tina4-nodejs 3.13.101 → 3.13.104

package/packages/core/dist/index.js

@@ -1462,6 +1462,7 @@ __export(engine_exports, {
   Frond: () => Frond,
   MEMO_CACHE_MAX: () => MEMO_CACHE_MAX,
   TEMPLATE_CACHE_MAX: () => TEMPLATE_CACHE_MAX,
+  expressionFormCache: () => expressionFormCache,
   filterChainCache: () => filterChainCache,
   pathParseCache: () => pathParseCache,
   setFormTokenSessionId: () => setFormTokenSessionId
@@ -1870,62 +1871,58 @@ function splitOutsideQuotes(expr, sep6) {
   parts.push(expr.slice(currentStart));
   return parts;
 }
-function evalExpr(expr, context) {
-  expr = expr.trim();
-  if (expr.length >= 2) {
-    const q = expr[0];
-    if ((q === '"' || q === "'") && expr.endsWith(q) && !expr.slice(1, -1).includes(q)) {
-      return expr.slice(1, -1);
-    }
-  }
-  if (expr.length >= 2 && expr[0] === "(" && expr.endsWith(")")) {
-    let depth = 0;
-    let matched = true;
-    for (let pi = 0; pi < expr.length; pi++) {
-      if (expr[pi] === "(") depth++;
-      else if (expr[pi] === ")") depth--;
-      if (depth === 0 && pi < expr.length - 1) {
-        matched = false;
-        break;
-      }
-    }
-    if (matched) {
-      return evalExpr(expr.slice(1, -1), context);
-    }
+function parenthesizedInner(expr) {
+  if (expr.length < 2 || expr[0] !== "(" || !expr.endsWith(")")) return null;
+  let depth = 0;
+  for (let index = 0; index < expr.length; index++) {
+    if (expr[index] === "(") depth++;
+    else if (expr[index] === ")") depth--;
+    if (depth === 0 && index < expr.length - 1) return null;
   }
-  const ternaryIdx = findTernary(expr);
-  if (ternaryIdx !== -1) {
-    const condPart = expr.slice(0, ternaryIdx).trim();
-    const rest = expr.slice(ternaryIdx + 1);
-    const colonIdx = findColon(rest);
-    if (colonIdx !== -1) {
-      const truePart = rest.slice(0, colonIdx).trim();
-      const falsePart = rest.slice(colonIdx + 1).trim();
-      const cond = evalExpr(condPart, context);
-      return cond ? evalExpr(truePart, context) : evalExpr(falsePart, context);
-    }
+  return expr.slice(1, -1);
+}
+function evalPrimary(expr, context) {
+  const quote = expr[0];
+  if (expr.length >= 2 && (quote === '"' || quote === "'") && expr.endsWith(quote) && !expr.slice(1, -1).includes(quote)) {
+    return expr.slice(1, -1);
   }
+  const inner = parenthesizedInner(expr);
+  if (inner !== null) return evalExpr(inner, context);
+  return EXPR_NOT_MATCHED;
+}
+function evalTernaryExpression(expr, context) {
+  const ternaryIdx = findTernary(expr);
+  if (ternaryIdx === -1) return EXPR_NOT_MATCHED;
+  const rest = expr.slice(ternaryIdx + 1);
+  const colonIdx = findColon(rest);
+  if (colonIdx === -1) return EXPR_NOT_MATCHED;
+  const condition = evalExpr(expr.slice(0, ternaryIdx).trim(), context);
+  const branch = condition ? rest.slice(0, colonIdx) : rest.slice(colonIdx + 1);
+  return evalExpr(branch.trim(), context);
+}
+function evalInlineIfExpression(expr, context) {
   const ifIdx = findOutsideQuotes(expr, " if ");
-  if (ifIdx >= 0) {
-    const elseIdx = findOutsideQuotes(expr, " else ");
-    if (elseIdx >= 0 && elseIdx > ifIdx) {
-      const valuePart = expr.slice(0, ifIdx).trim();
-      const condPart = expr.slice(ifIdx + 4, elseIdx).trim();
-      const elsePart = expr.slice(elseIdx + 6).trim();
-      const cond = evalExpr(condPart, context);
-      return cond ? evalExpr(valuePart, context) : evalExpr(elsePart, context);
-    }
-  }
+  if (ifIdx < 0) return EXPR_NOT_MATCHED;
+  const elseIdx = findOutsideQuotes(expr, " else ");
+  if (elseIdx < 0 || elseIdx <= ifIdx) return EXPR_NOT_MATCHED;
+  const condition = evalExpr(expr.slice(ifIdx + 4, elseIdx).trim(), context);
+  const branch = condition ? expr.slice(0, ifIdx) : expr.slice(elseIdx + 6);
+  return evalExpr(branch.trim(), context);
+}
+function evalCoalesceExpression(expr, context) {
   const qqIdx = findOutsideQuotes(expr, "??");
-  if (qqIdx !== -1) {
-    const left = expr.slice(0, qqIdx).trim();
-    const right = expr.slice(qqIdx + 2).trim();
-    const val = evalExpr(left, context);
-    if (val === null || val === void 0) {
-      return evalExpr(right, context);
-    }
-    return val;
+  if (qqIdx === -1) return EXPR_NOT_MATCHED;
+  const value = evalExpr(expr.slice(0, qqIdx).trim(), context);
+  return value === null || value === void 0 ? evalExpr(expr.slice(qqIdx + 2).trim(), context) : value;
+}
+function evalConditional(expr, context) {
+  for (const evaluator of [evalTernaryExpression, evalInlineIfExpression, evalCoalesceExpression]) {
+    const result = evaluator(expr, context);
+    if (result !== EXPR_NOT_MATCHED) return result;
   }
+  return EXPR_NOT_MATCHED;
+}
+function evalConcatOrComparison(expr, context) {
   if (findOutsideQuotes(expr, "~") >= 0) {
     const parts = splitOutsideQuotes(expr, "~");
     if (parts.length > 1) {
@@ -1943,6 +1940,9 @@ function evalExpr(expr, context) {
       return evalComparison(expr, context);
     }
   }
+  return EXPR_NOT_MATCHED;
+}
+function evalArithmeticExpression(expr, context) {
   for (const op of [" + ", " - ", " * ", " // ", " / ", " % ", " ** "]) {
     const pos = findOutsideQuotes(expr, op);
     if (pos >= 0) {
@@ -1955,40 +1955,15 @@ function evalExpr(expr, context) {
         let rNum = rVal != null ? Number(rVal) : 0;
         if (isNaN(lNum)) lNum = 0;
         if (isNaN(rNum)) rNum = 0;
-        const opS = op.trim();
-        const bothInt = Number.isInteger(lNum) && Number.isInteger(rNum) && opS !== "/";
-        let result;
-        switch (opS) {
-          case "+":
-            result = lNum + rNum;
-            break;
-          case "-":
-            result = lNum - rNum;
-            break;
-          case "*":
-            result = lNum * rNum;
-            break;
-          case "//":
-            result = rNum !== 0 ? Math.floor(lNum / rNum) : 0;
-            break;
-          case "/":
-            result = rNum !== 0 ? lNum / rNum : 0;
-            break;
-          case "%":
-            result = rNum !== 0 ? lNum % rNum : 0;
-            break;
-          case "**":
-            result = lNum ** rNum;
-            break;
-          default:
-            result = 0;
-        }
-        return bothInt && Number.isInteger(result) ? result : result;
+        return ARITHMETIC_OPERATIONS[op.trim()](lNum, rNum);
       } catch {
         return null;
       }
     }
   }
+  return EXPR_NOT_MATCHED;
+}
+function evalFilterExpression(expr, context) {
   if (findOutsideQuotes(expr, "|") >= 0) {
     const [baseExpr, filters] = parseFilterChain(expr);
     if (filters.length > 0) {
@@ -2007,38 +1982,49 @@ function evalExpr(expr, context) {
