tina4ruby 3.13.38 → 3.13.40

data/lib/tina4/router.rb

@@ -214,15 +214,33 @@ module Tina4
   # A registered WebSocket route with path pattern matching (reuses Route's compile logic)
   class WebSocketRoute
     attr_reader :path, :handler, :path_regex, :param_names
+    # PUBLIC by default (mirrors GET). Flip to true with #secure (or via
+    # Tina4.secure_websocket) to require a valid JWT on the upgrade. Mirrors the
+    # HTTP Route's auth_required so the upgrade path enforces it identically.
+    attr_accessor :auth_required
 
-    def initialize(path, handler)
+    def initialize(path, handler, auth_required: false)
       @path = normalize_path(path).freeze
       @handler = handler
+      @auth_required = auth_required
       @param_names = []
       @path_regex = compile_pattern(@path)
       @param_names.freeze
     end
 
+    # Mark this WebSocket route as requiring bearer-token auth on the upgrade.
+    # Returns self for chaining: Tina4::Router.websocket("/chat") { ... }.secure
+    def secure
+      @auth_required = true
+      self
+    end
+
+    # Opt back out (the default). Returns self for chaining.
+    def no_auth
+      @auth_required = false
+      self
+    end
+
     # Returns params hash if matched, false otherwise
     def match?(request_path)
       match = @path_regex.match(request_path)
@@ -295,13 +313,25 @@ module Tina4
       #   connection — WebSocketConnection with #send, #broadcast, #close, #params
       #   event      — :open, :message, or :close
       #   data       — String payload for :message, nil for :open/:close
-      def websocket(path, &block)
-        ws_route = WebSocketRoute.new(path, block)
+      #
+      # PUBLIC by default (mirrors GET). Pass secure: true (the declarative way)
+      # OR chain .secure on the returned route (the imperative way) to require a
+      # valid JWT on the upgrade — both set the same auth_required flag, exactly
+      # like the HTTP routes support both a decorator/docblock and .secure.
+      def websocket(path, secure: false, &block)
+        ws_route = WebSocketRoute.new(path, block, auth_required: secure)
         ws_routes << ws_route
-        Tina4::Log.debug("WebSocket route registered: #{path}")
+        Tina4::Log.debug("WebSocket route registered: #{path}#{secure ? ' (secured)' : ''}")
         ws_route
       end
 
+      # Register a SECURED WebSocket route (auth required on the upgrade). The
+      # declarative sibling of Tina4::Router.websocket(...).secure — mirrors the
+      # secure_get/secure_post pair for HTTP routes.
+      def secure_websocket(path, &block)
+        websocket(path, secure: true, &block)
+      end
+
       # Find a matching WebSocket route for a given path.
       # Returns [ws_route, params] or nil.
       def find_ws_route(path)

data/lib/tina4/swagger.rb

@@ -7,14 +7,28 @@ module Tina4
       def generate(routes = [])
         spec = base_spec
         route_list = routes.empty? ? Tina4::Router.routes : routes
+        # Accumulators shared across routes: ORM models referenced
+        # (-> components.schemas), tags used (-> top-level tags[]), seen
+        # operationIds (de-dup — OpenAPI requires them unique).
+        ctx = { models: {}, used_tags: [], seen_ids: [] }
         route_list.each do |route|
-          add_route_to_spec(spec, route)
+          add_route_to_spec(spec, route, ctx)
         end
+
+        unless ctx[:models].empty?
+          spec["components"]["schemas"] = {}
+          ctx[:models].each do |name, klass|
+            spec["components"]["schemas"][name] = model_schema(klass)
+          end
+        end
+        spec["tags"] = ctx[:used_tags].map { |t| { "name" => t } } unless ctx[:used_tags].empty?
+
         spec
       end
 
-      # TINA4_SWAGGER_ENABLED — defaults to TINA4_DEBUG. When false, callers
-      # can choose to skip mounting /swagger entirely in production.
+      # TINA4_SWAGGER_ENABLED — defaults to TINA4_DEBUG. Wired into RackApp's
+      # /swagger serving (v3.13.40), so it genuinely gates whether the docs are
+      # served — it was dead code before.
       def enabled?
         explicit = ENV["TINA4_SWAGGER_ENABLED"]
         if explicit && !explicit.empty?
@@ -51,9 +65,7 @@ module Tina4
         {
           "openapi" => "3.0.3",
           "info" => info,
-          "servers" => [
-            { "url" => "/" }
-          ],
+          "servers" => servers,
           "paths" => {},
           "components" => {
             "securitySchemes" => {
@@ -67,48 +79,125 @@ module Tina4
         }
       end
 
