tina4-nodejs 3.13.108 → 3.13.109

package/CLAUDE.md

@@ -1,10 +1,10 @@
-# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.108)
+# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.109)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 
 ## What This Project Is
 
-Tina4 for Node.js/TypeScript v3.13.108 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
+Tina4 for Node.js/TypeScript v3.13.109 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
 
 The philosophy: zero ceremony, batteries included, file system as source of truth.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tina4-nodejs",
-  "version": "3.13.108",
+  "version": "3.13.109",
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts",
   "keywords": [

package/packages/cli/dist/bin.js

@@ -17767,11 +17767,32 @@ function varyFields(raw) {
   const text = Array.isArray(raw) ? raw.join(",") : String(raw);
   return text.split(",").map((f) => f.trim().toLowerCase()).filter((f) => f !== "");
 }
-function mayStore(req2, vary, cacheControl) {
+function cacheControlTokens(raw) {
+  const text = Array.isArray(raw) ? raw.join(",") : String(raw ?? "");
+  const tokens = /* @__PURE__ */ new Set();
+  for (const token of text.split(",")) {
+    const name = token.split("=")[0].trim().toLowerCase();
+    if (name !== "") tokens.add(name);
+  }
+  return tokens;
+}
+function sharedCacheAllowed(cacheControl) {
+  const directives = cacheControlTokens(cacheControl);
+  return SHARED_CACHE_DIRECTIVES.some((directive) => directives.has(directive));
+}
+function hasSetCookie(raw) {
+  if (raw === void 0 || raw === null) return false;
+  if (Array.isArray(raw)) return raw.length > 0;
+  return String(raw) !== "";
+}
+function mayStore(req2, vary, cacheControl, setCookie) {
   if (vary.includes("*")) return false;
-  if (requestHeader(req2, "authorization") === void 0) return true;
-  const cc = String(cacheControl ?? "").toLowerCase();
-  return SHARED_CACHE_DIRECTIVES.some((directive) => cc.includes(directive));
+  const directives = cacheControlTokens(cacheControl);
+  if (NO_STORE_DIRECTIVES.some((directive) => directives.has(directive))) return false;
+  if (requestHeader(req2, "authorization") !== void 0) return sharedCacheAllowed(cacheControl);
+  if (requestHeader(req2, "cookie") !== void 0) return sharedCacheAllowed(cacheControl);
+  if (hasSetCookie(setCookie)) return sharedCacheAllowed(cacheControl);
+  return true;
 }
 function varyMatches(entry, req2) {
   const vary = entry.vary ?? [];
@@ -17804,7 +17825,7 @@ function responseCache(config) {
     let captured = false;
     res.raw.end = function(chunk, ...args) {
       const vary = varyFields(res.raw.getHeader("Vary"));
-      if (!captured && allowedCodes.has(res.raw.statusCode) && mayStore(req2, vary, res.raw.getHeader("Cache-Control"))) {
+      if (!captured && allowedCodes.has(res.raw.statusCode) && mayStore(req2, vary, res.raw.getHeader("Cache-Control"), res.raw.getHeader("Set-Cookie"))) {
         captured = true;
         const body = typeof chunk === "string" ? chunk : chunk?.toString() ?? "";
         const contentType = String(res.raw.getHeader("Content-Type") ?? "application/octet-stream");
@@ -17891,7 +17912,7 @@ function _resetBackend() {
   _explicitResponseBackends.clear();
   _defaultTtl = null;
 }
-var MemoryBackend, RespClient, RedisBackend, ValkeyBackend, FileBackend, MemcachedClient, MemcachedBackend, MongoBackend, DatabaseBackend, _responseBackend, _responseBackendPromise, _explicitResponseBackends, SHARED_CACHE_DIRECTIVES, _defaultBackend, _defaultBackendPromise, _defaultTtl;
+var MemoryBackend, RespClient, RedisBackend, ValkeyBackend, FileBackend, MemcachedClient, MemcachedBackend, MongoBackend, DatabaseBackend, _responseBackend, _responseBackendPromise, _explicitResponseBackends, SHARED_CACHE_DIRECTIVES, NO_STORE_DIRECTIVES, _defaultBackend, _defaultBackendPromise, _defaultTtl;
 var init_cache = __esm({
   "../core/src/cache.ts"() {
     "use strict";
@@ -19057,6 +19078,7 @@ ${data}\r
     _responseBackendPromise = null;
     _explicitResponseBackends = /* @__PURE__ */ new Map();
     SHARED_CACHE_DIRECTIVES = ["public", "s-maxage", "must-revalidate"];
+    NO_STORE_DIRECTIVES = ["no-store", "private", "no-cache"];
     _defaultBackend = null;
     _defaultBackendPromise = null;
     _defaultTtl = null;

