tina4-nodejs 3.13.98 → 3.13.100

package/packages/core/src/websocket.ts

@@ -676,13 +676,13 @@ export class WebSocketServer {
       const backlog = client.socket.writableLength ?? 0;
       const maxBacklog = parseInt(process.env.TINA4_WS_MAX_BACKLOG ?? "1048576", 10);
       if (maxBacklog > 0 && backlog > maxBacklog) {
-        Log.warn(`WebSocket client ${client.id} backlog ${backlog}B exceeds limit, dropping slow client`);
+        Log.warning(`WebSocket client ${client.id} backlog ${backlog}B exceeds limit, dropping slow client`);
         this.pruneClient(client);
         return false;
       }
       return true;
     } catch (err) {
-      Log.warn(`WebSocket send to ${client.id} failed, pruning: ${(err as Error).message}`);
+      Log.warning(`WebSocket send to ${client.id} failed, pruning: ${(err as Error).message}`);
       this.pruneClient(client);
       return false;
     }

package/packages/core/src/websocketBackplane.ts

@@ -348,7 +348,7 @@ export class WsBackplaneManager {
     // publish() is async; we fire-and-forget but still catch a rejection so a
     // dead bus can't produce an unhandled rejection that crashes the worker.
     Promise.resolve(this.backplane.publish(this.channel, JSON.stringify(envelope))).catch(
-      (err) => log?.warn(`WebSocket backplane publish failed: ${(err as Error).message}`),
+      (err) => log?.warning(`WebSocket backplane publish failed: ${(err as Error).message}`),
     );
   }
 
@@ -366,7 +366,7 @@ export class WsBackplaneManager {
 /** Minimal logger shape so the manager doesn't import the logger module. */
 export interface WsBackplaneLogger {
   info(message: string): void;
-  warn(message: string): void;
+  warning(message: string): void;
   error(message: string): void;
 }
 

package/packages/frond/dist/index.js

@@ -1,7 +1,7 @@
 // src/engine.ts
 import { createHash, createHmac, randomBytes } from "node:crypto";
-import { readFileSync, existsSync, statSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { readFileSync, existsSync, statSync, realpathSync } from "node:fs";
+import { join, resolve, isAbsolute, sep } from "node:path";
 var SafeString = class {
   constructor(value) {
     this.value = value;
@@ -179,12 +179,15 @@ var THOUSANDS_RE = /\B(?=(\d{3})+(?!\d))/g;
 var LIVE_RE = /^live\s+["']([^"']+)["']([\s\S]*)$/;
 var LIVE_WS_RE = /ws\s+["']([^"']+)["']/;
 var LIVE_SRC_RE = /src\s+["']([^"']+)["']/;
+var EXTENDS_RE = /\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/;
+var EXTENDS_RE_GLOBAL = /\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/g;
 function liveAttr(value) {
   return String(value).replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 var filterChainCache = /* @__PURE__ */ new Map();
 var pathParseCache = /* @__PURE__ */ new Map();
 var TEMPLATE_CACHE_MAX = 256;
+var MEMO_CACHE_MAX = 1024;
 function capCache(cache, maxEntries) {
   if (cache.size < maxEntries) return;
   let drop = Math.floor(maxEntries / 2);
@@ -193,6 +196,12 @@ function capCache(cache, maxEntries) {
     if (--drop <= 0) break;
   }
 }
+function sweepExpiredCache(cache) {
+  const now = Date.now();
+  for (const [key, [, expiresAt]] of cache) {
+    if (expiresAt <= now) cache.delete(key);
+  }
+}
 var TOKEN_RE = /(\{%-?\s*[\s\S]*?\s*-?%\})|(\{\{-?\s*[\s\S]*?\s*-?\}\})|(\{#[\s\S]*?#\})/g;
 var RAW_BLOCK_RE = /\{%-?\s*raw\s*-?%\}([\s\S]*?)\{%-?\s*endraw\s*-?%\}/g;
 function tokenize(source) {
@@ -258,6 +267,16 @@ function stripTag(raw) {
   }
   return [inner.trim(), stripBefore, stripAfter];
 }
+function extendsTarget(source) {
+  const matches = source.match(EXTENDS_RE_GLOBAL);
+  if (matches && matches.length > 1) {
+    throw new Error(
+      `Frond: template has ${matches.length} "{% extends %}" tags -- a template can extend only one parent`
+    );
+  }
+  const match = source.match(EXTENDS_RE);
+  return match ? match[1] : "";
+}
 function resolveVar(expr, context) {
   expr = expr.trim();
   if (expr.startsWith('"') && expr.endsWith('"') || expr.startsWith("'") && expr.endsWith("'")) {
@@ -338,6 +357,7 @@ function resolveVar(expr, context) {
         fromBracket.push(false);
       }
     }
+    capCache(pathParseCache, MEMO_CACHE_MAX);
     pathParseCache.set(expr, [parts, fromBracket]);
   }
   let value = context;
@@ -441,15 +461,15 @@ function findOutsideQuotes(expr, needle) {
   }
   return -1;
 }
-function splitOutsideQuotes(expr, sep) {
-  if (!expr.includes(sep)) return [expr];
+function splitOutsideQuotes(expr, sep2) {
+  if (!expr.includes(sep2)) return [expr];
   const parts = [];
   let currentStart = 0;
   let inQuote = null;
   let depth = 0;
   let bracketDepth = 0;
   let i = 0;
-  const sepLen = sep.length;
+  const sepLen = sep2.length;
   const lastStart = expr.length - sepLen;
   while (i <= lastStart) {
     const ch = expr[i];
@@ -470,7 +490,7 @@ function splitOutsideQuotes(expr, sep) {
     else if (ch === ")") depth--;
     else if (ch === "[") bracketDepth++;
     else if (ch === "]") bracketDepth--;
-    if (depth === 0 && bracketDepth === 0 && expr.startsWith(sep, i)) {
+    if (depth === 0 && bracketDepth === 0 && expr.startsWith(sep2, i)) {
       parts.push(expr.slice(currentStart, i));
       i += sepLen;
       currentStart = i;
@@ -925,6 +945,7 @@ function parseFilterChain(expr) {
     }
   }
   const result = [variable, filters];
+  capCache(filterChainCache, MEMO_CACHE_MAX);
   filterChainCache.set(expr, result);
   return result;
 }
@@ -1101,8 +1122,8 @@ var BUILTIN_FILTERS = {
   },
   first: (v) => Array.isArray(v) ? v[0] ?? null : null,
   last: (v) => Array.isArray(v) ? v[v.length - 1] ?? null : null,
-  join: (v, sep) => Array.isArray(v) ? v.map(String).join(sep !== void 0 ? String(sep) : ", ") : String(v),
-  split: (v, sep) => String(v).split(sep !== void 0 ? String(sep) : " "),
+  join: (v, sep2) => Array.isArray(v) ? v.map(String).join(sep2 !== void 0 ? String(sep2) : ", ") : String(v),
+  split: (v, sep2) => String(v).split(sep2 !== void 0 ? String(sep2) : " "),
   replace: (v, from, to) => {
     const s = String(v);
     if (from !== void 0 && typeof from === "object" && from !== null && !Array.isArray(from)) {
@@ -1290,7 +1311,7 @@ function _b64url(data) {
 }
 var _formTokenSessionId = "";
 function _buildFormTokenJwt(descriptor = "") {
-  const secret = process.env.TINA4_SECRET || "tina4-default-secret";
+  const secret = process.env.TINA4_SECRET ?? "";
   const ttlMinutes = parseInt(process.env.TINA4_TOKEN_LIMIT || "60", 10);
   const header = { alg: "HS256", typ: "JWT" };
   const now = Math.floor(Date.now() / 1e3);
@@ -1451,29 +1472,22 @@ var Frond = class _Frond {
     return this;
   }
   /**
-   * Register a custom filter. The filter is persisted at class level
-   * so new instances created by hot-reload inherit it automatically;
-   * the live instance's local filter map also receives the addition
-   * immediately. Mirrors Python's _ClassOrInstanceMethod dual-call.
+   * Register a custom filter on this instance only. Use the static method
+   * for process-global registration. tina4: ADR-0052.
    */
   addFilter(name, fn) {
-    _Frond.classFilters.set(name, fn);
     this.filters[name] = fn;
   }
   /**
-   * Register a global variable available in all templates. Persisted
-   * at class level — see ``addFilter`` for the dual-call semantics.
+   * Register a global variable on this instance only.
    */
   addGlobal(name, value) {
-    _Frond.classGlobals.set(name, value);
     this.globals[name] = value;
   }
   /**
-   * Register a custom test. Persisted at class level — see
-   * ``addFilter`` for the dual-call semantics.
+   * Register a custom test on this instance only.
    */
   addTest(name, fn) {
-    _Frond.classTests.set(name, fn);
     this.tests[name] = fn;
   }
   /**
@@ -1537,12 +1551,30 @@ var Frond = class _Frond {
   renderDump(value) {
     return renderDump(value).toString();
   }
+  /**
+   * Load a template's source, CONFINED under the templates directory.
+   *
+   * Every path-taking tag ({% include %}, {% extends %}, {% import %},
+   * {% from ... import %}) funnels through this one loader, so this single guard
+   * confines them all (TAG-DEC-01): a name that is absolute, climbs out with a
+   * `..` up-level segment, or resolves through a symlink to a location OUTSIDE
+   * the templates root is REFUSED -- the outside file is never read. Template
+   * -side analogue of the static-asset confinement (feature 41 / ADR-0050).
+   */
   load(name) {
+    if (isAbsolute(name) || name.split(/[\\/]/).includes("..")) {
+      throw new Error(`Template path escapes the templates directory: ${name}`);
+    }
     const filePath = join(this.templateDir, name);
-    if (!existsSync(filePath)) {
+    if (!existsSync(filePath) || !statSync(filePath).isFile()) {
       throw new Error(`Template not found: ${filePath}`);
     }
-    return readFileSync(filePath, "utf-8");
+    const root = realpathSync(this.templateDir);
+    const real = realpathSync(filePath);
+    if (real !== root && !real.startsWith(root + sep)) {
+      throw new Error(`Template path escapes the templates directory: ${name}`);
+    }
+    return readFileSync(real, "utf-8");
   }
   /** Execute pre-tokenized template against context. */
   executeCached(tokens, context) {
@@ -1570,9 +1602,8 @@ var Frond = class _Frond {
     if (Object.keys(this.tests).length > 0) {
       context.__frond_tests__ = this.tests;
     }
-    const extendsMatch = source.match(/\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/);
-    if (extendsMatch) {
-      const parentName = extendsMatch[1];
+    const parentName = extendsTarget(source);
+    if (parentName) {
       const parentSource = this.load(parentName);
       const childBlocks = this.extractBlocks(source);
       return this.renderWithBlocks(parentSource, context, childBlocks);
@@ -1583,9 +1614,8 @@ var Frond = class _Frond {
     if (Object.keys(this.tests).length > 0) {
       context.__frond_tests__ = this.tests;
     }
-    const extendsMatch = source.match(/\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/);
-    if (extendsMatch) {
-      const parentName = extendsMatch[1];
+    const parentName = extendsTarget(source);
+    if (parentName) {
       const parentSource = this.load(parentName);
       const childBlocks = this.extractBlocks(source);
       return this.renderWithBlocks(parentSource, context, childBlocks);
@@ -1630,10 +1660,93 @@ var Frond = class _Frond {
     }
     return blocks;
   }
+  /**
+   * Depth-aware block substitution against `source` (typically the
+   * fully-resolved root template).
+   *
+   * A single regex `.replace()` pass (the flat `pattern` this replaces in
+   * renderWithBlocks) pairs an OUTER block's open tag with the FIRST
+   * `{% endblock %}` found -- which, when the outer block wraps a NESTED
+   * `{% block %}`, is the nested block's own close tag, not the outer's.
+   * That silently truncates the outer block's captured content and drops
+   * everything after the inner endblock (the root-nested-block
+   * content-loss bug). This scans with an open/close depth counter
+   * instead (mirroring extractBlocks), so an outer block always captures
+   * its FULL body, nested child blocks included.
+   *
+   * The content chosen for each block -- the child override in `blocks`
+   * if present, else the block's own default body -- is then recursively
+   * substituted against the SAME `blocks` map before being tokenized and
+   * rendered, so a block nested inside another block resolves correctly
+   * regardless of which template in the inheritance chain declared the
+   * nesting (the root, an intermediate, however many levels deep).
+   *
+   * `{{ parent() }}` / `{{ super() }}` inside a block still render that
+   * block's OWN default content at this level (lazy, on first call).
+   */
+  substituteBlocks(source, blocks, context) {
+    const blockOpen = /\{%[-\s]*block\s+(\w+)\s*[-]?%\}/g;
+    const blockClose = /\{%[-\s]*endblock\s*[-]?%\}/g;
+    const engine = this;
+    const pieces = [];
+    let pos = 0;
+    while (pos < source.length) {
+      blockOpen.lastIndex = pos;
+      const mOpen = blockOpen.exec(source);
+      if (!mOpen) {
+        pieces.push(source.slice(pos));
+        break;
+      }
+      pieces.push(source.slice(pos, mOpen.index));
+      const name = mOpen[1];
+      const contentStart = mOpen.index + mOpen[0].length;
+      let depth = 1;
+      let scan = contentStart;
+      let closeMatch = null;
+      while (depth > 0 && scan < source.length) {
+        blockOpen.lastIndex = scan;
+        blockClose.lastIndex = scan;
+        const nextOpen = blockOpen.exec(source);
+        const nextClose = blockClose.exec(source);
+        if (!nextClose) break;
+        if (nextOpen && nextOpen.index < nextClose.index) {
+          depth++;
+          scan = nextOpen.index + nextOpen[0].length;
+        } else {
+          depth--;
+          if (depth === 0) {
+            closeMatch = nextClose;
+          } else {
+            scan = nextClose.index + nextClose[0].length;
+          }
+        }
+      }
+      if (!closeMatch) {
+        pieces.push(source.slice(mOpen.index));
+        pos = source.length;
+        break;
+      }
+      const parentContent = source.slice(contentStart, closeMatch.index);
+      const blockSource = blocks[name] ?? parentContent;
+      const resolvedSource = engine.substituteBlocks(blockSource, blocks, context);
+      let renderedParent = null;
+      const getParent = () => {
+        if (renderedParent === null) {
+          renderedParent = new SafeString(
+            engine.renderTokens(tokenize(parentContent), context)
+          );
+        }
+        return renderedParent;
+      };
+      const blockCtx = { ...context, parent: getParent, super: getParent };
+      pieces.push(engine.renderTokens(tokenize(resolvedSource), blockCtx));
+      pos = closeMatch.index + closeMatch[0].length;
+    }
+    return pieces.join("");
+  }
   renderWithBlocks(parentSource, context, childBlocks) {
-    const extendsMatch = parentSource.trimStart().match(/\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/);
-    if (extendsMatch) {
-      const grandparentName = extendsMatch[1];
+    const grandparentName = extendsTarget(parentSource);
+    if (grandparentName) {
       const grandparentSource = this.load(grandparentName);
       const parentBlocks = this.extractBlocks(parentSource);
       const mergedBlocks = { ...parentBlocks, ...childBlocks };
@@ -1653,22 +1766,7 @@ var Frond = class _Frond {
       }
       return this.renderWithBlocks(grandparentSource, context, mergedBlocks);
     }
-    const pattern = /\{%[-\s]*block\s+(\w+)\s*[-]?%\}([\s\S]*?)\{%[-\s]*endblock\s*[-]?%\}/g;
-    const engine = this;
-    const result = parentSource.replace(pattern, (_match, name, parentContent) => {
-      const blockSource = childBlocks[name] ?? parentContent;
-      let renderedParent = null;
-      const getParent = () => {
-        if (renderedParent === null) {
-          renderedParent = new SafeString(
-            engine.renderTokens(tokenize(parentContent), context)
-          );
-        }
-        return renderedParent;
-      };
-      const blockCtx = { ...context, parent: getParent, super: getParent };
-      return this.renderTokens(tokenize(blockSource), blockCtx);
-    });
+    const result = this.substituteBlocks(parentSource, childBlocks, context);
     return this.renderTokens(tokenize(result), context);
   }
   renderTokens(tokens, context) {
@@ -2309,9 +2407,9 @@ var Frond = class _Frond {
     let source;
     try {
       source = this.load(filename);
-    } catch {
+    } catch (err) {
       if (ignoreMissing) return "";
-      throw new Error(`Template not found: ${join(this.templateDir, filename)}`);
+      throw err;
     }
     const incContext = { ...context };
     if (withExpr) {
@@ -2491,6 +2589,7 @@ var Frond = class _Frond {
     const m = content.match(/^cache\s+["'](.+?)["']\s*(\d+)?/);
     const cacheKey = m ? m[1] : "default";
     const ttl = m && m[2] ? parseInt(m[2], 10) : 60;
+    sweepExpiredCache(this.fragmentCache);
     const cached = this.fragmentCache.get(cacheKey);
     if (cached) {
       const [htmlContent, expiresAt] = cached;
@@ -2538,6 +2637,7 @@ var Frond = class _Frond {
       i++;
     }
     const rendered = this.renderTokens([...bodyTokens], context);
+    capCache(this.fragmentCache, TEMPLATE_CACHE_MAX);
     this.fragmentCache.set(cacheKey, [rendered, Date.now() + ttl * 1e3]);
     return [rendered, i];
   }