       return value;
     }
   }
-  const fnMatch = expr.match(FN_CALL_RE);
-  if (fnMatch) {
-    const fnName = fnMatch[1];
-    const rawArgs = fnMatch[2] || "";
-    if (fnName.includes(".")) {
-      const lastDot = fnName.lastIndexOf(".");
-      const objPath = fnName.slice(0, lastDot);
-      const methodName = fnName.slice(lastDot + 1);
-      const obj = resolveVar(objPath, context);
-      if (obj && typeof obj === "object" && methodName in obj) {
-        const method = obj[methodName];
-        if (typeof method === "function") {
-          if (rawArgs.trim()) {
-            const parts = splitArgs(rawArgs);
-            const evalArgs = parts.map((a) => evalExpr(a.trim(), context));
-            return method.apply(obj, evalArgs);
-          }
-          return method.call(obj);
-        }
-      }
-    } else {
-      const fn = context[fnName] ?? resolveVar(fnName, context);
-      if (typeof fn === "function") {
-        if (rawArgs.trim()) {
-          const parts = splitArgs(rawArgs);
-          const evalArgs = parts.map((a) => evalExpr(a.trim(), context));
-          return fn(...evalArgs);
-        }
-        return fn();
-      }
+  return EXPR_NOT_MATCHED;
+}
+function evaluateCallArgs(rawArgs, context) {
+  return rawArgs.trim() ? splitArgs(rawArgs).map((arg) => evalExpr(arg.trim(), context)) : [];
+}
+function evalDottedFunction(name, rawArgs, context) {
+  const lastDot = name.lastIndexOf(".");
+  const owner = resolveVar(name.slice(0, lastDot), context);
+  const member = name.slice(lastDot + 1);
+  if (!owner || typeof owner !== "object" || !(member in owner)) {
+    return EXPR_NOT_MATCHED;
+  }
+  const method = owner[member];
+  return typeof method === "function" ? method.apply(owner, evaluateCallArgs(rawArgs, context)) : EXPR_NOT_MATCHED;
+}
+function evalFunctionExpression(expr, context) {
+  const match = expr.match(FN_CALL_RE);
+  if (!match) return EXPR_NOT_MATCHED;
+  const name = match[1];
+  const rawArgs = match[2] || "";
+  if (name.includes(".")) return evalDottedFunction(name, rawArgs, context);
+  const fn = context[name] ?? resolveVar(name, context);
+  if (typeof fn === "function") return fn(...evaluateCallArgs(rawArgs, context));
+  return EXPR_NOT_MATCHED;
+}
+function evalExpr(expr, context) {
+  expr = expr.trim();
+  const cachedForm = expressionFormCache.get(expr);
+  if (cachedForm !== void 0) {
+    if (cachedForm === -1) return resolveVar(expr, context);
+    const result = EXPR_EVALUATORS[cachedForm](expr, context);
+    return result === EXPR_NOT_MATCHED ? resolveVar(expr, context) : result;
+  }
+  for (let index = 0; index < EXPR_EVALUATORS.length; index++) {
+    const result = EXPR_EVALUATORS[index](expr, context);
+    if (result !== EXPR_NOT_MATCHED) {
+      capCache(expressionFormCache, MEMO_CACHE_MAX);
+      expressionFormCache.set(expr, index);
+      return result;
     }
   }
+  capCache(expressionFormCache, MEMO_CACHE_MAX);
+  expressionFormCache.set(expr, FN_CALL_RE.test(expr) ? EXPR_EVALUATORS.length - 1 : -1);
   return resolveVar(expr, context);
 }
 function findTernary(expr) {
@@ -2494,7 +2480,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, EXPR_EVALUATORS, expressionFormCache, VarRef, BUILTIN_FILTERS, _formTokenSessionId, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -2596,6 +2582,25 @@ var init_engine = __esm({
     MEMO_CACHE_MAX = 1024;
     TOKEN_RE = /(\{%-?\s*[\s\S]*?\s*-?%\})|(\{\{-?\s*[\s\S]*?\s*-?\}\})|(\{#[\s\S]*?#\})/g;
     RAW_BLOCK_RE = /\{%-?\s*raw\s*-?%\}([\s\S]*?)\{%-?\s*endraw\s*-?%\}/g;
+    EXPR_NOT_MATCHED = Symbol("frond-expression-not-matched");
+    ARITHMETIC_OPERATIONS = {
+      "+": (left, right) => left + right,
+      "-": (left, right) => left - right,
+      "*": (left, right) => left * right,
+      "//": (left, right) => right !== 0 ? Math.floor(left / right) : 0,
+      "/": (left, right) => right !== 0 ? left / right : 0,
+      "%": (left, right) => right !== 0 ? left % right : 0,
+      "**": (left, right) => left ** right
+    };
+    EXPR_EVALUATORS = [
+      evalPrimary,
+      evalConditional,
+      evalConcatOrComparison,
+      evalArithmeticExpression,
+      evalFilterExpression,
+      evalFunctionExpression
+    ];
+    expressionFormCache = /* @__PURE__ */ new Map();
     VarRef = class {
       constructor(name) {
         this.name = name;
@@ -6009,13 +6014,172 @@ var init_databaseUrl = __esm({
   }
 });
 
+// ../orm/src/point.ts
+function formatCoordinate(value) {
+  return Object.is(value, -0) ? "0" : Number(value.toPrecision(15)).toString();
+}
+var DEFAULT_SRID, SpatialNotSupportedError, Point;
+var init_point = __esm({
+  "../orm/src/point.ts"() {
+    "use strict";
+    DEFAULT_SRID = 4326;
+    SpatialNotSupportedError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "SpatialNotSupportedError";
+      }
+    };
+    Point = class _Point {
+      lon;
+      lat;
+      srid;
+      constructor(lon, lat, srid = DEFAULT_SRID) {
+        if (typeof lon === "boolean" || typeof lat === "boolean" || typeof srid === "boolean") {
+          throw new TypeError("Point longitude, latitude and SRID must be numbers");
+        }
+        this.lon = Number(lon);
+        this.lat = Number(lat);
+        this.srid = Number(srid);
+        if (!Number.isFinite(this.lon) || !Number.isFinite(this.lat) || !Number.isInteger(this.srid)) {
+          throw new TypeError("Point longitude and latitude must be finite numbers and SRID must be an integer");
+        }
+        if (this.srid === DEFAULT_SRID) {
+          if (this.lon < -180 || this.lon > 180) throw new RangeError(`Point longitude ${this.lon} is outside -180..180; Tina4 uses longitude, latitude order`);
+          if (this.lat < -90 || this.lat > 90) throw new RangeError(`Point latitude ${this.lat} is outside -90..90; Tina4 uses longitude, latitude order`);
+        }
+        Object.freeze(this);
+      }
+      get wkt() {
+        return `POINT(${formatCoordinate(this.lon)} ${formatCoordinate(this.lat)})`;
+      }
+      get ewkt() {
+        return `SRID=${this.srid};${this.wkt}`;
+      }
+      get geojson() {
+        return { type: "Point", coordinates: [this.lon, this.lat] };
+      }
+      toJSON() {
+        return this.geojson;
+      }
+      toArray() {
+        return [this.lon, this.lat];
+      }
+      static parse(value, srid = DEFAULT_SRID) {
+        if (value instanceof _Point) return value;
+        if (Array.isArray(value)) {
+          if (value.length < 2) throw new TypeError("Point coordinate pair needs longitude and latitude");
+          return new _Point(value[0], value[1], srid);
+        }
