : [name];
+        for (const loopName of loopNames) {
+            this.checkBindingName(loopName, node);
+            const value = nameValue(loopName) ?? '';
+            if (RESERVED_LOOP_NAMES.has(value) || RESERVED_LOOP_NAME_PREFIX.test(value)) {
+                throw refusal(`Templates may not use "${value}" as a loop variable`, node);
+            }
+        }
+    }
+    /** Positional arguments, and the keys of a trailing keyword-argument dictionary, become names. */
+    checkMacroNames(node) {
+        this.checkBindingName(property(node, 'name'), node);
+        const args = asArray(property(property(node, 'args'), 'children'));
+        args.forEach((arg, index) => {
+            const isKeywordArguments = index === args.length - 1 && isNode(arg) && (arg.typename === 'Dict' || arg.typename === 'KeywordArgs');
+            if (!isKeywordArguments) {
+                this.checkArgumentName(arg, node);
+                return;
+            }
+            asArray(property(arg, 'children')).forEach((pair) => this.checkArgumentName(property(pair, 'key'), node));
+        });
+    }
+    /**
+     * A macro or call-block argument. When a call leaves out a positional argument, nunjucks fills it from the
+     * call's keyword arguments, so an argument named after a member every object inherits would read that member.
+     */
+    checkArgumentName(nameNode, owner) {
+        this.checkName(nameNode, owner);
+        this.refuseInheritedName(nameValue(nameNode), owner, 'a macro or call-block argument');
+    }
+    /** The names `from ... import` reads from the imported template, and the names it binds. */
+    checkImportedNames(node) {
+        for (const entry of asArray(property(property(node, 'names'), 'children'))) {
+            if (isNode(entry) && entry.typename === 'Pair') {
+                this.checkBindingName(property(entry, 'key'), node);
+                this.checkBindingName(property(entry, 'value'), node);
+            }
+            else {
+                this.checkBindingName(entry, node);
+            }
+        }
+    }
+    /** The compiler writes an extension tag's registered name and method into double-quoted strings. */
+    checkExtensionCall(node) {
+        for (const value of [property(node, 'extName'), property(node, 'prop')]) {
+            if (typeof value !== 'string' || UNSAFE_STRING_CHARACTERS.test(value)) {
+                throw refusal('Template extensions must have names without a quote, a backslash or a line break', node);
+            }
+        }
+    }
+}
+/**
+ * The test name as the compiler writes it: the text of the called name's value for `is test(...)`,
+ * else the text of the test's own value. `is none` gives `"null"`.
+ */
+function testName(node) {
+    const test = property(node, 'right');
+    const calledName = property(test, 'name');
+    return String(calledName ? property(calledName, 'value') : property(test, 'value'));
+}
+function isNode(value) {
+    return value instanceof NUNJUCKS.nodes.Node;
+}
+/** `undefined`, `null`, a string, a number or a boolean. */
+function isPlainValue(value) {
+    return value === undefined || value === null || typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean';
+}
+/** A regular expression literal (`r/.../`), which the parser stores as the value of a Literal node. */
+function isPatternLiteral(value, owner, field) {
+    return value instanceof RegExp && owner?.typename === 'Literal' && field === 'value';
+}
+/** A node's field, or `undefined` when the value is not a node. */
+function property(node, key) {
+    return isNode(node) ? node[key] : undefined;
+}
+function asArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+/** The text of a symbol or of a quoted string, or `undefined` for any other node. */
+function nameValue(node) {
+    if (!isNode(node) || (node.typename !== 'Symbol' && node.typename !== 'Literal')) {
+        return undefined;
+    }
+    const value = property(node, 'value');
+    return typeof value === 'string' ? value : undefined;
+}
+/** The error for a refused template, with the node's position when the node has one. */
+function refusal(reason, node) {
+    const hasPosition = node !== undefined && Number.isInteger(node.lineno) && Number.isInteger(node.colno);
+    return new TemplateSandboxError(hasPosition ? `${reason} (line ${node.lineno + 1}, column ${node.colno + 1})` : reason);
+}
+//# sourceMappingURL=NunjucksCompileGuard.js.map

package/dist/NunjucksCompileGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NunjucksCompileGuard.js","sourceRoot":"","sources":["../src/NunjucksCompileGuard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAc9D,MAAM,QAAQ,GAAG,QAAwC,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,GAAG,sCAAsC,CAAC;AAE1D,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,8EAA8E,CAAC;AAEzG,kFAAkF;AAClF,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAEzD,wGAAwG;AACxG,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IACrD,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO;IACxF,gBAAgB,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU;CAChG,CAAC,CAAC;AAEH,4HAA4H;AAC5H,MAAM,yBAAyB,GAAG,0BAA0B,CAAC;AAE7D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa;IAClD,IAAI,iBAAiB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB;IAAvB;QACqB,YAAO,GAAG,IAAI,OAAO,EAAgB,CAAC;QACtC,gBAAW,GAAG,IAAI,OAAO,EAAgB,CAAC;IA+K/D,CAAC;IA7KG;;;;OAIG;IACI,KAAK,CAAC,KAAc,EAAE,KAAoB,EAAE,KAAc;QAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YACjE,OAAO;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjE,MAAM,OAAO,CAAC,yFAAyF,EAAE,KAAK,CAAC,CAAC;YACpH,CAAC;YACD,OAAO;QACX,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,IAAkB;QAChC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpB,KAAK,QAAQ;gBACT,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;YACnG,KAAK,MAAM;gBACP,OAAO,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,sCAAsC,CAAC,CAAC;YACpH,KAAK,QAAQ,CAAC;YACd,KAAK,aAAa;gBACd,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtC,KAAK,IAAI;gBACL,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,KAAK,SAAS;gBACV,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,KAAK,KAAK;gBACN,OAAO,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YACvG,KAAK,KAAK,CAAC;YACX,KAAK,WAAW,CAAC;YACjB,KAAK,UAAU;gBACX,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YACrC,KAAK,OAAO,CAAC;YACb,KAAK,QAAQ;gBACT,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACtC,KAAK,QAAQ;gBACT,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;YACjE,KAAK,YAAY;gBACb,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACzC,KAAK,OAAO;gBACR,OAAO,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;YAC/D,KAAK,OAAO;gBACR,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7D,KAAK,eAAe,CAAC;YACrB,KAAK,oBAAoB;gBACrB,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACzC;gBACI,OAAO;QACf,CAAC;IACL,CAAC;IAED,+FAA+F;IACvF,SAAS,CAAC,QAAiB,EAAE,KAAmB,EAAE,UAAkB,UAAU;QAClF,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,MAAM,OAAO,CAAC,sEAAsE,EAAE,KAAK,CAAC,CAAC;QACjG,CAAC;IACL,CAAC;IAED,oHAAoH;IAC5G,mBAAmB,CAAC,IAAwB,EAAE,KAAmB,EAAE,QAAgB;QACvF,IAAI,IAAI,KAAK,SAAS,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,CAAC,0BAA0B,IAAI,QAAQ,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3E,CAAC;IACL,CAAC;IAED,mGAAmG;IAC3F,gBAAgB,CAAC,QAAiB,EAAE,KAAmB;QAC3D,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,iCAAiC,CAAC,CAAC;IAC5F,CAAC;IAED,8GAA8G;IACtG,eAAe,CAAC,IAAkB;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC9C,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC7E,CAAC;IAED,sGAAsG;IAC9F,aAAa,CAAC,IAAkB;QACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,CAAC,sFAAsF,EAAE,IAAI,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAClE,CAAC;IAED,wGAAwG;IAChG,aAAa,CAAC,IAAkB;QACpC,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;YACtD,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACL,IAAI,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,OAAO,CAAC,iFAAiF,EAAE,IAAI,CAAC,CAAC;QAC3G,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,IAAkB;QACrC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3G,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,OAAO,CAAC,0BAA0B,KAAK,sBAAsB,EAAE,IAAI,CAAC,CAAC;YAC/E,CAAC;QACL,CAAC;IACL,CAAC;IAED,kGAAkG;IAC1F,eAAe,CAAC,IAAkB;QACtC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACxB,MAAM,kBAAkB,GAAG,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,CAAC,CAAC;YACnI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACtB,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAClC,OAAO;YACX,CAAC;YACD,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9G,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;OAGG;IACK,iBAAiB,CAAC,QAAiB,EAAE,KAAmB;QAC5D,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,gCAAgC,CAAC,CAAC;IAC3F,CAAC;IAED,4FAA4F;IACpF,kBAAkB,CAAC,IAAkB;QACzC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;YACzE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC7C,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;gBACpD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC;QACL,CAAC;IACL,CAAC;IAED,oGAAoG;IAC5F,kBAAkB,CAAC,IAAkB;QACzC,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,MAAM,OAAO,CAAC,kFAAkF,EAAE,IAAI,CAAC,CAAC;YAC5G,CAAC;QACL,CAAC;IACL,CAAC;CACJ;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,IAAkB;IAChC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC1B,OAAO,KAAK,YAAY,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,4DAA4D;AAC5D,SAAS,YAAY,CAAC,KAAc;IAChC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,CAAC;AACzI,CAAC;AAED,uGAAuG;AACvG,SAAS,gBAAgB,CAAC,KAAc,EAAE,KAA+B,EAAE,KAAyB;IAChG,OAAO,KAAK,YAAY,MAAM,IAAI,KAAK,EAAE,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC;AACzF,CAAC;AAED,mEAAmE;AACnE,SAAS,QAAQ,CAAC,IAAa,EAAE,GAAW;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAyD,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtG,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC3B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,qFAAqF;AACrF,SAAS,SAAS,CAAC,IAAa;IAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,EAAE,CAAC;QAC/E,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,wFAAwF;AACxF,SAAS,OAAO,CAAC,MAAc,EAAE,IAA8B;IAC3D,MAAM,WAAW,GAAG,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxG,OAAO,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,MAAM,UAAU,IAAI,CAAC,MAAM,GAAG,CAAC,YAAY,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC5H,CAAC"}

package/dist/NunjucksSandbox.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Guards the nunjucks parser, code generator and runtime used by every nunjucks environment in this process. After this call:
+ * - a template whose names could change the compiled code fails to compile (see `AssertTemplateTreeIsSafe`)
+ * - a macro or call-block argument that a call leaves out is filled only from a keyword argument that the
+ *   call itself passes under that name, never from a member the keyword arguments inherit, so otherwise it
+ *   reads as empty
+ * - keyword arguments written at a call site must be an ordinary object literal: ones that inherit from anything
+ *   but `Object.prototype`, or that use a name that every object inherits (or `prototype`), throw, and the code
+ *   generator refuses such a name as a dictionary key or keyword argument too; keyword arguments passed as a
+ *   value (from render data, for example) are read through a copy of their own keys
+ * - a filter, test or global resolves only to a name the environment registered itself, never to a member
+ *   that every object inherits (such as `hasOwnProperty`); an object, a function or a symbol is refused as the name
+ * - a member named `constructor`, `prototype`, `__proto__` or one of the `__define/lookup Getter/Setter__`
+ *   accessors, written literally or computed while rendering, reads as `undefined`, unless it is an object's
+ *   own data that is not a function; `__proto__` always reads as `undefined`
+ * - a bare name resolves only to a template variable, an own key of the render data, or an own environment
+ *   global, never to a property that the render data or the globals inherit
+ * - a template may not read a member of the render context, an environment, a loader, a frame, a
+ *   template or a nunjucks module, and a lookup or call that would return one of them throws
+ * - a lookup or call that would produce or use `Function` (or its async and generator variants), `eval`,
+ *   `Object`, `Reflect`, `globalThis` or `process` throws a {@link TemplateSandboxError}
+ *
+ * Safe to call any number of times: a hook that already carries the guard is left as it is.
+ */
+export declare function HardenNunjucksRuntime(): void;
+//# sourceMappingURL=NunjucksSandbox.d.ts.map

package/dist/NunjucksSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NunjucksSandbox.d.ts","sourceRoot":"","sources":["../src/NunjucksSandbox.ts"],"names":[],"mappings":"AAiIA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAY5C"}

package/dist/NunjucksSandbox.js

@@ -0,0 +1,292 @@
+/**
+ * @fileoverview Guards nunjucks so templates cannot run JavaScript or reach server objects.
+ *
+ * nunjucks has no sandbox mode, and a template can attack it at two points:
+ * - **Compile time.** The compiler copies template-controlled names into the code it generates.
+ *   {@link HardenNunjucksRuntime} wraps the parser that the compiler calls, so every parsed template is
+ *   checked by `AssertTemplateTreeIsSafe` (`NunjucksCompileGuard.ts`) before it compiles. It also wraps
+ *   the code generator's `compilePair`, which writes dictionary keys and keyword arguments.
+ * - **Render time.** Every compiled template resolves bare names, member access and calls through
+ *   three functions on nunjucks' shared runtime module: `contextOrFrameLookup`, `memberLookup` and
+ *   `callWrap`. It builds macros with `makeMacro` and marks keyword arguments with `makeKeywordArgs`, and
+ *   it finds filters and tests with the environment's `getFilter` and `getTest`, which read plain
+ *   objects. Unguarded, a template can walk from any value to `Function`, or reach the render context
+ *   and change the shared environment. {@link HardenNunjucksRuntime} wraps those functions in place.
+ *
+ * The parser, the code generator, the runtime module and the `Environment` prototype are shared by every
+ * nunjucks environment in the process, so the guard covers all of them, including templates loaded
+ * through `include` and `import`.
+ * @module @memberjunction/templates
+ */
+import nunjucks from 'nunjucks';
+import { IsInheritedMemberName } from './InheritedMemberNames.js';
+import { AssertTemplateTreeIsSafe } from './NunjucksCompileGuard.js';
+import { TemplateSandboxError } from './TemplateSandboxError.js';
+const NUNJUCKS = nunjucks;
+/** Member names that lead from a value to its constructor or prototype, and from there to `Function`. */
+const RESTRICTED_MEMBER_NAMES = new Set([
+    'constructor',
+    'prototype',
+    '__proto__',
+    '__defineGetter__',
+    '__defineSetter__',
+    '__lookupGetter__',
+    '__lookupSetter__',
+]);
+/** Values a template may never hold: constructors that compile code from strings, and reflection over any object. */
+const RESTRICTED_VALUES = new Set([
+    Function,
+    (async () => undefined).constructor,
+    (function* () { }).constructor,
+    (async function* () { }).constructor,
+    globalThis.eval,
+    Object,
+    Reflect,
+    globalThis,
+    globalThis.process,
+].filter((value) => value !== undefined && value !== null));
+/** nunjucks' base `Obj` class, which render contexts and templates extend. */
+const NUNJUCKS_OBJ_PROTOTYPE = Object.getPrototypeOf(NUNJUCKS.Template.prototype);
+/** nunjucks' base `EmitterObj` class, which environments and loaders extend. */
+const NUNJUCKS_EMITTER_PROTOTYPE = Object.getPrototypeOf(NUNJUCKS.Environment.prototype);
+/** Prototypes of the objects nunjucks uses to render: contexts and templates, environments and loaders, and frames. */
+const NUNJUCKS_OBJECT_PROTOTYPES = [NUNJUCKS_OBJ_PROTOTYPE, NUNJUCKS_EMITTER_PROTOTYPE, NUNJUCKS.runtime.Frame.prototype];
+/** The nunjucks module and its submodules. */
+const NUNJUCKS_MODULES = new Set([
+    nunjucks, NUNJUCKS.runtime, NUNJUCKS.parser, NUNJUCKS.lib, NUNJUCKS.compiler, NUNJUCKS.lexer, NUNJUCKS.nodes,
+]);
+/** Guards this module installed, so hardening again does not wrap a guard in another guard. */
+const installedGuards = new WeakSet();
+/**
+ * Guards the nunjucks parser, code generator and runtime used by every nunjucks environment in this process. After this call:
+ * - a template whose names could change the compiled code fails to compile (see `AssertTemplateTreeIsSafe`)
+ * - a macro or call-block argument that a call leaves out is filled only from a keyword argument that the
+ *   call itself passes under that name, never from a member the keyword arguments inherit, so otherwise it
+ *   reads as empty
+ * - keyword arguments written at a call site must be an ordinary object literal: ones that inherit from anything
+ *   but `Object.prototype`, or that use a name that every object inherits (or `prototype`), throw, and the code
+ *   generator refuses such a name as a dictionary key or keyword argument too; keyword arguments passed as a
+ *   value (from render data, for example) are read through a copy of their own keys
+ * - a filter, test or global resolves only to a name the environment registered itself, never to a member
+ *   that every object inherits (such as `hasOwnProperty`); an object, a function or a symbol is refused as the name
+ * - a member named `constructor`, `prototype`, `__proto__` or one of the `__define/lookup Getter/Setter__`
+ *   accessors, written literally or computed while rendering, reads as `undefined`, unless it is an object's
+ *   own data that is not a function; `__proto__` always reads as `undefined`
+ * - a bare name resolves only to a template variable, an own key of the render data, or an own environment
+ *   global, never to a property that the render data or the globals inherit
+ * - a template may not read a member of the render context, an environment, a loader, a frame, a
+ *   template or a nunjucks module, and a lookup or call that would return one of them throws
+ * - a lookup or call that would produce or use `Function` (or its async and generator variants), `eval`,
+ *   `Object`, `Reflect`, `globalThis` or `process` throws a {@link TemplateSandboxError}
+ *
+ * Safe to call any number of times: a hook that already carries the guard is left as it is.
+ */
+export function HardenNunjucksRuntime() {
+    const { parser, compiler, runtime, Environment } = NUNJUCKS;
+    installGuard(parser, 'parse', guardParse);
+    installGuard(compiler.Compiler.prototype, 'compilePair', guardCompilePair);
+    installGuard(runtime, 'memberLookup', guardMemberLookup);
+    installGuard(runtime, 'contextOrFrameLookup', guardContextOrFrameLookup);
+    installGuard(runtime, 'callWrap', guardCallWrap);
+    installGuard(runtime, 'makeMacro', guardMakeMacro);
+    installGuard(runtime, 'makeKeywordArgs', guardMakeKeywordArgs);
+    installGuard(Environment.prototype, 'getFilter', guardRegistryLookup('filters'));
+    installGuard(Environment.prototype, 'getTest', guardRegistryLookup('tests'));
+    installGuard(Environment.prototype, 'getGlobal', guardRegistryLookup('globals'));
+}
+/** Replaces one hook with its guarded version, unless the hook is already a guard. */
+function installGuard(target, hook, guard) {
+    if (installedGuards.has(target[hook])) {
+        return;
+    }
+    const guarded = guard(target[hook]);
+    installedGuards.add(guarded);
+    target[hook] = guarded;
+}
+/** Parsing for the compiler: the tree is checked before nunjucks compiles it. */
+function guardParse(original) {
+    return (src, extensions, opts) => {
+        const tree = original(src, extensions, opts);
+        AssertTemplateTreeIsSafe(tree);
+        return tree;
+    };
+}
+/**
+ * The code generator writes a dictionary key or keyword argument as an object-literal key. A key that
+ * `IsInheritedMemberName` matches is refused here as well, so one that reaches the code generator without
+ * passing the parse-time check still cannot become an object-literal key.
+ */
+function guardCompilePair(original) {
+    return function guardedCompilePair(node, frame) {
+        const key = pairKeyName(node);
+        if (key !== undefined && IsInheritedMemberName(key)) {
+            throw new TemplateSandboxError(`Templates may not use "${key}" as a dictionary key or keyword argument`);
+        }
+        original.call(this, node, frame);
+    };
+}
+/**
+ * `runtime.makeMacro`, which builds every macro and call block. The macro it returns fills an argument that a
+ * call leaves out by reading the call's keyword arguments, and stores extra positional values in them. The
+ * guard gives nunjucks a copy of the keyword arguments without a prototype, holding only the keys the call
+ * passed, so neither step can reach an inherited member.
+ */
+function guardMakeMacro(original) {
+    return (argNames, kwargNames, func) => {
+        const macro = original(argNames, kwargNames, func);
+        return function guardedMacro(...macroArgs) {
+            return macro.apply(this, withOwnKeywordArguments(macroArgs));
+        };
+    };
+}
+/**
+ * The call's arguments, with its keyword arguments replaced by a copy of their own keys in an object without a
+ * prototype. A call without keyword arguments gets an empty copy, because nunjucks would read from a new plain object.
+ */
+function withOwnKeywordArguments(macroArgs) {
+    const last = macroArgs[macroArgs.length - 1];
+    const hasKeywordArguments = isKeywordArguments(last);
+    const ownKeywordArguments = Object.create(null);
+    if (hasKeywordArguments) {
+        for (const key of Object.keys(last)) {
+            ownKeywordArguments[key] = readMember(last, key);
+        }
+    }
+    ownKeywordArguments.__keywords = true;
+    return [...(hasKeywordArguments ? macroArgs.slice(0, -1) : macroArgs), ownKeywordArguments];
+}
+/** Keyword arguments as nunjucks recognizes them: an object or function that owns `__keywords`. */
+function isKeywordArguments(value) {
+    return (typeof value === 'object' || typeof value === 'function') && value !== null && Object.hasOwn(value, '__keywords');
+}
+/**
+ * `runtime.makeKeywordArgs`, which marks the object literal that a call site passes as keyword arguments. It must
+ * inherit from `Object.prototype`, as an object literal does, and must not own a key that `IsInheritedMemberName` matches.
+ */
+function guardMakeKeywordArgs(original) {
+    return (obj) => {
+        if (Object.getPrototypeOf(obj) !== Object.prototype || Object.getOwnPropertyNames(obj).some((key) => IsInheritedMemberName(key))) {
+            throw new TemplateSandboxError('Templates may only pass keyword arguments that are a plain object with ordinary names');
+        }
+        return original(obj);
+    };
+}
+/**
+ * `env.getFilter(name)`, `env.getTest(name)` and `env.getGlobal(name)`. nunjucks keeps each registry in a
+ * plain object, so a name such as `toString` would find the member every object inherits. Only a name the
+ * environment registered itself resolves. A name that is not there at all still fails as nunjucks reports it.
+ *
+ * The `select` and `reject` filters pass a template value as the name. The name is converted to a key once,
+ * and nunjucks receives that same key, so it reads the key the guard checked. An object, a function or a
+ * symbol is refused before conversion, because converting it could run template code.
+ */
+function guardRegistryLookup(registry) {
+    return (original) => function guardedRegistryLookup(name) {
+        if ((typeof name === 'object' && name !== null) || typeof name === 'function' || typeof name === 'symbol') {
+            throw new TemplateSandboxError('Templates may not use an object, a function or a symbol as the name of a filter, test or global');
+        }
+        const key = String(name);
+        const entries = this[registry];
+        if (key in entries && !Object.hasOwn(entries, key)) {
+            throw new TemplateSandboxError(`Templates may only use filters, tests and globals that the environment registered ("${key}")`);
+        }
+        return original.call(this, key);
+    };
+}
+/**
+ * `obj.key` and `obj[key]`. The key is converted to a string once, so a computed key cannot change
+ * between the check and the read. The member is checked before nunjucks reads it again; templates
+ * cannot define accessors (the accessor helpers are restricted names), so both reads see the same value.
+ */
+function guardMemberLookup(original) {
+    return (obj, val) => {
+        if (obj === undefined || obj === null || typeof val === 'symbol') {
+            return undefined;
+        }
+        const key = String(val);
+        if (isNunjucksObject(obj)) {
+            throw new TemplateSandboxError(`Templates may not read members of the render context or other nunjucks objects (reading "${key}")`);
+        }
+        if (RESTRICTED_MEMBER_NAMES.has(key) && !isOwnDataValue(obj, key)) {
+            return undefined;
+        }
+        assertAllowed(obj, `members of a restricted value (reading "${key}")`);
+        assertAllowed(readMember(obj, key), `the member "${key}"`);
+        return original(obj, key);
+    };
+}
+/**
+ * A bare name such as `{{ user }}`: a template variable, then an own key of the render data, then an own
+ * environment global. The guard resolves the name itself, because nunjucks would also return members
+ * that the render data or the globals inherit.
+ */
+function guardContextOrFrameLookup() {
+    return (context, frame, name) => {
+        if (name === '__proto__') {
+            return undefined;
+        }
+        const value = ownBinding(context, frame, name);
+        if (value === undefined || (RESTRICTED_MEMBER_NAMES.has(name) && typeof value === 'function')) {
+            return undefined;
+        }
+        assertAllowed(value, `the name "${name}"`, context);
+        return value;
+    };
+}
+/** A call such as `{{ fn(x) }}`. nunjucks passes the render context as `this`, so a call may not return it. */
+function guardCallWrap(original) {
+    return (obj, name, context, args) => {
+        assertAllowed(obj, `the function "${name}"`, context);
+        const result = original(obj, name, context, args);
+        assertAllowed(result, `the value returned by "${name}"`, context);
+        return result;
+    };
+}
+/** The value of a bare name: a template variable, else an own key of the render data, else an own environment global. */
+function ownBinding(context, frame, name) {
+    const variable = frame.lookup(name);
+    if (variable !== undefined) {
+        return variable;
+    }
+    const data = context.getVariables();
+    if (Object.hasOwn(data, name)) {
+        return readMember(data, name);
+    }
+    const globals = context.env.globals;
+    return Object.hasOwn(globals, name) ? readMember(globals, name) : undefined;
+}
+/**
+ * True when an object (not a function) stores data that is not a function under `key` itself, as
+ * `{"constructor": "Acme"}` does. A prototype's own `constructor` is a function, so it never counts,
+ * and neither does `__proto__`.
+ */
+function isOwnDataValue(obj, key) {
+    return key !== '__proto__'
+        && typeof obj === 'object' && obj !== null
+        && Object.hasOwn(obj, key)
+        && typeof readMember(obj, key) !== 'function';
+}
+/** True for the render context, an environment, a loader, a frame, a template or a nunjucks module. */
+function isNunjucksObject(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    return NUNJUCKS_MODULES.has(value) || NUNJUCKS_OBJECT_PROTOTYPES.some((prototype) => prototype.isPrototypeOf(value));
+}
+/** Reads a member the way a template does, including members of primitive strings and numbers. */
+function readMember(obj, key) {
+    return obj[key];
+}
+/** The text of a dictionary key or keyword argument (a symbol or a quoted string), or `undefined` for any other key. */
+function pairKeyName(pair) {
+    const key = typeof pair === 'object' && pair !== null ? readMember(pair, 'key') : undefined;
+    const value = typeof key === 'object' && key !== null ? readMember(key, 'value') : undefined;
+    return typeof value === 'string' ? value : undefined;
+}
+/** Throws when a lookup or call would give a template a restricted value, the render context or another nunjucks object. */
+function assertAllowed(value, subject, context) {
+    if (RESTRICTED_VALUES.has(value) || isNunjucksObject(value) || (context !== undefined && value === context)) {
+        throw new TemplateSandboxError(`Templates may not access ${subject}`);
+    }
+}
+//# sourceMappingURL=NunjucksSandbox.js.map

package/dist/NunjucksSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NunjucksSandbox.js","sourceRoot":"","sources":["../src/NunjucksSandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AA4D9D,MAAM,QAAQ,GAAG,QAAwC,CAAC;AAK1D,yGAAyG;AACzG,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IACzD,aAAa;IACb,WAAW;IACX,WAAW;IACX,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;CACrB,CAAC,CAAC;AAEH,qHAAqH;AACrH,MAAM,iBAAiB,GAAyB,IAAI,GAAG,CAAU;IAC7D,QAAQ;IACR,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,WAAW;IACnC,CAAC,QAAQ,CAAC,MAAiD,CAAC,CAAC,CAAC,WAAW;IACzE,CAAC,KAAK,SAAS,CAAC,MAAuD,CAAC,CAAC,CAAC,WAAW;IACrF,UAAU,CAAC,IAAI;IACf,MAAM;IACN,OAAO;IACP,UAAU;IACV,UAAU,CAAC,OAAO;CACrB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,sBAAsB,GAAW,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAE1F,gFAAgF;AAChF,MAAM,0BAA0B,GAAW,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;AAEjG,uHAAuH;AACvH,MAAM,0BAA0B,GAAsB,CAAC,sBAAsB,EAAE,0BAA0B,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAE7I,8CAA8C;AAC9C,MAAM,gBAAgB,GAAyB,IAAI,GAAG,CAAU;IAC5D,QAAQ,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK;CAC/G,CAAC,CAAC;AAEH,+FAA+F;AAC/F,MAAM,eAAe,GAAG,IAAI,OAAO,EAAiB,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB;IACjC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1C,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;IAC3E,YAAY,CAAC,OAAO,EAAE,cAAc,EAAE,iBAAiB,CAAC,CAAC;IACzD,YAAY,CAAC,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,CAAC,CAAC;IACzE,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;IACjD,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;IACnD,YAAY,CAAC,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC;IAC/D,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;IACjF,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7E,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,WAAW,EAAE,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CACjB,MAAS,EACT,IAAO,EACP,KAA+B;IAE/B,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACpC,OAAO;IACX,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACpC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,QAAiC;IACjD,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAC7C,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IAChB,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,QAAqB;IAC3C,OAAO,SAAS,kBAAkB,CAAgB,IAAa,EAAE,KAAc;QAC3E,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,oBAAoB,CAAC,0BAA0B,GAAG,2CAA2C,CAAC,CAAC;QAC7G,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,QAA2C;IAC/D,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;QAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO,SAAS,YAAY,CAAgB,GAAG,SAAoB;YAC/D,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC;IACN,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,SAAoB;IACjD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,mBAAmB,GAA4B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzE,IAAI,mBAAmB,EAAE,CAAC;QACtB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,mBAAmB,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;IACD,mBAAmB,CAAC,UAAU,GAAG,IAAI,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC;AAChG,CAAC;AAED,mGAAmG;AACnG,SAAS,kBAAkB,CAAC,KAAc;IACtC,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC9H,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,QAAiD;IAC3E,OAAO,CAAC,GAAG,EAAE,EAAE;QACX,IAAI,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/H,MAAM,IAAI,oBAAoB,CAAC,uFAAuF,CAAC,CAAC;QAC5H,CAAC;QACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,QAAyC;IAClE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,qBAAqB,CAAsC,IAAa;QAClG,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,IAAI,KAAK,UAAU,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxG,MAAM,IAAI,oBAAoB,CAAC,iGAAiG,CAAC,CAAC;QACtI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,oBAAoB,CAAC,uFAAuF,GAAG,IAAI,CAAC,CAAC;QACnI,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAA8C;IACrE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAChB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC/D,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,4FAA4F,GAAG,IAAI,CAAC,CAAC;QACxI,CAAC;QACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,2CAA2C,GAAG,IAAI,CAAC,CAAC;QACvE,aAAa,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,eAAe,GAAG,GAAG,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB;IAC9B,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC5B,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC,EAAE,CAAC;YAC5F,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,aAAa,CAAC,KAAK,EAAE,aAAa,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;AACN,CAAC;AAED,+GAA+G;AAC/G,SAAS,aAAa,CAAC,QAA0C;IAC7D,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAChC,aAAa,CAAC,GAAG,EAAE,iBAAiB,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAClD,aAAa,CAAC,MAAM,EAAE,0BAA0B,IAAI,GAAG,EAAE,OAAO,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC;IAClB,CAAC,CAAC;AACN,CAAC;AAED,yHAAyH;AACzH,SAAS,UAAU,CAAC,OAA8B,EAAE,KAAoB,EAAE,IAAY;IAClF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,GAAW;IAC7C,OAAO,GAAG,KAAK,WAAW;WACnB,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;WACvC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC;WACvB,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,UAAU,CAAC;AACtD,CAAC;AAED,uGAAuG;AACvG,SAAS,gBAAgB,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AACzH,CAAC;AAED,kGAAkG;AAClG,SAAS,UAAU,CAAC,GAAY,EAAE,GAAW;IACzC,OAAQ,GAA8C,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,wHAAwH;AACxH,SAAS,WAAW,CAAC,IAAa;IAC9B,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,4HAA4H;AAC5H,SAAS,aAAa,CAAC,KAAc,EAAE,OAAe,EAAE,OAA+B;IACnF,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,CAAC,EAAE,CAAC;QAC1G,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;AACL,CAAC"}

package/dist/TemplateEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TemplateEngine.d.ts","sourceRoot":"","sources":["../src/TemplateEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAY,QAAQ,EAAuB,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAChL,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AAE7E,OAAO,EAAE,oBAAoB,EAAsB,MAAM,sCAAsC,CAAA;AAE/F;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,MAAM;IAC9C,KAAK,UAAQ;IAEpB,qCAAqC;IACrC,IAAW,KAAK,YAEf;IACD,qCAAqC;IACrC,IAAW,KAAK,CAAC,KAAK,SAAA,EAErB;IAED,OAAO,CAAC,SAAS,CAA0D;IAE3E;;;;OAIG;IACI,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB;IAIzE;;;;OAIG;IACI,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG;IAY5C,yCAAyC;IAClC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG;CAG/C;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,aAAa,CAAC,oBAAoB,CAAC;IACzE,WAAkB,QAAQ,IAAI,oBAAoB,CAEjD;IAED;;;;;;OAMG;IACH,OAAO,KAAK,IAAI,GAEf;IAED,+FAA+F;IAC/F,OAAO,CAAC,YAAY,CAAC,CAAW;IAChC,OAAO,CAAC,uBAAuB,CAAkB;IAEjD;;;;;;;;OAQG;IACU,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAShH,2GAA2G;IAC3G,OAAO,CAAC,yBAAyB;IAuBjC,oEAAoE;IACpE,IAAW,MAAM,IAAI,OAAO,CAA6B;IACzD,IAAW,WAAW,IAAI,QAAQ,CAAuD;IACzF,IAAW,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAgC;IAGtE,IAAW,SAAS,IAAI,wBAAwB,EAAE,CAAgC;IAClF,IAAW,oBAAoB,IAAI,2BAA2B,EAAE,CAA2C;IAC3G,IAAW,kBAAkB,IAAI,wBAAwB,EAAE,CAAyC;IACpG,IAAW,gBAAgB,IAAI,uBAAuB,EAAE,CAAuC;IAC/F,IAAW,cAAc,IAAI,qBAAqB,EAAE,CAAqC;IAClF,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,wBAAwB;IAE5D,aAAa,IAAI,IAAI;IAM5B,OAAO,CAAC,YAAY,CAAuB;IAC3C;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB,CAAC,CAAuB;IACxD,OAAO,CAAC,eAAe,CAAuB;IAE9C;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAQnC;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IA8BxB;;OAEG;IACH,OAAO,CAAC,cAAc,CAA4C;IAE3D,WAAW,CAAC,cAAc,EAAE,wBAAwB;IAK3D;;;;;;;OAOG;IACU,cAAc,CAAC,cAAc,EAAE,wBAAwB,EAAE,eAAe,EAAE,uBAAuB,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiE/M;;;;;;;;;OASG;IACU,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqBrI;;;;;;OAMG;IACH,SAAS,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,GAAG;IAgB3G;;;;;OAKG;IACH,SAAS,CAAC,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,GAAE,QAAQ,CAAC,WAA+B,GAAG,GAAG;IAI1G;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAUnB,kBAAkB;IAIzB;;;;OAIG;cACa,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAY5F;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,kBAAkB,CAAC,cAAc,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;CAuD5G"}
+{"version":3,"file":"TemplateEngine.d.ts","sourceRoot":"","sources":["../src/TemplateEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAY,QAAQ,EAAuB,MAAM,sBAAsB,CAAC;AAClG,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAChL,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,aAAa,EAAwB,MAAM,wBAAwB,CAAC;AAG7E,OAAO,EAAE,oBAAoB,EAAsB,MAAM,sCAAsC,CAAA;AAM/F;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,MAAM;IAC9C,KAAK,UAAQ;IAEpB,qCAAqC;IACrC,IAAW,KAAK,YAEf;IACD,qCAAqC;IACrC,IAAW,KAAK,CAAC,KAAK,SAAA,EAErB;IAED,OAAO,CAAC,SAAS,CAA0D;IAE3E;;;;OAIG;IACI,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB;IAIzE;;;;OAIG;IACI,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG;IAY5C,yCAAyC;IAClC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG;CAG/C;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,aAAa,CAAC,oBAAoB,CAAC;IACzE,WAAkB,QAAQ,IAAI,oBAAoB,CAEjD;IAED;;;;;;OAMG;IACH,OAAO,KAAK,IAAI,GAEf;IAED,+FAA+F;IAC/F,OAAO,CAAC,YAAY,CAAC,CAAW;IAChC,OAAO,CAAC,uBAAuB,CAAkB;IAEjD;;;;;;;;OAQG;IACU,MAAM,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAShH,2GAA2G;IAC3G,OAAO,CAAC,yBAAyB;IAuBjC,oEAAoE;IACpE,IAAW,MAAM,IAAI,OAAO,CAA6B;IACzD,IAAW,WAAW,IAAI,QAAQ,CAAuD;IACzF,IAAW,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAgC;IAGtE,IAAW,SAAS,IAAI,wBAAwB,EAAE,CAAgC;IAClF,IAAW,oBAAoB,IAAI,2BAA2B,EAAE,CAA2C;IAC3G,IAAW,kBAAkB,IAAI,wBAAwB,EAAE,CAAyC;IACpG,IAAW,gBAAgB,IAAI,uBAAuB,EAAE,CAAuC;IAC/F,IAAW,cAAc,IAAI,qBAAqB,EAAE,CAAqC;IAClF,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,wBAAwB;IAE5D,aAAa,IAAI,IAAI;IAM5B,OAAO,CAAC,YAAY,CAAuB;IAC3C;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB,CAAC,CAAuB;IACxD,OAAO,CAAC,eAAe,CAAuB;IAE9C;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAQnC;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IA8BxB;;OAEG;IACH,OAAO,CAAC,cAAc,CAA4C;IAE3D,WAAW,CAAC,cAAc,EAAE,wBAAwB;IAK3D;;;;;;;OAOG;IACU,cAAc,CAAC,cAAc,EAAE,wBAAwB,EAAE,eAAe,EAAE,uBAAuB,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAiE/M;;;;;;;;;OASG;IACU,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqBrI;;;;;;OAMG;IACH,SAAS,CAAC,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,GAAG,GAAG;IAgB3G;;;;;OAKG;IACH,SAAS,CAAC,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,GAAE,QAAQ,CAAC,WAA+B,GAAG,GAAG;IAI1G;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAUnB,kBAAkB;IAIzB;;;;OAIG;cACa,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAa5F;;;;;;;;;;;;;OAaG;IACH,SAAS,CAAC,kBAAkB,CAAC,cAAc,EAAE,wBAAwB,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,GAAG;CAuD5G"}

package/dist/TemplateEngine.js

@@ -2,7 +2,11 @@ import { LogError } from "@memberjunction/core";
 import nunjucks from 'nunjucks';
 import { BaseSingleton, MJGlobal, UUIDsEqual } from "@memberjunction/global";
 import { TemplateExtensionBase } from "./extensions/TemplateExtensionBase.js";
+import { HardenNunjucksRuntime } from "./NunjucksSandbox.js";
 import { TemplateEngineBase } from '@memberjunction/templates-base-types';
+// Stored templates are user-editable, so nunjucks is guarded as soon as the engine loads. The guard
+// is process-wide: it also covers nunjucks environments that other packages create.
+HardenNunjucksRuntime();
 /**
  * This class extends the nunjucks loader to allow adding templates directly to the loader
  */
@@ -329,6 +333,7 @@ export class TemplateEngineServer extends BaseSingleton {
      * @param data the data to render the template with
      */
     async renderTemplateAsync(template, data) {
+        HardenNunjucksRuntime(); // no-op unless something replaced a guarded nunjucks hook
         return new Promise((resolve, reject) => {
             template.render(data, (err, result) => {
                 if (err) {

package/dist/TemplateEngine.js.map

@@ -1 +1 @@
-{"version":3,"file":"TemplateEngine.js","sourceRoot":"","sources":["../src/TemplateEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,QAAQ,EAAiC,MAAM,sBAAsB,CAAC;AAElG,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAwB,kBAAkB,EAAE,MAAM,sCAAsC,CAAA;AAE/F;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ,CAAC,MAAM;IAAzD;;QACW,UAAK,GAAG,IAAI,CAAC;QAWZ,cAAS,GAAuD,EAAE,CAAC;IAgC/E,CAAC;IAzCG,qCAAqC;IACrC,IAAW,KAAK;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,qCAAqC;IACrC,IAAW,KAAK,CAAC,KAAK;QAClB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC,CAAC,wCAAwC;IAI1C;;;;OAIG;IACI,WAAW,CAAC,UAAkB,EAAE,QAAkC;QACrE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACI,SAAS,CAAC,IAAY,EAAE,QAAa;QACxC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACX,QAAQ,CAAC;gBACL,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,IAAI;aAChB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,yCAAyC;IAClC,SAAS,CAAC,IAAY,EAAE,QAAa;QACxC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,aAAmC;IAA7E;;QAkBY,4BAAuB,GAAY,KAAK,CAAC;QAyHjD;;WAEG;QACK,mBAAc,GAAqB,IAAI,GAAG,EAAe,CAAC;IAyPtE,CAAC;IAtYU,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAAwB,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,IAAY,IAAI;QACZ,OAAO,kBAAkB,CAAC,QAAQ,CAAC;IACvC,CAAC;IAMD;;;;;;;;OAQG;IACI,KAAK,CAAC,MAAM,CAAC,YAAsB,EAAE,WAAsB,EAAE,QAA4B;QAC5F,IAAI,WAAW,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,gEAAgE;QAC3F,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,2GAA2G;IACnG,yBAAyB,CAAC,WAAsB;QACpD,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC/B,OAAO;QACX,CAAC;QACD,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;QAEpC,IAAI,CAAC,eAAe,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC,uEAAuE;QAElH,gFAAgF;QAChF,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;QAC7F,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC3B,MAAM,mBAAmB,GAAG,GAAG,CAAC,QAAgE,CAAC;gBACjG,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC,WAAY,CAAC,CAAC;gBACvD,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACtD,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,IAAW,MAAM,KAAc,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,IAAW,WAAW,KAAe,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACzF,IAAW,WAAW,CAAC,KAAe,IAAI,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC;IAEtE,kGAAkG;IAClG,IAAW,SAAS,KAAiC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,IAAW,oBAAoB,KAAoC,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC3G,IAAW,kBAAkB,KAAiC,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACpG,IAAW,gBAAgB,KAAgC,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/F,IAAW,cAAc,KAA8B,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,YAAY,CAAC,YAAoB,IAA8B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAE7G,aAAa;QAChB,IAAI,CAAC,eAAe,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC,uEAAuE;IACtH,CAAC;IAaD;;;;OAIG;IACK,2BAA2B,CAAC,UAAmB;QACnD,kFAAkF;QAClF,qFAAqF;QACrF,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,eAA8C,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACtH,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,gBAAgB,CAAC,GAAyB;QAC9C,2DAA2D;QAC3D,sEAAsE;QACtE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,GAAQ,EAAE,SAAiB,CAAC,EAAE,EAAE;YACnD,IAAI,CAAC;gBACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,OAAO,8BAA8B,GAAG,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC;YAChE,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,kDAAkD;QAClD,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,GAAQ,EAAE,EAAE;YACrC,IAAI,CAAC;gBACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,OAAO,8BAA8B,GAAG,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC;YAChE,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,kDAAkD;QAClD,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,GAAW,EAAE,EAAE;YACvC,IAAI,CAAC;gBACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,CAAC,0CAA0C;YAC1D,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAOM,WAAW,CAAC,cAAwC;QACvD,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IACxE,CAAC;IAGD;;;;;;;OAOG;IACI,KAAK,CAAC,cAAc,CAAC,cAAwC,EAAE,eAAwC,EAAE,IAAS,EAAE,cAAwB,EAAE,gBAA0B;QAC3K,IAAI,CAAC;YACD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,sCAAsC;iBAClD,CAAC;YACN,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;gBAChC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,mDAAmD;iBAC/D,CAAC;YACN,CAAC;YAED,IAAG,CAAC,cAAc,EAAC,CAAC;gBAChB,6CAA6C;gBAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;gBACjF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;oBACrB,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,IAAI;wBACZ,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAA0B,EAAE,EAAE;4BACzD,OAAO,KAAK,CAAC,OAAO,CAAC;wBACzB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;qBAChB,CAAC;gBACN,CAAC;YACL,CAAC;iBACI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACzB,6HAA6H;gBAC7H,MAAM,SAAS,GAAG,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;gBACjF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;oBACrB,MAAM,eAAe,GAAG,SAAS,CAAC,MAAM;yBACnC,MAAM,CAAC,CAAC,KAA0B,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;yBAChE,GAAG,CAAC,CAAC,KAA0B,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;yBAClD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC7B,QAAQ,CAAC,0DAA0D,cAAc,CAAC,IAAI,MAAM,eAAe,EAAE,CAAC,CAAC;oBACnH,CAAC;gBACL,CAAC;YACL,CAAC;YAED,kEAAkE;YAClE,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAErF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAAE,EAAE,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACpE,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,SAAS;aACrB,CAAC;QACN,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACrB,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,oBAAoB,CAAC,YAAoB,EAAE,IAAS,EAAE,OAAkC;QACjG,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,SAAS;aACrB,CAAC;QACN,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACrB,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACO,mBAAmB,CAAC,iBAAyB,EAAE,YAAoB,EAAE,aAAsB;QACjG,IAAI,iBAAiB,IAAI,aAAa,EAAE,CAAC;YACrC,IAAI,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;gBACrD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,QAAQ,CAAC;QACpB,CAAC;aACI,CAAC;YACF,iGAAiG;YACjG,gFAAgF;YAChF,OAAO,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACO,sBAAsB,CAAC,YAAoB,EAAE,MAA4B,IAAI,CAAC,YAAY;QAChG,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,UAAmB;QAC1C,IAAI,UAAU,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,YAAY,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACjC,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC,wBAAwB,CAAC;IACzC,CAAC;IAEM,kBAAkB;QACrB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,mBAAmB,CAAC,QAA2B,EAAE,IAAS;QACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;gBAClC,IAAI,GAAG,EAAE,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACJ,OAAO,CAAC,MAAO,CAAC,CAAC;gBACrB,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;OAaG;IACO,kBAAkB,CAAC,cAAwC,EAAE,SAAiB,EAAE,IAAS;QAC/F,0CAA0C;QAC1C,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAE/B,gDAAgD;QAChD,MAAM,MAAM,GAAG,cAAc,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAEjE,gDAAgD;QAChD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;QAE9D,8BAA8B;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,CAAS,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC1D,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAE,CAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAChF,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,8CAA8C;QAC9C,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACjC,8DAA8D;YAC9D,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpG,IAAI,CAAC;oBACD,mCAAmC;oBACnC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;wBACjB,KAAK,OAAO,CAAC;wBACb,KAAK,QAAQ,CAAC;wBACd,KAAK,QAAQ,CAAC;wBACd,KAAK,QAAQ;4BACT,yCAAyC;4BACzC,IAAI,CAAC;gCACD,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;4BACtD,CAAC;4BAAC,MAAM,CAAC;gCACL,+BAA+B;gCAC/B,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;4BAC1C,CAAC;4BACD,MAAM;wBAEV,KAAK,QAAQ,CAAC;wBACd;4BACI,2CAA2C;4BAC3C,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;4BACtC,MAAM;oBACd,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,0DAA0D;oBAC1D,QAAQ,CAAC,gDAAgD,IAAI,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxF,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACtB,CAAC;CACJ"}
+{"version":3,"file":"TemplateEngine.js","sourceRoot":"","sources":["../src/TemplateEngine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,QAAQ,EAAiC,MAAM,sBAAsB,CAAC;AAElG,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAwB,kBAAkB,EAAE,MAAM,sCAAsC,CAAA;AAE/F,oGAAoG;AACpG,oFAAoF;AACpF,qBAAqB,EAAE,CAAC;AAExB;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,QAAQ,CAAC,MAAM;IAAzD;;QACW,UAAK,GAAG,IAAI,CAAC;QAWZ,cAAS,GAAuD,EAAE,CAAC;IAgC/E,CAAC;IAzCG,qCAAqC;IACrC,IAAW,KAAK;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IACD,qCAAqC;IACrC,IAAW,KAAK,CAAC,KAAK;QAClB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC,CAAC,wCAAwC;IAI1C;;;;OAIG;IACI,WAAW,CAAC,UAAkB,EAAE,QAAkC;QACrE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACI,SAAS,CAAC,IAAY,EAAE,QAAa;QACxC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACX,QAAQ,CAAC;gBACL,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,IAAI;aAChB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,yCAAyC;IAClC,SAAS,CAAC,IAAY,EAAE,QAAa;QACxC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,aAAmC;IAA7E;;QAkBY,4BAAuB,GAAY,KAAK,CAAC;QAyHjD;;WAEG;QACK,mBAAc,GAAqB,IAAI,GAAG,EAAe,CAAC;IA0PtE,CAAC;IAvYU,MAAM,KAAK,QAAQ;QACtB,OAAO,KAAK,CAAC,WAAW,EAAwB,CAAC;IACrD,CAAC;IAED;;;;;;OAMG;IACH,IAAY,IAAI;QACZ,OAAO,kBAAkB,CAAC,QAAQ,CAAC;IACvC,CAAC;IAMD;;;;;;;;OAQG;IACI,KAAK,CAAC,MAAM,CAAC,YAAsB,EAAE,WAAsB,EAAE,QAA4B;QAC5F,IAAI,WAAW,EAAE,CAAC;YACd,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,gEAAgE;QAC3F,IAAI,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;IAChD,CAAC;IAED,2GAA2G;IACnG,yBAAyB,CAAC,WAAsB;QACpD,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC/B,OAAO;QACX,CAAC;QACD,IAAI,CAAC,uBAAuB,GAAG,IAAI,CAAC;QAEpC,IAAI,CAAC,eAAe,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC,uEAAuE;QAElH,gFAAgF;QAChF,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;QAC7F,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC3B,MAAM,mBAAmB,GAAG,GAAG,CAAC,QAAgE,CAAC;gBACjG,MAAM,QAAQ,GAAG,IAAI,mBAAmB,CAAC,WAAY,CAAC,CAAC;gBACvD,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACtD,CAAC;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,oEAAoE;IACpE,IAAW,MAAM,KAAc,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD,IAAW,WAAW,KAAe,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IACzF,IAAW,WAAW,CAAC,KAAe,IAAI,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC;IAEtE,kGAAkG;IAClG,IAAW,SAAS,KAAiC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAClF,IAAW,oBAAoB,KAAoC,OAAO,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAC3G,IAAW,kBAAkB,KAAiC,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACpG,IAAW,gBAAgB,KAAgC,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/F,IAAW,cAAc,KAA8B,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IAClF,YAAY,CAAC,YAAoB,IAA8B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAE7G,aAAa;QAChB,IAAI,CAAC,eAAe,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC,uEAAuE;IACtH,CAAC;IAaD;;;;OAIG;IACK,2BAA2B,CAAC,UAAmB;QACnD,kFAAkF;QAClF,qFAAqF;QACrF,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,eAA8C,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACtH,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC;IACf,CAAC;IAED;;;OAGG;IACK,gBAAgB,CAAC,GAAyB;QAC9C,2DAA2D;QAC3D,sEAAsE;QACtE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,GAAQ,EAAE,SAAiB,CAAC,EAAE,EAAE;YACnD,IAAI,CAAC;gBACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,OAAO,8BAA8B,GAAG,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC;YAChE,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,kDAAkD;QAClD,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,GAAQ,EAAE,EAAE;YACrC,IAAI,CAAC;gBACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,OAAO,8BAA8B,GAAG,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC;YAChE,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,kDAAkD;QAClD,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,GAAW,EAAE,EAAE;YACvC,IAAI,CAAC;gBACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,OAAO,GAAG,CAAC,CAAC,0CAA0C;YAC1D,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;IAOM,WAAW,CAAC,cAAwC;QACvD,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC;IACxE,CAAC;IAGD;;;;;;;OAOG;IACI,KAAK,CAAC,cAAc,CAAC,cAAwC,EAAE,eAAwC,EAAE,IAAS,EAAE,cAAwB,EAAE,gBAA0B;QAC3K,IAAI,CAAC;YACD,IAAI,CAAC,eAAe,EAAE,CAAC;gBACnB,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,sCAAsC;iBAClD,CAAC;YACN,CAAC;YAED,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,CAAC;gBAChC,OAAO;oBACH,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,mDAAmD;iBAC/D,CAAC;YACN,CAAC;YAED,IAAG,CAAC,cAAc,EAAC,CAAC;gBAChB,6CAA6C;gBAC7C,MAAM,SAAS,GAAG,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;gBACjF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;oBACrB,OAAO;wBACH,OAAO,EAAE,KAAK;wBACd,MAAM,EAAE,IAAI;wBACZ,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAA0B,EAAE,EAAE;4BACzD,OAAO,KAAK,CAAC,OAAO,CAAC;wBACzB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;qBAChB,CAAC;gBACN,CAAC;YACL,CAAC;iBACI,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACzB,6HAA6H;gBAC7H,MAAM,SAAS,GAAG,cAAc,CAAC,qBAAqB,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC;gBACjF,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;oBACrB,MAAM,eAAe,GAAG,SAAS,CAAC,MAAM;yBACnC,MAAM,CAAC,CAAC,KAA0B,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;yBAChE,GAAG,CAAC,CAAC,KAA0B,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;yBAClD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC7B,QAAQ,CAAC,0DAA0D,cAAc,CAAC,IAAI,MAAM,eAAe,EAAE,CAAC,CAAC;oBACnH,CAAC;gBACL,CAAC;YACL,CAAC;YAED,kEAAkE;YAClE,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAErF,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,EAAE,EAAE,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YACpE,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,SAAS;aACrB,CAAC;QACN,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACrB,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;;;;OASG;IACI,KAAK,CAAC,oBAAoB,CAAC,YAAoB,EAAE,IAAS,EAAE,OAAkC;QACjG,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO;gBACH,OAAO,EAAE,IAAI;gBACb,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,SAAS;aACrB,CAAC;QACN,CAAC;QACD,OAAO,CAAC,EAAE,CAAC;YACP,QAAQ,CAAC,CAAC,CAAC,CAAC;YACZ,OAAO;gBACH,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;aACrB,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACO,mBAAmB,CAAC,iBAAyB,EAAE,YAAoB,EAAE,aAAsB;QACjG,IAAI,iBAAiB,IAAI,aAAa,EAAE,CAAC;YACrC,IAAI,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;gBACrD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,QAAQ,CAAC;QACpB,CAAC;aACI,CAAC;YACF,iGAAiG;YACjG,gFAAgF;YAChF,OAAO,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACO,sBAAsB,CAAC,YAAoB,EAAE,MAA4B,IAAI,CAAC,YAAY;QAChG,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,UAAmB;QAC1C,IAAI,UAAU,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,YAAY,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACjC,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,IAAI,CAAC,wBAAwB,CAAC;IACzC,CAAC;IAEM,kBAAkB;QACrB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,mBAAmB,CAAC,QAA2B,EAAE,IAAS;QACtE,qBAAqB,EAAE,CAAC,CAAC,0DAA0D;QACnF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;gBAClC,IAAI,GAAG,EAAE,CAAC;oBACN,MAAM,CAAC,GAAG,CAAC,CAAC;gBAChB,CAAC;qBAAM,CAAC;oBACJ,OAAO,CAAC,MAAO,CAAC,CAAC;gBACrB,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;OAaG;IACO,kBAAkB,CAAC,cAAwC,EAAE,SAAiB,EAAE,IAAS;QAC/F,0CAA0C;QAC1C,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QAE/B,gDAAgD;QAChD,MAAM,MAAM,GAAG,cAAc,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAEjE,gDAAgD;QAChD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAiC,CAAC;QAE9D,8BAA8B;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,CAAS,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAC1D,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,qDAAqD;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAE,CAAS,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAChF,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QAEH,8CAA8C;QAC9C,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;YACjC,8DAA8D;YAC9D,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACpG,IAAI,CAAC;oBACD,mCAAmC;oBACnC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;wBACjB,KAAK,OAAO,CAAC;wBACb,KAAK,QAAQ,CAAC;wBACd,KAAK,QAAQ,CAAC;wBACd,KAAK,QAAQ;4BACT,yCAAyC;4BACzC,IAAI,CAAC;gCACD,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;4BACtD,CAAC;4BAAC,MAAM,CAAC;gCACL,+BAA+B;gCAC/B,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;4BAC1C,CAAC;4BACD,MAAM;wBAEV,KAAK,QAAQ,CAAC;wBACd;4BACI,2CAA2C;4BAC3C,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;4BACtC,MAAM;oBACd,CAAC;gBACL,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,0DAA0D;oBAC1D,QAAQ,CAAC,gDAAgD,IAAI,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxF,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACtB,CAAC;CACJ"}

package/dist/TemplateSandboxError.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @fileoverview The error the template sandbox throws.
+ * @module @memberjunction/templates
+ */
+/** Thrown when a template uses a name, a value or a call that the template sandbox does not allow. */
+export declare class TemplateSandboxError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=TemplateSandboxError.d.ts.map

package/dist/TemplateSandboxError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TemplateSandboxError.d.ts","sourceRoot":"","sources":["../src/TemplateSandboxError.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,sGAAsG;AACtG,qBAAa,oBAAqB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI9B"}

package/dist/TemplateSandboxError.js

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview The error the template sandbox throws.
+ * @module @memberjunction/templates
+ */
+/** Thrown when a template uses a name, a value or a call that the template sandbox does not allow. */
+export class TemplateSandboxError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'TemplateSandboxError';
+    }
+}
+//# sourceMappingURL=TemplateSandboxError.js.map

package/dist/TemplateSandboxError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TemplateSandboxError.js","sourceRoot":"","sources":["../src/TemplateSandboxError.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,sGAAsG;AACtG,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC3C,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACvC,CAAC;CACJ"}

package/dist/index.d.ts

@@ -1,6 +1,10 @@
 export * from './TemplateEngine.js';
+export * from './NunjucksSandbox.js';
+export * from './NunjucksCompileGuard.js';
+export * from './TemplateSandboxError.js';
 export * from './extensions/AIPrompt.extension.js';
 export * from './extensions/TemplateEmbed.extension.js';
 export * from './extensions/TemplateExtensionBase.js';
 export * from './operations/TemplateRunOperation.js';
+export * from './operations/TemplateRunAuthorization.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AAAA,cAAc,mCAAmC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC"}

package/dist/index.js

@@ -1,6 +1,10 @@
 export * from './TemplateEngine.js';
+export * from './NunjucksSandbox.js';
+export * from './NunjucksCompileGuard.js';
+export * from './TemplateSandboxError.js';
 export * from './extensions/AIPrompt.extension.js';
 export * from './extensions/TemplateEmbed.extension.js';
 export * from './extensions/TemplateExtensionBase.js';
 export * from './operations/TemplateRunOperation.js';
+export * from './operations/TemplateRunAuthorization.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AAAA,cAAc,mCAAmC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,iCAAiC,CAAC;AAChD,cAAc,sCAAsC,CAAC;AACrD,cAAc,oCAAoC,CAAC;AACnD,cAAc,mCAAmC,CAAC;AAClD,cAAc,uCAAuC,CAAC"}

package/dist/operations/TemplateRunAuthorization.d.ts

@@ -0,0 +1,20 @@
+/**
+ * @fileoverview Decides who may render a stored template on demand, through the `RunTemplate`
+ * mutation or the `Template.Run` remote operation.
+ * @module @memberjunction/templates
+ */
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+/**
+ * Checks whether a principal may render a stored template on demand. A run is refused for:
+ * - a missing principal
+ * - a scope-limited session (an anonymous magic-link or widget guest, or a resource-scoped
+ *   magic-link session), whose confinement exists only as row-level security on entity reads
+ * - a principal without read permission on `MJ: Templates` and `MJ: Template Contents`
+ *
+ * Row-level security on the requested template still applies when the caller loads it.
+ * @param user the acting principal
+ * @param metadata the source of entity permissions; a missing provider refuses the run
+ * @returns `null` when the run may proceed, otherwise the reason it is refused
+ */
+export declare function GetTemplateRunRefusal(user: UserInfo | null | undefined, metadata: Pick<IMetadataProvider, 'EntityByName'> | null | undefined): string | null;
+//# sourceMappingURL=TemplateRunAuthorization.d.ts.map

package/dist/operations/TemplateRunAuthorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TemplateRunAuthorization.d.ts","sourceRoot":"","sources":["../../src/operations/TemplateRunAuthorization.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAKxE;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CACjC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EACjC,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,cAAc,CAAC,GAAG,IAAI,GAAG,SAAS,GACrE,MAAM,GAAG,IAAI,CAaf"}

package/dist/operations/TemplateRunAuthorization.js

@@ -0,0 +1,37 @@
+/** The entities a template run reads: the template, and the content it renders. */
+const TEMPLATE_RUN_ENTITIES = ['MJ: Templates', 'MJ: Template Contents'];
+/**
+ * Checks whether a principal may render a stored template on demand. A run is refused for:
+ * - a missing principal
+ * - a scope-limited session (an anonymous magic-link or widget guest, or a resource-scoped
+ *   magic-link session), whose confinement exists only as row-level security on entity reads
+ * - a principal without read permission on `MJ: Templates` and `MJ: Template Contents`
+ *
+ * Row-level security on the requested template still applies when the caller loads it.
+ * @param user the acting principal
+ * @param metadata the source of entity permissions; a missing provider refuses the run
+ * @returns `null` when the run may proceed, otherwise the reason it is refused
+ */
+export function GetTemplateRunRefusal(user, metadata) {
+    if (!user) {
+        return 'Unable to determine current user';
+    }
+    if (isScopeLimited(user)) {
+        return 'Running templates is not permitted for scope-limited sessions';
+    }
+    for (const entityName of TEMPLATE_RUN_ENTITIES) {
+        if (!metadata?.EntityByName(entityName)?.GetUserPermisions(user)?.CanRead) {
+            return `You do not have permission to read ${entityName}`;
+        }
+    }
+    return null;
+}
+/**
+ * True for a session confined by per-session scope rather than by its roles. Matches
+ * `IsScopeLimitedPrincipal` in `@memberjunction/server`, which this package cannot import.
+ */
+function isScopeLimited(user) {
+    const scope = user.MagicLinkScope;
+    return user.IsMagicLinkAnonymous || !!(scope?.ResourceID || scope?.ResourceType);
+}
+//# sourceMappingURL=TemplateRunAuthorization.js.map

package/dist/operations/TemplateRunAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TemplateRunAuthorization.js","sourceRoot":"","sources":["../../src/operations/TemplateRunAuthorization.ts"],"names":[],"mappings":"AAOA,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACjC,IAAiC,EACjC,QAAoE;IAEpE,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,kCAAkC,CAAC;IAC9C,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,+DAA+D,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;YACxE,OAAO,sCAAsC,UAAU,EAAE,CAAC;QAC9D,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAc;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC;IAClC,OAAO,IAAI,CAAC,oBAAoB,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,IAAI,KAAK,EAAE,YAAY,CAAC,CAAC;AACrF,CAAC"}

package/dist/operations/TemplateRunOperation.d.ts

@@ -1,6 +1,12 @@
 import { IMetadataProvider, UserInfo } from '@memberjunction/core';
 import { TemplateRunOperation, type TemplateRunInput, type TemplateRunOutput } from '@memberjunction/core-entities';
 export declare class TemplateRunServerOperation extends TemplateRunOperation {
+    /**
+     * Refuses scope-limited sessions and callers who cannot read templates and their content.
+     * The remote-operation resolver checks only API-key scope, which JWT, magic-link and widget
+     * sessions do not carry.
+     */
+    protected Authorize(_input: TemplateRunInput, user: UserInfo): Promise<boolean>;
     protected InternalExecute(input: TemplateRunInput, provider: IMetadataProvider, user: UserInfo): Promise<TemplateRunOutput>;
 }
 //# sourceMappingURL=TemplateRunOperation.d.ts.map

package/dist/operations/TemplateRunOperation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TemplateRunOperation.d.ts","sourceRoot":"","sources":["../../src/operations/TemplateRunOperation.ts"],"names":[],"mappings":"AAUA,OAAO,EAA0B,iBAAiB,EAAW,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEpG,OAAO,EAAE,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGpH,qBACa,0BAA2B,SAAQ,oBAAoB;cAChD,eAAe,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAqCpI"}
+{"version":3,"file":"TemplateRunOperation.d.ts","sourceRoot":"","sources":["../../src/operations/TemplateRunOperation.ts"],"names":[],"mappings":"AAUA,OAAO,EAA0B,iBAAiB,EAAqB,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAE9G,OAAO,EAAE,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,KAAK,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAIpH,qBACa,0BAA2B,SAAQ,oBAAoB;IAChE;;;;OAIG;cACsB,SAAS,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;cAI9E,eAAe,CAAC,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC;CAqCpI"}

package/dist/operations/TemplateRunOperation.js

@@ -14,10 +14,19 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
  * @module @memberjunction/templates
  */
 import { RegisterClass } from '@memberjunction/global';
-import { BaseRemotableOperation, RunView } from '@memberjunction/core';
+import { BaseRemotableOperation, Metadata, RunView } from '@memberjunction/core';
 import { TemplateRunOperation } from '@memberjunction/core-entities';
 import { TemplateEngineServer } from '../TemplateEngine.js';
+import { GetTemplateRunRefusal } from './TemplateRunAuthorization.js';
 let TemplateRunServerOperation = class TemplateRunServerOperation extends TemplateRunOperation {
+    /**
+     * Refuses scope-limited sessions and callers who cannot read templates and their content.
+     * The remote-operation resolver checks only API-key scope, which JWT, magic-link and widget
+     * sessions do not carry.
+     */
+    async Authorize(_input, user) {
+        return GetTemplateRunRefusal(user, Metadata.Provider) === null; // global-provider-ok: Authorize receives no provider; entity permissions are process-global metadata
+    }
     async InternalExecute(input, provider, user) {
         if (!input?.templateID) {
             throw new Error('templateID is required');

package/dist/operations/TemplateRunOperation.js.map

@@ -1 +1 @@
-{"version":3,"file":"TemplateRunOperation.js","sourceRoot":"","sources":["../../src/operations/TemplateRunOperation.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAqB,OAAO,EAAY,MAAM,sBAAsB,CAAC;AAEpG,OAAO,EAAE,oBAAoB,EAAiD,MAAM,+BAA+B,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAGlD,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,oBAAoB;IACtD,KAAK,CAAC,eAAe,CAAC,KAAuB,EAAE,QAA2B,EAAE,IAAc;QAChG,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,eAAe,CAA2B,eAAe,EAAE,IAAI,CAAC,CAAC;QACvG,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,UAAU,YAAY,CAAC,CAAC;QACtE,CAAC;QAED,6CAA6C;QAC7C,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAA0B;YAChG,UAAU,EAAE,uBAAuB;YACnC,WAAW,EAAE,iBAAiB,KAAK,CAAC,UAAU,GAAG;YACjD,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,eAAe;SAC9B,EAAE,IAAI,CAAC,CAAC;QACT,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0CAA0C,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAC7D,cAAc,EACd,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EACxB,KAAK,CAAC,IAAI,IAAI,EAAE,EAChB,IAAI,CAAC,mCAAmC,CAC3C,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IACpF,CAAC;CACJ,CAAA;AAtCY,0BAA0B;IADtC,aAAa,CAAC,sBAAsB,EAAE,cAAc,CAAC;GACzC,0BAA0B,CAsCtC"}
+{"version":3,"file":"TemplateRunOperation.js","sourceRoot":"","sources":["../../src/operations/TemplateRunOperation.ts"],"names":[],"mappings":";;;;;;AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAqB,QAAQ,EAAE,OAAO,EAAY,MAAM,sBAAsB,CAAC;AAE9G,OAAO,EAAE,oBAAoB,EAAiD,MAAM,+BAA+B,CAAC;AACpH,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAG5D,IAAM,0BAA0B,GAAhC,MAAM,0BAA2B,SAAQ,oBAAoB;IAChE;;;;OAIG;IACgB,KAAK,CAAC,SAAS,CAAC,MAAwB,EAAE,IAAc;QACvE,OAAO,qBAAqB,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,qGAAqG;IACzK,CAAC;IAES,KAAK,CAAC,eAAe,CAAC,KAAuB,EAAE,QAA2B,EAAE,IAAc;QAChG,IAAI,CAAC,KAAK,EAAE,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,eAAe,CAA2B,eAAe,EAAE,IAAI,CAAC,CAAC;QACvG,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,oBAAoB,KAAK,CAAC,UAAU,YAAY,CAAC,CAAC;QACtE,CAAC;QAED,6CAA6C;QAC7C,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,OAAO,CAA0B;YAChG,UAAU,EAAE,uBAAuB;YACnC,WAAW,EAAE,iBAAiB,KAAK,CAAC,UAAU,GAAG;YACjD,OAAO,EAAE,cAAc;YACvB,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,eAAe;SAC9B,EAAE,IAAI,CAAC,CAAC;QACT,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,0CAA0C,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,oBAAoB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,cAAc,CAC7D,cAAc,EACd,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,EACxB,KAAK,CAAC,IAAI,IAAI,EAAE,EAChB,IAAI,CAAC,mCAAmC,CAC3C,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,IAAI,wBAAwB,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;IACpF,CAAC;CACJ,CAAA;AA/CY,0BAA0B;IADtC,aAAa,CAAC,sBAAsB,EAAE,cAAc,CAAC;GACzC,0BAA0B,CA+CtC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@memberjunction/templates",
   "type": "module",
-  "version": "6.2.0-edge.3",
+  "version": "6.2.0-edge.4",
   "description": "MemberJunction Templating Engine and Utilities - Used for any application that requires templating utility functionality. NOTE: this package does use Angular Universal for compilation but is not marked with the usual ng prefix because it is a server-side library and not used within Angular apps.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,14 +14,14 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@memberjunction/core": "6.2.0-edge.3",
-    "@memberjunction/templates-base-types": "6.2.0-edge.3",
-    "@memberjunction/ai": "6.2.0-edge.3",
-    "@memberjunction/ai-core-plus": "6.2.0-edge.3",
-    "@memberjunction/aiengine": "6.2.0-edge.3",
-    "@memberjunction/ai-provider-bundle": "6.2.0-edge.3",
-    "@memberjunction/core-entities": "6.2.0-edge.3",
-    "@memberjunction/global": "6.2.0-edge.3",
+    "@memberjunction/core": "6.2.0-edge.4",
+    "@memberjunction/templates-base-types": "6.2.0-edge.4",
+    "@memberjunction/ai": "6.2.0-edge.4",
+    "@memberjunction/ai-core-plus": "6.2.0-edge.4",
+    "@memberjunction/aiengine": "6.2.0-edge.4",
+    "@memberjunction/ai-provider-bundle": "6.2.0-edge.4",
+    "@memberjunction/core-entities": "6.2.0-edge.4",
+    "@memberjunction/global": "6.2.0-edge.4",
     "nunjucks": "3.2.4"
   },
   "repository": {