TagScript

A sandboxed template language for text your users write.

TagScript is for the case where the person writing the template is not the person who wrote the app. A Discord server admin building a custom command. A user customising their profile. A support team editing an auto-reply.

You cannot hand those people a JavaScript template literal, Handlebars or EJS, because all three assume the template author is trusted. TagScript assumes the opposite.

import { Interpreter, RandomParser } from 'tagscript';

const ts = new Interpreter(new RandomParser());

(await ts.run('{random:heads,tails}')).body; // 'tails'
(await ts.run('{if(1==1):yes|no}')).body; // '{if(1==1):yes|no}', no IfStatementParser registered

There is no host object to reach, no prototype to walk, no require to find. An unknown tag is not an error and not a crash. It stays in the output as literal text.

What that buys you

A capability allowlist. The interpreter has no built-in tags. new Interpreter() renders plain text and nothing else, so what a template can do is exactly the list of parsers you passed in.

Templates ask, they never do. A template cannot send a message, delete a message or set a cooldown. It records a request on response.actions, and your code reads that object and decides. The Discord plugin is built entirely on this.

Bounded work. charLimit caps how much output one render may produce, so nobody hands you a template that expands forever.

Data you choose to expose. Values reach a template through transformers, which answer with a fixed set of keys and never the object underneath.

Install

npm install tagscript

Start here

Which page you want depends on which side of the template you are on.

Buy me some doughnuts

If you want to support me by donating, you can do so by using any of the following methods. Thank you very much in advance!

Contributors

Thanks goes to these wonderful people: