tina4-nodejs 3.10.21 → 3.10.24

package/CLAUDE.md

@@ -1,10 +1,10 @@
-# CLAUDE.md — AI Developer Guide for tina4-nodejs (v3.10.21)
+# CLAUDE.md — AI Developer Guide for tina4-nodejs (v3.10.24)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 
 ## What This Project Is
 
-Tina4 for Node.js/TypeScript v3.10.21 — a convention-over-configuration structural paradigm. **Not a framework.** The developer writes TypeScript; Tina4 is invisible infrastructure.
+Tina4 for Node.js/TypeScript v3.10.24 — a convention-over-configuration structural paradigm. **Not a framework.** The developer writes TypeScript; Tina4 is invisible infrastructure.
 
 The philosophy: zero ceremony, batteries included, file system as source of truth.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tina4-nodejs",
-  "version": "3.10.21",
+  "version": "3.10.24",
   "type": "module",
   "description": "This is not a framework. Tina4 for Node.js/TypeScript — zero deps, 38 built-in features.",
   "keywords": ["tina4", "framework", "web", "api", "orm", "graphql", "websocket", "typescript"],

package/packages/frond/src/engine.ts

@@ -4,7 +4,7 @@
  * Supports: variables, filters, if/elseif/else/endif, for/else/endfor,
  * extends/block, include, macro, set, comments, whitespace control, tests.
  */
-import { createHash, createHmac } from "node:crypto";
+import { createHash, createHmac, randomBytes } from "node:crypto";
 import { readFileSync, existsSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 
@@ -1016,6 +1016,8 @@ const BUILTIN_FILTERS: Record<string, FilterFn> = {
   dump: (v) => JSON.stringify(v),
   formToken: (v?: unknown) => _generateFormToken(v != null ? String(v) : ""),
   form_token: (v?: unknown) => _generateFormToken(v != null ? String(v) : ""),
+  formTokenValue: (v?: unknown) => _generateFormTokenValue(v != null ? String(v) : ""),
+  form_token_value: (v?: unknown) => _generateFormTokenValue(v != null ? String(v) : ""),
   tojson: (v, indent) => new SafeString(indent !== undefined ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
   to_json: (v, indent) => new SafeString(indent !== undefined ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
   js_escape: (v) => new SafeString(String(v).replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t")),
@@ -1050,13 +1052,13 @@ export function setFormTokenSessionId(sessionId: string): void {
   _formTokenSessionId = sessionId || "";
 }
 
-function _generateFormToken(descriptor: string = ""): SafeString {
+function _buildFormTokenJwt(descriptor: string = ""): string {
   const secret = process.env.SECRET || "tina4-default-secret";
   const ttlMinutes = parseInt(process.env.TINA4_TOKEN_LIMIT || "60", 10);
 
   const header = { alg: "HS256", typ: "JWT" };
   const now = Math.floor(Date.now() / 1000);
-  const payload: Record<string, unknown> = { type: "form", iat: now, exp: now + ttlMinutes * 60 };
+  const payload: Record<string, unknown> = { type: "form", nonce: randomBytes(8).toString("hex"), iat: now, exp: now + ttlMinutes * 60 };
 
   if (descriptor) {
     if (descriptor.includes("|")) {
@@ -1078,11 +1080,22 @@ function _generateFormToken(descriptor: string = ""): SafeString {
   const sigInput = `${h}.${p}`;
   const sig = _b64url(createHmac("sha256", secret).update(sigInput).digest());
 
-  const token = `${h}.${p}.${sig}`;
+  return `${h}.${p}.${sig}`;
+}
+
+function _generateFormToken(descriptor: string = ""): SafeString {
+  const token = _buildFormTokenJwt(descriptor);
   const escaped = token.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
   return new SafeString(`<input type="hidden" name="formToken" value="${escaped}">`);
 }
 
+/**
+ * Generate a JWT form token and return just the raw JWT string (no HTML wrapper).
+ */
+function _generateFormTokenValue(descriptor: string = ""): SafeString {
+  return new SafeString(_buildFormTokenJwt(descriptor));
+}
+
 // ── Frond Engine ───────────────────────────────────────────────
 
 export class Frond {
@@ -1118,6 +1131,8 @@ export class Frond {
     // Built-in global functions
     this.globals.formToken = (descriptor?: string) => _generateFormToken(descriptor || "");
     this.globals.form_token = (descriptor?: string) => _generateFormToken(descriptor || "");
+    this.globals.formTokenValue = (descriptor?: string) => _generateFormTokenValue(descriptor || "");
+    this.globals.form_token_value = (descriptor?: string) => _generateFormTokenValue(descriptor || "");
   }
 
   sandbox(filters?: string[], tags?: string[], vars?: string[]): Frond {
@@ -1157,20 +1172,16 @@ export class Frond {
     }
 
     const debugMode = (process.env.TINA4_DEBUG || "").toLowerCase() === "true";
-    const cached = this.compiled.get(template);
 
-    if (cached) {
-      if (debugMode) {
-        // Dev mode: check if file changed
-        const mtime = statSync(filePath).mtimeMs;
-        if (cached.mtime === mtime) {
-          return this.executeCached(cached.tokens, context);
-        }
-      } else {
-        // Production: skip mtime check, cache is permanent
+    if (!debugMode) {
+      // Production: use permanent cache (no filesystem checks)
+      const cached = this.compiled.get(template);
+      if (cached) {
         return this.executeCached(cached.tokens, context);
       }
     }
+    // Dev mode: skip cache entirely — always re-read and re-tokenize
+    // so edits to partials and extended base templates are detected
 
     // Cache miss — load, tokenize, cache
     const source = readFileSync(filePath, "utf-8");