tina4-nodejs 3.11.11 → 3.11.13

package/CLAUDE.md

@@ -108,7 +108,6 @@ The HTTP foundation. Handles request/response lifecycle, route matching, middlew
 - `response.ts` — Wraps `ServerResponse`, adds `.json()`, `.html()`, `.status()`, `.send()`, `.redirect()`
 - `middleware.ts` — Chain runner, built-in CORS and request logger
 - `static.ts` — Serves files from `public/` with MIME type detection
-- `watcher.ts` — `fs.watch` for hot-reload in dev mode
 - `types.ts` — All shared type definitions (`Tina4Request`, `Tina4Response`, `RouteHandler`, etc.)
 - `events.ts` — Observer-pattern event system (`Events.on`, `emit`, `once`, `off`, `clear`)
 - `ai.ts` — AI coding tool detection and context scaffolding (`detectAi`, `installAiContext`, `aiStatusReport`)
@@ -566,7 +565,7 @@ import { Router } from "./router.js";  // .js even though the file is .ts
 2. **`tsx` for dev** — No build step needed during development. TypeScript runs directly.
 3. **Convention-based models** — `static fields = {}` over decorators. No special TypeScript config needed.
 4. **CDN for Swagger UI** — Keeps install under 8MB. Single HTML file loads from unpkg.com.
-5. **Process restart for hot-reload** — Simpler and more reliable than HMR with ESM.
+5. **Browser reload, not process restart** — The `tina4` Rust CLI watches `src/`, `migrations/`, `.env` and POSTs `/__dev/api/reload` to the running server. The server stays up; only the browser reloads (via WS on `/__dev_reload`, polling fallback on `GET /__dev/api/mtime`). No ESM HMR gymnastics, no server restart, no framework-side watcher.
 6. **SQLite default** — `node:sqlite` is synchronous and fast. Full adapters for Postgres, MySQL, MSSQL/SQL Server, and Firebird.
 7. **CLI named `tina4nodejs`** (primary) with `tina4` as alias — So `npx tina4nodejs init` or `npx tina4 init` both work.
 8. **Event system** — Static `Events` class, synchronous dispatch, priority ordering, zero deps.

package/README.md

@@ -3,11 +3,11 @@
 </p>
 <h1 align="center">Tina4 Node.js</h1>
 <h3 align="center">The Intelligent Native Application 4ramework</h3>
-<p align="center">54 built-in features. Zero dependencies. One import, everything works.</p>
+<p align="center">55 built-in features. Zero dependencies. One import, everything works.</p>
 <p align="center">
-  <a href="https://www.npmjs.com/package/tina4-nodejs"><img src="https://img.shields.io/npm/v/tina4-nodejs?color=7b1fa2&label=npm" alt="npm"></a>
-  <img src="https://img.shields.io/badge/tests-1%2C812%20passing-brightgreen" alt="Tests">
-  <img src="https://img.shields.io/badge/features-54-blue" alt="Features">
+  <a href="https://www.npmjs.com/package/@tina4/core"><img src="https://img.shields.io/npm/v/@tina4/core?color=7b1fa2&label=npm" alt="npm"></a>
+  <img src="https://img.shields.io/badge/tests-2%2C897%20passing-brightgreen" alt="Tests">
+  <img src="https://img.shields.io/badge/features-55-blue" alt="Features">
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero Deps">
   <a href="https://tina4.com"><img src="https://img.shields.io/badge/docs-tina4.com-7b1fa2" alt="Docs"></a>
 </p>
@@ -17,6 +17,12 @@
 ## Quick Start
 
 ```bash
+# With the Tina4 CLI (recommended — enables SCSS + live reload)
+cargo install tina4    # or grab a binary from https://github.com/tina4stack/tina4/releases
+tina4 init nodejs ./my-app
+cd my-app && tina4 serve
+
+# Without the Tina4 CLI
 npx tina4nodejs init my-app
 cd my-app && npx tina4nodejs serve
 ```
@@ -61,7 +67,7 @@ export default class User {
 | **Developer Tools** (7) | Dev dashboard (11 tabs), dev toolbar, error overlay (Catppuccin Mocha), dev mailbox, hot reload + CSS hot-reload, code metrics (complexity, coupling, maintainability), AI context installer (7 tools) |
 | **Utilities** (7) | DI container (transient + singleton), HtmlElement builder, inline testing (`@tests` decorator), i18n (6 languages), Swagger/OpenAPI auto-generation, CLI scaffolding (`generate model/route/migration/middleware`), structured logging |
 
-**1,950 tests. Zero dependencies. Full parity across Python, PHP, Ruby, and Node.js.**
+**2,897 tests. Zero dependencies. Full parity across Python, PHP, Ruby, and Node.js.**
 
 ---
 
@@ -85,9 +91,9 @@ Benchmarked with `wrk` — 5,000 requests, 50 concurrent, median of 3 runs:
 | Framework | JSON req/s | Deps | Features |
 |-----------|-----------|------|----------|
 | Raw `node:http` | 91,110 | 0 | 1 |
-| **Tina4 Node.js** | **84,771** | 0 | 54 |
+| **Tina4 Node.js** | **84,771** | 0 | 55 |
 
-Tina4 Node.js runs at **93% of raw Node.js speed** while providing 54 built-in features — zero overhead architecture.
+Tina4 Node.js runs at **93% of raw Node.js speed** while providing 55 built-in features — zero overhead architecture.
 
 **Across all 4 Tina4 implementations:**
 
@@ -95,21 +101,21 @@ Tina4 Node.js runs at **93% of raw Node.js speed** while providing 54 built-in f
 |---|--------|-----|------|---------|
 | **JSON req/s** | 6,508 | 29,293 | 10,243 | 84,771 |
 | **Dependencies** | 0 | 0 | 0 | 0 |
-| **Features** | 54 | 54 | 54 | 54 |
+| **Features** | 55 | 55 | 55 | 55 |
 
 ---
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages — same architecture, same conventions, same 54 features:
+Tina4 ships identical features across four languages — same architecture, same conventions, same 55 features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|
-| **Package** | `tina4-python` | `tina4stack/tina4php` | `tina4ruby` | `tina4-nodejs` |
-| **Tests** | 2,066 | 1,427 | 1,793 | 1,950 |
-| **Default port** | 7145 | 7146 | 7147 | 7148 |
+| **Package** | `tina4-python` | `tina4stack/tina4php` | `tina4ruby` | `@tina4/core` |
+| **Tests (v3.11.12)** | 2,281 | 2,073 | 2,508 | 2,897 |
+| **Default port** | 7146 | 7145 | 7147 | 7148 |
 
-**7,236 tests** across all 4 frameworks. See [tina4.com](https://tina4.com).
+**~9,700 tests** across all 4 frameworks. See [tina4.com](https://tina4.com).
 
 ---
 

package/package.json

@@ -3,7 +3,7 @@
 
 
 
-  "version": "3.11.11",
+  "version": "3.11.13",
 
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript — 54 built-in features, zero dependencies",

package/packages/core/src/router.ts

@@ -384,6 +384,29 @@ export class Router {
     defaultRouter.group(prefix, callback, middlewares);
   }
 
+  /**
+   * Supported typed-parameter constraints. Mirrored verbatim in
+   * tina4-python / tina4-php / tina4-ruby for cross-framework parity.
+   *
+   * Any type name not in this table throws at route registration time —
+   * we never silently fall through to the default matcher, because a
+   * typo like `{id:inetger}` would otherwise match anything and create
+   * a security footgun (see tina4-book#125).
+   */
+  private static readonly PARAM_TYPE_PATTERNS: Record<string, string> = {
+    string: "[^/]+",            // default, any non-slash segment
+    int: "\\d+",
+    integer: "\\d+",
+    float: "[\\d.]+",
+    number: "[\\d.]+",
+    alpha: "[A-Za-z]+",         // letters only
+    alnum: "[A-Za-z0-9]+",      // letters + digits
+    slug: "[a-z0-9-]+",         // URL slug
+    uuid: "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}",
+    path: ".+",                  // greedy
+    ".*": ".+",
+  };
+
   private compilePattern(pattern: string): { regex: RegExp; paramNames: string[] } {
     const paramNames: string[] = [];
 
@@ -407,19 +430,14 @@ export class Router {
           const name = colonIdx >= 0 ? inner.slice(0, colonIdx) : inner;
           const type = colonIdx >= 0 ? inner.slice(colonIdx + 1) : "string";
           paramNames.push(name);
-          switch (type) {
-            case "int":
-            case "integer":
-              return "(\\d+)";
-            case "float":
-            case "number":
-              return "([\\d.]+)";
-            case "path":
-            case ".*":
-              return "(.+)";
-            default:
-              return "([^/]+)";
+          const table = Router.PARAM_TYPE_PATTERNS;
+          if (!Object.prototype.hasOwnProperty.call(table, type)) {
+            const valid = Object.keys(table).filter((k) => k !== ".*").sort().join(", ");
+            throw new Error(
+              `Unknown param type '${type}' in route '${pattern}'. Valid types: ${valid}.`
+            );
           }
+          return `(${table[type]})`;
         }
         // Dynamic param: [id] (file-based routing internal syntax)
         if (segment.startsWith("[") && segment.endsWith("]")) {

package/packages/orm/src/adapters/sqlite.ts

@@ -1,17 +1,48 @@
 import { DatabaseSync } from "node:sqlite";
 import { mkdirSync } from "node:fs";
-import { dirname } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import type { DatabaseAdapter, DatabaseResult, ColumnInfo, FieldDefinition } from "../types.js";
 