+        if (value && typeof value === "object" && !(value instanceof Uint8Array)) {
+          return _Point.fromGeoJson(value, srid);
+        }
+        if (value instanceof Uint8Array) return _Point.fromWkb(value, srid);
+        if (typeof value === "string") {
+          const text = value.trim();
+          const match = /^(?:SRID\s*=\s*(\d+)\s*;\s*)?POINT\s*(?:Z|M|ZM)?\s*\(\s*([-+0-9.eE]+)\s+([-+0-9.eE]+)(?:\s+[-+0-9.eE]+)*\s*\)$/i.exec(text);
+          if (match) return new _Point(match[2], match[3], match[1] ? Number(match[1]) : srid);
+          if (text.length >= 42 && text.length % 2 === 0 && /^[0-9a-f]+$/i.test(text)) {
+            return _Point.fromWkb(Uint8Array.from(Buffer.from(text, "hex")), srid);
+          }
+        }
+        throw new TypeError("Point must be Point, [longitude, latitude], WKT/EWKT, GeoJSON or WKB/EWKB");
+      }
+      static geometryBinding(value, srid = DEFAULT_SRID) {
+        if (value instanceof _Point || Array.isArray(value)) return [_Point.parse(value, srid).ewkt, "ewkt"];
+        if (value && typeof value === "object") {
+          const candidate = value;
+          const geometry = String(candidate.type).toLowerCase() === "feature" ? candidate.geometry : candidate;
+          const allowed = /* @__PURE__ */ new Set(["point", "linestring", "polygon", "multipoint", "multilinestring", "multipolygon", "geometrycollection"]);
+          if (!geometry || !allowed.has(String(geometry.type).toLowerCase())) throw new TypeError("GeoJSON geometry has an unsupported type");
+          return [JSON.stringify(geometry), "geojson"];
+        }
+        if (typeof value === "string" && /^\s*(?:SRID\s*=\s*\d+\s*;\s*)?(?:POINT|LINESTRING|POLYGON|MULTIPOINT|MULTILINESTRING|MULTIPOLYGON|GEOMETRYCOLLECTION)\b/i.test(value)) {
+          return [/^\s*SRID/i.test(value) ? value.trim() : `SRID=${srid};${value.trim()}`, "ewkt"];
+        }
+        throw new TypeError("Geometry must be Point, coordinate pair, WKT/EWKT or GeoJSON");
+      }
+      static fromGeoJson(data, srid) {
+        const geometry = String(data.type).toLowerCase() === "feature" ? data.geometry : data;
+        if (!geometry || String(geometry.type).toLowerCase() !== "point") throw new TypeError("Point GeoJSON type must be Point");
+        const coordinates = geometry.coordinates;
+        if (!Array.isArray(coordinates) || coordinates.length < 2) throw new TypeError("Point GeoJSON coordinates must be [longitude, latitude]");
+        return new _Point(coordinates[0], coordinates[1], srid);
+      }
+      static fromWkb(raw, srid) {
+        if (raw.byteLength < 21) throw new TypeError("Point WKB is too short");
+        const view = new DataView(raw.buffer, raw.byteOffset, raw.byteLength);
+        const little = raw[0] === 1;
+        const typeWord = view.getUint32(1, little);
+        let offset = 5;
+        if ((typeWord & 536870912) !== 0) {
+          srid = view.getUint32(5, little);
+          offset = 9;
+        }
+        const code = (typeWord & ~(536870912 | 1073741824 | 2147483648)) % 1e3;
+        if (code !== 1 || raw.byteLength < offset + 16) throw new TypeError("WKB geometry is not a Point");
+        return new _Point(view.getFloat64(offset, little), view.getFloat64(offset + 8, little), srid);
+      }
+    };
+  }
+});
+
 // ../orm/src/sqlTranslator.ts
 var SQLTranslator, QueryCache;
 var init_sqlTranslator = __esm({
   "../orm/src/sqlTranslator.ts"() {
     "use strict";
     init_databaseUrl();
+    init_point();
     SQLTranslator = class _SQLTranslator {
+      static SPATIAL_ENGINES = /* @__PURE__ */ new Set(["postgres", "postgresql"]);
+      static SPATIAL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/;
+      static requireSpatial(engine, feature) {
+        const name = String(engine || "unknown").toLowerCase();
+        if (!_SQLTranslator.SPATIAL_ENGINES.has(name)) {
+          throw new SpatialNotSupportedError(
+            `${feature} is not supported on the '${name}' database engine. Tina4 GIS support is PostGIS-first: use PostgreSQL with CREATE EXTENSION postgis. Tina4 will not replace a spatial query with an approximate coordinate query.`
+          );
+        }
+        return name;
+      }
+      static spatialIdentifier(name, what = "column") {
+        if (!_SQLTranslator.SPATIAL_IDENTIFIER.test(name)) throw new TypeError(`Spatial ${what} is not a valid SQL identifier: ${name}`);
+        return name;
+      }
+      static pointColumnType(engine, srid = DEFAULT_SRID) {
+        _SQLTranslator.requireSpatial(engine, "PointField");
+        return `geography(Point,${srid})`;
+      }
+      static spatialIndex(engine, table2, column2) {
+        _SQLTranslator.requireSpatial(engine, "spatial index creation");
+        table2 = _SQLTranslator.spatialIdentifier(table2, "table");
+        column2 = _SQLTranslator.spatialIdentifier(column2);
+        return `CREATE INDEX IF NOT EXISTS ${table2.replaceAll(".", "_")}_${column2}_gist ON ${table2} USING GIST (${column2})`;
+      }
+      static pointLiteral(engine, srid = DEFAULT_SRID) {
+        _SQLTranslator.requireSpatial(engine, "spatial predicates");
+        return `ST_SetSRID(ST_MakePoint(?, ?), ${srid})::geography`;
+      }
+      static withinDistance(engine, column2, srid = DEFAULT_SRID) {
+        return `ST_DWithin(${_SQLTranslator.spatialIdentifier(column2)}, ${_SQLTranslator.pointLiteral(engine, srid)}, ?)`;
+      }
+      static distance(engine, column2, srid = DEFAULT_SRID) {
+        return `ST_Distance(${_SQLTranslator.spatialIdentifier(column2)}, ${_SQLTranslator.pointLiteral(engine, srid)})`;
+      }
+      static distanceAs(engine, column2, alias, srid = DEFAULT_SRID) {
+        return `${_SQLTranslator.distance(engine, column2, srid)} AS ${_SQLTranslator.spatialIdentifier(alias, "result alias")}`;
+      }
+      static geometryLiteral(engine, form, srid = DEFAULT_SRID) {
+        _SQLTranslator.requireSpatial(engine, "spatial predicates");
+        return form === "ewkt" ? "ST_GeogFromText(?)" : `ST_SetSRID(ST_GeomFromGeoJSON(?), ${srid})::geography`;
+      }
+      static intersects(engine, column2, form = "ewkt", srid = DEFAULT_SRID) {
+        return `ST_Intersects(${_SQLTranslator.spatialIdentifier(column2)}, ${_SQLTranslator.geometryLiteral(engine, form, srid)})`;
+      }
+      static bbox(engine, column2, srid = DEFAULT_SRID) {
+        _SQLTranslator.requireSpatial(engine, "bbox");
+        return `ST_Intersects(${_SQLTranslator.spatialIdentifier(column2)}, ST_MakeEnvelope(?, ?, ?, ?, ${srid})::geography)`;
+      }
       /**
        * Convert LIMIT/OFFSET to Firebird ROWS...TO syntax.
        *
@@ -7669,6 +7833,8 @@ function fieldTypeToPostgres(def) {
       return "TEXT";
     case "json":
       return "JSONB";
+    case "point":
+      return SQLTranslator.pointColumnType("postgres", def.srid ?? 4326);
     case "string":
       return def.maxLength ? `VARCHAR(${def.maxLength})` : "VARCHAR(255)";
     default:
@@ -13292,10 +13458,13 @@ var init_queryBuilder = __esm({
     "use strict";
     init_database();
     init_databaseResult();
+    init_point();
+    init_sqlTranslator();
     QueryBuilder = class _QueryBuilder {
       table;
       db;
       columns = ["*"];
+      selectParams = [];
       wheres = [];
       params = [];
       joinClauses = [];
@@ -13303,14 +13472,17 @@ var init_queryBuilder = __esm({
       havings = [];
       havingParams = [];
       orderByCols = [];
+      orderByParams = [];
+      primaryKey;
       limitVal;
       offsetVal;
       /**
        * Private constructor — use static factory methods.
        */
-      constructor(table2, db) {
+      constructor(table2, db, primaryKey) {
         this.table = table2;
         this.db = db;
+        this.primaryKey = primaryKey;
       }
       /**
        * Create a QueryBuilder for a table.
@@ -13319,8 +13491,8 @@ var init_queryBuilder = __esm({
        * @param db - Optional database adapter.
        * @returns A new QueryBuilder instance.
        */
-      static fromTable(tableName, db) {
-        return new _QueryBuilder(tableName, db);
+      static fromTable(tableName, db, primaryKey) {
+        return new _QueryBuilder(tableName, db, primaryKey);
       }
       /**
        * Set the columns to select.
@@ -13331,6 +13503,7 @@ var init_queryBuilder = __esm({
       select(...cols) {
         if (cols.length > 0) {
           this.columns = cols;
+          this.selectParams = [];
         }
         return this;
       }
@@ -13412,6 +13585,41 @@ var init_queryBuilder = __esm({
         this.orderByCols.push(expression);
         return this;
       }
+      withinDistance(column2, pointValue, radiusMetres, srid = DEFAULT_SRID) {
+        const radius = Number(radiusMetres);
+        if (!Number.isFinite(radius) || radius < 0) throw new RangeError("Spatial radius must be finite and greater than or equal to zero");
+        const point = Point.parse(pointValue, srid);
+        return this.where(SQLTranslator.withinDistance(this.engine(), column2, point.srid), [point.lon, point.lat, radius]);
+      }
+      intersects(column2, geometry, srid = DEFAULT_SRID) {
+        const [bound, form] = Point.geometryBinding(geometry, srid);
+        return this.where(SQLTranslator.intersects(this.engine(), column2, form, srid), [bound]);
+      }
+      bbox(column2, minLon, minLat, maxLon, maxLat, srid = DEFAULT_SRID) {
+        const values = [minLon, minLat, maxLon, maxLat].map(Number);
+        if (!values.every(Number.isFinite)) throw new TypeError("Bounding-box coordinates must be finite numbers");
+        const [west, south, east, north] = values;
+        new Point(west, south, srid);
+        new Point(east, north, srid);
+        if (west > east || south > north) throw new RangeError("Bounding box must be ordered west, south, east, north");
+        return this.where(SQLTranslator.bbox(this.engine(), column2, srid), values);
+      }
+      selectDistance(column2, pointValue, alias = "distance", srid = DEFAULT_SRID) {
+        const point = Point.parse(pointValue, srid);
+        this.columns.push(SQLTranslator.distanceAs(this.engine(), column2, alias, point.srid));
+        this.selectParams.push(point.lon, point.lat);
+        return this;
+      }
+      orderByDistance(column2, pointValue, direction = "ASC", srid = DEFAULT_SRID) {
+        const order = direction.toUpperCase();
+        if (order !== "ASC" && order !== "DESC") throw new TypeError("Distance order direction must be ASC or DESC");
+        if (!this.primaryKey) throw new Error("Stable spatial ordering needs a primary key; use BaseModel.query() or pass one to fromTable()");
+        const point = Point.parse(pointValue, srid);
+        this.orderByCols.push(`${SQLTranslator.distance(this.engine(), column2, point.srid)} ${order}`);
+        this.orderByParams.push(point.lon, point.lat);
+        this.orderByCols.push(`${SQLTranslator.spatialIdentifier(this.primaryKey, "primary key")} ASC`);
+        return this;
+      }
       /**
        * Set LIMIT and optional OFFSET.
        *
@@ -13477,7 +13685,7 @@ var init_queryBuilder = __esm({
       async get() {
         this.ensureDb();
         const sql = this.toSql();
-        const allParams = [...this.params, ...this.havingParams];
+        const allParams = [...this.selectParams, ...this.params, ...this.havingParams, ...this.orderByParams];
         const queryParams = allParams.length > 0 ? allParams : void 0;
         const rows = await adapterFetch(
           this.db,
@@ -13505,7 +13713,7 @@ var init_queryBuilder = __esm({
       async first() {
         this.ensureDb();
         const sql = this.toSql();
-        const allParams = [...this.params, ...this.havingParams];
+        const allParams = [...this.selectParams, ...this.params, ...this.havingParams, ...this.orderByParams];
         return adapterFetchOne(
           this.db,
           sql,
@@ -13520,9 +13728,18 @@ var init_queryBuilder = __esm({
       async count() {
         this.ensureDb();
         const original = this.columns;
+        const originalSelectParams = this.selectParams;
+        const originalOrder = this.orderByCols;
+        const originalOrderParams = this.orderByParams;
         this.columns = ["COUNT(*) as cnt"];
+        this.selectParams = [];
+        this.orderByCols = [];
+        this.orderByParams = [];
         const sql = this.toSql();
         this.columns = original;
+        this.selectParams = originalSelectParams;
+        this.orderByCols = originalOrder;
+        this.orderByParams = originalOrderParams;
         const allParams = [...this.params, ...this.havingParams];
         const row = await adapterFetchOne(
           this.db,
@@ -13707,6 +13924,10 @@ var init_queryBuilder = __esm({
           }
         }
       }
+      engine() {
+        this.ensureDb();
+        return this.db.getDatabaseType();
+      }
     };
   }
 });
@@ -13730,6 +13951,11 @@ function toDbFieldValue(def, value) {
   if (def?.type === "json" && value !== null && value !== void 0 && typeof value !== "string") {
     return JSON.stringify(value);
   }
+  if (def?.type === "point" && value !== null && value !== void 0) {
+    const point = Point.parse(value, def.srid ?? DEFAULT_SRID);
+    if (point.srid !== (def.srid ?? DEFAULT_SRID)) throw new TypeError(`Point field expects SRID ${def.srid ?? DEFAULT_SRID}; received ${point.srid}`);
+    return point.ewkt;
+  }
   return value;
 }
 function fromDbFieldValue(def, value) {
@@ -13740,6 +13966,11 @@ function fromDbFieldValue(def, value) {
       return value;
     }
   }
+  if (def?.type === "point" && value !== null && value !== void 0) {
+    const point = Point.parse(value, def.srid ?? DEFAULT_SRID);
+    if (point.srid !== (def.srid ?? DEFAULT_SRID)) throw new TypeError(`Point field expects SRID ${def.srid ?? DEFAULT_SRID}; received ${point.srid}`);
+    return point;
+  }
   return value;
 }
 function _pluralRelKeys() {
@@ -13775,6 +14006,7 @@ var init_baseModel = __esm({
     init_sqlite();
     init_sqlTranslator();
     init_index();
+    init_point();
     _fkRegistry = /* @__PURE__ */ new Map();
     EAGER_IN_CHUNK = 500;
     modelQueryCache = new QueryCache({ defaultTtl: 0, maxSize: 500 });
@@ -13830,7 +14062,9 @@ var init_baseModel = __esm({
         for (const [name, def] of Object.entries(fields0)) {
           if (def.default === void 0) continue;
           let dv = typeof def.default === "function" ? def.default() : def.default;
-          if (dv !== null && typeof dv === "object") dv = structuredClone(dv);
+          if (def.type === "point" && dv !== null && dv !== void 0) {
+            dv = fromDbFieldValue(def, dv);
+          } else if (dv !== null && typeof dv === "object") dv = structuredClone(dv);
           this[name] = dv;
         }
         if (data) {
@@ -13932,7 +14166,7 @@ var init_baseModel = __esm({
        * @returns A QueryBuilder instance bound to this model's table and database.
        */
       static query() {
-        return QueryBuilder.fromTable(this.tableName, this.getDb());
+        return QueryBuilder.fromTable(this.tableName, this.getDb(), this.getPkColumn());
       }
       /**
        * Get the database adapter for this model.
@@ -14385,7 +14619,7 @@ var init_baseModel = __esm({
         for (const key of Object.keys(ModelClass.fields)) {
           if (this[key] !== void 0) {
             const outKey = case_ === "snake" ? ModelClass.fieldMapping[key] ?? key : key;
-            result[outKey] = this[key];
+            result[outKey] = this[key] instanceof Point ? this[key].geojson : this[key];
           }
         }
         if (ModelClass.softDelete && this.is_deleted !== void 0) {
@@ -14445,6 +14679,19 @@ var init_baseModel = __esm({
         }
         return result;
       }
+      toFeature(geometryField, include) {
+        const ModelClass = this.constructor;
+        const pointFields = Object.entries(ModelClass.fields).filter(([, def]) => def.type === "point").map(([name]) => name);
+        const field = geometryField ?? pointFields[0];
+        if (!field || !pointFields.includes(field)) throw new Error("toFeature() needs a declared point field");
+        const properties = this.toDict(include, "camel");
+        const geometry = properties[field] ?? null;
+        delete properties[field];
+        return { type: "Feature", geometry, properties };
+      }
+      static featureCollection(models, geometryField, include) {
+        return { type: "FeatureCollection", features: models.map((model) => model.toFeature(geometryField, include)) };
+      }
       /**
        * Convert to an associative object (alias for toDict).
        */
@@ -14495,7 +14742,10 @@ var init_baseModel = __esm({
        */
       static async createTable() {
         const db = this.getDb();
-        if (await adapterTableExists(db, this.tableName)) return true;
+        const pointFields = Object.entries(this.fields).filter(([, def]) => def.type === "point");
+        const engine = db.getDatabaseType();
+        if (pointFields.length > 0) SQLTranslator.requireSpatial(engine, "PointField");
+        if (await adapterTableExists(db, this.tableName)) return this.createSpatialIndexes(db, pointFields);
         if (typeof db.createTable === "function" || typeof db.createTableAsync === "function") {
           const mappedFields = {};
           for (const [fieldName, def] of Object.entries(this.fields)) {
@@ -14511,7 +14761,7 @@ var init_baseModel = __esm({
             mappedFields["is_deleted"] = { type: "integer", default: 0 };
           }
           await adapterCreateTable(db, this.tableName, mappedFields);
-          return true;
+          return this.createSpatialIndexes(db, pointFields);
         }
         const typeMap = {
           integer: "INTEGER",
@@ -14558,6 +14808,14 @@ var init_baseModel = __esm({
         }
         return true;
       }
+      static async createSpatialIndexes(db, fields) {
+        for (const [fieldName, def] of fields) {
+          SQLTranslator.pointColumnType(db.getDatabaseType(), def.srid ?? DEFAULT_SRID);
+          if (def.spatialIndex === false) continue;
+          await adapterExecute(db, SQLTranslator.spatialIndex(db.getDatabaseType(), this.tableName, this.getDbColumn(fieldName)));
+        }
+        return true;
+      }
       /**
        * Find a record by primary key or throw an error if not found.
        */
@@ -17205,6 +17463,7 @@ __export(src_exports, {
   CachedDatabaseAdapter: () => CachedDatabaseAdapter,
   Cursor: () => Cursor,
   DEFAULT_DATABASE_CONNECT_TIMEOUT_SECONDS: () => DEFAULT_DATABASE_CONNECT_TIMEOUT_SECONDS,
+  DEFAULT_SRID: () => DEFAULT_SRID,
   Database: () => Database,
   DatabaseResult: () => DatabaseResult,
   DatabaseUrl: () => DatabaseUrl,
@@ -17220,6 +17479,7 @@ __export(src_exports, {
   NOT_REQUIRED_ON_ADAPTER: () => NOT_REQUIRED_ON_ADAPTER,
   ObjectId: () => ObjectId,
   OdbcAdapter: () => OdbcAdapter,
+  Point: () => Point,
   PostgresAdapter: () => PostgresAdapter,
   QueryBuilder: () => QueryBuilder,
   QueryCache: () => QueryCache,
@@ -17232,6 +17492,7 @@ __export(src_exports, {
   S3Storage: () => S3Storage,
   SQLTranslator: () => SQLTranslator,
   SQLiteAdapter: () => SQLiteAdapter,
+  SpatialNotSupportedError: () => SpatialNotSupportedError,
   SqliteCollection: () => SqliteCollection,
   SqliteDatabase: () => SqliteDatabase,
   adapterColumns: () => adapterColumns,
@@ -17326,6 +17587,7 @@ var init_src = __esm({
     init_baseModel();
     init_queryBuilder();
     init_sqlTranslator();
+    init_point();
     init_connectTimeout();
     init_cachedDatabase();
     init_fakeData2();
@@ -19515,6 +19777,12 @@ function enforceRouteAuth(req2, res, match, isDevAdmin) {
     }
   }
   if (!resolvedToken) {
+    const sso = req2.session?.get?.("_tina4_sso");
+    const identity = sso?.identity;
+    if (identity?.issuer && identity?.subject) {
+      req2.user = identity;
+      return false;
+    }
     const sessionToken = req2.session?.get?.("token");
     if (sessionToken && validToken(sessionToken)) {
       resolvedToken = sessionToken;
@@ -22979,7 +23247,7 @@ var init_metrics = __esm({
     };
     INSTALL_HINT = "update the native tina4 CLI: https://tina4.com/cli";
     SUMMARY_KEYS = ["files_analyzed", "total_functions", "avg_complexity", "avg_maintainability"];
-    FILE_KEYS = ["path", "loc", "avg_complexity", "maintainability", "has_tests"];
+    FILE_KEYS = ["path", "loc", "avg_complexity", "maintainability", "has_referencing_test"];
     FUNCTION_KEYS = ["name", "file", "line", "complexity", "loc"];
   }
 });
@@ -34066,6 +34334,14 @@ function resolveSecuritySchemes() {
     const apiKeyIn = ["header", "query", "cookie"].includes(rawIn) ? rawIn : "header";
     schemes.apiKeyAuth = { type: "apiKey", name: apiKeyName, in: apiKeyIn };
   }
+  const ssoIssuer = (process.env.TINA4_SSO_ISSUER ?? "").replace(/\/$/, "");
+  if (ssoIssuer) {
+    schemes.oidc = {
+      type: "openIdConnect",
+      openIdConnectUrl: `${ssoIssuer}/.well-known/openid-configuration`
+    };
+    schemes.ssoSession = { type: "apiKey", in: "cookie", name: "tina4_session" };
+  }
   for (const [name, def] of Object.entries(registeredSchemes)) {
     schemes[name] = def;
   }
@@ -34247,7 +34523,9 @@ function generate(routes, models = []) {
         if (!responses["401"]) responses["401"] = { description: "Unauthorized" };
       }
     } else if (routeRequiresAuth(route, method)) {
-      operation.security = sanitizeSecurity([{ [defaultScheme]: [] }], schemes);
+      const requirements = [{ [defaultScheme]: [] }];
+      if (defaultScheme === "bearerAuth" && schemes.ssoSession) requirements.push({ ssoSession: [] });
+      operation.security = sanitizeSecurity(requirements, schemes);
       const responses = operation.responses;
       if (!responses["401"]) responses["401"] = { description: "Unauthorized" };
     }
@@ -34561,6 +34839,298 @@ var init_src2 = __esm({
   }
 });
 
+// src/sso.ts
+var sso_exports = {};
+__export(sso_exports, {
+  SSO: () => Sso,
+  Sso: () => Sso,
+  SsoError: () => SsoError
+});
+import { createHash as createHash9, randomBytes as randomBytes7, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+var SsoError, Sso;
+var init_sso = __esm({
+  "src/sso.ts"() {
+    "use strict";
+    SsoError = class extends Error {
+    };
+    Sso = class _Sso {
+      static PENDING_KEY = "_tina4_sso_pending";
+      static SESSION_KEY = "_tina4_sso";
+      issuer;
+      clientId;
+      clientSecret;
+      redirectUri;
+      scopes;
+      verify;
+      postLogoutRedirectUri;
+      claimMap;
+      timeout;
+      metadata = {};
+      static mountedRouters = /* @__PURE__ */ new WeakSet();
+      constructor(options = {}) {
+        this.issuer = (options.issuer ?? process.env.TINA4_SSO_ISSUER ?? "").replace(/\/$/, "");
+        this.clientId = options.clientId ?? process.env.TINA4_SSO_CLIENT_ID ?? "";
+        this.clientSecret = options.clientSecret ?? process.env.TINA4_SSO_CLIENT_SECRET;
+        this.redirectUri = options.redirectUri ?? process.env.TINA4_SSO_REDIRECT_URI ?? "";
+        this.scopes = options.scopes ?? this.jsonEnv("TINA4_SSO_SCOPES", ["openid", "profile", "email"]);
+        this.verify = options.verify ?? process.env.TINA4_SSO_VERIFY ?? "introspection";
+        this.postLogoutRedirectUri = options.postLogoutRedirectUri ?? process.env.TINA4_SSO_POST_LOGOUT_REDIRECT_URI;
+        this.claimMap = options.claimMap ?? this.jsonEnv("TINA4_SSO_CLAIM_MAP", {});
+        this.timeout = options.timeout ?? 1e4;
+        this.validateConfig();
+      }
+      static async fromIssuer(options = {}) {
+        const value = new _Sso(options);
+        await value.discover();
+        return value;
+      }
+      static configured() {
+        return ["TINA4_SSO_ISSUER", "TINA4_SSO_CLIENT_ID", "TINA4_SSO_REDIRECT_URI"].every((key) => Boolean(process.env[key]));
+      }
+      jsonEnv(name, fallback) {
+        const raw = process.env[name];
+        if (!raw) return fallback;
+        try {
+          return JSON.parse(raw);
+        } catch {
+          throw new SsoError(`${name} must be valid JSON`);
+        }
+      }
+      static secureUrl(value, name) {
+        let url;
+        try {
+          url = new URL(value);
+        } catch {
+          throw new SsoError(`${name} must be an absolute URL`);
+        }
+        const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+        if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+          throw new SsoError(`${name} must use HTTPS except on loopback`);
+        }
+      }
+      validateConfig() {
+        if (!this.issuer || !this.clientId || !this.redirectUri) {
+          throw new SsoError("TINA4_SSO_ISSUER, TINA4_SSO_CLIENT_ID and TINA4_SSO_REDIRECT_URI are required");
+        }
+        _Sso.secureUrl(this.issuer, "issuer");
+        _Sso.secureUrl(this.redirectUri, "redirect URI");
+        if (!["introspection", "jwks"].includes(this.verify)) throw new SsoError("TINA4_SSO_VERIFY must be introspection or jwks");
+        if (this.verify === "jwks") throw new SsoError("jwks verification requires an installed cryptography capability");
+        if (this.verify === "introspection" && !this.clientSecret) throw new SsoError("introspection verification requires TINA4_SSO_CLIENT_SECRET");
+        if (!Array.isArray(this.scopes) || !this.scopes.includes("openid")) throw new SsoError("TINA4_SSO_SCOPES must be a list containing openid");
+      }
+      async requestJson(url, form, bearer, basic = false) {
+        const headers = { Accept: "application/json" };
+        let body;
+        if (form) {
+          const parameters = new URLSearchParams();
+          for (const [key, value] of Object.entries(form)) parameters.set(key, String(value));
+          body = parameters.toString();
+          headers["Content-Type"] = "application/x-www-form-urlencoded";
+        }
+        if (bearer) headers.Authorization = `Bearer ${bearer}`;
+        if (basic) headers.Authorization = `Basic ${Buffer.from(`${this.clientId}:${this.clientSecret}`).toString("base64")}`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeout);
+        try {
+          const response = await fetch(url, { method: form ? "POST" : "GET", headers, body, signal: controller.signal });
+          if (!response.ok) throw new SsoError("OIDC provider request failed");
+          const result = await response.json();
+          if (!result || typeof result !== "object" || Array.isArray(result)) throw new SsoError("OIDC provider returned a non-object response");
+          return result;
+        } catch (error) {
+          if (error instanceof SsoError) throw error;
+          throw new SsoError("OIDC provider request failed");
+        } finally {
+          clearTimeout(timer);
+        }
+      }
+      async discover(force = false) {
+        if (Object.keys(this.metadata).length && !force) return { ...this.metadata };
+        const result = await this.requestJson(`${this.issuer}/.well-known/openid-configuration`);
+        if (result.issuer !== this.issuer) throw new SsoError("OIDC discovery issuer does not exactly match configuration");
+        const required = ["authorization_endpoint", "token_endpoint"];
+        if (this.verify === "introspection") required.push("introspection_endpoint");
+        for (const key of required) {
+          if (!result[key]) throw new SsoError(`OIDC discovery is missing ${key}`);
+          _Sso.secureUrl(result[key], key);
+        }
+        this.metadata = result;
+        return { ...result };
+      }
+      static safeReturn(value) {
+        if (!value || !value.startsWith("/") || value.startsWith("//") || value.includes("\\")) return "/";
+        return [...value].some((char) => char.charCodeAt(0) < 32) ? "/" : value;
+      }
+      session(value) {
+        return value?.session ?? value;
+      }
+      async login(requestOrSession, returnTo = "/") {
+        const session = this.session(requestOrSession);
+        if (!session) throw new SsoError("SSO login requires a Tina4 Session");
+        const state = randomBytes7(32).toString("base64url");
+        const nonce = randomBytes7(32).toString("base64url");
+        const verifier = randomBytes7(64).toString("base64url");
+        const challenge = createHash9("sha256").update(verifier).digest("base64url");
+        session.set(_Sso.PENDING_KEY, { state, nonce, verifier, return_to: _Sso.safeReturn(returnTo), created_at: Math.floor(Date.now() / 1e3) });
+        const metadata = await this.discover();
+        const query = new URLSearchParams({
+          client_id: this.clientId,
+          redirect_uri: this.redirectUri,
+          response_type: "code",
+          scope: this.scopes.join(" "),
+          state,
+          nonce,
+          code_challenge: challenge,
+          code_challenge_method: "S256"
+        });
+        return `${metadata.authorization_endpoint}?${query}`;
+      }
+      static equal(left, right) {
+        const a = Buffer.from(String(left ?? ""));
+        const b = Buffer.from(String(right ?? ""));
+        return a.length === b.length && timingSafeEqual3(a, b);
+      }
+      static jwtPayload(token) {
+        try {
+          return JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString());
+        } catch {
+          throw new SsoError("provider returned an invalid ID token");
+        }
+      }
+      async introspect(accessToken) {
+        const metadata = await this.discover();
+        const result = await this.requestJson(metadata.introspection_endpoint, { token: accessToken, token_type_hint: "access_token" }, void 0, true);
+        if (result.active !== true || result.iss !== this.issuer) throw new SsoError("OIDC access token is inactive or has the wrong issuer");
+        const audience = result.aud ?? result.client_id;
+        const valid = (Array.isArray(audience) ? audience.includes(this.clientId) : audience === this.clientId) || result.client_id === this.clientId;
+        if (!valid) throw new SsoError("OIDC token audience mismatch");
+        return result;
+      }
+      claim(claims, configured, fallback) {
+        let value = claims;
+        for (const part of (configured ?? fallback).split(".")) value = value && typeof value === "object" ? value[part] : void 0;
+        return value;
+      }
+      normalize(claims) {
+        const subject = this.claim(claims, this.claimMap.subject, "sub");
+        const issuer = this.claim(claims, this.claimMap.issuer, "iss") ?? this.issuer;
+        if (!subject || issuer !== this.issuer) throw new SsoError("OIDC identity is missing a valid issuer or subject");
+        const roles = [...this.claim(claims, this.claimMap.roles, "realm_access.roles") ?? [], ...claims.resource_access?.[this.clientId]?.roles ?? []];
+        const groups = this.claim(claims, this.claimMap.groups, "groups") ?? [];
+        return {
+          issuer,
+          subject,
+          username: this.claim(claims, this.claimMap.username, "preferred_username") ?? null,
+          email: this.claim(claims, this.claimMap.email, "email") ?? null,
+          name: this.claim(claims, this.claimMap.name, "name") ?? null,
+          roles: [...new Set(roles.map(String))].sort(),
+          groups: [...new Set(groups.map(String))].sort()
+        };
+      }
+      async callback(requestOrSession, query) {
+        const session = this.session(requestOrSession);
+        const values = query ?? requestOrSession?.query ?? {};
+        const pending = session?.get(_Sso.PENDING_KEY);
+        session?.delete(_Sso.PENDING_KEY);
+        if (!pending || !values.code || !_Sso.equal(values.state, pending.state)) throw new SsoError("OIDC callback state is invalid or already consumed");
+        if (Math.floor(Date.now() / 1e3) - Number(pending.created_at ?? 0) > 600) throw new SsoError("OIDC callback state has expired");
+        const metadata = await this.discover();
+        const tokens = await this.requestJson(metadata.token_endpoint, {
+          grant_type: "authorization_code",
+          code: values.code,
+          redirect_uri: this.redirectUri,
+          client_id: this.clientId,
+          code_verifier: pending.verifier
+        }, void 0, Boolean(this.clientSecret));
+        if (!tokens.access_token || !tokens.id_token) throw new SsoError("OIDC token response is incomplete");
+        if (this.verify === "jwks") throw new SsoError("JWKS verification requires an installed cryptography capability");
+        const claims = await this.introspect(tokens.access_token);
+        if (!_Sso.equal(_Sso.jwtPayload(tokens.id_token).nonce, pending.nonce)) throw new SsoError("OIDC ID token nonce mismatch");
+        if (metadata.userinfo_endpoint) Object.assign(claims, await this.requestJson(metadata.userinfo_endpoint, void 0, tokens.access_token));
+        const identity = this.normalize(claims);
+        session.regenerate();
+        session.set(_Sso.SESSION_KEY, {
+          version: 1,
+          identity,
+          access_token: tokens.access_token,
+          refresh_token: tokens.refresh_token,
+          id_token: tokens.id_token,
+          expires_at: Math.floor(Date.now() / 1e3) + Number(tokens.expires_in ?? 0)
+        });
+        return { identity, return_to: _Sso.safeReturn(pending.return_to) };
+      }
+      identity(requestOrSession) {
+        const stored = this.session(requestOrSession)?.get(_Sso.SESSION_KEY);
+        const identity = stored?.identity ?? null;
+        if (identity && requestOrSession?.session) requestOrSession.user = identity;
+        return identity;
+      }
+      async refresh(requestOrSession) {
+        const session = this.session(requestOrSession);
+        const stored = session?.get(_Sso.SESSION_KEY);
+        if (!stored?.refresh_token) {
+          session?.delete(_Sso.SESSION_KEY);
+          throw new SsoError("OIDC session cannot be refreshed");
+        }
+        try {
+          const metadata = await this.discover();
+          const tokens = await this.requestJson(metadata.token_endpoint, {
+            grant_type: "refresh_token",
+            refresh_token: stored.refresh_token,
+            client_id: this.clientId
+          }, void 0, Boolean(this.clientSecret));
+          const claims = await this.introspect(tokens.access_token);
+          if (metadata.userinfo_endpoint) Object.assign(claims, await this.requestJson(metadata.userinfo_endpoint, void 0, tokens.access_token));
+          const identity = this.normalize(claims);
+          session.set(_Sso.SESSION_KEY, {
+            ...stored,
+            identity,
+            access_token: tokens.access_token,
+            refresh_token: tokens.refresh_token ?? stored.refresh_token,
+            id_token: tokens.id_token ?? stored.id_token,
+            expires_at: Math.floor(Date.now() / 1e3) + Number(tokens.expires_in ?? 0)
+          });
+          return identity;
+        } catch (error) {
+          session?.delete(_Sso.SESSION_KEY);
+          throw error;
+        }
+      }
+      async logout(requestOrSession, returnTo = "/") {
+        const session = this.session(requestOrSession);
+        const stored = session?.get(_Sso.SESSION_KEY);
+        session?.destroy();
+        const endpoint = (await this.discover()).end_session_endpoint;
+        const target = this.postLogoutRedirectUri ?? _Sso.safeReturn(returnTo);
+        if (!endpoint) return target;
+        const params = new URLSearchParams({ post_logout_redirect_uri: target, client_id: this.clientId });
+        if (stored?.id_token) params.set("id_token_hint", stored.id_token);
+        return `${endpoint}?${params}`;
+      }
+      static async mountConfigured(router) {
+        if (_Sso.mountedRouters.has(router) || !_Sso.configured()) return false;
+        const owned = /* @__PURE__ */ new Set(["GET /auth/login", "GET /auth/callback", "POST /auth/logout"]);
+        const collisions = router.getRoutes().map((route) => `${route.method} ${route.pattern}`).filter((route) => owned.has(route));
+        if (collisions.length) throw new SsoError(`SSO route collision: ${collisions.join(", ")}`);
+        const sso = await _Sso.fromIssuer();
+        router.get("/auth/login", async (req2, res) => res.redirect(await sso.login(req2, req2.query?.return_to ?? "/")));
+        router.get("/auth/callback", async (req2, res) => {
+          try {
+            return res.redirect((await sso.callback(req2)).return_to);
+          } catch (error) {
+            const message = error instanceof SsoError ? error.message : "OIDC callback failed";
+            return res.error("SSO_CALLBACK_FAILED", message, 400);
+          }
+        });
+        router.post("/auth/logout", async (req2, res) => res.redirect(await sso.logout(req2, req2.query?.return_to ?? "/")));
+        _Sso.mountedRouters.add(router);
+        return true;
+      }
+    };
+  }
+});
+
 // src/docsAutoDiscovery.ts
 var docsAutoDiscovery_exports = {};
 __export(docsAutoDiscovery_exports, {
@@ -34630,7 +35200,7 @@ var init_docsAutoDiscovery = __esm({
 
 // src/server.ts
 import { createServer as createServer2 } from "node:http";
-import { randomBytes as randomBytes7 } from "node:crypto";
+import { randomBytes as randomBytes8 } from "node:crypto";
 import { resolve as resolve18, dirname as dirname13, join as join29, relative as relative8 } from "node:path";
 import { existsSync as existsSync24, readdirSync as readdirSync17, readFileSync as readFileSync23, statSync as statSync17 } from "node:fs";
 import { isatty } from "node:tty";
@@ -35270,7 +35840,7 @@ async function renderDispatchError(err, req2, res, templatesDir) {
       }
     }
   }
-  const requestId = Log.getRequestId() ?? randomBytes7(4).toString("hex");
+  const requestId = Log.getRequestId() ?? randomBytes8(4).toString("hex");
   if (wantsJson(req2)) {
     const body = negotiatedErrorBody(500, "Internal Server Error", requestId);
     res.raw.writeHead(500, { "Content-Type": "application/json" });
@@ -35341,7 +35911,7 @@ function serveStaticAsset(ctx) {
   return false;
 }
 async function serveNotFound(ctx) {
-  const requestId = Log.getRequestId() ?? randomBytes7(4).toString("hex");
+  const requestId = Log.getRequestId() ?? randomBytes8(4).toString("hex");
   if (wantsJson(ctx.req)) {
     const body = negotiatedErrorBody(404, "Not Found", requestId);
     ctx.res.raw.writeHead(404, httpReason(404), { "Content-Type": "application/json" });
@@ -35461,7 +36031,7 @@ async function dispatchInner(ctx, rawReq, rawRes, requestId) {
   }
 }
 async function runDispatch(ctx, rawReq, rawRes) {
-  const requestId = Log.sanitizeRequestId(rawReq.headers["x-request-id"]) ?? randomBytes7(4).toString("hex");
+  const requestId = Log.sanitizeRequestId(rawReq.headers["x-request-id"]) ?? randomBytes8(4).toString("hex");
   if (!rawRes.headersSent) rawRes.setHeader("x-request-id", requestId);
   return Log.runWithRequestId(requestId, () => dispatchInner(ctx, rawReq, rawRes, requestId));
 }
@@ -35595,6 +36165,8 @@ ${reset2}
     console.log(`
   No routes directory found at ${routesDir}`);
   }
+  const { Sso: Sso2 } = await Promise.resolve().then(() => (init_sso(), sso_exports));
+  await Sso2.mountConfigured(router);
   if (attachCsrfFromEnv()) {
     console.log(`
   \x1B[36mCSRF\x1B[0m protection enabled (TINA4_CSRF)`);
@@ -36119,7 +36691,7 @@ var init_mqttMessage = __esm({
 // src/mqtt.ts
 import net2 from "node:net";
 import tls from "node:tls";
-import { randomBytes as randomBytes8 } from "node:crypto";
+import { randomBytes as randomBytes9 } from "node:crypto";
 import { existsSync as existsSync25, readFileSync as readFileSync24 } from "node:fs";
 var MqttError, MqttTimeoutError, CONNECT, CONNACK, PUBLISH, PUBACK, SUBSCRIBE, SUBACK, PINGREQ, PINGRESP, DISCONNECT, PROTOCOL_LEVEL, DEFAULT_PORT, DEFAULT_TLS_PORT, DEFAULT_URL, DEFAULT_KEEPALIVE, SUBSCRIPTION_REFUSED, MAX_REMAINING_LENGTH, QOS2_REFUSED_MESSAGE, CONNACK_RETURN_CODES, Mqtt;
 var init_mqtt = __esm({
@@ -36207,7 +36779,7 @@ var init_mqtt = __esm({
         this.caFile = options.caFile ?? (Env.str("TINA4_MQTT_CA_FILE") || null);
         this.tlsVerify = options.tlsVerify ?? Env.bool("TINA4_MQTT_TLS_VERIFY", true);
         let cid = options.clientId ?? (Env.str("TINA4_MQTT_CLIENT_ID") || null);
-        if (cid === null || cid === "") cid = "tina4-" + randomBytes8(8).toString("hex");
+        if (cid === null || cid === "") cid = "tina4-" + randomBytes9(8).toString("hex");
         this.clientId = cid;
         this.keepalive = options.keepalive ?? Env.int("TINA4_MQTT_KEEPALIVE", DEFAULT_KEEPALIVE);
         this.cleanSession = options.cleanSession ?? true;
@@ -37137,7 +37709,7 @@ var init_service = __esm({
 import http from "node:http";
 import https from "node:https";
 import { URL as URL2 } from "node:url";
-import { randomBytes as randomBytes9 } from "node:crypto";
+import { randomBytes as randomBytes10 } from "node:crypto";
 import { promises as fsp, createWriteStream } from "node:fs";
 import { basename as basename5 } from "node:path";
 import { pipeline } from "node:stream/promises";
@@ -37435,7 +38007,7 @@ var init_api = __esm({
           return { http_code: null, body: null, headers: {}, error: "upload requires filePath or fileBytes" };
         }
         const partContentType = guessContentType(uploadName);
-        const boundary = "----Tina4Boundary" + randomBytes9(16).toString("hex");
+        const boundary = "----Tina4Boundary" + randomBytes10(16).toString("hex");
         const bodyBuffer = buildMultipartBody(boundary, fieldName, uploadName, content, partContentType, extraFields);
         const contentType = `multipart/form-data; boundary=${boundary}`;
         return this.execute("POST", this.buildUrl(path8), bodyBuffer, contentType, headers);
@@ -42267,10 +42839,13 @@ __export(index_exports, {
   RouteGroup: () => RouteGroup,
   RouteRef: () => RouteRef,
   Router: () => Router,
+  SSO: () => Sso,
   SafeString: () => SafeString2,
   SecurityHeadersMiddleware: () => SecurityHeadersMiddleware,
   ServiceRunner: () => ServiceRunner,
   Session: () => Session,
+  Sso: () => Sso,
+  SsoError: () => SsoError,
   TAKEOVER_KILLED: () => TAKEOVER_KILLED,
   TAKEOVER_NOTHING: () => TAKEOVER_NOTHING,
   TAKEOVER_REFUSALS: () => TAKEOVER_REFUSALS,
@@ -42506,6 +43081,7 @@ var init_index = __esm({
     init_htmlElement();
     init_errorOverlay();
     init_ai();
+    init_sso();
     init_aiClient();
     init_liteBackend();
     init_rabbitmqBackend();
@@ -42629,10 +43205,13 @@ export {
   RouteGroup,
   RouteRef,
   Router,
+  Sso as SSO,
   SafeString2 as SafeString,
   SecurityHeadersMiddleware,
   ServiceRunner,
   Session,
+  Sso,
+  SsoError,
   TAKEOVER_KILLED,
   TAKEOVER_NOTHING,
   TAKEOVER_REFUSALS,