-      def add_route_to_spec(spec, route)
-        path = convert_path(route.path)
+      # servers[] — TINA4_SWAGGER_SERVERS (comma-separated) for a multi-server
+      # list, else SWAGGER_DEV_URL, else the relative "/" default.
+      def servers
+        raw = ENV.fetch("TINA4_SWAGGER_SERVERS", "")
+        urls = raw.split(",").map(&:strip).reject(&:empty?)
+        return urls.map { |u| { "url" => u } } unless urls.empty?
+
+        dev = ENV["SWAGGER_DEV_URL"]
+        return [{ "url" => dev }] if dev && !dev.empty?
+
+        [{ "url" => "/" }]
+      end
+
+      # Valid OpenAPI path-item methods. Anything else (e.g. "any", a WebSocket
+      # "ws") is not a valid key and would make the document spec-invalid.
+      HTTP_METHODS = %w[get post put patch delete head options trace].freeze
+
+      def add_route_to_spec(spec, route, ctx)
         method = route.method.downcase
-        return if method == "any"
+        return unless HTTP_METHODS.include?(method)
+
+        path = convert_path(route.path)
+        meta = route.swagger_meta || {}
+
+        # ORM model -> components.schemas + $ref
+        ref = nil
+        if (model = meta[:model])
+          klass = model.is_a?(String) ? resolve_model(model) : model
+          if klass
+            name = klass.name.split("::").last
+            ctx[:models][name] ||= klass
+            ref = "#/components/schemas/#{name}"
+          end
+        end
+
+        tags = meta[:tags] || [extract_tag(route.path)]
+        tags.each { |t| ctx[:used_tags] << t unless ctx[:used_tags].include?(t) }
 
         spec["paths"][path] ||= {}
         operation = {
-          "summary" => route.swagger_meta[:summary] || "#{method.upcase} #{route.path}",
-          "description" => route.swagger_meta[:description] || "",
-          "tags" => route.swagger_meta[:tags] || [extract_tag(route.path)],
+          "operationId" => unique_operation_id(method, path, ctx[:seen_ids]),
+          "summary" => meta[:summary] || "#{method.upcase} #{route.path}",
+          "description" => meta[:description] || "",
+          "tags" => tags,
           "parameters" => build_parameters(route),
-          "responses" => route.swagger_meta[:responses] || default_responses
+          "responses" => meta[:responses] || model_or_default_responses(ref, meta[:model_list])
         }
 
+        operation["deprecated"] = true if meta[:deprecated]
+
         if route.auth_handler
           operation["security"] = [{ "bearerAuth" => [] }]
         end
 
-        if %w[post put patch].include?(method) && route.swagger_meta[:request_body]
-          operation["requestBody"] = route.swagger_meta[:request_body]
-        elsif %w[post put patch].include?(method)
-          operation["requestBody"] = default_request_body
+        if %w[post put patch].include?(method)
+          operation["requestBody"] = build_request_body(method, meta, ref)
         end
 
         spec["paths"][path][method] = operation
       end
 
+      def build_request_body(_method, meta, ref)
+        return meta[:request_body] if meta[:request_body]
+
+        schema = ref ? { "$ref" => ref } : { "type" => "object" }
+        content = { "schema" => schema }
+        content["example"] = meta[:example] if meta[:example]
+        { "content" => { "application/json" => content } }
+      end
+
+      def model_or_default_responses(ref, model_list)
+        return default_responses unless ref
+
+        schema = model_list ? { "type" => "array", "items" => { "$ref" => ref } } : { "$ref" => ref }
+        {
+          "200" => {
+            "description" => "Successful response",
+            "content" => { "application/json" => { "schema" => schema } }
+          }
+        }
+      end
+
       def convert_path(path)
-        # Convert {id:int} to {id}
-        path.gsub(/\{(\w+)(?::\w+)?\}/, '{\1}')
+        # {id:int} -> {id}
+        p = path.gsub(/\{(\w+)(?::\w+)?\}/, '{\1}')
+        # splat *path -> {path}; bare /* -> /{wildcard} (a literal '*' segment
+        # or an orphaned splat param is invalid OpenAPI templating)
+        p = p.gsub(/\*(\w+)/, '{\1}')
+        p.gsub(%r{(?<=/)\*(?=/|$)}, "{wildcard}")
       end
 
