tina4-nodejs 3.13.45 → 3.13.47

package/CLAUDE.md

@@ -1,4 +1,4 @@
-# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.45)
+# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.47)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 

package/package.json

@@ -3,7 +3,7 @@
 
 
 
-  "version": "3.13.45",
+  "version": "3.13.47",
 
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript \u2014 54 built-in features, zero dependencies",

package/packages/core/src/scss.ts

@@ -122,6 +122,9 @@ function compileString(
   // 5. Resolve @include
   scss = resolveIncludes(scss, mixins);
 
+  // 5.5. Resolve #{ ... } interpolation (before $var substitution + nesting).
+  scss = resolveInterpolation(scss, variables);
+
   // 6. Substitute variables
   scss = substituteVariables(scss, variables);
 
@@ -182,6 +185,26 @@ function substituteVariables(scss: string, variables: Record<string, string>): s
   return scss;
 }
 
+/**
+ * Resolve SCSS `#{ ... }` interpolation. Each `#{ expr }` is replaced by its
+ * resolved inner text: a `$variable` inside the braces resolves to its value,
+ * anything else is inlined verbatim (trimmed). This lets a value carry a
+ * variable inside a string context plain `$var` substitution can't reach —
+ * e.g. `calc(100% - #{$gap})` → `calc(100% - 20px)` — and lets a variable
+ * appear in a selector (`.icon-#{$name}` → `.icon-home`). Run BEFORE nested
+ * rule flattening so the literal braces never confuse the block matcher.
+ */
+function resolveInterpolation(scss: string, variables: Record<string, string>): string {
+  const sorted = Object.keys(variables).sort((a, b) => b.length - a.length);
+  return scss.replace(/#\{([^{}]*)\}/g, (_m, inner: string) => {
+    let resolved = inner.trim();
+    for (const name of sorted) {
+      resolved = resolved.replaceAll(`$${name}`, variables[name]);
+    }
+    return resolved;
+  });
+}
+
 // ── Mixins ───────────────────────────────────────────────────────
 
 function extractMixins(

package/packages/orm/src/adapters/mssql.ts

@@ -40,6 +40,10 @@ export interface MssqlConfig {
 export class MssqlAdapter implements DatabaseAdapter {
   private connection: any = null;
   private _lastInsertId: number | bigint | null = null;
+  // True between startTransactionAsync() and commit/rollback. executeManyAsync
+  // uses it to decide whether IT owns the batch transaction (mirrors the Python
+  // master's owns_txn guard) so it never double-BEGINs inside an explicit one.
+  private _inTransaction = false;
 
   constructor(private config: MssqlConfig | string) {}
 
@@ -179,10 +183,26 @@ export class MssqlAdapter implements DatabaseAdapter {
   }
 
   async executeManyAsync(sql: string, paramsList: unknown[][]): Promise<{ totalAffected: number; lastInsertId?: number | bigint }> {
+    // Run the whole batch in ONE transaction so it is atomic (all-or-nothing) —
+    // a bad row mid-batch rolls back the rows already inserted instead of
+    // leaving a partial write. Mirrors the documented "wrapped in a transaction"
+    // contract, the SQLite adapter, and the Python master's execute_many. Only
+    // own the transaction when not already inside an explicit one (owns guard),
+    // so a batch insert nested in a caller's startTransaction() just joins it.
+    const owns = !this._inTransaction;
+    if (owns) await this.startTransactionAsync();
     let totalAffected = 0;
-    for (const params of paramsList) {
-      await this.executeAsync(sql, params);
-      totalAffected++;
+    try {
+      for (const params of paramsList) {
+        await this.executeAsync(sql, params);
+        totalAffected++;
+      }
+      if (owns) await this.commitAsync();
+    } catch (e) {
+      if (owns) {
+        try { await this.rollbackAsync(); } catch { /* surface the original error */ }
+      }
+      throw e;
     }
     return { totalAffected };
   }
@@ -275,7 +295,11 @@ export class MssqlAdapter implements DatabaseAdapter {
       if (id !== null) this._lastInsertId = id;
       return {
         success: true,
-        rowsAffected: result.rowCount,
+        // A single-object insert affects exactly one row. Do NOT use
+        // result.rowCount here: the statement is "INSERT ...; SELECT
+        // SCOPE_IDENTITY()", and tedious sums the row counts of BOTH statements
+        // (1 for the INSERT + 1 for the SELECT), which reported rowsAffected=2.
+        rowsAffected: 1,
         lastInsertId: id ?? undefined,
       };
     } catch (e) {
@@ -331,7 +355,16 @@ export class MssqlAdapter implements DatabaseAdapter {
   }
 
   async startTransactionAsync(): Promise<void> {
-    await this.executeAsync("BEGIN TRANSACTION");
+    // Use tedious's NATIVE transaction API, NOT a raw "BEGIN TRANSACTION" via
+    // execSql: every adapter statement runs through sp_executesql (an RPC), and
+    // SQL Server forbids changing @@TRANCOUNT inside an sp_executesql call, so a
+    // raw BEGIN raised "Transaction count ... mismatching BEGIN and COMMIT".
+    // beginTransaction manages the transaction at the TDS protocol level, so the
+    // INSERTs inside it commit/rollback atomically.
+    await new Promise<void>((resolve, reject) => {
+      this.connection.beginTransaction((err: Error | null) => (err ? reject(err) : resolve()));
+    });
+    this._inTransaction = true;
   }
 
   commit(): void {
@@ -339,7 +372,10 @@ export class MssqlAdapter implements DatabaseAdapter {
   }
 
   async commitAsync(): Promise<void> {
-    await this.executeAsync("COMMIT");
+    await new Promise<void>((resolve, reject) => {
+      this.connection.commitTransaction((err: Error | null) => (err ? reject(err) : resolve()));
+    });
+    this._inTransaction = false;
   }
 
   rollback(): void {
@@ -347,7 +383,10 @@ export class MssqlAdapter implements DatabaseAdapter {
   }
 
   async rollbackAsync(): Promise<void> {
-    await this.executeAsync("ROLLBACK");
+    await new Promise<void>((resolve, reject) => {
+      this.connection.rollbackTransaction((err: Error | null) => (err ? reject(err) : resolve()));
+    });
+    this._inTransaction = false;
   }
 
   tables(): string[] {

package/packages/orm/src/adapters/mysql.ts

@@ -39,6 +39,10 @@ export interface MysqlConfig {
 export class MysqlAdapter implements DatabaseAdapter {
   private connection: any = null;
   private _lastInsertId: number | bigint | null = null;
+  // True between startTransactionAsync() and commit/rollback. executeManyAsync
+  // uses it to decide whether IT owns the batch transaction (mirrors the Python
+  // master's owns_txn guard) so it never double-BEGINs inside an explicit one.
+  private _inTransaction = false;
 
   constructor(private config: MysqlConfig | string) {}
 
@@ -108,12 +112,28 @@ export class MysqlAdapter implements DatabaseAdapter {
   }
 
   async executeManyAsync(sql: string, paramsList: unknown[][]): Promise<{ totalAffected: number; lastInsertId?: number | bigint }> {
+    // Run the whole batch in ONE transaction so it is atomic (all-or-nothing) —
+    // a bad row mid-batch rolls back the rows already inserted instead of
+    // leaving a partial write. Mirrors the documented "wrapped in a transaction"
+    // contract, the SQLite adapter, and the Python master's execute_many. Only
+    // own the transaction when not already inside an explicit one (owns guard),
+    // so a batch insert nested in a caller's startTransaction() just joins it.
+    const owns = !this._inTransaction;
+    if (owns) await this.startTransactionAsync();
     let totalAffected = 0;
     let lastId: number | bigint | undefined;
-    for (const params of paramsList) {
-      const result = await this.executeAsync(sql, params) as any;
-      totalAffected += result?.affectedRows ?? 1;
-      if (result?.insertId) lastId = result.insertId;
+    try {
+      for (const params of paramsList) {
+        const result = await this.executeAsync(sql, params) as any;
+        totalAffected += result?.affectedRows ?? 1;
+        if (result?.insertId) lastId = result.insertId;
+      }
+      if (owns) await this.commitAsync();
+    } catch (e) {
+      if (owns) {
+        try { await this.rollbackAsync(); } catch { /* surface the original error */ }
+      }
+      throw e;
     }
     return { totalAffected, lastInsertId: lastId };
   }
@@ -248,6 +268,7 @@ export class MysqlAdapter implements DatabaseAdapter {
 
   async startTransactionAsync(): Promise<void> {
     await this.executeAsync("START TRANSACTION");
+    this._inTransaction = true;
   }
 
   commit(): void {
@@ -256,6 +277,7 @@ export class MysqlAdapter implements DatabaseAdapter {
 
   async commitAsync(): Promise<void> {
     await this.executeAsync("COMMIT");
+    this._inTransaction = false;
   }
 
   rollback(): void {
@@ -264,6 +286,7 @@ export class MysqlAdapter implements DatabaseAdapter {
 
   async rollbackAsync(): Promise<void> {
     await this.executeAsync("ROLLBACK");
+    this._inTransaction = false;
   }
 
