tina4-nodejs 3.13.149 → 3.13.151

package/packages/frond/src/engine.ts

@@ -283,6 +283,15 @@ const FILTER_WITH_ARGS_RE = /^(\w+)\s*\(([\s\S]*)\)$/;
 const FILTER_COMPARISON_RE = /^(\w+)\s*(!=|==|>=|<=|>|<)\s*(.+)$/;
 const TITLE_WORD_RE = /\b\w/g;
 const STRIP_TAGS_RE = /<[^>]+>/g;
+
+// Strip tags to a fixed point: a single pass leaves a tag that only appears once
+// the surrounding one is removed (`<<b>b>` -> `<b>`), which CodeQL flags as
+// incomplete multi-character sanitization. Repeat until nothing more matches.
+function stripTags(input: string): string {
+  let s = input, prev: string;
+  do { prev = s; s = s.replace(STRIP_TAGS_RE, ""); } while (s !== prev);
+  return s;
+}
 const FAST_FILTERS: Record<string, (value: unknown) => unknown> = {
   upper: (value) => String(value).toUpperCase(),
   lower: (value) => String(value).toLowerCase(),
@@ -296,7 +305,7 @@ const FAST_FILTERS: Record<string, (value: unknown) => unknown> = {
   int: (value) => value ? parseInt(String(value), 10) || 0 : 0,
   float: (value) => value ? parseFloat(String(value)) || 0.0 : 0.0,
   abs: (value) => typeof value === "number" ? Math.abs(value) : value,
-  striptags: (value) => String(value).replace(STRIP_TAGS_RE, ""),
+  striptags: (value) => stripTags(String(value)),
   first: (value) => Array.isArray(value) ? value[0] ?? null : null,
   last: (value) => Array.isArray(value) ? value[value.length - 1] ?? null : null,
   keys: (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value) : [],
@@ -313,17 +322,20 @@ const FAST_FILTERS: Record<string, (value: unknown) => unknown> = {
 // common types. Matches PHP sprintf / Python % / Ruby format so the `format`
 // filter renders e.g. `{{ '%.2f' | format(n) }}` as "3.14" across all engines.
 const FORMAT_RE = /%%|%([-+ 0]*)(\d+)?(?:\.(\d+))?([sdifFeEgGxXob])/g;
-const LEADING_WS_RE = /^\s+/;
-const TRAILING_WS_RE = /\s+$/;
 const THOUSANDS_RE = /\B(?=(\d{3})+(?!\d))/g;
 // {% live "name" poll N | sse | ws "path" [src "url"] %}
 const LIVE_RE = /^live\s+["']([^"']+)["']([\s\S]*)$/;
 const LIVE_WS_RE = /ws\s+["']([^"']+)["']/;
 const LIVE_SRC_RE = /src\s+["']([^"']+)["']/;
-const EXTENDS_RE = /\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/;
+// The captured path is a single negated class ([^"']+), not .+?, for the same
+// reason LIVE_RE above uses one: V8 backtracks a lazy dot catastrophically when
+// the closing quote never arrives, so `{% extends "` + 100KB of junk would hang
+// the render (js/polynomial-redos). A template path never carries a quote, so
+// the class loses nothing and the match is linear.
+const EXTENDS_RE = /\{%[-\s]*extends\s+["']([^"']+)["']\s*[-]?%\}/;
 // Global-flag twin of EXTENDS_RE purely for counting every occurrence (a
 // non-global RegExp's .exec()/.match() only ever reports the first match).
-const EXTENDS_RE_GLOBAL = /\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/g;
+const EXTENDS_RE_GLOBAL = /\{%[-\s]*extends\s+["']([^"']+)["']\s*[-]?%\}/g;
 
 /** Escape a value for a live-marker HTML attribute. Byte-identical order to
  * the Python master / PHP liveAttr / Ruby live_attr so the emitted marker
@@ -420,47 +432,90 @@ function sweepExpiredCache(cache: Map<string, [string, number]>): void {
 }
 
 // ── Lexer ──────────────────────────────────────────────────────
+//
+// ReDoS note: this lexer is an INDEX-BASED forward scan, not a backtracking
+// regex. The old `/( \{%…[\s\S]*?…%\} )|…/g` + `/\{%…raw…([\s\S]*?)…endraw…/g`
+// pair ran O(n^2) on V8 for a crafted "many openers, no closer" input (a lazy
+// body re-scanned from every opener), so an ~8 KB template value could hang the
+// event loop for tens of seconds. `indexOf` never backtracks; the per-kind
+// "no more closers" cache below keeps even the pathological case linear.
+
+// Raw-block delimiters. These are BOUNDED (fixed keyword, no lazy body), so they
+// cannot backtrack — the ReDoS lived only in the `[\s\S]*?` body, which is gone.
+const RAW_OPEN_RE = /\{%-?\s*raw\s*-?%\}/g;
+const RAW_CLOSE_RE = /\{%-?\s*endraw\s*-?%\}/g;
+
+// Extract {% raw %}…{% endraw %} blocks, replacing each with a NUL-wrapped
+// placeholder so its body is never tokenized. First opener → first endraw after
+// it (matches the old non-greedy body). An opener with no endraw anywhere is left
+// in place (it tokenizes as an ordinary {% raw %} BLOCK, exactly as before).
+function extractRawBlocks(source: string): { source: string; rawBlocks: string[] } {
+  const rawBlocks: string[] = [];
+  let out = "";
+  let pos = 0;
+  RAW_OPEN_RE.lastIndex = 0;
+  let om: RegExpExecArray | null;
+  while ((om = RAW_OPEN_RE.exec(source)) !== null) {
+    const openStart = om.index;
+    const openEnd = RAW_OPEN_RE.lastIndex;
+    RAW_CLOSE_RE.lastIndex = openEnd;
+    const cm = RAW_CLOSE_RE.exec(source);
+    if (cm === null) break; // no endraw after this opener → none after any later one
+    const idx = rawBlocks.length;
+    rawBlocks.push(source.slice(openEnd, cm.index));
+    out += source.slice(pos, openStart) + `\x00RAW_${idx}\x00`;
+    pos = RAW_CLOSE_RE.lastIndex;
+    RAW_OPEN_RE.lastIndex = pos; // continue after the endraw
+  }
+  out += source.slice(pos);
+  return { source: out, rawBlocks };
+}
 
-const TOKEN_RE = /(\{%-?\s*[\s\S]*?\s*-?%\})|(\{\{-?\s*[\s\S]*?\s*-?\}\})|(\{#[\s\S]*?#\})/g;
-
-// Regex to extract {% raw %}...{% endraw %} blocks before tokenizing
-const RAW_BLOCK_RE = /\{%-?\s*raw\s*-?%\}([\s\S]*?)\{%-?\s*endraw\s*-?%\}/g;
+const TAG_KINDS: Record<string, { close: string; type: TokenType }> = {
+  "%": { close: "%}", type: "BLOCK" },
+  "{": { close: "}}", type: "VAR" },
+  "#": { close: "#}", type: "COMMENT" },
+};
 
-function tokenize(source: string): Token[] {
+function tokenize(rawSource: string): Token[] {
   // 1. Extract raw blocks and replace with placeholders
-  const rawBlocks: string[] = [];
-  source = source.replace(RAW_BLOCK_RE, (_match, content) => {
-    const idx = rawBlocks.length;
-    rawBlocks.push(content);
-    return `\x00RAW_${idx}\x00`;
-  });
+  const { source, rawBlocks } = extractRawBlocks(rawSource);
 
-  // 2. Normal tokenization
+  // 2. Forward index scan — find each '{', classify it, jump to its close.
   const tokens: Token[] = [];
-  let pos = 0;
-
-  TOKEN_RE.lastIndex = 0;
-  let m: RegExpExecArray | null;
-  while ((m = TOKEN_RE.exec(source)) !== null) {
-    const start = m.index;
-    if (start > pos) {
-      tokens.push(["TEXT", source.slice(pos, start)]);
+  const n = source.length;
+  let pos = 0; // start of the current TEXT run
+  let scan = 0; // where to look for the next '{'
+  // Once a close delimiter has no occurrence beyond some point it never will
+  // (indexOf is monotonic as `scan` only advances), so remember it and skip that
+  // kind in O(1) instead of re-scanning to EOF for every dead opener.
+  const exhausted: Record<string, boolean> = { "%}": false, "}}": false, "#}": false };
+
+  while (scan < n) {
+    const brace = source.indexOf("{", scan);
+    if (brace === -1) break;
+    const kind = TAG_KINDS[source[brace + 1]];
+    if (!kind) {
+      scan = brace + 1; // a '{' that starts no tag — part of TEXT
+      continue;
     }
-
-    const raw = m[0];
-    if (raw.startsWith("{#")) {
-      tokens.push(["COMMENT", raw]);
-    } else if (raw.startsWith("{{")) {
-      tokens.push(["VAR", raw]);
-    } else if (raw.startsWith("{%")) {
-      tokens.push(["BLOCK", raw]);
+    if (exhausted[kind.close]) {
+      scan = brace + 1; // no matching close remains — treat as TEXT, keep scanning
+      continue;
+    }
+    const close = source.indexOf(kind.close, brace + 2);
+    if (close === -1) {
+      exhausted[kind.close] = true;
+      scan = brace + 1;
+      continue;
     }
-    pos = m.index + raw.length;
+    if (brace > pos) tokens.push(["TEXT", source.slice(pos, brace)]);
+    tokens.push([kind.type, source.slice(brace, close + 2)]);
+    pos = close + 2;
+    scan = close + 2;
   }
 
-  if (pos < source.length) {
-    tokens.push(["TEXT", source.slice(pos)]);
-  }
+  if (pos < n) tokens.push(["TEXT", source.slice(pos)]);
 
   // 3. Restore raw block placeholders as literal TEXT
   if (rawBlocks.length > 0) {
@@ -844,26 +899,163 @@ const ARITHMETIC_OPERATIONS: Record<string, (left: number, right: number) => num
   "**": (left, right) => left ** right,
 };
 
+/** Arithmetic precedence levels, loosest first. `**` is right-associative; the rest are left-associative. */
+const ARITHMETIC_LEVELS: string[][] = [["+", "-"], ["*", "//", "/", "%"], ["**"]];
+
+/** Every position in expr outside quotes and brackets. */
+function topLevelPositions(expr: string): number[] {
+  const positions: number[] = [];
+  let inQuote: string | null = null;
+  let depth = 0;
+  for (let pos = 0; pos < expr.length; pos++) {
+    const ch = expr[pos];
+    if (inQuote) {
+      if (ch === inQuote) inQuote = null;
+    } else if (ch === '"' || ch === "'") {
+      inQuote = ch;
+    } else if ("([{".includes(ch)) {
+      depth++;
+    } else if (")]}".includes(ch)) {
+      depth--;
+    } else if (depth === 0) {
+      positions.push(pos);
+    }
+  }
+  return positions;
+}
+
+/** True when the text before pos ends in an operand, so an operator there is binary; the `-` in `n * -1` or `-7` is a sign. */
+function followsOperand(expr: string, pos: number): boolean {
+  return /[\w)\]'"]$/.test(expr.slice(0, pos).trimEnd());
+}
+
+/** [position, operator] for every binary arithmetic operator outside quotes and brackets (`**` and `//` are two characters). */
+function topLevelArithmeticOperators(expr: string): [number, string][] {
+  const operators: [number, string][] = [];
+  let skipUntil = -1;
+  for (const pos of topLevelPositions(expr)) {
+    if (pos < skipUntil || !"+-*/%".includes(expr[pos])) continue;
+    const pair = expr.slice(pos, pos + 2);
+    const op = pair === "**" || pair === "//" ? pair : expr[pos];
+    skipUntil = pos + op.length;
+    if (followsOperand(expr, pos)) operators.push([pos, op]);
+  }
+  return operators;
+}
+
+/**
+ * Pick the operator that binds loosest, so it is evaluated last. Within a
+ * left-associative level the RIGHTMOST operator is the split point
+ * (`10 - 2 - 3` is `(10 - 2) - 3`); `**` splits at the leftmost.
+ */
+function splitArithmetic(expr: string): [number, string] | null {
+  const operators = topLevelArithmeticOperators(expr);
+  for (const level of ARITHMETIC_LEVELS) {
+    const matches = operators.filter(([, op]) => level.includes(op));
+    if (matches.length > 0) return level[0] === "**" ? matches[0] : matches[matches.length - 1];
+  }
+  return null;
+}
+
 function evalArithmeticExpression(expr: string, context: Record<string, unknown>): ExprResult {
-  for (const op of [" + ", " - ", " * ", " // ", " / ", " % ", " ** "]) {
-    const pos = findOutsideQuotes(expr, op);
-    if (pos >= 0) {
-      const left = expr.slice(0, pos).trim();
-      const right = expr.slice(pos + op.length).trim();
-      const lVal = evalExpr(left, context);
-      const rVal = evalExpr(right, context);
-      try {
-        let lNum = lVal != null ? Number(lVal) : 0;
-        let rNum = rVal != null ? Number(rVal) : 0;
-        if (isNaN(lNum)) lNum = 0;
-        if (isNaN(rNum)) rNum = 0;
-        return ARITHMETIC_OPERATIONS[op.trim()](lNum, rNum);
-      } catch {
-        return null;
-      }
+  const split = splitArithmetic(expr);
+  if (!split) return EXPR_NOT_MATCHED;
+  const [pos, op] = split;
+  const lVal = evalExpr(expr.slice(0, pos).trim(), context);
+  const rVal = evalExpr(expr.slice(pos + op.length).trim(), context);
+  let lNum = lVal != null ? Number(lVal) : 0;
+  let rNum = rVal != null ? Number(rVal) : 0;
+  if (isNaN(lNum)) lNum = 0;
+  if (isNaN(rNum)) rNum = 0;
+  return ARITHMETIC_OPERATIONS[op](lNum, rNum);
+}
+