       def extract_tag(path)
         parts = path.split("/").reject(&:empty?)
-        parts.first || "default"
+        first = parts.first
+        return "default" if first.nil? || first.start_with?("{", "*")
+
+        first
+      end
+
+      def unique_operation_id(method, path, seen)
+        base = method + path.gsub(%r{[/{}*]}) { |c| c == "*" ? "wildcard" : "_" }
+        base = base.gsub(/_+/, "_").chomp("_")
+        oid = base
+        n = 2
+        while seen.include?(oid)
+          oid = "#{base}_#{n}"
+          n += 1
+        end
+        seen << oid
+        oid
       end
 
       def build_parameters(route)
         params = []
         route.param_names.each do |param|
+          name = param[:name].to_s
+          name = "wildcard" if name == "*"
           params << {
-            "name" => param[:name].to_s,
+            "name" => name,
             "in" => "path",
             "required" => true,
             "schema" => param_schema(param[:type])
@@ -118,16 +207,71 @@ module Tina4
       end
 
       def param_schema(type)
-        case type
+        case type.to_s
         when "int", "integer"
           { "type" => "integer" }
         when "float", "number"
           { "type" => "number" }
+        when "uuid"
+          { "type" => "string", "format" => "uuid" }
+        when "slug"
+          { "type" => "string", "pattern" => "^[a-z0-9]+(?:-[a-z0-9]+)*$" }
+        when "alpha"
+          { "type" => "string", "pattern" => "^[A-Za-z]+$" }
+        when "alnum"
+          { "type" => "string", "pattern" => "^[A-Za-z0-9]+$" }
+        else
+          { "type" => "string" }
+        end
+      end
+
+      # Build a components.schemas object from an ORM model's field definitions.
+      def model_schema(model_class)
+        props = {}
+        required = []
+        defs = model_class.respond_to?(:field_definitions) ? model_class.field_definitions : {}
+        defs.each do |name, opts|
+          props[name.to_s] = field_schema(opts)
+          required << name.to_s if opts[:nullable] == false
+        end
+        schema = { "type" => "object", "properties" => props.empty? ? {} : props }
+        schema["required"] = required unless required.empty?
+        schema
+      end
+
+      def field_schema(opts)
+        schema = map_field_type(opts[:type])
+        schema["readOnly"] = true if opts[:primary_key] && opts[:auto_increment]
+        schema
+      end
+
+      def map_field_type(type)
+        case type.to_s
+        when "integer"
+          { "type" => "integer" }
+        when "float", "decimal", "numeric"
+          { "type" => "number" }
+        when "boolean"
+          { "type" => "boolean" }
+        when "datetime", "date", "timestamp"
+          { "type" => "string", "format" => "date-time" }
+        when "blob"
+          { "type" => "string", "format" => "byte" }
         else
           { "type" => "string" }
         end
       end
 
+      def resolve_model(name)
+        Object.const_get(name)
+      rescue NameError
+        begin
+          Tina4.const_get(name)
+        rescue NameError
+          nil
+        end
+      end
+
       def default_responses
         {
           "200" => { "description" => "Successful response" },
@@ -137,16 +281,6 @@ module Tina4
           "500" => { "description" => "Internal server error" }
         }
       end
-
-      def default_request_body
-        {
-          "content" => {
-            "application/json" => {
-              "schema" => { "type" => "object" }
-            }
-          }
-        }
-      end
     end
   end
 end

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.38"
+  VERSION = "3.13.40"
 end

data/lib/tina4/websocket.rb

@@ -42,6 +42,79 @@ module Tina4
     allowed.include?(origin)
   end
 
+  # Extract a bearer token from a WebSocket upgrade handshake.
+  #
+  # Order (mirrors Python's tina4_python.websocket.ws_token):
+  #   1. the Authorization: Bearer <jwt> header (server/CLI/mobile clients)
+  #   2. the Sec-WebSocket-Protocol subprotocol in the form "bearer, <jwt>"
+  #      (the only way a *browser* can pass a token — new WebSocket() cannot set
+  #      headers, but it CAN offer subprotocols)
+  #   3. a ?token=<jwt> query-string param
+  # Returns the token String, or nil.
+  #
+  # +headers+ is a Hash. Lookups are case-insensitive across both the Rack-style
+  # "HTTP_AUTHORIZATION"/"HTTP_SEC_WEBSOCKET_PROTOCOL" keys and plain
+  # "authorization"/"Authorization"/"sec-websocket-protocol" keys so the same
+  # helper serves the rack_app upgrade path and direct callers/tests.
+  def self.ws_token(headers, query_string = "", subprotocol = "")
+    headers ||= {}
+    auth = headers["HTTP_AUTHORIZATION"] || headers["authorization"] || headers["Authorization"] || ""
+    if auth[0, 7].to_s.downcase == "bearer "
+      tok = auth[7..].to_s.strip
+      return tok.empty? ? nil : tok
+    end
+
+    proto = subprotocol.to_s
+    proto = headers["HTTP_SEC_WEBSOCKET_PROTOCOL"] || headers["sec-websocket-protocol"] ||
+            headers["Sec-WebSocket-Protocol"] || "" if proto.empty?
+    parts = proto.to_s.split(",").map(&:strip).reject(&:empty?)
+    if parts.length >= 2 && parts[0].downcase == "bearer"
+      return parts[1].empty? ? nil : parts[1]
+    end
+
+    qs = query_string.to_s
+    qs = headers["QUERY_STRING"].to_s if qs.empty?
+    unless qs.empty?
+      tok = qs.split("&").each_with_object(nil) do |pair, _acc|
+        k, v = pair.split("=", 2)
+        break v if k == "token"
+      end
+      return tok unless tok.nil? || tok.to_s.empty?
+    end
+
+    nil
+  end
+
+  # Per-route WebSocket authentication, checked on the upgrade.
+  #
+  # A route is secured when it requires auth (the WebSocketRoute's #auth_required
+  # is truthy — set by .secure on the route or by Tina4.secure_websocket). Public
+  # routes (the default) always pass. A secured route needs a valid JWT via the
+  # Authorization header, the "bearer" subprotocol, or ?token=.
+  #
+  # Returns [payload, ok] — the verified token payload (or nil) and whether the
+  # upgrade may proceed. Mirrors Python's ws_authorized.
+  def self.ws_authorized(auth_required, headers, query_string = "", subprotocol = "")
+    return [nil, true] unless auth_required
+
+    token = ws_token(headers, query_string, subprotocol)
+    return [nil, false] unless token
+
+    payload = Tina4::Auth.valid_token(token)
+    [payload, !payload.nil?]
+  end
+
+  # Whether the client offered the "bearer" subprotocol — in which case the
+  # handshake response must echo "bearer" as the accepted subprotocol (browsers
+  # reject a 101 that doesn't echo back a subprotocol they offered).
+  def self.ws_bearer_subprotocol_offered?(headers)
+    headers ||= {}
+    proto = headers["HTTP_SEC_WEBSOCKET_PROTOCOL"] || headers["sec-websocket-protocol"] ||
+            headers["Sec-WebSocket-Protocol"] || ""
+    parts = proto.to_s.split(",").map(&:strip).reject(&:empty?)
+    !parts.empty? && parts[0].downcase == "bearer"
+  end
+
   # Build a WebSocket frame (server→client, never masked).
   def self.build_frame(opcode, data, fin: true)
     first_byte = (fin ? 0x80 : 0x00) | opcode
@@ -451,7 +524,9 @@ module Tina4
     #     conn.on_close   { puts "bye" }
     #   end
     #
-    def self.route(path, &block)
+    # PUBLIC by default (mirrors GET). Pass secure: true to require a valid JWT
+    # on the upgrade (or chain .secure on the returned route).
+    def self.route(path, secure: false, &block)
       @route_handlers ||= {}
       @route_handlers[path] = block
 
@@ -467,7 +542,7 @@ module Tina4
         end
       end
 
-      Tina4::Router.websocket(path, &adapter)
+      Tina4::Router.websocket(path, secure: secure, &adapter)
     end
 
     # Upgrade a raw socket to a WebSocket connection and run its frame loop.
@@ -477,7 +552,7 @@ module Tina4
     # (Rack) mode the rack_app passes a process-wide shared engine here so that
     # broadcasts, rooms and the backplane span every route's connections even
     # though each upgrade keeps its own isolated event handlers on +self+.
-    def handle_upgrade(env, socket, manager: self)
+    def handle_upgrade(env, socket, manager: self, auth_required: false)
       key = env["HTTP_SEC_WEBSOCKET_KEY"]
       return unless key
 
@@ -490,11 +565,30 @@ module Tina4
         return
       end
 
+      # Per-route auth — checked AFTER the origin allow-list and BEFORE we accept
+      # the handshake. A PUBLIC route (the default, mirrors GET) always passes; a
+      # secured route (auth_required) needs a valid JWT via the Authorization
+      # header, the "bearer" subprotocol, or ?token=. Missing/invalid → reject
+      # the upgrade with a 401 (close code 1008 equivalent) and never accept.
+      payload, ok = Tina4.ws_authorized(auth_required, env, env["QUERY_STRING"].to_s)
+      unless ok
+        socket.write("HTTP/1.1 401 Unauthorized\r\n\r\n") rescue nil
+        socket.close rescue nil
+        return
+      end
+
       accept = Tina4.compute_accept_key(key)
 
+      # When the client offered the "bearer" subprotocol (the browser transport,
+      # since new WebSocket() can't set headers), echo "bearer" back as the
+      # accepted subprotocol — browsers reject a 101 that doesn't echo a
+      # subprotocol they offered. Mirrors Python's accept-subprotocol behaviour.
+      subproto_header = Tina4.ws_bearer_subprotocol_offered?(env) ? "Sec-WebSocket-Protocol: bearer\r\n" : ""
+
       response = "HTTP/1.1 101 Switching Protocols\r\n" \
                  "Upgrade: websocket\r\n" \
                  "Connection: Upgrade\r\n" \
+                 "#{subproto_header}" \
                  "Sec-WebSocket-Accept: #{accept}\r\n\r\n"
 
       socket.write(response)
@@ -502,6 +596,9 @@ module Tina4
       conn_id = SecureRandom.hex(16)
       ws_path = env["REQUEST_PATH"] || env["PATH_INFO"] || "/"
       connection = WebSocketConnection.new(conn_id, socket, ws_server: manager, path: ws_path)
+      # Expose the verified token payload on the connection (nil on public
+      # routes). Mirrors Python's connection.auth = payload.
+      connection.auth = payload
       manager.register_connection(connection)
 
       # Start the idle reaper lazily once we actually have a connection (opt-in
@@ -548,7 +645,8 @@ module Tina4
 
   class WebSocketConnection
     attr_reader :id, :rooms, :last_activity
-    attr_accessor :params, :path, :on_message_handler, :on_close_handler, :on_error_handler
+    attr_accessor :params, :path, :on_message_handler, :on_close_handler, :on_error_handler,
+                  :auth
 
     def initialize(id, socket, ws_server: nil, path: "/")
       @id = id
@@ -556,6 +654,9 @@ module Tina4
       @params = {}
       @ws_server = ws_server
       @path = path
+      # Verified JWT payload on a secured WS route, else nil (public route).
+      # Mirrors Python's connection.auth.
+      @auth = nil
       @rooms = Set.new
       @on_message_handler = nil
       @on_close_handler = nil

data/lib/tina4.rb

@@ -50,6 +50,7 @@ require_relative "tina4/error_overlay"
 require_relative "tina4/test_client"
 require_relative "tina4/test"
 require_relative "tina4/docs"
+require_relative "tina4/docstore"
 require_relative "tina4/mcp"
 
 module Tina4
@@ -212,6 +213,10 @@ module Tina4
       # Auto-discover routes
       auto_discover(root_dir)
 
+      # Apply pending DB migrations on startup (non-breaking — see method doc).
+      # Runs AFTER route discovery / DB bind, BEFORE serving.
+      auto_migrate_on_startup!(root_dir)
+
       Tina4::Log.info("Tina4 initialized successfully")
     end
 
@@ -383,9 +388,17 @@ module Tina4
       Tina4::Router.group(prefix, auth_handler: auth, &block)
     end
 
-    # WebSocket route registration
-    def websocket(path, &block)
-      Tina4::Router.websocket(path, &block)
+    # WebSocket route registration. PUBLIC by default (mirrors GET). Pass
+    # secure: true OR chain .secure on the returned route to require a valid JWT
+    # on the upgrade.
+    def websocket(path, secure: false, &block)
+      Tina4::Router.websocket(path, secure: secure, &block)
+    end
+
+    # Register a SECURED WebSocket route — declarative sibling of
+    # Tina4.websocket(...).secure, mirroring secure_get/secure_post.
+    def secure_websocket(path, &block)
+      Tina4::Router.secure_websocket(path, &block)
     end
 
     # Middleware hooks
@@ -440,8 +453,73 @@ module Tina4
       Tina4::Container.get(name)
     end
 
+    # Apply pending DB migrations on startup — NON-BREAKING. Public so it can be
+    # called explicitly (and unit-tested) as `Tina4.auto_migrate_on_startup!`.
+    #
+    # When a migrations/ folder exists (with at least one .sql file) and
+    # TINA4_AUTO_MIGRATE is not disabled, pending migrations are applied during
+    # boot so the schema is current with no manual `tina4ruby migrate` step. A
+    # failure here is logged LOUD and the service STILL starts — a bad migration
+    # must never take the backend down. (The explicit `tina4ruby migrate` CLI
+    # stays fail-fast so CI still gets a non-zero exit.)
+    #
+    # Disable with TINA4_AUTO_MIGRATE=false (also 0/no/off) — e.g. multi-instance
+    # production that migrates as a separate deploy step (concurrent first-apply
+    # can race).
+    def auto_migrate_on_startup!(root_dir = Dir.pwd)
+      # Gate 1: a migrations folder with at least one .sql file must exist.
+      migrations_dir = resolve_startup_migrations_dir(root_dir)
+      return unless migrations_dir
+
+      # Gate 2: TINA4_AUTO_MIGRATE not disabled (default "true"; false/0/no/off off).
+      unless Tina4::Env.is_truthy(ENV.fetch("TINA4_AUTO_MIGRATE", "true"))
+        Tina4::Log.debug("TINA4_AUTO_MIGRATE is off — skipping startup migrations")
+        return
+      end
+
+      # Gate 3: a database must be resolvable.
+      db = Tina4.database
+      unless db
+        Tina4::Log.debug("Startup migrations skipped (no database configured)")
+        return
+      end
+
+      begin
+        migration = Tina4::Migration.new(db, migrations_dir: migrations_dir)
+        results = migration.run
+        applied = Array(results).count { |r| r[:status] == "success" }
+        Tina4::Log.info("Applied #{applied} pending migration(s) on startup") if applied.positive?
+        # A migration that records as "failed" surfaces in `run`'s results but
+        # does NOT raise from the runner; treat a recorded failure as loud-log too.
+        if Array(results).any? { |r| r[:status] == "failed" }
+          Tina4::Log.error(
+            "Startup auto-migration failed — the service is starting anyway. " \
+            "Run `tina4ruby migrate` to retry."
+          )
+        end
+      rescue => e
+        # NON-BREAKING: never re-raise out of the startup hook.
+        Tina4::Log.error(
+          "Startup auto-migration failed: #{e.message} — the service is starting " \
+          "anyway. Run `tina4ruby migrate` to retry."
+        )
+      end
+    end
+
     private
 
+    # Resolve the migrations directory for startup auto-migration, returning it
+    # only when it exists AND contains at least one .sql file. Prefers
+    # src/migrations, falls back to migrations/ (mirrors Migration#resolve_migrations_dir).
+    def resolve_startup_migrations_dir(root_dir)
+      %w[src/migrations migrations].each do |rel|
+        dir = File.join(root_dir, rel)
+        next unless Dir.exist?(dir)
+        return dir unless Dir.glob(File.join(dir, "*.sql")).empty?
+      end
+      nil
+    end
+
     # Resolve auth option for route registration
     # :default => use bearer auth (default for POST/PUT/PATCH/DELETE)
     # false    => no auth (public route)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.38
+  version: 3.13.40
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-19 00:00:00.000000000 Z
+date: 2026-06-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -278,6 +278,7 @@ files:
 - lib/tina4/dev_admin.rb
 - lib/tina4/dev_mailbox.rb
 - lib/tina4/docs.rb
+- lib/tina4/docstore.rb
 - lib/tina4/drivers/firebird_driver.rb
 - lib/tina4/drivers/mongodb_driver.rb
 - lib/tina4/drivers/mssql_driver.rb