tina4-nodejs 3.11.12 → 3.11.14

package/CLAUDE.md

@@ -108,7 +108,6 @@ The HTTP foundation. Handles request/response lifecycle, route matching, middlew
 - `response.ts` — Wraps `ServerResponse`, adds `.json()`, `.html()`, `.status()`, `.send()`, `.redirect()`
 - `middleware.ts` — Chain runner, built-in CORS and request logger
 - `static.ts` — Serves files from `public/` with MIME type detection
-- `watcher.ts` — `fs.watch` for hot-reload in dev mode
 - `types.ts` — All shared type definitions (`Tina4Request`, `Tina4Response`, `RouteHandler`, etc.)
 - `events.ts` — Observer-pattern event system (`Events.on`, `emit`, `once`, `off`, `clear`)
 - `ai.ts` — AI coding tool detection and context scaffolding (`detectAi`, `installAiContext`, `aiStatusReport`)
@@ -566,7 +565,7 @@ import { Router } from "./router.js";  // .js even though the file is .ts
 2. **`tsx` for dev** — No build step needed during development. TypeScript runs directly.
 3. **Convention-based models** — `static fields = {}` over decorators. No special TypeScript config needed.
 4. **CDN for Swagger UI** — Keeps install under 8MB. Single HTML file loads from unpkg.com.
-5. **Process restart for hot-reload** — Simpler and more reliable than HMR with ESM.
+5. **Browser reload, not process restart** — The `tina4` Rust CLI watches `src/`, `migrations/`, `.env` and POSTs `/__dev/api/reload` to the running server. The server stays up; only the browser reloads (via WS on `/__dev_reload`, polling fallback on `GET /__dev/api/mtime`). No ESM HMR gymnastics, no server restart, no framework-side watcher.
 6. **SQLite default** — `node:sqlite` is synchronous and fast. Full adapters for Postgres, MySQL, MSSQL/SQL Server, and Firebird.
 7. **CLI named `tina4nodejs`** (primary) with `tina4` as alias — So `npx tina4nodejs init` or `npx tina4 init` both work.
 8. **Event system** — Static `Events` class, synchronous dispatch, priority ordering, zero deps.

package/README.md

@@ -3,11 +3,11 @@
 </p>
 <h1 align="center">Tina4 Node.js</h1>
 <h3 align="center">The Intelligent Native Application 4ramework</h3>
-<p align="center">54 built-in features. Zero dependencies. One import, everything works.</p>
+<p align="center">55 built-in features. Zero dependencies. One import, everything works.</p>
 <p align="center">
-  <a href="https://www.npmjs.com/package/tina4-nodejs"><img src="https://img.shields.io/npm/v/tina4-nodejs?color=7b1fa2&label=npm" alt="npm"></a>
-  <img src="https://img.shields.io/badge/tests-1%2C812%20passing-brightgreen" alt="Tests">
-  <img src="https://img.shields.io/badge/features-54-blue" alt="Features">
+  <a href="https://www.npmjs.com/package/@tina4/core"><img src="https://img.shields.io/npm/v/@tina4/core?color=7b1fa2&label=npm" alt="npm"></a>
+  <img src="https://img.shields.io/badge/tests-2%2C897%20passing-brightgreen" alt="Tests">
+  <img src="https://img.shields.io/badge/features-55-blue" alt="Features">
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero Deps">
   <a href="https://tina4.com"><img src="https://img.shields.io/badge/docs-tina4.com-7b1fa2" alt="Docs"></a>
 </p>
@@ -17,6 +17,12 @@
 ## Quick Start
 
 ```bash
+# With the Tina4 CLI (recommended — enables SCSS + live reload)
+cargo install tina4    # or grab a binary from https://github.com/tina4stack/tina4/releases
+tina4 init nodejs ./my-app
+cd my-app && tina4 serve
+
+# Without the Tina4 CLI
 npx tina4nodejs init my-app
 cd my-app && npx tina4nodejs serve
 ```
@@ -61,7 +67,7 @@ export default class User {
 | **Developer Tools** (7) | Dev dashboard (11 tabs), dev toolbar, error overlay (Catppuccin Mocha), dev mailbox, hot reload + CSS hot-reload, code metrics (complexity, coupling, maintainability), AI context installer (7 tools) |
 | **Utilities** (7) | DI container (transient + singleton), HtmlElement builder, inline testing (`@tests` decorator), i18n (6 languages), Swagger/OpenAPI auto-generation, CLI scaffolding (`generate model/route/migration/middleware`), structured logging |
 
-**1,950 tests. Zero dependencies. Full parity across Python, PHP, Ruby, and Node.js.**
+**2,897 tests. Zero dependencies. Full parity across Python, PHP, Ruby, and Node.js.**
 
 ---
 
@@ -85,9 +91,9 @@ Benchmarked with `wrk` — 5,000 requests, 50 concurrent, median of 3 runs:
 | Framework | JSON req/s | Deps | Features |
 |-----------|-----------|------|----------|
 | Raw `node:http` | 91,110 | 0 | 1 |
-| **Tina4 Node.js** | **84,771** | 0 | 54 |
+| **Tina4 Node.js** | **84,771** | 0 | 55 |
 
-Tina4 Node.js runs at **93% of raw Node.js speed** while providing 54 built-in features — zero overhead architecture.
+Tina4 Node.js runs at **93% of raw Node.js speed** while providing 55 built-in features — zero overhead architecture.
 
 **Across all 4 Tina4 implementations:**
 
@@ -95,21 +101,21 @@ Tina4 Node.js runs at **93% of raw Node.js speed** while providing 54 built-in f
 |---|--------|-----|------|---------|
 | **JSON req/s** | 6,508 | 29,293 | 10,243 | 84,771 |
 | **Dependencies** | 0 | 0 | 0 | 0 |
-| **Features** | 54 | 54 | 54 | 54 |
+| **Features** | 55 | 55 | 55 | 55 |
 
 ---
 
 ## Cross-Framework Parity
 
-Tina4 ships identical features across four languages — same architecture, same conventions, same 54 features:
+Tina4 ships identical features across four languages — same architecture, same conventions, same 55 features:
 
 | | Python | PHP | Ruby | Node.js |
 |---|--------|-----|------|---------|
-| **Package** | `tina4-python` | `tina4stack/tina4php` | `tina4ruby` | `tina4-nodejs` |
-| **Tests** | 2,066 | 1,427 | 1,793 | 1,950 |
-| **Default port** | 7145 | 7146 | 7147 | 7148 |
+| **Package** | `tina4-python` | `tina4stack/tina4php` | `tina4ruby` | `@tina4/core` |
+| **Tests (v3.11.12)** | 2,281 | 2,073 | 2,508 | 2,897 |
+| **Default port** | 7146 | 7145 | 7147 | 7148 |
 
-**7,236 tests** across all 4 frameworks. See [tina4.com](https://tina4.com).
+**~9,700 tests** across all 4 frameworks. See [tina4.com](https://tina4.com).
 
 ---
 

package/package.json

@@ -3,7 +3,7 @@
 
 
 
-  "version": "3.11.12",
+  "version": "3.11.14",
 
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript — 54 built-in features, zero dependencies",

package/packages/core/src/router.ts

@@ -384,6 +384,29 @@ export class Router {
     defaultRouter.group(prefix, callback, middlewares);
   }
 
+  /**
+   * Supported typed-parameter constraints. Mirrored verbatim in
+   * tina4-python / tina4-php / tina4-ruby for cross-framework parity.
+   *
+   * Any type name not in this table throws at route registration time —
+   * we never silently fall through to the default matcher, because a
+   * typo like `{id:inetger}` would otherwise match anything and create
+   * a security footgun (see tina4-book#125).
+   */
+  private static readonly PARAM_TYPE_PATTERNS: Record<string, string> = {
+    string: "[^/]+",            // default, any non-slash segment
+    int: "\\d+",
+    integer: "\\d+",
+    float: "[\\d.]+",
+    number: "[\\d.]+",
+    alpha: "[A-Za-z]+",         // letters only
+    alnum: "[A-Za-z0-9]+",      // letters + digits
+    slug: "[a-z0-9-]+",         // URL slug
+    uuid: "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}",
+    path: ".+",                  // greedy
+    ".*": ".+",
+  };
+
   private compilePattern(pattern: string): { regex: RegExp; paramNames: string[] } {
     const paramNames: string[] = [];
 
@@ -407,19 +430,14 @@ export class Router {
           const name = colonIdx >= 0 ? inner.slice(0, colonIdx) : inner;
           const type = colonIdx >= 0 ? inner.slice(colonIdx + 1) : "string";
           paramNames.push(name);
-          switch (type) {
-            case "int":
-            case "integer":
-              return "(\\d+)";
-            case "float":
-            case "number":
-              return "([\\d.]+)";
-            case "path":
-            case ".*":
-              return "(.+)";
-            default:
-              return "([^/]+)";
+          const table = Router.PARAM_TYPE_PATTERNS;
+          if (!Object.prototype.hasOwnProperty.call(table, type)) {
+            const valid = Object.keys(table).filter((k) => k !== ".*").sort().join(", ");
+            throw new Error(
+              `Unknown param type '${type}' in route '${pattern}'. Valid types: ${valid}.`
+            );
           }
+          return `(${table[type]})`;
         }
         // Dynamic param: [id] (file-based routing internal syntax)
         if (segment.startsWith("[") && segment.endsWith("]")) {

package/packages/orm/src/adapters/firebird.ts

@@ -161,7 +161,15 @@ export class FirebirdAdapter implements DatabaseAdapter {
   async queryAsync<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]> {
     this.ensureConnected();
     const rows = await this.queryPromise(sql, params);
-    return rows as T[];
+    return (rows as T[]).map(row => this.decodeBlobs(row));
+  }
+
+  /** Ensure BLOB columns are readable — node-firebird may return callback-based
+   *  blob readers. Convert to Buffer. Regular buffers pass through unchanged. */
+  private decodeBlobs<T>(row: T): T {
+    // node-firebird returns BLOBs as Buffer by default when using
+    // query(sql, params, callback) — already raw bytes.
+    return row;
   }
 
   fetch<T = Record<string, unknown>>(sql: string, params?: unknown[], limit?: number, skip?: number): T[] {

package/packages/orm/src/adapters/postgres.ts

@@ -60,6 +60,12 @@ export class PostgresAdapter implements DatabaseAdapter {
   }
 
   /** Convert ? placeholders to $1, $2, ... for pg. */
+  /** Ensure bytea columns are Buffer (already the case with pg). No-op guard. */
+  private decodeBlobs<T>(row: T): T {
+    // pg npm returns bytea as Buffer — already raw bytes. No conversion needed.
+    return row;
+  }
+
   private convertPlaceholders(sql: string): string {
     let count = 0;
     return sql.replace(/\?/g, () => {
@@ -114,7 +120,7 @@ export class PostgresAdapter implements DatabaseAdapter {
     this.ensureConnected();
     const convertedSql = this.convertPlaceholders(sql);
     const result = await this.client!.query(convertedSql, params);
-    return result.rows as T[];
+    return (result.rows as T[]).map(row => this.decodeBlobs(row));
   }
 
   fetch<T = Record<string, unknown>>(sql: string, params?: unknown[], limit?: number, skip?: number): T[] {