npm - miki-template - Versions diffs - 1.3.3 → 1.3.7 - Mend

miki-template 1.3.3 → 1.3.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (115) hide show

package/.eslintrc.json +16 -0
package/.github/release-notes/v1.3.1.md +55 -55
package/.github/release-notes/v1.3.3.md +77 -0
package/.github/workflows/ci.yml +38 -54
package/.github/workflows/release.yml +106 -0
package/AGENT.md +71 -71
package/API_REFERENCE.md +314 -314
package/CHANGELOG.md +173 -169
package/CODE_OF_CONDUCT.md +14 -14
package/CONTRIBUTING.md +27 -27
package/README.md +342 -321
package/ROADMAP.md +40 -40
package/benchmarks/report.json +16 -16
package/benchmarks/run.js +49 -49
package/benchmarks/stress.mjs +647 -647
package/benchmarks/templates/large.dtpl +7 -7
package/benchmarks/templates/medium.dtpl +3 -3
package/benchmarks/templates/small.dtpl +7 -7
package/context/component.md +109 -109
package/context/prd.md +131 -131
package/context/project-structure.md +33 -33
package/dir/base.html +22 -22
package/dir/cmpnt.html +10 -10
package/dir/footer.html +2 -2
package/dir/home.html +80 -80
package/dir/index.html +80 -0
package/dir/navbar.html +8 -8
package/docs/README.md +18 -18
package/docs/advanced_usage.md +71 -71
package/docs/api.md +119 -119
package/docs/filters.md +708 -708
package/docs/installation.md +106 -106
package/docs/overview.md +79 -57
package/docs/partialdef.md +70 -70
package/docs/security.md +27 -27
package/docs/tags.md +673 -673
package/docs/usage.md +646 -646
package/eslint.config.mjs +42 -42
package/ex.mjs +34 -32
package/live-test/package-lock.json +915 -0
package/live-test/package.json +9 -0
package/live-test/server.js +14 -0
package/live-test/views/base.html +8 -0
package/live-test/views/child.html +7 -0
package/live-test/views/index.html +1 -0
package/miki-template-extension/.github/workflows/ci.yml +116 -116
package/miki-template-extension/.vscodeignore +7 -7
package/miki-template-extension/CHANGELOG.md +99 -99
package/miki-template-extension/LICENSE +21 -21
package/miki-template-extension/README.md +273 -273
package/miki-template-extension/extension.js +1013 -1013
package/miki-template-extension/icon.svg +10 -10
package/miki-template-extension/package.json +280 -280
package/miki-template-extension/snippets/miki-template.json +717 -717
package/miki-template-extension/syntaxes/language-configuration.json +114 -114
package/miki-template-extension/syntaxes/miki-template.tmLanguage.json +355 -355
package/miki-template-extension/tests/grammar-tests.json +162 -162
package/miki-template-extension/tests/run-grammar-tests.js +82 -82
package/package.json +40 -34
package/sample-app/package-lock.json +901 -0
package/sample-app/package.json +9 -0
package/sample-app/server.js +14 -0
package/sample-app/views/index.html +1 -0
package/scripts/build-vsix.js +129 -129
package/scripts/build-vsix.ps1 +15 -15
package/snippets/miki-template.json +177 -177
package/src/asyncRender.js +20 -20
package/src/cache.js +80 -80
package/src/context.js +126 -126
package/src/context_processors.js +48 -48
package/src/esm.mjs +89 -84
package/src/filters.js +975 -975
package/src/i18n.js +171 -171
package/src/index.js +1112 -940
package/src/lexer.js +114 -114
package/src/libraries.js +371 -371
package/src/parser.js +270 -270
package/src/security.js +53 -53
package/src/tags/control.js +719 -719
package/src/tags/extra.js +154 -154
package/src/tags/helpers.js +26 -26
package/src/tags/i18n.js +256 -256
package/src/tags/inheritance.js +335 -335
package/src/tags/registry.js +18 -18
package/src/tags/util.js +400 -400
package/src/types.d.ts +107 -107
package/syntaxes/language-configuration.json +26 -26
package/syntaxes/miki-template.tmLanguage.json +146 -146
package/tests/asyncRender.test.js +17 -17
package/tests/base.html +6 -6
package/tests/child.html +3 -3
package/tests/context_processors.test.js +13 -13
package/tests/esm.test.mjs +61 -61
package/tests/filters.test.js +254 -254
package/tests/finder-appdirs.test.js +19 -0
package/tests/finder.test.js +17 -0
package/tests/fixtures/views/nested/index.html +1 -0
package/tests/fixtures/views/partial.html +1 -0
package/tests/fixtures/views/sub/deepfile.html +1 -0
package/tests/fixtures/views-appdirs/product/site/detail.html +1 -0
package/tests/include_security.test.js +9 -9
package/tests/integration/README.md +32 -32
package/tests/integration/features.test.cjs +1681 -1681
package/tests/integration/features.test.mjs +1697 -1697
package/tests/integration/finder.esm.test.mjs +13 -0
package/tests/integration/templates/base.miki +6 -6
package/tests/integration/templates/child.miki +6 -6
package/tests/integration/templates/index.html +17 -17
package/tests/lexer.test.js +45 -45
package/tests/parser.test.js +57 -57
package/tests/partial.html +1 -1
package/tests/partialdef.test.js +79 -79
package/tests/production_checks.js +57 -57
package/tests/security.test.js +28 -28
package/tests/tags.test.js +233 -233