package/packages/core/dist/index.js

@@ -17766,11 +17766,32 @@ function varyFields(raw) {
   const text = Array.isArray(raw) ? raw.join(",") : String(raw);
   return text.split(",").map((f) => f.trim().toLowerCase()).filter((f) => f !== "");
 }
-function mayStore(req2, vary, cacheControl) {
+function cacheControlTokens(raw) {
+  const text = Array.isArray(raw) ? raw.join(",") : String(raw ?? "");
+  const tokens = /* @__PURE__ */ new Set();
+  for (const token of text.split(",")) {
+    const name = token.split("=")[0].trim().toLowerCase();
+    if (name !== "") tokens.add(name);
+  }
+  return tokens;
+}
+function sharedCacheAllowed(cacheControl) {
+  const directives = cacheControlTokens(cacheControl);
+  return SHARED_CACHE_DIRECTIVES.some((directive) => directives.has(directive));
+}
+function hasSetCookie(raw) {
+  if (raw === void 0 || raw === null) return false;
+  if (Array.isArray(raw)) return raw.length > 0;
+  return String(raw) !== "";
+}
+function mayStore(req2, vary, cacheControl, setCookie) {
   if (vary.includes("*")) return false;
-  if (requestHeader(req2, "authorization") === void 0) return true;
-  const cc = String(cacheControl ?? "").toLowerCase();
-  return SHARED_CACHE_DIRECTIVES.some((directive) => cc.includes(directive));
+  const directives = cacheControlTokens(cacheControl);
+  if (NO_STORE_DIRECTIVES.some((directive) => directives.has(directive))) return false;
+  if (requestHeader(req2, "authorization") !== void 0) return sharedCacheAllowed(cacheControl);
+  if (requestHeader(req2, "cookie") !== void 0) return sharedCacheAllowed(cacheControl);
+  if (hasSetCookie(setCookie)) return sharedCacheAllowed(cacheControl);
+  return true;
 }
 function varyMatches(entry, req2) {
   const vary = entry.vary ?? [];
@@ -17803,7 +17824,7 @@ function responseCache(config) {
     let captured = false;
     res.raw.end = function(chunk, ...args) {
       const vary = varyFields(res.raw.getHeader("Vary"));
-      if (!captured && allowedCodes.has(res.raw.statusCode) && mayStore(req2, vary, res.raw.getHeader("Cache-Control"))) {
+      if (!captured && allowedCodes.has(res.raw.statusCode) && mayStore(req2, vary, res.raw.getHeader("Cache-Control"), res.raw.getHeader("Set-Cookie"))) {
         captured = true;
         const body = typeof chunk === "string" ? chunk : chunk?.toString() ?? "";
         const contentType = String(res.raw.getHeader("Content-Type") ?? "application/octet-stream");
@@ -17890,7 +17911,7 @@ function _resetBackend() {
   _explicitResponseBackends.clear();
   _defaultTtl = null;
 }
-var MemoryBackend, RespClient, RedisBackend, ValkeyBackend, FileBackend, MemcachedClient, MemcachedBackend, MongoBackend, DatabaseBackend, _responseBackend, _responseBackendPromise, _explicitResponseBackends, SHARED_CACHE_DIRECTIVES, _defaultBackend, _defaultBackendPromise, _defaultTtl;
+var MemoryBackend, RespClient, RedisBackend, ValkeyBackend, FileBackend, MemcachedClient, MemcachedBackend, MongoBackend, DatabaseBackend, _responseBackend, _responseBackendPromise, _explicitResponseBackends, SHARED_CACHE_DIRECTIVES, NO_STORE_DIRECTIVES, _defaultBackend, _defaultBackendPromise, _defaultTtl;
 var init_cache = __esm({
   "src/cache.ts"() {
     "use strict";
@@ -19056,6 +19077,7 @@ ${data}\r
     _responseBackendPromise = null;
     _explicitResponseBackends = /* @__PURE__ */ new Map();
     SHARED_CACHE_DIRECTIVES = ["public", "s-maxage", "must-revalidate"];
+    NO_STORE_DIRECTIVES = ["no-store", "private", "no-cache"];
     _defaultBackend = null;
     _defaultBackendPromise = null;
     _defaultTtl = null;

package/packages/core/src/cache.ts

@@ -1629,6 +1629,14 @@ export function _getResponseBackend(config?: ResponseCacheConfig): Promise<Cache
  */
 const SHARED_CACHE_DIRECTIVES = ["public", "s-maxage", "must-revalidate"];
 
