tina4-nodejs 3.13.120 → 3.13.122

package/packages/orm/dist/index.js

@@ -3150,15 +3150,15 @@ function findOutsideQuotes(expr, needle) {
   }
   return -1;
 }
-function splitOutsideQuotes(expr, sep6) {
-  if (!expr.includes(sep6)) return [expr];
+function splitOutsideQuotes(expr, sep7) {
+  if (!expr.includes(sep7)) return [expr];
   const parts = [];
   let currentStart = 0;
   let inQuote = null;
   let depth = 0;
   let bracketDepth = 0;
   let i = 0;
-  const sepLen = sep6.length;
+  const sepLen = sep7.length;
   const lastStart = expr.length - sepLen;
   while (i <= lastStart) {
     const ch = expr[i];
@@ -3179,7 +3179,7 @@ function splitOutsideQuotes(expr, sep6) {
     else if (ch === ")") depth--;
     else if (ch === "[") bracketDepth++;
     else if (ch === "]") bracketDepth--;
-    if (depth === 0 && bracketDepth === 0 && expr.startsWith(sep6, i)) {
+    if (depth === 0 && bracketDepth === 0 && expr.startsWith(sep7, i)) {
       parts.push(expr.slice(currentStart, i));
       i += sepLen;
       currentStart = i;
@@ -3955,8 +3955,8 @@ var init_engine = __esm({
       },
       first: (v) => Array.isArray(v) ? v[0] ?? null : null,
       last: (v) => Array.isArray(v) ? v[v.length - 1] ?? null : null,
-      join: (v, sep6) => Array.isArray(v) ? v.map(String).join(sep6 !== void 0 ? String(sep6) : ", ") : String(v),
-      split: (v, sep6) => String(v).split(sep6 !== void 0 ? String(sep6) : " "),
+      join: (v, sep7) => Array.isArray(v) ? v.map(String).join(sep7 !== void 0 ? String(sep7) : ", ") : String(v),
+      split: (v, sep7) => String(v).split(sep7 !== void 0 ? String(sep7) : " "),
       replace: (v, from, to) => {
         const s = String(v);
         if (from !== void 0 && typeof from === "object" && from !== null && !Array.isArray(from)) {
@@ -6657,6 +6657,9 @@ var init_middleware = __esm({
             `max-age=${hsts}; includeSubDomains`
           );
         }
+        if (process.env.TINA4_CSP === void 0) {
+          _SecurityHeadersMiddleware.warnCspDefaultOnce();
+        }
         res.header(
           "Content-Security-Policy",
           process.env.TINA4_CSP ?? "default-src 'self'"
@@ -6672,6 +6675,30 @@ var init_middleware = __esm({
         );
         return [req2, res];
       }
+      /** Warn-once ledger for the default-CSP heads-up (per process). */
+      static cspDefaultWarned = false;
+      /**
+       * Warn once per process that the default CSP is in force (TINA4_CSP unset).
+       *
+       * Secure-by-default keeps `default-src 'self'` (SECHDR-DEC-01), but that
+       * default is invisible: it blocks runtime-injected inline styles, cross-origin
+       * fonts/scripts/CDNs, `data:` URIs, and cross-origin WebSocket/XHR (a separate
+       * API or LiveKit host) — and the failure surfaces only in the browser at
+       * runtime, long after a deploy has gone green. So the framework says so once,
+       * naming the escape hatch. It NEVER fails the boot or a request — logging a
+       * heads-up must not be the reason the server or a request dies. Fires only when
+       * TINA4_CSP is ABSENT; setting it (even to empty) is an explicit opt-in.
+       */
+      static warnCspDefaultOnce() {
+        if (_SecurityHeadersMiddleware.cspDefaultWarned) return;
+        _SecurityHeadersMiddleware.cspDefaultWarned = true;
+        const message = `TINA4_CSP is not set, so Tina4 is serving the default Content-Security-Policy "default-src 'self'" on every response. That default blocks runtime-injected inline styles, cross-origin fonts/scripts/CDNs, data: URIs, and cross-origin WebSocket/XHR (e.g. a separate API or LiveKit host). If your app uses any of these, set TINA4_CSP to a policy that allows them (see https://tina4.com); to silence this notice without changing behaviour, set TINA4_CSP="default-src 'self'".`;
+        try {
+          Log.warning(message);
+        } catch {
+          console.warn(message);
+        }
+      }
       /**
        * True when the client request is HTTPS. Proxy-aware and byte-parity with
        * Python (request.is_secure_scheme), PHP (Request::isSecureScheme) and Ruby
@@ -7161,7 +7188,7 @@ ${s}\r
       connect() {
         if (this.connected) return Promise.resolve();
         if (this.connecting) return this.connecting;
-        this.connecting = new Promise((resolve20, reject) => {
+        this.connecting = new Promise((resolve21, reject) => {
           const sock = net.createConnection({ host: this.host, port: this.port });
           sock.setNoDelay(true);
           const onError = (err) => {
@@ -7198,7 +7225,7 @@ ${s}\r
               sock.on("error", (e) => {
                 this.brokenError = e;
               });
-              resolve20();
+              resolve21();
             } catch (e) {
               onError(e);
             }
@@ -7261,12 +7288,12 @@ ${s}\r
       }
       /** Send one command and await its reply (assumes socket is up). */
       raw(args) {
-        return new Promise((resolve20, reject) => {
+        return new Promise((resolve21, reject) => {
           if (!this.sock || this.sock.destroyed) {
             reject(this.brokenError ?? new Error("redis socket not connected"));
             return;
           }
-          this.waiters.push({ resolve: resolve20, reject });
+          this.waiters.push({ resolve: resolve21, reject });
           this.sock.write(_RespClient.encode(args));
         });
       }
@@ -7608,7 +7635,7 @@ ${s}\r
       connect() {
         if (this.connected) return Promise.resolve();
         if (this.connecting) return this.connecting;
-        this.connecting = new Promise((resolve20, reject) => {
+        this.connecting = new Promise((resolve21, reject) => {
           const sock = net.createConnection({ host: this.host, port: this.port });
           sock.setNoDelay(true);
           sock.once("error", (err) => {
@@ -7629,7 +7656,7 @@ ${s}\r
                 p.resolve(this.buffer.toString("utf-8"));
               }
             });
-            resolve20();
+            resolve21();
           });
         });
         return this.connecting;
@@ -7662,13 +7689,13 @@ ${s}\r
       async send(payload, terminator) {
         await this.connect();
         if (!this.sock || this.sock.destroyed) return "";
-        return new Promise((resolve20) => {
+        return new Promise((resolve21) => {
           this.buffer = Buffer.alloc(0);
-          this.pending = { terminator, resolve: resolve20 };
+          this.pending = { terminator, resolve: resolve21 };
           const timer = setTimeout(() => {
-            if (this.pending && this.pending.resolve === resolve20) {
+            if (this.pending && this.pending.resolve === resolve21) {
               this.pending = null;
-              resolve20(this.buffer.toString("utf-8"));
+              resolve21(this.buffer.toString("utf-8"));
             }
           }, 4e3);
           if (timer.unref) timer.unref();
@@ -9434,7 +9461,7 @@ async function parseBody(req2) {
   }
   const contentType = req2.headers["content-type"] ?? "";
   const chunks = [];
-  await new Promise((resolve20, reject) => {
+  await new Promise((resolve21, reject) => {
     let received = 0;
     let refused = false;
     req2.on("data", (chunk) => {
@@ -9449,7 +9476,7 @@ async function parseBody(req2) {
       chunks.push(chunk);
     });
     req2.on("end", () => {
-      if (!refused) resolve20();
+      if (!refused) resolve21();
     });
     req2.on("error", reject);
   });
@@ -12682,6 +12709,2038 @@ var init_version = __esm({
   }
 });
 
+// ../cli/src/commands/generate.ts
+var generate_exports = {};
+__export(generate_exports, {
+  DEFAULT_FIELDS: () => DEFAULT_FIELDS,
+  GENERATORS: () => GENERATORS,
+  RESOLUTION_ENVELOPE_VERSION: () => RESOLUTION_ENVELOPE_VERSION,
+  SQL_RESERVED_TABLE_NAMES: () => SQL_RESERVED_TABLE_NAMES,
+  aiFill: () => aiFill,
+  currentResolution: () => currentResolution,
+  extend: () => extend,
+  fieldsOrDefault: () => fieldsOrDefault,
+  generate: () => generate,
+  generateMigration: () => generateMigration,
+  generateProgrammatic: () => generateProgrammatic,
+  parseCliArgs: () => parseCliArgs,
+  parseEvery: () => parseEvery,
+  parseFields: () => parseFields,
+  pluralizeReserved: () => pluralizeReserved,
+  toPascal: () => toPascal,
+  toSnake: () => toSnake,
+  toTableName: () => toTableName
+});
+import { existsSync as existsSync13, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join15, relative as relative2, resolve as resolve6, sep as sep3 } from "node:path";
+function ensureDir(dir) {
+  if (__resolution.dryRun) return;
+  if (!existsSync13(dir)) {
+    mkdirSync8(dir, { recursive: true });
+  }
+}
+function writeFileSafe(path8, content) {
+  captureEditHints(path8, content);
+  if (__resolution.dryRun) {
+    return;
+  }
+  if (existsSync13(path8)) {
+    if (!__resolution.jsonMode) console.log(`  File already exists: ${path8}`);
+    return;
+  }
+  writeFileSync7(path8, content, "utf-8");
+  __resolution.actionsTaken.push(`wrote ${path8}`);
+  if (!__resolution.jsonMode) console.log(`  Created ${path8}`);
+}
+function toSnake(name) {
+  return name.replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
+}
+function pluralizeReserved(name) {
+  if (name.endsWith("y") && !/[aeiouy]y$/i.test(name)) return name.slice(0, -1) + "ies";
+  if (/(s|x|z|ch|sh)$/.test(name)) return name + "es";
+  return name + "s";
+}
+function toTableName(name) {
+  const raw = toSnake(name);
+  if (SQL_RESERVED_TABLE_NAMES.has(raw)) {
+    const safe = pluralizeReserved(raw);
+    recordTransformation({
+      kind: "reserved_word_pluralize",
+      from: raw,
+      to: safe,
+      reason: `SQL reserved word '${raw}' would break CREATE TABLE`,
+      override: `--table ${raw} --quote (requires quoted-identifier mode, not yet implemented)`
+    });
+    return safe;
+  }
+  return raw;
+}
+function resetResolution(target, input, opts) {
+  __resolution.target = target;
+  __resolution.input = input;
+  __resolution.body = { transformations: [] };
+  __resolution.actionsTaken = [];
+  __resolution.dryRun = opts.dryRun;
+  __resolution.jsonMode = opts.jsonMode;
+}
+function recordTransformation(t) {
+  __resolution.body.transformations.push(t);
+}
+function currentResolution() {
+  const body = {
+    ...__resolution.body,
+    transformations: [...__resolution.body.transformations]
+  };
+  if (__resolution.body.edit_hints) {
+    body.edit_hints = __resolution.body.edit_hints.map((h) => ({ ...h }));
+  }
+  if (__resolution.body.next) {
+    body.next = [...__resolution.body.next];
+  }
+  if (__resolution.body.test_paths) {
+    body.test_paths = [...__resolution.body.test_paths];
+  }
+  if (__resolution.body.routes) {
+    body.routes = [...__resolution.body.routes];
+  }
+  return {
+    command: "generate",
+    target: __resolution.target,
+    input: { ...__resolution.input },
+    resolution: body,
+    actions_taken: [...__resolution.actionsTaken],
+    dry_run: __resolution.dryRun
+  };
+}
+function setResolutionField(key, value) {
+  __resolution.body[key] = value;
+}
+function pushRoute(routePattern) {
+  if (!__resolution.body.routes) __resolution.body.routes = [];
+  __resolution.body.routes.push(routePattern);
+}
+function pushTestPath(path8) {
+  if (!__resolution.body.test_paths) __resolution.body.test_paths = [];
+  __resolution.body.test_paths.push(path8);
+}
+function pushEditHint(hint) {
+  if (!__resolution.body.edit_hints) __resolution.body.edit_hints = [];
+  __resolution.body.edit_hints.push(hint);
+}
+function setNextSteps(steps) {
+  if (steps.length === 0) return;
+  __resolution.body.next = [...steps];
+}
+function toRelPath(absPath) {
+  const cwd = process.cwd();
+  const rel = relative2(cwd, absPath);
+  if (!rel) return absPath;
+  return sep3 === "/" ? rel : rel.split(sep3).join("/");
+}
+function captureEditHints(absPath, content) {
+  if (!/\.(ts|tsx|js|mjs|cjs|jsx|sql|twig|html\.twig)$/.test(absPath)) return;
+  const relPath = toRelPath(absPath);
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const match = TINA4_EDIT_MARKER.exec(lines[i]);
+    if (match) {
+      pushEditHint({ file: relPath, line: i + 1, label: match[1].trim() });
+    }
+  }
+}
+function printResolution() {
+  if (__resolution.jsonMode) {
+    process.stdout.write(JSON.stringify(currentResolution(), null, 2) + "\n");
+    return;
+  }
+  const b = __resolution.body;
+  const lines = [];
+  lines.push("");
+  lines.push(`Generated ${__resolution.target} ${__resolution.input.name}`);
+  if (b.class_name || b.file_path) {
+    const where = b.file_path ? `  (in ${b.file_path})` : "";
+    lines.push(`  class      ${b.class_name ?? __resolution.input.name}${where}`);
+  }
+  if (b.table_name) {
+    const t = b.transformations.find((x) => x.kind === "reserved_word_pluralize");
+    const note = t ? `  (auto-pluralized: '${t.from}' is a SQL reserved word)` : "";
+    lines.push(`  table      ${b.table_name}${note}`);
+  }
+  if (b.routes && b.routes.length) {
+    lines.push(`  routes     ${b.routes.join(", ")}`);
+  }
+  if (b.migration_path) {
+    lines.push(`  migration  ${b.migration_path}`);
+  }
+  const reserved = b.transformations.find((t) => t.kind === "reserved_word_pluralize");
+  if (reserved && reserved.from && reserved.override) {
+    lines.push("");
+    lines.push(`  To keep the raw name '${reserved.from}' as the table:`);
+    lines.push(`    tina4nodejs generate ${__resolution.target} ${__resolution.input.name} ${reserved.override}`);
+  }
+  if (b.test_paths && b.test_paths.length > 0) {
+    lines.push("");
+    lines.push("  Tests:");
+    for (const testPath of b.test_paths) lines.push(`    ${testPath}`);
+  }
+  if (b.edit_hints && b.edit_hints.length > 0) {
+    lines.push("");
+    lines.push("  Edit these lines:");
+    for (const hint of b.edit_hints) {
+      lines.push(`    ${hint.file}:${hint.line}  ${hint.label}`);
+    }
+  }
+  if (b.next && b.next.length > 0) {
+    lines.push("");
+    lines.push("  Next:");
+    for (const step of b.next) lines.push(`    ${step}`);
+  }
+  lines.push("");
+  process.stderr.write(lines.join("\n"));
+}
+function toPlural(name) {
+  const lower = name.toLowerCase();
+  if (lower.endsWith("s")) return lower;
+  if (lower.endsWith("y") && !/[aeiou]y$/i.test(lower)) return lower.slice(0, -1) + "ies";
+  return lower + "s";
+}
+function toCamel(name) {
+  return name.charAt(0).toLowerCase() + name.slice(1);
+}
+function toPascal(name) {
+  return name.split(/[^0-9a-zA-Z]+/).filter(Boolean).map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join("");
+}
+function parseFields(fieldsStr) {
+  if (!fieldsStr || !fieldsStr.trim()) return [];
+  const result = [];
+  for (const part of fieldsStr.split(",")) {
+    const trimmed = part.trim();
+    if (trimmed.includes(":")) {
+      const [fname, ftype] = trimmed.split(":", 2);
+      if (fname.trim()) result.push([fname.trim(), ftype.trim().toLowerCase()]);
+    } else if (trimmed) {
+      result.push([trimmed, "string"]);
+    }
+  }
+  return result;
+}
+function fieldsOrDefault(fieldsStr) {
+  const parsed = parseFields(fieldsStr);
+  return parsed.length > 0 ? parsed : DEFAULT_FIELDS.map(([f, t]) => [f, t]);
+}
+function parseCliArgs(args) {
+  const booleanFlags = /* @__PURE__ */ new Set([
+    "no-browser",
+    "no-reload",
+    "production",
+    "managed",
+    "all",
+    "clear",
+    "public",
+    "no-migration",
+    // Suppress the co-emitted migration test (used by the migrate:create
+    // delegation — a plain migrate:create is "just a migration, no test",
+    // matching its pre-3.13.121 UX now that it routes through generate migration).
+    "no-test",
+    // Resolution transparency (Feature B, 3.13.117): both accept NO value.
+    "json",
+    "dry-run"
+  ]);
+  const flags = {};
+  const positional = [];
+  let i = 0;
+  while (i < args.length) {
+    if (args[i].startsWith("--")) {
+      const key = args[i].slice(2);
+      if (booleanFlags.has(key)) {
+        flags[key] = true;
+        i += 1;
+      } else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
+        flags[key] = args[i + 1];
+        i += 2;
+      } else {
+        flags[key] = true;
+        i += 1;
+      }
+    } else {
+      positional.push(args[i]);
+      i += 1;
+    }
+  }
+  return { flags, positional };
+}
+function parseEvery(every) {
+  if (!every || every === true) return 60;
+  const s = String(every).trim().toLowerCase();
+  const units = { s: 1, m: 60, h: 3600, d: 86400 };
+  const unit = s.slice(-1);
+  if (unit in units) {
+    const n2 = parseFloat(s.slice(0, -1));
+    return Number.isFinite(n2) ? Math.max(1, Math.round(n2 * units[unit])) : 60;
+  }
+  const n = parseFloat(s);
+  return Number.isFinite(n) ? Math.max(1, Math.round(n)) : 60;
+}
+function aiFill(fn, spec, indent = "  ") {
+  const rule = (label) => "\u2500".repeat(Math.max(4, 46 - label.length));
+  const lines = [`${indent}// \u2500\u2500\u2500 AI-FILL: ${fn} ${rule(fn)}`];
+  lines.push(`${indent}// Intent:  ${spec.intent}`);
+  if (spec.given) lines.push(`${indent}// Given:   ${spec.given}`);
+  lines.push(`${indent}// Use:     ${spec.use}`);
+  if (spec.ret) lines.push(`${indent}// Return:  ${spec.ret}`);
+  lines.push(`${indent}// Ground:  ${spec.ground}`);
+  lines.push(`${indent}throw new Error(${JSON.stringify(spec.raise)});   // remove when implemented`);
+  lines.push(`${indent}// ${"\u2500".repeat(52)}`);
+  return lines.join("\n") + "\n";
+}
+function extend(note, hint = "", indent = "  ") {
+  let out = `${indent}// \u2500\u2500\u2500 EXTEND: ${note} ${"\u2500".repeat(Math.max(4, 46 - note.length))}
+`;
+  if (hint) out += `${indent}// ${hint}
+`;
+  return out;
+}
+function timestamp() {
+  const now = /* @__PURE__ */ new Date();
+  return now.getFullYear().toString() + String(now.getMonth() + 1).padStart(2, "0") + String(now.getDate()).padStart(2, "0") + String(now.getHours()).padStart(2, "0") + String(now.getMinutes()).padStart(2, "0") + String(now.getSeconds()).padStart(2, "0");
+}
+function isoNow() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").replace(/\.\d+Z$/, "");
+}
+async function generate(what, name, extraArgs = []) {
+  if (!what) {
+    console.error("  Usage: tina4nodejs generate <what> <name> [options]");
+    console.error(`  Generators: ${GENERATOR_LIST}`);
+    console.error('  Options:    --fields "name:string,price:float"  --model ModelName');
+    console.error("              --public                 open a route's writes (default: secure)");
+    console.error('              --every 5m | --cron "\u2026"   service schedule');
+    console.error("              --json                    emit machine-readable resolution envelope on stdout");
+    console.error("              --dry-run                 report resolution without writing any files");
+    process.exit(1);
+  }
+  const noNameGenerators = /* @__PURE__ */ new Set(["auth"]);
+  if (noNameGenerators.has(what) && name.startsWith("--")) {
+    extraArgs = [name, ...extraArgs];
+    name = "";
+  }
+  if (!noNameGenerators.has(what) && !name) {
+    console.error(`  Usage: tina4nodejs generate ${what} <name> [options]`);
+    process.exit(1);
+  }
+  const { flags } = parseCliArgs(extraArgs);
+  const jsonMode = Boolean(flags.json);
+  const dryRun = Boolean(flags["dry-run"]);
+  resetResolution(what, { name, fields: flags.fields ?? null }, { dryRun, jsonMode });
+  const spec = GENERATORS[what];
+  if (spec) {
+    spec.handler(name, flags);
+  } else {
+    console.error(`  Unknown generator: ${what}`);
+    console.error(`  Available: ${GENERATOR_LIST}`);
+    process.exit(1);
+  }
+  const nextFn = NEXT_STEPS[what];
+  if (nextFn) {
+    const resolvedTable = __resolution.body.table_name ?? (name ? SQL_RESERVED_TABLE_NAMES.has(toSnake(name)) ? pluralizeReserved(toSnake(name)) : toSnake(name) : "");
+    setNextSteps(nextFn({ name: name || "", table: resolvedTable }));
+  }
+  printResolution();
+}
+async function generateProgrammatic(what, name, extraArgs = []) {
+  const spec = GENERATORS[what];
+  if (!spec) throw new Error(`Unknown generator: ${what} (available: ${GENERATOR_LIST})`);
+  const { flags } = parseCliArgs(extraArgs);
+  const dryRun = Boolean(flags["dry-run"]);
+  resetResolution(what, { name, fields: flags.fields ?? null }, { dryRun, jsonMode: true });
+  spec.handler(name, flags);
+  const nextFn = NEXT_STEPS[what];
+  if (nextFn) {
+    const resolvedTable = __resolution.body.table_name ?? (name ? SQL_RESERVED_TABLE_NAMES.has(toSnake(name)) ? pluralizeReserved(toSnake(name)) : toSnake(name) : "");
+    setNextSteps(nextFn({ name: name || "", table: resolvedTable }));
+  }
+  return currentResolution();
+}
+function generateModel(name, flags, emitTest = true) {
+  const fields = fieldsOrDefault(flags.fields || "");
+  const table2 = toTableName(name);
+  const dir = resolve6("src/models");
+  ensureDir(dir);
+  const path8 = join15(dir, `${name}.ts`);
+  setResolutionField("class_name", name);
+  setResolutionField("table_name", table2);
+  setResolutionField("file_path", `src/models/${name}.ts`);
+  pushTestPath(`tests/${table2}_model.test.ts`);
+  const fieldLines = [
+    `    id: { type: "integer" as const, primaryKey: true, autoIncrement: true },`,
+    `    // tina4:edit add or change fields for this model (string,int,float,bool,text,datetime)`
+  ];
+  for (const [fname, ftype] of fields) {
+    const info = FIELD_TYPE_MAP[ftype] || FIELD_TYPE_MAP.string;
+    fieldLines.push(`    ${fname}: { type: ${info.orm} as const },`);
+  }
+  fieldLines.push(`    created_at: { type: "datetime" as const },`);
+  const content = `import { BaseModel } from "tina4-nodejs/orm";
+
+export default class ${name} extends BaseModel {
+  static tableName = "${table2}";
+  static fields = {
+${fieldLines.join("\n")}
+  };
+}
+`;
+  writeFileSafe(path8, content);
+  if (!flags["no-migration"]) {
+    generateMigration(`create_${table2}`, flags, fields, table2, false);
+  }
+  if (emitTest) emitModelTest(name, table2, fields);
+}
+function secureOptOut(isPublic) {
+  return isPublic ? `export const secure = false;
+
+` : "";
+}
+function generateRoute(name, flags, emitTest = true) {
+  const routePath = name.replace(/^\//, "");
+  const singular = routePath.endsWith("s") ? routePath.slice(0, -1) : routePath;
+  const model = flags.model;
+  const isPublic = Boolean(flags.public);
+  const base = resolve6("src/routes/api", routePath);
+  const idDir = join15(base, "[id]");
+  ensureDir(base);
+  ensureDir(idDir);
+  pushRoute(`/api/${routePath}`);
+  pushRoute(`/api/${routePath}/{id}`);
+  if (__resolution.target === "route") {
+    setResolutionField("file_path", `src/routes/api/${routePath}/get.ts`);
+  }
+  const table2 = model ? toTableName(model) : "";
+  const modelImportBase = model ? `import ${model} from "../../../models/${model}.js";
+` : "";
+  const modelImportId = model ? `import ${model} from "../../../../models/${model}.js";
+` : "";
+  const writeDoc = isPublic ? "Public (--public): no token required." : "Secure by default: requires a Bearer token (use --public to open).";
+  if (model) {
+    writeFileSafe(
+      join15(base, "get.ts"),
+      `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+${modelImportBase}
+export const meta = { summary: "List all ${routePath}", tags: ["${routePath}"] };
+
+export default async function (req: Tina4Request, res: Tina4Response) {
+  // tina4:edit tune pagination defaults or add filter/sort parsing here
+  const page = parseInt(req.query.page as string) || 1;
+  const limit = parseInt(req.query.limit as string) || 20;
+  const offset = (page - 1) * limit;
+  const rows = await ${model}.select("SELECT * FROM ${table2} LIMIT ? OFFSET ?", [limit, offset]);
+  res.json({ data: rows.map((r) => r.toObject()), page, limit });
+}
+`
+    );
+  } else {
+    writeFileSafe(
+      join15(base, "get.ts"),
+      `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+
+export const meta = { summary: "List all ${routePath}", tags: ["${routePath}"] };
+
+export default async function (req: Tina4Request, res: Tina4Response) {
+${aiFill(`list_${routePath}`, {
+        intent: `return the ${routePath} collection (add pagination if it grows)`,
+        given: "req.query -> filters/paging",
+        use: `Model.select("SELECT \u2026 LIMIT ? OFFSET ?", [limit, offset]) then r.toObject()`,
+        ret: "res.json({ data: rows })",
+        ground: `tina4_context("list ORM records with pagination", "nodejs") \xB7 skill tina4-developer-nodejs`,
+        raise: `${routePath} list not implemented`
+      })}}
+`
+    );
+  }
+  if (model) {
+    writeFileSafe(
+      join15(base, "post.ts"),
+      `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+${modelImportBase}${secureOptOut(isPublic)}export const meta = { summary: "Create a new ${singular}", tags: ["${routePath}"] };
+
+// ${writeDoc}
+export default async function (req: Tina4Request, res: Tina4Response) {
+  // tina4:edit validate the body before persist (Validator or hand-checks)
+${extend(
+        "validate / business rules before persist",
+        `e.g. reject invalid input; ground: tina4_context("validate before create", "nodejs")`
+      )}  const item = new ${model}(req.body as Record<string, unknown>);
+  // save() returns false on failure rather than throwing - check it, or a failed
+  // write is reported to the client as a 201 carrying unsaved data.