package/tests/integration/finder.esm.test.mjs ADDED Viewed

@@ -0,0 +1,13 @@
+import assert from 'node:assert';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+import { findTemplateInViews } from '../../src/esm.mjs';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+test('ESM Template finder - nested index', () => {
+  const views = [path.join(__dirname, '..', 'fixtures', 'views')];
+  const found = findTemplateInViews('nested/index', views);
+  assert.ok(found && typeof found === 'string');
+});

package/tests/integration/templates/base.miki CHANGED Viewed

@@ -1,6 +1,6 @@
-<!DOCTYPE html>
-<html>
-<body>
-  {% block content %}Default content from base{% endblock %}
-</body>
-</html>
+<!DOCTYPE html>
+<html>
+<body>
+  {% block content %}Default content from base{% endblock %}
+</body>
+</html>

package/tests/integration/templates/child.miki CHANGED Viewed

@@ -1,6 +1,6 @@
-{% extends "base.miki" %}
-{% block content %}
-  <h1>{{ heading }}</h1>
-  <p>Welcome, {{ user.name }}!</p>
-  {{ block.super }}
-{% endblock %}
+{% extends "base.miki" %}
+{% block content %}
+  <h1>{{ heading }}</h1>
+  <p>Welcome, {{ user.name }}!</p>
+  {{ block.super }}
+{% endblock %}

package/tests/integration/templates/index.html CHANGED Viewed

@@ -1,17 +1,17 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>{{ title }}</title>
-</head>
-<body>
-  <h1>{{ heading }}</h1>
-  <ul>
-  {% for item in items %}
-    <li>{{ forloop.counter }}: {{ item|upper }}</li>
-  {% empty %}
-    <li>No items</li>
-  {% endfor %}
-  </ul>
-  <p>User: {{ user.name|title }}</p>
-</body>
-</html>
+<!DOCTYPE html>
+<html>
+<head>
+  <title>{{ title }}</title>
+</head>
+<body>
+  <h1>{{ heading }}</h1>
+  <ul>
+  {% for item in items %}
+    <li>{{ forloop.counter }}: {{ item|upper }}</li>
+  {% empty %}
+    <li>No items</li>
+  {% endfor %}
+  </ul>
+  <p>User: {{ user.name|title }}</p>
+</body>
+</html>

