// engine.js
 
const TAG_RE = /\{\{(.*?)\}\}/gs;
 
function tokenize(template) {
  const tokens = [];
  let pos = 0;
  let match;
 
  TAG_RE.lastIndex = 0; // never trust a shared /g regex's lastIndex
 
  while ((match = TAG_RE.exec(template)) !== null) {
    if (match.index > pos) {
      tokens.push({ type: 'TEXT', value: template.slice(pos, match.index) });
    }
    tokens.push(classifyTag(match[1].trim()));
    pos = TAG_RE.lastIndex;
  }
 
  if (pos < template.length) {
    tokens.push({ type: 'TEXT', value: template.slice(pos) });
  }
 
  return tokens;
}
 
// A path is a dot-separated chain of keys. These characters make a tag either
// malformed or ambiguous, and every one of them used to render silently as ''.
// This is a syntax check for error quality, not a security boundary — the
// security boundary is JSON.stringify in the code generator.
const INVALID_IN_PATH = /[{}()[\]"'`;,\\/#\s]/;
 
function checkPath(raw, tag) {
  if (raw === '') throw new SyntaxError('Empty tag: {{}}');
  if (INVALID_IN_PATH.test(raw)) {
    const hint = raw.startsWith('{')
      ? " — there is no {{{triple-stash}}} here; use {{& path }} for raw output"
      : '';
    throw new SyntaxError(`Invalid path in ${tag}: ${JSON.stringify(raw)}${hint}`);
  }
  return raw;
}
 
function classifyTag(raw) {
  if (raw.startsWith('#if '))   return { type: 'IF_OPEN',   expr: checkPath(raw.slice(4).trim(), '{{#if}}') };
  if (raw.startsWith('#each ')) return { type: 'EACH_OPEN', expr: checkPath(raw.slice(6).trim(), '{{#each}}') };
  if (raw === '/if')            return { type: 'IF_CLOSE' };
  if (raw === '/each')          return { type: 'EACH_CLOSE' };
  // {{else}} would otherwise be an ordinary lookup for a key called 'else':
  // undefined, rendered as ''. Both branches of the if would then emit.
  if (raw === 'else' || raw === '#else' || raw === '/else') {
    throw new SyntaxError('{{else}} is not supported by this engine — see "What We Skipped"');
  }
  if (raw.startsWith('>'))     return { type: 'PARTIAL',   name: raw.slice(1).trim() };
  if (raw.startsWith('!'))     return { type: 'COMMENT' };
  if (raw.startsWith('&'))     return { type: 'EXPR', path: checkPath(raw.slice(1).trim(), '{{& }}'), escape: false };
  return                              { type: 'EXPR', path: checkPath(raw, '{{ }}'), escape: true };
}

const engine = new TemplateEngine();
try { engine.render('aaaa{{ ok }}bbbb{{ {bad }}', { ok: 'X' }); } catch {}
engine.render('Hi {{name}}!', { name: 'Al' });
// with    TAG_RE.lastIndex = 0 → 'Hi Al!'
// without TAG_RE.lastIndex = 0 → 'Hi {{name}}!'

function parse(tokens) {
  let pos = 0;
 
  function parseNodes(closeType) {
    const nodes = [];
    while (pos < tokens.length) {
      const tok = tokens[pos];
      if (tok.type === closeType) {
        pos++; // consume the closing tag
        return nodes;
      }
      nodes.push(parseNode());
    }
    if (closeType) throw new Error(`Unclosed block — expected ${closeType}`);
    return nodes;
  }
 
  function parseNode() {
    const tok = tokens[pos++];
    switch (tok.type) {
      case 'TEXT':      return { type: 'Text',    value: tok.value };
      case 'EXPR':      return { type: 'Expr',    path: tok.path, escape: tok.escape };
      case 'COMMENT':   return { type: 'Comment' };
      case 'PARTIAL':   return { type: 'Partial', name: tok.name };
      case 'IF_OPEN':   return { type: 'If',   cond: tok.expr, body: parseNodes('IF_CLOSE') };
      case 'EACH_OPEN': return { type: 'Each', iter: tok.expr, body: parseNodes('EACH_CLOSE') };
      default: throw new Error(`Unexpected token: ${tok.type}`);
    }
  }
 
  return parseNodes(null);
}

// Inside an #each block the current item is stashed on the context object
// under this symbol, so `{{ . }}` can find it without colliding with a
// real data key called '.'.
const CURRENT = Symbol('current');
 
// Path segments that would let a template walk out of the data and into the
// prototype chain — `{{ constructor.constructor }}` reaches Function.
const BLOCKED = new Set(['__proto__', 'constructor', 'prototype']);
 
// `in` throws on a primitive, and the whole point of CURRENT is to make
// {{ . }} work for primitives. Test for an object before using it.
const isObject = (v) => v !== null && (typeof v === 'object' || typeof v === 'function');
 
// Resolves dot-notation paths against a data context.
// 'user.address.city' → data.user.address.city
function resolve(data, path) {
  if (path === '.' || path === 'this') {
    return isObject(data) && CURRENT in data ? data[CURRENT] : data;
  }
  if (path.startsWith('@')) return data?.[path]; // loop variables: @index, @first, @last
 
  const parts = path.split('.');
  let val = data;
  for (const part of parts) {
    if (val == null) return undefined;
    if (BLOCKED.has(part)) return undefined;
    val = val[part];
  }
  return val;
}
 
// #each only means anything over a list. Fail with a message that names the
// tag instead of "(intermediate value).forEach is not a function".
function toList(value, iterName) {
  if (value == null) return [];
  if (Array.isArray(value)) return value;
  // A string IS iterable, so the check below would happily walk it one
  // character at a time. That is never what {{#each}} means.
  if (typeof value === 'string') {
    throw new TypeError(
      `{{#each ${iterName}}} got a string. Iterating a string character by ` +
      `character is almost certainly not what you meant — wrap it in an array if it is.`
    );
  }
  if (typeof value[Symbol.iterator] === 'function') return Array.from(value);
  throw new TypeError(
    `{{#each ${iterName}}} expects an array or iterable, got ${typeof value}`
  );
}
 
// Escapes HTML to prevent XSS. Every {{ expr }} passes through this.
const ESCAPE_MAP = { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' };
 
function escape(val) {
  if (val == null) return '';
  return String(val).replace(/[&<>"']/g, (c) => ESCAPE_MAP[c]);
}

<p>&lt;script&gt;alert(1)&lt;/script&gt;</p>

function generateCode(ast) {
  const lines = ['let __out = "";'];
 
  function emit(nodes) {
    for (const node of nodes) {
      switch (node.type) {
 
        case 'Text':
          lines.push(`__out += ${JSON.stringify(node.value)};`);
          break;
 
        case 'Comment':
          break; // discard
 
        case 'Expr': {
          const val = `__resolve(__data, ${JSON.stringify(node.path)})`;
          lines.push(`__out += ${node.escape ? `__escape(${val})` : `(${val} ?? '')`};`);
          break;
        }
 
        case 'Partial':
          lines.push(`__out += __partial(${JSON.stringify(node.name)}, __data);`);
          break;
 
        case 'If':
          lines.push(`if (__resolve(__data, ${JSON.stringify(node.cond)})) {`);
          emit(node.body);
          lines.push('}');
          break;
 
        case 'Each': {
          const iter = JSON.stringify(node.iter);
          // __parent has to be captured *outside* the callback — see below.
          lines.push(`{ const __parent = __data;`);
          lines.push(
            `__toList(__resolve(__parent, ${iter}), ${iter})` +
            `.forEach(function(__item, __i, __arr) {`
          );
          lines.push(
            `  const __data = Object.assign({}, __parent,` +
            ` { '@index': __i, '@first': __i === 0,` +
            ` '@last': __i === __arr.length - 1 },` +
            ` __item !== null && typeof __item === 'object' ? __item : {});`
          );
          lines.push(`  __data[__CURRENT] = __item;`);
          emit(node.body);
          lines.push('}); }');
          break;
        }
      }
    }
  }
 
  emit(ast);
  lines.push('return __out;');
  return lines.join('\n');
}

let __out = "";
{ const __parent = __data;
__toList(__resolve(__parent, "users"), "users").forEach(function(__item, __i, __arr) {
  const __data = Object.assign({}, __parent, { '@index': __i, '@first': __i === 0, '@last': __i === __arr.length - 1 }, __item !== null && typeof __item === 'object' ? __item : {});
  __data[__CURRENT] = __item;
__out += __escape(__resolve(__data, "name"));
}); }
return __out;

// generateCode, with JSON.stringify(node.path) replaced by "${node.path}"
new TemplateEngine().render('{{ x"), globalThis.PWNED = 1, ("y }}', {});
// globalThis.PWNED === 1

class TemplateEngine {
  #cache = new Map();
  #partials = new Map();
 
  registerPartial(name, template) {
    this.#partials.set(name, template);
    return this; // chainable
  }
 
  compile(template) {
    if (this.#cache.has(template)) return this.#cache.get(template);
 
    const tokens = tokenize(template);
    const ast    = parse(tokens);
    const code   = generateCode(ast);
 
    // new Function creates a function from a string.
    // Arguments: parameter names, then the function body.
    const compiled = new Function(
      '__data', '__resolve', '__escape', '__partial', '__toList', '__CURRENT', code);
 
    const self = this;
    const renderFn = (data) =>
      compiled(
        data,
        resolve,
        escape,
        (name, ctx) => {
          // Silently rendering '' for an unregistered partial hides typos
          // for as long as the template lives.
          if (!self.#partials.has(name)) throw new Error(`Unknown partial: ${name}`);
          return self.render(self.#partials.get(name), ctx);
        },
        toList,
        CURRENT
      );
 
    this.#cache.set(template, renderFn);
    return renderFn;
  }
 
  render(template, data = {}) {
    return this.compile(template)(data);
  }
}

// demo.js
 
const engine = new TemplateEngine();
 
engine.registerPartial('user-card', `
<div class="card">
  <strong>{{ name }}</strong>
  <span>{{ role }}</span>
</div>`);
 
const template = `
<section>
  {{! This comment won't appear in the output }}
 
  {{#each members}}
  <div class="row">
    {{> user-card}}
    {{#if @first}}<span class="badge">First!</span>{{/if}}
    <small>Item {{ @index }} of {{ total }}</small>
  </div>
  {{/each}}
 
  {{#if hasFooter}}
  <footer>{{ footer }}</footer>
  {{/if}}
</section>`;
 
const html = engine.render(template, {
  members: [
    { name: 'Alice', role: 'Admin' },
    { name: 'Bob',   role: 'Member' },
  ],
  total: 2,
  hasFooter: true,
  footer: '<b>Built with our engine</b>',
});
 
console.log(html);

// engine-tests.js
const { TemplateEngine, generateCode } = require('./engine');
 
// console.assert() logs and continues in Node — a broken engine would still
// reach the "all passed" line. Throw.
const assert = (cond, msg) => { if (!cond) throw new Error('FAILED: ' + msg); };
const eq = (actual, expected, msg) =>
  assert(actual === expected, `${msg} — expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
const e = () => new TemplateEngine();
 
