tina4ruby 3.13.50 → 3.13.52

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8e5481c75ff116f52ef9981a60239741d14ebb21949d167e64760f6f618db2d0
-  data.tar.gz: 1eef903d1d00d45d21beef778ca31ffc5400208bd0ebebf0271cbe660e2b86d7
+  metadata.gz: b6a859f05cd2ac97b5e38ab9ee678cd8419f91be1aca0dedaed1e1d63b268968
+  data.tar.gz: 4454362a269ef77b5992a0ec4d2e30e6dd64134ed64265d1e8fd6f9432fcbc0f
 SHA512:
-  metadata.gz: afabfb4f602eab2b0e8f6d0be151f2f1bfb131f6c928d2627010b896b105fc6260f0d4647c42d07c5752a267c84222df2b080b8e7ac8c43b8406e8528832037c
-  data.tar.gz: 1249983018db2293240fe6d66d2938197a8e00febdb0dd818bd490c077ac49e794ea5f70bf8601db5863db452306458fb95a4c6064e588d71e7e5b04719b56b0
+  metadata.gz: 595d84b72e3b75a263f54ff93859a9f92f52fc76434b7633d149d11a2fa8a172a72478a13b9aa649ea0189a1f975d0a98daf7afa7cbceeb5bec9636433c95dad
+  data.tar.gz: 66634157b45125bb796277f54a9b93d12ab721c237b0dec39450d78d69ba4f3162972a178ef742607d45e4cc33d572c3460d7d336e0133e7c29ea902e21b68ae

data/lib/tina4/cli.rb

@@ -200,6 +200,10 @@ module Tina4
       # Register health check endpoint
       Tina4::Health.register!
 
+      # Register the always-on Frond {% live %} refresh endpoint
+      # (GET /__frond/live/{name}) so server-rendered live blocks can poll/SSE.
+      Tina4::Frond.register_live_endpoint!
+
       # Load route files
       load_routes(root_dir)
 

data/lib/tina4/database.rb

@@ -111,6 +111,7 @@ module Tina4
       "sqlite3" => "Tina4::Drivers::SqliteDriver",
       "postgres" => "Tina4::Drivers::PostgresDriver",
       "postgresql" => "Tina4::Drivers::PostgresDriver",
+      "pgsql" => "Tina4::Drivers::PostgresDriver",
       "mysql" => "Tina4::Drivers::MysqlDriver",
       "mssql" => "Tina4::Drivers::MssqlDriver",
       "sqlserver" => "Tina4::Drivers::MssqlDriver",

data/lib/tina4/dev_admin.rb

@@ -339,12 +339,13 @@ module Tina4
         return unless enabled?
 
         port = ENV["TINA4_PORT"] || ENV["PORT"] || "7147"
-        url  = "http://localhost:#{port}/__dev/api/mcp"
+        url  = "http://localhost:#{port}/__dev/mcp"
         target_dir = File.join(project_root, ".tina4")
         target = File.join(target_dir, "mcp.json")
         payload = {
           "mcpServers" => {
             "tina4-live-docs" => {
+              "type" => "http",
               "url" => url,
               "description" => "Live API docs for this Tina4 project (framework + user code)",
             },
@@ -659,8 +660,14 @@ module Tina4
             body = read_json_body(env) || {}
             json_response(mcp_tool_call(body))
           end
-        when ["POST", "/__dev/mcp"], ["POST", "/__dev/mcp/message"]
-          with_mcp_gate(env) { mcp_jsonrpc(env) }
+        when ["POST", "/__dev/mcp"]
+          with_mcp_gate(env) { mcp_streamable(env) }
+        when ["DELETE", "/__dev/mcp"]
+          with_mcp_gate(env) { mcp_delete(env) }
+        when ["GET", "/__dev/mcp"]
+          with_mcp_gate(env) { mcp_get_405 }
+        when ["POST", "/__dev/mcp/message"]
+          with_mcp_gate(env) { mcp_legacy_message(env) }
         when ["GET", "/__dev/mcp/sse"]
           with_mcp_gate(env) { mcp_sse_handshake }
         when ["GET", "/__dev/api/scaffold"]
@@ -1683,15 +1690,45 @@ module Tina4
       # clients POST a JSON-RPC 2.0 request; we hand the parsed body straight
       # to the default server's handle_message and echo the response. A
       # notification (no id) yields an empty 204, mirroring Python.
-      def mcp_jsonrpc(env)
-        body = read_json_body(env) || {}
+      # Streamable HTTP POST /__dev/mcp — the current MCP transport. initialize
+      # issues an Mcp-Session-Id; an unknown session on a non-initialize request
+      # is a 404; a notification is 202; anything else answers inline (200).
+      def mcp_streamable(env)
         server = Tina4._default_mcp_server
-        raw = server.handle_message(body)
-        if raw.nil? || raw.empty?
-          [204, { "content-type" => "application/json; charset=utf-8" }, []]
-        else
-          [200, { "content-type" => "application/json; charset=utf-8" }, [raw]]
-        end
+        out = server.dispatch_http(read_json_body(env) || {}, mcp_session_id(env))
+        mcp_triple(out)
+      end
+
+      # Legacy HTTP+SSE POST /__dev/mcp/message — inline, session-lenient.
+      def mcp_legacy_message(env)
+        server = Tina4._default_mcp_server
+        out = server.dispatch_http(read_json_body(env) || {}, "")
+        mcp_triple(out)
+      end
+
+      # DELETE /__dev/mcp — terminate the session (Streamable HTTP spec).
+      def mcp_delete(env)
+        Tina4._default_mcp_server.close_session(mcp_session_id(env))
+        [204, {}, []]
+      end
+
+      # GET /__dev/mcp — a server->client stream we do not open here.
+      def mcp_get_405
+        [405,
+         { "allow" => "POST, DELETE", "content-type" => "application/json; charset=utf-8" },
+         [McpProtocol.encode_error(nil, McpProtocol::INVALID_REQUEST, "Method Not Allowed")]]
+      end
+
+      # Read the Mcp-Session-Id request header (Rack: HTTP_MCP_SESSION_ID).
+      def mcp_session_id(env)
+        (env["HTTP_MCP_SESSION_ID"] || "").to_s
+      end
+
+      # Turn a dispatch_http result hash into a Rack [status, headers, body].
+      def mcp_triple(out)
+        headers = { "content-type" => "application/json; charset=utf-8" }.merge(out[:headers] || {})
+        body = out[:body].to_s
+        [out[:status], headers, body.empty? ? [] : [body]]
       end
 
       # SSE handshake (GET /__dev/mcp/sse). Tells the client where to POST

data/lib/tina4/frond.rb

@@ -39,7 +39,23 @@ module Tina4
     @@class_globals = {}
     @@class_tests   = {}
 
-    # Clear the class-level globals/filters/tests registries.
+    # -- Live-block registries (server-rendered {% live %} regions) -----------
+    # A {% live %} block registers three things when its page first renders:
+    #   * class_live_fragments[name]  -> the raw body source, re-rendered on
+    #                                    every refresh by the /__frond/live/<name>
+    #                                    endpoint or push_live
+    #   * class_live_sources[name]    -> an optional data provider (live_source)
+    #                                    that re-runs with the LIVE request each
+    #                                    refresh, so auth re-applies (IDOR guard)
+    #   * class_live_ws_paths[name]   -> the ws path a `ws "path"` block declared,
+    #                                    used as the push_live broadcast target
+    # These persist across requests in the long-lived server (parity with the
+    # Python master's class-level dicts and PHP's static registries).
+    @@class_live_fragments = {}
+    @@class_live_sources   = {}
+    @@class_live_ws_paths  = {}
+
+    # Clear the class-level globals/filters/tests/live registries.
     #
     # Useful in test fixtures to prevent leaking state between tests. Does
     # NOT affect built-in filters or globals — only user-registered ones.
@@ -47,6 +63,9 @@ module Tina4
       @@class_filters = {}
       @@class_globals = {}
       @@class_tests   = {}
+      @@class_live_fragments = {}
+      @@class_live_sources   = {}
+      @@class_live_ws_paths  = {}
     end
 
     # -- Token types ----------------------------------------------------------
@@ -91,6 +110,18 @@ module Tina4
     SET_RE          = /\Aset\s+(\w+)\s*=\s*(.+)\z/m
     INCLUDE_RE      = /\Ainclude\s+["'](.+?)["'](?:\s+with\s+(.+))?\z/
     MACRO_RE        = /\Amacro\s+(\w+)\s*\(([^)]*)\)/
+    # {% live "name" poll N | sse | ws "path" [src "url"] %}
+    LIVE_RE         = /\Alive\s+["']([^"']+)["'](.*)\z/m
+    LIVE_WS_RE      = /ws\s+["']([^"']+)["']/
+    LIVE_SRC_RE     = /src\s+["']([^"']+)["']/
+
+    # Escape a value for use inside an HTML attribute on a live marker.
+    # Byte-identical order to the Python master / PHP liveAttr so the emitted
+    # marker element matches across all four frameworks.
+    def self.live_attr(value)
+      value.to_s.gsub("&", "&amp;").gsub('"', "&quot;")
+           .gsub("<", "&lt;").gsub(">", "&gt;")
+    end
     FROM_IMPORT_RE  = /\Afrom\s+["'](.+?)["']\s+import\s+(.+)/
     CACHE_RE        = /\Acache\s+["'](.+?)["']\s*(\d+)?/
     SPACELESS_RE    = />\s+</
@@ -587,6 +618,9 @@ module Tina4
           when "cache"
             result, i = handle_cache(tokens, i, context)
             output << result
+          when "live"
+            result, i = handle_live(tokens, i, context)
+            output << result
           when "spaceless"
             result, i = handle_spaceless(tokens, i, context)
             output << result
@@ -1794,6 +1828,181 @@ module Tina4
       [rendered, i]
     end
 
+    # Handle {% live "name" poll N | sse | ws "path" [src "url"] %}...{% endlive %}.
+    #
+    # Server-rendered live region. The body renders once for first paint, is
+    # registered under <name> so the /__frond/live/<name> endpoint (or a
+    # live_source provider) can re-render it, and is wrapped in a marker element
+    # that frond.js wires to the chosen transport (poll / sse / ws). Mirrors the
+    # Python master's _handle_live and PHP's handleLive.
+    def handle_live(tokens, start, context)
+      content, _, _ = strip_tag(tokens[start][1])
+      m = LIVE_RE.match(content)
+      raise 'live: expected {% live "name" poll N | sse | ws "path" %}' unless m
+
+      name = m[1]
+      rest = (m[2] || "").strip
+      parts = rest.split
+      mode = parts[0] || ""
+
+      src = nil
+      if (sm = LIVE_SRC_RE.match(rest))
+        src = sm[1]
+      end
+      if src && (src.start_with?("http://") || src.start_with?("https://") || src.start_with?("//"))
+        raise "live: src must be a same-origin path, not an absolute URL"
+      end
+
+      interval = nil
+      ws_path  = nil
+      case mode
+      when "poll"
+        raise 'live: poll requires seconds, e.g. {% live "x" poll 5 %}' unless parts[1]&.match?(/\A\d+\z/)
+        interval = parts[1].to_i
+      when "sse"
+        # no extra config
+      when "ws"
+        wm = LIVE_WS_RE.match(rest)
+        raise 'live: ws requires a path, e.g. {% live "x" ws "/ws/x" %}' unless wm
+        ws_path = wm[1]
+      else
+        raise %(live: unknown transport "#{mode}" (use poll N, sse, or ws "path"))
+      end
+
+      # Collect body tokens up to {% endlive %}. Nested live is unsupported.
+      body_tokens = []
+      i = start + 1
+      while i < tokens.length
+        if tokens[i][0] == BLOCK
+          tc, _, _ = strip_tag(tokens[i][1])
+          tag = tc.split[0] || ""
+          raise "live: nested live blocks are not supported" if tag == "live"
+          if tag == "endlive"
+            i += 1
+            break
+          end
+          body_tokens << tokens[i]
+        else
+          body_tokens << tokens[i]
+        end
+        i += 1
+      end
+
+      # Register the raw body source so the auto endpoint can re-render it.
+      @@class_live_fragments[name] = body_tokens.map { |t| t[1] }.join
+
+      endpoint = src || ("/__frond/live/" + name)
+      attrs = [%(data-frond-live="#{Frond.live_attr(name)}"), %(id="live-#{Frond.live_attr(name)}")]
+      case mode
+      when "poll"
+        attrs << 'data-mode="poll"' << %(data-interval="#{interval}") << %(data-src="#{Frond.live_attr(endpoint)}")
+      when "sse"
+        attrs << 'data-mode="sse"' << %(data-src="#{Frond.live_attr(endpoint)}")
+      when "ws"
+        @@class_live_ws_paths[name] = ws_path
+        attrs << 'data-mode="ws"' << %(data-ws="#{Frond.live_attr(ws_path)}")
+      end
+
+      first_paint = render_tokens(body_tokens.dup, context)
+      [%(<div #{attrs.join(' ')}>#{first_paint}</div>), i]
+    end
+
+    # -- Live-block class API (mirrors Python master + PHP static facade) -----
+
+    # Re-render a registered {% live %} fragment by name with fresh data.
+    # Returns the rendered HTML, or nil if no fragment is registered under that
+    # name yet (its page has not rendered). The /__frond/live/<name> endpoint
+    # calls this after resolving the provider data.
+    def self.render_live(name, data = {})
+      source = @@class_live_fragments[name]
+      return nil if source.nil?
+
+      new.render_string(source, data || {})
+    end
+
+    # Register a data provider for a {% live %} block. Accepts a block OR a
+    # callable (proc/lambda); it is invoked with the live request on every
+    # refresh so auth re-applies (IDOR guard). Mirrors Python's @live_source.
+    def self.live_source(name, callable = nil, &blk)
+      @@class_live_sources[name] = callable || blk
+    end
+
+    # The provider registered for a live block, or nil.
+    def self.get_live_source(name)
+      @@class_live_sources[name]
+    end
+
+    # Whether a live fragment has been registered (its page rendered).
+    def self.has_live_fragment?(name)
+      @@class_live_fragments.key?(name)
+    end
+
+    # The ws path a live block declared (data-ws), or nil.
+    def self.get_live_ws_path(name)
+      @@class_live_ws_paths[name]
+    end
+
+    # Handle GET /__frond/live/{name}: resolve the provider, run it with the
+    # live request (auth re-applies), re-render the fragment, return via the
+    # response callable. 404 for unknown name / unrendered fragment. Mirrors
+    # Python's live_endpoint and PHP's respondLive.
+    def self.respond_live(request, response, name)
+      provider = @@class_live_sources[name]
+      if !@@class_live_fragments.key?(name) && provider.nil?
+        return response.call("live block not found: #{name}", 404)
+      end
+
+      context = {}
+      unless provider.nil?
+        result = provider.call(request)
+        context = result.is_a?(Hash) ? result : {}
+      end
+
+      html = render_live(name, context)
+      return response.call("live fragment not registered yet: #{name}", 404) if html.nil?
+
+      response.call(html)
+    end
+
+    # Re-render the '<name>' live fragment and push it to connected clients.
+    # Broadcasts a {type,name,html} envelope over WebSocket to the block's
+    # declared data-ws path (else a room named <name>). Returns the rendered
+    # HTML, or nil if the fragment is not registered. Mirrors Python push_live
+    # / PHP pushLive. The broadcast is best-effort — a missing/failed WS engine
+    # never raises into the caller.
+    def self.push_live(name, data = {})
+      html = render_live(name, data)
+      return nil if html.nil?
+
+      envelope = { "type" => "live", "name" => name, "html" => html }.to_json
+      engine = (Tina4::WebSocket.current if defined?(Tina4::WebSocket))
+      if engine
+        begin
+          ws_path = get_live_ws_path(name)
+          if ws_path
+            engine.broadcast(envelope, path: ws_path)
+          else
+            engine.broadcast_to_room(name, envelope)
+          end
+        rescue StandardError => e
+          Tina4::Log.error("push_live(#{name}) broadcast failed: #{e.message}") if defined?(Tina4::Log)
+        end
+      end
+      html
+    end
+
+    # Register the always-on GET /__frond/live/{name} endpoint that re-renders
+    # a live block on demand. Idempotent — guarded against a re-register after a
+    # Router.clear! (specs / hot-reload rescans). Mirrors PHP App::registerLiveEndpoint.
+    def self.register_live_endpoint!
+      return if Tina4::Router.find_route("GET", "/__frond/live/live-probe")
+
+      Tina4::Router.add(
+        "GET", "/__frond/live/{name}",
+        lambda { |request, response, name| Tina4::Frond.respond_live(request, response, name) }
+      )
+    end
+
     def handle_spaceless(tokens, start, context)
       body_tokens = []
       i = start + 1

data/lib/tina4/mcp.rb

@@ -22,6 +22,7 @@ require "json"
 require "socket"
 require "fileutils"
 require "open3"
+require "securerandom"
 
 module Tina4
   # ── JSON-RPC 2.0 codec ────────────────────────────────────────────
@@ -216,6 +217,12 @@ module Tina4
 
   # ── McpServer ─────────────────────────────────────────────────────
   class McpServer
+    # MCP protocol versions this server can speak, newest first. The 2025-*
+    # versions are the Streamable HTTP era; 2024-11-05 is the legacy HTTP+SSE
+    # transport we still accept for older clients (Claude Desktop et al.).
+    SUPPORTED_PROTOCOL_VERSIONS = %w[2025-06-18 2025-03-26 2024-11-05].freeze
+    LATEST_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS.first
+
     attr_reader :path, :name, :version
 
     # Class-level registry of all MCP server instances
@@ -231,6 +238,10 @@ module Tina4
       @tools       = {}
       @resources   = {}
       @initialized = false
+      # Streamable HTTP sessions: id => opened-at epoch. `initialize` mints one
+      # (returned in the Mcp-Session-Id header); a request bearing an unknown id
+      # gets a 404 so the client re-initializes.
+      @sessions    = {}
       self.class.instances << self
     end
 
@@ -292,23 +303,102 @@ module Tina4
       end
     end
 
-    # Register HTTP routes for this MCP server on the Tina4 router.
+    # ── Streamable HTTP transport ─────────────────────────────────────
+    # Session lifecycle + protocol negotiation shared by every transport
+    # entry point so the wire behaviour is identical across all 4 frameworks.
+
+    # Mint a new session id and remember it. Called on `initialize`.
+    def open_session
+      sid = SecureRandom.hex(16)
+      @sessions[sid] = Time.now.to_f
+      sid
+    end
+
+    # True when +session_id+ was issued by this server and is still open.
+    def is_valid_session(session_id)
+      !session_id.to_s.empty? && @sessions.key?(session_id)
+    end
+
+    # Forget a session (client DELETE or SSE stream close). Returns true when a
+    # live session was actually removed.
+    def close_session(session_id)
+      !@sessions.delete(session_id).nil?
+    end
+
+    # Pick the protocol version to run on. Echo the client's requested version
+    # when we support it (proper negotiation), else fall back to the newest
+    # version we speak so an unversioned/old client still connects.
+    def negotiate_protocol_version(requested)
+      return requested if SUPPORTED_PROTOCOL_VERSIONS.include?(requested)
+
+      LATEST_PROTOCOL_VERSION
+    end
+
+    # Transport-agnostic Streamable HTTP POST handler. Every transport calls
+    # this so the wire behaviour stays identical:
+    #   - `initialize` mints a session id, returned in the Mcp-Session-Id header.
+    #   - a non-initialize request carrying an unknown session id is a 404
+    #     (JSON-RPC error) so the client knows to re-initialize.
+    #   - a notification / response-only POST (no id) yields 202 with an empty
+    #     body.
+    #   - anything else returns 200 with the JSON-RPC response as
+    #     application/json (the MCP Streamable HTTP spec permits a POST that
+    #     resolves to a single response to answer inline).
+    # Returns { status:, headers:, body: }.
+    def dispatch_http(raw_data, session_id = "")
+      is_init = peek_method(raw_data) == "initialize"
+      if !is_init && !session_id.to_s.empty? && !is_valid_session(session_id)
+        return {
+          status: 404,
+          headers: {},
+          body: McpProtocol.encode_error(nil, McpProtocol::INVALID_REQUEST, "session not found")
+        }
+      end
+
+      body = handle_message(raw_data)
+      headers = {}
+      headers["Mcp-Session-Id"] = open_session if is_init
+      return { status: 202, headers: headers, body: "" } if body.nil? || body.empty?
+
+      { status: 200, headers: headers, body: body }
+    end
+
+    # Register HTTP routes for this MCP server on the Tina4 router. Custom
+    # (developer-created) MCP servers use this; the built-in dev server mounts
+    # the same transport via DevAdmin's dispatcher.
     def register_routes(router = nil)
-      server   = self
-      msg_path = "#{@path}/message"
-      sse_path = "#{@path}/sse"
+      server    = self
+      base_path = @path
+      msg_path  = "#{@path}/message"
+      sse_path  = "#{@path}/sse"
+
+      # Streamable HTTP (current transport) — single POST endpoint.
+      Tina4::Router.post(base_path) do |request, response|
+        out = server.dispatch_http(request.body, (request.header("mcp-session-id") || "").to_s)
+        out[:headers].each { |k, v| response.header(k, v) }
+        response.call(out[:body], out[:status], "application/json")
+      end
 
+      # DELETE terminates the session (Streamable HTTP spec).
+      Tina4::Router.delete(base_path) do |request, response|
+        server.close_session((request.header("mcp-session-id") || "").to_s)
+        response.call("", 204)
+      end
+
+      # GET on the endpoint is a server->client stream we do not open here.
+      Tina4::Router.get(base_path) do |_request, response|
+        response.header("allow", "POST, DELETE")
+        response.call({ "error" => "Method Not Allowed" }, 405, "application/json")
+      end
+
+      # Legacy HTTP+SSE POST target — inline, session-lenient.
       Tina4::Router.post(msg_path) do |request, response|
-        body = request.body
-        raw  = body.is_a?(Hash) ? body : (body.is_a?(String) ? body : body.to_s)
-        result = server.handle_message(raw)
-        if result.nil? || result.empty?
-          response.call("", 204)
-        else
-          response.call(JSON.parse(result))
-        end
+        out = server.dispatch_http(request.body, "")
+        out[:headers].each { |k, v| response.header(k, v) }
+        response.call(out[:body], out[:status], "application/json")
       end
 
+      # Legacy HTTP+SSE handshake — one-shot endpoint event.
       Tina4::Router.get(sse_path) do |request, response|
         endpoint_url = "#{request.url.sub(%r{/sse\z}, "")}/message"
         sse_data = "event: endpoint\ndata: #{endpoint_url}\n\n"
@@ -334,7 +424,8 @@ module Tina4
       config["mcpServers"] ||= {}
       server_key = @name.downcase.gsub(" ", "-")
       config["mcpServers"][server_key] = {
-        "url" => "http://localhost:#{port}#{@path}/sse"
+        "type" => "http",
+        "url"  => "http://localhost:#{port}#{@path}"
       }
 
       File.write(config_file, JSON.pretty_generate(config) + "\n")
@@ -352,10 +443,24 @@ module Tina4
 
     private
 
-    def _handle_initialize(_params)
+    # Read the JSON-RPC `method` from a raw request without dispatching. Used by
+    # the transport to spot `initialize` (mint a session) before handing the
+    # message to handle_message. Accepts a parsed Hash or a raw JSON string.
+    def peek_method(raw_data)
+      obj = if raw_data.is_a?(Hash)
+              raw_data
+            else
+              str = raw_data.to_s
+              str.empty? ? {} : (JSON.parse(str) rescue nil)
+            end
+      obj.is_a?(Hash) ? obj["method"] : nil
+    end
+
+    def _handle_initialize(params)
       @initialized = true
+      requested = params.is_a?(Hash) ? params["protocolVersion"] : nil
       {
-        "protocolVersion" => "2024-11-05",
+        "protocolVersion" => negotiate_protocol_version(requested),
         "capabilities"    => {
           "tools"     => { "listChanged" => false },
           "resources" => { "subscribe" => false, "listChanged" => false }

data/lib/tina4/public/js/frond.js

@@ -558,6 +558,132 @@ var _frondModule = (() => {
       }
     });
   }
+  function _liveKey(el) {
+    const d = el.dataset;
+    return d && d.key ? d.key : null;
+  }
+  function _liveSyncAttrs(oldNode, newNode) {
+    const na = newNode.attributes;
+    for (let i = 0; i < na.length; i++) {
+      const a = na[i];
+      if (oldNode.getAttribute(a.name) !== a.value) oldNode.setAttribute(a.name, a.value);
+    }
+    const oa = Array.prototype.slice.call(oldNode.attributes);
+    oa.forEach(function(a) {
+      if (!newNode.hasAttribute(a.name)) oldNode.removeAttribute(a.name);
+    });
+  }
+  function _liveMorphNode(oldNode, newNode) {
+    const tag = newNode.tagName;
+    if (tag === "INPUT" || tag === "TEXTAREA" || tag === "SELECT") return;
+    _liveSyncAttrs(oldNode, newNode);
+    if (oldNode.children.length || newNode.children.length) {
+      _liveReconcile(oldNode, newNode);
+    } else if (oldNode.innerHTML !== newNode.innerHTML) {
+      oldNode.innerHTML = newNode.innerHTML;
+    }
+  }
+  function _liveReconcile(parent, next) {
+    const oldKids = Array.prototype.slice.call(parent.children);
+    const newKids = Array.prototype.slice.call(next.children);
+    const oldByKey = {};
+    oldKids.forEach(function(c) {
+      const k = _liveKey(c);
+      if (k) oldByKey[k] = c;
+    });
+    const order = [];
+    for (let i = 0; i < newKids.length; i++) {
+      const nk = newKids[i];
+      const k = _liveKey(nk);
+      let match = null;
+      if (k && oldByKey[k]) {
+        match = oldByKey[k];
+      } else if (!k && oldKids[i] && !_liveKey(oldKids[i]) && oldKids[i].tagName === nk.tagName) {
+        match = oldKids[i];
+      }
+      if (match && match.tagName === nk.tagName) {
+        _liveMorphNode(match, nk);
+        reused.push(match);
+        order.push(match);
+      } else {
+        order.push(nk);
+      }
+    }
+    let cursor = parent.firstElementChild;
+    for (let i = 0; i < order.length; i++) {
+      const node = order[i];
+      if (node === cursor) {
+        cursor = cursor.nextElementSibling;
+      } else {
+        parent.insertBefore(node, cursor);
+      }
+    }
+    oldKids.forEach(function(c) {
+      if (order.indexOf(c) === -1 && c.parentNode === parent) parent.removeChild(c);
+    });
+    void reused;
+  }
+  function _liveSwap(container, html) {
+    const tmp = document.createElement("div");
+    tmp.innerHTML = html;
+    if (!tmp.children.length || !container.children.length) {
+      container.innerHTML = html;
+      return;
+    }
+    _liveReconcile(container, tmp);
+  }
+  function _liveWsUrl(path) {
+    if (/^wss?:\/\//.test(path)) return path;
+    const proto = typeof location !== "undefined" && location.protocol === "https:" ? "wss" : "ws";
+    return proto + "://" + location.host + path;
+  }
+  function _liveExtract(msg, name) {
+    if (msg && typeof msg === "object") {
+      if (msg.type === "live") {
+        if (name && msg.name && msg.name !== name) return null;
+        return msg.html != null ? String(msg.html) : null;
+      }
+      return null;
+    }
+    return typeof msg === "string" ? msg : null;
+  }
+  function liveInit(root) {
+    if (typeof document === "undefined") return;
+    const scope = root || document;
+    const blocks = scope.querySelectorAll("[data-frond-live]");
+    Array.prototype.slice.call(blocks).forEach(function(el) {
+      if (el.__frondLive) return;
+      el.__frondLive = true;
+      const mode = el.getAttribute("data-mode");
+      const name = el.getAttribute("data-frond-live");
+      if (mode === "poll") {
+        const src = el.getAttribute("data-src");
+        const interval = (parseInt(el.getAttribute("data-interval"), 10) || 5) * 1e3;
+        const timer = setInterval(function() {
+          if (typeof document !== "undefined" && document.hidden) return;
+          request(src, { method: "GET", onSuccess: function(data) {
+            _liveSwap(el, typeof data === "string" ? data : String(data));
+          } });
+        }, interval);
+        el.__frondLiveStop = function() {
+          clearInterval(timer);
+        };
+      } else if (mode === "ws") {
+        const sock = wsConnect(_liveWsUrl(el.getAttribute("data-ws")));
+        sock.on("message", function(msg) {
+          const h = _liveExtract(msg, name);
+          if (h !== null) _liveSwap(el, h);
+        });
+        el.__frondLiveStop = function() {
+          sock.close();
+        };
+      } else if (mode === "sse") {
+        if (typeof console !== "undefined" && console.warn) {
+          console.warn("[frond.live] sse transport is not wired yet (v1 supports poll and ws); block '" + name + "' shows first paint only. Use poll or ws.");
+        }
+      }
+    });
+  }
   var frond = {
     /** Core HTTP request. */
     request,
@@ -573,6 +699,8 @@ var _frondModule = (() => {
     ws: wsConnect,
     /** Server-Sent Events with auto-reconnect. */
     sse: sseConnect,
+    /** Wire {% live %} blocks (poll/ws) with keyed morph. Auto-runs on DOMContentLoaded. */
+    live: liveInit,
     /** Cookie helpers: get, set, remove. */
     cookie,
     /** Display alert message in #message element. */
@@ -593,8 +721,17 @@ var _frondModule = (() => {
   };
   if (typeof window !== "undefined") {
     window.frond = frond;
+    if (typeof document !== "undefined") {
+      if (document.readyState === "loading") {
+        document.addEventListener("DOMContentLoaded", function() {
+          liveInit();
+        });
+      } else {
+        liveInit();
+      }
+    }
   }
   return __toCommonJS(frond_exports);
 })();
-/* Frond v2.1.3 — tina4.com */
+/* Frond v2.2.0 - tina4.com */
 //# sourceMappingURL=frond.js.map

data/lib/tina4/public/js/frond.min.js

@@ -1,2 +1,2 @@
-var _frondModule=(()=>{var b=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var C=Object.prototype.hasOwnProperty;var O=(o,s)=>{for(var e in s)b(o,e,{get:s[e],enumerable:!0})},M=(o,s,e,t)=>{if(s&&typeof s=="object"||typeof s=="function")for(let n of x(s))!C.call(o,n)&&n!==e&&b(o,n,{get:()=>s[n],enumerable:!(t=k(s,n))||t.enumerable});return o};var q=o=>M(b({},"__esModule",{value:!0}),o);var j={};O(j,{frond:()=>R});var g=null;function w(o,s){let e;typeof s=="function"?e={onSuccess:s}:e=s||{};let t=(e.method||"GET").toUpperCase(),n=new XMLHttpRequest;if(n.open(t,o,!0),g!==null&&n.setRequestHeader("Authorization","Bearer "+g),e.headers)for(let r in e.headers)Object.prototype.hasOwnProperty.call(e.headers,r)&&n.setRequestHeader(r,e.headers[r]);let i=null;e.body!==void 0&&e.body!==null&&(e.body instanceof FormData?i=e.body:typeof e.body=="object"?(i=JSON.stringify(e.body),n.setRequestHeader("Content-Type","application/json; charset=UTF-8")):typeof e.body=="string"&&(i=e.body,n.setRequestHeader("Content-Type","text/plain; charset=UTF-8"))),n.onload=function(){let r=n.getResponseHeader("FreshToken");r&&r!==""&&(g=r);let u=n.response;try{u=JSON.parse(u)}catch{}if(n.responseURL){let c=new URL(o,window.location.href).href;if(n.responseURL!==c){window.location.href=n.responseURL;return}}n.status>=200&&n.status<400?e.onSuccess&&e.onSuccess(u,n.status,n):e.onError&&e.onError(n.status,n)},n.onerror=function(){e.onError&&e.onError(n.status,n)},n.send(i)}function h(o,s){if(!o)return"";let e=new DOMParser,t=o.includes("<html>")?o:"<body>"+o+"</body></html>",i=e.parseFromString(t,"text/html").querySelector("body"),r=i.querySelectorAll("script");if(r.forEach(function(u){u.remove()}),s!==null){let u=document.getElementById(s);return u&&(i.children.length>0?u.replaceChildren.apply(u,Array.from(i.children)):u.innerHTML=i.innerHTML,r.forEach(function(c){let d=document.createElement("script");d.type="text/javascript",d.async=!0,c.src?d.src=c.src:d.textContent=c.textContent,u.appendChild(d)})),""}return r.forEach(function(u){let c=document.createElement("script");c.type="text/javascript",c.async=!0,c.textContent=u.textContent,document.body.appendChild(c)}),i.innerHTML}function H(o,s,e){let t=s||"content";w(o,{method:"GET",onSuccess:function(n,i){if(document.getElementById(t)){let r=h(n,t);e&&e(r,n)}else e&&e(n)}})}function S(o,s,e,t){let n=e||"content";w(o,{method:"POST",body:s,onSuccess:function(i){let r="";if(i&&i.message!==void 0)r=h(i.message,n);else if(document.getElementById(n))r=h(i,n);else{t&&t(i);return}t&&t(r,i)}})}var T={collect:function(o){let s=new FormData,e=document.querySelectorAll("#"+o+" select, #"+o+" input, #"+o+" textarea");for(let t=0;t<e.length;t++){let n=e[t];if(n.name==="formToken"&&g!==null&&(n.value=g),!!n.name)if(n.type==="file"){let i=n.files;if(i)for(let r=0;r<i.length;r++){let u=i[r];if(u!==void 0){let c=n.name;i.length>1&&!c.includes("[")&&(c=c+"[]"),s.append(c,u,u.name)}}}else n.type==="checkbox"||n.type==="radio"?n.checked?s.append(n.name,n.value):n.type!=="radio"&&s.append(n.name,"0"):s.append(n.name,n.value===""?"":n.value)}return s},submit:function(o,s,e,t){let n=T.collect(o);S(s,n,e||"message",t)},show:function(o,s,e,t){let n=o.toUpperCase();(o==="create"||o==="edit")&&(n="GET"),o==="delete"&&(n="DELETE");let i=e||"form";w(s,{method:n,onSuccess:function(r){let u="";if(r&&r.message!==void 0)u=h(r.message,i);else if(document.getElementById(i))u=h(r,i);else{t&&t(r);return}t&&t(u)}})}};function L(o,s){let e={reconnect:!0,reconnectDelay:1e3,maxReconnectDelay:3e4,maxReconnectAttempts:1/0,protocols:[],onOpen:function(){},onClose:function(){},onError:function(){},...s||{}},t=null,n=!1,i=e.reconnectDelay,r=0,u=null,c={message:[],open:[],close:[],error:[]},d={status:"connecting",send:function(l){if(!t||t.readyState!==WebSocket.OPEN)throw new Error("[frond] WebSocket is not connected");t.send(typeof l=="string"?l:JSON.stringify(l))},on:function(l,a){return c[l]||(c[l]=[]),c[l].push(a),function(){let f=c[l],m=f.indexOf(a);m>=0&&f.splice(m,1)}},close:function(l,a){n=!0,u&&(clearTimeout(u),u=null),t&&t.close(l||1e3,a||""),d.status="closed"}};function y(l){if(typeof l!="string")return l;try{return JSON.parse(l)}catch{return l}}function p(){!e.reconnect||r>=e.maxReconnectAttempts||(r++,d.status="reconnecting",u=setTimeout(function(){u=null,v()},i),i=Math.min(i*2,e.maxReconnectDelay))}function v(){d.status=r>0?"reconnecting":"connecting";try{t=new WebSocket(o,e.protocols)}catch{d.status="closed";return}t.onopen=function(){d.status="open",r=0,i=e.reconnectDelay,e.onOpen();for(let l of c.open)l()},t.onmessage=function(l){let a=y(l.data);for(let f of c.message)f(a)},t.onclose=function(l){d.status="closed",e.onClose(l.code,l.reason);for(let a of c.close)a(l.code,l.reason);n||p()},t.onerror=function(l){e.onError(l);for(let a of c.error)a(l)}}return v(),d}function D(o,s){let e={reconnect:!0,reconnectDelay:1e3,maxReconnectDelay:3e4,maxReconnectAttempts:1/0,events:[],json:!0,onOpen:function(){},onClose:function(){},onError:function(){},...s||{}},t=null,n=!1,i=e.reconnectDelay,r=0,u=null,c={message:[],open:[],close:[],error:[]},d={status:"connecting",on:function(a,f){return c[a]||(c[a]=[]),c[a].push(f),function(){let m=c[a],E=m.indexOf(f);E>=0&&m.splice(E,1)}},close:function(){n=!0,u&&(clearTimeout(u),u=null),t&&(t.close(),t=null),d.status="closed"}};function y(a){if(!e.json)return a;try{return JSON.parse(a)}catch{return a}}function p(a,f){for(let m of c.message)m(a,f||void 0)}function v(){!e.reconnect||r>=e.maxReconnectAttempts||(r++,d.status="reconnecting",u=setTimeout(function(){u=null,l()},i),i=Math.min(i*2,e.maxReconnectDelay))}function l(){d.status=r>0?"reconnecting":"connecting";try{t=new EventSource(o)}catch{d.status="closed";return}t.onopen=function(){d.status="open",r=0,i=e.reconnectDelay,e.onOpen();for(let a of c.open)a(null)},t.onmessage=function(a){p(y(a.data),null)};for(let a of e.events)t.addEventListener(a,function(f){p(y(f.data),a)});t.onerror=function(a){e.onError(a);for(let f of c.error)f(a);if(t&&t.readyState===2){t=null,d.status="closed",e.onClose();for(let f of c.close)f(null);n||v()}}}return l(),d}var W={set:function(o,s,e){let t="";if(e){let n=new Date;n.setTime(n.getTime()+e*24*60*60*1e3),t="; expires="+n.toUTCString()}document.cookie=o+"="+(s||"")+t+"; path=/"},get:function(o){let s=o+"=",e=document.cookie.split(";");for(let t=0;t<e.length;t++){let n=e[t];for(;n.charAt(0)===" ";)n=n.substring(1);if(n.indexOf(s)===0)return n.substring(s.length)}return null},remove:function(o){document.cookie=o+"=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/"}};function A(o,s){let e=document.getElementById("message");if(!e)return;let t=s||"info";e.innerHTML='<div class="alert alert-'+t+' alert-dismissible">'+o+'<button type="button" class="btn-close" data-t4-dismiss="alert">&times;</button></div>'}function I(o,s,e,t){let n=window.screenLeft!==void 0?window.screenLeft:window.screenX,i=window.screenTop!==void 0?window.screenTop:window.screenY,r=window.innerWidth||document.documentElement.clientWidth||screen.width,u=window.innerHeight||document.documentElement.clientHeight||screen.height,c=r/window.screen.availWidth,d=(r-e)/2/c+n,y=(u-t)/2/c+i,p=window.open(o,s,"directories=no,toolbar=no,location=no,status=no,menubar=no,scrollbars=yes,resizable=yes,width="+e/c+",height="+t/c+",top="+y+",left="+d);return window.focus&&p&&p.focus(),p}function N(o){if(o.indexOf("No data available")>=0){window.alert("No data available for this report.");return}window.open(o,"_blank","toolbar=no,scrollbars=yes,resizable=yes,width=800,height=600,top=0,left=0")}function U(o,s,e,t){w(o,{method:"POST",body:{query:s,variables:e||{}},onSuccess:function(n){t&&t(n.data||null,n.errors||void 0)},onError:function(n){t&&t(null,[{message:"GraphQL request failed with status "+n}])}})}var R={request:w,load:H,post:S,inject:h,form:T,ws:L,sse:D,cookie:W,message:A,popup:I,report:N,graphql:U,get token(){return g},set token(o){g=o}};typeof window<"u"&&(window.frond=R);return q(j);})();
-/* Frond v2.1.3 — tina4.com */
+var _frondModule=(()=>{var E=Object.defineProperty;var O=Object.getOwnPropertyDescriptor;var A=Object.getOwnPropertyNames;var H=Object.prototype.hasOwnProperty;var q=(t,s)=>{for(var e in s)E(t,e,{get:s[e],enumerable:!0})},D=(t,s,e,o)=>{if(s&&typeof s=="object"||typeof s=="function")for(let n of A(s))!H.call(t,n)&&n!==e&&E(t,n,{get:()=>s[n],enumerable:!(o=O(s,n))||o.enumerable});return t};var W=t=>D(E({},"__esModule",{value:!0}),t);var z={};q(z,{frond:()=>L});var y=null;function v(t,s){let e;typeof s=="function"?e={onSuccess:s}:e=s||{};let o=(e.method||"GET").toUpperCase(),n=new XMLHttpRequest;if(n.open(o,t,!0),y!==null&&n.setRequestHeader("Authorization","Bearer "+y),e.headers)for(let u in e.headers)Object.prototype.hasOwnProperty.call(e.headers,u)&&n.setRequestHeader(u,e.headers[u]);let c=null;e.body!==void 0&&e.body!==null&&(e.body instanceof FormData?c=e.body:typeof e.body=="object"?(c=JSON.stringify(e.body),n.setRequestHeader("Content-Type","application/json; charset=UTF-8")):typeof e.body=="string"&&(c=e.body,n.setRequestHeader("Content-Type","text/plain; charset=UTF-8"))),n.onload=function(){let u=n.getResponseHeader("FreshToken");u&&u!==""&&(y=u);let r=n.response;try{r=JSON.parse(r)}catch{}if(n.responseURL){let i=new URL(t,window.location.href).href;if(n.responseURL!==i){window.location.href=n.responseURL;return}}n.status>=200&&n.status<400?e.onSuccess&&e.onSuccess(r,n.status,n):e.onError&&e.onError(n.status,n)},n.onerror=function(){e.onError&&e.onError(n.status,n)},n.send(c)}function h(t,s){if(!t)return"";let e=new DOMParser,o=t.includes("<html>")?t:"<body>"+t+"</body></html>",c=e.parseFromString(o,"text/html").querySelector("body"),u=c.querySelectorAll("script");if(u.forEach(function(r){r.remove()}),s!==null){let r=document.getElementById(s);return r&&(c.children.length>0?r.replaceChildren.apply(r,Array.from(c.children)):r.innerHTML=c.innerHTML,u.forEach(function(i){let l=document.createElement("script");l.type="text/javascript",l.async=!0,i.src?l.src=i.src:l.textContent=i.textContent,r.appendChild(l)})),""}return u.forEach(function(r){let i=document.createElement("script");i.type="text/javascript",i.async=!0,i.textContent=r.textContent,document.body.appendChild(i)}),c.innerHTML}function _(t,s,e){let o=s||"content";v(t,{method:"GET",onSuccess:function(n,c){if(document.getElementById(o)){let u=h(n,o);e&&e(u,n)}else e&&e(n)}})}function R(t,s,e,o){let n=e||"content";v(t,{method:"POST",body:s,onSuccess:function(c){let u="";if(c&&c.message!==void 0)u=h(c.message,n);else if(document.getElementById(n))u=h(c,n);else{o&&o(c);return}o&&o(u,c)}})}var x={collect:function(t){let s=new FormData,e=document.querySelectorAll("#"+t+" select, #"+t+" input, #"+t+" textarea");for(let o=0;o<e.length;o++){let n=e[o];if(n.name==="formToken"&&y!==null&&(n.value=y),!!n.name)if(n.type==="file"){let c=n.files;if(c)for(let u=0;u<c.length;u++){let r=c[u];if(r!==void 0){let i=n.name;c.length>1&&!i.includes("[")&&(i=i+"[]"),s.append(i,r,r.name)}}}else n.type==="checkbox"||n.type==="radio"?n.checked?s.append(n.name,n.value):n.type!=="radio"&&s.append(n.name,"0"):s.append(n.name,n.value===""?"":n.value)}return s},submit:function(t,s,e,o){let n=x.collect(t);R(s,n,e||"message",o)},show:function(t,s,e,o){let n=t.toUpperCase();(t==="create"||t==="edit")&&(n="GET"),t==="delete"&&(n="DELETE");let c=e||"form";v(s,{method:n,onSuccess:function(u){let r="";if(u&&u.message!==void 0)r=h(u.message,c);else if(document.getElementById(c))r=h(u,c);else{o&&o(u);return}o&&o(r)}})}};function M(t,s){let e={reconnect:!0,reconnectDelay:1e3,maxReconnectDelay:3e4,maxReconnectAttempts:1/0,protocols:[],onOpen:function(){},onClose:function(){},onError:function(){},...s||{}},o=null,n=!1,c=e.reconnectDelay,u=0,r=null,i={message:[],open:[],close:[],error:[]},l={status:"connecting",send:function(f){if(!o||o.readyState!==WebSocket.OPEN)throw new Error("[frond] WebSocket is not connected");o.send(typeof f=="string"?f:JSON.stringify(f))},on:function(f,a){return i[f]||(i[f]=[]),i[f].push(a),function(){let d=i[f],g=d.indexOf(a);g>=0&&d.splice(g,1)}},close:function(f,a){n=!0,r&&(clearTimeout(r),r=null),o&&o.close(f||1e3,a||""),l.status="closed"}};function p(f){if(typeof f!="string")return f;try{return JSON.parse(f)}catch{return f}}function m(){!e.reconnect||u>=e.maxReconnectAttempts||(u++,l.status="reconnecting",r=setTimeout(function(){r=null,w()},c),c=Math.min(c*2,e.maxReconnectDelay))}function w(){l.status=u>0?"reconnecting":"connecting";try{o=new WebSocket(t,e.protocols)}catch{l.status="closed";return}o.onopen=function(){l.status="open",u=0,c=e.reconnectDelay,e.onOpen();for(let f of i.open)f()},o.onmessage=function(f){let a=p(f.data);for(let d of i.message)d(a)},o.onclose=function(f){l.status="closed",e.onClose(f.code,f.reason);for(let a of i.close)a(f.code,f.reason);n||m()},o.onerror=function(f){e.onError(f);for(let a of i.error)a(f)}}return w(),l}function I(t,s){let e={reconnect:!0,reconnectDelay:1e3,maxReconnectDelay:3e4,maxReconnectAttempts:1/0,events:[],json:!0,onOpen:function(){},onClose:function(){},onError:function(){},...s||{}},o=null,n=!1,c=e.reconnectDelay,u=0,r=null,i={message:[],open:[],close:[],error:[]},l={status:"connecting",on:function(a,d){return i[a]||(i[a]=[]),i[a].push(d),function(){let g=i[a],T=g.indexOf(d);T>=0&&g.splice(T,1)}},close:function(){n=!0,r&&(clearTimeout(r),r=null),o&&(o.close(),o=null),l.status="closed"}};function p(a){if(!e.json)return a;try{return JSON.parse(a)}catch{return a}}function m(a,d){for(let g of i.message)g(a,d||void 0)}function w(){!e.reconnect||u>=e.maxReconnectAttempts||(u++,l.status="reconnecting",r=setTimeout(function(){r=null,f()},c),c=Math.min(c*2,e.maxReconnectDelay))}function f(){l.status=u>0?"reconnecting":"connecting";try{o=new EventSource(t)}catch{l.status="closed";return}o.onopen=function(){l.status="open",u=0,c=e.reconnectDelay,e.onOpen();for(let a of i.open)a(null)},o.onmessage=function(a){m(p(a.data),null)};for(let a of e.events)o.addEventListener(a,function(d){m(p(d.data),a)});o.onerror=function(a){e.onError(a);for(let d of i.error)d(a);if(o&&o.readyState===2){o=null,l.status="closed",e.onClose();for(let d of i.close)d(null);n||w()}}}return f(),l}var U={set:function(t,s,e){let o="";if(e){let n=new Date;n.setTime(n.getTime()+e*24*60*60*1e3),o="; expires="+n.toUTCString()}document.cookie=t+"="+(s||"")+o+"; path=/"},get:function(t){let s=t+"=",e=document.cookie.split(";");for(let o=0;o<e.length;o++){let n=e[o];for(;n.charAt(0)===" ";)n=n.substring(1);if(n.indexOf(s)===0)return n.substring(s.length)}return null},remove:function(t){document.cookie=t+"=; expires=Thu, 01 Jan 1970 00:00:00 UTC; path=/"}};function j(t,s){let e=document.getElementById("message");if(!e)return;let o=s||"info";e.innerHTML='<div class="alert alert-'+o+' alert-dismissible">'+t+'<button type="button" class="btn-close" data-t4-dismiss="alert">&times;</button></div>'}function B(t,s,e,o){let n=window.screenLeft!==void 0?window.screenLeft:window.screenX,c=window.screenTop!==void 0?window.screenTop:window.screenY,u=window.innerWidth||document.documentElement.clientWidth||screen.width,r=window.innerHeight||document.documentElement.clientHeight||screen.height,i=u/window.screen.availWidth,l=(u-e)/2/i+n,p=(r-o)/2/i+c,m=window.open(t,s,"directories=no,toolbar=no,location=no,status=no,menubar=no,scrollbars=yes,resizable=yes,width="+e/i+",height="+o/i+",top="+p+",left="+l);return window.focus&&m&&m.focus(),m}function P(t){if(t.indexOf("No data available")>=0){window.alert("No data available for this report.");return}window.open(t,"_blank","toolbar=no,scrollbars=yes,resizable=yes,width=800,height=600,top=0,left=0")}function F(t,s,e,o){v(t,{method:"POST",body:{query:s,variables:e||{}},onSuccess:function(n){o&&o(n.data||null,n.errors||void 0)},onError:function(n){o&&o(null,[{message:"GraphQL request failed with status "+n}])}})}function b(t){let s=t.dataset;return s&&s.key?s.key:null}function X(t,s){let e=s.attributes;for(let n=0;n<e.length;n++){let c=e[n];t.getAttribute(c.name)!==c.value&&t.setAttribute(c.name,c.value)}Array.prototype.slice.call(t.attributes).forEach(function(n){s.hasAttribute(n.name)||t.removeAttribute(n.name)})}function G(t,s){let e=s.tagName;e==="INPUT"||e==="TEXTAREA"||e==="SELECT"||(X(t,s),t.children.length||s.children.length?C(t,s):t.innerHTML!==s.innerHTML&&(t.innerHTML=s.innerHTML))}function C(t,s){let e=Array.prototype.slice.call(t.children),o=Array.prototype.slice.call(s.children),n={};e.forEach(function(r){let i=b(r);i&&(n[i]=r)});let c=[];for(let r=0;r<o.length;r++){let i=o[r],l=b(i),p=null;l&&n[l]?p=n[l]:!l&&e[r]&&!b(e[r])&&e[r].tagName===i.tagName&&(p=e[r]),p&&p.tagName===i.tagName?(G(p,i),reused.push(p),c.push(p)):c.push(i)}let u=t.firstElementChild;for(let r=0;r<c.length;r++){let i=c[r];i===u?u=u.nextElementSibling:t.insertBefore(i,u)}e.forEach(function(r){c.indexOf(r)===-1&&r.parentNode===t&&t.removeChild(r)}),reused}function k(t,s){let e=document.createElement("div");if(e.innerHTML=s,!e.children.length||!t.children.length){t.innerHTML=s;return}C(t,e)}function J(t){return/^wss?:\/\//.test(t)?t:(typeof location<"u"&&location.protocol==="https:"?"wss":"ws")+"://"+location.host+t}function N(t,s){return t&&typeof t=="object"?t.type==="live"?s&&t.name&&t.name!==s?null:t.html!=null?String(t.html):null:null:typeof t=="string"?t:null}function S(t){if(typeof document>"u")return;let e=(t||document).querySelectorAll("[data-frond-live]");Array.prototype.slice.call(e).forEach(function(o){if(o.__frondLive)return;o.__frondLive=!0;let n=o.getAttribute("data-mode"),c=o.getAttribute("data-frond-live");if(n==="poll"){let u=o.getAttribute("data-src"),r=(parseInt(o.getAttribute("data-interval"),10)||5)*1e3,i=setInterval(function(){typeof document<"u"&&document.hidden||v(u,{method:"GET",onSuccess:function(l){k(o,typeof l=="string"?l:String(l))}})},r);o.__frondLiveStop=function(){clearInterval(i)}}else if(n==="ws"){let u=M(J(o.getAttribute("data-ws")));u.on("message",function(r){let i=N(r,c);i!==null&&k(o,i)}),o.__frondLiveStop=function(){u.close()}}else n==="sse"&&typeof console<"u"&&console.warn&&console.warn("[frond.live] sse transport is not wired yet (v1 supports poll and ws); block '"+c+"' shows first paint only. Use poll or ws.")})}var L={request:v,load:_,post:R,inject:h,form:x,ws:M,sse:I,live:S,cookie:U,message:j,popup:B,report:P,graphql:F,get token(){return y},set token(t){y=t}};typeof window<"u"&&(window.frond=L,typeof document<"u"&&(document.readyState==="loading"?document.addEventListener("DOMContentLoaded",function(){S()}):S()));return W(z);})();
+/* Frond v2.2.0 - tina4.com */

data/lib/tina4/rack_app.rb

@@ -34,8 +34,11 @@ module Tina4
       fallback = Dir.exist?(FRAMEWORK_PUBLIC_DIR) ? [FRAMEWORK_PUBLIC_DIR] : []
       @static_roots = (project_roots + fallback).freeze
 
-      # Shared WebSocket engine for route-based WS handling
+      # Shared WebSocket engine for route-based WS handling. Publish it as the
+      # process-wide "current" engine so Frond.push_live (and other framework
+      # code) can broadcast live-block updates without a threaded reference.
       @websocket_engine = Tina4::WebSocket.new
+      Tina4::WebSocket.current = @websocket_engine
 
       # Register the dev-reload WebSocket route (debug mode only) so a browser
       # handshake to /__dev_reload is accepted and held open by the connection

data/lib/tina4/scss_compiler.rb

@@ -111,6 +111,10 @@ module Tina4
           content = content.gsub("$#{name}", value)
         end
 
+        # Resolve color functions (lighten/darken/rgba/rgb/mix) — after variable
+        # substitution so a $colour arg is already a hex literal (issue #124).
+        content = resolve_color_functions(content)
+
         # Handle nesting (basic single-level)
         content = flatten_nesting(content)
 
@@ -120,6 +124,109 @@ module Tina4
         content
       end
 
+      # Resolve lighten/darken/rgba/rgb/mix color functions. rgba(<hex>, a) is
+      # the damaging case (issue #124): the functional rgba() notation cannot
+      # take a hex, so rgba(#0f3460, 0.12) is invalid CSS and browsers drop the
+      # whole declaration. Convert the hex to its r,g,b components. hex_to_rgb /
+      # adjust_lightness are regex-free so they never clobber the match globals.
+      def resolve_color_functions(content)
+        content = content.gsub(/lighten\(\s*([^,]+)\s*,\s*([^)]+)\s*\)/) do
+          adjust_lightness(Regexp.last_match(1).strip, Regexp.last_match(2).strip.chomp("%").to_f / 100)
+        end
+        content = content.gsub(/darken\(\s*([^,]+)\s*,\s*([^)]+)\s*\)/) do
+          adjust_lightness(Regexp.last_match(1).strip, -(Regexp.last_match(2).strip.chomp("%").to_f / 100))
+        end
+        # rgba(<hex>, <alpha>) — only the two-arg hex form; leave rgba(r,g,b,a).
+        content = content.gsub(/rgba\(\s*(#[0-9a-fA-F]{3,8})\s*,\s*([\d.]+)\s*\)/) do
+          hex = Regexp.last_match(1)
+          alpha = Regexp.last_match(2).strip
+          whole = Regexp.last_match(0)
+          rgb = hex_to_rgb(hex)
+          rgb ? "rgba(#{rgb[0]}, #{rgb[1]}, #{rgb[2]}, #{alpha})" : whole
+        end
+        content = content.gsub(/rgb\(\s*(#[0-9a-fA-F]{3,8})\s*\)/) do
+          hex = Regexp.last_match(1)
+          whole = Regexp.last_match(0)
+          rgb = hex_to_rgb(hex)
+          rgb ? "rgb(#{rgb[0]}, #{rgb[1]}, #{rgb[2]})" : whole
+        end
+        # mix(<c1>, <c2>[, <weight>]) — Sass weight is c1's proportion (default 50%).
+        content.gsub(/mix\(\s*(#[0-9a-fA-F]{3,8})\s*,\s*(#[0-9a-fA-F]{3,8})\s*(?:,\s*([\d.]+%?)\s*)?\)/) do
+          hex1 = Regexp.last_match(1)
+          hex2 = Regexp.last_match(2)
+          weight = Regexp.last_match(3)
+          whole = Regexp.last_match(0)
+          c1 = hex_to_rgb(hex1)
+          c2 = hex_to_rgb(hex2)
+          if c1 && c2
+            w = weight ? weight.chomp("%").to_f / 100 : 0.5
+            mixed = (0..2).map { |i| (c1[i] * w + c2[i] * (1 - w)).round }
+            format("#%02x%02x%02x", *mixed)
+          else
+            whole
+          end
+        end
+      end
+
+      # Parse a #rgb / #rrggbb hex string into an [r, g, b] int array, or nil.
+      # Regex-free (uses Integer()) so it never touches the match globals.
+      def hex_to_rgb(color)
+        c = color.strip.delete_prefix("#")
+        c = c.chars.map { |ch| ch * 2 }.join if c.length == 3
+        return nil unless c.length == 6
+
+        [Integer(c[0, 2], 16), Integer(c[2, 2], 16), Integer(c[4, 2], 16)]
+      rescue ArgumentError
+        nil
+      end
+
+      # Adjust the HSL lightness of a hex color by `amount` (-1..1), return hex.
+      # Truncates (to_i) to match the Python master's int(x*255) byte-for-byte.
+      def adjust_lightness(color, amount)
+        rgb = hex_to_rgb(color)
+        return color if rgb.nil?
+
+        r, g, b = rgb.map { |v| v / 255.0 }
+        max = [r, g, b].max
+        min = [r, g, b].min
+        l = (max + min) / 2.0
+        d = max - min
+        h = 0.0
+        s = 0.0
+        if d != 0.0
+          s = l > 0.5 ? d / (2 - max - min) : d / (max + min)
+          h = if max == r
+                (g - b) / d + (g < b ? 6 : 0)
+              elsif max == g
+                (b - r) / d + 2
+              else
+                (r - g) / d + 4
+              end
+          h /= 6.0
+        end
+        l = [0.0, [1.0, l + amount].min].max
+        if s.zero?
+          r = g = b = l
+        else
+          q = l < 0.5 ? l * (1 + s) : l + s - l * s
+          p = 2 * l - q
+          r = _hue_to_rgb(p, q, h + 1.0 / 3)
+          g = _hue_to_rgb(p, q, h)
+          b = _hue_to_rgb(p, q, h - 1.0 / 3)
+        end
+        format("#%02x%02x%02x", (r * 255).to_i, (g * 255).to_i, (b * 255).to_i)
+      end
+
+      def _hue_to_rgb(p, q, t)
+        t += 1 if t < 0
+        t -= 1 if t > 1
+        return p + (q - p) * 6 * t if t < 1.0 / 6
+        return q if t < 1.0 / 2
+        return p + (q - p) * (2.0 / 3 - t) * 6 if t < 2.0 / 3
+
+        p
+      end
+
       # Resolve SCSS #{ ... } interpolation. Each #{ expr } is replaced by its
       # resolved inner text: a $variable inside the braces resolves to its value,
       # anything else is inlined verbatim (trimmed). Lets a value carry a

data/lib/tina4/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tina4
-  VERSION = "3.13.50"
+  VERSION = "3.13.52"
 end

data/lib/tina4/websocket.rb

@@ -135,6 +135,16 @@ module Tina4
   class WebSocket
     GUID = WEBSOCKET_GUID
 
+    # Process-wide handle to the live route-serving WebSocket engine. RackApp
+    # sets this on construction so framework code (Frond.push_live, background
+    # tasks) can broadcast without threading an engine reference through every
+    # call site. Mirrors PHP's \Tina4\Server::getInstance(). Nil until a RackApp
+    # is built (e.g. in unit specs) — best-effort callers degrade silently.
+    @current = nil
+    class << self
+      attr_accessor :current
+    end
+
     attr_reader :connections
 
     def initialize

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tina4ruby
 version: !ruby/object:Gem::Version
-  version: 3.13.50
+  version: 3.13.52
 platform: ruby
 authors:
 - Tina4 Team
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-02 00:00:00.000000000 Z
+date: 2026-07-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack