tina4ruby 3.13.86 → 3.13.88

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dae161f7ae0f39d834a01876bde153cd83b4df51ac355225c2c123ce20eec210
-  data.tar.gz: 1e12103ca5685fc65dcfa7dedd16c38ddf5d4435ccd77ad4f73ad9a987596e2f
+  metadata.gz: 8878ff3cfcfe50696d437b251a372f66d99a8098707e7cfd919554ec24d996fb
+  data.tar.gz: dbc5ae0b61c125a88fda3310d7dff72e0bb5a5d52d94ae863455ff607c5aab35
 SHA512:
-  metadata.gz: 5ea0ee3373aab820be175916dda33ca1e353f8cd9894ab1fa2613af2a85438195b5345a0af2b441ec444c51482e8bb64632f49c9af3e4f6acedbef8c3f66fe45
-  data.tar.gz: cd556ef4a20f2b6acd245a2926af62e8592ca56a11fb3827ffcb9e8fede128f928b070ab1bfd7acb850a0b4371f8ec6367499d140488216eeb7a0f65939303ab
+  metadata.gz: b51a87207d60bff1cd55241e23eb3b7325980752430bfef840ed8fce8e1ba491fbdf4096dd8369548112163ec40147b5e70874b3d6b66c174d82a5161e3f2062
+  data.tar.gz: 8b03d0f03526f60931fefafdf78f21e84b3e85dfb040af5106a1a7c26677e110fc21a2274b8d623bbbab60c23ba70661d8612ae02c43f024d29e02a82ca5e167

data/lib/tina4/drivers/firebird_driver.rb

@@ -213,16 +213,38 @@ module Tina4
         "SELECT FIRST #{limit} SKIP #{offset} * FROM (#{sql})"
       end
 
+      # Transaction handling — mirrors the Python master's connection-level
+      # contract (tina4_python firebird.py: start_transaction sets a flag,
+      # commit/rollback act on the connection).
+      #
+      # In the `fb` gem the transaction lives ON the connection:
+      # `Fb::Connection#transaction` (no block) STARTS a transaction and returns
+      # `true` (a boolean — NOT a transaction object), and
+      # `Fb::Connection#commit` / `#rollback` end it. The old code stored that
+      # boolean in `@transaction` and called `@transaction&.commit` /
+      # `&.rollback`, i.e. `true.commit` / `true.rollback` — a NoMethodError that
+      # broke every explicit-transaction commit AND rollback (a rolled-back write
+      # was never undone). We now start the transaction on the connection and
+      # commit/rollback the CONNECTION, tracking open-ness with an
+      # `@in_transaction` boolean (parity with Python's `_in_transaction`).
+      #
+      # A standalone write auto-commits inside the gem's own `execute`, so the
+      # framework's autocommit_standalone_write then calls #commit with no txn
+      # open — `Fb::Connection#commit` is a harmless no-op there (returns nil, no
+      # raise), so standalone-autocommit is preserved.
       def begin_transaction
-        @transaction = @connection.transaction
+        @connection.transaction
+        @in_transaction = true
       end
 
       def commit
-        @transaction&.commit
+        @connection&.commit
+        @in_transaction = false
       end
 
       def rollback
-        @transaction&.rollback
+        @connection&.rollback
+        @in_transaction = false
       end
 
       def tables
@@ -263,7 +285,7 @@ module Tina4
           # connection already gone — nothing to clean up
         end
         @connection = nil
-        @transaction = nil
+        @in_transaction = false
         open_connection
       end
 
@@ -273,7 +295,7 @@ module Tina4
       def with_reconnect
         yield
       rescue StandardError => e
-        raise unless self.class.dead_connection?(e) && @transaction.nil?
+        raise unless self.class.dead_connection?(e) && !@in_transaction
         reconnect!
         yield
       end

data/lib/tina4/frond.rb

@@ -106,7 +106,11 @@ module Tina4
       " and ", " or ", " not ",
       " + ", " - ", " * ", " // ", " / ", " % ", " ** "
     ].freeze
-    FUNC_CALL_RE    = /\A(\w+)\s*\((.*)\)\z/m
+    # A dot is allowed in the callee so {% import "f" as m %} can register its macros
+    # under the literal key "m.greet" and {{ m.greet("Andre") }} resolves as a call.
+    # Without the dot the whole expression was not recognised as a function call at
+    # all, so an aliased macro rendered as SILENTLY EMPTY.
+    FUNC_CALL_RE    = /\A([\w.]+)\s*\((.*)\)\z/m
     FILTER_WITH_ARGS_RE = /\A(\w+)\s*\((.*)\)\z/m
     FILTER_CMP_RE   = /\A(\w+)\s*(!=|==|>=|<=|>|<)\s*(.+)\z/
     OR_SPLIT_RE     = /\s+or\s+/
@@ -136,6 +140,7 @@ module Tina4
            .gsub("<", "&lt;").gsub(">", "&gt;")
     end
     FROM_IMPORT_RE  = /\Afrom\s+["'](.+?)["']\s+import\s+(.+)/
+    IMPORT_AS_RE    = /\Aimport\s+["'](.+?)["']\s+as\s+(\w+)/
     CACHE_RE        = /\Acache\s+["'](.+?)["']\s*(\d+)?/
     SPACELESS_RE    = />\s+</
     AUTOESCAPE_RE   = /\Aautoescape\s+(false|true)/
@@ -147,6 +152,17 @@ module Tina4
     # Set of common no-arg filter names that can be inlined for speed
     INLINE_FILTERS = %w[upper lower length trim capitalize title string int escape e].each_with_object({}) { |f, h| h[f] = true }.freeze
 
+    # Hard cap on the template caches — @compiled and @compiled_strings
+    # (ADR-0004, parity with PHP/Python/Node TEMPLATE_CACHE_MAX).
+    #
+    # An entry here is a whole token list, so the cap sits well below what a
+    # per-expression memo would justify. 256 is far above any real
+    # application's template count, so a normal app never evicts. The cap
+    # exists for the workload that genuinely grows without limit for the life
+    # of a worker: +render_string+ keys on md5(source), so an app that builds
+    # template strings dynamically adds an entry per distinct string.
+    TEMPLATE_CACHE_MAX = 256
+
     # -- Lazy context overlay for for-loops (avoids full Hash#dup) --
     class LoopContext
       def initialize(parent)
@@ -302,6 +318,7 @@ module Tina4
       source = File.read(path, encoding: "utf-8")
       mtime = File.mtime(path)
       tokens = tokenize(source)
+      cap_cache(@compiled, TEMPLATE_CACHE_MAX)
       @compiled[template] = [tokens, mtime, Time.now.to_i]
       execute_with_tokens(source, tokens, context)
     end
@@ -318,6 +335,7 @@ module Tina4
       end
 
       tokens = tokenize(source)
+      cap_cache(@compiled_strings, TEMPLATE_CACHE_MAX)
       @compiled_strings[key] = tokens
       execute_cached(tokens, context)
     end
@@ -411,8 +429,89 @@ module Tina4
       str.to_s.gsub(HTML_ESCAPE_RE, HTML_ESCAPE_MAP)
     end
 
+    # Serializes a value to compact JSON text that is always valid JSON.
+    #
+    # Never raises and never returns an empty string: a non-finite float becomes
+    # null (the JSON spec has no Infinity or NaN) and malformed UTF-8 is scrubbed,
+    # so a payload always arrives, in the worst case as null.
+    def self.json_text(value)
+      JSON.generate(value)
+    rescue StandardError
+      # Only reached when the happy path raised, so a well-formed payload never
+      # pays for the walk.
+      begin
+        JSON.generate(json_sanitize(value))
+      rescue StandardError
+        "null"
+      end
+    end
+
+    # Replaces anything JSON.generate refuses with a JSON-representable stand-in.
+    def self.json_sanitize(value)
+      case value
+      when Float   then value.finite? ? value : nil
+      when Hash    then value.transform_values { |item| json_sanitize(item) }
+      when Array   then value.map { |item| json_sanitize(item) }
+      when String  then value.valid_encoding? ? value : value.scrub
+      else value
+      end
+    end
+
+    # Serializes to JSON that is valid JSON, valid JavaScript, and safe in HTML.
+    #
+    # THE cross-framework contract for json_encode / to_json / tojson. Keep the
+    # four implementations byte-identical; frond_expression_corpus.txt locks it.
+    #
+    # Three things this must never do, each of which was a real bug:
+    #
+    # 1. Never emit a non-finite literal. JSON.generate raises on Infinity, and
+    #    the old `rescue v.to_s` turned that raise into Ruby inspect output --
+    #    `{"a" => 1.0}` -- which no JSON.parse will read. Reported as
+    #    tina4-php#184 by justin-k-bruce, who hit the same class of bug in PHP.
+    # 2. Never emit nothing, and never emit something that still parses and means
+    #    something else. "var ROWS = ;" is at least a loud SyntaxError.
+    # 3. Never HTML-escape it. Entity-encoding JSON produces {&quot;a&quot;:1},
+    #    a SyntaxError inside <script>, which is the filter's whole point. Escape
+    #    only the dangerous characters, as JSON \uXXXX escapes: the result stays
+    #    valid JSON AND valid JavaScript, </script> cannot terminate the block,
+    #    and it is safe inside a single-quoted attribute. This is what Jinja2's
+    #    tojson does, and it is why the result is a SafeString.
+    #
+    # U+2028 and U+2029 join that escape set. Both are legal inside a JSON string
+    # and both were illegal inside a JavaScript string literal before ES2019.
+    def self.json_safe(value)
+      Tina4::SafeString.new(json_text(value).gsub(JSON_ESCAPE_RE, JSON_ESCAPE_MAP))
+    end
+
+    JSON_ESCAPE_MAP = {
+      "<" => "\\u003c", ">" => "\\u003e", "&" => "\\u0026", "'" => "\\u0027",
+      "\u2028" => "\\u2028", "\u2029" => "\\u2029"
+    }.freeze
+    JSON_ESCAPE_RE = /[<>&'\u2028\u2029]/
+
     private
 
+    # Keep a memo cache bounded (ADR-0004). Call immediately before inserting
+    # a new entry.
+    #
+    # Eviction is insertion-ordered (oldest first), not true LRU: a Ruby Hash
+    # preserves insertion order, so dropping from the front is cheap, whereas
+    # refreshing recency on every cache HIT would add writes to the hottest
+    # path in a render and cost more than it saves. Half the cache is dropped
+    # at once so the sweep amortises to O(1) per insert.
+    #
+    # Evicting can never change what a render produces: every read site treats
+    # a miss as "recompute", so a swept entry is rebuilt on next use.
+    #
+    # @param cache [Hash] memo cache to bound, mutated in place
+    # @param max_entries [Integer] cap for this cache
+    # @return [void]
+    def cap_cache(cache, max_entries)
+      return if cache.size < max_entries
+
+      cache.keys.first(max_entries / 2).each { |key| cache.delete(key) }
+    end
+
     # -----------------------------------------------------------------------
     # Tokenizer
     # -----------------------------------------------------------------------
@@ -625,6 +724,9 @@ module Tina4
             end
           when "macro"
             i = handle_macro(tokens, i, context)
+          when "import"
+            handle_import_as(content, context)
+            i += 1
           when "from"
             handle_from_import(content, context)
             i += 1
@@ -1082,44 +1184,111 @@ module Tina4
     # Helpers return :not_matched when the expression doesn't match their
     # type, so the dispatcher falls through to the next handler.
 
+    # Bound for the expression-form cache. Python bounds its expression caches
+    # (lru_cache 1024) and PHP's were unbounded instance arrays until ADR-0004;
+    # a template with generated expression strings must not grow this forever.
+    # FIFO drop-oldest-half, deliberately not LRU (no per-hit bookkeeping on the
+    # hot path).
+    EXPR_FORM_CACHE_MAX = 2048
+
+    # ── Expression evaluation: a cascade, with the branch memoised ──
+    #
+    # eval_expr tries 12 structural forms in Twig precedence order. The catch is
+    # that the LAST one, `resolve`, is by far the most common (a plain `i.name`),
+    # so every ordinary variable used to walk all 11 detectors ahead of it on
+    # EVERY render. Measured: ~6-7 microseconds and ~38 Frond method calls per
+    # expression evaluation, linear in expression count.
+    #
+    # So: on first sight run the real cascade and RECORD which branch fired; on
+    # later renders jump straight to that branch. The cache key is the expression
+    # string, and a form is a pure property of that string.
+    #
+    # Correctness is owned by the existing evaluators, not by a second copy of the
+    # detection logic (which is what would drift). The fast path calls exactly one
+    # evaluator; if it declines -- returns its own :not_* sentinel -- we fall
+    # through to the full cascade and re-record. A wrong cache entry therefore
+    # costs one wasted call, never a wrong render.
     def eval_expr(expr, context)
       expr = expr.strip
       return nil if expr.empty?
 
+      form = (@expr_form ||= {})[expr]
+      if form
+        result = eval_expr_as(form, expr, context)
+        return result unless result == :form_declined
+      end
+
       result = eval_literal(expr)
-      return result unless result == :not_literal
+      return remember_form(expr, :literal, result) unless result == :not_literal
 
       result = eval_collection_literal(expr, context)
-      return result unless result == :not_collection
+      return remember_form(expr, :collection, result) unless result == :not_collection
 
-      return eval_expr(expr[1..-2], context) if matched_parens?(expr)
+      if matched_parens?(expr)
+        remember_form(expr, :parens, nil)
+        return eval_expr(expr[1..-2], context)
+      end
 
       result = eval_ternary(expr, context)
-      return result unless result == :not_ternary
+      return remember_form(expr, :ternary, result) unless result == :not_ternary
 
       result = eval_inline_if(expr, context)
-      return result unless result == :not_inline_if
+      return remember_form(expr, :inline_if, result) unless result == :not_inline_if
 
       result = eval_null_coalesce(expr, context)
-      return result unless result == :not_coalesce
+      return remember_form(expr, :coalesce, result) unless result == :not_coalesce
 
       result = eval_concat(expr, context)
-      return result unless result == :not_concat
+      return remember_form(expr, :concat, result) unless result == :not_concat
 
-      return eval_comparison(expr, context) if has_comparison?(expr)
+      if has_comparison?(expr)
+        remember_form(expr, :comparison, nil)
+        return eval_comparison(expr, context)
+      end
 
       result = eval_arithmetic(expr, context)
-      return result unless result == :not_arithmetic
+      return remember_form(expr, :arithmetic, result) unless result == :not_arithmetic
 
       result = eval_filter_pipe(expr, context)
-      return result unless result == :not_filter_pipe
+      return remember_form(expr, :pipe, result) unless result == :not_filter_pipe
 
       result = eval_function_call(expr, context)
-      return result unless result == :not_function
+      return remember_form(expr, :function, result) unless result == :not_function
 
+      remember_form(expr, :resolve, nil)
       resolve(expr, context)
     end
 
+    # Record the branch an expression took, then hand back its value unchanged.
+    def remember_form(expr, form, result)
+      cache = (@expr_form ||= {})
+      if cache.length >= EXPR_FORM_CACHE_MAX
+        cache.keys.first(EXPR_FORM_CACHE_MAX / 2).each { |k| cache.delete(k) }
+      end
+      cache[expr] = form
+      result
+    end
+
+    # Evaluate via the one remembered branch. Returns :form_declined when that
+    # branch no longer applies, so the caller re-runs the full cascade.
+    def eval_expr_as(form, expr, context)
+      case form
+      when :resolve     then resolve(expr, context)
+      when :pipe        then (r = eval_filter_pipe(expr, context)) == :not_filter_pipe ? :form_declined : r
+      when :literal     then (r = eval_literal(expr)) == :not_literal ? :form_declined : r
+      when :function    then (r = eval_function_call(expr, context)) == :not_function ? :form_declined : r
+      when :concat      then (r = eval_concat(expr, context)) == :not_concat ? :form_declined : r
+      when :comparison  then has_comparison?(expr) ? eval_comparison(expr, context) : :form_declined
+      when :arithmetic  then (r = eval_arithmetic(expr, context)) == :not_arithmetic ? :form_declined : r
+      when :ternary     then (r = eval_ternary(expr, context)) == :not_ternary ? :form_declined : r
+      when :inline_if   then (r = eval_inline_if(expr, context)) == :not_inline_if ? :form_declined : r
+      when :coalesce    then (r = eval_null_coalesce(expr, context)) == :not_coalesce ? :form_declined : r
+      when :collection  then (r = eval_collection_literal(expr, context)) == :not_collection ? :form_declined : r
+      when :parens      then matched_parens?(expr) ? eval_expr(expr[1..-2], context) : :form_declined
+      else :form_declined
+      end
+    end
+
     # ── Filter pipe: value|filter(args) ──
     # Reached only after every looser-binding operator (concat ~, comparison,
     # arithmetic, ternary, ...) has been ruled out at this level, so the pipe
@@ -1139,6 +1308,10 @@ module Tina4
     # looser than the filter pipe. Quote/paren-aware via find_outside_quotes so
     # operator-like text inside a string literal or filter args never matches.
     def has_looser_than_pipe_operator?(expr)
+      # Leading unary `not` -- see has_comparison? for why a space-delimited
+      # match cannot see it. `not x|upper` must be `not (x|upper)`.
+      return true if expr.start_with?("not ")
+
       LOOSER_THAN_PIPE_OPS.any? { |op| find_outside_quotes(expr, op) >= 0 }
     end
 
@@ -1254,7 +1427,12 @@ module Tina4
     def eval_concat(expr, context)
       return :not_concat unless expr.include?("~")
       parts = expr.split("~")
-      parts.map { |p| (eval_expr(p.strip, context) || "").to_s }.join
+      # `|| ""` would swallow a legitimate `false`: in Ruby only nil and false are
+      # falsy, so `false || ""` is "" and a boolean rendered as EMPTY. Guard on nil
+      # only -- false must render as "false", matching the other three frameworks
+      # (and line 635, which already got this right, which is why a comparison
+      # rendered "false" while a bare false variable rendered "").
+      parts.map { |p| v = eval_expr(p.strip, context); v.nil? ? "" : v.to_s }.join
     end
 
     # ── Arithmetic: +, -, *, //, /, %, ** ──
@@ -1282,7 +1460,21 @@ module Tina4
       fn.call(*args)
     end
 
+    # True when the expression carries a comparison/logical operator, so it is
+    # routed to eval_comparison -- the SAME evaluator {% if %} uses. A condition
+    # therefore means the same thing in a condition and in an output expression.
+    #
+    # The LEADING unary `not` needs its own check: every operator in the list is
+    # matched WITH surrounding spaces, so `not x` (nothing to its left) matched
+    # none of them and fell through to the variable-resolution tail, which
+    # looked up a variable literally named "not x", found nothing, and rendered
+    # EMPTY. `{% if not x %}` and `x and not y` always worked; only the
+    # standalone `{{ not x }}` was dropped, and before booleans rendered
+    # lowercase a dropped expression and `false -> ''` looked identical.
+    # Fixed in 3.13.87 alongside the boolean contract.
     def has_comparison?(expr)
+      return true if expr.start_with?("not ")
+
       [" not in ", " in ", " is not ", " is ", "!=", "==", ">=", "<=", ">", "<",
        " and ", " or ", " not "].any? { |op| expr.include?(op) }
     end
@@ -1448,7 +1640,19 @@ module Tina4
       parts.each do |part|
         part = part.strip.gsub(RESOLVE_STRIP_RE, "") # strip quotes from bracket access
         if value.is_a?(Hash) || value.is_a?(LoopContext)
-          value = value[part] || value[part.to_sym]
+          # `a[k] || a[k.to_sym]` LOSES a stored `false`: only nil and false are
+          # falsy in Ruby, so a legitimate false fell through to the symbol lookup,
+          # missed, and became nil -- rendering as EMPTY. That is why
+          # `{{ flag }}` printed nothing while `{{ n < 3 }}` printed "false".
+          # Probe the string key by presence, not truthiness.
+          value = if value.is_a?(Hash) && value.key?(part)
+                    value[part]
+                  elsif value.is_a?(Hash) && value.key?(part.to_sym)
+                    value[part.to_sym]
+                  else
+                    sv = value[part]
+                    sv.nil? ? value[part.to_sym] : sv
+                  end
         elsif value.is_a?(Array)
           # Slice syntax: value[1:5], value[:10], value[start:end]
           if part.include?(":") && !(part.start_with?('"') || part.start_with?("'"))
@@ -1750,7 +1954,7 @@ module Tina4
       end
 
       macro_name = m[1]
-      param_names = m[2].split(",").map(&:strip).reject(&:empty?)
+      params = parse_macro_params(m[2])
 
       body_tokens = []
       i = start + 1
@@ -1769,8 +1973,8 @@ module Tina4
 
       context[macro_name] = lambda { |*args|
         macro_ctx = captured_context.dup
-        param_names.each_with_index do |pname, pi|
-          macro_ctx[pname] = pi < args.length ? args[pi] : nil
+        params.each_with_index do |(pname, pdefault), pi|
+          macro_ctx[pname] = pi < args.length ? args[pi] : pdefault
         end
         Tina4::SafeString.new(engine.send(:render_tokens, captured_body.dup, macro_ctx))
       }
@@ -1778,6 +1982,54 @@ module Tina4
       i
     end
 
+    # {% import "file" as alias %} — load EVERY macro in a file under one namespace.
+    #
+    # Macros are registered in the context under the dotted key "alias.name", so
+    # {{ alias.greet("Andre") }} resolves through the ordinary function-call path
+    # (FUNC_CALL_RE now admits a dot) and reuses _make_macro_fn — identical argument
+    # binding, default handling and SafeString output as every other macro. Both
+    # import forms therefore render identically, the contract Python locks too.
+    def handle_import_as(content, context)
+      m = content.match(IMPORT_AS_RE)
+      return unless m
+
+      filename = m[1]
+      alias_name = m[2]
+      source = load_template(filename)
+      tokens = tokenize(source)
+
+      i = 0
+      while i < tokens.length
+        ttype, raw = tokens[i]
+        if ttype == BLOCK
+          tag_content, = strip_tag(raw)
+          if tag_content.split(/\s+/).first == "macro"
+            macro_m = tag_content.match(MACRO_RE)
+            if macro_m
+              macro_name = macro_m[1]
+              params = parse_macro_params(macro_m[2])
+
+              body_tokens = []
+              i += 1
+              while i < tokens.length
+                if tokens[i][0] == BLOCK && tokens[i][1].include?("endmacro")
+                  i += 1
+                  break
+                end
+                body_tokens << tokens[i]
+                i += 1
+              end
+
+              context["#{alias_name}.#{macro_name}"] =
+                _make_macro_fn(body_tokens.dup, params.dup, context.dup)
+              next
+            end
+          end
+        end
+        i += 1
+      end
+    end
+
     # {% from "file" import macro1, macro2 %}
     def handle_from_import(content, context)
       m = content.match(FROM_IMPORT_RE)
@@ -1799,7 +2051,7 @@ module Tina4
             macro_m = tag_content.match(MACRO_RE)
             if macro_m && names.include?(macro_m[1])
               macro_name = macro_m[1]
-              param_names = macro_m[2].split(",").map(&:strip).reject(&:empty?)
+              param_names = parse_macro_params(macro_m[2])
 
               body_tokens = []
               i += 1
@@ -1821,13 +2073,34 @@ module Tina4
       end
     end
 
+    # Parse a macro parameter list into [name, default] pairs.
+    #
+    # Handles: name, name="default", name='default'. Splitting on "," alone left
+    # a defaulted parameter NAMED "greeting='Hello'", so the body's {{ greeting }}
+    # matched nothing (rendered empty) AND the caller's positional argument was
+    # stored under that junk key and lost. Mirrors the Python master's
+    # _parse_macro_params. `default` is nil when none is declared.
+    def parse_macro_params(raw_params)
+      raw_params.split(",").map(&:strip).reject(&:empty?).map do |p|
+        name, default = p.split("=", 2)
+        default = default.strip if default
+        if default && default.length >= 2 &&
+           ((default.start_with?('"') && default.end_with?('"')) ||
+            (default.start_with?("'") && default.end_with?("'")))
+          default = default[1..-2]
+        end
+        [name.strip, default]
+      end
+    end
+
     # Build an isolated lambda for a macro — avoids closure-in-loop variable sharing.
-    def _make_macro_fn(body_tokens, param_names, ctx)
+    # `params` is the [name, default] list from parse_macro_params.
+    def _make_macro_fn(body_tokens, params, ctx)
       engine = self
       lambda { |*args|
         macro_ctx = ctx.dup
-        param_names.each_with_index do |pname, pi|
-          macro_ctx[pname] = pi < args.length ? args[pi] : nil
+        params.each_with_index do |(pname, pdefault), pi|
+          macro_ctx[pname] = pi < args.length ? args[pi] : pdefault
         end
         Tina4::SafeString.new(engine.send(:render_tokens, body_tokens.dup, macro_ctx))
       }
@@ -2193,7 +2466,10 @@ module Tina4
         "e"             => ->(v, *_a) { Tina4::SafeString.new(Frond.escape_html(v.to_s)) },
         "raw"           => ->(v, *_a) { v },
         "safe"          => ->(v, *_a) { v },
-        "json_encode"   => ->(v, *_a) { JSON.generate(v) rescue v.to_s },
+        # Frond.json_safe, never a bare JSON.generate: generate RAISES on an
+        # Infinity/NaN float, and the old `rescue v.to_s` answered that raise with
+        # Ruby inspect output that no JSON.parse will read. See Frond.json_safe.
+        "json_encode"   => ->(v, *_a) { Frond.json_safe(v) },
         "json_decode"   => ->(v, *_a) { v.is_a?(String) ? (JSON.parse(v) rescue v) : v },
         "base64_encode" => ->(v, *_a) { Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
         "base64encode"  => ->(v, *_a) { Base64.strict_encode64(v.is_a?(String) ? v : v.to_s) },
@@ -2212,17 +2488,12 @@ module Tina4
         "url_encode"    => ->(v, *_a) { ERB::Util.url_encode(v.to_s) },
 
         # -- JSON / JS --
-        "to_json" => ->(v, *a) {
-          indent = a[0] ? a[0].to_i : nil
-          json = indent ? JSON.pretty_generate(v) : JSON.generate(v)
-          # Escape <, >, & for safe HTML embedding
-          Tina4::SafeString.new(json.gsub("<", '\u003c').gsub(">", '\u003e').gsub("&", '\u0026'))
-        },
-        "tojson" => ->(v, *a) {
-          indent = a[0] ? a[0].to_i : nil
-          json = indent ? JSON.pretty_generate(v) : JSON.generate(v)
-          Tina4::SafeString.new(json.gsub("<", '\u003c').gsub(">", '\u003e').gsub("&", '\u0026'))
-        },
+        # Same serializer as json_encode -- the three names are one behaviour.
+        # The old indent argument is gone: PHP cannot honour an arbitrary indent
+        # (JSON_PRETTY_PRINT is fixed at four spaces), so honouring it here alone
+        # broke byte-parity for the one filter whose whole job is a wire format.
+        "to_json" => ->(v, *_a) { Frond.json_safe(v) },
+        "tojson"  => ->(v, *_a) { Frond.json_safe(v) },
         "js_escape" => ->(v, *_a) {
           Tina4::SafeString.new(
             v.to_s.gsub("\\", "\\\\").gsub("'", "\\'").gsub('"', '\\"')

data/lib/tina4/metrics.rb

@@ -338,7 +338,14 @@ module Tina4
         "total_functions" => all_functions.length,
         "avg_complexity" => avg_cc.round(2),
         "avg_maintainability" => avg_mi.round(1),
+        # Display-only: the top-15 for the "most complex functions" report.
+        # Do NOT source offenders / --fail-on from this — capping here silently
+        # hides the 16th+ over-threshold function from the gate. offenders()
+        # reads "all_functions" (below) instead.
         "most_complex_functions" => all_functions.first(15),
+        # Full, uncapped, complexity-sorted list — offenders()/--fail-on use this
+        # so no function over the complexity threshold ever escapes the gate.
+        "all_functions" => all_functions,
         "file_metrics" => file_metrics,
         "violations" => violations,
         "dependency_graph" => import_graph,
@@ -386,8 +393,10 @@ module Tina4
 
       items = []
 
-      # Function-level: cyclomatic complexity.
-      (analysis["most_complex_functions"] || []).each do |fn|
+      # Function-level: cyclomatic complexity. Use the FULL function list (not the
+      # display-capped most_complex_functions[:15]) so a 16th+ over-threshold
+      # function is never silently dropped from the offenders list or --fail-on.
+      (analysis["all_functions"] || analysis["most_complex_functions"] || []).each do |fn|
         cc = fn["complexity"]
         next unless cc > 10
         items << {

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.86"
+  VERSION = "3.13.88"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.86
+  version: 3.13.88
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-25 00:00:00.000000000 Z
+date: 2026-07-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack