tina4-nodejs 3.13.87 → 3.13.88

package/CLAUDE.md

@@ -1,10 +1,10 @@
-# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.87)
+# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.88)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 
 ## What This Project Is
 
-Tina4 for Node.js/TypeScript v3.13.87 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
+Tina4 for Node.js/TypeScript v3.13.88 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
 
 The philosophy: zero ceremony, batteries included, file system as source of truth.
 
@@ -1244,7 +1244,7 @@ When adding new features, add a corresponding `test/<feature>.test.ts` file.
 ## v3 Features Summary
 
 - **98 built-in features**, zero third-party dependencies
-- **5,879 tests** passing across 189 files (build + typecheck green)
+- **5,899 tests** passing across 189 files (build + typecheck green)
 - **Race-safe `getNextId()`** with atomic sequence table (`tina4_sequences`) for SQLite/MySQL/MSSQL; PostgreSQL auto-creates sequences
 - **Frond template engine optimizations**: pre-compiled regexes, lazy loop context (copy-on-write), filter chain caching, path split caching, inline common filters (11-15% speedup)
 - **Production server auto-detect**: `npx tina4nodejs serve --production` auto-uses cluster mode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tina4-nodejs",
-  "version": "3.13.87",
+  "version": "3.13.88",
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript - 54 built-in features, zero dependencies",
   "keywords": [

package/packages/cli/dist/bin.js

@@ -12786,6 +12786,26 @@ __export(engine_exports, {
 import { createHash as createHash2, createHmac as createHmac3, randomBytes as randomBytes4 } from "node:crypto";
 import { readFileSync as readFileSync6, existsSync as existsSync9, statSync as statSync6 } from "node:fs";
 import { join as join11, resolve as resolve7 } from "node:path";
+function jsonText(value) {
+  try {
+    const text = JSON.stringify(value);
+    return text === void 0 ? "null" : text;
+  } catch {
+    const seen = /* @__PURE__ */ new WeakSet();
+    const text = JSON.stringify(value, (_key, v) => {
+      if (typeof v === "bigint") return v.toString();
+      if (typeof v === "object" && v !== null) {
+        if (seen.has(v)) return null;
+        seen.add(v);
+      }
+      return v;
+    });
+    return text === void 0 ? "null" : text;
+  }
+}
+function jsonSafe(value) {
+  return new SafeString(jsonText(value).replace(JSON_UNSAFE_RE, (c) => JSON_UNSAFE_MAP[c]));
+}
 function inspectValue(value, seen = /* @__PURE__ */ new WeakSet(), depth = 0) {
   if (value === null) return "null";
   if (value === void 0) return "undefined";
@@ -13773,7 +13793,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -13785,6 +13805,15 @@ var init_engine = __esm({
         return this.value;
       }
     };
+    JSON_UNSAFE_RE = /[<>&'\u2028\u2029]/g;
+    JSON_UNSAFE_MAP = {
+      "<": "\\u003c",
+      ">": "\\u003e",
+      "&": "\\u0026",
+      "'": "\\u0027",
+      "\u2028": "\\u2028",
+      "\u2029": "\\u2029"
+    };
     NUMERIC_RE = /^-?\d+(\.\d+)?$/;
     METHOD_CALL_RE = /^(\w+)\s*\(([\s\S]*)?\)$/;
     FN_CALL_RE = /^([\w.]+)\s*\(([\s\S]*)?\)$/;
@@ -13875,7 +13904,7 @@ var init_engine = __esm({
       int: (v) => v ? parseInt(String(v), 10) || 0 : 0,
       float: (v) => v ? parseFloat(String(v)) || 0 : 0,
       string: (v) => String(v),
-      json_encode: (v) => JSON.stringify(v),
+      json_encode: (v) => jsonSafe(v),
       json_decode: (v) => typeof v === "string" ? JSON.parse(v) : v,
       keys: (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? Object.keys(v) : [],
       values: (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? Object.values(v) : [],
@@ -14020,8 +14049,12 @@ var init_engine = __esm({
       form_token: (v) => _generateFormToken(v != null ? String(v) : ""),
       formTokenValue: (v) => _generateFormTokenValue(v != null ? String(v) : ""),
       form_token_value: (v) => _generateFormTokenValue(v != null ? String(v) : ""),
-      tojson: (v, indent) => new SafeString(indent !== void 0 ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
-      to_json: (v, indent) => new SafeString(indent !== void 0 ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
+      // Same serializer as json_encode -- the three names are one behaviour. The
+      // old indent argument is gone: PHP cannot honour an arbitrary indent
+      // (JSON_PRETTY_PRINT is fixed at four spaces), so honouring it here alone
+      // broke byte-parity for the one filter whose whole job is a wire format.
+      tojson: (v) => jsonSafe(v),
+      to_json: (v) => jsonSafe(v),
       js_escape: (v) => new SafeString(String(v).replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t"))
     };
     _formTokenSessionId = "";
@@ -14761,7 +14794,7 @@ var init_engine = __esm({
                 value = typeof value === "object" && value !== null && !Array.isArray(value) ? Object.values(value) : [];
                 continue;
               case "json_encode":
-                value = JSON.stringify(value);
+                value = jsonSafe(value);
                 continue;
               case "dump":
                 value = renderDump(value);

package/packages/core/dist/index.js

@@ -12785,6 +12785,26 @@ __export(engine_exports, {
 import { createHash as createHash2, createHmac as createHmac3, randomBytes as randomBytes4 } from "node:crypto";
 import { readFileSync as readFileSync6, existsSync as existsSync8, statSync as statSync6 } from "node:fs";
 import { join as join10, resolve as resolve6 } from "node:path";
+function jsonText(value) {
+  try {
+    const text = JSON.stringify(value);
+    return text === void 0 ? "null" : text;
+  } catch {
+    const seen = /* @__PURE__ */ new WeakSet();
+    const text = JSON.stringify(value, (_key, v) => {
+      if (typeof v === "bigint") return v.toString();
+      if (typeof v === "object" && v !== null) {
+        if (seen.has(v)) return null;
+        seen.add(v);
+      }
+      return v;
+    });
+    return text === void 0 ? "null" : text;
+  }
+}
+function jsonSafe(value) {
+  return new SafeString(jsonText(value).replace(JSON_UNSAFE_RE, (c) => JSON_UNSAFE_MAP[c]));
+}
 function inspectValue(value, seen = /* @__PURE__ */ new WeakSet(), depth = 0) {
   if (value === null) return "null";
   if (value === void 0) return "undefined";
@@ -13772,7 +13792,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -13784,6 +13804,15 @@ var init_engine = __esm({
         return this.value;
       }
     };
+    JSON_UNSAFE_RE = /[<>&'\u2028\u2029]/g;
+    JSON_UNSAFE_MAP = {
+      "<": "\\u003c",
+      ">": "\\u003e",
+      "&": "\\u0026",
+      "'": "\\u0027",
+      "\u2028": "\\u2028",
+      "\u2029": "\\u2029"
+    };
     NUMERIC_RE = /^-?\d+(\.\d+)?$/;
     METHOD_CALL_RE = /^(\w+)\s*\(([\s\S]*)?\)$/;
     FN_CALL_RE = /^([\w.]+)\s*\(([\s\S]*)?\)$/;
@@ -13874,7 +13903,7 @@ var init_engine = __esm({
       int: (v) => v ? parseInt(String(v), 10) || 0 : 0,
       float: (v) => v ? parseFloat(String(v)) || 0 : 0,
       string: (v) => String(v),
-      json_encode: (v) => JSON.stringify(v),
+      json_encode: (v) => jsonSafe(v),
       json_decode: (v) => typeof v === "string" ? JSON.parse(v) : v,
       keys: (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? Object.keys(v) : [],
       values: (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? Object.values(v) : [],
@@ -14019,8 +14048,12 @@ var init_engine = __esm({
       form_token: (v) => _generateFormToken(v != null ? String(v) : ""),
       formTokenValue: (v) => _generateFormTokenValue(v != null ? String(v) : ""),
       form_token_value: (v) => _generateFormTokenValue(v != null ? String(v) : ""),
-      tojson: (v, indent) => new SafeString(indent !== void 0 ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
-      to_json: (v, indent) => new SafeString(indent !== void 0 ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
+      // Same serializer as json_encode -- the three names are one behaviour. The
+      // old indent argument is gone: PHP cannot honour an arbitrary indent
+      // (JSON_PRETTY_PRINT is fixed at four spaces), so honouring it here alone
+      // broke byte-parity for the one filter whose whole job is a wire format.
+      tojson: (v) => jsonSafe(v),
+      to_json: (v) => jsonSafe(v),
       js_escape: (v) => new SafeString(String(v).replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t"))
     };
     _formTokenSessionId = "";
@@ -14760,7 +14793,7 @@ var init_engine = __esm({
                 value = typeof value === "object" && value !== null && !Array.isArray(value) ? Object.values(value) : [];
                 continue;
               case "json_encode":
-                value = JSON.stringify(value);
+                value = jsonSafe(value);
                 continue;
               case "dump":
                 value = renderDump(value);

package/packages/frond/dist/index.js

@@ -10,6 +10,35 @@ var SafeString = class {
     return this.value;
   }
 };
+function jsonText(value) {
+  try {
+    const text = JSON.stringify(value);
+    return text === void 0 ? "null" : text;
+  } catch {
+    const seen = /* @__PURE__ */ new WeakSet();
+    const text = JSON.stringify(value, (_key, v) => {
+      if (typeof v === "bigint") return v.toString();
+      if (typeof v === "object" && v !== null) {
+        if (seen.has(v)) return null;
+        seen.add(v);
+      }
+      return v;
+    });
+    return text === void 0 ? "null" : text;
+  }
+}
+var JSON_UNSAFE_RE = /[<>&'\u2028\u2029]/g;
+var JSON_UNSAFE_MAP = {
+  "<": "\\u003c",
+  ">": "\\u003e",
+  "&": "\\u0026",
+  "'": "\\u0027",
+  "\u2028": "\\u2028",
+  "\u2029": "\\u2029"
+};
+function jsonSafe(value) {
+  return new SafeString(jsonText(value).replace(JSON_UNSAFE_RE, (c) => JSON_UNSAFE_MAP[c]));
+}
 function inspectValue(value, seen = /* @__PURE__ */ new WeakSet(), depth = 0) {
   if (value === null) return "null";
   if (value === void 0) return "undefined";
@@ -1049,7 +1078,7 @@ var BUILTIN_FILTERS = {
   int: (v) => v ? parseInt(String(v), 10) || 0 : 0,
   float: (v) => v ? parseFloat(String(v)) || 0 : 0,
   string: (v) => String(v),
-  json_encode: (v) => JSON.stringify(v),
+  json_encode: (v) => jsonSafe(v),
   json_decode: (v) => typeof v === "string" ? JSON.parse(v) : v,
   keys: (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? Object.keys(v) : [],
   values: (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? Object.values(v) : [],
@@ -1194,8 +1223,12 @@ var BUILTIN_FILTERS = {
   form_token: (v) => _generateFormToken(v != null ? String(v) : ""),
   formTokenValue: (v) => _generateFormTokenValue(v != null ? String(v) : ""),
   form_token_value: (v) => _generateFormTokenValue(v != null ? String(v) : ""),
-  tojson: (v, indent) => new SafeString(indent !== void 0 ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
-  to_json: (v, indent) => new SafeString(indent !== void 0 ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
+  // Same serializer as json_encode -- the three names are one behaviour. The
+  // old indent argument is gone: PHP cannot honour an arbitrary indent
+  // (JSON_PRETTY_PRINT is fixed at four spaces), so honouring it here alone
+  // broke byte-parity for the one filter whose whole job is a wire format.
+  tojson: (v) => jsonSafe(v),
+  to_json: (v) => jsonSafe(v),
   js_escape: (v) => new SafeString(String(v).replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t"))
 };
 function _b64url(data) {
@@ -1970,7 +2003,7 @@ var Frond = class _Frond {
             value = typeof value === "object" && value !== null && !Array.isArray(value) ? Object.values(value) : [];
             continue;
           case "json_encode":
-            value = JSON.stringify(value);
+            value = jsonSafe(value);
             continue;
           case "dump":
             value = renderDump(value);

package/packages/frond/src/engine.ts

@@ -34,6 +34,69 @@ class SafeString {
   toString() { return this.value; }
 }
 
+/**
+ * Serialize a value to compact JSON text that is always valid JSON.
+ *
+ * Never throws and never returns an empty string. JSON.stringify already maps a
+ * non-finite number to null, but it returns the VALUE `undefined` for undefined,
+ * a function, or a symbol, and it throws on a BigInt or a circular structure --
+ * all four of which would otherwise reach the page as nothing or as a crash.
+ */
+function jsonText(value: unknown): string {
+  try {
+    const text = JSON.stringify(value);
+    return text === undefined ? "null" : text;
+  } catch {
+    // Only reached when the happy path threw, so a well-formed payload never
+    // pays for the walk.
+    const seen = new WeakSet<object>();
+    const text = JSON.stringify(value, (_key, v) => {
+      if (typeof v === "bigint") return v.toString();
+      if (typeof v === "object" && v !== null) {
+        if (seen.has(v)) return null;
+        seen.add(v);
+      }
+      return v;
+    });
+    return text === undefined ? "null" : text;
+  }
+}
+
+const JSON_UNSAFE_RE = /[<>&'\u2028\u2029]/g;
+const JSON_UNSAFE_MAP: Record<string, string> = {
+  "<": "\\u003c", ">": "\\u003e", "&": "\\u0026", "'": "\\u0027",
+  "\u2028": "\\u2028", "\u2029": "\\u2029",
+};
+
+/**
+ * Serialize to JSON that is valid JSON, valid JavaScript, and safe in HTML.
+ *
+ * THE cross-framework contract for json_encode / to_json / tojson. Keep the four
+ * implementations byte-identical; frond_expression_corpus.txt locks it.
+ *
+ * Three things this must never do, each of which was a real bug in one of the
+ * four engines:
+ *
+ * 1. Never emit a non-finite literal. Python wrote a bare `Infinity`, PHP
+ *    returned false, Ruby fell back to inspect output -- none of them parse.
+ *    Node was the one that already got this right. Reported as tina4-php#184 by
+ *    justin-k-bruce.
+ * 2. Never emit nothing, and never emit something that still parses and means
+ *    something else. "var ROWS = ;" is at least a loud SyntaxError.
+ * 3. Never HTML-escape it. Entity-encoding JSON produces {&quot;a&quot;:1}, a
+ *    SyntaxError inside <script>, which is the filter's whole point. Escape only
+ *    the dangerous characters, as JSON \uXXXX escapes: the result stays valid
+ *    JSON AND valid JavaScript, </script> cannot terminate the block, and it is
+ *    safe inside a single-quoted attribute. This is what Jinja2's tojson does,
+ *    and it is why the result is a SafeString.
+ *
+ * U+2028 and U+2029 join that escape set. Both are legal inside a JSON string and
+ * both were illegal inside a JavaScript string literal before ES2019.
+ */
+function jsonSafe(value: unknown): SafeString {
+  return new SafeString(jsonText(value).replace(JSON_UNSAFE_RE, (c) => JSON_UNSAFE_MAP[c]));
+}
+
 /**
  * Produce a human-readable, debugger-friendly inspection of any value.
  *
@@ -1307,7 +1370,7 @@ const BUILTIN_FILTERS: Record<string, FilterFn> = {
   int: (v) => v ? parseInt(String(v), 10) || 0 : 0,
   float: (v) => v ? parseFloat(String(v)) || 0.0 : 0.0,
   string: (v) => String(v),
-  json_encode: (v) => JSON.stringify(v),
+  json_encode: (v) => jsonSafe(v),
   json_decode: (v) => typeof v === "string" ? JSON.parse(v) : v,
   keys: (v) => (typeof v === "object" && v !== null && !Array.isArray(v)) ? Object.keys(v) : [],
   values: (v) => (typeof v === "object" && v !== null && !Array.isArray(v)) ? Object.values(v) : [],
@@ -1431,8 +1494,12 @@ const BUILTIN_FILTERS: Record<string, FilterFn> = {
   form_token: (v?: unknown) => _generateFormToken(v != null ? String(v) : ""),
   formTokenValue: (v?: unknown) => _generateFormTokenValue(v != null ? String(v) : ""),
   form_token_value: (v?: unknown) => _generateFormTokenValue(v != null ? String(v) : ""),
-  tojson: (v, indent) => new SafeString(indent !== undefined ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
-  to_json: (v, indent) => new SafeString(indent !== undefined ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
+  // Same serializer as json_encode -- the three names are one behaviour. The
+  // old indent argument is gone: PHP cannot honour an arbitrary indent
+  // (JSON_PRETTY_PRINT is fixed at four spaces), so honouring it here alone
+  // broke byte-parity for the one filter whose whole job is a wire format.
+  tojson: (v) => jsonSafe(v),
+  to_json: (v) => jsonSafe(v),
   js_escape: (v) => new SafeString(String(v).replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t")),
 };
 
@@ -2346,7 +2413,7 @@ export class Frond {
           case "last":       value = Array.isArray(value) ? value[value.length - 1] ?? null : null; continue;
           case "keys":       value = (typeof value === "object" && value !== null && !Array.isArray(value)) ? Object.keys(value) : []; continue;
           case "values":     value = (typeof value === "object" && value !== null && !Array.isArray(value)) ? Object.values(value) : []; continue;
-          case "json_encode": value = JSON.stringify(value); continue;
+          case "json_encode": value = jsonSafe(value); continue;
           case "dump":
             // Delegates to renderDump(), which is gated on TINA4_DEBUG.
             // In production this emits an empty SafeString (no leaked state).

package/packages/orm/dist/index.js

@@ -3421,6 +3421,26 @@ __export(engine_exports, {
 import { createHash as createHash2, createHmac as createHmac2, randomBytes as randomBytes2 } from "node:crypto";
 import { readFileSync as readFileSync4, existsSync as existsSync6, statSync as statSync4 } from "node:fs";
 import { join as join5, resolve as resolve2 } from "node:path";
+function jsonText(value) {
+  try {
+    const text = JSON.stringify(value);
+    return text === void 0 ? "null" : text;
+  } catch {
+    const seen = /* @__PURE__ */ new WeakSet();
+    const text = JSON.stringify(value, (_key, v) => {
+      if (typeof v === "bigint") return v.toString();
+      if (typeof v === "object" && v !== null) {
+        if (seen.has(v)) return null;
+        seen.add(v);
+      }
+      return v;
+    });
+    return text === void 0 ? "null" : text;
+  }
+}
+function jsonSafe(value) {
+  return new SafeString(jsonText(value).replace(JSON_UNSAFE_RE, (c) => JSON_UNSAFE_MAP[c]));
+}
 function inspectValue(value, seen = /* @__PURE__ */ new WeakSet(), depth = 0) {
   if (value === null) return "null";
   if (value === void 0) return "undefined";
@@ -4408,7 +4428,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -4420,6 +4440,15 @@ var init_engine = __esm({
         return this.value;
       }
     };
+    JSON_UNSAFE_RE = /[<>&'\u2028\u2029]/g;
+    JSON_UNSAFE_MAP = {
+      "<": "\\u003c",
+      ">": "\\u003e",
+      "&": "\\u0026",
+      "'": "\\u0027",
+      "\u2028": "\\u2028",
+      "\u2029": "\\u2029"
+    };
     NUMERIC_RE = /^-?\d+(\.\d+)?$/;
     METHOD_CALL_RE = /^(\w+)\s*\(([\s\S]*)?\)$/;
     FN_CALL_RE = /^([\w.]+)\s*\(([\s\S]*)?\)$/;
@@ -4510,7 +4539,7 @@ var init_engine = __esm({
       int: (v) => v ? parseInt(String(v), 10) || 0 : 0,
       float: (v) => v ? parseFloat(String(v)) || 0 : 0,
       string: (v) => String(v),
-      json_encode: (v) => JSON.stringify(v),
+      json_encode: (v) => jsonSafe(v),
       json_decode: (v) => typeof v === "string" ? JSON.parse(v) : v,
       keys: (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? Object.keys(v) : [],
       values: (v) => typeof v === "object" && v !== null && !Array.isArray(v) ? Object.values(v) : [],
@@ -4655,8 +4684,12 @@ var init_engine = __esm({
       form_token: (v) => _generateFormToken(v != null ? String(v) : ""),
       formTokenValue: (v) => _generateFormTokenValue(v != null ? String(v) : ""),
       form_token_value: (v) => _generateFormTokenValue(v != null ? String(v) : ""),
-      tojson: (v, indent) => new SafeString(indent !== void 0 ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
-      to_json: (v, indent) => new SafeString(indent !== void 0 ? JSON.stringify(v, null, parseInt(String(indent), 10)) : JSON.stringify(v)),
+      // Same serializer as json_encode -- the three names are one behaviour. The
+      // old indent argument is gone: PHP cannot honour an arbitrary indent
+      // (JSON_PRETTY_PRINT is fixed at four spaces), so honouring it here alone
+      // broke byte-parity for the one filter whose whole job is a wire format.
+      tojson: (v) => jsonSafe(v),
+      to_json: (v) => jsonSafe(v),
       js_escape: (v) => new SafeString(String(v).replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t"))
     };
     _formTokenSessionId = "";
@@ -5396,7 +5429,7 @@ var init_engine = __esm({
                 value = typeof value === "object" && value !== null && !Array.isArray(value) ? Object.values(value) : [];
                 continue;
               case "json_encode":
-                value = JSON.stringify(value);
+                value = jsonSafe(value);
                 continue;
               case "dump":
                 value = renderDump(value);