tina4-nodejs 3.10.48 → 3.10.55

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tina4-nodejs",
-  "version": "3.10.48",
+  "version": "3.10.55",
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript — 54 built-in features, zero dependencies",
   "keywords": ["tina4", "framework", "web", "api", "orm", "graphql", "websocket", "typescript"],

package/packages/cli/src/bin.ts

@@ -46,6 +46,7 @@ const HELP = `
   Options:
     --port <number>      Server port (default: 7148)
     --no-browser         Don't open the browser on serve
+    --no-reload          Disable file watcher / live-reload on serve
     --all                Install AI context for all tools (with ai command)
     --force              Overwrite existing AI context files (with ai command)
     --help               Show this help message
@@ -85,11 +86,12 @@ async function main(): Promise<void> {
       const portIndex = args.indexOf("--port");
       const port = portIndex !== -1 ? parseInt(args[portIndex + 1], 10) : 7148;
       const noBrowser = args.includes("--no-browser");
+      const noReload = args.includes("--no-reload");
 
       // Kill any existing process on the port
       killProcessOnPort(port);
 
-      await serveProject({ port, noBrowser });
+      await serveProject({ port, noBrowser, noReload });
       break;
     }
     case "migrate": {

package/packages/cli/src/commands/init.ts

@@ -1,5 +1,6 @@
-import { mkdirSync, writeFileSync, existsSync } from "node:fs";
-import { join, resolve, basename } from "node:path";
+import { mkdirSync, writeFileSync, existsSync, copyFileSync } from "node:fs";
+import { join, resolve, basename, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
 import { execSync } from "node:child_process";
 
 export async function initProject(name: string): Promise<void> {
@@ -30,6 +31,28 @@ export async function initProject(name: string): Promise<void> {
     mkdirSync(join(targetDir, dir), { recursive: true });
   }
 
+  // Copy framework public assets into the project so they're visible
+  const __filename = fileURLToPath(import.meta.url);
+  const __dirname = dirname(__filename);
+  const frameworkPublic = resolve(__dirname, "..", "..", "..", "core", "public");
+  const projectPublic = join(targetDir, "public");
+  const assetsToCopy = [
+    "css/tina4.css",
+    "css/tina4.min.css",
+    "js/tina4.min.js",
+    "js/frond.min.js",
+    "images/tina4-logo-icon.webp",
+  ];
+  for (const asset of assetsToCopy) {
+    const src = join(frameworkPublic, ...asset.split("/"));
+    const dst = join(projectPublic, ...asset.split("/"));
+    mkdirSync(dirname(dst), { recursive: true });
+    if (existsSync(src) && !existsSync(dst)) {
+      copyFileSync(src, dst);
+      console.log(`  Copied ${asset}`);
+    }
+  }
+
   // package.json
   writeFileSync(
     join(targetDir, "package.json"),

package/packages/cli/src/commands/serve.ts

@@ -4,9 +4,14 @@ import { existsSync } from "node:fs";
 export interface ServeOptions {
   port?: number;
   noBrowser?: boolean;
+  noReload?: boolean;
 }
 
 export async function serveProject(options: ServeOptions): Promise<void> {
+  if (options.noReload) {
+    process.env.TINA4_NO_RELOAD = "true";
+  }
+
   const port = options.port ?? 7148;
   const cwd = process.cwd();
 
@@ -21,8 +26,8 @@ export async function serveProject(options: ServeOptions): Promise<void> {
     process.exit(1);
   }
 
-  const { startServer } = await import("@tina4/core");
-  const { watchForChanges } = await import("@tina4/core/src/watcher.js");
+  const { startServer } = await import("../../../core/src/index.js");
+  const { watchForChanges } = await import("../../../core/src/watcher.js");
 
   const server = await startServer({
     port,
@@ -33,26 +38,30 @@ export async function serveProject(options: ServeOptions): Promise<void> {
   });
 
   // Watch for file changes and reload routes
+  const noReload = ["true", "1", "yes"].includes((process.env.TINA4_NO_RELOAD ?? "").toLowerCase());
   const watchDirs = [routesDir, ormDir, modelsDir, templatesDir].filter((d) => existsSync(d));
-  const watcher = watchForChanges(watchDirs, async () => {
-    try {
-      const { discoverRoutes } = await import("@tina4/core");
-      // Clear routes BEFORE re-discovery to avoid stale duplicates
-      server.router.clear();
-      const routes = await discoverRoutes(routesDir);
-      for (const route of routes) {
-        server.router.addRoute(route);
+  let watcher: { close: () => void } | null = null;
+  if (!noReload) {
+    watcher = watchForChanges(watchDirs, async () => {
+      try {
+        const { discoverRoutes } = await import("../../../core/src/index.js");
+        // Clear routes BEFORE re-discovery to avoid stale duplicates
+        server.router.clear();
+        const routes = await discoverRoutes(routesDir);
+        for (const route of routes) {
+          server.router.addRoute(route);
+        }
+        console.log(`  Reloaded ${routes.length} route(s)`);
+      } catch (err) {
+        console.error("  Error reloading routes:", err);
       }
-      console.log(`  Reloaded ${routes.length} route(s)`);
-    } catch (err) {
-      console.error("  Error reloading routes:", err);
-    }
-  });
+    });
+  }
 