+  if ((await item.save()) === false) {
+    res.json({ error: "Could not create ${singular}" }, 400);
+    return;
+  }
+  res.json({ data: item.toObject() }, 201);
+}
+`
+    );
+  } else {
+    writeFileSafe(
+      join15(base, "post.ts"),
+      `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+
+${secureOptOut(isPublic)}export const meta = { summary: "Create a new ${singular}", tags: ["${routePath}"] };
+
+// ${writeDoc}
+export default async function (req: Tina4Request, res: Tina4Response) {
+  // tina4:edit fill the create handler (see AI-FILL fill-spec below)
+${aiFill(`create_${singular}`, {
+        intent: `validate the body and persist a new ${singular}`,
+        given: "req.body -> the posted fields",
+        use: "new Model(req.body).save() then item.toObject()  (import your model)",
+        ret: "res.json({ data: item }, 201)",
+        ground: `tina4_context("create ORM record and return 201", "nodejs") \xB7 skill tina4-developer-nodejs`,
+        raise: `create ${singular} not implemented`
+      })}}
+`
+    );
+  }
+  if (model) {
+    writeFileSafe(
+      join15(idDir, "get.ts"),
+      `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+${modelImportId}
+export const meta = { summary: "Get a ${singular} by ID", tags: ["${routePath}"] };
+
+export default async function (req: Tina4Request, res: Tina4Response) {
+  const { id } = req.params;
+  const item = await ${model}.selectOne("SELECT * FROM ${table2} WHERE id = ?", [id]);
+  if (!item) {
+    res.json({ error: "Not found" }, 404);
+    return;
+  }
+  res.json({ data: item.toObject() });
+}
+`
+    );
+  } else {
+    writeFileSafe(
+      join15(idDir, "get.ts"),
+      `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+
+export const meta = { summary: "Get a ${singular} by ID", tags: ["${routePath}"] };
+
+export default async function (req: Tina4Request, res: Tina4Response) {
+${aiFill(`get_${singular}`, {
+        intent: `fetch one ${singular} by id`,
+        given: "req.params.id -> the record id",
+        use: `Model.selectOne("SELECT \u2026 WHERE id = ?", [req.params.id])`,
+        ret: "res.json({ data: item }) or res.json({ error: 'Not found' }, 404)",
+        ground: `tina4_context("find ORM record by id", "nodejs") \xB7 skill tina4-developer-nodejs`,
+        raise: `get ${singular} not implemented`
+      })}}
+`
+    );
+  }
+  if (model) {
+    writeFileSafe(
+      join15(idDir, "put.ts"),
+      `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+${modelImportId}${secureOptOut(isPublic)}export const meta = { summary: "Update a ${singular} by ID", tags: ["${routePath}"] };
+
+// ${writeDoc}
+export default async function (req: Tina4Request, res: Tina4Response) {
+  const { id } = req.params;
+  const item = await ${model}.selectOne("SELECT * FROM ${table2} WHERE id = ?", [id]);
+  if (!item) {
+    res.json({ error: "Not found" }, 404);
+    return;
+  }
+  // tina4:edit guard which fields may be updated and who may update this row
+${extend(
+        "guard which fields / who may update",
+        `e.g. enforce ownership; ground: tina4_context("authorize update", "nodejs")`
+      )}  Object.assign(item, req.body as Record<string, unknown>);
+  // save() returns false on failure rather than throwing - check it, or a failed
+  // write is reported to the client as a 200 carrying unsaved data.
+  if ((await item.save()) === false) {
+    res.json({ error: "Could not update ${singular}" }, 400);
+    return;
+  }
+  res.json({ data: item.toObject() });
+}
+`
+    );
+  } else {
+    writeFileSafe(
+      join15(idDir, "put.ts"),
+      `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+
+${secureOptOut(isPublic)}export const meta = { summary: "Update a ${singular} by ID", tags: ["${routePath}"] };
+
+// ${writeDoc}
+export default async function (req: Tina4Request, res: Tina4Response) {
+  // tina4:edit fill the update handler (see AI-FILL fill-spec below)
+${aiFill(`update_${singular}`, {
+        intent: `load, mutate and save an existing ${singular}`,
+        given: "req.params.id -> id; req.body -> changed fields",
+        use: "Model.selectOne(\u2026) then Object.assign(item, req.body) then item.save()",
+        ret: "res.json({ data: item }) or 404",
+        ground: `tina4_context("update ORM record", "nodejs") \xB7 skill tina4-developer-nodejs`,
+        raise: `update ${singular} not implemented`
+      })}}
+`
+    );
+  }
+  if (model) {
+    writeFileSafe(
+      join15(idDir, "delete.ts"),
+      `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+${modelImportId}${secureOptOut(isPublic)}export const meta = { summary: "Delete a ${singular} by ID", tags: ["${routePath}"] };
+
+// ${writeDoc}
+export default async function (req: Tina4Request, res: Tina4Response) {
+  const { id } = req.params;
+  const item = await ${model}.selectOne("SELECT * FROM ${table2} WHERE id = ?", [id]);
+  if (!item) {
+    res.json({ error: "Not found" }, 404);
+    return;
+  }
+  await item.delete();
+  res.json({ message: "deleted", id });
+}
+`
+    );
+  } else {
+    writeFileSafe(
+      join15(idDir, "delete.ts"),
+      `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+
+${secureOptOut(isPublic)}export const meta = { summary: "Delete a ${singular} by ID", tags: ["${routePath}"] };
+
+// ${writeDoc}
+export default async function (req: Tina4Request, res: Tina4Response) {
+${aiFill(`delete_${singular}`, {
+        intent: `delete a ${singular} by id`,
+        given: "req.params.id -> id",
+        use: "Model.selectOne(\u2026) then item.delete()",
+        ret: "res.json({ message: 'deleted', id }) or 404",
+        ground: `tina4_context("delete ORM record", "nodejs") \xB7 skill tina4-developer-nodejs`,
+        raise: `delete ${singular} not implemented`
+      })}}
+`
+    );
+  }
+  if (emitTest) {
+    if (model) {
+      generateTest(routePath, { model, "secure-writes": true, public: isPublic });
+    } else {
+      emitRouteStubTest(routePath);
+    }
+  }
+}
+function generateCrud(name, flags) {
+  const table2 = toTableName(name);
+  const routeName = toPlural(table2);
+  const isPublic = Boolean(flags.public);
+  if (!__resolution.jsonMode) console.log(`
+  Generating CRUD for ${name}...
+`);
+  generateModel(name, flags, false);
+  generateRoute(routeName, { ...flags, model: name }, false);
+  generateForm(name, flags);
+  generateView(name, flags);
+  generateTest(routeName, { model: name, "secure-writes": true, public: isPublic });
+  if (!__resolution.jsonMode) {
+    console.log(`
+  CRUD generation complete for ${name}.`);
+    console.log("  Run: tina4nodejs migrate");
+    console.log("  Visit: /swagger to see the API docs");
+  }
+}
+function generateMigration(name, flags, fieldsOverride, tableOverride, emitTest = true) {
+  const ts = timestamp();
+  const dir = resolve6("migrations");
+  ensureDir(dir);
+  let table2;
+  if (tableOverride) {
+    table2 = tableOverride;
+  } else {
+    const raw = name.replace(/^create_/, "").replace(/^add_/, "").replace(/^drop_/, "");
+    table2 = toTableName(raw);
+  }
+  if (__resolution.target === "migration") {
+    setResolutionField("table_name", table2);
+  }
+  const fields = fieldsOverride || parseFields(flags.fields || "");
+  const isCreate = name.startsWith("create_") || fieldsOverride !== void 0;
+  const fileName = `${ts}_${name}.sql`;
+  const path8 = join15(dir, fileName);
+  setResolutionField("migration_path", `migrations/${fileName}`);
+  if (__resolution.target === "migration") {
+    setResolutionField("file_path", `migrations/${fileName}`);
+    pushTestPath(`tests/${table2}_migration.test.ts`);
+  }
+  let upSql;
+  let downSql;
+  if (isCreate) {
+    const colLines = ["    id INTEGER PRIMARY KEY AUTOINCREMENT"];
+    for (const [fname, ftype] of fields) {
+      const info = FIELD_TYPE_MAP[ftype] || FIELD_TYPE_MAP.string;
+      const defaultClause = info.defaultVal !== "NULL" ? ` DEFAULT ${info.defaultVal}` : "";
+      colLines.push(`    ${fname} ${info.sql}${defaultClause}`);
+    }
+    colLines.push("    created_at TEXT DEFAULT CURRENT_TIMESTAMP");
+    upSql = `CREATE TABLE IF NOT EXISTS ${table2} (
+    -- tina4:edit  add columns beyond id + created_at
+${colLines.join(",\n")}
+);`;
+    downSql = `-- tina4:edit  mirror the CREATE's added columns in the rollback
+DROP TABLE IF EXISTS ${table2};`;
+  } else {
+    upSql = `-- tina4:edit  write your UP migration SQL here
+-- Example: ALTER TABLE ${table2} ADD COLUMN new_col TEXT DEFAULT '';`;
+    downSql = `-- tina4:edit  write your DOWN rollback SQL here
+-- Example: ALTER TABLE ${table2} DROP COLUMN new_col;`;
+  }
+  const now = isoNow();
+  const content = `-- Migration: ${name}
+-- Created: ${now}
+
+-- UP
+${upSql}
+
+-- DOWN
+${downSql}
+`;
+  writeFileSafe(path8, content);
+  const downPath = join15(dir, `${ts}_${name}.down.sql`);
+  const downContent = `-- Rollback: ${name}
+-- Created: ${now}
+
+${downSql}
+`;
+  writeFileSafe(downPath, downContent);
+  if (emitTest && isCreate) emitMigrationTest(name, table2);
+}
+function generateMiddleware(name, _flags) {
+  const snake = toSnake(name);
+  const dir = resolve6("src/middleware");
+  ensureDir(dir);
+  const path8 = join15(dir, `${snake}.ts`);
+  if (__resolution.target === "middleware") {
+    setResolutionField("class_name", name);
+    setResolutionField("file_path", `src/middleware/${snake}.ts`);
+    pushTestPath(`tests/${snake}.test.ts`);
+  }
+  const content = `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+
+/**
+ * ${name} middleware \u2014 runs before and after route handlers.
+ *
+ * Usage:
+ *   import { before${name}, after${name} } from "../middleware/${snake}.js";
+ */
+
+export async function before${name}(
+  req: Tina4Request,
+  res: Tina4Response,
+  next: () => Promise<void>,
+): Promise<void> {
+  // tina4:edit replace the Authorization check with the real pre-request rule
+  const auth = req.headers["authorization"];
+  if (!auth) {
+    res.json({ error: "Unauthorized" }, 401);
+    return;
+  }
+  await next();
+}
+
+export async function after${name}(
+  req: Tina4Request,
+  res: Tina4Response,
+  next: () => Promise<void>,
+): Promise<void> {
+  // tina4:edit add post-processing (logging, header injection, telemetry)
+  await next();
+}
+`;
+  writeFileSafe(path8, content);
+  emitMiddlewareTest(name, snake);
+}
+function generateTest(name, flags) {
+  const snake = toSnake(name);
+  const singular = snake.endsWith("s") ? snake.slice(0, -1) : snake;
+  const model = flags.model;
+  const dir = resolve6("tests");
+  ensureDir(dir);
+  const path8 = join15(dir, `${snake}.test.ts`);
+  if (model && flags["secure-writes"]) {
+    const isPublic = Boolean(flags.public);
+    const posture = isPublic ? "open (--public)" : "gated";
+    const writeCase = isPublic ? `  // --public opened the write: an anonymous POST creates -> 201.
+  assert("anonymous POST is public -> 201",
+    (await client.post("/api/${snake}", { json: { name: "test" } })).status === 201);` : `  // Secure by default: a tokenless POST is rejected with 401.
+  assert("anonymous POST is gated -> 401",
+    (await client.post("/api/${snake}", { json: { name: "test" } })).status === 401);
+  // A valid Bearer token passes the gate and creates -> 201.
+  const token = getToken({ userId: 1 });
+  assert("authenticated POST creates -> 201",
+    (await client.post("/api/${snake}", { json: { name: "test" }, headers: { authorization: \`Bearer \${token}\` } })).status === 201);`;
+    const content2 = `/**
+ * ${name} CRUD \u2014 reads public, writes ${posture} (secure by default).
+ *
+ * Real end-to-end via TestClient: no mocks \u2014 real Router, real auth gate, real
+ * JWT, real SQLite DB + table. Run with: npx tsx tests/${snake}.test.ts
+ */
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Router, TestClient, getToken, discoverRoutes } from "tina4-nodejs";
+import { initDatabase } from "tina4-nodejs/orm";
+import ${model} from "../src/models/${model}.js";
+
+process.env.TINA4_SECRET = process.env.TINA4_SECRET ?? "test-secret";
+const here = dirname(fileURLToPath(import.meta.url));
+
+let pass = 0;
+let fail = 0;
+function assert(label: string, ok: boolean): void {
+  if (ok) { pass++; console.log(\`  PASS \${label}\`); }
+  else { fail++; console.log(\`  FAIL \${label}\`); }
+}
+
+await initDatabase({ url: "sqlite:///data/test_${snake}.db" });
+await ${model}.createTable();
+
+const router = new Router();
+for (const def of await discoverRoutes(resolve(here, "../src/routes"))) router.addRoute(def);
+const client = new TestClient(router);
+
+// Reads are public.
+assert("GET list is public -> 200", (await client.get("/api/${snake}")).status === 200);
+${writeCase}
+
+console.log(\`\\nResults: \${pass} passed, \${fail} failed\`);
+process.exit(fail > 0 ? 1 : 0);
+`;
+    writeFileSafe(path8, content2);
+    return;
+  }
+  let content;
+  if (model) {
+    content = `import { tests, assertTrue } from "tina4-nodejs";
+
+/**
+ * Tests for ${name} CRUD operations.
+ */
+
+const list${model}s = tests(
+  assertTrue([]),
+)(function list${model}s() {
+  // tina4:edit assert against a real GET /api/${toSnake(name)} response (rows, count)
+  return true;
+});
+
+const get${model} = tests(
+  assertTrue([]),
+)(function get${model}() {
+  // tina4:edit assert against GET /api/${toSnake(name)}/{id} for one seeded row
+  return true;
+});
+
+const create${model} = tests(
+  assertTrue([]),
+)(function create${model}() {
+  // tina4:edit POST a valid + an invalid body, assert 201 vs 400
+  return true;
+});
+
+const update${model} = tests(
+  assertTrue([]),
+)(function update${model}() {
+  // tina4:edit PUT changed fields, assert the row was persisted
+  return true;
+});
+
+const delete${model} = tests(
+  assertTrue([]),
+)(function delete${model}() {
+  // tina4:edit DELETE the id, assert 200 then GET returns 404
+  return true;
+});
+
+void [list${model}s, get${model}, create${model}, update${model}, delete${model}];
+`;
+  } else {
+    const titleName = name.charAt(0).toUpperCase() + name.slice(1);
+    content = `import { tests, assertTrue } from "tina4-nodejs";
+
+/**
+ * Tests for ${name}.
+ */
+
+const test${titleName} = tests(
+  assertTrue([]),
+)(function test${titleName}() {
+  // tina4:edit assert against the real behaviour under test (no mocks)
+  return true;
+});
+
+void test${titleName};
+`;
+  }
+  writeFileSafe(path8, content);
+}
+function generateForm(name, flags) {
+  const fields = fieldsOrDefault(flags.fields || "");
+  const table2 = toTableName(name);
+  const routeName = toPlural(table2);
+  const inputTypes = {
+    string: "text",
+    str: "text",
+    text: "textarea",
+    int: "number",
+    integer: "number",
+    float: "number",
+    numeric: "number",
+    decimal: "number",
+    bool: "checkbox",
+    boolean: "checkbox",
+    datetime: "datetime-local",
+    blob: "file"
+  };
+  const dir = resolve6("src/templates/forms");
+  ensureDir(dir);
+  const path8 = join15(dir, `${table2}.twig`);
+  let fieldHtml = "";
+  for (const [fname, ftype] of fields) {
+    const itype = inputTypes[ftype] || "text";
+    const label = fname.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+    const step = ["float", "numeric", "decimal"].includes(ftype) ? ' step="0.01"' : "";
+    if (itype === "textarea") {
+      fieldHtml += `    <div class="form-group mb-3">
+        <label for="${fname}">${label}</label>
+        <textarea id="${fname}" name="${fname}" class="form-control" rows="4" placeholder="${label}">{{ item.${fname} }}</textarea>
+    </div>
+`;
+    } else if (itype === "checkbox") {
+      fieldHtml += `    <div class="form-group mb-3">
+        <label>
+            <input type="checkbox" id="${fname}" name="${fname}" value="1" {% if item.${fname} %}checked{% endif %}>
+            ${label}
+        </label>
+    </div>
+`;
+    } else {
+      fieldHtml += `    <div class="form-group mb-3">
+        <label for="${fname}">${label}</label>
+        <input type="${itype}" id="${fname}" name="${fname}" class="form-control"${step} value="{{ item.${fname} }}" placeholder="${label}">
+    </div>
+`;
+    }
+  }
+  const content = `{% extends "base.twig" %}
+{% block title %}${name} {% if item.id %}Edit{% else %}Create{% endif %}{% endblock %}
+{% block content %}
+<div class="container mt-4">
+    <h1>{% if item.id %}Edit ${name}{% else %}Create ${name}{% endif %}</h1>
+    {# tina4:edit  restyle the form beyond the scaffolded defaults #}
+    <form method="post" action="/api/${routeName}{% if item.id %}/{{ item.id }}{% endif %}">
+        {{ form_token() }}
+` + fieldHtml + `    <button type="submit" class="btn btn-primary">
+        {% if item.id %}Update{% else %}Create{% endif %}
+    </button>
+    <a href="/api/${routeName}" class="btn btn-secondary">Cancel</a>
+    </form>
+</div>
+{% endblock %}
+`;
+  writeFileSafe(path8, content);
+}
+function generateView(name, flags) {
+  const fields = fieldsOrDefault(flags.fields || "");
+  const table2 = toTableName(name);
+  const routeName = toPlural(table2);
+  const cols = fields.map(([f]) => f);
+  const dir = resolve6("src/templates/pages");
+  ensureDir(dir);
+  const listPath = join15(dir, `${routeName}.twig`);
+  const th = cols.map((c) => `                <th>${c.replace(/_/g, " ").replace(/\b\w/g, (ch) => ch.toUpperCase())}</th>`).join("\n");
+  const td = cols.map((c) => `                <td>{{ item.${c} }}</td>`).join("\n");
+  const listContent = `{% extends "base.twig" %}
+{% block title %}${name}s{% endblock %}
+{% block content %}
+<div class="container mt-4">
+    {# tina4:edit  add sort / filter / pagination controls to the list #}
+    <div class="d-flex justify-content-between align-items-center mb-3">
+        <h1>${name}s</h1>
+        <a href="/${routeName}/create" class="btn btn-primary">Add ${name}</a>
+    </div>
+    <table class="table">
+        <thead>
+            <tr>
+                <th>ID</th>
+${th}
+                <th>Actions</th>
+            </tr>
+        </thead>
+        <tbody>
+        {% for item in items %}
+            <tr>
+                <td>{{ item.id }}</td>
+${td}
+                <td>
+                    <a href="/${routeName}/{{ item.id }}" class="btn btn-sm btn-primary">View</a>
+                    <a href="/${routeName}/{{ item.id }}/edit" class="btn btn-sm btn-secondary">Edit</a>
+                </td>
+            </tr>
+        {% endfor %}
+        </tbody>
+    </table>
+</div>
+{% endblock %}
+`;
+  writeFileSafe(listPath, listContent);
+  const detailPath = join15(dir, `${table2}.twig`);
+  const detailFields = cols.map((c) => `    <div class="mb-3"><strong>${c.replace(/_/g, " ").replace(/\b\w/g, (ch) => ch.toUpperCase())}:</strong> {{ item.${c} }}</div>`).join("\n");
+  const detailContent = `{% extends "base.twig" %}
+{% block title %}${name} Detail{% endblock %}
+{% block content %}
+<div class="container mt-4">
+    {# tina4:edit  extend the detail view with related records or actions #}
+    <div class="d-flex justify-content-between align-items-center mb-3">
+        <h1>${name} #{{ item.id }}</h1>
+        <div>
+            <a href="/${routeName}/{{ item.id }}/edit" class="btn btn-secondary">Edit</a>
+            <a href="/${routeName}" class="btn btn-outline-secondary">Back</a>
+        </div>
+    </div>
+${detailFields}
+</div>
+{% endblock %}
+`;
+  writeFileSafe(detailPath, detailContent);
+}
+function generateAuth(_flags) {
+  if (!__resolution.jsonMode) console.log("\n  Generating authentication scaffolding...\n");
+  generateModel("User", { fields: "email:string,password:string,role:string" }, false);
+  const registerDir = resolve6("src/routes/api/auth/register");
+  const loginDir = resolve6("src/routes/api/auth/login");
+  const meDir = resolve6("src/routes/api/auth/me");
+  ensureDir(registerDir);
+  ensureDir(loginDir);
+  ensureDir(meDir);
+  writeFileSafe(
+    join15(registerDir, "post.ts"),
+    `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+import { hashPassword } from "tina4-nodejs";
+import User from "../../../../models/User.js";
+
+// Public: registration mints an account for a user who has no token yet.
+export const secure = false;
+
+export const meta = { summary: "Register a new user", tags: ["auth"] };
+
+export default async function (req: Tina4Request, res: Tina4Response) {
+  // tina4:edit add password-strength / email-format / captcha rules before mint
+  const { email, password } = (req.body ?? {}) as { email?: string; password?: string };
+
+  if (!email || !password) {
+    res.json({ error: "Email and password required" }, 400);
+    return;
+  }
+
+  const existing = await User.selectOne("SELECT * FROM users WHERE email = ?", [email]);
+  if (existing) {
+    res.json({ error: "Email already registered" }, 409);
+    return;
+  }
+
+  const user = new User({ email, password: hashPassword(password), role: "user" });
+  await user.save();
+  res.json({ message: "Registered", id: user.toObject().id }, 201);
+}
+`
+  );
+  writeFileSafe(
+    join15(loginDir, "post.ts"),
+    `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+import { checkPassword, getToken } from "tina4-nodejs";
+import User from "../../../../models/User.js";
+
+// Public: login authenticates by password and mints the token.
+export const secure = false;
+
+export const meta = { summary: "Login and receive JWT token", tags: ["auth"] };
+
+export default async function (req: Tina4Request, res: Tina4Response) {
+  // tina4:edit add rate-limit / lock-after-N-failures / 2FA before password check
+  const { email, password } = (req.body ?? {}) as { email?: string; password?: string };
+
+  if (!email || !password) {
+    res.json({ error: "Email and password required" }, 400);
+    return;
+  }
+
+  const user = await User.selectOne("SELECT * FROM users WHERE email = ?", [email]);
+  if (!user || !checkPassword(password, user.toObject().password as string)) {
+    res.json({ error: "Invalid credentials" }, 401);
+    return;
+  }
+
+  const data = user.toObject();
+  // tina4:edit set token TTL (getToken(payload, secret, expiresInMinutes)) and add scopes if needed
+  const token = getToken({ userId: data.id, email: data.email, role: data.role });
+  res.json({ token });
+}
+`
+  );
+  writeFileSafe(
+    join15(meDir, "get.ts"),
+    `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+import { authenticateRequest } from "tina4-nodejs";
+
+export const meta = { summary: "Get current authenticated user", tags: ["auth"] };
+
+export default async function (req: Tina4Request, res: Tina4Response) {
+  const payload = authenticateRequest(req.headers as Record<string, string | string[] | undefined>);
+  if (!payload) {
+    res.json({ error: "Unauthorized" }, 401);
+    return;
+  }
+  res.json({ user: payload });
+}
+`
+  );
+  const formsDir = resolve6("src/templates/forms");
+  ensureDir(formsDir);
+  writeFileSafe(
+    join15(formsDir, "login.twig"),
+    `{% extends "base.twig" %}
+{% block title %}Login{% endblock %}
+{% block content %}
+<div class="container mt-4" style="max-width:400px">
+    <h1>Login</h1>
+    <form method="post" action="/api/auth/login">
+        {{ form_token() }}
+        <div class="form-group mb-3">
+            <label for="email">Email</label>
+            <input type="email" id="email" name="email" class="form-control" placeholder="you@example.com" required>
+        </div>
+        <div class="form-group mb-3">
+            <label for="password">Password</label>
+            <input type="password" id="password" name="password" class="form-control" placeholder="Password" required>
+        </div>
+        <button type="submit" class="btn btn-primary w-100">Login</button>
+        <p class="mt-3 text-center"><a href="/register">Create an account</a></p>
+    </form>
+</div>
+{% endblock %}
+`
+  );
+  writeFileSafe(
+    join15(formsDir, "register.twig"),
+    `{% extends "base.twig" %}
+{% block title %}Register{% endblock %}
+{% block content %}
+<div class="container mt-4" style="max-width:400px">
+    <h1>Register</h1>
+    <form method="post" action="/api/auth/register">
+        {{ form_token() }}
+        <div class="form-group mb-3">
+            <label for="email">Email</label>
+            <input type="email" id="email" name="email" class="form-control" placeholder="you@example.com" required>
+        </div>
+        <div class="form-group mb-3">
+            <label for="password">Password</label>
+            <input type="password" id="password" name="password" class="form-control" placeholder="Password" minlength="8" required>
+        </div>
+        <button type="submit" class="btn btn-primary w-100">Register</button>
+        <p class="mt-3 text-center"><a href="/login">Already have an account?</a></p>
+    </form>
+</div>
+{% endblock %}
+`
+  );
+  emitAuthTest();
+  if (!__resolution.jsonMode) {
+    console.log("\n  Authentication scaffolding complete.");
+    console.log("  Run: tina4nodejs migrate");
+    console.log("  POST /api/auth/register  \u2014 create account (public)");
+    console.log("  POST /api/auth/login     \u2014 get JWT token (public)");
+    console.log("  GET  /api/auth/me        \u2014 get profile (requires token)");
+  }
+}
+function generateService(name, flags) {
+  const snake = toSnake(name);
+  const camel = toCamel(toPascal(name)) || snake;
+  const cron = flags.cron;
+  const dir = resolve6("src/services");
+  ensureDir(dir);
+  const path8 = join15(dir, `${snake}.ts`);
+  let scheduleField;
+  let note;
+  if (cron && cron !== true) {
+    scheduleField = `  timing: ${JSON.stringify(String(cron))},`;
+    note = `cron '${cron}'`;
+  } else {
+    const seconds = parseEvery(flags.every);
+    scheduleField = `  interval: ${seconds},`;
+    note = `every ${seconds}s`;
+  }
+  const body = aiFill(`${camel}Task`, {
+    intent: "do the scheduled work for this service",
+    given: "context -> ServiceContext (.name, .running, .lastRun)",
+    use: "your ORM / Api / Messenger code (re-run on schedule)",
+    ground: `tina4_context("background service scheduled task", "nodejs") \xB7 skill tina4-developer-nodejs`,
+    raise: `service ${snake} not implemented`
+  });
+  const content = `import type { ServiceContext } from "tina4-nodejs";
+
+/**
+ * ${name} background service \u2014 runs ${note} via ServiceRunner.
+ *
+ * Wire a runner once (e.g. in app.ts) to actually run it \u2014 \`tina4nodejs serve\`
+ * does NOT auto-start services:
+ *
+ *   import { ServiceRunner } from "tina4-nodejs";
+ *   await ServiceRunner.discover("src/services");   // registers this default export
+ *   ServiceRunner.start();
+ */
+
+export async function ${camel}Task(context: ServiceContext): Promise<void> {
+  // tina4:edit replace the AI-FILL stub below with the scheduled work
+${body}}
+
+// Discovered by ServiceRunner.discover("src/services") \u2014 it reads name/handler
+// (+ interval or timing) off this default export.
+export default {
+  name: "${snake}",
+  handler: ${camel}Task,
+${scheduleField}
+};
+`;
+  writeFileSafe(path8, content);
+  emitServiceTest(name, snake, camel);
+}
+function generateQueue(name, _flags) {
+  const topic = name.replace(/^\//, "");
+  const slug = toSnake(topic.replace(/[^0-9a-zA-Z]+/g, "_")).replace(/^_+|_+$/g, "") || "topic";
+  const pascal = toPascal(topic) || "Topic";
+  const dir = resolve6("src/services");
+  ensureDir(dir);
+  const path8 = join15(dir, `${slug}_consumer.ts`);
+  const body = aiFill(`handle${pascal}`, {
+    intent: `process ONE ${topic} job payload`,
+    given: "payload -> the produced job data (job.payload)",
+    use: "your ORM / Messenger code; return to ack (job.complete), throw to nack (job.fail)",
+    ground: `tina4_context("process a queue job", "nodejs") \xB7 skill tina4-developer-nodejs`,
+    raise: `queue ${topic} handler not implemented`
+  });
+  const content = `import { Queue } from "tina4-nodejs";
+import type { ServiceContext } from "tina4-nodejs";
+
+/**
+ * ${topic} queue \u2014 producer + consumer worker.
+ *
+ * Produce from anywhere:  publish${pascal}({ ... })
+ * The consumer is a long-running worker wired as a ServiceRunner daemon:
+ *   await ServiceRunner.discover("src/services"); ServiceRunner.start();
+ */
+
+/** Enqueue a ${topic} job for the worker below to process. Returns the job id. */
+export function publish${pascal}(payload: Record<string, unknown>): string {
+  return new Queue({ topic: "${topic}" }).produce("${topic}", payload);
+}
+
+/** Process ONE ${topic} job payload. */
+export async function handle${pascal}(payload: unknown): Promise<void> {
+  // tina4:edit implement the per-job handler; return to ack, throw to nack
+${body}}
+
+/** Long-running ${topic} worker \u2014 consume() yields jobs; ack/nack each. */
+export async function consume${pascal}(_context?: ServiceContext): Promise<void> {
+  const queue = new Queue({ topic: "${topic}" });
+  for await (const job of queue.consume("${topic}")) {
+    const one = Array.isArray(job) ? job[0] : job;
+    try {
+      await handle${pascal}(one.payload);
+      one.complete();          // ack \u2014 remove from the queue
+    } catch (err) {
+      one.fail(String(err));   // nack \u2014 retry / dead-letter
+    }
+  }
+}
+
+// Discovered by ServiceRunner.discover("src/services"); daemon:true because
+// consume${pascal} owns its own loop. The topic + per-job handle keys let
+// \`tina4nodejs queue work ${topic}\` drive this consumer directly (own the poll
+// loop / bounded --once drain) without wiring a ServiceRunner.
+export default {
+  name: "${topic}-consumer",
+  topic: "${topic}",
+  handler: consume${pascal},
+  handle: handle${pascal},
+  daemon: true,
+};
+`;
+  writeFileSafe(path8, content);
+  emitQueueTest(topic, slug, pascal);
+}
+function generateValidator(name, _flags) {
+  const dir = resolve6("src/validators");
+  ensureDir(dir);
+  const path8 = join15(dir, `${toSnake(name)}.ts`);
+  const rules = extend(
+    "add / adjust the validation rules for this payload",
+    `e.g. .email("email").minLength("name", 2).integer("age"); ground: tina4_context("validate request body with Validator", "nodejs")`
+  );
+  const content = `import { Validator } from "tina4-nodejs";
+
+/**
+ * Validate a ${name} payload. Returns a Validator (chainable rules).
+ *
+ * Usage in a route:
+ *   const v = validate${toPascal(name)}(req.body as Record<string, unknown>);
+ *   if (!v.isValid()) return res.json({ error: v.errors()[0]?.message }, 400);
+ */
+export function validate${toPascal(name)}(data: Record<string, unknown>): Validator {
+  const validator = new Validator(data);
+  // tina4:edit add rules for this payload (.email/.minLength/.integer/.inList/.pattern)
+${rules}  validator.required("name");   // starter rule (matches the model's default field)
+  return validator;
+}
+`;
+  writeFileSafe(path8, content);
+  emitValidatorTest(name, toSnake(name), toPascal(name));
+}
+function generateSeeder(name, _flags) {
+  const table2 = toTableName(name);
+  const dir = resolve6("src/seeds");
+  ensureDir(dir);
+  const path8 = join15(dir, `${table2}_seeder.ts`);
+  const overrides = extend(
+    "override fields that need a specific shape (seedOrm auto-fills the rest)",
+    `e.g. return { email: (f) => f.email(), status: "active" }; ground: tina4_context("seed ORM model with FakeData", "nodejs")`
+  );
+  const content = `import { pathToFileURL } from "node:url";
+import { FakeData, seedOrm, initDatabase } from "tina4-nodejs/orm";
+import ${name} from "../models/${name}.js";
+
+/**
+ * Seeder for ${name} \u2014 run with: tina4nodejs seed
+ *
+ * seedOrm auto-fills every field by type/name; override the ones that need a
+ * specific shape below. Each callable receives a FakeData instance.
+ */
+export function fieldOverrides(fake: FakeData): Record<string, unknown> {
+  // tina4:edit override any fields that need a specific shape (seedOrm auto-fills the rest)
+${overrides}  void fake;   // available for overrides above
+  return {};
+}
+
+/** Seed rows. Invoked when this file is run directly by \`tina4nodejs seed\`. */
+export async function run(): Promise<void> {
+  await initDatabase({ url: process.env.TINA4_DATABASE_URL ?? "sqlite:///data/app.db" });
+  const summary = await seedOrm(${name} as never, 20, fieldOverrides(new FakeData()));
+  console.log(\`Seeded \${summary.seeded} ${name} row(s), \${summary.failed} failed\`);
+}
+
+// Only seed when executed as a script (\`tina4nodejs seed\` runs it via tsx) \u2014
+// importing this module (e.g. in a test) must NOT trigger seeding.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  await run();
+}
+`;
+  writeFileSafe(path8, content);
+  emitSeederTest(name, table2);
+}
+function generateWebsocket(name, _flags) {
+  const raw = name.trim();
+  const wsPath = raw.startsWith("/") ? raw : "/ws/" + raw.replace(/^\/+/, "");
+  let slug = toSnake(raw.replace(/^\/+|\/+$/g, "").replace(/[^0-9a-zA-Z]+/g, "_")).replace(/^_+|_+$/g, "") || "ws";
+  const base = slug.startsWith("ws_") ? slug.slice(3) : slug;
+  const handlerName = `${toCamel(toPascal(base))}Ws`;
+  const dir = resolve6("src/routes");
+  ensureDir(dir);
+  const path8 = join15(dir, `ws_${base}.ts`);
+  const body = aiFill(handlerName, {
+    intent: `handle an inbound "message" frame on ${wsPath}`,
+    given: "data -> the message payload (string); connection -> WebSocketConnection",
+    use: "connection.broadcast(data)  or  connection.sendJson({ ... })",
+    ground: `tina4_context("websocket broadcast message", "nodejs") \xB7 skill tina4-developer-nodejs`,
+    raise: `websocket ${wsPath} not implemented`
+  });
+  const content = `import { websocket } from "tina4-nodejs";
+import type { WebSocketConnection } from "tina4-nodejs";
+
+/**
+ * ${wsPath} WebSocket route.
+ *
+ * Registered on import by websocket(). Node has NO file-based WS
+ * auto-discovery, so IMPORT this module once from app.ts to activate it (add
+ * \`.secure()\` to require a JWT on the upgrade):
+ *
+ *   import "./src/routes/ws_${base}.js";
+ *
+ * The server invokes the handler as (connection, event, data) for each event:
+ * "open" (connect), "message" (inbound frame), "close" (disconnect).
+ */
+export async function ${handlerName}(
+  connection: WebSocketConnection,
+  event: "open" | "message" | "close",
+  data: string,
+): Promise<void> {
+  if (event === "open") {
+    // tina4:edit customize the welcome frame (or drop it)
+    connection.sendJson({ type: "welcome" });
+    return;
+  }
+  if (event === "close") {
+    return;
+  }
+  // event === "message"
+  // tina4:edit handle the inbound "message" frame (broadcast, echo, route, etc.)
+${body}}
+
+websocket("${wsPath}", ${handlerName});
+`;
+  writeFileSafe(path8, content);
+  emitWebsocketTest(wsPath, base, handlerName);
+}
+function generateListener(name, _flags) {
+  const event = name.trim();
+  const slug = toSnake(event.replace(/[^0-9a-zA-Z]+/g, "_")).replace(/^_+|_+$/g, "") || "event";
+  const handlerName = `on${toPascal(slug)}`;
+  const dir = resolve6("src/listeners");
+  ensureDir(dir);
+  const path8 = join15(dir, `${slug}.ts`);
+  const body = aiFill(handlerName, {
+    intent: `react to the '${event}' event`,
+    given: `args -> whatever Events.emit("${event}", ...args) passed`,
+    use: "your app code \u2014 Messenger().send(...), an ORM write, or Events.emit(...) a follow-up",
+    ground: `tina4_context("event listener reaction", "nodejs") \xB7 skill tina4-developer-nodejs`,
+    raise: `listener ${event} not implemented`
+  });
+  const content = `import { Events } from "tina4-nodejs";
+
+/**
+ * Listener for the '${event}' event.
+ *
+ * Registered on import by Events.on(). Node has NO src/listeners/
+ * auto-discovery, so IMPORT this module once from app.ts to activate it:
+ *
+ *   import "./src/listeners/${slug}.js";
+ *
+ * Fires when something calls Events.emit("${event}", ...args).
+ */
+export function ${handlerName}(...args: unknown[]): void {
+  // tina4:edit implement the reaction to '${event}' (email, ORM write, follow-up emit)
+${body}}
+
+Events.on("${event}", ${handlerName});
+`;
+  writeFileSafe(path8, content);
+  emitListenerTest(event, slug);
+}
+function writeTest(testName, content) {
+  const dir = resolve6("tests");
+  ensureDir(dir);
+  writeFileSafe(join15(dir, `${testName}.test.ts`), content);
+}
+function standaloneTest(doc, body) {
+  return `${doc}
+
+let pass = 0;
+let fail = 0;
+function assert(label: string, ok: boolean): void {
+  if (ok) { pass++; console.log(\`  PASS \${label}\`); }
+  else { fail++; console.log(\`  FAIL \${label}\`); }
+}
+async function assertThrows(label: string, fn: () => unknown | Promise<unknown>): Promise<void> {
+  try { await fn(); assert(label, false); }
+  catch { assert(label, true); }
+}
+
+${body}
+
+console.log(\`\\nResults: \${pass} passed, \${fail} failed\`);
+process.exit(fail > 0 ? 1 : 0);
+`;
+}
+function sampleLiteral(fieldType) {
+  switch ((fieldType || "string").toLowerCase()) {
+    case "int":
+    case "integer":
+      return "1";
+    case "float":
+    case "number":
+    case "numeric":
+    case "decimal":
+      return "1.5";
+    case "bool":
+    case "boolean":
+      return "true";
+    case "datetime":
+      return '"2020-01-01 00:00:00"';
+    case "blob":
+      return '"x"';
+    default:
+      return '"sample"';
+  }
+}
+function emitModelTest(model, table2, fields) {
+  const flds = fields.length > 0 ? fields : DEFAULT_FIELDS.map(([f, t]) => [f, t]);
+  const payload = flds.map(([f, t]) => `${f}: ${sampleLiteral(t)}`).join(", ");
+  const stringField = flds.find(([, t]) => ["string", "str", "text"].includes((t || "string").toLowerCase()))?.[0];
+  const valueAssert = stringField ? `
+assert("string field round-trips", fetched !== null && (fetched.toObject() as Record<string, unknown>).${stringField} === "sample");` : "";
+  const doc = `/**
+ * Real ORM roundtrip for ${model} \u2014 no mocks, real SQLite.
+ *
+ * Generated with src/models/${model}.ts by \`tina4nodejs generate model
+ * ${model}\`. The model scaffold is working code, so this passes on generation:
+ * binds a real in-memory SQLite DB, creates the table, saves a row, reads it
+ * back. Run with: npx tsx tests/${table2}_model.test.ts
+ */
+import ${model} from "../src/models/${model}.js";
+import { initDatabase } from "tina4-nodejs/orm";`;
+  const body = `await initDatabase({ url: "sqlite:///:memory:" });
+await ${model}.createTable();
+
+const row = new ${model}({ ${payload} });
+const saved = await row.save();
+assert("create() persists and returns the row", saved !== false && Boolean(row.toObject().id));
+
+const id = row.toObject().id;
+const fetched = await ${model}.selectOne("SELECT * FROM ${table2} WHERE id = ?", [id]);
+assert("row reads back by id", fetched !== null);
+assert("read-back id matches", fetched !== null && (fetched.toObject() as Record<string, unknown>).id === id);${valueAssert}
+
+const missing = await ${model}.selectOne("SELECT * FROM ${table2} WHERE id = ?", [999999]);
+assert("find missing returns null", missing === null);`;
+  writeTest(`${table2}_model`, standaloneTest(doc, body));
+}
+function emitRouteStubTest(route) {
+  const doc = `/**
+ * Routing test for ${route} \u2014 no mocks, real Router + route discovery.
+ *
+ * Generated with src/routes/api/${route}/ by \`tina4nodejs generate route
+ * ${route}\` (no --model). The handlers are AI-FILL stubs that throw until you
+ * implement them, so this tests what IS live on generation: all five routes
+ * register on the REAL Router, and the list handler fails loud until filled.
+ * Run with: npx tsx tests/${route}.test.ts
+ */
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Router, discoverRoutes } from "tina4-nodejs";
+import listHandler from "../src/routes/api/${route}/get.js";`;
+  const body = `const here = dirname(fileURLToPath(import.meta.url));
+const router = new Router();
+const defs = await discoverRoutes(resolve(here, "../src/routes"));
+for (const def of defs) router.addRoute(def);
+
+const sigs = defs.map((d) => \`\${d.method} \${d.pattern}\`);
+for (const sig of ["GET /api/${route}", "POST /api/${route}", "GET /api/${route}/{id}", "PUT /api/${route}/{id}", "DELETE /api/${route}/{id}"]) {
+  assert(\`route registered: \${sig}\`, sigs.includes(sig));
+}
+
+// The scaffolded list handler is a loud AI-FILL stub \u2014 it throws until filled.
+await assertThrows("list handler is a live stub (throws until filled)",
+  () => listHandler({} as never, {} as never));`;
+  writeTest(route, standaloneTest(doc, body));
+}
+function emitMiddlewareTest(name, snake) {
+  const doc = `/**
+ * Real dispatch test for the ${name} middleware \u2014 no mocks.
+ *
+ * Generated with src/middleware/${snake}.ts by \`tina4nodejs generate middleware
+ * ${name}\`. Drives the scaffolded before/after functions through the REAL
+ * MiddlewareChain with a real Tina4Request/Response (built from real node http
+ * objects) \u2014 the same continuation dispatch the live server runs.
+ * Run with: npx tsx tests/${snake}.test.ts
+ */
+import { IncomingMessage, ServerResponse } from "node:http";
+import { Socket } from "node:net";
+import { MiddlewareChain, createRequest, createResponse } from "tina4-nodejs";
+import type { Tina4Request, Tina4Response } from "tina4-nodejs";
+import { before${name}, after${name} } from "../src/middleware/${snake}.js";`;
+  const body = `function realPair(headers: Record<string, string>): { req: Tina4Request; res: Tina4Response; raw: ServerResponse } {
+  const socket = new Socket();
+  const rawReq = new IncomingMessage(socket);
+  rawReq.method = "GET";
+  rawReq.url = "/";
+  rawReq.headers = { ...headers, host: "localhost" };
+  rawReq.push(null);
+  const rawRes = new ServerResponse(rawReq);
+  rawRes.write = (() => true) as typeof rawRes.write;
+  rawRes.end = (function (this: ServerResponse) { return this; }) as typeof rawRes.end;
+  return { req: createRequest(rawReq), res: createResponse(rawRes), raw: rawRes };
+}
+
+// before(): blocks an unauthenticated request (401, does not call next()).
+{
+  const chain = new MiddlewareChain();
+  chain.use(before${name});
+  let reached = false;
+  chain.use(async (_r, _s, next) => { reached = true; next(); });
+  const { req, res, raw } = realPair({});
+  await chain.run(req, res);
+  assert("before blocks unauthenticated (401, chain short-circuits)", raw.statusCode === 401 && reached === false);
+}
+
+// before(): lets an authenticated request through to the next middleware.
+{
+  const chain = new MiddlewareChain();
+  chain.use(before${name});
+  let reached = false;
+  chain.use(async (_r, _s, next) => { reached = true; next(); });
+  const { req, res } = realPair({ authorization: "Bearer test" });
+  await chain.run(req, res);
+  assert("before passes an authenticated request through", reached === true);
+}
+
+// after(): always continues the chain.
+{
+  const chain = new MiddlewareChain();
+  chain.use(after${name});
+  let reached = false;
+  chain.use(async (_r, _s, next) => { reached = true; next(); });
+  const { req, res } = realPair({});
+  await chain.run(req, res);
+  assert("after runs and continues the chain", reached === true);
+}`;
+  writeTest(snake, standaloneTest(doc, body));
+}
+function emitServiceTest(name, snake, camel) {
+  const doc = `/**
+ * Real ServiceRunner test for the ${name} service \u2014 no mocks.
+ *
+ * Generated with src/services/${snake}.ts by \`tina4nodejs generate service
+ * ${name}\`. Registers the scaffold on a REAL ServiceRunner and confirms the
+ * descriptor; the task body is an AI-FILL stub that throws until filled.
+ * Run with: npx tsx tests/${snake}.test.ts
+ */
+import { ServiceRunner } from "tina4-nodejs";
+import service, { ${camel}Task } from "../src/services/${snake}.js";`;
+  const body = `assert("descriptor has a name + callable handler",
+  service.name === "${snake}" && typeof service.handler === "function");
+
+// Register on a REAL ServiceRunner and confirm it is listed.
+ServiceRunner.register(service.name, service.handler, { interval: (service as { interval?: number }).interval });
+assert("registers on a real ServiceRunner", ServiceRunner.list().some((s) => s.name === "${snake}"));
+ServiceRunner.remove("${snake}");
+
+// The scaffolded task body is an AI-FILL stub \u2014 it throws until filled.
+await assertThrows("task is a live stub (throws until filled)", () => ${camel}Task({} as never));`;
+  writeTest(snake, standaloneTest(doc, body));
+}
+function emitQueueTest(topic, slug, pascal) {
+  const doc = `/**
+ * Real file-backed Queue test for the ${topic} worker \u2014 no mocks.
+ *
+ * Generated with src/services/${slug}_consumer.ts by \`tina4nodejs generate
+ * queue ${topic}\`. Pushes a REAL job onto the real file-backed Queue and
+ * asserts it is enqueued, and that the consumer is wired as a daemon. The
+ * per-job handle is an AI-FILL stub that throws until filled.
+ * Run with: npx tsx tests/${slug}.test.ts
+ */
+import { Queue } from "tina4-nodejs";
+import worker, { publish${pascal}, handle${pascal} } from "../src/services/${slug}_consumer.js";`;
+  const body = `const jobId = publish${pascal}({ hello: "world" });
+assert("publish enqueues a real job (returns an id)", typeof jobId === "string" && jobId.length > 0);
+assert("the job is really on the queue", new Queue({ topic: "${topic}" }).size() >= 1);
+
+assert("consumer default export is a daemon", worker.daemon === true);
+assert("consumer handler is wired", typeof worker.handler === "function");
+
+// The per-job handler is an AI-FILL stub \u2014 it throws until filled.
+await assertThrows("handle is a live stub (throws until filled)", () => handle${pascal}({}));`;
+  writeTest(slug, standaloneTest(doc, body));
+}
+function emitValidatorTest(name, snake, pascal) {
+  const doc = `/**
+ * Real validation test for validate${pascal} \u2014 no mocks.
+ *
+ * Generated with src/validators/${snake}.ts by \`tina4nodejs generate validator
+ * ${name}\`. The scaffold ships a starter rule (required "name"), so this passes
+ * on generation \u2014 adjust the rules for your payload and update these cases.
+ * Run with: npx tsx tests/${snake}.test.ts
+ */
+import { validate${pascal} } from "../src/validators/${snake}.js";`;
+  const body = `assert("valid input passes", validate${pascal}({ name: "Ada" }).isValid());
+
+const bad = validate${pascal}({});
+assert("invalid input fails", bad.isValid() === false);
+assert("invalid input reports errors", bad.errors().length > 0);`;
+  writeTest(snake, standaloneTest(doc, body));
+}
+function emitSeederTest(model, table2) {
+  const doc = `/**
+ * Real seeding test for the ${model} seeder \u2014 no mocks, real SQLite.
+ *
+ * Generated with src/seeds/${table2}_seeder.ts by \`tina4nodejs generate seeder
+ * ${model}\`. Binds a real SQLite DB, creates the table, runs the scaffolded
+ * seeder (auto-fills every field via FakeData) and asserts rows were created.
+ * Run with: npx tsx tests/${table2}_seeder.test.ts
+ */
+import { initDatabase, FakeData } from "tina4-nodejs/orm";
+import ${model} from "../src/models/${model}.js";
+import { fieldOverrides, run } from "../src/seeds/${table2}_seeder.js";`;
+  const body = `process.env.TINA4_DATABASE_URL = "sqlite:///test_${table2}_seeder.db";
+await initDatabase({ url: process.env.TINA4_DATABASE_URL });
+await ${model}.createTable();
+
+assert("fieldOverrides returns an object", typeof fieldOverrides(new FakeData()) === "object");
+
+await run();   // run() re-binds the same DB URL and seeds via seedOrm
+const rows = await ${model}.all();
+assert("run() seeds real rows", rows.length >= 1);`;
+  writeTest(`${table2}_seeder`, standaloneTest(doc, body));
+}
+function emitWebsocketTest(wsPath, base, handler) {
+  const doc = `/**
+ * Real handler test for the ${wsPath} WebSocket route \u2014 no mocks.
+ *
+ * Generated with src/routes/ws_${base}.ts by \`tina4nodejs generate websocket
+ * ...\`. Confirms the handler registers on the REAL Router (importing runs the
+ * module-level websocket() call) and drives the real handler for the "close"
+ * event (no socket needed). The "message" branch is an AI-FILL stub that throws
+ * until filled. Run with: npx tsx tests/ws_${base}.test.ts
+ */
+import { Router } from "tina4-nodejs";
+import { ${handler} } from "../src/routes/ws_${base}.js";  // importing registers via websocket()`;
+  const body = `assert("handler registered on the real router",
+  Router.getWebSocketRoutes().some((r) => r.pattern === "${wsPath}"));
+
+// The "close" branch returns cleanly without a live connection.
+const closed = await ${handler}(null as never, "close", "");
+assert("close event handled cleanly", closed === undefined);
+
+// The "message" branch is an AI-FILL stub \u2014 it throws until filled.
+await assertThrows("message branch is a live stub (throws until filled)",
+  () => ${handler}(null as never, "message", "hi"));`;
+  writeTest(`ws_${base}`, standaloneTest(doc, body));
+}
+function emitListenerTest(event, slug) {
+  const doc = `/**
+ * Real event-bus test for the '${event}' listener \u2014 no mocks.
+ *
+ * Generated with src/listeners/${slug}.ts by \`tina4nodejs generate listener
+ * ${event}\`. Confirms the listener binds on the REAL event bus (importing runs
+ * the module-level Events.on) and that emitting the event reaches it. The
+ * reaction body is an AI-FILL stub, so a strict emit re-raises here (proving it
+ * ran). Run with: npx tsx tests/${slug}.test.ts
+ */
+import { Events } from "tina4-nodejs";
+import "../src/listeners/${slug}.js";  // importing registers the listener via Events.on()`;
+  const body = `assert("listener registered on the real event bus", Events.listeners("${event}").length >= 1);
+
+// strict emit re-raises the stub error, proving the listener actually ran.
+await assertThrows("emitting the event reaches the (stub) listener",
+  () => Events.emit("${event}", { strict: true }, { id: 1 }));`;
+  writeTest(slug, standaloneTest(doc, body));
+}
+function emitAuthTest() {
+  const doc = `/**
+ * Real auth test \u2014 register / login / me via the real TestClient.
+ *
+ * Generated with the auth scaffold by \`tina4nodejs generate auth\`. No mocks:
+ * real Router + route discovery, real Auth (PBKDF2 + JWT), real SQLite. register
+ * + login are public; the token from login authenticates GET /api/auth/me.
+ * Run with: npx tsx tests/auth.test.ts
+ */
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { Router, TestClient, discoverRoutes } from "tina4-nodejs";
+import { initDatabase } from "tina4-nodejs/orm";
+import User from "../src/models/User.js";
+
+process.env.TINA4_SECRET = process.env.TINA4_SECRET ?? "test-secret";
+delete process.env.TINA4_API_KEY;
+const here = dirname(fileURLToPath(import.meta.url));`;
+  const body = `await initDatabase({ url: "sqlite:///test_auth.db" });
+await User.createTable();
+for (const existing of await User.all()) await existing.delete();   // start from an empty table
+
+const router = new Router();
+for (const def of await discoverRoutes(resolve(here, "../src/routes"))) router.addRoute(def);
+const client = new TestClient(router);
+
+const registered = await client.post("/api/auth/register", { json: { email: "a@b.c", password: "secret12" } });
+assert("register a new user -> 201", registered.status === 201);
+
+const duplicate = await client.post("/api/auth/register", { json: { email: "a@b.c", password: "secret12" } });
+assert("duplicate register -> 409", duplicate.status === 409);
+
+const login = await client.post("/api/auth/login", { json: { email: "a@b.c", password: "secret12" } });
+assert("login -> 200", login.status === 200);
+const token = (login.json() as { token?: string }).token;
+assert("login returns a token", typeof token === "string" && token.length > 0);
+
+const me = await client.get("/api/auth/me", { headers: { authorization: \`Bearer \${token}\` } });
+assert("authenticated GET /api/auth/me -> 200 (token accepted)", me.status === 200);
+assert("me returns the authenticated user's email",
+  ((me.json() as { user?: { email?: string } }).user?.email) === "a@b.c");
+
+const anon = await client.get("/api/auth/me");
+assert("anonymous GET /api/auth/me -> 401", anon.status === 401);
+
+const bad = await client.post("/api/auth/login", { json: { email: "a@b.c", password: "WRONG" } });
+assert("wrong password -> 401", bad.status === 401);`;
+  writeTest("auth", standaloneTest(doc, body));
+}
+function emitMigrationTest(migrationName, table2) {
+  const doc = `/**
+ * Real migration test for ${migrationName} \u2014 no mocks, real SQLite.
+ *
+ * Generated with the migration by \`tina4nodejs generate migration
+ * ${migrationName}\`. Applies the generated UP SQL against a fresh real
+ * in-memory SQLite database and asserts the table exists, then applies the DOWN
+ * SQL and asserts it is gone \u2014 the raw SQL the migration runner executes.
+ * Run with: npx tsx tests/${table2}_migration.test.ts
+ */
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { readdirSync, readFileSync } from "node:fs";
+import { SQLiteAdapter } from "tina4-nodejs/orm";`;
+  const body = `const here = dirname(fileURLToPath(import.meta.url));
+const migrationsDir = resolve(here, "../migrations");
+
+const upFile = readdirSync(migrationsDir).find((f) => f.endsWith("_${migrationName}.sql") && !f.endsWith(".down.sql"));
+assert("generated UP migration file exists", Boolean(upFile));
+const downFile = upFile!.replace(/\\.sql$/, ".down.sql");
+
+function statements(sql: string): string[] {
+  const noComments = sql.split("\\n").filter((l) => !l.trim().startsWith("--")).join("\\n");
+  return noComments.split(";").map((s) => s.trim()).filter(Boolean);
+}
+
+const upText = readFileSync(join(migrationsDir, upFile!), "utf-8");
+const upSql = upText.split("-- UP")[1].split("-- DOWN")[0];
+const downSql = readFileSync(join(migrationsDir, downFile), "utf-8");
+
+const db = new SQLiteAdapter(":memory:");
+for (const stmt of statements(upSql)) db.execute(stmt);
+assert("UP creates the ${table2} table", db.tableExists("${table2}"));
+
+for (const stmt of statements(downSql)) db.execute(stmt);
+assert("DOWN drops the ${table2} table", db.tableExists("${table2}") === false);`;
+  writeTest(`${table2}_migration`, standaloneTest(doc, body));
+}
+var FIELD_TYPE_MAP, SQL_RESERVED_TABLE_NAMES, RESOLUTION_ENVELOPE_VERSION, __resolution, TINA4_EDIT_MARKER, DEFAULT_FIELDS, GENERATORS, GENERATOR_LIST, NEXT_STEPS;
+var init_generate = __esm({
+  "../cli/src/commands/generate.ts"() {
+    "use strict";
+    FIELD_TYPE_MAP = {
+      string: { orm: '"string"', sql: "TEXT", defaultVal: "''" },
+      str: { orm: '"string"', sql: "TEXT", defaultVal: "''" },
+      int: { orm: '"integer"', sql: "INTEGER", defaultVal: "0" },
+      integer: { orm: '"integer"', sql: "INTEGER", defaultVal: "0" },
+      float: { orm: '"number"', sql: "REAL", defaultVal: "0" },
+      number: { orm: '"number"', sql: "REAL", defaultVal: "0" },
+      numeric: { orm: '"number"', sql: "REAL", defaultVal: "0" },
+      decimal: { orm: '"number"', sql: "REAL", defaultVal: "0" },
+      bool: { orm: '"boolean"', sql: "INTEGER", defaultVal: "0" },
+      boolean: { orm: '"boolean"', sql: "INTEGER", defaultVal: "0" },
+      text: { orm: '"string"', sql: "TEXT", defaultVal: "''" },
+      datetime: { orm: '"datetime"', sql: "TEXT", defaultVal: "NULL" },
+      blob: { orm: '"string"', sql: "BLOB", defaultVal: "NULL" }
+    };
+    SQL_RESERVED_TABLE_NAMES = /* @__PURE__ */ new Set([
+      "order",
+      "group",
+      "user",
+      "table",
+      "select",
+      "from",
+      "where",
+      "index",
+      "key",
+      "values",
+      "column",
+      "constraint",
+      "check",
+      "default",
+      "primary",
+      "foreign",
+      "references",
+      "unique",
+      "join",
+      "union",
+      "having",
+      "limit",
+      "offset",
+      "desc",
+      "asc",
+      "case",
+      "when",
+      "then",
+      "else",
+      "end",
+      "and",
+      "or",
+      "not",
+      "null",
+      "insert",
+      "update",
+      "delete",
+      "create",
+      "drop",
+      "alter",
+      "grant",
+      "revoke",
+      "commit",
+      "rollback",
+      "view",
+      "trigger",
+      "procedure",
+      "function",
+      "database",
+      "schema",
+      "session",
+      "set",
+      "into",
+      "as",
+      "on",
+      "by",
+      "inner",
+      "outer",
+      "left",
+      "right",
+      "full",
+      "natural",
+      "using",
+      "with",
+      "distinct",
+      "between",
+      "exists",
+      "like",
+      "in",
+      "is",
+      "all",
+      "any",
+      "cross",
+      "add",
+      "row",
+      "rows",
+      "range",
+      "current",
+      "to"
+    ]);
+    RESOLUTION_ENVELOPE_VERSION = "generate_v1_1";
+    __resolution = {
+      target: "",
+      input: { name: "", fields: null },
+      body: { transformations: [] },
+      actionsTaken: [],
+      dryRun: false,
+      jsonMode: false
+    };
+    TINA4_EDIT_MARKER = /^\s*(?:\/\/|--|\{#|#)\s*tina4:edit\s+(.+?)(?:\s*#\})?\s*$/;
+    DEFAULT_FIELDS = [["name", "string"]];
+    GENERATORS = {
+      model: { handler: generateModel, usage: '<Name> [--fields "name:string,price:float"]', summary: "ORM model + matching migration" },
+      route: { handler: generateRoute, usage: "<name> [--model Name] [--public]", summary: "CRUD route file, secure by default (--public opens writes)" },
+      crud: { handler: generateCrud, usage: '<Name> [--fields "..."] [--public]', summary: "Model + migration + routes + form + view + test" },
+      migration: { handler: (n, f) => generateMigration(n, f, void 0, void 0, !f["no-test"]), usage: "<description>", summary: "Timestamped migration file (UP/DOWN)" },
+      middleware: { handler: generateMiddleware, usage: "<Name>", summary: "Middleware with before/after hooks" },
+      test: { handler: generateTest, usage: "<name> [--model Name]", summary: "Test file" },
+      form: { handler: generateForm, usage: '<Name> [--fields "..."]', summary: "Form template with inputs matching model fields" },
+      view: { handler: generateView, usage: '<Name> [--fields "..."]', summary: "List + detail view templates" },
+      auth: { handler: (_n, f) => generateAuth(f), usage: "", summary: "Login/register routes (public) + User model + templates" },
+      service: { handler: generateService, usage: '<Name> [--every 5m | --cron "..."]', summary: "Scheduled ServiceRunner task (src/services/)" },
+      queue: { handler: generateQueue, usage: "<topic>", summary: "Producer + consumer daemon worker (src/services/)" },
+      validator: { handler: generateValidator, usage: "<Name>", summary: "Request-body Validator (src/validators/)" },
+      seeder: { handler: generateSeeder, usage: "<Model>", summary: "FakeData + seedOrm seeder (src/seeds/)" },
+      websocket: { handler: generateWebsocket, usage: "<path>", summary: "websocket() handler (src/routes/)" },
+      listener: { handler: generateListener, usage: "<event>", summary: "Events.on(event) listener (src/listeners/)" }
+    };
+    GENERATOR_LIST = Object.keys(GENERATORS).join(", ");
+    NEXT_STEPS = {
+      model: ({ name, table: table2 }) => [
+        `Edit src/models/${name}.ts to add fields beyond the default 'name'`,
+        `Apply the migration:   npx tina4nodejs migrate`,
+        `Run its test:          npx tsx tests/${table2}_model.test.ts`,
+        `Add CRUD scaffolding:  npx tina4nodejs generate crud ${name}`
+      ],
+      route: ({ name, table: table2 }) => [
+        `Fill the AI-FILL stubs in src/routes/api/${name.replace(/^\//, "")}/`,
+        `Run its test:   npx tsx tests/${table2}.test.ts`,
+        `Serve and try:  npx tina4nodejs serve  ->  curl http://localhost:7148/api/${name.replace(/^\//, "")}`
+      ],
+      crud: ({ name, table: table2 }) => [
+        `Apply the migration:   npx tina4nodejs migrate`,
+        `Serve and try:         npx tina4nodejs serve  ->  visit /swagger`,
+        `Run the gate test:     npx tsx tests/${toPlural(table2)}.test.ts`,
+        `Change fields: edit src/models/${name}.ts then re-run generate crud`
+      ],
+      migration: () => [
+        `Apply pending migrations:  npx tina4nodejs migrate`,
+        `Check status:              npx tina4nodejs migrate:status`,
+        `Roll back the batch:       npx tina4nodejs migrate:rollback`
+      ],
+      middleware: ({ name }) => [
+        `Wire it: router.middleware(before${name}, after${name}) \u2014 or bind per-route`,
+        `Run its test:  npx tsx tests/${toSnake(name)}.test.ts`
+      ],
+      test: ({ name }) => [
+        `Fill the TODOs in tests/${toSnake(name)}.test.ts`,
+        `Run it:  npx tsx tests/${toSnake(name)}.test.ts`
+      ],
+      form: ({ name, table: table2 }) => [
+        `Render from a route:  res.render("forms/${table2}.twig", { item })`,
+        `Add the POST route:   npx tina4nodejs generate route ${toPlural(table2)} --model ${name}`
+      ],
+      view: ({ table: table2 }) => [
+        `Wire routes to render list -> ${toPlural(table2)}.twig, detail -> ${table2}.twig`,
+        `Customize the templates in src/templates/pages/`
+      ],
+      auth: () => [
+        `Apply the migration:  npx tina4nodejs migrate`,
+        `Run the auth test:    npx tsx tests/auth.test.ts`,
+        `Try register:  curl -X POST http://localhost:7148/api/auth/register -d '{"email":"a@b.c","password":"secret12"}' -H 'content-type: application/json'`,
+        `Login:         curl -X POST http://localhost:7148/api/auth/login    -d '{"email":"a@b.c","password":"secret12"}' -H 'content-type: application/json'`
+      ],
+      service: ({ name }) => [
+        `Wire ServiceRunner in app.ts: await ServiceRunner.discover("src/services"); ServiceRunner.start();`,
+        `Fill the task body in src/services/${toSnake(name)}.ts`,
+        `Run its test:  npx tsx tests/${toSnake(name)}.test.ts`
+      ],
+      queue: ({ name }) => {
+        const slug = toSnake(name.replace(/[^0-9a-zA-Z]+/g, "_")).replace(/^_+|_+$/g, "") || "topic";
+        return [
+          `Fill handle${toPascal(name)}() in src/services/${slug}_consumer.ts`,
+          `Produce a job:  publish${toPascal(name)}({ ... })`,
+          `Run the worker: npx tina4nodejs queue work ${name}`,
+          `Run its test:   npx tsx tests/${slug}.test.ts`
+        ];
+      },
+      validator: ({ name }) => [
+        `Add rules in src/validators/${toSnake(name)}.ts (.email/.minLength/.integer/.inList/.pattern)`,
+        `Run its test:  npx tsx tests/${toSnake(name)}.test.ts`
+      ],
+      seeder: ({ name, table: table2 }) => [
+        `Override any fields that need a specific shape in src/seeds/${table2}_seeder.ts`,
+        `Seed the table:  npx tina4nodejs seed`,
+        `Run its test:    npx tsx tests/${table2}_seeder.test.ts`
+      ],
+      websocket: ({ name }) => {
+        const raw = name.trim();
+        const slugRaw = toSnake(raw.replace(/^\/+|\/+$/g, "").replace(/[^0-9a-zA-Z]+/g, "_")).replace(/^_+|_+$/g, "") || "ws";
+        const base = slugRaw.startsWith("ws_") ? slugRaw.slice(3) : slugRaw;
+        return [
+          `Import once in app.ts to register:  import "./src/routes/ws_${base}.js";`,
+          `Fill the "message" branch in src/routes/ws_${base}.ts`,
+          `Run its test:  npx tsx tests/ws_${base}.test.ts`
+        ];
+      },
+      listener: ({ name }) => {
+        const slug = toSnake(name.replace(/[^0-9a-zA-Z]+/g, "_")).replace(/^_+|_+$/g, "") || "event";
+        return [
+          `Import once in app.ts to register:  import "./src/listeners/${slug}.js";`,
+          `Fill the reaction in src/listeners/${slug}.ts`,
+          `Run its test:  npx tsx tests/${slug}.test.ts`
+        ];
+      }
+    };
+  }
+});
+
 // ../core/src/mcp.ts
 var mcp_exports = {};
 __export(mcp_exports, {
@@ -13182,10 +15241,10 @@ function registerDevTools(server) {
     "swagger_spec",
     (_args) => {
       try {
-        const { generate: generate2 } = reqSibling("swagger");
+        const { generate: generate3 } = reqSibling("swagger");
         const { defaultRouter: defaultRouter2 } = req("./router.js");
         const routes = defaultRouter2?.getRoutes?.() ?? [];
-        return generate2?.(routes, []) ?? { info: "Swagger not available" };
+        return generate3?.(routes, []) ?? { info: "Swagger not available" };
       } catch (e) {
         return { error: e.message };
       }
@@ -13344,20 +15403,43 @@ function registerDevTools(server) {
   );
   server.registerTool(
     "migration_create",
-    (args) => {
-      const desc = args.description.replace(/\s+/g, "_").toLowerCase();
-      const migrationsDir = path3.join(projectRoot3, "migrations");
-      if (!fs4.existsSync(migrationsDir)) {
-        fs4.mkdirSync(migrationsDir, { recursive: true });
-      }
-      const existing = fs4.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql"));
-      const nextNum = String(existing.length + 1).padStart(6, "0");
-      const filename = `${nextNum}_${desc}.sql`;
-      fs4.writeFileSync(path3.join(migrationsDir, filename), `-- Migration: ${args.description}
-`, "utf-8");
-      return { created: filename };
+    async (args) => {
+      try {
+        const rawDesc = String(args.description ?? "").trim();
+        if (!rawDesc) return { ok: false, error: "description is required" };
+        const slug = rawDesc.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "");
+        if (!slug) return { ok: false, error: "description sanitised to an empty slug" };
+        const migrationsDir = path3.join(projectRoot3, "migrations");
+        if (fs4.existsSync(migrationsDir)) {
+          const upSuffix = `_${slug}.sql`;
+          const downSuffix = `_${slug}.down.sql`;
+          const existing = fs4.readdirSync(migrationsDir).filter(
+            (f) => f.endsWith(upSuffix) && !f.endsWith(downSuffix) || f.endsWith(downSuffix)
+          );
+          if (existing.length > 0) {
+            return {
+              ok: false,
+              error: `A migration with slug "${slug}" already exists`,
+              existing
+            };
+          }
+        }
+        const originalCwd = process.cwd();
+        try {
+          process.chdir(projectRoot3);
+          const gen = await Promise.resolve().then(() => (init_generate(), generate_exports));
+          const envelope = await gen.generateProgrammatic("migration", slug, ["--no-test"]);
+          const migrationPath = envelope.resolution?.migration_path;
+          const created = migrationPath ? path3.basename(migrationPath) : "";
+          return { ok: true, created, resolution: envelope };
+        } finally {
+          process.chdir(originalCwd);
+        }
+      } catch (e) {
+        return { ok: false, error: e.message };
+      }
     },
-    "Create a new migration file",
+    "Create a new migration file (delegates to `generate migration` \u2014 emits the ADR-0063 generate_v1_1 envelope + timestamped filename)",
     schemaFromParams([{ name: "description", type: "string" }])
