@rhinostone/swig 2.7.3 → 2.8.1

package/HISTORY.md

@@ -1,3 +1,33 @@
+[2.8.1](https://github.com/gina-io/swig/tree/v2.8.1) / 2026-10-20
+-----------------------------------------------------------------
+
+* **Added** A "What's new in v<version>" section at the top of the README, regenerated from the release notes at every cut
+
+* **Fixed** Refreshed stale README claims — the benchmark summary now reflects the latest measured run (swig leads on all five workloads; the previous table predated the 2.2.0 escape-filter rewrite and showed nunjucks ahead on simple var output), and the security bullet no longer pins an exact CVE regression-test count nor conflates the prototype-chain hardening with CVE-2023-25345 (a directory-traversal fix)
+
+* **Fixed** README completeness pass against the 2.x release line — the feature list now covers the async-loader render path (callback dispatch with loader.async, dynamic extends included) and the single-runtime-dependency posture, the "How it works" section explains the runtime-only strict-CSP path, and the Jinja2/Django migration notes no longer list the default filter as absent (it has been built into native swig since upstream 2014)
+
+* **Fixed** The v0.9.0 changelog entry's PHP date-format citation now links to the canonical `https://www.php.net/manual/en/function.date.php` instead of the plain-HTTP `http://php.net/date` it had carried since upstream. The old form still resolves — it 301s through to exactly that URL — so this is the same destination over HTTPS, with the link text unchanged; it removes the last plain-HTTP link a link-health scan can flag in this repo (reported twice, gina-io/gina#51 and #58). Documentation only; no runtime or API change.
+
+* **Fixed** The bundled DateZ attribution banner now points at `https://github.com/tn0ms/DateZ`, following the fourth rename of that upstream account. The previous `tomoio` form still resolves — GitHub 301s a renamed account through to its current owner — so this is the same destination, with the misspelled upstream `LISENCE` filename preserved because that is genuinely how the file is named there. The banner ships in every `dist/` artifact, so the corrected URL reaches consumers at the next publish. Documentation only; no runtime or API change.
+
+* **Changed** Upgraded the ESLint dev dependency from 9.x, which its maintainers no longer support, to 10.x. The flat-config eslint.config.js carries over unchanged, and make lint reports the same results as under 9.x. ESLint 10 raises the lint toolchain Node floor to ^20.19.0, ^22.13.0 or >=24, which affects development and CI only; the published package is unaffected and its only runtime dependency remains @rhinostone/swig-core.
+
+[2.8.0](https://github.com/gina-io/swig/tree/v2.8.0) / 2026-08-02
+-----------------------------------------------------------------
+
+* **Added** AOT template registration — swig.register(path, fn) and swig.registerBundle(map) on every flavor store pre-compiled templates in the template cache under loader-normalized keys, wrapped in the locals-binding call shape include expects (priming via swig.run cached the raw template function, which crashed included partials that used variables or filters); swig compile --recursive --register emits a self-registering browser bundle
+
+* **Added** Runtime-only browser build — dist/swig.runtime.js and dist/swig.runtime.min.js execute pre-compiled template bundles (register, registerBundle, run, compileFile, renderFile with the native filter catalog and a root-based memory loader) and ship no parser and no new Function, so pages under a strict Content-Security-Policy without unsafe-eval can render AOT-compiled templates; also exposed to Node as require("@rhinostone/swig/runtime")
+
+* **Fixed** Updated the stale `/docs/swig` and `/docs/swig/migration` documentation links to their canonical `/docs/templating/swig` and `/docs/templating/swig/migration` paths in `README.md` (4 occurrences) and `CONTRIBUTING.md` (1 occurrence) (2026-06-15 link-health scan, gina-io/gina#39). The old URLs still resolved via the 301 redirects added in the 2026-04-23 Templating umbrella restructure, but were no longer canonical and kept accruing redirect hops. Documentation only; no runtime or API change.
+
+* **Fixed** Refreshed two stale external URLs flagged by the 2026-06-22 / 2026-06-29 link-health scans (gina-io/gina#43). `README.md` now links to `https://expressjs.com/` instead of the plain-HTTP `http://expressjs.com/` (the domain 301-redirects HTTP to HTTPS). `browser/comments.js` updates the DateZ `@license` URL from `github.com/ocrybit/DateZ` to `github.com/tomoio/DateZ` — the upstream GitHub user was renamed again (same class as the v2.0.0 `TomoUniversalis` to `ocrybit` rename); the target repo keeps the upstream `LISENCE` spelling. Documentation and comment-only; no runtime or API change.
+
+* **Fixed** De-linked the two remaining live references to the archived `paularmstrong/swig` repository (GitHub topic `unmaintained-dont-use`, last released 2014), flagged by the 2026-07-06 link-health scan (gina-io/gina#47). `README.md` no longer links the "abandoned `paularmstrong/swig`" mention to the archived repo root, and `CONTRIBUTING.md` de-links the "Pull Request 273" historical example (a PR on the archived repo, where contributions are disabled) — both references are preserved as plain text for traceability, matching the de-linking house style from the gina-io/gina#18 and #33 link-health fixes. Documentation only; no runtime or API change.
+
+* **Fixed** Several template-cache paths failed silently and now report the problem. The memory loader rejects a climbing path when a basepath is set, instead of resolving it to a different template than the one requested — with a root basepath it clamped and rendered the wrong file, mirroring the confinement the filesystem loader already enforces. Passing a filepath to run stores the same locals-binding wrapper, under the same resolved key, that a cache lookup expects, so a template primed that way is usable by a later include rather than crashing on the raw function argument shape. The memory cache no longer reads inherited object members, so an identifier-style loader cannot resolve a name such as constructor to a cache hit. Both minified bundles now point at the source map filename that is actually written.
+
 [2.7.3](https://github.com/gina-io/swig/tree/v2.7.3) / 2026-06-10
 -----------------------------------------------------------------
 
@@ -550,7 +580,7 @@ Migrating from v0.x.x? The upstream wiki has since been deleted; see the individ
 * **Added** New `raw` tag.
 * **Changed** Swig is no longer node 0.4 compatible.
 * **Fixed** Filter `date('f')` for 10am times.
-* **Fixed** Filter `date('r')` returns in UTC date format. This is more correct tospec RFC2822, per [php.net/date](http://php.net/date).
+* **Fixed** Filter `date('r')` returns in UTC date format. This is more correct tospec RFC2822, per [php.net/date](https://www.php.net/manual/en/function.date.php).
 * **Fixed** Filter `add` when adding numbers/numbers+strings together.
 * **Fixed** Tests for error messages that changed in node >0.6.0.
 

package/README.md

@@ -3,11 +3,11 @@ Swig
 
 [![CI](https://github.com/gina-io/swig/actions/workflows/ci.yml/badge.svg?branch=develop)](https://github.com/gina-io/swig/actions/workflows/ci.yml) [![NPM version](https://img.shields.io/npm/v/@rhinostone/swig.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig) [![NPM Downloads](https://img.shields.io/npm/dm/@rhinostone/swig.svg?style=flat)](https://www.npmjs.com/package/@rhinostone/swig) [![Socket Badge](https://socket.dev/api/badge/npm/package/@rhinostone/swig)](https://socket.dev/npm/package/@rhinostone/swig)
 
-> **Multi-flavor template engine** for Node.js and browsers — native Swig syntax (Jinja2/Django-inspired), Twig syntax, Python Jinja2 syntax, and Django Template Language syntax via dedicated frontends sharing one IR backend. [gina-io/swig](https://github.com/gina-io/swig) started as a maintained continuation of the abandoned [paularmstrong/swig](https://github.com/paularmstrong/swig) (last released 2014) and is now a standalone project. Security and bug fixes ship here.
+> **Multi-flavor template engine** for Node.js and browsers — native Swig syntax (Jinja2/Django-inspired), Twig syntax, Python Jinja2 syntax, and Django Template Language syntax via dedicated frontends sharing one IR backend. [gina-io/swig](https://github.com/gina-io/swig) started as a maintained continuation of the abandoned `paularmstrong/swig` (last released 2014) and is now a standalone project. Security and bug fixes ship here.
 
 > **Part of the [Gina](https://github.com/gina-io/gina) ecosystem.** This is the built-in template engine for [Gina](https://gina.io) ([npm](https://www.npmjs.com/package/gina)), a Node.js MVC framework with HTTP/2, multi-bundle architecture, and scope-based data isolation.
 
-Swig is a **Jinja2/Django-inspired** template engine for node.js and browsers. The syntax will feel familiar to Jinja2 and Django users, but Swig is **not drop-in compatible** with either — porting templates from an existing project requires a handful of changes. See the [Migration Guide](https://gina.io/docs/swig/migration) for the full parity list and workaround patterns.
+Swig is a **Jinja2/Django-inspired** template engine for node.js and browsers. The syntax will feel familiar to Jinja2 and Django users, but Swig is **not drop-in compatible** with either — porting templates from an existing project requires a handful of changes. See the [Migration Guide](https://gina.io/docs/templating/swig/migration) for the full parity list and workaround patterns.
 
 > **Coming from Twig?** Install [@rhinostone/swig-twig](https://www.npmjs.com/package/@rhinostone/swig-twig) instead — a dedicated Twig-syntax frontend with closer parity than working around incompatibilities here.
 
@@ -32,15 +32,28 @@ Features
 --------
 
 * Available for node.js **and** major web browsers.
-* [Express](http://expressjs.com/) compatible.
+* **Strict-CSP browser runtime** — AOT-compile templates ahead of time (`swig compile --recursive --register`) and render them with the runtime-only bundle (`dist/swig.runtime.min.js`, ~22 KB) — no parser, no `new Function`, no `unsafe-eval` required.
+* [Express](https://expressjs.com/) compatible.
+* **Async template loading** — back the loader with S3 / Redis / HTTP / any callback API: set `loader.async = true` and pass a callback to `renderFile` / `compileFile`; `extends` / `include` / `import` resolve at render time, dynamic `{% extends %}` paths included.
 * Object-Oriented template inheritance.
 * Apply filters and transformations to output in your templates.
-* **Hardened against prototype-pollution** — `__proto__` / `constructor` / `prototype` blocked at parser, tag-side, and IR-emission layers. CVE-2023-25345 fully patched. 11 CVE regression cases under [`tests/regressions.test.js`](./tests/regressions.test.js).
+* **Security-hardened** — prototype-pollution vectors (`__proto__` / `constructor` / `prototype`) blocked at parser, tag-side, and IR-emission layers; template-driven file reads outside the loader root rejected (CVE-2023-25345 directory traversal, patched in 2.7.1). Dedicated CVE regression suite in [`tests/regressions.test.js`](./tests/regressions.test.js).
 * Automatically escapes all variable output (HTML by default; configurable per-call).
 * Lots of iteration and conditionals supported.
-* Robust without the bloat.
+* Robust without the bloat — a single runtime dependency ([`@rhinostone/swig-core`](https://www.npmjs.com/package/@rhinostone/swig-core)).
 * Extendable and customizable — register custom filters, tags, and loaders per-instance.
 
+What's new in v2.8.1
+--------------------
+
+* **Fixed — README corrections now on npm.** The 2.8.0 README listed CVE-2023-25345 under the prototype-chain hardening; it is the directory-traversal fix, and the security bullet now says so without pinning an exact CVE regression-test count. The benchmark summary reflects the latest measured run (swig leads on all five workloads; the previous table predated the 2.2.0 escape-filter rewrite and showed nunjucks ahead on simple var output). The Jinja2/Django migration notes no longer list the `default` filter as absent — it has been built into native swig since upstream 2014.
+* **Fixed — README completeness for the 2.x line.** The feature list now covers the async-loader render path (callback dispatch with `loader.async`, dynamic `extends` included) and the single-runtime-dependency posture, and "How it works" explains the runtime-only strict-CSP path.
+* **Added — a "What's new" section.** The README now opens with a section like this one, regenerated from the release notes at every cut.
+* **Fixed — attribution and changelog links.** The bundled DateZ attribution banner points at `https://github.com/tn0ms/DateZ` after the upstream account's rename, and the v0.9.0 changelog's PHP date-format citation links to the canonical HTTPS `php.net` page. Both old links still resolved; documentation only, no runtime or API change.
+* **Changed — ESLint 10 for development.** ESLint 9 is no longer supported by its maintainers, so the lint toolchain moves to ESLint 10 with the flat config unchanged. Running `make lint` now needs Node ^20.19.0, ^22.13.0 or >=24; the published package and its runtime Node floor are unaffected.
+
+See the full [HISTORY.md](./HISTORY.md) and [ROADMAP.md](./ROADMAP.md).
+
 Benchmarks
 ----------
 
@@ -50,13 +63,13 @@ Benchmarks
 cd benchmarks && npm install && node render.js
 ```
 
-In production-typical settings (autoescape on), `@rhinostone/swig` outperforms Nunjucks on iteration-heavy templates by 2–3.5× and ties on simple control flow. See [`benchmarks/README.md`](./benchmarks/README.md) for the methodology, the full result table, and how to reproduce on your own hardware.
+In production-typical settings (autoescape on), `@rhinostone/swig` leads Nunjucks on all five workload shapes — from ~1.8× on simple variable output to 3.5–5.5× on iteration-heavy templates (median of 3 runs, 2026-08). See [`benchmarks/README.md`](./benchmarks/README.md) for the methodology, the full result table, and how to reproduce on your own hardware.
 
 Need Help? Have Questions? Comments?
 ------------------------------------
 
 * File an issue at [gina-io/swig/issues](https://github.com/gina-io/swig/issues).
-* Swig v0.x → v1.x migration notes — the original upstream wiki has been deleted; see `HISTORY.md` entries around v1.0.0 for the individual breaking changes. For porting *from Jinja2 or Django* into Swig, see the [Migration Guide](https://gina.io/docs/swig/migration).
+* Swig v0.x → v1.x migration notes — the original upstream wiki has been deleted; see `HISTORY.md` entries around v1.0.0 for the individual breaking changes. For porting *from Jinja2 or Django* into Swig, see the [Migration Guide](https://gina.io/docs/templating/swig/migration).
 
 Installation
 ------------
@@ -78,7 +91,7 @@ For Django syntax:
 Documentation
 -------------
 
-User-facing documentation lives in the Gina Docusaurus site under the [Swig Template Engine](https://gina.io/docs/swig) section, maintained in [gina-io/docs](https://github.com/gina-io/docs) at `docs/templating/swig/`. The JSDoc blocks in `lib/swig.js`, `lib/filters.js`, `lib/tags/`, and `lib/loaders/` remain the canonical source-of-truth for the public API and are mirrored into the Docusaurus pages.
+User-facing documentation lives in the Gina Docusaurus site under the [Swig Template Engine](https://gina.io/docs/templating/swig) section, maintained in [gina-io/docs](https://github.com/gina-io/docs) at `docs/templating/swig/`. The JSDoc blocks in `lib/swig.js`, `lib/filters.js`, `lib/tags/`, and `lib/loaders/` remain the canonical source-of-truth for the public API and are mirrored into the Docusaurus pages.
 
 Basic Example
 -------------
@@ -137,9 +150,9 @@ Swig is *inspired by* Jinja2 and Django, not a drop-in replacement. Common pitfa
 * **`{% with x=1 %}` → `{% set x = 1 %}`**, and no block-form `{% set %}…{% endset %}`.
 * **No `{% from "f" import x %}` — use `{% import "f" as ns %}` + `ns.x` instead**.
 * **Method calls require parens** — Django auto-invokes `x.get_absolute_url`; Swig needs `x.get_absolute_url()`.
-* **~25 Jinja2 filters are absent** — `default`, `truncate`, `tojson`, `round`, `int`, `float`, `map`, `select`, `batch`, `trim`, etc. Register them via `swig.setFilter(name, fn)`.
+* **Many Jinja2 filters are absent** — `truncate`, `tojson`, `round`, `int`, `float`, `map`, `select`, `batch`, `trim`, etc. (`default` **is** built in). Register missing ones via `swig.setFilter(name, fn)` — or use [@rhinostone/swig-jinja2](https://www.npmjs.com/package/@rhinostone/swig-jinja2), which ships 39 of them natively.
 
-Full parity tables and workaround patterns: **[Migration Guide](https://gina.io/docs/swig/migration)**.
+Full parity tables and workaround patterns: **[Migration Guide](https://gina.io/docs/templating/swig/migration)**.
 
 How it works
 ------------
@@ -148,6 +161,8 @@ Swig reads template files and translates them into cached JavaScript functions.
 
 In `2.x`, frontend parsers (native Swig syntax in [@rhinostone/swig](https://www.npmjs.com/package/@rhinostone/swig), Twig syntax in [@rhinostone/swig-twig](https://www.npmjs.com/package/@rhinostone/swig-twig), Python Jinja2 syntax in [@rhinostone/swig-jinja2](https://www.npmjs.com/package/@rhinostone/swig-jinja2), Django Template Language syntax in [@rhinostone/swig-django](https://www.npmjs.com/package/@rhinostone/swig-django)) emit a shared intermediate representation. The backend in [@rhinostone/swig-core](https://www.npmjs.com/package/@rhinostone/swig-core) lowers IR to JS. New flavors plug in at the frontend without touching the runtime.
 
+For strict-CSP targets the compile pipeline can be skipped entirely: AOT-compile templates with the CLI (`swig compile --recursive --register`) and execute the resulting bundle with the runtime-only build (`dist/swig.runtime.min.js`), which contains no parser and no `new Function`.
+
 License
 -------
 

package/ROADMAP.md

@@ -16,11 +16,20 @@ _No near-term scheduled items. See [Future (post-2.0)](#future-post-20) for upco
 | --- | --- |
 | Planned | Async parse path for the remaining dynamic targets — runtime-resolved `{% import %}` / `{% from %}` paths on the async-codegen branch. Static-target async dispatch shipped in 2.2.0; dynamic `{% extends %}` shipped in 2.5.2 (native + Twig + Jinja2) and dynamic `{% include %}` paths already resolve (the include path has always been an expression). Dynamic `import` / `from` are on hold pending consumer demand. |
 | Planned | Modern browser-test harness. The legacy phantomjs runner was removed; a replacement (e.g. Playwright or JSDOM) has not yet landed, so browser parity is verified in the interim via the production build plus a symbol grep. (The `mocha` → `node:test` runner migration, the `expect.js` → in-repo assertion-shim swap, and the `blanket` → `node:test` built-in coverage migration have all shipped.) |
+| On demand | Ahead-of-time browser support for the Twig, Jinja2, and Django frontends, in two parts that ship together. Runtime-only bundles: the shared runtime factory already supports them, and each flavor needs its own bundle entry and build target, since filter catalogs are per-flavor. A flavor-aware compile step: `swig compile --register` compiles with the native parser only, so flavor templates are precompiled programmatically until it lands. The native `dist/swig.runtime.min.js` shipped in 2.8.0; the flavor pieces land when a consumer needs them. |
 
 ---
 
 ## Completed
 
+### v2.8.0 (August 2026)
+
+- Added ahead-of-time template registration: `swig.register(path, fn)` and `swig.registerBundle(map)` place pre-compiled template functions into the template cache under loader-normalized keys, so `include`, `compileFile`, and `renderFile` resolve them without a compiler. Available on all four frontends (native, Twig, Jinja2, Django). `swig compile --recursive --register` emits a bundle that registers itself on load and also exports the template map, so a page needs no per-template wiring.
+- Added a runtime-only browser build — `dist/swig.runtime.js` and `dist/swig.runtime.min.js` (22 KB minified, roughly a quarter of the full bundle). It executes pre-compiled bundles with the full filter catalog but ships no lexer, parser, or code generator, and therefore contains no `new Function`: pages served under a strict Content-Security-Policy without `unsafe-eval` can render AOT-compiled templates. Every compiling entry point throws a clear error naming the CLI workflow instead of failing obscurely. Also available to Node as `require('@rhinostone/swig/runtime')`.
+- Fixed several template-cache paths that failed silently. A registered template no longer shadows a loadable `{% extends %}` parent — the parent's source is still read through the loader, where previously registering a layout could make a child that rendered correctly start rendering an empty string with no error. The memory loader rejects a climbing path when a `basepath` is set rather than resolving it to a different template than the one requested. Passing a filepath to `run` now caches an entry a later `include` can actually use. The memory cache no longer treats inherited object members as cache hits. `register` reports a disabled cache for every falsy `cache` value, and `registerBundle` validates a whole bundle before committing any of it, so a malformed map cannot leave the registry half-populated.
+- Fixed browser integration for the new bundles: a self-registering bundle finds the engine whether it is a bare global or a property of the global object (under AMD there is no bare binding, so every template previously went unregistered in silence) and warns when no engine is present; loading a runtime bundle twice, or after the full build, no longer discards existing registrations or replaces a compiler-capable instance; and the runtime entry no longer assumes `window`, so it loads in a worker. Both minified bundles now reference the source map filename that is actually written.
+- All five packages (`@rhinostone/swig`, `@rhinostone/swig-core`, `@rhinostone/swig-twig`, `@rhinostone/swig-jinja2`, `@rhinostone/swig-django`) released in lockstep at `2.8.0`. Lockstep is now required rather than conventional: the frontends reference modules inside `@rhinostone/swig-core` that exist only from this version forward.
+
 ### v2.7.3 (June 2026)
 
 - Fixed a filter-chain argument leak in the expression parsers: the per-filter argument accumulator was function-scoped and never reset between iterations, so an arg-bearing filter earlier in a chain leaked its arguments onto a later no-arg filter (e.g. `x|default("y")|upper` lowered `upper` with the leaked `["y"]`). Affected nested and parenthesized chains in the shared core parser and all filter chains in the Twig and Jinja2 frontends; the Django frontend already shipped the per-iteration reset. Runtime impact ranged from harmless (filters that ignore extra positional arguments) to wrong output (a no-arg filter consuming a leaked positional argument).

package/bin/swig.js

@@ -27,6 +27,7 @@ var FLAGS = {
   'm': { alias: 'minify', boolean: true },
   'r': { alias: 'recursive' },
   'ext': {},
+  'register': { boolean: true },
   'filters': {},
   'tags': {},
   'options': {},
@@ -313,6 +314,10 @@ function validate(argv) {
     }
   }
 
+  if (argv.register && !argv.r) {
+    throw new Error('--register requires --recursive; it emits a self-registering bundle of the compiled directory.');
+  }
+
   if (argv.ext && !argv.r) {
     throw new Error('--ext is only meaningful with --recursive.');
   }
@@ -344,6 +349,7 @@ function usage() {
     '    -m, --minify        Minify compiled functions with terser',
     '    -r, --recursive     Recursively compile every template in <dir> into a single AOT bundle module.',
     '    --ext               Comma-separated list of file extensions to include when using --recursive (e.g. ".html,.swig"). Defaults to no filter.',
+    '    --register          With --recursive: emit a self-registering bundle (calls swig.registerBundle when a global swig is present; also exports the template map).',
     '    --filters           Custom filters as a CommonJS-style file',
     '    --tags              Custom tags as a CommonJS-style file',
     '    --options           Customize Swig\'s Options from a CommonJS-style file',
@@ -418,6 +424,13 @@ function walkSync(dir) {
  * resolution still happens at render time through the consumer's loader. The
  * bundle is not a closed module against inheritance chains.
  *
+ * With <code>--register</code> the bundle self-registers instead: it calls
+ * <code>swig.registerBundle(map)</code> against a global <code>swig</code>
+ * when one is present (a browser page that loaded the swig bundle first),
+ * and still exports the raw map for Node-side consumers. Run the command
+ * from the template root (<code>swig compile -r . --register</code>) so
+ * baked include paths line up with the bundle's registration keys.
+ *
  * @param  {string}  dir Directory to walk.
  * @return {undefined}   Writes to stdout or to <code>argv.o</code>.
  * @private
@@ -452,7 +465,27 @@ function bundleRecursive(dir) {
     parts.push(JSON.stringify(key) + ': ' + tpl);
   });
 
-  output = 'module.exports = {\n' + parts.join(',\n') + '\n};\n';
+  if (argv.register) {
+    // The engine may be reachable as a bare global (classic script tag) or
+    // only as a property of the global object — under AMD the browser entry
+    // registers a named module and never creates the bare binding, so a
+    // bare-identifier lookup alone would silently register nothing.
+    output = 'var __swigTemplates = {\n' + parts.join(',\n') + '\n};\n' +
+      'if (typeof module !== "undefined" && module.exports) {\n' +
+      '  module.exports = __swigTemplates;\n' +
+      '}\n' +
+      'var __swigEngine = (typeof swig !== "undefined" && swig) ||\n' +
+      '  (typeof window !== "undefined" && window.swig) ||\n' +
+      '  (typeof globalThis !== "undefined" && globalThis.swig) || null;\n' +
+      'if (__swigEngine && __swigEngine.registerBundle) {\n' +
+      '  __swigEngine.registerBundle(__swigTemplates);\n' +
+      '} else if (typeof console !== "undefined" && console.warn) {\n' +
+      '  console.warn("swig: no engine found; ' + parts.length + ' pre-compiled template(s) were not registered. ' +
+      'Load swig before this bundle, or call swig.registerBundle(__swigTemplates) yourself.");\n' +
+      '}\n';
+  } else {
+    output = 'module.exports = {\n' + parts.join(',\n') + '\n};\n';
+  }
 
   if (argv.m) {
     output = loadTerser().minify_sync(output).code;

package/context7.json

@@ -0,0 +1,17 @@
+{
+  "url": "https://context7.com/gina-io/swig",
+  "public_key": "pk_MGD4ulFUKUHnxmzFGuWc8",
+  "projectTitle": "Rhinostone Swig",
+  "description": "Rhinostone Swig is a simple, powerful, and extendable template engine for Node.js and browsers, supporting native Swig, Twig, Python Jinja2, and Django Template Language syntaxes.",
+  "branch": "develop",
+  "excludeFolders": [
+    ".changes"
+  ],
+  "excludeFiles": [
+    "HISTORY.md",
+    "ROADMAP.md",
+    "AUTHORS",
+    "ISSUE_TEMPLATE.md",
+    "PULL_REQUEST_TEMPLATE.md"
+  ]
+}

package/dist/swig.js

@@ -1,9 +1,13 @@
-/*! Swig v2.7.3 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
-/*! DateZ (c) 2011 Tomo Universalis | @license https://github.com/ocrybit/DateZ/blob/master/LISENCE */
+/*! Swig v2.8.1 | https://github.com/gina-io/swig | @license https://github.com/gina-io/swig/blob/master/LICENSE */
+/*! DateZ (c) 2011 Tomo Universalis | @license https://github.com/tn0ms/DateZ/blob/master/LISENCE */
 (() => {
   var __getOwnPropNames = Object.getOwnPropertyNames;
   var __commonJS = (cb, mod) => function __require() {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+    try {
+      return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+    } catch (e) {
+      throw mod = 0, e;
+    }
   };
 
   // packages/swig-core/lib/security.js
@@ -4176,6 +4180,9 @@
         basepath = basepath ? path.normalize(basepath) : null;
         ret.resolve = function(to, from) {
           if (basepath) {
+            if (/^\.\.([\\/]|$)/.test(path.normalize(to))) {
+              utils.throwError('Template "' + to + '" resolves outside the loader root "' + basepath + '".');
+            }
             from = basepath;
           } else {
             from = from ? path.dirname(from) : "/";
@@ -4376,7 +4383,7 @@
           return;
         }
         if (engineCache === "memory") {
-          return memoryStore[key];
+          return Object.prototype.hasOwnProperty.call(memoryStore, key) ? memoryStore[key] : void 0;
         }
         return engineCache.get(key);
       };
@@ -4475,7 +4482,10 @@
           }
           parentFile = parentFile || options.filename;
           parentFile = deps.resolve(parentName, parentFile);
-          parent = deps.cacheGet(parentFile, options) || deps.parseFile(parentFile, utils.extend({}, options, { filename: parentFile }));
+          parent = deps.cacheGet(parentFile, options);
+          if (!parent || !parent.tokens) {
+            parent = deps.parseFile(parentFile, utils.extend({}, options, { filename: parentFile }));
+          }
           parentName = parent.parent;
           if (parentFiles.indexOf(parentFile) !== -1) {
             throw new Error('Illegal circular extends of "' + parentFile + '".');
@@ -4526,6 +4536,52 @@
             self.cache = {};
           }
         };
+        function buildRegistered(fn) {
+          var context = getLocals(), contextLength = utils.keys(context).length;
+          return function registered(locals, blocks) {
+            var lcls;
+            if (locals && contextLength) {
+              lcls = utils.extend({}, context, locals);
+            } else if (locals && !contextLength) {
+              lcls = locals;
+            } else if (!locals && contextLength) {
+              lcls = context;
+            } else {
+              lcls = {};
+            }
+            return fn(self, lcls, filters, utils, efn, blocks);
+          };
+        }
+        function validateRegistration(path, fn) {
+          if (typeof path !== "string" || !path.length) {
+            throw new Error("Template registration path must be a non-empty string.");
+          }
+          if (typeof fn !== "function") {
+            throw new Error('Registered template for "' + path + '" is not a function. Pass a pre-compiled template function.');
+          }
+          if (!self.options.cache) {
+            throw new Error("Cannot register templates while caching is disabled (cache: " + self.options.cache + "). The registry is the compile cache.");
+          }
+        }
+        self.register = function(path, fn) {
+          validateRegistration(path, fn);
+          cacheSet(self.options.loader.resolve(path), {}, buildRegistered(fn));
+          return self;
+        };
+        self.registerBundle = function(map) {
+          var entries = [];
+          if (!map || typeof map !== "object") {
+            throw new Error("Template bundle must be an object of { path: templateFn } pairs.");
+          }
+          utils.each(map, function(fn, path) {
+            entries.push([path, fn]);
+            validateRegistration(path, fn);
+          });
+          utils.each(entries, function(entry) {
+            self.register(entry[0], entry[1]);
+          });
+          return self;
+        };
         self.setFilter = function(name, method) {
           if (typeof method !== "function") {
             throw new Error('Filter "' + name + '" is not a valid function.');
@@ -4739,7 +4795,7 @@
         self.run = function(tpl, locals, filepath) {
           var context = getLocals({ locals });
           if (filepath) {
-            cacheSet(filepath, {}, tpl);
+            cacheSet(self.options.loader.resolve(filepath), {}, buildRegistered(tpl));
           }
           return tpl(self, context, filters, utils, efn);
         };
@@ -4758,7 +4814,7 @@
       var loaders = require_loaders2();
       var preWalker = require_pre_walker();
       var engine = require_engine();
-      exports.version = "2.7.3";
+      exports.version = "2.8.1";
       var defaultOptions = {
         autoescape: true,
         varControls: ["{{", "}}"],
@@ -4963,6 +5019,8 @@
       exports.renderFile = defaultInstance.renderFile;
       exports.renderFileAsync = defaultInstance.renderFileAsync;
       exports.run = defaultInstance.run;
+      exports.register = defaultInstance.register;
+      exports.registerBundle = defaultInstance.registerBundle;
       exports.invalidateCache = defaultInstance.invalidateCache;
       exports.loaders = loaders;
     }
@@ -5126,6 +5184,17 @@
  * chunk, returning the trimmed tag body (e.g. `extends "x.html"`).
  * @private
  */
+/*!
+ * Wrap a pre-compiled template function in the locals-binding call shape
+ * cached entries have — include-emitted code invokes them as
+ * `(context)`, so the raw five-argument function is the wrong shape.
+ * @private
+ */
+/*!
+ * Shared argument checks for register / registerBundle, so a bundle can be
+ * validated in full before any entry is committed.
+ * @private
+ */
 /*!
  * Export methods publicly
  */