   tables(): string[] {

package/packages/orm/src/adapters/postgres.ts

@@ -72,6 +72,10 @@ export class PostgresAdapter implements DatabaseAdapter {
   // `id uuid PRIMARY KEY DEFAULT gen_random_uuid()` shape) returns its id as a
   // 36-char string via RETURNING, not a SERIAL integer (#256).
   private _lastInsertId: number | bigint | string | null = null;
+  // True between startTransactionAsync() and commit/rollback. executeManyAsync
+  // uses it to decide whether IT owns the batch transaction (mirrors the Python
+  // master's owns_txn guard) so it never double-BEGINs inside an explicit one.
+  private _inTransaction = false;
 
   constructor(private config: PostgresConfig | string) {}
 
@@ -150,14 +154,30 @@ export class PostgresAdapter implements DatabaseAdapter {
 
   /** Async executeMany for real usage. */
   async executeManyAsync(sql: string, paramsList: unknown[][]): Promise<{ totalAffected: number; lastInsertId?: number | bigint }> {
+    // Run the whole batch in ONE transaction so it is atomic (all-or-nothing) —
+    // a bad row mid-batch rolls back the rows already inserted instead of
+    // leaving a partial write. Mirrors the documented "wrapped in a transaction"
+    // contract, the SQLite adapter, and the Python master's execute_many. Only
+    // own the transaction when not already inside an explicit one (owns guard),
+    // so a batch insert nested in a caller's startTransaction() just joins it.
+    const owns = !this._inTransaction;
+    if (owns) await this.startTransactionAsync();
     let totalAffected = 0;
     let lastId: number | bigint | undefined;
-    for (const params of paramsList) {
-      const result = await this.executeAsync(sql, params);
-      totalAffected++;
-      if (result && typeof result === "object" && "lastInsertId" in (result as any)) {
-        lastId = (result as any).lastInsertId;
+    try {
+      for (const params of paramsList) {
+        const result = await this.executeAsync(sql, params);
+        totalAffected++;
+        if (result && typeof result === "object" && "lastInsertId" in (result as any)) {
+          lastId = (result as any).lastInsertId;
+        }
+      }
+      if (owns) await this.commitAsync();
+    } catch (e) {
+      if (owns) {
+        try { await this.rollbackAsync(); } catch { /* surface the original error */ }
       }
+      throw e;
     }
     return { totalAffected, lastInsertId: lastId };
   }

package/packages/orm/src/migration.ts

@@ -569,54 +569,137 @@ export function normalizeQuotes(sql: string): string {
 }
 
 /**
- * Split SQL text into individual statements on the given delimiter.
+ * Split SQL text into individual statements with a single-pass, quote- and
+ * comment-aware scanner. The split decision is made character by character so
+ * the delimiter only ever fires in real statement position.
  *
- * Strips line comments (`-- ...`) and block comments, handles stored
- * procedure blocks delimited by `$$` or `//`.
+ * This is the fix for issue #54: the old implementation split on `delimiter`
+ * BEFORE stripping `-- …` line comments, so a `;` inside a line comment
+ * fragmented one statement into several broken pieces. A scanner that knows
+ * where it is (code / comment / string) cannot make that mistake.
+ *
+ * Handled, in priority order, only when NOT already inside a stored-proc block:
+ * - `$$ … $$` and `// … //` stored-proc blocks are kept intact (inner `;` never
+ *   splits). A `//` preceded by `:` is a URL scheme (`https://…`), not a delimiter.
+ * - `/* … *​/` block comments are stripped.
+ * - `-- …` line comments are stripped to end of line (the newline is kept).
+ * - `'…'` single-quoted strings and `"…"` double-quoted identifiers are copied
+ *   verbatim, honouring the SQL doubled-quote escape (`''` / `""`); a `;`, `--`
+ *   or `/*` inside a literal is data, not a delimiter or comment.
+ * Mirrors the tina4-python `_split_statements` / tina4-php scanner (parity).
  */
 export function splitStatements(sql: string, delimiter = ";"): string[] {
   // Normalize smart/curly quotes to straight ASCII first, so SQL pasted from
-  // an editor/doc (which converts " → “ ” and ' → ‘ ’) actually runs. Mirrors
-  // Python's _split_statements applying _normalize_quotes as its first line.
+  // an editor/doc (which converts " → “ ” and ' → ‘ ’) actually runs.
   sql = normalizeQuotes(sql);
 
-  // Extract blocks delimited by $$ or // first, replacing with placeholders
-  const blocks: string[] = [];
-  const saveBlock = (_match: string, _p1: string): string => {
-    blocks.push(_match);
-    return `__BLOCK_${blocks.length - 1}__`;
-  };
+  const statements: string[] = [];
+  let current = "";
+  const n = sql.length;
+  const dlen = delimiter.length;
+  let i = 0;
+  let inDollarBlock = false;
+  let inSlashBlock = false;
+
+  while (i < n) {
+    const ch = sql[i];
+
+    // $$ … $$ stored-proc block (toggle).
+    if (!inSlashBlock && ch === "$" && i + 1 < n && sql[i + 1] === "$") {
+      current += "$$";
+      i += 2;
+      inDollarBlock = !inDollarBlock;
+      continue;
+    }
+
+    // // … // stored-proc block (toggle) — but NOT a `://` URL scheme.
+    if (
+      !inDollarBlock && ch === "/" && i + 1 < n && sql[i + 1] === "/" &&
+      !(i > 0 && sql[i - 1] === ":")
+    ) {
+      current += "//";
+      i += 2;
+      inSlashBlock = !inSlashBlock;
+      continue;
+    }
 
-  let processed = sql.replace(/\$\$([\s\S]*?)\$\$/g, saveBlock);
-  // The `//` delimiters must NOT be preceded by a colon, so a URL scheme
-  // (`https://…`) or other `://` literal inside a migration is never captured
-  // as an opaque stored-proc block (it would otherwise swallow everything
-  // between two `//` occurrences and skip statement splitting/cleaning).
-  // Negative lookbehind `(?<!:)` mirrors Python's runner.
-  processed = processed.replace(/(?<!:)\/\/([\s\S]*?)(?<!:)\/\//g, saveBlock);
+    // Inside a stored-proc block: consume verbatim (inner ; never splits).
+    if (inDollarBlock || inSlashBlock) {
+      current += ch;
+      i += 1;
+      continue;
+    }
 
-  // Remove block comments (/* ... */)
-  const clean = processed.replace(/\/\*[\s\S]*?\*\//g, "");
+    // Block comment /* … */ — stripped.
+    if (ch === "/" && i + 1 < n && sql[i + 1] === "*") {
+      const end = sql.indexOf("*/", i + 2);
+      i = end !== -1 ? end + 2 : n;
+      continue;
+    }
 
-  const statements: string[] = [];
-  for (const part of clean.split(delimiter)) {
-    const lines: string[] = [];
-    for (const line of part.split("\n")) {
-      const stripped = line.trim();
-      if (!stripped || stripped.startsWith("--")) continue;
-      // Remove inline comments
-      const commentPos = line.indexOf("--");
-      lines.push(commentPos >= 0 ? line.slice(0, commentPos) : line);
+    // Line comment -- … — stripped to end of line; the newline is left for the
+    // next iteration so line structure (and NEXT-line boundaries) survive.
+    if (ch === "-" && i + 1 < n && sql[i + 1] === "-") {
+      const end = sql.indexOf("\n", i + 2);
+      i = end !== -1 ? end : n;
+      continue;
     }
-    let cleaned = lines.join("\n").trim();
 
-    // Restore block placeholders
-    for (let i = 0; i < blocks.length; i++) {
-      cleaned = cleaned.replace(`__BLOCK_${i}__`, blocks[i]);
+    // Single-quoted string literal — '' escapes a quote. Copied verbatim.
+    if (ch === "'") {
+      current += "'";
+      i += 1;
+      while (i < n) {
+        if (sql[i] === "'" && i + 1 < n && sql[i + 1] === "'") {
+          current += "''";
+          i += 2;
+        } else if (sql[i] === "'") {
+          current += "'";
+          i += 1;
+          break;
+        } else {
+          current += sql[i];
+          i += 1;
+        }
+      }
+      continue;
+    }
+
+    // Double-quoted identifier — "" escapes a quote. Same verbatim handling.
+    if (ch === '"') {
+      current += '"';
+      i += 1;
+      while (i < n) {
+        if (sql[i] === '"' && i + 1 < n && sql[i + 1] === '"') {
+          current += '""';
+          i += 2;
+        } else if (sql[i] === '"') {
+          current += '"';
+          i += 1;
+          break;
+        } else {
+          current += sql[i];
+          i += 1;
+        }
+      }
+      continue;
     }
 
-    if (cleaned) statements.push(cleaned);
+    // Statement delimiter — only reached outside blocks/comments/strings.
+    if (dlen > 0 && sql.startsWith(delimiter, i)) {
+      const stmt = current.trim();
+      if (stmt) statements.push(stmt);
+      current = "";
+      i += dlen;
+      continue;
+    }
+
+    current += ch;
+    i += 1;
   }
+
+  const stmt = current.trim();
+  if (stmt) statements.push(stmt);
   return statements;
 }