+/**
+ * Response directives that forbid storing the response here (RFC 9111 s3):
+ * `no-store` forbids storage in any cache, `private` and `no-cache` in a shared
+ * one. Before this was honoured a handler had no way to keep a response out of
+ * the cache — setting the correct standard header did nothing.
+ */
+const NO_STORE_DIRECTIVES = ["no-store", "private", "no-cache"];
+
 /** Case-insensitive request header lookup. */
 function requestHeader(req: { headers?: Record<string, unknown> }, name: string): string | undefined {
   const headers = req?.headers;
@@ -1650,22 +1658,67 @@ function varyFields(raw: unknown): string[] {
 }
 
 /**
- * May a SHARED cache store this response? (RFC 9111 s3, s4.1)
+ * The lower-cased Cache-Control directive NAMES on a header value, as a set.
  *
- * s3 — "if the cache is shared: the Authorization header field is not present
- * in the request ... or a response directive is present that explicitly allows
- * shared caching". The key is method + URL only, and on Node the cache answers
- * BEFORE the auth gate, so without this an anonymous caller was served an
- * authenticated caller's body with a 200.
+ * Parsed as comma-separated tokens with any `=value` stripped, rather than by
+ * substring search, so `no-cache="Set-Cookie"` is recognised as `no-cache` and
+ * a directive name never matches as a fragment of a longer one.
+ */
+function cacheControlTokens(raw: unknown): Set<string> {
+  const text = Array.isArray(raw) ? raw.join(",") : String(raw ?? "");
+  const tokens = new Set<string>();
+  for (const token of text.split(",")) {
+    const name = token.split("=")[0].trim().toLowerCase();
+    if (name !== "") tokens.add(name);
+  }
+  return tokens;
+}
+
+/** Does the response Cache-Control carry a directive that lets a SHARED cache store it? */
+function sharedCacheAllowed(cacheControl: unknown): boolean {
+  const directives = cacheControlTokens(cacheControl);
+  return SHARED_CACHE_DIRECTIVES.some((directive) => directives.has(directive));
+}
+
+/** Is a Set-Cookie response header present? Any non-empty value (it may be an array). */
+function hasSetCookie(raw: unknown): boolean {
+  if (raw === undefined || raw === null) return false;
+  if (Array.isArray(raw)) return raw.length > 0;
+  return String(raw) !== "";
+}
+
+/**
+ * May a SHARED cache store this response? (RFC 9111 s3, s4.1)
  *
  * s4.1 — a stored response whose Vary contains "*" "always fails to match", so
  * storing one is pointless.
+ *
+ * s3 — a shared cache may store a response only when it is not marked
+ * un-storable and is not built for one specific caller:
+ *
+ * - `no-store`/`private`/`no-cache` on the response forbid storing it here, so a
+ *   handler can always opt a body out of the cache with the standard header.
+ * - The key is method + URL only, and on Node the cache answers BEFORE the auth
+ *   gate, so a response built for one caller replays to whoever asks for that URL
+ *   next. Authorization marks such a caller — and so does a session Cookie on the
+ *   request (Tina4's own session mechanism IS a cookie), and a Set-Cookie on the
+ *   response (it installs a per-caller session). All three are storable only when
+ *   the response opts in with an explicit shared-cache directive, which keeps a
+ *   genuinely public page cacheable for cookie-bearing browsers.
  */
-function mayStore(req: { headers?: Record<string, unknown> }, vary: string[], cacheControl: unknown): boolean {
+function mayStore(
+  req: { headers?: Record<string, unknown> },
+  vary: string[],
+  cacheControl: unknown,
+  setCookie: unknown,
+): boolean {
   if (vary.includes("*")) return false;
-  if (requestHeader(req, "authorization") === undefined) return true;
-  const cc = String(cacheControl ?? "").toLowerCase();
-  return SHARED_CACHE_DIRECTIVES.some((directive) => cc.includes(directive));
+  const directives = cacheControlTokens(cacheControl);
+  if (NO_STORE_DIRECTIVES.some((directive) => directives.has(directive))) return false;
+  if (requestHeader(req, "authorization") !== undefined) return sharedCacheAllowed(cacheControl);
+  if (requestHeader(req, "cookie") !== undefined) return sharedCacheAllowed(cacheControl);
+  if (hasSetCookie(setCookie)) return sharedCacheAllowed(cacheControl);
+  return true;
 }
 
 /**
@@ -1722,7 +1775,7 @@ export function responseCache(config?: ResponseCacheConfig): Middleware {
     res.raw.end = function (chunk?: any, ...args: any[]) {
       const vary = varyFields(res.raw.getHeader("Vary"));
       if (!captured && allowedCodes.has(res.raw.statusCode)
-          && mayStore(req as any, vary, res.raw.getHeader("Cache-Control"))) {
+          && mayStore(req as any, vary, res.raw.getHeader("Cache-Control"), res.raw.getHeader("Set-Cookie"))) {
         captured = true;
         const body = typeof chunk === "string" ? chunk : chunk?.toString() ?? "";
         const contentType = String(res.raw.getHeader("Content-Type") ?? "application/octet-stream");

package/packages/orm/dist/index.js

@@ -6909,11 +6909,32 @@ function varyFields(raw) {
   const text = Array.isArray(raw) ? raw.join(",") : String(raw);
   return text.split(",").map((f) => f.trim().toLowerCase()).filter((f) => f !== "");
 }
-function mayStore(req2, vary, cacheControl) {
+function cacheControlTokens(raw) {
+  const text = Array.isArray(raw) ? raw.join(",") : String(raw ?? "");
+  const tokens = /* @__PURE__ */ new Set();
+  for (const token of text.split(",")) {
+    const name = token.split("=")[0].trim().toLowerCase();
+    if (name !== "") tokens.add(name);
+  }
+  return tokens;
+}
+function sharedCacheAllowed(cacheControl) {
+  const directives = cacheControlTokens(cacheControl);
+  return SHARED_CACHE_DIRECTIVES.some((directive) => directives.has(directive));
+}
+function hasSetCookie(raw) {
+  if (raw === void 0 || raw === null) return false;
+  if (Array.isArray(raw)) return raw.length > 0;
+  return String(raw) !== "";
+}
+function mayStore(req2, vary, cacheControl, setCookie) {
   if (vary.includes("*")) return false;
-  if (requestHeader(req2, "authorization") === void 0) return true;
-  const cc = String(cacheControl ?? "").toLowerCase();
-  return SHARED_CACHE_DIRECTIVES.some((directive) => cc.includes(directive));
+  const directives = cacheControlTokens(cacheControl);
+  if (NO_STORE_DIRECTIVES.some((directive) => directives.has(directive))) return false;
+  if (requestHeader(req2, "authorization") !== void 0) return sharedCacheAllowed(cacheControl);
+  if (requestHeader(req2, "cookie") !== void 0) return sharedCacheAllowed(cacheControl);
+  if (hasSetCookie(setCookie)) return sharedCacheAllowed(cacheControl);
+  return true;
 }
 function varyMatches(entry, req2) {
   const vary = entry.vary ?? [];
@@ -6946,7 +6967,7 @@ function responseCache(config) {
     let captured = false;
     res.raw.end = function(chunk, ...args) {
       const vary = varyFields(res.raw.getHeader("Vary"));
-      if (!captured && allowedCodes.has(res.raw.statusCode) && mayStore(req2, vary, res.raw.getHeader("Cache-Control"))) {
+      if (!captured && allowedCodes.has(res.raw.statusCode) && mayStore(req2, vary, res.raw.getHeader("Cache-Control"), res.raw.getHeader("Set-Cookie"))) {
         captured = true;
         const body = typeof chunk === "string" ? chunk : chunk?.toString() ?? "";
         const contentType = String(res.raw.getHeader("Content-Type") ?? "application/octet-stream");
@@ -7033,7 +7054,7 @@ function _resetBackend() {
   _explicitResponseBackends.clear();
   _defaultTtl = null;
 }
-var MemoryBackend, RespClient, RedisBackend, ValkeyBackend, FileBackend, MemcachedClient, MemcachedBackend, MongoBackend, DatabaseBackend, _responseBackend, _responseBackendPromise, _explicitResponseBackends, SHARED_CACHE_DIRECTIVES, _defaultBackend, _defaultBackendPromise, _defaultTtl;
+var MemoryBackend, RespClient, RedisBackend, ValkeyBackend, FileBackend, MemcachedClient, MemcachedBackend, MongoBackend, DatabaseBackend, _responseBackend, _responseBackendPromise, _explicitResponseBackends, SHARED_CACHE_DIRECTIVES, NO_STORE_DIRECTIVES, _defaultBackend, _defaultBackendPromise, _defaultTtl;
 var init_cache = __esm({
   "../core/src/cache.ts"() {
     "use strict";
@@ -8199,6 +8220,7 @@ ${data}\r
     _responseBackendPromise = null;
     _explicitResponseBackends = /* @__PURE__ */ new Map();
     SHARED_CACHE_DIRECTIVES = ["public", "s-maxage", "must-revalidate"];
+    NO_STORE_DIRECTIVES = ["no-store", "private", "no-cache"];
     _defaultBackend = null;
     _defaultBackendPromise = null;
     _defaultTtl = null;