tina4ruby 3.13.149 → 3.13.151

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '08653f37ab3b3baf01b6103f97ec3893f910fbaf5a50b4b34a5521c872e9a225'
-  data.tar.gz: 2df60c055ca63a7957f79da033add45a12e3418f1e5890a3a986c254a8f4f6ec
+  metadata.gz: 2628729439684b6bb6c01c45a812c8e2e811bc8ad3da8848d4213311d3ecffa2
+  data.tar.gz: 78842ef5d13e8fd555baec8b1f25321390060d2be22fab7948de599a8c204fa4
 SHA512:
-  metadata.gz: dafb902ac5f0b385862acf78fbc1ded074233082a98d7dac462f095fb82fc4043a0ff5369eb9a7dbcd0c4662daab0c00b34a1c1647bcb6f29332a7d4882bbc30
-  data.tar.gz: 2408c4a0f724372a555efb9a39d3dd30b4334476109e257e4eb301d38db666f27f932bcd6b278c0087e3080f109042924236b550c6fafb6d8763b0db9e9c505d
+  metadata.gz: c036143a0e8fc8206c6091e93d0a5f9d5e9af59f721afb5e33ebd48a86ba4a124b39fa8540ed8a0403e3474941484ad767152ad91775997289685e0c4c2cee7d
+  data.tar.gz: b61e7f1708946b5a9b3528a7b9cf1244bb0c9c064bd84661c76075b8f56c9ccf63f17f2b5733ee7514a0412a6c3b9387dab64ad01635c5c65cfccbeed9683072

data/CHANGELOG.md

@@ -6,6 +6,32 @@ number means the same thing everywhere.
 **The authoritative release notes for every shipped version live in the documentation:**
 https://tina4.com/ruby/36-releases
 
+## 3.13.151 - 2026-10-15
+
+### Security
+- Cross-Origin-Opener-Policy joins the default security-header set (`TINA4_COOP`,
+  default `same-origin-allow-popups`). It pairs with a COEP header to unlock
+  `SharedArrayBuffer` and WASM threads in the browser.
+- S3 storage is a zero-dependency SigV4 client (no aws-sdk-s3). It now fails loud on
+  a missing credential, retries 429/5xx and dropped connections with capped backoff,
+  honours `Retry-After`, and keeps the endpoint path prefix.
+- MongoDB keeps bound values out of the parsed SQL text.
+- CRUD attributes are de-raw'd, the 302 redirect is guarded, CodeQL core findings
+  are cleared, and uploaded files are created owner-only (0600).
+
+### Docs
+- The README built-in feature count is corrected (55 -> 140).
+
+## 3.13.150 — 2026-10-11
+
+### Dev admin
+- The dashboard AI talks to the `tina4 ai serve` gateway on :11435, not a model
+  directly; `/__dev/split` serves the shared split-preview asset; the scaffold
+  panel is data-driven from the CLI generators; and the Code Landscape metrics
+  bubbles are free to spread (zoom-out + Fit frame the layout, was crammed into
+  the viewport). The dashboard metrics scan passes `--no-history` so it stops
+  self-reloading. Shipped in the shared SPA bundle.
+
 ## 3.13.149 — 2026-10-10
 
 ### CRUD

data/lib/tina4/auth.rb

@@ -466,7 +466,7 @@ module Tina4
       # is now honoured here too (explicit > env > HS256).
       def authenticate_request(headers, secret: nil, algorithm: nil)
         auth_header = headers["HTTP_AUTHORIZATION"] || headers["Authorization"] || ""
-        return nil unless auth_header =~ /\ABearer\s+(.+)\z/i
+        return nil unless auth_header =~ /\ABearer\s++(.+)\z/i
 
         token = Regexp.last_match(1)
 
@@ -518,7 +518,7 @@ module Tina4
       def bearer_auth
         lambda do |env|
           auth_header = env["HTTP_AUTHORIZATION"] || ""
-          return false unless auth_header =~ /\ABearer\s+(.+)\z/i
+          return false unless auth_header =~ /\ABearer\s++(.+)\z/i
 
           token = Regexp.last_match(1)
 
@@ -664,7 +664,7 @@ module Tina4
         auth_header = env["HTTP_AUTHORIZATION"] || ""
         return true if auth_header.empty?
 
-        if auth_header =~ /\ABearer\s+(.+)\z/i
+        if auth_header =~ /\ABearer\s++(.+)\z/i
           valid_token(Regexp.last_match(1))
         else
           false

data/lib/tina4/cli.rb

@@ -457,7 +457,7 @@ module Tina4
     # per-instance to_snake_case when only the class name is known.
     def self.to_snake_case_static(name)
       s = name.to_s
-      s.gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2')
+      s.gsub(/([A-Z])(?=[A-Z][a-z])/, '\1_')
        .gsub(/([a-z\d])([A-Z])/, '\1_\2')
        .downcase
     end

data/lib/tina4/crud.rb

@@ -112,7 +112,7 @@ module Tina4
         verb = method.to_s.upcase
         Tina4::Template.render("crud/form.twig", {
           "wrap" => true,
-          "form_id_attr" => "",
+          "form_id" => "",
           "action" => h(action),
           "form_method" => h(verb),
           "method_override" => (%w[PUT PATCH DELETE].include?(verb) ? verb : nil),
@@ -204,14 +204,14 @@ module Tina4
             "value" => "",
             "placeholder" => h("Enter #{label.downcase}"),
             "type" => "text",
-            "required_attr" => "",
+            "required" => false,
             "input" => true
           }
         end
 
         Tina4::Template.render("crud/form.twig", {
           "wrap" => true,
-          "form_id_attr" => " id=\"form-#{mode}\"",
+          "form_id" => "form-#{mode}",
           "action" => "",
           "form_method" => "POST",
           "method_override" => nil,
@@ -263,7 +263,7 @@ module Tina4
           "readonly" => !editable,
           "inline_script" => inline_script,
           "table_name" => h(table_name),
-          "table_id_attr" => (table_id ? " id=\"#{h(table_id)}\"" : "")
+          "table_id" => (table_id ? table_id.to_s : "")
         }
       end
 
@@ -309,7 +309,7 @@ module Tina4
         name     = field[:name].to_s
         label    = field[:label] || name.capitalize
         value    = field[:value]
-        required = field[:required] ? " required" : ""
+        required = field[:required] ? true : false
 
         base = {
           "id" => h(name),
@@ -317,14 +317,14 @@ module Tina4
           "label" => h(label.to_s),
           "value" => h(value.to_s),
           "placeholder" => "",
-          "required_attr" => required
+          "required" => required
         }
 
         case (field[:type] || :string).to_sym
         when :text
           base.merge("textarea" => true)
         when :boolean
-          base.merge("checkbox" => true, "checked_attr" => (value ? " checked" : ""))
+          base.merge("checkbox" => true, "checked" => (value ? true : false))
         when :select
           base.merge("select" => true, "options_html" => build_options(field[:options], value))
         when :date

data/lib/tina4/dev_admin.rb

@@ -439,6 +439,8 @@ module Tina4
           serve_dashboard
         when ["GET", "/__dev/js/tina4-dev-admin.min.js"]
           serve_dev_js
+        when ["GET", "/__dev/split"], ["GET", "/__dev/split/"]
+          serve_split
         when ["GET", "/__dev/toolbar.css"]
           # tina4stack #115: the injected toolbar's stylesheet, served as an
           # external asset so the toolbar carries no inline style= and renders
@@ -934,6 +936,18 @@ module Tina4
         end
       end
 
+      # Detached split view — dashboard/editor LEFT, live app preview RIGHT.
+      # Served from the SHARED asset (the same tina4-dev-admin-split.html the
+      # python/php/node frameworks serve); a plain shell, no toolbar injected.
+      def serve_split
+        path = File.join(File.dirname(__FILE__), "public", "js", "tina4-dev-admin-split.html")
+        if File.file?(path)
+          [200, { "content-type" => "text/html; charset=utf-8" }, [File.read(path)]]
+        else
+          [404, { "content-type" => "text/plain" }, ["tina4-dev-admin-split.html not found"]]
+        end
+      end
+
       def status_payload
         db_table_count = 0
         begin

data/lib/tina4/drivers/mongodb_driver.rb

@@ -232,12 +232,26 @@ module Tina4
 
       # ── SQL-to-MongoDB translator ──────────────────────────────────────
 
+      # Fiber-local: the driver is shared across threads, the bound values are not.
+      BOUND_VALUES_KEY = :tina4_mongodb_bound_values
+
       def parse_sql(sql, params = [])
         sql_stripped = sql.strip
-        upper = sql_stripped.upcase
 
         # Bind positional ? params
-        bound_sql = bind_params(sql_stripped, params)
+        bound_sql, bound_values = bind_params(sql_stripped, params)
+
+        previous = Thread.current[BOUND_VALUES_KEY]
+        Thread.current[BOUND_VALUES_KEY] = bound_values
+        begin
+          parse_bound_sql(bound_sql)
+        ensure
+          Thread.current[BOUND_VALUES_KEY] = previous
+        end
+      end
+
+      def parse_bound_sql(bound_sql)
+        upper = bound_sql.upcase
 
         if upper.start_with?("SELECT")
           parse_select(bound_sql)
@@ -254,15 +268,34 @@ module Tina4
         end
       end
 
+      # Numbers, booleans and nil are written inline. Anything else is replaced
+      # by a quoted token with no quote, space, comma or keyword inside it, and the
+      # value is looked up again where literals are read (parse_value, LIKE).
+      # The parser splits the text on all of those, so a value pasted into it
+      # could otherwise change the statement it belongs to.
       def bind_params(sql, params)
-        return sql if params.nil? || params.empty?
+        bound_values = {}
+        return [sql, bound_values] if params.nil? || params.empty?
 
         idx = -1
-        sql.gsub("?") do
+        bound_sql = sql.gsub("?") do
           idx += 1
           v = params[idx]
-          v.is_a?(String) ? "'#{v.gsub("'", "\\\\'")}'" : v.to_s
+          case v
+          when Integer, Float, true, false, nil
+            v.to_s
+          else
+            token = "'\0#{bound_values.size}\0'"
+            bound_values[token] = v.to_s
+            token
+          end
         end
+        [bound_sql, bound_values]
+      end
+
+      def bound_value(literal)
+        bound_values = Thread.current[BOUND_VALUES_KEY]
+        bound_values && bound_values[literal]
       end
 
       # ── SELECT parsing ─────────────────────────────────────────────────
@@ -296,7 +329,7 @@ module Tina4
       end
 
       def parse_projection(sql)
-        m = sql.match(/^SELECT\s+(.*?)\s+FROM\b/im)
+        m = sql.match(/^SELECT\s++((?:(?!\s+FROM\b).)*+)\s+FROM\b/im)
         return {} unless m
 
         cols = m[1].strip
@@ -313,7 +346,7 @@ module Tina4
       end
 
       def parse_order_by(sql)
-        m = sql.match(/\bORDER\s+BY\s+(.*?)(?:\s+LIMIT|\s+OFFSET|\s*$)/im)
+        m = sql.match(/\bORDER\s+BY\s++((?:(?!\s+LIMIT\b|\s+OFFSET\b|\s*$).)*+)(?:\s+LIMIT|\s+OFFSET|\s*$)/im)
         return {} unless m
 
         sort = {}
@@ -440,13 +473,13 @@ module Tina4
 
         # LIKE → $regex
         if (m = clause.match(/^(\w+)\s+LIKE\s+'(.+)'$/i))
-          pattern = m[2].gsub("%", ".*").gsub("_", ".")
+          pattern = (bound_value("'#{m[2]}'") || m[2]).gsub("%", ".*").gsub("_", ".")
           return { m[1] => { "$regex" => pattern, "$options" => "i" } }
         end
 
         # NOT LIKE → $not $regex
         if (m = clause.match(/^(\w+)\s+NOT\s+LIKE\s+'(.+)'$/i))
-          pattern = m[2].gsub("%", ".*").gsub("_", ".")
+          pattern = (bound_value("'#{m[2]}'") || m[2]).gsub("%", ".*").gsub("_", ".")
           return { m[1] => { "$not" => /#{pattern}/i } }
         end
 
@@ -496,7 +529,9 @@ module Tina4
 
       def parse_value(str)
         str = str.strip
-        if str.start_with?("'") && str.end_with?("'")
+        if (value = bound_value(str))
+          value
+        elsif str.start_with?("'") && str.end_with?("'")
           str[1..-2]
         elsif str =~ /\A-?\d+\z/
           str.to_i
@@ -518,7 +553,7 @@ module Tina4
       def parse_insert(sql)
         result = { operation: :insert }
 
-        m = sql.match(/INSERT\s+INTO\s+(\w+)\s*\(([^)]+)\)\s*VALUES\s*\(([^)]+)\)/im)
+        m = sql.match(/INSERT\s+INTO\s+(\w+)\s*+\(([^)]+)\)\s*+VALUES\s*+\(([^)]+)\)/im)
         unless m
           result[:collection] = :unknown
           result[:document] = {}
@@ -564,7 +599,7 @@ module Tina4
       def parse_update(sql)
         result = { operation: :update }
 
-        m = sql.match(/UPDATE\s+(\w+)\s+SET\s+(.+?)(?:\s+WHERE\s+(.+))?$/im)
+        m = sql.match(/UPDATE\s+(\w+)\s+SET\s+((?:(?!\s+WHERE\b).)+)(?:\s+WHERE\s++(.+))?$/im)
         unless m
           raise ArgumentError, "MongodbDriver: cannot parse UPDATE statement: #{sql}"
         end
@@ -621,7 +656,7 @@ module Tina4
       def parse_delete(sql)
         result = { operation: :delete }
 
-        m = sql.match(/DELETE\s+FROM\s+(\w+)(?:\s+WHERE\s+(.+))?$/im)
+        m = sql.match(/DELETE\s+FROM\s+(\w++)(?:\s++WHERE\s++(.+))?$/im)
         unless m
           raise ArgumentError, "MongodbDriver: cannot parse DELETE statement: #{sql}"
         end

data/lib/tina4/drivers/mssql_driver.rb

@@ -222,7 +222,12 @@ module Tina4
 
       def parse_connection(str)
         # Format: mssql://user:pass@host:port/database
-        match = str.match(%r{(?:mssql|sqlserver)://(?:(\w+):([^@]+)@)?([^:/]+)(?::(\d+))?/(.+)})
+        # Possessive quantifiers (++): every quantified class is bounded by a
+        # delimiter it cannot itself match (\w++ by ':', [^@]++ by '@', [^:/]++
+        # by ':'/'/' , \d++ by ')'), so possessive changes nothing but what the
+        # engine tries on failure -- it kills the backtracking CodeQL flags as
+        # polynomial-redos without altering a single successful parse.
+        match = str.match(%r{(?:mssql|sqlserver)://(?:(\w++):([^@]++)@)?([^:/]++)(?::(\d++))?/(.+)})
         if match
           { username: match[1], password: match[2], host: match[3],
             port: match[4]&.to_i, database: match[5] }

data/lib/tina4/form_parser.rb

@@ -29,6 +29,15 @@ module Tina4
     # Rack's QueryParser param_depth_limit, kept for the same reason.
     PARAM_DEPTH_LIMIT = 32
 
+    # A lenient form with more fields than this is not nested at all, so a
+    # crafted body cannot turn each small field into a deep structure.
+    # Rack's QueryParser params_limit.
+    PARAMS_LIMIT = 4096
+
+    # A lenient field name longer than this (in bytes) keeps its flat key, so
+    # nesting never copies a huge name once per level.
+    NAME_LIMIT = 1024
+
     # A field name that is both a value and a container (`a=1` then `a[b]=2`)
     # or nests past PARAM_DEPTH_LIMIT. Rack raised here too.
     class ParameterError < StandardError; end
@@ -64,7 +73,6 @@ module Tina4
     #   as :error rather than raised, so one bad field name cannot lose the files.
     def parse_multipart(body, content_type)
       token = boundary(content_type)
-      fields = NestedParams.new
       files = {}
       return { fields: {}, files: files, error: nil } if token.nil? || body.nil? || body.empty?
 
@@ -89,12 +97,38 @@ module Tina4
       # the files were collected independently and survive it.
       error = nil
       begin
-        pairs.each { |name, value| normalize_params(fields, name, value, 0) }
+        fields = nest(pairs)
       rescue ParameterError => e
         error = e
-        fields = NestedParams.new
+        fields = {}
+      end
+      { fields: fields, files: files, error: error }
+    end
+
+    # Nest [name, value] pairs the way Rack nests a form: `tags[]` collects an
+    # array, `user[name]` builds a hash, a repeated plain name keeps its last
+    # value. Shared by multipart and urlencoded bodies, so one form arrives in
+    # the same shape whichever way it was sent. Strict (multipart) raises
+    # ParameterError on a name conflict or over-deep nesting. Lenient
+    # (urlencoded) keeps such a field - or one longer than NAME_LIMIT, or not
+    # valid UTF-8 - under its flat key and nests the rest, and nests nothing
+    # past PARAMS_LIMIT fields.
+    def nest(pairs, lenient: false)
+      return pairs.to_h if lenient && pairs.size > PARAMS_LIMIT
+
+      params = NestedParams.new
+      pairs.each do |name, value|
+        next params[name] = value if lenient && (name.bytesize > NAME_LIMIT || name.b.count("[") >= PARAM_DEPTH_LIMIT)
+
+        begin
+          normalize_params(params, name, value, 0)
+        rescue ParameterError, ArgumentError # ArgumentError: a name that is not valid UTF-8
+          raise unless lenient
+
+          params[name] = value
+        end
       end
-      { fields: to_plain_hash(fields), files: files, error: error }
+      to_plain_hash(params)
     end
 
     # Yield [headers, content] for every part. headers keys are lowercased.

data/lib/tina4/frond.rb

@@ -101,9 +101,10 @@ module Tina4
     FLOAT_RE        = /\A-?\d+\.\d+\z/
     ARRAY_LIT_RE    = /\A\[(.+)\]\z/m
     HASH_LIT_RE     = /\A\{(.+)\}\z/m
-    HASH_PAIR_RE    = /\A\s*(?:["']([^"']+)["']|(\w+))\s*:\s*(.+)\z/
-    RANGE_LIT_RE    = /\A(\d+)\.\.(\d+)\z/
-    ARITHMETIC_OPS  = [" + ", " - ", " * ", " // ", " / ", " % ", " ** "].freeze
+    HASH_PAIR_RE    = /\A\s*(?:["']([^"']+)["']|(\w+)|\((.+?)\))\s*:\s*(.+)\z/m
+    # Arithmetic precedence levels, loosest first. `**` is right-associative;
+    # every other level is left-associative.
+    ARITHMETIC_LEVELS = [%w[+ -], %w[* // / %], %w[**]].freeze
     # Operators Twig binds LOOSER than the filter pipe `|`. When one of these
     # sits at the top level alongside a pipe (e.g. `amount|number_format(2) ~
     # ' EUR'`), the whole expression must go through eval_expr (which resolves
@@ -1714,7 +1715,8 @@ module Tina4
       ternary: [:eval_ternary, :not_ternary, true],
       inline_if: [:eval_inline_if, :not_inline_if, true],
       coalesce: [:eval_null_coalesce, :not_coalesce, true],
-      collection: [:eval_collection_literal, :not_collection, true]
+      collection: [:eval_collection_literal, :not_collection, true],
+      range: [:eval_range, :not_range, true]
     }.freeze
 
     # ── Expression evaluation: a cascade, with the branch memoised ──
@@ -1772,6 +1774,9 @@ module Tina4
         return eval_comparison(expr, context)
       end
 
+      result = eval_range(expr, context)
+      return remember_form(expr, :range, result) unless result == :not_range
+
       result = eval_arithmetic(expr, context)
       return remember_form(expr, :arithmetic, result) unless result == :not_arithmetic
 
@@ -1879,16 +1884,15 @@ module Tina4
         inner = Regexp.last_match(1)
         hash = {}
         split_args_toplevel(inner).each do |pair|
-          if pair =~ HASH_PAIR_RE
-            key = Regexp.last_match(1) || Regexp.last_match(2)
-            hash[key] = eval_expr(Regexp.last_match(3).strip, context)
-          end
+          next unless pair =~ HASH_PAIR_RE
+
+          quoted, bare, evaluated, value = Regexp.last_match.captures
+          # A bare key is a string; a parenthesised key is evaluated: {(name): 1}.
+          key = quoted || bare || eval_expr(evaluated, context).to_s
+          hash[key] = eval_expr(value.strip, context)
         end
         return hash
       end
-      if expr =~ RANGE_LIT_RE
-        return (Regexp.last_match(1).to_i..Regexp.last_match(2).to_i).to_a
-      end
       :not_collection
     end
 
@@ -1959,14 +1963,112 @@ module Tina4
     # ── Arithmetic: +, -, *, //, /, %, ** ──
 
     def eval_arithmetic(expr, context)
-      ARITHMETIC_OPS.each do |op|
-        pos = find_outside_quotes(expr, op)
-        next unless pos && pos >= 0
-        l_val = eval_expr(expr[0...pos].strip, context)
-        r_val = eval_expr(expr[(pos + op.length)..].strip, context)
-        return apply_math(l_val, op.strip, r_val)
+      split = split_arithmetic(expr)
+      return :not_arithmetic unless split
+
+      op, pos = split
+      l_val = eval_expr(expr[0...pos].strip, context)
+      r_val = eval_expr(expr[(pos + op.length)..].strip, context)
+      apply_math(l_val, op, r_val)
+    end
+
+    # Pick the operator that binds loosest, so it is evaluated last. Within a
+    # left-associative level the RIGHTMOST operator is the split point
+    # (`10 - 2 - 3` is `(10 - 2) - 3`); `**` splits at the leftmost.
+    def split_arithmetic(expr)
+      operators = top_level_arithmetic_operators(expr)
+      ARITHMETIC_LEVELS.each do |level|
+        matches = operators.select { |_pos, op| level.include?(op) }
+        next if matches.empty?
+
+        pos, op = level == %w[**] ? matches.first : matches.last
+        return [op, pos]
+      end
+      nil
+    end
+
+    # Every position in expr outside quotes and brackets.
+    def top_level_positions(expr)
+      positions = []
+      in_quote = nil
+      depth = 0
+      expr.each_char.with_index do |ch, pos|
+        if in_quote
+          in_quote = nil if ch == in_quote
+        elsif ch == '"' || ch == "'"
+          in_quote = ch
+        elsif "([{".include?(ch)
+          depth += 1
+        elsif ")]}".include?(ch)
+          depth -= 1
+        elsif depth.zero?
+          positions << pos
+        end
+      end
+      positions
+    end
+
+    # True when the text before pos ends in an operand, so an operator there is
+    # binary; the `-` in `n * -1` or `-7` is a sign.
+    def follows_operand?(expr, pos)
+      preceding = expr[0...pos].rstrip
+      !preceding.empty? && preceding[-1].match?(/[\w)\]'"]/)
+    end
+
+    # [position, operator] for every binary arithmetic operator outside quotes
+    # and brackets (`**` and `//` are two characters).
+    def top_level_arithmetic_operators(expr)
+      operators = []
+      skip_until = -1
+      top_level_positions(expr).each do |pos|
+        next if pos < skip_until || !"+-*/%".include?(expr[pos])
+
+        op = %w[** //].include?(expr[pos, 2]) ? expr[pos, 2] : expr[pos]
+        skip_until = pos + op.length
+        operators << [pos, op] if follows_operand?(expr, pos)
       end
-      :not_arithmetic
+      operators
+    end
+
+    # ── Range: a..b ──
+
+    # Integers from start to finish inclusive, counting down when start is
+    # greater than finish. Backs both range() and `a..b`; returns [] for a
+    # bound that is not a number or a zero step.
+    def self.frond_range(start, finish, step = 1)
+      numeric = ->(v) { v.is_a?(Numeric) || v.to_s.match?(/\A-?\d+(\.\d+)?\z/) }
+      return [] unless numeric.(start) && numeric.(finish) && numeric.(step)
+
+      start = start.to_i
+      finish = finish.to_i
+      step = step.to_i.abs
+      return [] if step.zero?
+
+      start <= finish ? start.step(finish, step).to_a : start.step(finish, -step).to_a
+    end
+
+    def eval_range(expr, context)
+      pos = find_range_operator(expr)
+      return :not_range unless pos
+
+      Frond.frond_range(eval_expr(expr[0...pos].strip, context), eval_expr(expr[(pos + 2)..].strip, context))
+    end
+
+    # Position of a top-level `..` (not part of `...`), or nil. A pipe after the
+    # range (`1..4|join(",")`) applies to the whole range, so it is left to the
+    # filter step.
+    def find_range_operator(expr)
+      pos = find_outside_quotes(expr, "..")
+      while pos && pos >= 0
+        part_of_ellipsis = expr[pos, 3] == "..." || (pos.positive? && expr[pos - 1] == ".")
+        if pos.positive? && !part_of_ellipsis
+          return find_outside_quotes(expr[(pos + 2)..], "|") >= 0 ? nil : pos
+        end
+
+        next_pos = find_outside_quotes(expr[(pos + 2)..], "..")
+        pos = next_pos >= 0 ? pos + 2 + next_pos : nil
+      end
+      nil
     end
 
     # ── Function call: name(arg1, arg2) ──
@@ -2994,7 +3096,9 @@ module Tina4
             v.to_s
           end
         },
-        "striptags"  => ->(v, *_a) { v.to_s.gsub(STRIPTAGS_RE, "") },
+        # Fixed-point strip (see template.rb): loop the gsub until no tag remains,
+        # so nested `<scr<script>ipt>` cannot leave a `<script>` behind.
+        "striptags"  => ->(v, *_a) { s = v.to_s; loop { t = s.gsub(STRIPTAGS_RE, ""); break if t == s; s = t }; s },
 
         # -- Encoding --
         "escape"        => ->(v, *a) { Frond.escape_strategy(v, a[0] || "html") },
@@ -3179,6 +3283,7 @@ module Tina4
       @globals["form_token"] = ->(descriptor = "") { Frond.generate_form_token(descriptor.to_s) }
       @globals["formTokenValue"] = ->(descriptor = "") { Frond.generate_form_token_value(descriptor.to_s) }
       @globals["form_token_value"] = ->(descriptor = "") { Frond.generate_form_token_value(descriptor.to_s) }
+      @globals["range"] = ->(start, finish, step = 1) { Frond.frond_range(start, finish, step) }
 
       # Debug helper: {{ dump(x) }} — gated on TINA4_DEBUG=true.
       # Both this global and the |dump filter call Frond.render_dump which
@@ -3236,6 +3341,31 @@ module Tina4
       def set_form_token_session_id(session_id)
         self.form_token_session_id = session_id
       end
+
+      # The Rack env of the request this thread is dispatching. The app sets it
+      # for each request, so a token is bound to the session that rendered it
+      # without sharing a process-wide value between Puma threads.
+      def request_env=(env)
+        Thread.current[:tina4_form_token_env] = env
+      end
+
+      # The current request's session id, or "" outside a request.
+      #
+      # A session that holds nothing is sent no cookie, so the form's own POST
+      # would arrive under a newly minted id and fail its own token. Rendering a
+      # bound token therefore stores a marker, which makes the session persist.
+      def request_session_id
+        env = Thread.current[:tina4_form_token_env]
+        request = env && env["tina4.request"]
+        return "" unless request.respond_to?(:session)
+
+        session = request.session
+        sid = session.respond_to?(:get_session_id) ? session.get_session_id.to_s : ""
+        return "" if sid.empty?
+
+        session.set("_tina4_csrf", true) if session.respond_to?(:fresh?) && session.fresh?
+        sid
+      end
     end
 
     # Generate a raw JWT form token string.
@@ -3262,7 +3392,8 @@ module Tina4
       end
 
       # Include session_id for CSRF session binding
-      sid = form_token_session_id.to_s
+      sid = request_session_id
+      sid = form_token_session_id.to_s if sid.empty?
       payload["session_id"] = sid unless sid.empty?
 
       # get_token's expires_in is MINUTES, like every framework's. This used to