tina4-nodejs 3.13.90 → 3.13.92

package/CLAUDE.md

@@ -1,10 +1,10 @@
-# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.90)
+# CLAUDE.md - AI Developer Guide for tina4-nodejs (v3.13.92)
 
 > This file helps AI assistants (Claude, Copilot, Cursor, etc.) understand and work on this codebase effectively.
 
 ## What This Project Is
 
-Tina4 for Node.js/TypeScript v3.13.90 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
+Tina4 for Node.js/TypeScript v3.13.92 - The Intelligent Native Application 4ramework. A convention-over-configuration structural paradigm. The developer writes TypeScript; Tina4 is invisible infrastructure.
 
 The philosophy: zero ceremony, batteries included, file system as source of truth.
 
@@ -1244,7 +1244,7 @@ When adding new features, add a corresponding `test/<feature>.test.ts` file.
 ## v3 Features Summary
 
 - **98 built-in features**, zero third-party dependencies
-- **5,923 tests** passing across 189 files (build + typecheck green)
+- **6,005 tests** passing across 191 files (build + typecheck green)
 - **Race-safe `getNextId()`** with atomic sequence table (`tina4_sequences`) for SQLite/MySQL/MSSQL; PostgreSQL auto-creates sequences
 - **Frond template engine optimizations**: pre-compiled regexes, lazy loop context (copy-on-write), filter chain caching, path split caching, inline common filters (11-15% speedup)
 - **Production server auto-detect**: `npx tina4nodejs serve --production` auto-uses cluster mode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tina4-nodejs",
-  "version": "3.13.90",
+  "version": "3.13.92",
   "type": "module",
   "description": "Tina4 for Node.js/TypeScript - 54 built-in features, zero dependencies",
   "keywords": [

package/packages/cli/dist/bin.js

@@ -12122,6 +12122,7 @@ var init_logger = __esm({
 var auth_exports = {};
 __export(auth_exports, {
   Auth: () => Auth,
+  JWT_LEEWAY_SECONDS: () => JWT_LEEWAY_SECONDS,
   authMiddleware: () => authMiddleware,
   authenticateRequest: () => authenticateRequest,
   checkPassword: () => checkPassword,
@@ -12130,6 +12131,7 @@ __export(auth_exports, {
   getToken: () => getToken,
   hashPassword: () => hashPassword,
   refreshToken: () => refreshToken,
+  resolveAlgorithm: () => resolveAlgorithm,
   validToken: () => validToken,
   validateApiKey: () => validateApiKey
 });
@@ -12190,6 +12192,18 @@ function ensureDevSecret(cwd) {
   }
   return newSecret;
 }
+function unsupportedAlgorithmError(algorithm) {
+  return new Error(
+    `Unsupported JWT algorithm "${algorithm}". Tina4 signs with ${SUPPORTED_ALGORITHMS.join(", ")} (HMAC via node:crypto; RS256 needs a PEM key pair). Set TINA4_JWT_ALGORITHM to one of those.`
+  );
+}
+function resolveAlgorithm(algorithm) {
+  const chosen = (algorithm || process.env.TINA4_JWT_ALGORITHM || "HS256").trim();
+  if (!HMAC_DIGESTS.has(chosen) && !RSA_SIGN_ALGORITHMS.has(chosen)) {
+    throw unsupportedAlgorithmError(chosen);
+  }
+  return chosen;
+}
 function base64urlEncode(data) {
   return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -12212,7 +12226,7 @@ function getToken(payload, secretOrExpiresIn, expiresIn = 60, algorithm) {
   if (!resolvedSecret) {
     _warnBlankSecret();
   }
-  const resolvedAlgorithm = algorithm ?? process.env.TINA4_JWT_ALGORITHM ?? "HS256";
+  const resolvedAlgorithm = resolveAlgorithm(algorithm);
   const header = { alg: resolvedAlgorithm, typ: "JWT" };
   const now = Math.floor(Date.now() / 1e3);
   const claims = { ...payload, iat: now };
@@ -12230,19 +12244,27 @@ function validToken(token, secret, algorithm) {
   if (!resolvedSecret) {
     _warnBlankSecret();
   }
-  const resolvedAlgorithm = algorithm ?? process.env.TINA4_JWT_ALGORITHM ?? "HS256";
+  const resolvedAlgorithm = resolveAlgorithm(algorithm);
   try {
     const parts = token.split(".");
     if (parts.length !== 3) return null;
     const [h, p, sig] = parts;
+    const header = JSON.parse(base64urlDecode(h).toString());
+    if (header.alg !== resolvedAlgorithm) return null;
     const signingInput = `${h}.${p}`;
     if (!verifySignature(signingInput, sig, resolvedSecret, resolvedAlgorithm)) {
       return null;
     }
     const payload = JSON.parse(base64urlDecode(p).toString());
-    if (typeof payload.exp === "number" && Date.now() / 1e3 > payload.exp) {
+    const now = Date.now() / 1e3;
+    if (typeof payload.exp === "number" && now > payload.exp) {
       return null;
     }
+    if (Object.hasOwn(payload, "nbf")) {
+      const notBefore = payload.nbf;
+      if (typeof notBefore !== "number" || !Number.isFinite(notBefore)) return null;
+      if (now + JWT_LEEWAY_SECONDS < notBefore) return null;
+    }
     return payload;
   } catch {
     return null;
@@ -12258,32 +12280,33 @@ function getPayload(token) {
   }
 }
 function sign(input, secret, algorithm) {
-  if (algorithm === "HS256") {
-    const sig = createHmac2("sha256", secret).update(input).digest();
-    return base64urlEncode(sig);
+  const digest = HMAC_DIGESTS.get(algorithm);
+  if (digest) {
+    return base64urlEncode(createHmac2(digest, secret).update(input).digest());
   }
-  if (algorithm === "RS256") {
-    const signer = createSign("RSA-SHA256");
+  const rsaAlgorithm = RSA_SIGN_ALGORITHMS.get(algorithm);
+  if (rsaAlgorithm) {
+    const signer = createSign(rsaAlgorithm);
     signer.update(input);
-    const sig = signer.sign(secret);
-    return base64urlEncode(sig);
+    return base64urlEncode(signer.sign(secret));
   }
-  throw new Error(`Unsupported algorithm: ${algorithm}`);
+  throw unsupportedAlgorithmError(algorithm);
 }
 function verifySignature(input, sig, secret, algorithm) {
-  if (algorithm === "HS256") {
+  if (HMAC_DIGESTS.has(algorithm)) {
     const expected = sign(input, secret, algorithm);
     const a = Buffer.from(sig);
     const b = Buffer.from(expected);
     if (a.length !== b.length) return false;
     return timingSafeEqual(a, b);
   }
-  if (algorithm === "RS256") {
-    const verifier = createVerify("RSA-SHA256");
+  const rsaAlgorithm = RSA_SIGN_ALGORITHMS.get(algorithm);
+  if (rsaAlgorithm) {
+    const verifier = createVerify(rsaAlgorithm);
     verifier.update(input);
     return verifier.verify(secret, base64urlDecode(sig));
   }
-  throw new Error(`Unsupported algorithm: ${algorithm}`);
+  throw unsupportedAlgorithmError(algorithm);
 }
 function hashPassword(password, salt, iterations = 26e4) {
   const actualSalt = salt ?? randomBytes3(16).toString("hex");
@@ -12308,7 +12331,7 @@ function checkPassword(password, hash) {
     return false;
   }
 }
-function authMiddleware(secret, algorithm = "HS256") {
+function authMiddleware(secret, algorithm) {
   return (req2, res, next) => {
     const authHeader = req2.headers.authorization ?? "";
     if (!authHeader.startsWith("Bearer ")) {
@@ -12331,11 +12354,11 @@ function refreshToken(token, expiresIn = 60) {
   const { iat: _iat, exp: _exp, ...claims } = payload;
   return getToken(claims, expiresIn);
 }
-function authenticateRequest(headers, secret, algorithm = "HS256") {
+function authenticateRequest(headers, secret, algorithm) {
   const authHeader = headers.authorization ?? headers.Authorization ?? "";
   if (!authHeader.startsWith("Bearer ")) return null;
   const token = authHeader.slice(7);
-  if (validToken(token)) return getPayload(token);
+  if (validToken(token, secret, algorithm)) return getPayload(token);
   if (validateApiKey(token)) {
     return { _auth: "api_key" };
   }
@@ -12349,12 +12372,23 @@ function validateApiKey(provided, expected) {
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
-var BLANK_SECRET_WARNING, Auth;
+var BLANK_SECRET_WARNING, HMAC_DIGESTS, RSA_SIGN_ALGORITHMS, SUPPORTED_ALGORITHMS, JWT_LEEWAY_SECONDS, Auth;
 var init_auth = __esm({
   "../core/src/auth.ts"() {
     "use strict";
     init_dotenv();
     BLANK_SECRET_WARNING = "Auth: TINA4_SECRET is not set \u2014 JWT signing is insecure. Set TINA4_SECRET to a random value (e.g. `openssl rand -hex 32`) in your environment or .env before serving traffic. For LOCAL DEV, set TINA4_DEBUG=true and a per-machine secret is generated automatically into .env.local (gitignored). Seeing this warning means the run was NOT detected as dev \u2014 typically a container or CI without TINA4_DEBUG set, or TINA4_ENV=production.";
+    HMAC_DIGESTS = /* @__PURE__ */ new Map([
+      ["HS256", "sha256"],
+      ["HS384", "sha384"],
+      ["HS512", "sha512"]
+    ]);
+    RSA_SIGN_ALGORITHMS = /* @__PURE__ */ new Map([["RS256", "RSA-SHA256"]]);
+    SUPPORTED_ALGORITHMS = [
+      ...HMAC_DIGESTS.keys(),
+      ...RSA_SIGN_ALGORITHMS.keys()
+    ];
+    JWT_LEEWAY_SECONDS = 60;
     Auth = class {
       static getToken = getToken;
       static validToken = validToken;
@@ -17938,7 +17972,7 @@ function extractFunctions(source, filePath, root = ".") {
     if (funcName !== null && !NON_FUNCTION_WORDS.has(funcName)) {
       const displayName = funcName === "constructor" && currentClass ? `${currentClass}.constructor` : currentClass !== null && !isTopLevelDecl ? `${currentClass}.${funcName}` : funcName;
       const funcBody = extractFunctionBody(lines, i);
-      const funcLoc = funcBody.split("\n").length;
+      const funcLoc = Math.max(1, countLines(funcBody).loc);
       const complexity = cycloMaticComplexity(funcBody);
       const args = argsStr.split(",").map((a) => a.trim().split(":")[0].split("=")[0].replace("?", "").trim()).filter((a) => a && a !== "this");
       functions.push({
@@ -17954,6 +17988,24 @@ function extractFunctions(source, filePath, root = ".") {
       currentClass = null;
     }
   }
+  return chargeNestedComplexityToTheNestedFunction(functions);
+}
+function chargeNestedComplexityToTheNestedFunction(functions) {
+  if (functions.length < 2) return functions;
+  const lastLine = (f) => f.line + Math.max(1, f.loc) - 1;
+  const contains = (outer, inner) => inner.line > outer.line && lastLine(inner) <= lastLine(outer);
+  const raw = functions.map((f) => f.complexity);
+  functions.forEach((outer, i) => {
+    let subtract = 0;
+    functions.forEach((inner, j) => {
+      if (i === j || !contains(outer, inner)) return;
+      const nestedDeeper = functions.some(
+        (mid, k) => k !== i && k !== j && contains(outer, mid) && contains(mid, inner)
+      );
+      if (!nestedDeeper) subtract += raw[j] - 1;
+    });
+    outer.complexity = Math.max(1, raw[i] - subtract);
+  });
   return functions;
 }
 function extractFunctionBody(lines, startLine) {

package/packages/core/dist/index.js

@@ -12121,6 +12121,7 @@ var init_logger = __esm({
 var auth_exports = {};
 __export(auth_exports, {
   Auth: () => Auth,
+  JWT_LEEWAY_SECONDS: () => JWT_LEEWAY_SECONDS,
   authMiddleware: () => authMiddleware,
   authenticateRequest: () => authenticateRequest,
   checkPassword: () => checkPassword,
@@ -12129,6 +12130,7 @@ __export(auth_exports, {
   getToken: () => getToken,
   hashPassword: () => hashPassword,
   refreshToken: () => refreshToken,
+  resolveAlgorithm: () => resolveAlgorithm,
   validToken: () => validToken,
   validateApiKey: () => validateApiKey
 });
@@ -12189,6 +12191,18 @@ function ensureDevSecret(cwd) {
   }
   return newSecret;
 }
+function unsupportedAlgorithmError(algorithm) {
+  return new Error(
+    `Unsupported JWT algorithm "${algorithm}". Tina4 signs with ${SUPPORTED_ALGORITHMS.join(", ")} (HMAC via node:crypto; RS256 needs a PEM key pair). Set TINA4_JWT_ALGORITHM to one of those.`
+  );
+}
+function resolveAlgorithm(algorithm) {
+  const chosen = (algorithm || process.env.TINA4_JWT_ALGORITHM || "HS256").trim();
+  if (!HMAC_DIGESTS.has(chosen) && !RSA_SIGN_ALGORITHMS.has(chosen)) {
+    throw unsupportedAlgorithmError(chosen);
+  }
+  return chosen;
+}
 function base64urlEncode(data) {
   return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -12211,7 +12225,7 @@ function getToken(payload, secretOrExpiresIn, expiresIn = 60, algorithm) {
   if (!resolvedSecret) {
     _warnBlankSecret();
   }
-  const resolvedAlgorithm = algorithm ?? process.env.TINA4_JWT_ALGORITHM ?? "HS256";
+  const resolvedAlgorithm = resolveAlgorithm(algorithm);
   const header = { alg: resolvedAlgorithm, typ: "JWT" };
   const now = Math.floor(Date.now() / 1e3);
   const claims = { ...payload, iat: now };
@@ -12229,19 +12243,27 @@ function validToken(token, secret, algorithm) {
   if (!resolvedSecret) {
     _warnBlankSecret();
   }
-  const resolvedAlgorithm = algorithm ?? process.env.TINA4_JWT_ALGORITHM ?? "HS256";
+  const resolvedAlgorithm = resolveAlgorithm(algorithm);
   try {
     const parts = token.split(".");
     if (parts.length !== 3) return null;
     const [h, p, sig] = parts;
+    const header = JSON.parse(base64urlDecode(h).toString());
+    if (header.alg !== resolvedAlgorithm) return null;
     const signingInput = `${h}.${p}`;
     if (!verifySignature(signingInput, sig, resolvedSecret, resolvedAlgorithm)) {
       return null;
     }
     const payload = JSON.parse(base64urlDecode(p).toString());
-    if (typeof payload.exp === "number" && Date.now() / 1e3 > payload.exp) {
+    const now = Date.now() / 1e3;
+    if (typeof payload.exp === "number" && now > payload.exp) {
       return null;
     }
+    if (Object.hasOwn(payload, "nbf")) {
+      const notBefore = payload.nbf;
+      if (typeof notBefore !== "number" || !Number.isFinite(notBefore)) return null;
+      if (now + JWT_LEEWAY_SECONDS < notBefore) return null;
+    }
     return payload;
   } catch {
     return null;
@@ -12257,32 +12279,33 @@ function getPayload(token) {
   }
 }
 function sign(input, secret, algorithm) {
-  if (algorithm === "HS256") {
-    const sig = createHmac2("sha256", secret).update(input).digest();
-    return base64urlEncode(sig);
+  const digest = HMAC_DIGESTS.get(algorithm);
+  if (digest) {
+    return base64urlEncode(createHmac2(digest, secret).update(input).digest());
   }
-  if (algorithm === "RS256") {
-    const signer = createSign("RSA-SHA256");
+  const rsaAlgorithm = RSA_SIGN_ALGORITHMS.get(algorithm);
+  if (rsaAlgorithm) {
+    const signer = createSign(rsaAlgorithm);
     signer.update(input);
-    const sig = signer.sign(secret);
-    return base64urlEncode(sig);
+    return base64urlEncode(signer.sign(secret));
   }
-  throw new Error(`Unsupported algorithm: ${algorithm}`);
+  throw unsupportedAlgorithmError(algorithm);
 }
 function verifySignature(input, sig, secret, algorithm) {
-  if (algorithm === "HS256") {
+  if (HMAC_DIGESTS.has(algorithm)) {
     const expected = sign(input, secret, algorithm);
     const a = Buffer.from(sig);
     const b = Buffer.from(expected);
     if (a.length !== b.length) return false;
     return timingSafeEqual(a, b);
   }
-  if (algorithm === "RS256") {
-    const verifier = createVerify("RSA-SHA256");
+  const rsaAlgorithm = RSA_SIGN_ALGORITHMS.get(algorithm);
+  if (rsaAlgorithm) {
+    const verifier = createVerify(rsaAlgorithm);
     verifier.update(input);
     return verifier.verify(secret, base64urlDecode(sig));
   }
-  throw new Error(`Unsupported algorithm: ${algorithm}`);
+  throw unsupportedAlgorithmError(algorithm);
 }
 function hashPassword(password, salt, iterations = 26e4) {
   const actualSalt = salt ?? randomBytes3(16).toString("hex");
@@ -12307,7 +12330,7 @@ function checkPassword(password, hash) {
     return false;
   }
 }
-function authMiddleware(secret, algorithm = "HS256") {
+function authMiddleware(secret, algorithm) {
   return (req2, res, next) => {
     const authHeader = req2.headers.authorization ?? "";
     if (!authHeader.startsWith("Bearer ")) {
@@ -12330,11 +12353,11 @@ function refreshToken(token, expiresIn = 60) {
   const { iat: _iat, exp: _exp, ...claims } = payload;
   return getToken(claims, expiresIn);
 }
-function authenticateRequest(headers, secret, algorithm = "HS256") {
+function authenticateRequest(headers, secret, algorithm) {
   const authHeader = headers.authorization ?? headers.Authorization ?? "";
   if (!authHeader.startsWith("Bearer ")) return null;
   const token = authHeader.slice(7);
-  if (validToken(token)) return getPayload(token);
+  if (validToken(token, secret, algorithm)) return getPayload(token);
   if (validateApiKey(token)) {
     return { _auth: "api_key" };
   }
@@ -12348,12 +12371,23 @@ function validateApiKey(provided, expected) {
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
-var BLANK_SECRET_WARNING, Auth;
+var BLANK_SECRET_WARNING, HMAC_DIGESTS, RSA_SIGN_ALGORITHMS, SUPPORTED_ALGORITHMS, JWT_LEEWAY_SECONDS, Auth;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
     init_dotenv();
     BLANK_SECRET_WARNING = "Auth: TINA4_SECRET is not set \u2014 JWT signing is insecure. Set TINA4_SECRET to a random value (e.g. `openssl rand -hex 32`) in your environment or .env before serving traffic. For LOCAL DEV, set TINA4_DEBUG=true and a per-machine secret is generated automatically into .env.local (gitignored). Seeing this warning means the run was NOT detected as dev \u2014 typically a container or CI without TINA4_DEBUG set, or TINA4_ENV=production.";
+    HMAC_DIGESTS = /* @__PURE__ */ new Map([
+      ["HS256", "sha256"],
+      ["HS384", "sha384"],
+      ["HS512", "sha512"]
+    ]);
+    RSA_SIGN_ALGORITHMS = /* @__PURE__ */ new Map([["RS256", "RSA-SHA256"]]);
+    SUPPORTED_ALGORITHMS = [
+      ...HMAC_DIGESTS.keys(),
+      ...RSA_SIGN_ALGORITHMS.keys()
+    ];
+    JWT_LEEWAY_SECONDS = 60;
     Auth = class {
       static getToken = getToken;
       static validToken = validToken;
@@ -17937,7 +17971,7 @@ function extractFunctions(source, filePath, root = ".") {
     if (funcName !== null && !NON_FUNCTION_WORDS.has(funcName)) {
       const displayName = funcName === "constructor" && currentClass ? `${currentClass}.constructor` : currentClass !== null && !isTopLevelDecl ? `${currentClass}.${funcName}` : funcName;
       const funcBody = extractFunctionBody(lines, i);
-      const funcLoc = funcBody.split("\n").length;
+      const funcLoc = Math.max(1, countLines(funcBody).loc);
       const complexity = cycloMaticComplexity(funcBody);
       const args = argsStr.split(",").map((a) => a.trim().split(":")[0].split("=")[0].replace("?", "").trim()).filter((a) => a && a !== "this");
       functions.push({
@@ -17953,6 +17987,24 @@ function extractFunctions(source, filePath, root = ".") {
       currentClass = null;
     }
   }
+  return chargeNestedComplexityToTheNestedFunction(functions);
+}
+function chargeNestedComplexityToTheNestedFunction(functions) {
+  if (functions.length < 2) return functions;
+  const lastLine = (f) => f.line + Math.max(1, f.loc) - 1;
+  const contains = (outer, inner) => inner.line > outer.line && lastLine(inner) <= lastLine(outer);
+  const raw = functions.map((f) => f.complexity);
+  functions.forEach((outer, i) => {
+    let subtract = 0;
+    functions.forEach((inner, j) => {
+      if (i === j || !contains(outer, inner)) return;
+      const nestedDeeper = functions.some(
+        (mid, k) => k !== i && k !== j && contains(outer, mid) && contains(mid, inner)
+      );
+      if (!nestedDeeper) subtract += raw[j] - 1;
+    });
+    outer.complexity = Math.max(1, raw[i] - subtract);
+  });
   return functions;
 }
 function extractFunctionBody(lines, startLine) {