tina4-nodejs 3.13.68 → 3.13.70

package/CLAUDE.md

@@ -1,10 +1,10 @@
-# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.68)
+# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.70)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 
 ## What This Project Is
 
-Tina4 for Node.js/TypeScript v3.13.68 — The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
+Tina4 for Node.js/TypeScript v3.13.70 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
 
 The philosophy: zero ceremony, batteries included, file system as source of truth.
 
@@ -877,7 +877,7 @@ frond.unsandbox();
 
 Zero-dep HTTP client over `node:http` / `node:https`. Used by integrations, queue producers, health checks, and tests.
 
-**Retry/backoff (opt-in, default off):** pass `maxRetries` (default `0`) and `retryBackoff` (default `0.5`s base, exponential) in the options bag — `new Api(url, { bearerToken, maxRetries: 3, retryBackoff: 0.5 })`. Retries a transport error (`http_code` null) or a retryable status (429/500/502/503/504); 4xx is never retried (a retried non-idempotent request may be re-sent, so retries are opt-in). Node's `node:http`/`node:https` doesn't auto-follow redirects, so there's no cross-host Authorization-leak surface (the redirect auth-strip is Python-only).
+**Retry/backoff (opt-in, default off):** pass `maxRetries` (default `0`) and `retryBackoff` (default `0.5`s base, exponential) in the options bag — `new Api(url, { bearerToken, maxRetries: 3, retryBackoff: 0.5 })`. Retries a transport error (`http_code` null) or a retryable status (429/500/502/503/504); 4xx is never retried (a retried non-idempotent request may be re-sent, so retries are opt-in).
 
 ```typescript
 import { Api } from "@tina4/core";
@@ -902,6 +902,34 @@ await api.sendRequest("OPTIONS", "/users");
 
 `error` is non-null on transport failure or timeout; `http_code` is `null` if the request never reached the server.
 
+**Multipart upload, streaming download, transport seam, cookie jar, redirects (v3.13.69, Python master parity).** All zero-dep, all opt-in and non-breaking:
+
+```typescript
+// Multipart upload — from disk OR in-memory bytes (no temp file needed).
+// Boundary is "----Tina4Boundary" + 32 hex; part Content-Type is guessed from
+// the filename (fallback application/octet-stream). A missing file / no source
+// returns a clean error result ({ http_code: null, error: ... }) — never throws.
+await api.upload("/avatars", { filePath: "/tmp/me.png", extraFields: { user_id: "42" } });
+await api.upload("/avatars", { fileBytes: buf, filename: "me.png", fieldName: "file" });
+
+// Streaming download — writes the body to disk in 64KB chunks (never buffered
+// whole). Returns { http_code, headers, error, path } (NO body field); path is
+// null and no file is written on any error.
+const dl = await api.download("/report.pdf", "/tmp/report.pdf", { q: "2026" });
+
+// Transport seam — an injectable async/sync callable
+// (method, url, headers, body, timeout) => { http_code, body, headers, error }
+// that REPLACES the node:http/https call. For APPLICATION-developer unit tests
+// only — Tina4's own suite never injects a fake (no-mock rule).
+new Api(url, { transport: async (method, u, headers, body, timeout) => ({ http_code: 200, body: {}, headers: {}, error: null }) });
+
+// Cookie jar — opt-in, in-memory, per-client. Parses Set-Cookie (leading
+// name=value, last write wins) and replays the accumulated Cookie header.
+new Api(url, { cookies: true });
+```
+
+**Redirect following (all verbs + download):** unlike bare `node:http`/`node:https`, the client now follows 3xx redirects (bounded to 10 hops). 301/302/303 on a body-bearing method become GET (body dropped, matching urllib); 307/308 preserve method + body. **Security:** the `Authorization` AND `Cookie` headers are STRIPPED when the redirect target is a different origin (scheme/host/port), so a bearer token or session cookie never leaks to a host you didn't authenticate to; same-origin redirects keep them. Full parity with Python master.
+
 ## Module: Queue (`packages/core/src/queue.ts`)
 
 Pluggable job queue (file/RabbitMQ/Kafka/MongoDB backends). The same fluent API works against any backend — pick via env vars.
@@ -1210,7 +1238,7 @@ When adding new features, add a corresponding `test/<feature>.test.ts` file.
 ## v3 Features Summary
 
 - **45 built-in features**, zero third-party dependencies
-- **3,752 tests** passing across all modules
+- **5,379 tests** passing across 154 files (build + typecheck green; 9 PostgreSQL/Valkey service-gated failures)
 - **Race-safe `getNextId()`** with atomic sequence table (`tina4_sequences`) for SQLite/MySQL/MSSQL; PostgreSQL auto-creates sequences
 - **Frond template engine optimizations**: pre-compiled regexes, lazy loop context (copy-on-write), filter chain caching, path split caching, inline common filters (11-15% speedup)
 - **Production server auto-detect**: `npx tina4nodejs serve --production` auto-uses cluster mode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tina4-nodejs",
-  "version": "3.13.68",
+  "version": "3.13.70",
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript - 54 built-in features, zero dependencies",
   "keywords": [
@@ -60,6 +60,13 @@
   "engines": {
     "node": ">=22.0.0"
   },
+  "optionalDependencies": {
+    "@aws-sdk/client-s3": "^3.600.0",
+    "@aws-sdk/s3-request-presigner": "^3.600.0",
+    "mongodb": "^6.0.0",
+    "pg": "^8.20.0",
+    "redis": "^4.7.0"
+  },
   "devDependencies": {
     "@types/node": "^22.10.0",
     "esbuild": "^0.24.0",

package/packages/core/src/ai.ts

@@ -4,7 +4,7 @@
  * Simple menu-driven installer for AI tool context files.
  * The user picks which tools they use, we install the appropriate files.
  *
- *   import { showMenu, installSelected } from "@tina4/core";
+ *   import { showMenu, installSelected } from "tina4-nodejs";
  */
 import { existsSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
@@ -693,7 +693,7 @@ Set \`TINA4_DATABASE_URL\` in \`.env\` (e.g. \`postgres://localhost:5432/mydb\`)
 
 ## Auth
 
-JWT auth built in. \`import { createToken, validateToken, hashPassword, checkPassword } from "@tina4/core"\`.
+JWT auth built in. \`import { createToken, validateToken, hashPassword, checkPassword } from "tina4-nodejs"\`.
 GET routes are public. POST/PUT/PATCH/DELETE require auth by default.
 `;
 }
@@ -862,7 +862,7 @@ Set \`TINA4_DATABASE_URL\` in \`.env\` (e.g. \`sqlite:///path/to/db.sqlite\`, \`
 
 ## Auth
 
-JWT auth built in. \`import { createToken, validateToken, hashPassword, checkPassword } from "@tina4/core"\`.
+JWT auth built in. \`import { createToken, validateToken, hashPassword, checkPassword } from "tina4-nodejs"\`.
 GET routes are public. POST/PUT/PATCH/DELETE require auth by default.
 
 ## Testing
@@ -873,7 +873,7 @@ npx tina4nodejs test      # Run all tests
 
 Add test files in \`test/\` directory. Use built-in inline testing:
 \`\`\`typescript
-import { tests, assertEqual, runAll } from "@tina4/core";
+import { tests, assertEqual, runAll } from "tina4-nodejs";
 \`\`\`
 
 ## Important