+/**
+ * Resolve a SQLite path argument against the project root (cwd).
+ *
+ * Matches the tina4-python + tina4-php convention:
+ *   ":memory:"         → passthrough
+ *   "data/app.db"      → {cwd}/data/app.db  (auto-mkdir under cwd)
+ *   "/abs/app.db"      → /abs/app.db        (NO auto-mkdir; user's responsibility)
+ *   "C:/Users/app.db"  → C:/Users/app.db    (NO auto-mkdir)
+ *
+ * Never mkdir a directory that isn't a descendant of cwd — that was the
+ * root cause of the `EROFS: read-only file system, mkdir '/data'` crash
+ * reported on macOS.
+ */
+function resolveSqlitePath(dbPath: string): string {
+  if (dbPath === ":memory:") return dbPath;
+
+  let path = dbPath;
+  if (!isAbsolute(path)) {
+    path = join(process.cwd(), path);
+    // Auto-mkdir is safe here — we know the parent is under cwd
+    mkdirSync(dirname(path), { recursive: true });
+  } else {
+    // Absolute path. Only auto-mkdir if it's a descendant of cwd.
+    const cwd = resolve(process.cwd());
+    const abs = resolve(path);
+    if (abs.startsWith(cwd + "/") || abs === cwd) {
+      mkdirSync(dirname(abs), { recursive: true });
+    }
+    // Otherwise, trust the user — don't touch the filesystem.
+  }
+  return path;
+}
+
 export class SQLiteAdapter implements DatabaseAdapter {
   private db: DatabaseSync;
   private _lastInsertId: number | bigint | null = null;
 
   constructor(dbPath: string) {
-    if (dbPath !== ":memory:") {
-      mkdirSync(dirname(dbPath), { recursive: true });
-    }
-    this.db = new DatabaseSync(dbPath);
+    const resolved = resolveSqlitePath(dbPath);
+    this.db = new DatabaseSync(resolved);
     this.db.exec("PRAGMA journal_mode = WAL");
     this.db.exec("PRAGMA foreign_keys = ON");
   }

package/packages/orm/src/database.ts

@@ -92,18 +92,31 @@ export interface ParsedDatabaseUrl {
 export function parseDatabaseUrl(url: string, username?: string, password?: string): ParsedDatabaseUrl {
   let result: ParsedDatabaseUrl;
 
-  // Handle sqlite:// separately because URL class mangles the path
-  if (url.startsWith("sqlite:///")) {
-    // sqlite:///absolute/path — three slashes means absolute
-    let path = url.slice("sqlite://".length);
-    // Windows: sqlite:///C:/Users/app.db → /C:/Users/app.db after slicing.
-    // The leading / before the drive letter must be removed.
-    if (/^\/[A-Za-z]:/.test(path)) {
-      path = path.slice(1);
-    }
-    result = { type: "sqlite", path };
+  // Handle sqlite:// separately because URL class mangles the path.
+  //
+  // Convention (matches tina4-python, tina4-php, and the docs):
+  //   sqlite::memory:              → in-memory
+  //   sqlite:///:memory:           → in-memory (URL form)
+  //   sqlite:///app.db             → ./app.db (relative to cwd)
+  //   sqlite:///data/app.db        → ./data/app.db (relative)
+  //   sqlite:////absolute/app.db   → /absolute/app.db (absolute)
+  //   sqlite:///C:/Users/app.db    → C:/Users/app.db (Windows absolute)
+  if (url === "sqlite::memory:" || url === "sqlite:///:memory:") {
+    result = { type: "sqlite", path: ":memory:" };
+  } else if (url.startsWith("sqlite:///")) {
+    // Strip the "sqlite://" prefix (leaving one "/" + path)
+    let rest = url.slice("sqlite://".length); // e.g. "/data/app.db" or "//abs/app.db" or "/C:/Users/..."
+    // Drop exactly one leading "/"
+    if (rest.startsWith("/")) rest = rest.slice(1);
+    // Windows absolute: C:/Users/app.db or C:\...
+    const isWindowsAbs = /^[A-Za-z]:[\/\\]/.test(rest);
+    // Unix absolute: still starts with "/" after the strip (four-slash URL form)
+    const isUnixAbs = rest.startsWith("/");
+    result = { type: "sqlite", path: isWindowsAbs || isUnixAbs ? rest : rest };
+    // Relative paths are resolved against cwd by the SQLite adapter at connect time;
+    // keep the string as-is here so tests can inspect the raw form.
   } else if (url.startsWith("sqlite://")) {
-    // sqlite://./relative or sqlite://relative
+    // sqlite://./relative or sqlite://relative — legacy two-slash form
     const path = url.slice("sqlite://".length);
     result = { type: "sqlite", path };
   } else if (url.startsWith("mssql://") || url.startsWith("sqlserver://")) {