tina4-nodejs 3.13.121 → 3.13.123

package/CLAUDE.md

@@ -13,13 +13,13 @@ Even if the skill text is not currently loaded, these are non-negotiable:
 
 The full discipline lives in `.claude/skills/tina4-maintainer/SKILL.md`; this block is the always-on floor.
 
-# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.121)
+# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.123)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 
 ## What This Project Is
 
-Tina4 for Node.js/TypeScript v3.13.121 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
+Tina4 for Node.js/TypeScript v3.13.123 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
 
 The philosophy: zero ceremony, batteries included, file system as source of truth.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tina4-nodejs",
-  "version": "3.13.121",
+  "version": "3.13.123",
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript - native TypeScript conventions and shared Tina4 contracts",
   "keywords": [

package/packages/cli/dist/bin.js

@@ -5339,6 +5339,9 @@ var init_middleware = __esm({
             `max-age=${hsts}; includeSubDomains`
           );
         }
+        if (process.env.TINA4_CSP === void 0) {
+          _SecurityHeadersMiddleware.warnCspDefaultOnce();
+        }
         res.header(
           "Content-Security-Policy",
           process.env.TINA4_CSP ?? "default-src 'self'"
@@ -5354,6 +5357,30 @@ var init_middleware = __esm({
         );
         return [req2, res];
       }
+      /** Warn-once ledger for the default-CSP heads-up (per process). */
+      static cspDefaultWarned = false;
+      /**
+       * Warn once per process that the default CSP is in force (TINA4_CSP unset).
+       *
+       * Secure-by-default keeps `default-src 'self'` (SECHDR-DEC-01), but that
+       * default is invisible: it blocks runtime-injected inline styles, cross-origin
+       * fonts/scripts/CDNs, `data:` URIs, and cross-origin WebSocket/XHR (a separate
+       * API or LiveKit host) — and the failure surfaces only in the browser at
+       * runtime, long after a deploy has gone green. So the framework says so once,
+       * naming the escape hatch. It NEVER fails the boot or a request — logging a
+       * heads-up must not be the reason the server or a request dies. Fires only when
+       * TINA4_CSP is ABSENT; setting it (even to empty) is an explicit opt-in.
+       */
+      static warnCspDefaultOnce() {
+        if (_SecurityHeadersMiddleware.cspDefaultWarned) return;
+        _SecurityHeadersMiddleware.cspDefaultWarned = true;
+        const message = `TINA4_CSP is not set, so Tina4 is serving the default Content-Security-Policy "default-src 'self'" on every response. That default blocks runtime-injected inline styles, cross-origin fonts/scripts/CDNs, data: URIs, and cross-origin WebSocket/XHR (e.g. a separate API or LiveKit host). If your app uses any of these, set TINA4_CSP to a policy that allows them (see https://tina4.com); to silence this notice without changing behaviour, set TINA4_CSP="default-src 'self'".`;
+        try {
+          Log.warning(message);
+        } catch {
+          console.warn(message);
+        }
+      }
       /**
        * True when the client request is HTTPS. Proxy-aware and byte-parity with
        * Python (request.is_secure_scheme), PHP (Request::isSecureScheme) and Ruby

package/packages/core/dist/index.js

@@ -5338,6 +5338,9 @@ var init_middleware = __esm({
             `max-age=${hsts}; includeSubDomains`
           );
         }
+        if (process.env.TINA4_CSP === void 0) {
+          _SecurityHeadersMiddleware.warnCspDefaultOnce();
+        }
         res.header(
           "Content-Security-Policy",
           process.env.TINA4_CSP ?? "default-src 'self'"
@@ -5353,6 +5356,30 @@ var init_middleware = __esm({
         );
         return [req2, res];
       }
+      /** Warn-once ledger for the default-CSP heads-up (per process). */
+      static cspDefaultWarned = false;
+      /**
+       * Warn once per process that the default CSP is in force (TINA4_CSP unset).
+       *
+       * Secure-by-default keeps `default-src 'self'` (SECHDR-DEC-01), but that
+       * default is invisible: it blocks runtime-injected inline styles, cross-origin
+       * fonts/scripts/CDNs, `data:` URIs, and cross-origin WebSocket/XHR (a separate
+       * API or LiveKit host) — and the failure surfaces only in the browser at
+       * runtime, long after a deploy has gone green. So the framework says so once,
+       * naming the escape hatch. It NEVER fails the boot or a request — logging a
+       * heads-up must not be the reason the server or a request dies. Fires only when
+       * TINA4_CSP is ABSENT; setting it (even to empty) is an explicit opt-in.
+       */
+      static warnCspDefaultOnce() {
+        if (_SecurityHeadersMiddleware.cspDefaultWarned) return;
+        _SecurityHeadersMiddleware.cspDefaultWarned = true;
+        const message = `TINA4_CSP is not set, so Tina4 is serving the default Content-Security-Policy "default-src 'self'" on every response. That default blocks runtime-injected inline styles, cross-origin fonts/scripts/CDNs, data: URIs, and cross-origin WebSocket/XHR (e.g. a separate API or LiveKit host). If your app uses any of these, set TINA4_CSP to a policy that allows them (see https://tina4.com); to silence this notice without changing behaviour, set TINA4_CSP="default-src 'self'".`;
+        try {
+          Log.warning(message);
+        } catch {
+          console.warn(message);
+        }
+      }
       /**
        * True when the client request is HTTPS. Proxy-aware and byte-parity with
        * Python (request.is_secure_scheme), PHP (Request::isSecureScheme) and Ruby