package/tests/lexer.test.js CHANGED Viewed

@@ -1,45 +1,45 @@
-const test = require('node:test');
-const assert = require('node:assert');
-const { tokenize } = require('../src/lexer');
-test('Lexer - plain text tokenizing', () => {
-  const tokens = tokenize('Hello World');
-  assert.strictEqual(tokens.length, 1);
-  assert.strictEqual(tokens[0].type, 'text');
-  assert.strictEqual(tokens[0].content, 'Hello World');
-});
-test('Lexer - variable tokenizing', () => {
-  const tokens = tokenize('Hello {{ name }}!');
-  assert.strictEqual(tokens.length, 3);
-  assert.strictEqual(tokens[0].content, 'Hello ');
-  assert.strictEqual(tokens[1].type, 'var');
-  assert.strictEqual(tokens[1].content, 'name');
-  assert.strictEqual(tokens[2].content, '!');
-});
-test('Lexer - block tag tokenizing', () => {
-  const tokens = tokenize('{% if active %}Yes{% endif %}');
-  assert.strictEqual(tokens.length, 3);
-  assert.strictEqual(tokens[0].type, 'block');
-  assert.strictEqual(tokens[0].content, 'if active');
-  assert.strictEqual(tokens[1].content, 'Yes');
-  assert.strictEqual(tokens[2].type, 'block');
-  assert.strictEqual(tokens[2].content, 'endif');
-});
-test('Lexer - inline comment exclusion', () => {
-  const tokens = tokenize('Before {# comment #} After');
-  assert.strictEqual(tokens.length, 2);
-  assert.strictEqual(tokens[0].content, 'Before ');
-  assert.strictEqual(tokens[1].content, ' After');
-});
-test('Lexer - verbatim tag handling', () => {
-  const tokens = tokenize('Text {% verbatim %} {{ unparsed }} {% endverbatim %} End');
-  assert.strictEqual(tokens.length, 3);
-  assert.strictEqual(tokens[0].content, 'Text ');
-  assert.strictEqual(tokens[1].type, 'text');
-  assert.strictEqual(tokens[1].content, ' {{ unparsed }} ');
-  assert.strictEqual(tokens[2].content, ' End');
-});
+const test = require('node:test');
+const assert = require('node:assert');
+const { tokenize } = require('../src/lexer');
+test('Lexer - plain text tokenizing', () => {
+  const tokens = tokenize('Hello World');
+  assert.strictEqual(tokens.length, 1);
+  assert.strictEqual(tokens[0].type, 'text');
+  assert.strictEqual(tokens[0].content, 'Hello World');
+});
+test('Lexer - variable tokenizing', () => {
+  const tokens = tokenize('Hello {{ name }}!');
+  assert.strictEqual(tokens.length, 3);
+  assert.strictEqual(tokens[0].content, 'Hello ');
+  assert.strictEqual(tokens[1].type, 'var');
+  assert.strictEqual(tokens[1].content, 'name');
+  assert.strictEqual(tokens[2].content, '!');
+});
+test('Lexer - block tag tokenizing', () => {
+  const tokens = tokenize('{% if active %}Yes{% endif %}');
+  assert.strictEqual(tokens.length, 3);
+  assert.strictEqual(tokens[0].type, 'block');
+  assert.strictEqual(tokens[0].content, 'if active');
+  assert.strictEqual(tokens[1].content, 'Yes');
+  assert.strictEqual(tokens[2].type, 'block');
+  assert.strictEqual(tokens[2].content, 'endif');
+});
+test('Lexer - inline comment exclusion', () => {
+  const tokens = tokenize('Before {# comment #} After');
+  assert.strictEqual(tokens.length, 2);
+  assert.strictEqual(tokens[0].content, 'Before ');
+  assert.strictEqual(tokens[1].content, ' After');
+});
+test('Lexer - verbatim tag handling', () => {
+  const tokens = tokenize('Text {% verbatim %} {{ unparsed }} {% endverbatim %} End');
+  assert.strictEqual(tokens.length, 3);
+  assert.strictEqual(tokens[0].content, 'Text ');
+  assert.strictEqual(tokens[1].type, 'text');
+  assert.strictEqual(tokens[1].content, ' {{ unparsed }} ');
+  assert.strictEqual(tokens[2].content, ' End');
+});

package/tests/parser.test.js CHANGED Viewed

@@ -1,57 +1,57 @@
-const test = require('node:test');
-const assert = require('node:assert');
-const { parseVariableExpression } = require('../src/parser');
-const { Context } = require('../src/context');
-test('Parser - variable expression parsing', () => {
-  const res = parseVariableExpression('user.name|lower|default:"Guest"');
-  assert.strictEqual(res.varPath, 'user.name');
-  assert.strictEqual(res.filters.length, 2);
-  assert.strictEqual(res.filters[0].name, 'lower');
-  assert.strictEqual(res.filters[0].arg, null);
-  assert.strictEqual(res.filters[1].name, 'default');
-  assert.strictEqual(res.filters[1].arg.type, 'literal');
-  assert.strictEqual(res.filters[1].arg.value, 'Guest');
-});
-test('Context - basic dotted lookups', () => {
-  const ctx = new Context({
-    user: {
-      profile: {
-        name: 'Miki',
-        age: 30
-      }
-    },
-    items: ['apple', 'banana']
-  });
-  assert.strictEqual(ctx.get('user.profile.name'), 'Miki');
-  assert.strictEqual(ctx.get('user.profile.age'), 30);
-  assert.strictEqual(ctx.get('items.1'), 'banana');
-  // Missing key now returns undefined (so filters like default_if_none
-  // can detect missing values) instead of empty string.
-  assert.strictEqual(ctx.get('user.profile.missing'), undefined);
-});
-test('Context - scope pushing and popping', () => {
-  const ctx = new Context({ name: 'Global' });
-  ctx.push({ name: 'Local', age: 25 });
-  assert.strictEqual(ctx.get('name'), 'Local');
-  assert.strictEqual(ctx.get('age'), 25);
-  ctx.pop();
-  assert.strictEqual(ctx.get('name'), 'Global');
-  assert.strictEqual(ctx.get('age'), undefined);
-});
-test('Context - automatic function calling', () => {
-  const ctx = new Context({
-    user: {
-      getName: () => 'Dynamic Name'
-    }
-  });
-  assert.strictEqual(ctx.get('user.getName'), 'Dynamic Name');
-});
+const test = require('node:test');
+const assert = require('node:assert');
+const { parseVariableExpression } = require('../src/parser');
+const { Context } = require('../src/context');
+test('Parser - variable expression parsing', () => {
+  const res = parseVariableExpression('user.name|lower|default:"Guest"');
+  assert.strictEqual(res.varPath, 'user.name');
+  assert.strictEqual(res.filters.length, 2);
+  assert.strictEqual(res.filters[0].name, 'lower');
+  assert.strictEqual(res.filters[0].arg, null);
+  assert.strictEqual(res.filters[1].name, 'default');
+  assert.strictEqual(res.filters[1].arg.type, 'literal');
+  assert.strictEqual(res.filters[1].arg.value, 'Guest');
+});
+test('Context - basic dotted lookups', () => {
+  const ctx = new Context({
+    user: {
+      profile: {
+        name: 'Miki',
+        age: 30
+      }
+    },
+    items: ['apple', 'banana']
+  });
+  assert.strictEqual(ctx.get('user.profile.name'), 'Miki');
+  assert.strictEqual(ctx.get('user.profile.age'), 30);
+  assert.strictEqual(ctx.get('items.1'), 'banana');
+  // Missing key now returns undefined (so filters like default_if_none
+  // can detect missing values) instead of empty string.
+  assert.strictEqual(ctx.get('user.profile.missing'), undefined);
+});
+test('Context - scope pushing and popping', () => {
+  const ctx = new Context({ name: 'Global' });
+  ctx.push({ name: 'Local', age: 25 });
+  assert.strictEqual(ctx.get('name'), 'Local');
+  assert.strictEqual(ctx.get('age'), 25);
+  ctx.pop();
+  assert.strictEqual(ctx.get('name'), 'Global');
+  assert.strictEqual(ctx.get('age'), undefined);
+});
+test('Context - automatic function calling', () => {
+  const ctx = new Context({
+    user: {
+      getName: () => 'Dynamic Name'
+    }
+  });
+  assert.strictEqual(ctx.get('user.getName'), 'Dynamic Name');
+});

