tina4-nodejs 3.13.5 → 3.13.7

package/CLAUDE.md

@@ -1,10 +1,10 @@
-# CLAUDE.md — AI Developer Guide for tina4-nodejs (v3.13.5)
+# CLAUDE.md — AI Developer Guide for tina4-nodejs (v3.13.7)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 
 ## What This Project Is
 
-Tina4 for Node.js/TypeScript v3.13.5 — The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
+Tina4 for Node.js/TypeScript v3.13.7 — The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
 
 The philosophy: zero ceremony, batteries included, file system as source of truth.
 

package/package.json

@@ -3,7 +3,7 @@
 
 
 
-  "version": "3.13.5",
+  "version": "3.13.7",
 
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript \u2014 54 built-in features, zero dependencies",

package/packages/core/src/server.ts

@@ -1278,7 +1278,31 @@ ${reset}
         res({ error: "Not Found", statusCode: 404, message: `No route found for ${req.method} ${pathname}` }, 404);
       }
     } catch (err) {
-      console.error("  Error:", err);
+      // v3.13.7: log structured + surface to observability BEFORE rendering.
+      // Listeners get the canonical {exception, request} payload mirrored
+      // by Python / PHP / Ruby. Listener errors are swallowed + warning-
+      // logged so a broken listener can't break the 500 page.
+      Log.error(`Route error: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}`, {
+        method: req?.method,
+        path: req?.path,
+      });
+      try {
+        const { Events } = await import("./events.js");
+        Events.emit("tina4.request.error", { exception: err, request: req });
+      } catch (listenerErr) {
+        try {
+          Log.warn(
+            `Listener for tina4.request.error raised: ${
+              listenerErr instanceof Error
+                ? `${listenerErr.name}: ${listenerErr.message}`
+                : String(listenerErr)
+            }`
+          );
+        } catch {
+          // Log failures must never block the 500 render.
+        }
+      }
+
       if (!res.raw.writableEnded) {
         if (isDevMode() && err instanceof Error) {
           // Rich error overlay with stack trace, source context, and line numbers
@@ -1287,9 +1311,12 @@ ${reset}
           res.raw.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
           res.raw.end(overlayHtml);
         } else {
-          const errorMessage = !isTruthy(process.env.TINA4_DEBUG) ? "Internal Server Error" : String(err);
+          // v3.13.7 SECURITY (CWE-209): production response body must NOT
+          // contain the stack trace or exception message. Pass an empty
+          // error_message — the 500.twig template only renders the trace
+          // block when error_message is truthy.
           const html500 = await renderErrorPage(500, {
-            error_message: errorMessage,
+            error_message: "",
             request_id: `${Date.now().toString(36)}`,
             path: req.path,
           }, templatesDir);
@@ -1297,7 +1324,7 @@ ${reset}
             res.raw.writeHead(500, { "Content-Type": "text/html; charset=utf-8" });
             res.raw.end(html500);
           } else {
-            res({ error: "Internal Server Error", statusCode: 500, message: errorMessage }, 500);
+            res({ error: "Internal Server Error", statusCode: 500 }, 500);
           }
         }
       }

package/packages/core/templates/errors/500.twig

@@ -27,7 +27,7 @@ body { font-family: system-ui, -apple-system, sans-serif; background: #0f172a; c
         <div class="error-title">Server Error</div>
     </div>
     <div class="error-msg">Something went wrong while processing your request.</div>
-    <pre class="error-trace">{{ error_message }}</pre>
+    {% if error_message %}<pre class="error-trace">{{ error_message }}</pre>{% endif %}
     <div class="error-footer">
         <span class="error-hint">Fix the error and save to auto-reload</span>
         <span class="error-id">{{ request_id }}</span>

package/packages/orm/src/adapters/firebird.ts

@@ -18,7 +18,11 @@ function requireFirebird(): any {
     return firebird;
   } catch {
     throw new Error(
-      'Firebird adapter requires the "node-firebird" package. Install it with: npm install node-firebird',
+      'Firebird adapter requires the "node-firebird" package. Install one of:\n' +
+        "    npm install node-firebird\n" +
+        "    yarn add node-firebird\n" +
+        "    pnpm add node-firebird\n" +
+        "    bun add node-firebird",
     );
   }
 }

package/packages/orm/src/adapters/mongodb.ts

@@ -301,8 +301,11 @@ export class MongodbAdapter implements DatabaseAdapter {
       MongoClient = (await import("mongodb")).MongoClient;
     } catch {
       throw new Error(
-        "The 'mongodb' package is required for MongoDB connections. " +
-        "Install: npm install mongodb",
+        "The 'mongodb' package is required for MongoDB connections. Install one of:\n" +
+          "    npm install mongodb\n" +
+          "    yarn add mongodb\n" +
+          "    pnpm add mongodb\n" +
+          "    bun add mongodb",
       );
     }
 

package/packages/orm/src/adapters/mssql.ts

@@ -18,7 +18,11 @@ function requireTedious(): any {
     return tedious;
   } catch {
     throw new Error(
-      'MSSQL adapter requires the "tedious" package. Install it with: npm install tedious',
+      'MSSQL adapter requires the "tedious" package. Install one of:\n' +
+        "    npm install tedious\n" +
+        "    yarn add tedious\n" +
+        "    pnpm add tedious\n" +
+        "    bun add tedious",
     );
   }
 }

package/packages/orm/src/adapters/mysql.ts

@@ -18,7 +18,11 @@ function requireMysql2(): any {
     return mysql2;
   } catch {
     throw new Error(
-      'MySQL adapter requires the "mysql2" package. Install it with: npm install mysql2',
+      'MySQL adapter requires the "mysql2" package. Install one of:\n' +
+        "    npm install mysql2\n" +
+        "    yarn add mysql2\n" +
+        "    pnpm add mysql2\n" +
+        "    bun add mysql2",
     );
   }
 }

package/packages/orm/src/adapters/odbc.ts

@@ -21,7 +21,11 @@ function requireOdbc(): any {
     return odbcModule;
   } catch {
     throw new Error(
-      "The 'odbc' package is required for ODBC connections. Install it with: npm install odbc",
+      "The 'odbc' package is required for ODBC connections. Install one of:\n" +
+        "    npm install odbc\n" +
+        "    yarn add odbc\n" +
+        "    pnpm add odbc\n" +
+        "    bun add odbc",
     );
   }
 }

package/packages/orm/src/adapters/postgres.ts

@@ -19,7 +19,11 @@ function requirePg(): typeof import("pg") {
     return pg!;
   } catch {
     throw new Error(
-      'PostgreSQL adapter requires the "pg" package. Install it with: npm install pg',
+      'PostgreSQL adapter requires the "pg" package. Install one of:\n' +
+        "    npm install pg\n" +
+        "    yarn add pg\n" +
+        "    pnpm add pg\n" +
+        "    bun add pg",
     );
   }
 }