   // Graceful shutdown
   const shutdown = () => {
     console.log("\n  Shutting down...");
-    watcher.close();
+    watcher?.close();
     server.close();
     process.exit(0);
   };

package/packages/core/src/devAdmin.ts

@@ -2467,7 +2467,7 @@ function renderBubbleChart(files,depGraph,scanMode){
         bubbles.forEach(function(b,i){if(b.f.path===src)srcIdx=i;});
         if(srcIdx===null)return;
         (depGraph[src]||[]).forEach(function(tgt){
-            var tgtName=tgt.split('.').pop().toLowerCase();
+            var tgtName=basename(tgt);
             var tgtIdx=nameIdx[tgtName];
             if(tgtIdx!==undefined&&srcIdx!==tgtIdx)edges.push([srcIdx,tgtIdx]);
         });

package/packages/core/src/request.ts

@@ -106,7 +106,7 @@ function extractBoundary(contentType: string): string | null {
  * Parse multipart/form-data body into fields and files.
  * Zero-dependency implementation.
  */
-function parseMultipart(
+export function parseMultipart(
   body: Buffer,
   boundary: string,
 ): { fields: Record<string, string>; files: UploadedFile[] } {

package/packages/core/src/router.ts

@@ -413,6 +413,11 @@ export class Router {
           paramNames.push(name);
           return "([^/]+)";
         }
+        // Wildcard: * (catch-all, param key is "*")
+        if (segment === "*") {
+          paramNames.push("*");
+          return "(.+)";
+        }
         return segment;
       })
       .join("/");

package/packages/core/src/server.ts

@@ -29,7 +29,18 @@ const BUILTIN_ERROR_TEMPLATES_DIR = resolve(__dirname, "..", "templates");
 /** Built-in public directory for framework-bundled static assets. */
 const BUILTIN_PUBLIC_DIR = resolve(__dirname, "..", "public");
 
-const TINA4_VERSION = "3.10.30";
+/** Read version from root package.json so the banner always matches the published version. */
+function readPackageVersion(): string {
+  try {
+    const pkgPath = resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    return pkg.version ?? "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+
+const TINA4_VERSION = readPackageVersion();
 
 /** Cache Frond instances by template directory to avoid repeated instantiation. */
 const frondCache = new Map<string, InstanceType<any>>();
@@ -94,7 +105,7 @@ async function renderErrorPage(
   templatesDir: string,
 ): Promise<string | null> {
   try {
-    const { Frond } = await import("@tina4/frond");
+    const { Frond } = await import("../../frond/src/engine.js");
     const templateFile = `errors/${code}.twig`;
 
     // Helper: get-or-create a cached Frond instance for a directory
@@ -494,7 +505,7 @@ ${reset}
   let frondEngine: any = null;
   setDefaultTemplatesDir(templatesDir);
   try {
-    const { Frond } = await import("@tina4/frond");
+    const { Frond } = await import("../../frond/src/engine.js");
     frondEngine = new Frond(templatesDir);
   } catch {
     // Frond not available
@@ -524,7 +535,7 @@ ${reset}
   const hasModelsDir = existsSync(modelsDir);
   if (hasOrmDir || hasModelsDir) {
     try {
-      const orm = await import("@tina4/orm");
+      const orm = await import("../../orm/src/index.js");
       const dbConfig = config?.database ?? {};
       await orm.initDatabase({
         type: dbConfig.type ?? "sqlite",
@@ -572,13 +583,13 @@ ${reset}
 
   // Initialize Swagger
   try {
-    const swagger = await import("@tina4/swagger");
+    const swagger = await import("../../swagger/src/index.js");
     const allRoutes = router.getRoutes();
 
     // Collect model definitions for schema generation
     let modelDefs: Array<{ tableName: string; fields: Record<string, unknown> }> = [];
     try {
-      const orm = await import("@tina4/orm");
+      const orm = await import("../../orm/src/index.js");
       const allModelDirs = [ormDir, modelsDir].filter((d) => existsSync(d));
       const seenTables = new Set<string>();
       for (const dir of allModelDirs) {
@@ -662,7 +673,17 @@ ${reset}
       const requestId = Date.now().toString(36);
 
       // Wrap res.raw.end to inject dev toolbar and capture requests
-      if (isDevMode() && !pathname.startsWith("/__dev")) {
+      // Skip toolbar injection on the AI port (no-reload behaviour)
+      const isAiPortRequest = !!(rawReq as any)._tina4AiPort;
+
+      // AI port: block /__dev_reload so AI tools never trigger a browser reload
+      if (isAiPortRequest && pathname === "/__dev_reload") {
+        res.raw.writeHead(404, { "Content-Type": "application/json" });
+        res.raw.end(JSON.stringify({ error: "Not available on AI port" }));
+        return;
+      }
+
+      if (isDevMode() && !pathname.startsWith("/__dev") && !isAiPortRequest) {
         const originalEnd = res.raw.end.bind(res.raw);
 
         const wrappedEnd: typeof res.raw.end = function (
@@ -730,7 +751,9 @@ ${reset}
         }
 
         // Auth enforcement: secure routes require a valid Bearer token
-        if (match.secure === true && match.noAuth !== true) {
+        // Dev admin routes (/__dev) are always public
+        const isDevAdmin = pathname.startsWith("/__dev");
+        if (match.secure === true && match.noAuth !== true && !isDevAdmin) {
           const authHeader = req.headers.authorization ?? "";
           const token = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
           const secret = process.env.SECRET || "";
@@ -860,7 +883,35 @@ ${reset}
       // Determine server mode label
       const serverMode = isDebug ? "single" : (cluster.isWorker ? "cluster-worker" : "single");
 
+      // AI dual-port: start a second HTTP server on port+1 when in debug mode
+      // and TINA4_NO_AI_PORT is not set. This port serves requests without
+      // dev-reload or toolbar injection so AI coding tools get stable responses.
+      const noAiPort = isTruthy(process.env.TINA4_NO_AI_PORT ?? "");
+      let aiServer: ReturnType<typeof createServer> | null = null;
+      let aiPort = port + 1;
+
+      if (isDebug && !noAiPort) {
+        aiServer = createServer(async (req, res) => {
+          // Tag the request so dispatch knows it came from the AI port
+          (req as any)._tina4AiPort = true;
+          await dispatch(req, res);
+        });
+
+        aiServer.on("error", (err: any) => {
+          if (err.code === "EADDRINUSE") {
+            Log.warn(`AI port ${aiPort} in use — skipping`);
+            aiServer = null;
+          }
+        });
+
+        aiServer.listen(aiPort, host);
+      }
+
       // Banner goes to stdout via console.log — NOT through the framework logger
+      const aiPortLine = (isDebug && !noAiPort)
+        ? `\n  AI Port:   http://localhost:${aiPort} (no-reload)`
+        : "";
+
       console.log(`${color}
   ______ _             __ __
  /_  __/(_)___  ____ _/ // /
@@ -873,14 +924,18 @@ ${reset}
   Server:    http://${displayHost}:${port} (${serverMode})
   Swagger:   http://localhost:${port}/swagger
   Dashboard: http://localhost:${port}/__dev
-  Debug:     ${isDebug ? "ON" : "OFF"} (Log level: ${logLevel})
+  Debug:     ${isDebug ? "ON" : "OFF"} (Log level: ${logLevel})${aiPortLine}
 `);
-      openBrowser(`http://${displayHost}:${port}`);
+      const noBrowser = isTruthy(process.env.TINA4_NO_BROWSER);
+      if (!noBrowser) {
+        openBrowser(`http://${displayHost}:${port}`);
+      }
       resolvePromise({
         close: () => {
+          if (aiServer) aiServer.close();
           server.close();
           // Close database if ORM was initialized
-          import("@tina4/orm").then((orm) => orm.closeDatabase()).catch(() => {});
+          import("../../orm/src/index.js").then((orm) => orm.closeDatabase()).catch(() => {});
         },
         router,
         port,

package/packages/core/src/session.ts

@@ -100,15 +100,23 @@ export class FileSessionHandler implements SessionHandler {
     try {
       if (!existsSync(filePath)) return null;
       const raw = readFileSync(filePath, "utf-8");
-      return JSON.parse(raw) as SessionData;
+      const wrapper = JSON.parse(raw);
+      // Check expiry
+      if (wrapper._expires && wrapper._expires > 0 && Date.now() / 1000 > wrapper._expires) {
+        try { unlinkSync(filePath); } catch { /* ignore */ }
+        return null;
+      }
+      return (wrapper._data ?? wrapper) as SessionData;
     } catch {
       return null;
     }
   }
 
-  write(sessionId: string, data: SessionData, _ttl: number): void {
+  write(sessionId: string, data: SessionData, ttl: number): void {
     this.ensureDir();
-    writeFileSync(this.filePath(sessionId), JSON.stringify(data), "utf-8");
+    const expires = ttl > 0 ? Math.floor(Date.now() / 1000) + ttl : 0;
+    const wrapper = { _data: data, _expires: expires };
+    writeFileSync(this.filePath(sessionId), JSON.stringify(wrapper), "utf-8");
   }
 
   destroy(sessionId: string): void {
@@ -118,7 +126,7 @@ export class FileSessionHandler implements SessionHandler {
     } catch { /* ignore */ }
   }
 
-  gc(maxLifetime: number): void {
+  gc(_maxLifetime: number): void {
     if (!existsSync(this.storagePath)) return;
     const now = Math.floor(Date.now() / 1000);
     try {
@@ -128,8 +136,8 @@ export class FileSessionHandler implements SessionHandler {
         const fullPath = join(this.storagePath, file);
         try {
           const raw = readFileSync(fullPath, "utf-8");
-          const data = JSON.parse(raw) as SessionData;
-          if (data._accessed && (now - data._accessed) > maxLifetime) {
+          const wrapper = JSON.parse(raw);
+          if (wrapper._expires && wrapper._expires > 0 && now > wrapper._expires) {
             unlinkSync(fullPath);
           }
         } catch {