package/tests/partial.html CHANGED Viewed

	@@ -1 +1 @@
1	- <p>Included: {{ item }}</p>
1	+ <p>Included: {{ item }}</p>

package/tests/partialdef.test.js CHANGED Viewed

@@ -1,79 +1,79 @@
-// tests for partialdef support, including conditionals, loops, and inline rendering
-const test = require('node:test');
-const assert = require('node:assert');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const { render, compile, renderPartialFromSource } = require('../src/index');
-// Basic partialdef rendering via {% partial %}
-test('Partialdef basic rendering', () => {
-  const tpl = `{% partialdef greeting %}Hello {{ name }}{% endpartialdef %}{% partial greeting %}`;
-  const out = render(tpl, { name: 'Miki' });
-  assert.strictEqual(out, 'Hello Miki');
-});
-// Partialdef with conditional logic
-test('Partialdef with if/else', () => {
-  const tpl = `{% partialdef cond %}{% if show %}Visible{% else %}Hidden{% endif %}{% endpartialdef %}{% partial cond %}`;
-  assert.strictEqual(render(tpl, { show: true }), 'Visible');
-  assert.strictEqual(render(tpl, { show: false }), 'Hidden');
-});
-// Partialdef with loop and metadata
-test('Partialdef with for loop', () => {
-  const tpl = `{% partialdef list %}{% for item in items %}{{ item }},{% empty %}none{% endfor %}{% endpartialdef %}{% partial list %}`;
-  assert.strictEqual(render(tpl, { items: ['a', 'b'] }), 'a,b,');
-  assert.strictEqual(render(tpl, { items: [] }), 'none');
-});
-// Inline partialdef (renders immediately)
-test('Inline partialdef renders inline', () => {
-  const tpl = `{% partialdef inline_example inline %}Inline {{ val }}{% endpartialdef %}`;
-  const out = render(tpl, { val: 'X' });
-  assert.strictEqual(out, 'Inline X');
-});
-// Rendering a partial via compile.renderPartial API
-test('renderPartial API works', () => {
-  const tpl = `{% partialdef api %}API {{ data }}{% endpartialdef %}`;
-  const compiled = compile(tpl);
-  const out = compiled.renderPartial('api', { data: 123 });
-  assert.strictEqual(out, 'API 123');
-});
-// Bug fix: partials defined inside for loops are found by renderPartialFromSource
-test('renderPartialFromSource finds partials inside for loops', () => {
-  const tpl = `{% for item in items %}{% partialdef loop_item %}{{ item }}{% endpartialdef %}{% endfor %}`;
-  const out = renderPartialFromSource(tpl, 'loop_item', { item: 'X' });
-  assert.strictEqual(out, 'X');
-});
-// Bug fix: include with partial selector does not leak other partials from included file
-test('include with partial selector does not leak other partials', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'miki-partial-'));
-  fs.writeFileSync(path.join(dir, 'main.html'), `{% include "frag.html#only_me" %}`);
-  fs.writeFileSync(path.join(dir, 'frag.html'), `{% partialdef only_me %}ME{% endpartialdef %}{% partialdef secret %}SECRET{% endpartialdef %}`);
-  const mainTpl = fs.readFileSync(path.join(dir, 'main.html'), 'utf8');
-  assert.throws(
-    () => renderPartialFromSource(mainTpl, 'secret', {}, { views: dir }),
-    /Partial 'secret' not found/
-  );
-  fs.rmSync(dir, { recursive: true });
-});
-// Bug fix: full include makes all partials from included file available
-test('full include makes all included partials available', () => {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'miki-partial-full-'));
-  fs.writeFileSync(path.join(dir, 'main.html'), `{% include "frag.html" %}`);
-  fs.writeFileSync(path.join(dir, 'frag.html'), `{% partialdef only_me %}ME{% endpartialdef %}{% partialdef secret %}SECRET{% endpartialdef %}`);
-  const mainTpl = fs.readFileSync(path.join(dir, 'main.html'), 'utf8');
-  const out = renderPartialFromSource(mainTpl, 'secret', {}, { views: dir });
-  assert.strictEqual(out, 'SECRET');
-  fs.rmSync(dir, { recursive: true });
-});
+// tests for partialdef support, including conditionals, loops, and inline rendering
+const test = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const fs = require('fs');
+const os = require('os');
+const { render, compile, renderPartialFromSource } = require('../src/index');
+// Basic partialdef rendering via {% partial %}
+test('Partialdef basic rendering', () => {
+  const tpl = `{% partialdef greeting %}Hello {{ name }}{% endpartialdef %}{% partial greeting %}`;
+  const out = render(tpl, { name: 'Miki' });
+  assert.strictEqual(out, 'Hello Miki');
+});
+// Partialdef with conditional logic
+test('Partialdef with if/else', () => {
+  const tpl = `{% partialdef cond %}{% if show %}Visible{% else %}Hidden{% endif %}{% endpartialdef %}{% partial cond %}`;
+  assert.strictEqual(render(tpl, { show: true }), 'Visible');
+  assert.strictEqual(render(tpl, { show: false }), 'Hidden');
+});
+// Partialdef with loop and metadata
+test('Partialdef with for loop', () => {
+  const tpl = `{% partialdef list %}{% for item in items %}{{ item }},{% empty %}none{% endfor %}{% endpartialdef %}{% partial list %}`;
+  assert.strictEqual(render(tpl, { items: ['a', 'b'] }), 'a,b,');
+  assert.strictEqual(render(tpl, { items: [] }), 'none');
+});
+// Inline partialdef (renders immediately)
+test('Inline partialdef renders inline', () => {
+  const tpl = `{% partialdef inline_example inline %}Inline {{ val }}{% endpartialdef %}`;
+  const out = render(tpl, { val: 'X' });
+  assert.strictEqual(out, 'Inline X');
+});
+// Rendering a partial via compile.renderPartial API
+test('renderPartial API works', () => {
+  const tpl = `{% partialdef api %}API {{ data }}{% endpartialdef %}`;
+  const compiled = compile(tpl);
+  const out = compiled.renderPartial('api', { data: 123 });
+  assert.strictEqual(out, 'API 123');
+});
+// Bug fix: partials defined inside for loops are found by renderPartialFromSource
+test('renderPartialFromSource finds partials inside for loops', () => {
+  const tpl = `{% for item in items %}{% partialdef loop_item %}{{ item }}{% endpartialdef %}{% endfor %}`;
+  const out = renderPartialFromSource(tpl, 'loop_item', { item: 'X' });
+  assert.strictEqual(out, 'X');
+});
+// Bug fix: include with partial selector does not leak other partials from included file
+test('include with partial selector does not leak other partials', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'miki-partial-'));
+  fs.writeFileSync(path.join(dir, 'main.html'), `{% include "frag.html#only_me" %}`);
+  fs.writeFileSync(path.join(dir, 'frag.html'), `{% partialdef only_me %}ME{% endpartialdef %}{% partialdef secret %}SECRET{% endpartialdef %}`);
+  const mainTpl = fs.readFileSync(path.join(dir, 'main.html'), 'utf8');
+  assert.throws(
+    () => renderPartialFromSource(mainTpl, 'secret', {}, { views: dir }),
+    /Partial 'secret' not found/
+  );
+  fs.rmSync(dir, { recursive: true });
+});
+// Bug fix: full include makes all partials from included file available
+test('full include makes all included partials available', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'miki-partial-full-'));
+  fs.writeFileSync(path.join(dir, 'main.html'), `{% include "frag.html" %}`);
+  fs.writeFileSync(path.join(dir, 'frag.html'), `{% partialdef only_me %}ME{% endpartialdef %}{% partialdef secret %}SECRET{% endpartialdef %}`);
+  const mainTpl = fs.readFileSync(path.join(dir, 'main.html'), 'utf8');
+  const out = renderPartialFromSource(mainTpl, 'secret', {}, { views: dir });
+  assert.strictEqual(out, 'SECRET');
+  fs.rmSync(dir, { recursive: true });
+});

package/tests/production_checks.js CHANGED Viewed

@@ -1,57 +1,57 @@
-// Production readiness checks
-const { render, compile } = require('../src/index');
-const checks = [];
-try {
-  render('{% if x %}hello', {});
-  checks.push('FAIL: should throw on unclosed if');
-} catch(e) {
-  checks.push('OK: unclosed if throws: ' + e.message.slice(0, 50));
-}
-try {
-  render('{{ x|nonexistent }}', { x: 'hi' });
-  checks.push('FAIL: should throw on unknown filter');
-} catch(e) {
-  checks.push('OK: unknown filter throws: ' + e.message.slice(0, 50));
-}
-try {
-  render('{% nonexistent_tag %}', {});
-  checks.push('FAIL: should throw on unknown tag');
-} catch(e) {
-  checks.push('OK: unknown tag throws: ' + e.message.slice(0, 50));
-}
-const xss = render('{{ x }}', { x: '<script>alert(1)</script>' });
-checks.push(xss.includes('&lt;script&gt;') ? 'OK: XSS auto-escaped' : 'FAIL: XSS not escaped');
-const safe = render('{{ x|safe }}', { x: '<b>bold</b>' });
-checks.push(safe === '<b>bold</b>' ? 'OK: safe filter works' : 'FAIL: safe: ' + safe);
-const c1 = compile('{% cycle a b c %}');
-const r1 = c1.render({});
-const r2 = c1.render({});
-checks.push(r1 !== r2 ? 'OK: cycle resets' : 'WARN: cycle state: ' + r1 + '/' + r2);
-try {
-  render('{{ x }}', { x: 'a'.repeat(100000) });
-  checks.push('OK: handles large input');
-} catch(e) {
-  checks.push('FAIL: large input: ' + e.message);
-}
-const nullTest = render('{{ x }}', { x: null });
-checks.push(nullTest === '' ? 'OK: null renders empty' : 'FAIL: null=' + nullTest);
-try {
-  render('{% extends "../etc/passwd" %}', {});
-  checks.push('FAIL: path traversal not blocked');
-} catch(e) {
-  checks.push('OK: path traversal blocked: ' + e.message.slice(0, 50));
-}
-const nested = render('{% for i in outer %}{% for j in i %}{{ forloop.parentloop.counter }}.{{ forloop.counter }} {% endfor %}{% endfor %}', { outer: [[1,2],[3,4]] });
-checks.push(nested.trim() === '1.1 1.2 2.1 2.2' ? 'OK: nested forloop' : 'WARN nested: ' + nested);
-console.log(checks.join('\n'));
+// Production readiness checks
+const { render, compile } = require('../src/index');
+const checks = [];
+try {
+  render('{% if x %}hello', {});
+  checks.push('FAIL: should throw on unclosed if');
+} catch(e) {
+  checks.push('OK: unclosed if throws: ' + e.message.slice(0, 50));
+}
+try {
+  render('{{ x|nonexistent }}', { x: 'hi' });
+  checks.push('FAIL: should throw on unknown filter');
+} catch(e) {
+  checks.push('OK: unknown filter throws: ' + e.message.slice(0, 50));
+}
+try {
+  render('{% nonexistent_tag %}', {});
+  checks.push('FAIL: should throw on unknown tag');
+} catch(e) {
+  checks.push('OK: unknown tag throws: ' + e.message.slice(0, 50));
+}
+const xss = render('{{ x }}', { x: '<script>alert(1)</script>' });
+checks.push(xss.includes('&lt;script&gt;') ? 'OK: XSS auto-escaped' : 'FAIL: XSS not escaped');
+const safe = render('{{ x|safe }}', { x: '<b>bold</b>' });
+checks.push(safe === '<b>bold</b>' ? 'OK: safe filter works' : 'FAIL: safe: ' + safe);
+const c1 = compile('{% cycle a b c %}');
+const r1 = c1.render({});
+const r2 = c1.render({});
+checks.push(r1 !== r2 ? 'OK: cycle resets' : 'WARN: cycle state: ' + r1 + '/' + r2);
+try {
+  render('{{ x }}', { x: 'a'.repeat(100000) });
+  checks.push('OK: handles large input');
+} catch(e) {
+  checks.push('FAIL: large input: ' + e.message);
+}
+const nullTest = render('{{ x }}', { x: null });
+checks.push(nullTest === '' ? 'OK: null renders empty' : 'FAIL: null=' + nullTest);
+try {
+  render('{% extends "../etc/passwd" %}', {});
+  checks.push('FAIL: path traversal not blocked');
+} catch(e) {
+  checks.push('OK: path traversal blocked: ' + e.message.slice(0, 50));
+}
+const nested = render('{% for i in outer %}{% for j in i %}{{ forloop.parentloop.counter }}.{{ forloop.counter }} {% endfor %}{% endfor %}', { outer: [[1,2],[3,4]] });
+checks.push(nested.trim() === '1.1 1.2 2.1 2.2' ? 'OK: nested forloop' : 'WARN nested: ' + nested);
+console.log(checks.join('\n'));

package/tests/security.test.js CHANGED Viewed

@@ -1,28 +1,28 @@
-const test = require('node:test');
-const assert = require('node:assert');
-const { render, markSafe } = require('../src/index');
-test('Security - HTML Auto-escaping enabled by default', () => {
-  const tpl = '{{ value }}';
-  const output = render(tpl, { value: '<script>alert("xss")</script>' });
-  assert.strictEqual(output, '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;');
-});
-test('Security - safe filter disables escaping', () => {
-  const tpl = '{{ value|safe }}';
-  const output = render(tpl, { value: '<b>Hello</b>' });
-  assert.strictEqual(output, '<b>Hello</b>');
-});
-test('Security - escape filter forces escaping', () => {
-  // In autoescape off mode, escape filter still escapes
-  const tpl = '{% autoescape off %}{{ value|escape }}{% endautoescape %}';
-  const output = render(tpl, { value: '<b>Hello</b>' });
-  assert.strictEqual(output, '&lt;b&gt;Hello&lt;/b&gt;');
-});
-test('Security - markSafe variables bypassed', () => {
-  const tpl = '{{ value }}';
-  const output = render(tpl, { value: markSafe('<h1>Title</h1>') });
-  assert.strictEqual(output, '<h1>Title</h1>');
-});
+const test = require('node:test');
+const assert = require('node:assert');
+const { render, markSafe } = require('../src/index');
+test('Security - HTML Auto-escaping enabled by default', () => {
+  const tpl = '{{ value }}';
+  const output = render(tpl, { value: '<script>alert("xss")</script>' });
+  assert.strictEqual(output, '&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;');
+});
+test('Security - safe filter disables escaping', () => {
+  const tpl = '{{ value|safe }}';
+  const output = render(tpl, { value: '<b>Hello</b>' });
+  assert.strictEqual(output, '<b>Hello</b>');
+});
+test('Security - escape filter forces escaping', () => {
+  // In autoescape off mode, escape filter still escapes
+  const tpl = '{% autoescape off %}{{ value|escape }}{% endautoescape %}';
+  const output = render(tpl, { value: '<b>Hello</b>' });
+  assert.strictEqual(output, '&lt;b&gt;Hello&lt;/b&gt;');
+});
+test('Security - markSafe variables bypassed', () => {
+  const tpl = '{{ value }}';
+  const output = render(tpl, { value: markSafe('<h1>Title</h1>') });
+  assert.strictEqual(output, '<h1>Title</h1>');
+});