tina4-nodejs 3.13.141 → 3.13.143

package/packages/cli/src/bin.ts

@@ -20,8 +20,9 @@ import { runSeeds } from "./commands/seed.js";
 import { queueCommand, QUEUE_SUBCOMMAND_NAMES } from "./commands/queue.js";
 import { buildImage } from "./commands/build.js";
 import { spawnSync } from "node:child_process";
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { delimiter, dirname, join } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { findOnPath } from "./util.js";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 // ── Version (cheap, side-effect-free) ───────────────────────────────
@@ -496,18 +497,7 @@ function findClient(): string | null {
   const names = windows
     ? [`${CLIENT_BINARY}.exe`, `${CLIENT_BINARY}.cmd`, `${CLIENT_BINARY}.bat`]
     : [CLIENT_BINARY];
-  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
-    if (!dir) continue;
-    for (const name of names) {
-      const candidate = join(dir, name);
-      try {
-        if (statSync(candidate).isFile()) return candidate;
-      } catch {
-        // not there — keep looking
-      }
-    }
-  }
-  return null;
+  return findOnPath(names);
 }
 
 /**

package/packages/cli/src/commands/build.ts

@@ -24,27 +24,11 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { accessSync, constants, existsSync, statSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawnSync } from "node:child_process";
+import { parseFlags as parseFlagsShared } from "../util.js";
 
 /** Parse --key value / bare --flag (build only needs --tag and --file values). */
 function parseFlags(args: string[]): Record<string, string | boolean> {
-  const flags: Record<string, string | boolean> = {};
-  let i = 0;
-  while (i < args.length) {
-    const arg = args[i];
-    if (arg.startsWith("--")) {
-      const key = arg.slice(2);
-      if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
-        flags[key] = args[i + 1];
-        i += 2;
-      } else {
-        flags[key] = true;
-        i += 1;
-      }
-    } else {
-      i += 1;
-    }
-  }
-  return flags;
+  return parseFlagsShared(args).flags;
 }
 
 /**

package/packages/cli/src/commands/generate.ts

@@ -42,6 +42,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  */
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join, relative, resolve, sep } from "node:path";
+import { parseFlags } from "../util.js";
 
 // ── Field type mapping ──────────────────────────────────────────────
 const FIELD_TYPE_MAP: Record<string, { orm: string; sql: string; defaultVal: string }> = {
@@ -558,28 +559,7 @@ export function parseCliArgs(args: string[]): { flags: Record<string, string | b
     "json", "dry-run",
   ]);
 
-  const flags: Record<string, string | boolean> = {};
-  const positional: string[] = [];
-  let i = 0;
-  while (i < args.length) {
-    if (args[i].startsWith("--")) {
-      const key = args[i].slice(2);
-      if (booleanFlags.has(key)) {
-        flags[key] = true;
-        i += 1;
-      } else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
-        flags[key] = args[i + 1];
-        i += 2;
-      } else {
-        flags[key] = true;
-        i += 1;
-      }
-    } else {
-      positional.push(args[i]);
-      i += 1;
-    }
-  }
-  return { flags, positional };
+  return parseFlags(args, booleanFlags);
 }
 
 /**
@@ -1870,7 +1850,11 @@ export default async function (req: Tina4Request, res: Tina4Response) {
     `{% extends "base.twig" %}
 {% block title %}Login{% endblock %}
 {% block content %}
-<div class="container mt-4" style="max-width:400px">
+{# No inline style attribute: a nonce lets this <style> block run under the
+   strict default Content-Security-Policy. csp_nonce() is a built-in Frond global
+   that returns this response's nonce (ADR-0088). #}
+<style nonce="{{ csp_nonce() }}">.auth-form{max-width:400px;margin:0 auto}</style>
+<div class="container mt-4 auth-form">
     <h1>Login</h1>
     <form method="post" action="/api/auth/login">
         {{ form_token() }}
@@ -1896,7 +1880,8 @@ export default async function (req: Tina4Request, res: Tina4Response) {
     `{% extends "base.twig" %}
 {% block title %}Register{% endblock %}
 {% block content %}
-<div class="container mt-4" style="max-width:400px">
+<style nonce="{{ csp_nonce() }}">.auth-form{max-width:400px;margin:0 auto}</style>
+<div class="container mt-4 auth-form">
     <h1>Register</h1>
     <form method="post" action="/api/auth/register">
         {{ form_token() }}

package/packages/cli/src/commands/init.ts

@@ -211,20 +211,30 @@ export default async function (req: Tina4Request, res: Tina4Response): Promise<v
 `
   );
 
-  // Static index page
+  // Static index stylesheet. A static file cannot carry a per-response CSP
+  // nonce (ADR-0088), so its styles live in an external same-origin stylesheet
+  // the strict default policy ('self') already allows — not an inline <style>,
+  // which the browser would refuse, leaving a fresh project unstyled.
+  writeFileSync(
+    join(targetDir, "public/style.css"),
+    `body { font-family: -apple-system, sans-serif; max-width: 600px; margin: 80px auto; padding: 0 20px; color: #333; }
+h1 { font-size: 2.5em; margin-bottom: 0.2em; }
+p { color: #666; font-size: 1.1em; }
+code { background: #f4f4f4; padding: 2px 6px; border-radius: 3px; font-size: 0.9em; }
+a { color: #2563eb; }
+`
+  );
+
+  // Static index page. CSP-clean: an external stylesheet, no inline <style>.
+  // For a page that needs an inline block, render it through a Frond template
+  // and stamp the nonce: <style nonce="{{ csp_nonce() }}">...</style>.
   writeFileSync(
     join(targetDir, "public/index.html"),
     `<!DOCTYPE html>
 <html>
 <head>
   <title>Tina4</title>
-  <style>
-    body { font-family: -apple-system, sans-serif; max-width: 600px; margin: 80px auto; padding: 0 20px; color: #333; }
-    h1 { font-size: 2.5em; margin-bottom: 0.2em; }
-    p { color: #666; font-size: 1.1em; }
-    code { background: #f4f4f4; padding: 2px 6px; border-radius: 3px; font-size: 0.9em; }
-    a { color: #2563eb; }
-  </style>
+  <link rel="stylesheet" href="/style.css">
 </head>
 <body>
   <h1>tina4</h1>

package/packages/cli/src/commands/lint.ts

@@ -43,7 +43,8 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  */
 import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
-import { delimiter, dirname, join, relative } from "node:path";
+import { dirname, join, relative } from "node:path";
+import { findOnPath } from "../util.js";
 import { spawnSync } from "node:child_process";
 
 // Source extensions we count as lintable app code. `.d.ts` declaration files are
@@ -217,18 +218,7 @@ function hasPackage(cwd: string, pkg: string): boolean {
 function resolveNpm(): string | null {
   const windows = process.platform === "win32";
   const names = windows ? ["npm.cmd", "npm.exe", "npm"] : ["npm"];
-  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
-    if (!dir) continue;
-    for (const name of names) {
-      const candidate = join(dir, name);
-      try {
-        if (statSync(candidate).isFile()) return candidate;
-      } catch {
-        // not there — keep looking
-      }
-    }
-  }
-  return null;
+  return findOnPath(names);
 }
 
 interface EslintSetup {

package/packages/cli/src/commands/migrate.ts

@@ -29,6 +29,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { loadEnv } from "../../../core/src/dotenv.js";
+import { initDatabaseOrExit } from "../util.js";
 
 export async function runMigrations(migrationDir?: string): Promise<void> {
   // Load .env before initialising the DB so DATABASE_URL/TINA4_DATABASE_URL
@@ -59,12 +60,7 @@ export async function runMigrations(migrationDir?: string): Promise<void> {
   // async — MUST be awaited, otherwise setAdapter() has not run by the time
   // migrate() asks for the adapter and the whole CLI crashes with
   // "No database adapter configured."
-  try {
-    await initDatabase();
-  } catch (err) {
-    console.error(`  Error initialising database: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
-  }
+  await initDatabaseOrExit(initDatabase);
 
   const result = await migrate(undefined, { migrationsDir: dir });
 

package/packages/cli/src/commands/migrateRollback.ts

@@ -18,6 +18,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  */
 import { resolve } from "node:path";
 import { loadEnv } from "../../../core/src/dotenv.js";
+import { initDatabaseOrExit } from "../util.js";
 
 export async function migrateRollback(migrationDir?: string): Promise<void> {
   // .env must load before initDatabase() — otherwise DATABASE_URL from the
@@ -45,12 +46,7 @@ export async function migrateRollback(migrationDir?: string): Promise<void> {
   // Ensure database is initialised — MUST await; initDatabase() is async
   // and calls setAdapter() inside the promise. Without await, the next call
   // to getAdapter() throws "No database adapter configured."
-  try {
-    await initDatabase();
-  } catch (err) {
-    console.error(`  Error initialising database: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
-  }
+  await initDatabaseOrExit(initDatabase);
 
   await ensureMigrationTable();
 

package/packages/cli/src/commands/migrateStatus.ts

@@ -15,6 +15,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  */
 import { resolve } from "node:path";
 import { loadEnv } from "../../../core/src/dotenv.js";
+import { initDatabaseOrExit } from "../util.js";
 
 export async function migrateStatus(migrationDir?: string): Promise<void> {
   // .env must load before initDatabase() so the project's DATABASE_URL is seen.
@@ -38,12 +39,7 @@ export async function migrateStatus(migrationDir?: string): Promise<void> {
 
   // Ensure database is initialised — MUST await; initDatabase() is async
   // and calls setAdapter() inside. Without await, getAdapter() throws.
-  try {
-    await initDatabase();
-  } catch (err) {
-    console.error(`  Error initialising database: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
-  }
+  await initDatabaseOrExit(initDatabase);
 
   ensureMigrationTable();
 

package/packages/cli/src/commands/queue.ts

@@ -28,6 +28,7 @@ import { pathToFileURL } from "node:url";
 import { loadEnv } from "../../../core/src/dotenv.js";
 import { Queue } from "../../../core/src/queue.js";
 import type { QueueJob } from "../../../core/src/job.js";
+import { parseFlags as parseFlagsShared } from "../util.js";
 
 // ── Flag parsing ─────────────────────────────────────────────────────
 //
@@ -36,36 +37,7 @@ import type { QueueJob } from "../../../core/src/job.js";
 
 const BOOLEAN_FLAGS = new Set(["once", "json"]);
 
-interface ParsedFlags {
-  flags: Record<string, string | boolean>;
-  positional: string[];
-}
-
-function parseFlags(args: string[]): ParsedFlags {
-  const flags: Record<string, string | boolean> = {};
-  const positional: string[] = [];
-  let i = 0;
-  while (i < args.length) {
-    const arg = args[i];
-    if (arg.startsWith("--")) {
-      const key = arg.slice(2);
-      if (BOOLEAN_FLAGS.has(key)) {
-        flags[key] = true;
-        i += 1;
-      } else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
-        flags[key] = args[i + 1];
-        i += 2;
-      } else {
-        flags[key] = true;
-        i += 1;
-      }
-    } else {
-      positional.push(arg);
-      i += 1;
-    }
-  }
-  return { flags, positional };
-}
+const parseFlags = (args: string[]) => parseFlagsShared(args, BOOLEAN_FLAGS);
 
 /** A per-job handler declared by a consumer module (receives the job payload). */
 export type QueueHandler = (payload: unknown) => unknown | Promise<unknown>;

package/packages/cli/src/util.ts

@@ -0,0 +1,90 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
+/**
+ * Shared CLI helpers — argument parsing, PATH lookup, and database bootstrap.
+ * Kept zero-dependency (node stdlib only) so the CLI entry path stays light.
+ */
+import { delimiter, join } from "node:path";
+import { statSync } from "node:fs";
+
+/** Flags and positional arguments split out of a command's argv slice. */
+export interface ParsedFlags {
+  flags: Record<string, string | boolean>;
+  positional: string[];
+}
+
+/**
+ * Parse `--key value` and bare `--flag` arguments into flags plus positionals.
+ *
+ * A name listed in `booleanFlags` never consumes the next token; every other
+ * `--key` takes the following token as its value unless that token is itself a
+ * `--flag` (or the argv ends), in which case the key is a bare boolean.
+ */
+export function parseFlags(args: string[], booleanFlags?: ReadonlySet<string>): ParsedFlags {
+  const flags: Record<string, string | boolean> = {};
+  const positional: string[] = [];
+  let i = 0;
+  while (i < args.length) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      const key = arg.slice(2);
+      if (booleanFlags?.has(key)) {
+        flags[key] = true;
+        i += 1;
+      } else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
+        flags[key] = args[i + 1];
+        i += 2;
+      } else {
+        flags[key] = true;
+        i += 1;
+      }
+    } else {
+      positional.push(arg);
+      i += 1;
+    }
+  }
+  return { flags, positional };
+}
+
+/**
+ * Absolute path of the first of `names` found on PATH, or null.
+ *
+ * Scans PATH directories directly (no `which` shell-out) so it behaves the same
+ * on every platform and honours a deliberately emptied PATH. Callers pass the
+ * platform-specific candidate names (e.g. `["npm.cmd", "npm.exe", "npm"]`).
+ */
+export function findOnPath(names: string[]): string | null {
+  for (const dir of (process.env.PATH ?? "").split(delimiter)) {
+    if (!dir) continue;
+    for (const name of names) {
+      const candidate = join(dir, name);
+      try {
+        if (statSync(candidate).isFile()) return candidate;
+      } catch {
+        // not there — keep looking
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * Await the ORM's async `initDatabase()` and exit(1) with a clear message on
+ * failure. The await matters: initDatabase() calls setAdapter() inside the
+ * promise, so without it the next getAdapter() throws "No database adapter
+ * configured." Shared by the migrate, rollback, and status commands.
+ */
+export async function initDatabaseOrExit(initDatabase: () => Promise<unknown>): Promise<void> {
+  try {
+    await initDatabase();
+  } catch (err) {
+    console.error(`  Error initialising database: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+}