// interpolation and paths
eq(e().render('Hi {{name}}!', { name: 'Al' }), 'Hi Al!', 'simple interpolation');
eq(e().render('{{user.address.city}}', { user: { address: { city: 'Pune' } } }), 'Pune', 'nested path');
eq(e().render('[{{nope}}]', {}), '[]', 'missing key renders empty');
eq(e().render('[{{a.b.c.d}}]', {}), '[]', 'deep miss does not throw');
eq(e().render('[{{v}}]', { v: null }), '[]', 'null renders empty');
eq(e().render('[{{v}}]', { v: 0 }), '[0]', 'zero is not falsy-blanked');
 
// escaping
eq(e().render('{{x}}', { x: `<a href="x">&'` }), '&lt;a href=&quot;x&quot;&gt;&amp;&#39;', 'all five characters');
eq(e().render('<p>{{name}}</p>', { name: '<script>alert(1)</script>' }),
   '<p>&lt;script&gt;alert(1)&lt;/script&gt;</p>', 'script payload is inert');
eq(e().render('{{& x}}', { x: '<b>hi</b>' }), '<b>hi</b>', 'the & prefix opts out');
eq(e().render('[{{constructor.name}}]', {}), '[]', 'no walking the prototype chain');
 
// conditionals and loops
eq(e().render('{{#if a}}Y{{/if}}', { a: 1 }), 'Y', 'if true');
eq(e().render('{{#if a}}Y{{/if}}', { a: 0 }), '', 'if false');
eq(e().render('{{#each xs}}[{{.}}]{{/each}}', { xs: [1, 2] }), '[1][2]', '{{.}} over primitives');
eq(e().render('{{#each xs}}{{@index}}{{#if @last}}!{{/if}}{{/each}}', { xs: ['a', 'b'] }), '01!', 'loop variables');
eq(e().render('{{#each xs}}{{@index}}/{{total}} {{/each}}', { xs: ['a', 'b'], total: 2 }),
   '0/2 1/2 ', 'parent scope is visible inside a loop');
eq(e().render('{{#each rows}}{{#each cells}}{{.}}{{/each}}|{{/each}}',
   { rows: [{ cells: [1, 2] }, { cells: [3] }] }), '12|3|', 'nested loops');
eq(e().render('{{#each nope}}x{{/each}}', {}), '', 'each over undefined is empty, not a crash');
 
// errors that should be errors
const throws = (fn, re, msg) => {
  try { fn(); } catch (err) { assert(re.test(err.message), `${msg} — wrong message: ${err.message}`); return; }
  throw new Error('FAILED: expected a throw — ' + msg);
};
throws(() => e().render('{{#if a}}Y', {}), /Unclosed block/, 'unclosed if');
throws(() => e().render('a{{/if}}', {}), /Unexpected token/, 'stray close tag');
throws(() => e().render('{{#each o}}x{{/each}}', { o: { a: 1 } }), /expects an array/, 'each over an object');
throws(() => e().render('{{> nope}}', {}), /Unknown partial/, 'unregistered partial');
 
// {{.}} and {{this}} against a primitive root context — the reason CURRENT exists
eq(e().render('{{.}}', 'hello'), 'hello', '{{.}} with a primitive root context');
eq(e().render('{{this}}', 'hi'), 'hi', '{{this}} with a primitive root context');
eq(e().render('{{.}}', 42), '42', '{{.}} with a number root context');
eq(e().render('{{.}}', '<b>'), '&lt;b&gt;', '{{.}} is still escaped');
eq(e().render('[{{.}}]', null), '[]', '{{.}} with a null context');
 
// Syntax this engine does not have must say so, not render something
throws(() => e().render('{{{x}}}', { x: 'v' }), /no \{\{\{triple-stash\}\}\}/, 'triple-stash is rejected');
throws(() => e().render('{{#if a}}Y{{else}}N{{/if}}', { a: 1 }), /\{\{else\}\} is not supported/, '{{else}} is rejected');
throws(() => e().render('{{#else}}', {}), /\{\{else\}\} is not supported/, '{{#else}} is rejected too');
throws(() => e().render('a{{/foo}}', {}), /Invalid path/, 'an unknown close tag is rejected');
throws(() => e().render('{{}}', {}), /Empty tag/, 'an empty tag is rejected');
throws(() => e().render('{{#each s}}x{{/each}}', { s: 'abc' }), /got a string/, 'each over a string is rejected');
eq(e().render('{{#each s}}[{{.}}]{{/each}}', { s: new Set([1, 2]) }), '[1][2]', 'each over a non-array iterable still works');
eq(e().render('{{data-id}}', { 'data-id': 7 }), '7', 'an unusual but harmless key still resolves');
 
// A tokenizer throw must not poison the shared regex's lastIndex
{
  const engine = new TemplateEngine();
  try { engine.render('aaaa{{ ok }}bbbb{{ {bad }}', { ok: 'X' }); } catch { /* expected */ }
  eq(engine.render('Hi {{name}}!', { name: 'Al' }), 'Hi Al!',
     'a throw mid-tokenize does not make the next template skip its first tag');
}
 
// The code generator must quote everything it embeds — including for an AST
// that did not come from tokenize(). This is the actual security boundary, and
// it needs testing on its own: checkPath would refuse these templates upstream.
{
  const evil = 'x"), globalThis.PWNED = 1, ("y';
  const run = (ast) => {
    const paths = [];
    const fn = new Function('__data', '__resolve', '__escape', '__partial', '__toList', '__CURRENT',
                            generateCode(ast));
    delete globalThis.PWNED;
    const out = fn({}, (d, p) => { paths.push(p); return undefined; }, (v) => (v ?? ''),
                   (n) => { paths.push(n); return ''; }, () => [], Symbol('c'));
    return { out, paths, pwned: globalThis.PWNED };
  };
 
  const expr = run([{ type: 'Expr', path: evil, escape: true }]);
  eq(expr.paths.length, 1, 'codegen: an Expr path produces exactly one lookup');
  eq(expr.paths[0], evil, 'codegen: the path arrives at __resolve as one literal string');
  assert(expr.pwned === undefined, 'codegen: nothing inside an Expr path executes');
 
  const text = run([{ type: 'Text', value: '";globalThis.PWNED=1;__out+="' }]);
  eq(text.out, '";globalThis.PWNED=1;__out+="', 'codegen: Text is emitted as a literal');
  assert(text.pwned === undefined, 'codegen: nothing inside a Text node executes');
 
  const cond = run([{ type: 'If', cond: evil, body: [] }]);
  eq(cond.paths[0], evil, 'codegen: an If condition is a literal path too');
  assert(cond.pwned === undefined, 'codegen: nothing inside an If condition executes');
 
  const each = run([{ type: 'Each', iter: evil, body: [] }]);
  eq(each.paths[0], evil, 'codegen: an Each iterable is a literal path too');
  assert(each.pwned === undefined, 'codegen: nothing inside an Each iterable executes');
 
  const partial = run([{ type: 'Partial', name: evil }]);
  eq(partial.paths[0], evil, 'codegen: a Partial name is a literal too');
  assert(partial.pwned === undefined, 'codegen: nothing inside a Partial name executes');
}
 
// caching
{
  const engine = new TemplateEngine();
  assert(engine.compile('{{a}}') === engine.compile('{{a}}'), 'same string → same compiled function');
}
 
// The canary. If assert() ever stops throwing, everything above is decoration.
let harnessWorks = false;
try { assert(false, 'canary'); } catch { harnessWorks = true; }
assert(harnessWorks, 'assert() does not throw');
 
console.log('All assertions passed.');

const { tokenize, parse, generateCode } = require('./engine');
 
const tpl = `Hello {{ name }}!`;
const code = generateCode(parse(tokenize(tpl)));
console.log(code);
// let __out = "";
// __out += "Hello ";
// __out += __escape(__resolve(__data, "name"));
// __out += "!";
// return __out;