tina4-nodejs 3.13.88 → 3.13.90

package/CLAUDE.md

@@ -1,10 +1,10 @@
-# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.88)
+# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.90)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 
 ## What This Project Is
 
-Tina4 for Node.js/TypeScript v3.13.88 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
+Tina4 for Node.js/TypeScript v3.13.90 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
 
 The philosophy: zero ceremony, batteries included, file system as source of truth.
 
@@ -1244,7 +1244,7 @@ When adding new features, add a corresponding `test/<feature>.test.ts` file.
 ## v3 Features Summary
 
 - **98 built-in features**, zero third-party dependencies
-- **5,899 tests** passing across 189 files (build + typecheck green)
+- **5,923 tests** passing across 189 files (build + typecheck green)
 - **Race-safe `getNextId()`** with atomic sequence table (`tina4_sequences`) for SQLite/MySQL/MSSQL; PostgreSQL auto-creates sequences
 - **Frond template engine optimizations**: pre-compiled regexes, lazy loop context (copy-on-write), filter chain caching, path split caching, inline common filters (11-15% speedup)
 - **Production server auto-detect**: `npx tina4nodejs serve --production` auto-uses cluster mode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tina4-nodejs",
-  "version": "3.13.88",
+  "version": "3.13.90",
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript - 54 built-in features, zero dependencies",
   "keywords": [

package/packages/cli/dist/bin.js

@@ -13793,7 +13793,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -13805,6 +13805,37 @@ var init_engine = __esm({
         return this.value;
       }
     };
+    KNOWN_TAGS = /* @__PURE__ */ new Set([
+      "autoescape",
+      "block",
+      "cache",
+      "extends",
+      "for",
+      "from",
+      "if",
+      "import",
+      "include",
+      "live",
+      "macro",
+      "raw",
+      "set",
+      "spaceless"
+    ]);
+    TERMINATOR_TAGS = /* @__PURE__ */ new Set([
+      "elif",
+      "else",
+      "elseif",
+      "endautoescape",
+      "endblock",
+      "endcache",
+      "endfor",
+      "endif",
+      "endlive",
+      "endmacro",
+      "endraw",
+      "endset",
+      "endspaceless"
+    ]);
     JSON_UNSAFE_RE = /[<>&'\u2028\u2029]/g;
     JSON_UNSAFE_MAP = {
       "<": "\\u003c",
@@ -14459,8 +14490,11 @@ var init_engine = __esm({
                 i = skip;
               }
             } else if (tag === "set") {
+              const isBlockSet = !content.includes("=");
               if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("set")) {
-                i++;
+                i = isBlockSet ? this.skipBlock(tokens, i, "set", "endset") : i + 1;
+              } else if (isBlockSet) {
+                i = this.handleSetBlock(tokens, i, context);
               } else {
                 this.handleSet(content, context);
                 i++;
@@ -14502,6 +14536,11 @@ var init_engine = __esm({
               i++;
             } else {
               i++;
+              if (tag !== "" && !TERMINATOR_TAGS.has(tag)) {
+                throw new Error(
+                  `Frond: unknown tag "${tag}" -- known tags are: ${[...KNOWN_TAGS].sort().join(", ")}`
+                );
+              }
             }
             if (stripA && i < tokens.length && tokens[i][0] === "TEXT") {
               tokens[i] = ["TEXT", tokens[i][1].replace(LEADING_WS_RE, "")];
@@ -15398,6 +15437,47 @@ var init_engine = __esm({
         }
         return html;
       }
+      /**
+       * {% set name %}...{% endset %} -- render the body and bind it.
+       *
+       * Emits nothing itself. The captured value is a SafeString because it is
+       * template output that has already been escaped on the way in; re-escaping it
+       * at {{ name }} would double-encode every entity. Twig and Jinja2 both mark the
+       * capture safe. Returns the index just past {% endset %}.
+       */
+      handleSetBlock(tokens, start2, context) {
+        const [content] = stripTag(tokens[start2][1]);
+        const name = (content.split(/\s+/)[1] || "").trim();
+        const bodyTokens = [];
+        let i = start2 + 1;
+        let depth = 0;
+        while (i < tokens.length) {
+          if (tokens[i][0] === "BLOCK") {
+            const [tagContent] = stripTag(tokens[i][1]);
+            const tag = tagContent.split(/\s+/)[0] || "";
+            if (tag === "set" && !tagContent.includes("=")) {
+              depth++;
+              bodyTokens.push(tokens[i]);
+            } else if (tag === "endset") {
+              if (depth === 0) {
+                i++;
+                break;
+              }
+              depth--;
+              bodyTokens.push(tokens[i]);
+            } else {
+              bodyTokens.push(tokens[i]);
+            }
+          } else {
+            bodyTokens.push(tokens[i]);
+          }
+          i++;
+        }
+        if (name) {
+          context[name] = new SafeString(this.renderTokens([...bodyTokens], context));
+        }
+        return i;
+      }
       handleSpaceless(tokens, start2, context) {
         const bodyTokens = [];
         let i = start2 + 1;
@@ -38681,6 +38761,11 @@ function parseFields(fieldsStr) {
   }
   return result;
 }
+var DEFAULT_FIELDS = [["name", "string"]];
+function fieldsOrDefault(fieldsStr) {
+  const parsed = parseFields(fieldsStr);
+  return parsed.length > 0 ? parsed : DEFAULT_FIELDS.map(([f, t]) => [f, t]);
+}
 function parseCliArgs(args) {
   const booleanFlags = /* @__PURE__ */ new Set([
     "no-browser",
@@ -38796,7 +38881,7 @@ async function generate2(what, name, extraArgs = []) {
   }
 }
 function generateModel(name, flags, emitTest = true) {
-  const fields = parseFields(flags.fields || "");
+  const fields = fieldsOrDefault(flags.fields || "");
   const table2 = toTableName(name);
   const dir = resolve29("src/models");
   ensureDir(dir);
@@ -38804,13 +38889,9 @@ function generateModel(name, flags, emitTest = true) {
   const fieldLines = [
     `    id: { type: "integer" as const, primaryKey: true, autoIncrement: true },`
   ];
-  if (fields.length > 0) {
-    for (const [fname, ftype] of fields) {
-      const info = FIELD_TYPE_MAP[ftype] || FIELD_TYPE_MAP.string;
-      fieldLines.push(`    ${fname}: { type: ${info.orm} as const },`);
-    }
-  } else {
-    fieldLines.push(`    name: { type: "string" as const },`);
+  for (const [fname, ftype] of fields) {
+    const info = FIELD_TYPE_MAP[ftype] || FIELD_TYPE_MAP.string;
+    fieldLines.push(`    ${fname}: { type: ${info.orm} as const },`);
   }
   fieldLines.push(`    created_at: { type: "datetime" as const },`);
   const content = `import { BaseModel } from "tina4-nodejs/orm";
@@ -38824,7 +38905,7 @@ ${fieldLines.join("\n")}
 `;
   writeFileSafe(path8, content);
   if (!flags["no-migration"]) {
-    generateMigration(`create_${table2}`, flags, fields.length > 0 ? fields : void 0, table2, false);
+    generateMigration(`create_${table2}`, flags, fields, table2, false);
   }
   if (emitTest) emitModelTest(name, table2, fields);
 }
@@ -38895,7 +38976,12 @@ ${extend(
         "validate / business rules before persist",
         `e.g. reject invalid input; ground: tina4_context("validate before create", "nodejs")`
       )}  const item = new ${model}(req.body as Record<string, unknown>);
-  await item.save();
+  // save() returns false on failure rather than throwing - check it, or a failed
+  // write is reported to the client as a 201 carrying unsaved data.
+  if ((await item.save()) === false) {
+    res.json({ error: "Could not create ${singular}" }, 400);
+    return;
+  }
   res.json({ data: item.toObject() }, 201);
 }
 `
@@ -38975,7 +39061,12 @@ ${extend(
         "guard which fields / who may update",
         `e.g. enforce ownership; ground: tina4_context("authorize update", "nodejs")`
       )}  Object.assign(item, req.body as Record<string, unknown>);
-  await item.save();
+  // save() returns false on failure rather than throwing - check it, or a failed
+  // write is reported to the client as a 200 carrying unsaved data.
+  if ((await item.save()) === false) {
+    res.json({ error: "Could not update ${singular}" }, 400);
+    return;
+  }
   res.json({ data: item.toObject() });
 }
 `
@@ -39282,7 +39373,7 @@ void test${titleName};
   writeFileSafe(path8, content);
 }
 function generateForm(name, flags) {
-  const fields = parseFields(flags.fields || "");
+  const fields = fieldsOrDefault(flags.fields || "");
   const table2 = toTableName(name);
   const routeName = toPlural(table2);
   const inputTypes = {
@@ -39302,9 +39393,8 @@ function generateForm(name, flags) {
   const dir = resolve29("src/templates/forms");
   ensureDir(dir);
   const path8 = join33(dir, `${table2}.twig`);
-  const fieldEntries = fields.length > 0 ? fields : [["name", "string"]];
   let fieldHtml = "";
-  for (const [fname, ftype] of fieldEntries) {
+  for (const [fname, ftype] of fields) {
     const itype = inputTypes[ftype] || "text";
     const label = fname.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
     const step = ["float", "numeric", "decimal"].includes(ftype) ? ' step="0.01"' : "";
@@ -39348,10 +39438,10 @@ function generateForm(name, flags) {
   writeFileSafe(path8, content);
 }
 function generateView(name, flags) {
-  const fields = parseFields(flags.fields || "");
+  const fields = fieldsOrDefault(flags.fields || "");
   const table2 = toTableName(name);
   const routeName = toPlural(table2);
-  const cols = fields.length > 0 ? fields.map(([f]) => f) : ["name"];
+  const cols = fields.map(([f]) => f);
   const dir = resolve29("src/templates/pages");
   ensureDir(dir);
   const listPath = join33(dir, `${routeName}.twig`);
@@ -39866,7 +39956,7 @@ function sampleLiteral(fieldType) {
   }
 }
 function emitModelTest(model, table2, fields) {
-  const flds = fields.length > 0 ? fields : [["name", "string"]];
+  const flds = fields.length > 0 ? fields : DEFAULT_FIELDS.map(([f, t]) => [f, t]);
   const payload = flds.map(([f, t]) => `${f}: ${sampleLiteral(t)}`).join(", ");
   const stringField = flds.find(([, t]) => ["string", "str", "text"].includes((t || "string").toLowerCase()))?.[0];
   const valueAssert = stringField ? `

package/packages/cli/src/commands/generate.ts

@@ -115,6 +115,21 @@ export function parseFields(fieldsStr: string): Array<[string, string]> {
   return result;
 }
 
+// Called without --fields, the generators fall back to a single `name` string
+// column. That default MUST be materialised here, in one place, and then flow
+// into the model, the migration, the form, the view and the test alike. It used
+// to live only inside the model template, so `generate model X` / `generate
+// crud X` wrote a model declaring `name` while the migration - built from the
+// parsed field list, which was empty - created only id + created_at. The first
+// write then failed with "table x has no column named name".
+export const DEFAULT_FIELDS: ReadonlyArray<[string, string]> = [["name", "string"]];
+
+/** Parsed --fields, or the default single `name` column when none given. */
+export function fieldsOrDefault(fieldsStr: string): Array<[string, string]> {
+  const parsed = parseFields(fieldsStr);
+  return parsed.length > 0 ? parsed : DEFAULT_FIELDS.map(([f, t]) => [f, t] as [string, string]);
+}
+
 export function parseCliArgs(args: string[]): { flags: Record<string, string | boolean>; positional: string[] } {
   // Boolean-only flags that never take a value argument.
   const booleanFlags = new Set([
@@ -290,7 +305,7 @@ export async function generate(what: string, name: string, extraArgs: string[] =
 // ── Model ───────────────────────────────────────────────────────────
 
 function generateModel(name: string, flags: Record<string, string | boolean>, emitTest = true): void {
-  const fields = parseFields((flags.fields as string) || "");
+  const fields = fieldsOrDefault((flags.fields as string) || "");
   const table = toTableName(name);
   const dir = resolve("src/models");
   ensureDir(dir);
@@ -300,13 +315,9 @@ function generateModel(name: string, flags: Record<string, string | boolean>, em
   const fieldLines: string[] = [
     `    id: { type: "integer" as const, primaryKey: true, autoIncrement: true },`,
   ];
-  if (fields.length > 0) {
-    for (const [fname, ftype] of fields) {
-      const info = FIELD_TYPE_MAP[ftype] || FIELD_TYPE_MAP.string;
-      fieldLines.push(`    ${fname}: { type: ${info.orm} as const },`);
-    }
-  } else {
-    fieldLines.push(`    name: { type: "string" as const },`);
+  for (const [fname, ftype] of fields) {
+    const info = FIELD_TYPE_MAP[ftype] || FIELD_TYPE_MAP.string;
+    fieldLines.push(`    ${fname}: { type: ${info.orm} as const },`);
   }
   fieldLines.push(`    created_at: { type: "datetime" as const },`);
 
@@ -328,7 +339,11 @@ ${fieldLines.join("\n")}
   // (below) proves the schema through the real ORM, so the migration sub-call
   // does NOT also co-emit a migration test (emitTest=false).
   if (!flags["no-migration"]) {
-    generateMigration(`create_${table}`, flags, fields.length > 0 ? fields : undefined, table, false);
+    // Always hand over the RESOLVED field list. Passing `undefined` when the
+    // parsed list was empty made the migration fall back to its own
+    // parseFields() - also empty - so the table got only id + created_at while
+    // the model above declared `name`, and the first write 500'd.
+    generateMigration(`create_${table}`, flags, fields, table, false);
   }
 
   // Co-emit a real SQLite roundtrip test next to the model. Composite
@@ -417,7 +432,12 @@ ${modelImportBase}${secureOptOut(isPublic)}export const meta = { summary: "Creat
 export default async function (req: Tina4Request, res: Tina4Response) {
 ${extend("validate / business rules before persist",
   `e.g. reject invalid input; ground: tina4_context("validate before create", "nodejs")`)}  const item = new ${model}(req.body as Record<string, unknown>);
-  await item.save();
+  // save() returns false on failure rather than throwing - check it, or a failed
+  // write is reported to the client as a 201 carrying unsaved data.
+  if ((await item.save()) === false) {
+    res.json({ error: "Could not create ${singular}" }, 400);
+    return;
+  }
   res.json({ data: item.toObject() }, 201);
 }
 `,
@@ -499,7 +519,12 @@ export default async function (req: Tina4Request, res: Tina4Response) {
   }
 ${extend("guard which fields / who may update",
   `e.g. enforce ownership; ground: tina4_context("authorize update", "nodejs")`)}  Object.assign(item, req.body as Record<string, unknown>);
-  await item.save();
+  // save() returns false on failure rather than throwing - check it, or a failed
+  // write is reported to the client as a 200 carrying unsaved data.
+  if ((await item.save()) === false) {
+    res.json({ error: "Could not update ${singular}" }, 400);
+    return;
+  }
   res.json({ data: item.toObject() });
 }
 `,
@@ -873,7 +898,7 @@ void test${titleName};
 // ── Form ────────────────────────────────────────────────────────────
 
 function generateForm(name: string, flags: Record<string, string | boolean>): void {
-  const fields = parseFields((flags.fields as string) || "");
+  const fields = fieldsOrDefault((flags.fields as string) || "");
   const table = toTableName(name);
   const routeName = toPlural(table);
 
@@ -890,9 +915,8 @@ function generateForm(name: string, flags: Record<string, string | boolean>): vo
   const path = join(dir, `${table}.twig`);
 
   // Build form fields
-  const fieldEntries = fields.length > 0 ? fields : [["name", "string"] as [string, string]];
   let fieldHtml = "";
-  for (const [fname, ftype] of fieldEntries) {
+  for (const [fname, ftype] of fields) {
     const itype = inputTypes[ftype] || "text";
     const label = fname.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
     const step = ["float", "numeric", "decimal"].includes(ftype) ? ' step="0.01"' : "";
@@ -946,11 +970,11 @@ function generateForm(name: string, flags: Record<string, string | boolean>): vo
 // ── View ────────────────────────────────────────────────────────────
 
 function generateView(name: string, flags: Record<string, string | boolean>): void {
-  const fields = parseFields((flags.fields as string) || "");
+  const fields = fieldsOrDefault((flags.fields as string) || "");
   const table = toTableName(name);
   const routeName = toPlural(table);
 
-  const cols = fields.length > 0 ? fields.map(([f]) => f) : ["name"];
+  const cols = fields.map(([f]) => f);
 
   const dir = resolve("src/templates/pages");
   ensureDir(dir);
@@ -1591,7 +1615,9 @@ function sampleLiteral(fieldType: string): string {
 
 /** model → real SQLite roundtrip (create / read back / missing → null). */
 function emitModelTest(model: string, table: string, fields: Array<[string, string]>): void {
-  const flds = fields.length > 0 ? fields : [["name", "string"] as [string, string]];
+  // Reuse the single DEFAULT_FIELDS constant rather than re-stating the literal,
+  // so the co-emitted test can never describe a shape the model does not have.
+  const flds = fields.length > 0 ? fields : DEFAULT_FIELDS.map(([f, t]) => [f, t] as [string, string]);
   const payload = flds.map(([f, t]) => `${f}: ${sampleLiteral(t)}`).join(", ");
   const stringField = flds.find(([, t]) => ["string", "str", "text"].includes((t || "string").toLowerCase()))?.[0];
   const valueAssert = stringField

package/packages/core/dist/index.js

@@ -13792,7 +13792,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -13804,6 +13804,37 @@ var init_engine = __esm({
         return this.value;
       }
     };
+    KNOWN_TAGS = /* @__PURE__ */ new Set([
+      "autoescape",
+      "block",
+      "cache",
+      "extends",
+      "for",
+      "from",
+      "if",
+      "import",
+      "include",
+      "live",
+      "macro",
+      "raw",
+      "set",
+      "spaceless"
+    ]);
+    TERMINATOR_TAGS = /* @__PURE__ */ new Set([
+      "elif",
+      "else",
+      "elseif",
+      "endautoescape",
+      "endblock",
+      "endcache",
+      "endfor",
+      "endif",
+      "endlive",
+      "endmacro",
+      "endraw",
+      "endset",
+      "endspaceless"
+    ]);
     JSON_UNSAFE_RE = /[<>&'\u2028\u2029]/g;
     JSON_UNSAFE_MAP = {
       "<": "\\u003c",
@@ -14458,8 +14489,11 @@ var init_engine = __esm({
                 i = skip;
               }
             } else if (tag === "set") {
+              const isBlockSet = !content.includes("=");
               if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("set")) {
-                i++;
+                i = isBlockSet ? this.skipBlock(tokens, i, "set", "endset") : i + 1;
+              } else if (isBlockSet) {
+                i = this.handleSetBlock(tokens, i, context);
               } else {
                 this.handleSet(content, context);
                 i++;
@@ -14501,6 +14535,11 @@ var init_engine = __esm({
               i++;
             } else {
               i++;
+              if (tag !== "" && !TERMINATOR_TAGS.has(tag)) {
+                throw new Error(
+                  `Frond: unknown tag "${tag}" -- known tags are: ${[...KNOWN_TAGS].sort().join(", ")}`
+                );
+              }
             }
             if (stripA && i < tokens.length && tokens[i][0] === "TEXT") {
               tokens[i] = ["TEXT", tokens[i][1].replace(LEADING_WS_RE, "")];
@@ -15397,6 +15436,47 @@ var init_engine = __esm({
         }
         return html;
       }
+      /**
+       * {% set name %}...{% endset %} -- render the body and bind it.
+       *
+       * Emits nothing itself. The captured value is a SafeString because it is
+       * template output that has already been escaped on the way in; re-escaping it
+       * at {{ name }} would double-encode every entity. Twig and Jinja2 both mark the
+       * capture safe. Returns the index just past {% endset %}.
+       */
+      handleSetBlock(tokens, start2, context) {
+        const [content] = stripTag(tokens[start2][1]);
+        const name = (content.split(/\s+/)[1] || "").trim();
+        const bodyTokens = [];
+        let i = start2 + 1;
+        let depth = 0;
+        while (i < tokens.length) {
+          if (tokens[i][0] === "BLOCK") {
+            const [tagContent] = stripTag(tokens[i][1]);
+            const tag = tagContent.split(/\s+/)[0] || "";
+            if (tag === "set" && !tagContent.includes("=")) {
+              depth++;
+              bodyTokens.push(tokens[i]);
+            } else if (tag === "endset") {
+              if (depth === 0) {
+                i++;
+                break;
+              }
+              depth--;
+              bodyTokens.push(tokens[i]);
+            } else {
+              bodyTokens.push(tokens[i]);
+            }
+          } else {
+            bodyTokens.push(tokens[i]);
+          }
+          i++;
+        }
+        if (name) {
+          context[name] = new SafeString(this.renderTokens([...bodyTokens], context));
+        }
+        return i;
+      }
       handleSpaceless(tokens, start2, context) {
         const bodyTokens = [];
         let i = start2 + 1;

package/packages/core/public/js/tina4-dev-admin.min.js

@@ -985,7 +985,7 @@ ${t.traceback||""}`;window.__switchTab("chat"),setTimeout(()=>{window.__prefillC
       <span class="thread-pip"></span>
       <span class="thread-title">${g(t.title)}</span>
       ${o}
-    </div>`}).join("")}let cd=!1;async function Qa(i=0){for(let e=0;;e++)try{Se=await NZ(),cd=!1,EQ();return}catch(t){if(e>=i){cd=!0,console.error("refreshThreadList failed",t);return}await new Promise(n=>setTimeout(n,250*2**e))}}function HZ(i){const e=document.getElementById("editor-ai-messages");if(!e)return;const t=rt.get(i)||[];if(!t.length){e.innerHTML='<div class="ai-msg ai-bot" style="opacity:0.6">Start the conversation…</div>';return}e.innerHTML="";for(const n of t){const r=document.createElement("div");r.className=`ai-msg ai-${n.role==="user"?"user":"bot"}`,n.role==="user"?r.textContent=n.content:r.innerHTML=fs(n.content),e.appendChild(r)}e.scrollTop=e.scrollHeight}async function AQ(i,e=!1){if(!(!e&&rt.has(i)))try{const t=await FZ(i);rt.set(i,t)}catch(t){console.error(`loadThreadMessages(${i}) failed`,t),rt.set(i,[])}}async function dd(i){if(i!==ve){ve=i;try{localStorage.setItem(WQ,i)}catch{}EQ(),await AQ(i),HZ(i)}}async function KZ(){try{const i=await cs();Se.push(i),rt.set(i.id,[]),await dd(i.id);const e=document.getElementById("editor-ai-input");e==null||e.focus()}catch(i){AZ(`<span style="color:var(--danger)">Couldn't create thread: ${g(String((i==null?void 0:i.message)||i))}</span>`,"bot")}}async function JZ(i){const e=document.querySelector(`.thread-row[data-thread-id="${CSS.escape(i)}"]`),t=e==null?void 0:e.querySelector(".thread-title");if(!e||!t)return;const n=t.textContent||"",r=document.createElement("input");r.className="thread-title-edit",r.value=n,t.replaceWith(r),r.focus(),r.select();const s=a=>{const l=document.createElement("span");l.className="thread-title",l.textContent=a,r.replaceWith(l)},o=async()=>{const a=r.value.trim();if(!a||a===n){s(n);return}try{const l=await ga(i,{title:a}),O=Se.find(c=>c.id===i);O&&(O.title=l.title),s(l.title)}catch(l){console.error("rename failed",l),s(n)}};r.addEventListener("blur",()=>{o()}),r.addEventListener("keydown",a=>{a.key==="Enter"?(a.preventDefault(),r.blur()):a.key==="Escape"&&(a.preventDefault(),s(n))})}async function ez(){if(await Qa(4),!Se.length){ve=null,er();return}try{const i=localStorage.getItem(WQ);i&&Se.some(e=>e.id===i)&&(ve=i)}catch{}ya()}window.__editorThreadNew=()=>{KZ()},window.__editorThreadSwitch=i=>{dd(i)},window.__editorThreadRename=i=>{JZ(i)};const tz={done:"DONE",awaiting_customer:"AWAITING YOU",wont_do:"WONT DO",blocked:"BLOCKED",feedback:"NEW FEEDBACK",idle:"IDLE",running:"RUNNING"};function hd(i){const e=tz[i]||i.toUpperCase();return`<span class="status-pill" data-status="${g(i)}">${g(e)}</span>`}function fd(i){if(!i)return"";let e;if(/^\d+Z$/.test(i)?e=new Date(parseInt(i,10)*1e3):e=new Date(i),isNaN(e.getTime()))return i;const t=n=>String(n).padStart(2,"0");return`${t(e.getDate())}/${t(e.getMonth()+1)}/${e.getFullYear()} ${t(e.getHours())}:${t(e.getMinutes())}`}let Jn=null;function ya(){const i=e=>document.getElementById(e);i("threads-pane-head-list").hidden=!1,i("threads-pane-head-detail").hidden=!0,i("threads-list-view").hidden=!1,i("threads-detail-view").hidden=!0,Qa().then(er)}async function ba(i){await dd(i);const e=Se.find(s=>s.id===i);if(!e)return;const t=s=>document.getElementById(s);t("threads-pane-head-list").hidden=!0,t("threads-pane-head-detail").hidden=!1,t("threads-list-view").hidden=!0,t("threads-detail-view").hidden=!1,t("threads-detail-title").textContent=e.title||"Thread";const n=t("threads-detail-meta"),r=e.sender?`<span>📨 from ${g(e.sender)}</span>`:"";n.innerHTML=`${hd(e.status_hint||"idle")} <span>${g(fd(e.last_message_at))}</span> ${r}`,pd(i),setTimeout(()=>{var s;return(s=t("threads-reply-input"))==null?void 0:s.focus()},30)}async function iz(){if(!ve)return;const i=ve;try{await ga(i,{archived:!0,closure_reason:"done"});const e=Se.find(t=>t.id===i);e&&(e.archived=!0,e.closure_reason="done"),ve=null,ya()}catch(e){console.error("archive failed",e)}}async function nz(i){try{await ga(i,{archived:!0});const e=Se.find(t=>t.id===i);e&&(e.archived=!0),ve===i?(ve=null,ya()):er()}catch(e){console.error("archive-from-list failed",e)}}function er(){const i=document.getElementById("threads-rows");if(!i)return;if(!Se.length){i.innerHTML=cd?`<div class="threads-empty">
+    </div>`}).join("")}let cd=!1;async function Qa(i=0){for(let e=0;;e++)try{Se=await NZ(),cd=!1,EQ();return}catch(t){if(e>=i){cd=!0,console.error("refreshThreadList failed",t);return}await new Promise(n=>setTimeout(n,250*2**e))}}function HZ(i){const e=document.getElementById("editor-ai-messages");if(!e)return;const t=rt.get(i)||[];if(!t.length){e.innerHTML='<div class="ai-msg ai-bot" style="opacity:0.6">Start the conversation…</div>';return}e.innerHTML="";for(const n of t){const r=document.createElement("div");r.className=`ai-msg ai-${n.role==="user"?"user":"bot"}`,n.role==="user"?r.textContent=n.content:r.innerHTML=fs(n.content),e.appendChild(r)}e.scrollTop=e.scrollHeight}async function AQ(i,e=!1){if(!(!e&&rt.has(i)))try{const t=await FZ(i);rt.set(i,t)}catch(t){console.error(`loadThreadMessages(${i}) failed`,t),rt.set(i,[])}}async function dd(i){if(i!==ve){ve=i;try{localStorage.setItem(WQ,i)}catch{}EQ(),await AQ(i),HZ(i)}}async function KZ(){try{const i=await cs();Se.push(i),rt.set(i.id,[]),await dd(i.id);const e=document.getElementById("editor-ai-input");e==null||e.focus()}catch(i){AZ(`<span style="color:var(--danger)">Couldn't create thread: ${g(String((i==null?void 0:i.message)||i))}</span>`,"bot")}}async function JZ(i){const e=document.querySelector(`.thread-row[data-thread-id="${CSS.escape(i)}"]`),t=e==null?void 0:e.querySelector(".thread-title");if(!e||!t)return;const n=t.textContent||"",r=document.createElement("input");r.className="thread-title-edit",r.value=n,t.replaceWith(r),r.focus(),r.select();const s=a=>{const l=document.createElement("span");l.className="thread-title",l.textContent=a,r.replaceWith(l)},o=async()=>{const a=r.value.trim();if(!a||a===n){s(n);return}try{const l=await ga(i,{title:a}),O=Se.find(c=>c.id===i);O&&(O.title=l.title),s(l.title)}catch(l){console.error("rename failed",l),s(n)}};r.addEventListener("blur",()=>{o()}),r.addEventListener("keydown",a=>{a.key==="Enter"?(a.preventDefault(),r.blur()):a.key==="Escape"&&(a.preventDefault(),s(n))})}async function ez(){if(await Qa(4),!Se.length){ve=null,er();return}try{const i=localStorage.getItem(WQ);i&&Se.some(e=>e.id===i)&&(ve=i)}catch{}ya()}window.__editorThreadNew=()=>{KZ()},window.__editorThreadSwitch=i=>{dd(i)},window.__editorThreadRename=i=>{JZ(i)};const tz={done:"DONE",awaiting_customer:"AWAITING YOU",wont_do:"WONT DO",blocked:"BLOCKED",feedback:"NEW FEEDBACK",idle:"IDLE",running:"RUNNING"};function hd(i){const e=tz[i]||i.toUpperCase();return`<span class="status-pill" data-status="${g(i)}">${g(e)}</span>`}function fd(i){if(!i)return"";let e;if(/^\d+Z$/.test(i)?e=new Date(parseInt(i,10)*1e3):e=new Date(i),isNaN(e.getTime()))return i;const t=n=>String(n).padStart(2,"0");return`${t(e.getDate())}/${t(e.getMonth()+1)}/${e.getFullYear()} ${t(e.getHours())}:${t(e.getMinutes())}`}let Jn=null;function ya(){const i=s=>document.getElementById(s),e=i("threads-pane-head-list");e&&(e.hidden=!1);const t=i("threads-pane-head-detail");t&&(t.hidden=!0);const n=i("threads-list-view");n&&(n.hidden=!1);const r=i("threads-detail-view");r&&(r.hidden=!0),Qa().then(er)}async function ba(i){await dd(i);const e=Se.find(c=>c.id===i);if(!e)return;const t=c=>document.getElementById(c),n=t("threads-pane-head-list");n&&(n.hidden=!0);const r=t("threads-pane-head-detail");r&&(r.hidden=!1);const s=t("threads-list-view");s&&(s.hidden=!0);const o=t("threads-detail-view");o&&(o.hidden=!1);const a=t("threads-detail-title");a&&(a.textContent=e.title||"Thread");const l=t("threads-detail-meta"),O=e.sender?`<span>📨 from ${g(e.sender)}</span>`:"";l&&(l.innerHTML=`${hd(e.status_hint||"idle")} <span>${g(fd(e.last_message_at))}</span> ${O}`),pd(i),setTimeout(()=>{var c;return(c=t("threads-reply-input"))==null?void 0:c.focus()},30)}async function iz(){if(!ve)return;const i=ve;try{await ga(i,{archived:!0,closure_reason:"done"});const e=Se.find(t=>t.id===i);e&&(e.archived=!0,e.closure_reason="done"),ve=null,ya()}catch(e){console.error("archive failed",e)}}async function nz(i){try{await ga(i,{archived:!0});const e=Se.find(t=>t.id===i);e&&(e.archived=!0),ve===i?(ve=null,ya()):er()}catch(e){console.error("archive-from-list failed",e)}}function er(){const i=document.getElementById("threads-rows");if(!i)return;if(!Se.length){i.innerHTML=cd?`<div class="threads-empty">
           <div style="margin-bottom:0.6rem">Can't reach the agent — threads unavailable.</div>
           <button type="button" class="action-pill"
                   onclick="window.__threadsRetry()">Retry</button>
@@ -1012,7 +1012,7 @@ ${t.traceback||""}`;window.__switchTab("chat"),setTimeout(()=>{window.__prefillC
           <span>severity: ${g(e.severity||"-")}</span>
         </div>
         <div style="margin-top:0.3rem">${g(e.summary||"")}</div>
-      </div>`}catch{return fs(i)}}async function az(){try{const i=await cs();Se.push(i),rt.set(i.id,[]),await ba(i.id)}catch(i){console.error("threadsNew failed",i)}}async function lz(){if(!ve)return;const i=Se.find(t=>t.id===ve);if(!i)return;const e=window.prompt("Rename thread:",i.title);if(!(e==null||e.trim()===""||e===i.title))try{const t=await ga(ve,{title:e.trim()});i.title=t.title;const n=document.getElementById("threads-detail-title");n&&(n.textContent=t.title),er()}catch(t){console.error("rename failed",t)}}function Oz(i){return i?i.status_hint==="done"||i.status_hint==="wont_do"||i.closure_reason==="done"||i.closure_reason==="wont_do":!1}async function md(){const i=document.getElementById("threads-reply-input");if(!i)return;let e=i.value.trim();if(!e)return;i.value="";const t=e.match(/^new topic:\s*(.*)$/is);if(t){const o=t[1].trim();try{const a=await cs(o.slice(0,80)||void 0);if(Se.push(a),rt.set(a.id,[]),await ba(a.id),!o)return;e=o}catch(a){console.error("New Topic spawn failed",a);return}}if(!t&&ve&&Oz(Se.find(o=>o.id===ve)))try{const o=await cs(e.slice(0,80)||void 0);Se.push(o),rt.set(o.id,[]),await ba(o.id)}catch(o){console.error("auto-new-thread on done reply failed",o);return}if(!ve)try{const o=await cs(e.slice(0,80));Se.push(o),rt.set(o.id,[]),ve=o.id}catch(o){console.error("auto-create failed",o);return}const n=ve,r=rt.get(n)||[];r.push({id:`local-${Date.now()}`,role:"user",content:e,timestamp:new Date().toISOString(),thread_id:n}),rt.set(n,r),pd(n),$a.add(n),er();const s=document.getElementById("threads-chat");Jn==null||Jn.abort(),Jn=new AbortController;try{await pz(e,n,Jn.signal,s)}catch(o){if((o==null?void 0:o.name)!=="AbortError"){const a=document.createElement("div");a.className="ai-msg ai-bot",a.style.color="var(--danger,#f38ba8)",a.textContent=`Connection failed: ${(o==null?void 0:o.message)||o}`,s==null||s.appendChild(a)}}finally{$a.delete(n),Jn=null;try{await AQ(n,!0)}catch{}await Qa(),pd(n);const o=Se.find(a=>a.id===n);if(o){const a=document.getElementById("threads-detail-meta"),l=o.sender?`<span>📨 from ${g(o.sender)}</span>`:"";a.innerHTML=`${hd(o.status_hint||"idle")} <span>${g(fd(o.last_message_at))}</span> ${l}`}}}queueMicrotask(()=>{const i=document.getElementById("threads-reply-form");i&&i.addEventListener("submit",t=>{t.preventDefault(),md()});const e=document.getElementById("threads-reply-input");e&&e.addEventListener("keydown",t=>{t.key==="Enter"&&!t.shiftKey&&(t.preventDefault(),t.stopPropagation(),md())})}),window.__threadsShowList=()=>ya(),window.__threadsShowDetail=i=>{ba(i)},window.__threadsNew=()=>{az()},window.__threadsRetry=()=>{Qa(2).then(er)},window.__threadsRenameActive=()=>{lz()};let un=!1;async function jQ(){const i=document.getElementById("plans-panel"),e=document.getElementById("plans-toggle-btn");i&&(un=!un,i.hidden=!un,e==null||e.classList.toggle("active",un),un&&await cz())}async function cz(){const i=document.getElementById("plans-rows");if(i){i.innerHTML='<div class="threads-empty">Loading plans…</div>';try{const e=await Mi("plan_list",{}),t=e.ok&&Array.isArray(e.result)?e.result:[];if(!t.length){i.innerHTML='<div class="threads-empty">No plans yet — they appear here when the planner agent creates one.</div>';return}const n=[...t].sort((r,s)=>String(s.name||s.file||"").localeCompare(String(r.name||r.file||"")));i.innerHTML=n.map(r=>{var h,f;const s=String(r.name||r.file||""),o=String(r.path||`plan/${s}`),a=String(r.title||s).slice(0,60),l=r.steps_done??((h=r.progress)==null?void 0:h.done)??0,O=r.steps_total??((f=r.progress)==null?void 0:f.total)??0,c=O>0?`${l}/${O} steps`:"",d=r.is_current||r.current?" · ★ current":"";return`<div class="plan-row" onclick="window.__plansOpen('${g(o)}')" title="Open ${g(o)} in editor">
+      </div>`}catch{return fs(i)}}async function az(){try{const i=await cs();Se.push(i),rt.set(i.id,[]),await ba(i.id)}catch(i){console.error("threadsNew failed",i)}}async function lz(){if(!ve)return;const i=Se.find(t=>t.id===ve);if(!i)return;const e=window.prompt("Rename thread:",i.title);if(!(e==null||e.trim()===""||e===i.title))try{const t=await ga(ve,{title:e.trim()});i.title=t.title;const n=document.getElementById("threads-detail-title");n&&(n.textContent=t.title),er()}catch(t){console.error("rename failed",t)}}function Oz(i){return i?i.status_hint==="done"||i.status_hint==="wont_do"||i.closure_reason==="done"||i.closure_reason==="wont_do":!1}async function md(){const i=document.getElementById("threads-reply-input");if(!i)return;let e=i.value.trim();if(!e)return;i.value="";const t=e.match(/^new topic:\s*(.*)$/is);if(t){const o=t[1].trim();try{const a=await cs(o.slice(0,80)||void 0);if(Se.push(a),rt.set(a.id,[]),await ba(a.id),!o)return;e=o}catch(a){console.error("New Topic spawn failed",a);return}}if(!t&&ve&&Oz(Se.find(o=>o.id===ve)))try{const o=await cs(e.slice(0,80)||void 0);Se.push(o),rt.set(o.id,[]),await ba(o.id)}catch(o){console.error("auto-new-thread on done reply failed",o);return}if(!ve)try{const o=await cs(e.slice(0,80));Se.push(o),rt.set(o.id,[]),ve=o.id}catch(o){console.error("auto-create failed",o);return}const n=ve,r=rt.get(n)||[];r.push({id:`local-${Date.now()}`,role:"user",content:e,timestamp:new Date().toISOString(),thread_id:n}),rt.set(n,r),pd(n),$a.add(n),er();const s=document.getElementById("threads-chat");Jn==null||Jn.abort(),Jn=new AbortController;try{await pz(e,n,Jn.signal,s)}catch(o){if((o==null?void 0:o.name)!=="AbortError"){const a=document.createElement("div");a.className="ai-msg ai-bot",a.style.color="var(--danger,#f38ba8)",a.textContent=`Connection failed: ${(o==null?void 0:o.message)||o}`,s==null||s.appendChild(a)}}finally{$a.delete(n),Jn=null;try{await AQ(n,!0)}catch{}await Qa(),pd(n);const o=Se.find(l=>l.id===n),a=document.getElementById("threads-detail-meta");if(o&&a){const l=o.sender?`<span>📨 from ${g(o.sender)}</span>`:"";a.innerHTML=`${hd(o.status_hint||"idle")} <span>${g(fd(o.last_message_at))}</span> ${l}`}}}queueMicrotask(()=>{const i=document.getElementById("threads-reply-form");i&&i.addEventListener("submit",t=>{t.preventDefault(),md()});const e=document.getElementById("threads-reply-input");e&&e.addEventListener("keydown",t=>{t.key==="Enter"&&!t.shiftKey&&(t.preventDefault(),t.stopPropagation(),md())})}),window.__threadsShowList=()=>ya(),window.__threadsShowDetail=i=>{ba(i)},window.__threadsNew=()=>{az()},window.__threadsRetry=()=>{Qa(2).then(er)},window.__threadsRenameActive=()=>{lz()};let un=!1;async function jQ(){const i=document.getElementById("plans-panel"),e=document.getElementById("plans-toggle-btn");i&&(un=!un,i.hidden=!un,e==null||e.classList.toggle("active",un),un&&await cz())}async function cz(){const i=document.getElementById("plans-rows");if(i){i.innerHTML='<div class="threads-empty">Loading plans…</div>';try{const e=await Mi("plan_list",{}),t=e.ok&&Array.isArray(e.result)?e.result:[];if(!t.length){i.innerHTML='<div class="threads-empty">No plans yet — they appear here when the planner agent creates one.</div>';return}const n=[...t].sort((r,s)=>String(s.name||s.file||"").localeCompare(String(r.name||r.file||"")));i.innerHTML=n.map(r=>{var h,f;const s=String(r.name||r.file||""),o=String(r.path||`plan/${s}`),a=String(r.title||s).slice(0,60),l=r.steps_done??((h=r.progress)==null?void 0:h.done)??0,O=r.steps_total??((f=r.progress)==null?void 0:f.total)??0,c=O>0?`${l}/${O} steps`:"",d=r.is_current||r.current?" · ★ current":"";return`<div class="plan-row" onclick="window.__plansOpen('${g(o)}')" title="Open ${g(o)} in editor">
         <div class="plan-name">${g(a)}</div>
         <div class="plan-meta">${g(s)}${c?" · "+g(c):""}${d}</div>
       </div>`}).join("")}catch{i.innerHTML='<div class="threads-empty" style="color:var(--danger,#f38ba8)">Failed to load plans</div>'}}}async function dz(i){var t;try{await ui(i)}catch(n){console.error("plansOpen failed",n)}un=!1;const e=document.getElementById("plans-panel");e&&(e.hidden=!0),(t=document.getElementById("plans-toggle-btn"))==null||t.classList.remove("active")}window.__plansToggle=()=>{jQ()},window.__plansOpen=i=>{dz(i)};let ds=!1;async function hz(){const i=document.getElementById("grounding-panel"),e=document.getElementById("grounding-toggle-btn");i&&(un&&jQ(),ds=!ds,i.hidden=!ds,e==null||e.classList.toggle("active",ds),ds&&await MQ())}async function MQ(){const i=document.getElementById("grounding-body");if(!i)return;i.innerHTML='<div class="threads-empty">Loading…</div>';let e={};try{const r=await fetch("/__dev/api/grounding/status");r.ok&&(e=await r.json())}catch{}const t=g(e.url||"https://mcp.tina4.com"),n=e.configured?`<span style="color:var(--success,#a6e3a1)">&#9679; Configured</span> <span style="opacity:0.6">(…${g(e.last4||"")})</span>`:'<span style="color:var(--warn,#f9e2af)">&#9675; Not set</span> — using local corpus fallback';i.innerHTML=`

package/packages/frond/dist/index.js

@@ -10,6 +10,37 @@ var SafeString = class {
     return this.value;
   }
 };
+var KNOWN_TAGS = /* @__PURE__ */ new Set([
+  "autoescape",
+  "block",
+  "cache",
+  "extends",
+  "for",
+  "from",
+  "if",
+  "import",
+  "include",
+  "live",
+  "macro",
+  "raw",
+  "set",
+  "spaceless"
+]);
+var TERMINATOR_TAGS = /* @__PURE__ */ new Set([
+  "elif",
+  "else",
+  "elseif",
+  "endautoescape",
+  "endblock",
+  "endcache",
+  "endfor",
+  "endif",
+  "endlive",
+  "endmacro",
+  "endraw",
+  "endset",
+  "endspaceless"
+]);
 function jsonText(value) {
   try {
     const text = JSON.stringify(value);
@@ -1668,8 +1699,11 @@ var Frond = class _Frond {
             i = skip;
           }
         } else if (tag === "set") {
+          const isBlockSet = !content.includes("=");
           if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("set")) {
-            i++;
+            i = isBlockSet ? this.skipBlock(tokens, i, "set", "endset") : i + 1;
+          } else if (isBlockSet) {
+            i = this.handleSetBlock(tokens, i, context);
           } else {
             this.handleSet(content, context);
             i++;
@@ -1711,6 +1745,11 @@ var Frond = class _Frond {
           i++;
         } else {
           i++;
+          if (tag !== "" && !TERMINATOR_TAGS.has(tag)) {
+            throw new Error(
+              `Frond: unknown tag "${tag}" -- known tags are: ${[...KNOWN_TAGS].sort().join(", ")}`
+            );
+          }
         }
         if (stripA && i < tokens.length && tokens[i][0] === "TEXT") {
           tokens[i] = ["TEXT", tokens[i][1].replace(LEADING_WS_RE, "")];
@@ -2607,6 +2646,47 @@ var Frond = class _Frond {
     }
     return html;
   }
+  /**
+   * {% set name %}...{% endset %} -- render the body and bind it.
+   *
+   * Emits nothing itself. The captured value is a SafeString because it is
+   * template output that has already been escaped on the way in; re-escaping it
+   * at {{ name }} would double-encode every entity. Twig and Jinja2 both mark the
+   * capture safe. Returns the index just past {% endset %}.
+   */
+  handleSetBlock(tokens, start, context) {
+    const [content] = stripTag(tokens[start][1]);
+    const name = (content.split(/\s+/)[1] || "").trim();
+    const bodyTokens = [];
+    let i = start + 1;
+    let depth = 0;
+    while (i < tokens.length) {
+      if (tokens[i][0] === "BLOCK") {
+        const [tagContent] = stripTag(tokens[i][1]);
+        const tag = tagContent.split(/\s+/)[0] || "";
+        if (tag === "set" && !tagContent.includes("=")) {
+          depth++;
+          bodyTokens.push(tokens[i]);
+        } else if (tag === "endset") {
+          if (depth === 0) {
+            i++;
+            break;
+          }
+          depth--;
+          bodyTokens.push(tokens[i]);
+        } else {
+          bodyTokens.push(tokens[i]);
+        }
+      } else {
+        bodyTokens.push(tokens[i]);
+      }
+      i++;
+    }
+    if (name) {
+      context[name] = new SafeString(this.renderTokens([...bodyTokens], context));
+    }
+    return i;
+  }
   handleSpaceless(tokens, start, context) {
     const bodyTokens = [];
     let i = start + 1;

package/packages/frond/src/engine.ts

@@ -34,6 +34,31 @@ class SafeString {
   toString() { return this.value; }
 }
 
+/**
+ * Every tag that OPENS a construct.
+ *
+ * An unknown tag is a typo, and 3.13.89 makes it throw rather than render its
+ * body: a mistyped guard -- {% iff is_admin %} instead of {% if is_admin %} --
+ * used to render the gated content UNCONDITIONALLY, so a reviewer saw a guard
+ * that was not there. Twig and Jinja2 both raise on an unknown tag; Frond now
+ * does too. There is no user-extension point for tags in any of the four
+ * frameworks, so an unknown name is always a mistake, never a plugin.
+ */
+const KNOWN_TAGS = new Set([
+  "autoescape", "block", "cache", "extends", "for", "from", "if", "import",
+  "include", "live", "macro", "raw", "set", "spaceless",
+]);
+
+/**
+ * Terminators and branch keywords. These reach the tag dispatch only when stray
+ * (their own collector consumes them in the normal case), and a stray one keeps
+ * the old render-nothing behaviour -- see the comment at the throw.
+ */
+const TERMINATOR_TAGS = new Set([
+  "elif", "else", "elseif", "endautoescape", "endblock", "endcache", "endfor",
+  "endif", "endlive", "endmacro", "endraw", "endset", "endspaceless",
+]);
+
 /**
  * Serialize a value to compact JSON text that is always valid JSON.
  *
@@ -2077,8 +2102,16 @@ export class Frond {
             i = skip;
           }
         } else if (tag === "set") {
+          // An assignment has an "="; without one this is the BLOCK form,
+          // {% set name %}...{% endset %}, which captures its rendered body. A
+          // bare includes() is exact here, not a shortcut: the block form's tag
+          // content is only ever "set <name>", so an "=" anywhere -- even inside
+          // a quoted value like {% set m = "a = b" %} -- means assignment.
+          const isBlockSet = !content.includes("=");
           if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("set")) {
-            i++;
+            i = isBlockSet ? this.skipBlock(tokens, i, "set", "endset") : i + 1;
+          } else if (isBlockSet) {
+            i = this.handleSetBlock(tokens, i, context);
           } else {
             this.handleSet(content, context);
             i++;
@@ -2120,6 +2153,16 @@ export class Frond {
           i++; // Already handled
         } else {
           i++;
+          if (tag !== "" && !TERMINATOR_TAGS.has(tag)) {
+            throw new Error(
+              `Frond: unknown tag "${tag}" -- known tags are: ${[...KNOWN_TAGS].sort().join(", ")}`,
+            );
+          }
+          // An empty tag ({%  %}) or a stray terminator (an {% endif %} with
+          // no {% if %}): no output.
+          // Malformed, but it has always rendered nothing, and nothing is the
+          // safe answer -- unlike an unknown tag it cannot expose content that
+          // was meant to be gated.
         }
 
         if (stripA && i < tokens.length && tokens[i][0] === "TEXT") {
@@ -3121,6 +3164,50 @@ export class Frond {
     return html;
   }
 
+  /**
+   * {% set name %}...{% endset %} -- render the body and bind it.
+   *
+   * Emits nothing itself. The captured value is a SafeString because it is
+   * template output that has already been escaped on the way in; re-escaping it
+   * at {{ name }} would double-encode every entity. Twig and Jinja2 both mark the
+   * capture safe. Returns the index just past {% endset %}.
+   */
+  private handleSetBlock(tokens: Token[], start: number, context: Record<string, unknown>): number {
+    const [content] = stripTag(tokens[start][1]);
+    const name = (content.split(/\s+/)[1] || "").trim();
+
+    const bodyTokens: Token[] = [];
+    let i = start + 1;
+    let depth = 0;
+    while (i < tokens.length) {
+      if (tokens[i][0] === "BLOCK") {
+        const [tagContent] = stripTag(tokens[i][1]);
+        const tag = tagContent.split(/\s+/)[0] || "";
+        if (tag === "set" && !tagContent.includes("=")) {
+          depth++;
+          bodyTokens.push(tokens[i]);
+        } else if (tag === "endset") {
+          if (depth === 0) {
+            i++;
+            break;
+          }
+          depth--;
+          bodyTokens.push(tokens[i]);
+        } else {
+          bodyTokens.push(tokens[i]);
+        }
+      } else {
+        bodyTokens.push(tokens[i]);
+      }
+      i++;
+    }
+
+    if (name) {
+      context[name] = new SafeString(this.renderTokens([...bodyTokens], context));
+    }
+    return i;
+  }
+
   private handleSpaceless(tokens: Token[], start: number, context: Record<string, unknown>): [string, number] {
     const bodyTokens: Token[] = [];
     let i = start + 1;

package/packages/orm/dist/index.js

@@ -4428,7 +4428,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -4440,6 +4440,37 @@ var init_engine = __esm({
         return this.value;
       }
     };
+    KNOWN_TAGS = /* @__PURE__ */ new Set([
+      "autoescape",
+      "block",
+      "cache",
+      "extends",
+      "for",
+      "from",
+      "if",
+      "import",
+      "include",
+      "live",
+      "macro",
+      "raw",
+      "set",
+      "spaceless"
+    ]);
+    TERMINATOR_TAGS = /* @__PURE__ */ new Set([
+      "elif",
+      "else",
+      "elseif",
+      "endautoescape",
+      "endblock",
+      "endcache",
+      "endfor",
+      "endif",
+      "endlive",
+      "endmacro",
+      "endraw",
+      "endset",
+      "endspaceless"
+    ]);
     JSON_UNSAFE_RE = /[<>&'\u2028\u2029]/g;
     JSON_UNSAFE_MAP = {
       "<": "\\u003c",
@@ -5094,8 +5125,11 @@ var init_engine = __esm({
                 i = skip;
               }
             } else if (tag === "set") {
+              const isBlockSet = !content.includes("=");
               if (this._sandbox && this._allowedTags !== null && !this._allowedTags.has("set")) {
-                i++;
+                i = isBlockSet ? this.skipBlock(tokens, i, "set", "endset") : i + 1;
+              } else if (isBlockSet) {
+                i = this.handleSetBlock(tokens, i, context);
               } else {
                 this.handleSet(content, context);
                 i++;
@@ -5137,6 +5171,11 @@ var init_engine = __esm({
               i++;
             } else {
               i++;
+              if (tag !== "" && !TERMINATOR_TAGS.has(tag)) {
+                throw new Error(
+                  `Frond: unknown tag "${tag}" -- known tags are: ${[...KNOWN_TAGS].sort().join(", ")}`
+                );
+              }
             }
             if (stripA && i < tokens.length && tokens[i][0] === "TEXT") {
               tokens[i] = ["TEXT", tokens[i][1].replace(LEADING_WS_RE, "")];
@@ -6033,6 +6072,47 @@ var init_engine = __esm({
         }
         return html;
       }
+      /**
+       * {% set name %}...{% endset %} -- render the body and bind it.
+       *
+       * Emits nothing itself. The captured value is a SafeString because it is
+       * template output that has already been escaped on the way in; re-escaping it
+       * at {{ name }} would double-encode every entity. Twig and Jinja2 both mark the
+       * capture safe. Returns the index just past {% endset %}.
+       */
+      handleSetBlock(tokens, start2, context) {
+        const [content] = stripTag(tokens[start2][1]);
+        const name = (content.split(/\s+/)[1] || "").trim();
+        const bodyTokens = [];
+        let i = start2 + 1;
+        let depth = 0;
+        while (i < tokens.length) {
+          if (tokens[i][0] === "BLOCK") {
+            const [tagContent] = stripTag(tokens[i][1]);
+            const tag = tagContent.split(/\s+/)[0] || "";
+            if (tag === "set" && !tagContent.includes("=")) {
+              depth++;
+              bodyTokens.push(tokens[i]);
+            } else if (tag === "endset") {
+              if (depth === 0) {
+                i++;
+                break;
+              }
+              depth--;
+              bodyTokens.push(tokens[i]);
+            } else {
+              bodyTokens.push(tokens[i]);
+            }
+          } else {
+            bodyTokens.push(tokens[i]);
+          }
+          i++;
+        }
+        if (name) {
+          context[name] = new SafeString(this.renderTokens([...bodyTokens], context));
+        }
+        return i;
+      }
       handleSpaceless(tokens, start2, context) {
         const bodyTokens = [];
         let i = start2 + 1;