+/**
+ * Integers from start to end inclusive, counting down when start is greater
+ * than end. Backs both range() and `a..b`; [] for a bound that is not a
+ * number or a zero step.
+ */
+export function frondRange(start: unknown, end: unknown, step: unknown = 1): number[] {
+  const numeric = (value: unknown) => typeof value === "number" || (typeof value === "string" && NUMERIC_RE.test(value));
+  if (!numeric(start) || !numeric(end) || !numeric(step)) return [];
+  const first = Math.trunc(Number(start));
+  const last = Math.trunc(Number(end));
+  const stride = Math.abs(Math.trunc(Number(step)));
+  if (stride === 0) return [];
+  const values: number[] = [];
+  if (first <= last) for (let value = first; value <= last; value += stride) values.push(value);
+  else for (let value = first; value >= last; value -= stride) values.push(value);
+  return values;
+}
+
+/**
+ * Position of a top-level `..` (not part of `...`), or -1. A pipe after the
+ * range (`1..4|join(",")`) applies to the whole range, so it is left to the
+ * filter step.
+ */
+function findRangeOperator(expr: string): number {
+  let pos = findOutsideQuotes(expr, "..");
+  while (pos >= 0) {
+    const partOfEllipsis = expr.startsWith("...", pos) || (pos > 0 && expr[pos - 1] === ".");
+    if (pos > 0 && !partOfEllipsis) return findOutsideQuotes(expr.slice(pos + 2), "|") >= 0 ? -1 : pos;
+    const next = findOutsideQuotes(expr.slice(pos + 2), "..");
+    pos = next >= 0 ? pos + 2 + next : -1;
+  }
+  return -1;
+}
+
+function evalRangeExpression(expr: string, context: Record<string, unknown>): ExprResult {
+  const pos = findRangeOperator(expr);
+  if (pos < 0) return EXPR_NOT_MATCHED;
+  return frondRange(evalExpr(expr.slice(0, pos).trim(), context), evalExpr(expr.slice(pos + 2).trim(), context));
+}
+
+/** Offset of the bracket closing the one that opens expr, skipping quotes; -1 when unbalanced. */
+function closingBracketIndex(expr: string): number {
+  let depth = 0;
+  let inQuote: string | null = null;
+  for (let i = 0; i < expr.length; i++) {
+    const ch = expr[i];
+    if (inQuote) {
+      if (ch === inQuote) inQuote = null;
+    } else if (ch === '"' || ch === "'") {
+      inQuote = ch;
+    } else if ("([{".includes(ch)) {
+      depth++;
+    } else if (")]}".includes(ch) && --depth === 0) {
+      return i;
     }
   }
-  return EXPR_NOT_MATCHED;
+  return -1;
+}
+
+const BARE_KEY_RE = /^[A-Za-z_]\w*$/;
+
+/** A bare map key is a string, as in Twig; a quoted key is its text; a parenthesised key is evaluated: `{(name): 1}`. */
+function mapLiteralKey(rawKey: string, context: Record<string, unknown>): string {
+  const quoted = rawKey.length >= 2 && (rawKey[0] === '"' || rawKey[0] === "'") && rawKey.endsWith(rawKey[0]);
+  if (quoted) return rawKey.slice(1, -1);
+  return BARE_KEY_RE.test(rawKey) ? rawKey : String(evalExpr(rawKey, context));
+}
+
+function evalMapLiteral(inner: string, context: Record<string, unknown>): Record<string, unknown> {
+  const map: Record<string, unknown> = {};
+  for (const pair of inner === "" ? [] : splitArgs(inner)) {
+    const colon = findOutsideQuotes(pair, ":");
+    if (colon > 0) map[mapLiteralKey(pair.slice(0, colon).trim(), context)] = evalExpr(pair.slice(colon + 1).trim(), context);
+  }
+  return map;
+}
+
+/**
+ * A whole `[...]` or `{...}` literal is one value, so operators inside its
+ * members (`{a: "x" ~ name}`) never split it.
+ */
+function evalCollectionLiteral(expr: string, context: Record<string, unknown>): ExprResult {
+  if ((expr[0] !== "[" && expr[0] !== "{") || closingBracketIndex(expr) !== expr.length - 1) return EXPR_NOT_MATCHED;
+  const inner = expr.slice(1, -1).trim();
+  if (expr[0] === "{") return evalMapLiteral(inner, context);
+  return inner === "" ? [] : splitArgs(inner).map(item => evalExpr(item.trim(), context));
 }
 
 function evalFilterExpression(expr: string, context: Record<string, unknown>): ExprResult {
@@ -928,9 +1120,11 @@ function evalFunctionExpression(expr: string, context: Record<string, unknown>):
 }
 
 const EXPR_EVALUATORS = [
+  evalCollectionLiteral,
   evalPrimary,
   evalConditional,
   evalConcatOrComparison,
+  evalRangeExpression,
   evalArithmeticExpression,
   evalFilterExpression,
   evalFunctionExpression,
@@ -1357,8 +1551,8 @@ function splitArgs(raw: string): string[] {
       current += ch;
       continue;
     }
-    if (ch === "(" || ch === "[") { depth++; current += ch; continue; }
-    if (ch === ")" || ch === "]") { depth--; current += ch; continue; }
+    if (ch === "(" || ch === "[" || ch === "{") { depth++; current += ch; continue; }
+    if (ch === ")" || ch === "]" || ch === "}") { depth--; current += ch; continue; }
     if (ch === "," && depth === 0) {
       args.push(current.trim());
       current = "";
@@ -1610,8 +1804,8 @@ const BUILTIN_FILTERS: Record<string, FilterFn> = {
   capitalize: (v) => { const s = String(v); return s.charAt(0).toUpperCase() + s.slice(1).toLowerCase(); },
   title: (v) => String(v).replace(TITLE_WORD_RE, c => c.toUpperCase()),
   trim: (v) => String(v).trim(),
-  ltrim: (v) => String(v).replace(LEADING_WS_RE, ""),
-  rtrim: (v) => String(v).replace(TRAILING_WS_RE, ""),
+  ltrim: (v) => String(v).trimStart(),
+  rtrim: (v) => String(v).trimEnd(),
   length: (v) => {
     if (Array.isArray(v)) return v.length;
     if (typeof v === "string") return v.length;
@@ -1652,7 +1846,7 @@ const BUILTIN_FILTERS: Record<string, FilterFn> = {
   safe: (v) => v,
   escape: (v, ...a) => escapeStrategy(v, (a[0] as string) ?? "html"),
   e: (v, ...a) => escapeStrategy(v, (a[0] as string) ?? "html"),
-  striptags: (v) => String(v).replace(STRIP_TAGS_RE, ""),
+  striptags: (v) => stripTags(String(v)),
   nl2br: (v) => new SafeString(htmlEscape(String(v)).replace(/\n/g, "<br />\n")),
   abs: (v) => typeof v === "number" ? Math.abs(v) : v,
   round: (v, decimals) => {
@@ -1768,7 +1962,7 @@ const BUILTIN_FILTERS: Record<string, FilterFn> = {
 // ── Form Token ────────────────────────────────────────────────
 
 function _b64url(data: Buffer): string {
-  return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/={1,2}$/, "");
 }
 
 /**
@@ -1794,6 +1988,19 @@ export function setFormTokenSessionId(sessionId: string): void {
   _formTokenSessionId = sessionId || "";
 }
 
+// Form-token session provider. Core registers its request-scoped session id
+// source here, for the same reason as the CSP nonce provider below. Default
+// returns "" for standalone Frond use.
+let _formTokenSessionProvider: () => string = () => "";
+
+/**
+ * Register the function that gives form_token() the current request's session
+ * id, so each token is bound to the session that rendered it (CSRF).
+ */
+export function setFormTokenSessionProvider(fn: () => string): void {
+  _formTokenSessionProvider = fn;
+}
+
 // CSP nonce provider (ADR-0088). Frond never imports @tina4/core (that would be
 // circular — core depends on frond), so core injects the per-response nonce
 // source through this setter. Default returns "" for standalone Frond use.
@@ -1844,8 +2051,9 @@ function _buildFormTokenJwt(descriptor: string = ""): string {
   }
 
   // Include session_id for CSRF session binding
-  if (_formTokenSessionId) {
-    payload.session_id = _formTokenSessionId;
+  const sessionId = _formTokenSessionProvider() || _formTokenSessionId;
+  if (sessionId) {
+    payload.session_id = sessionId;
   }
 
   const h = _b64url(Buffer.from(JSON.stringify(header)));
@@ -2032,6 +2240,7 @@ export class Frond {
     this.globals.form_token = (descriptor?: string) => _generateFormToken(descriptor || "");
     this.globals.formTokenValue = (descriptor?: string) => _generateFormTokenValue(descriptor || "");
     this.globals.form_token_value = (descriptor?: string) => _generateFormTokenValue(descriptor || "");
+    this.globals.range = frondRange;
 
     // Debug helper: {{ dump(x) }} — gated on TINA4_DEBUG, see renderDump().
     // Available alongside the |dump filter so both styles work:
@@ -2479,21 +2688,21 @@ export class Frond {
 
   private renderVarToken(tokens: Token[], index: number, context: Record<string, unknown>, output: string[]): number {
     const [content, stripB, stripA] = stripTag(tokens[index][1]);
-    if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].replace(TRAILING_WS_RE, "");
+    if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].trimEnd();
     const result = this.evalVar(content, context);
     output.push(result !== null && result !== undefined ? String(result) : "");
     if (stripA && index + 1 < tokens.length && tokens[index + 1][0] === "TEXT") {
-      tokens[index + 1] = ["TEXT", tokens[index + 1][1].replace(LEADING_WS_RE, "")];
+      tokens[index + 1] = ["TEXT", tokens[index + 1][1].trimStart()];
     }
     return index + 1;
   }
 
   private renderBlockToken(tokens: Token[], index: number, context: Record<string, unknown>, output: string[]): number {
     const [content, stripB, stripA] = stripTag(tokens[index][1]);
-    if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].replace(TRAILING_WS_RE, "");
+    if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].trimEnd();
     const tag = content.split(/\s+/)[0] || "";
     if (stripA && index + 1 < tokens.length && tokens[index + 1][0] === "TEXT") {
-      tokens[index + 1] = ["TEXT", tokens[index + 1][1].replace(LEADING_WS_RE, "")];
+      tokens[index + 1] = ["TEXT", tokens[index + 1][1].trimStart()];
     }
     let next: number;
     if (tag === "if" && this.tagPermitted(tag)) {
@@ -2510,7 +2719,7 @@ export class Frond {
       next = block.next;
     }
     if (stripA && next < tokens.length && tokens[next][0] === "TEXT") {
-      tokens[next] = ["TEXT", tokens[next][1].replace(LEADING_WS_RE, "")];
+      tokens[next] = ["TEXT", tokens[next][1].trimStart()];
     }
     return next;
   }
@@ -2839,7 +3048,7 @@ export class Frond {
   ): void {
     if (stripBefore && branchTokens.length > 0 && branchTokens[branchTokens.length - 1][0] === "TEXT") {
       const last = branchTokens[branchTokens.length - 1];
-      branchTokens[branchTokens.length - 1] = ["TEXT", last[1].replace(TRAILING_WS_RE, "")];
+      branchTokens[branchTokens.length - 1] = ["TEXT", last[1].trimEnd()];
     }
     branches.push([condition, branchTokens]);
   }
@@ -2872,7 +3081,7 @@ export class Frond {
       } else if (tag === "endif") {
         this.pushIfBranch(branches, currentCond, currentTokens, tagStripB);
         if (tagStripA && i + 1 < tokens.length && tokens[i + 1][0] === "TEXT") {
-          tokens[i + 1] = ["TEXT", tokens[i + 1][1].replace(LEADING_WS_RE, "")];
+          tokens[i + 1] = ["TEXT", tokens[i + 1][1].trimStart()];
         }
         return { branches, next: i + 1 };
       } else if ((tag === "elseif" || tag === "elif") && depth === 0) {

package/packages/frond/src/index.ts

@@ -6,5 +6,5 @@ License, v. 2.0. If a copy of the MPL was not distributed with this
 file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */
 
-export { Frond, escapeHtml, setCspNonceProvider } from "./engine.js";
+export { Frond, escapeHtml, setCspNonceProvider, setFormTokenSessionProvider } from "./engine.js";
 export type { FilterFn, TestFn, LiveProvider, LiveRequest, LiveResponse, LiveBroadcaster } from "./engine.js";