   );
   server.registerTool(
@@ -14125,14 +16207,14 @@ data: ${channel.buffer.shift()}
 `;
               continue;
             }
-            const gotMessage = await new Promise((resolve20) => {
+            const gotMessage = await new Promise((resolve21) => {
               const timer = setTimeout(() => {
                 channel.wake = null;
-                resolve20(false);
+                resolve21(false);
               }, keepaliveMs);
               channel.wake = () => {
                 clearTimeout(timer);
-                resolve20(true);
+                resolve21(true);
               };
             });
             if (!gotMessage) yield `: keep-alive
@@ -15451,8 +17533,8 @@ __export(context_exports, {
   fts5Supported: () => fts5Supported
 });
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-import { existsSync as existsSync14, mkdirSync as mkdirSync9, readFileSync as readFileSync13, readdirSync as readdirSync7, realpathSync as realpathSync5 } from "node:fs";
-import { basename as basename4, dirname as dirname8, extname as extname4, isAbsolute as isAbsolute4, join as join16, relative as relative3, resolve as resolve7 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync10, readFileSync as readFileSync13, readdirSync as readdirSync7, realpathSync as realpathSync5 } from "node:fs";
+import { basename as basename4, dirname as dirname8, extname as extname4, isAbsolute as isAbsolute4, join as join17, relative as relative4, resolve as resolve8 } from "node:path";
 function fts5Supported() {
   try {
     const conn = new DatabaseSync2(":memory:");
@@ -15475,13 +17557,13 @@ function realResolve(abs) {
   } catch {
   }
   try {
-    return join16(realpathSync5(dirname8(abs)), basename4(abs));
+    return join17(realpathSync5(dirname8(abs)), basename4(abs));
   } catch {
     return abs;
   }
 }
 function dbKey(db) {
-  return resolve7(db ? String(db) : join16(process.cwd(), ".tina4", "context.db"));
+  return resolve8(db ? String(db) : join17(process.cwd(), ".tina4", "context.db"));
 }
 function defaultContext(root, db) {
   const key = dbKey(db);
@@ -15565,7 +17647,7 @@ var init_context = __esm({
         if (!this.available) return;
         const parent = dirname8(this.path);
         if (parent !== "" && parent !== ".") {
-          mkdirSync9(parent, { recursive: true });
+          mkdirSync10(parent, { recursive: true });
         }
         this.conn = new DatabaseSync2(this.path);
         this.ensureTable();
@@ -15637,7 +17719,7 @@ var init_context = __esm({
        */
       indexRoot(root) {
         if (!this.available) return 0;
-        const rootAbs = realResolve(resolve7(String(root)));
+        const rootAbs = realResolve(resolve8(String(root)));
         this.root = rootAbs;
         let total = 0;
         const walk2 = (dir) => {
@@ -15654,11 +17736,11 @@ var init_context = __esm({
           files.sort();
           for (const fn of files) {
             if (!_Context.eligible(fn)) continue;
-            const full = join16(dir, fn);
-            const rel = relative3(rootAbs, full);
+            const full = join17(dir, fn);
+            const rel = relative4(rootAbs, full);
             total += this.indexPath(full, rel);
           }
-          for (const d of subdirs) walk2(join16(dir, d));
+          for (const d of subdirs) walk2(join17(dir, d));
         };
         walk2(rootAbs);
         return total;
@@ -15674,9 +17756,9 @@ var init_context = __esm({
       reindexFile(changedPath) {
         if (!this.available || this.root === null) return -1;
         const raw = String(changedPath);
-        const abs = isAbsolute4(raw) ? raw : join16(process.cwd(), raw);
-        const resolved = realResolve(resolve7(abs));
-        const rel = relative3(this.root, resolved);
+        const abs = isAbsolute4(raw) ? raw : join17(process.cwd(), raw);
+        const resolved = realResolve(resolve8(abs));
+        const rel = relative4(this.root, resolved);
         if (rel === "" || rel.startsWith("..") || isAbsolute4(rel)) {
           return -1;
         }
@@ -15687,7 +17769,7 @@ var init_context = __esm({
         }
         if (!_Context.eligible(basename4(rel))) return -1;
         const stored = rel;
-        if (!existsSync14(abs)) {
+        if (!existsSync15(abs)) {
           this.conn.prepare("DELETE FROM chunks WHERE path = ?").run(stored);
           return 0;
         }
@@ -16433,7 +18515,7 @@ var init_websocket = __esm({
        * Start the WebSocket server.
        */
       async start() {
-        return new Promise((resolve20, reject) => {
+        return new Promise((resolve21, reject) => {
           this.server = createServer((req2, res) => {
             res.writeHead(426, { "Content-Type": "text/plain" });
             res.end("Upgrade Required");
@@ -16443,7 +18525,7 @@ var init_websocket = __esm({
           });
           this.server.listen(this.port, () => {
             this.startIdleReaper();
-            resolve20();
+            resolve21();
           });
           this.server.on("error", (err) => {
             this.emit("error", err);
@@ -17664,8 +19746,8 @@ var init_job = __esm({
 });
 
 // ../core/src/queueBackends/liteBackend.ts
-import { mkdirSync as mkdirSync10, readdirSync as readdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync8, unlinkSync as unlinkSync6, existsSync as existsSync15 } from "node:fs";
-import { join as join17 } from "node:path";
+import { mkdirSync as mkdirSync11, readdirSync as readdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync9, unlinkSync as unlinkSync6, existsSync as existsSync16 } from "node:fs";
+import { join as join18 } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 var LiteBackend;
 var init_liteBackend = __esm({
@@ -17689,22 +19771,22 @@ var init_liteBackend = __esm({
         this.visibilityTimeout = visibilityTimeout;
       }
       ensureDir(queue) {
-        const dir = join17(this.basePath, queue);
-        mkdirSync10(dir, { recursive: true });
+        const dir = join18(this.basePath, queue);
+        mkdirSync11(dir, { recursive: true });
         return dir;
       }
       ensureFailedDir(queue) {
-        const dir = join17(this.basePath, queue, "failed");
-        mkdirSync10(dir, { recursive: true });
+        const dir = join18(this.basePath, queue, "failed");
+        mkdirSync11(dir, { recursive: true });
         return dir;
       }
       ensureReservedDir(queue) {
-        const dir = join17(this.basePath, queue, "reserved");
-        mkdirSync10(dir, { recursive: true });
+        const dir = join18(this.basePath, queue, "reserved");
+        mkdirSync11(dir, { recursive: true });
         return dir;
       }
       reservedPath(queue, jobId) {
-        return join17(this.ensureReservedDir(queue), `${jobId}.queue-data`);
+        return join18(this.ensureReservedDir(queue), `${jobId}.queue-data`);
       }
       nowIso() {
         return (/* @__PURE__ */ new Date()).toISOString();
@@ -17742,7 +19824,7 @@ var init_liteBackend = __esm({
           error: void 0
         };
         const prefix = this.nextPrefix();
-        writeFileSync8(join17(dir, `${prefix}_${id}.queue-data`), JSON.stringify(job, null, 2));
+        writeFileSync9(join18(dir, `${prefix}_${id}.queue-data`), JSON.stringify(job, null, 2));
         return id;
       }
       /**
@@ -17761,7 +19843,7 @@ var init_liteBackend = __esm({
         }
         const candidates = [];
         for (const filename of filenames) {
-          const filePath = join17(dir, filename);
+          const filePath = join18(dir, filename);
           let job;
           try {
             job = JSON.parse(readFileSync14(filePath, "utf-8"));
@@ -17804,7 +19886,7 @@ var init_liteBackend = __esm({
           createdAt: job.createdAt ?? now,
           topic: job.topic ?? queue
         };
-        writeFileSync8(this.reservedPath(queue, record.id), JSON.stringify(record, null, 2));
+        writeFileSync9(this.reservedPath(queue, record.id), JSON.stringify(record, null, 2));
       }
       /**
        * Return expired reservations to the queue (at-least-once delivery).
@@ -17825,7 +19907,7 @@ var init_liteBackend = __esm({
           return;
         }
         for (const filename of filenames) {
-          const filePath = join17(reservedDir, filename);
+          const filePath = join18(reservedDir, filename);
           let record;
           try {
             record = JSON.parse(readFileSync14(filePath, "utf-8"));
@@ -17863,7 +19945,7 @@ var init_liteBackend = __esm({
         this.reclaimExpired(queue, bridge.getMaxRetries(), this.nowIso());
         const now = this.nowIso();
         for (const [filename, job] of this.availableCandidates(queue, now)) {
-          const filePath = join17(dir, filename);
+          const filePath = join18(dir, filename);
           job.topic = queue;
           job.priority = job.priority ?? 0;
           this.writeReserved(queue, job);
@@ -17888,7 +19970,7 @@ var init_liteBackend = __esm({
         const results = [];
         for (const [filename, job] of this.availableCandidates(queue, now)) {
           if (results.length >= count) break;
-          const filePath = join17(dir, filename);
+          const filePath = join18(dir, filename);
           job.topic = queue;
           job.priority = job.priority ?? 0;
           this.writeReserved(queue, job);
@@ -17941,7 +20023,7 @@ var init_liteBackend = __esm({
         let count = 0;
         for (const file of files) {
           try {
-            const job = JSON.parse(readFileSync14(join17(scanDir, file), "utf-8"));
+            const job = JSON.parse(readFileSync14(join18(scanDir, file), "utf-8"));
             if (job.status === status2) count++;
           } catch {
           }
@@ -17954,28 +20036,28 @@ var init_liteBackend = __esm({
         try {
           const files = readdirSync8(dir).filter((f) => f.endsWith(".queue-data"));
           for (const file of files) {
-            unlinkSync6(join17(dir, file));
+            unlinkSync6(join18(dir, file));
             count++;
           }
         } catch {
         }
-        const failedDir = join17(dir, "failed");
+        const failedDir = join18(dir, "failed");
         try {
-          if (existsSync15(failedDir)) {
+          if (existsSync16(failedDir)) {
             const files = readdirSync8(failedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
-              unlinkSync6(join17(failedDir, file));
+              unlinkSync6(join18(failedDir, file));
               count++;
             }
           }
         } catch {
         }
-        const reservedDir = join17(dir, "reserved");
+        const reservedDir = join18(dir, "reserved");
         try {
-          if (existsSync15(reservedDir)) {
+          if (existsSync16(reservedDir)) {
             const files = readdirSync8(reservedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
-              unlinkSync6(join17(reservedDir, file));
+              unlinkSync6(join18(reservedDir, file));
               count++;
             }
           }
@@ -17998,7 +20080,7 @@ var init_liteBackend = __esm({
           const files = readdirSync8(dir).filter((f) => f.endsWith(".queue-data")).sort();
           for (const file of files) {
             try {
-              const job = JSON.parse(readFileSync14(join17(dir, file), "utf-8"));
+              const job = JSON.parse(readFileSync14(join18(dir, file), "utf-8"));
               const attempts = job.attempts || 0;
               if (attempts > 0 && attempts < maxRetries) {
                 results.push(job);
@@ -18021,9 +20103,9 @@ var init_liteBackend = __esm({
         try {
           const queues = readdirSync8(this.basePath);
           for (const q of queues) {
-            const failedDir = join17(this.basePath, q, "failed");
-            const filePath = join17(failedDir, `${jobId}.queue-data`);
-            if (existsSync15(filePath)) {
+            const failedDir = join18(this.basePath, q, "failed");
+            const filePath = join18(failedDir, `${jobId}.queue-data`);
+            if (existsSync16(filePath)) {
               const job = JSON.parse(readFileSync14(filePath, "utf-8"));
               job.status = "pending";
               job.attempts = (job.attempts || 0) + 1;
@@ -18031,8 +20113,8 @@ var init_liteBackend = __esm({
               job.createdAt = (/* @__PURE__ */ new Date()).toISOString();
               job.delayUntil = delaySeconds ? new Date(Date.now() + delaySeconds * 1e3).toISOString() : null;
               const prefix = this.nextPrefix();
-              const queueDir = join17(this.basePath, q);
-              writeFileSync8(join17(queueDir, `${prefix}_${jobId}.queue-data`), JSON.stringify(job, null, 2));
+              const queueDir = join18(this.basePath, q);
+              writeFileSync9(join18(queueDir, `${prefix}_${jobId}.queue-data`), JSON.stringify(job, null, 2));
               unlinkSync6(filePath);
               return true;
             }
@@ -18048,7 +20130,7 @@ var init_liteBackend = __esm({
           const files = readdirSync8(failedDir).filter((f) => f.endsWith(".queue-data")).sort();
           for (const file of files) {
             try {
-              const job = JSON.parse(readFileSync14(join17(failedDir, file), "utf-8"));
+              const job = JSON.parse(readFileSync14(join18(failedDir, file), "utf-8"));
               if ((job.attempts || 0) >= maxRetries) {
                 job.status = "dead";
                 results.push(job);
@@ -18069,7 +20151,7 @@ var init_liteBackend = __esm({
             const files = readdirSync8(failedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
               try {
-                unlinkSync6(join17(failedDir, file));
+                unlinkSync6(join18(failedDir, file));
                 count++;
               } catch {
               }
@@ -18082,9 +20164,9 @@ var init_liteBackend = __esm({
             const files = readdirSync8(dir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
               try {
-                const job = JSON.parse(readFileSync14(join17(dir, file), "utf-8"));
+                const job = JSON.parse(readFileSync14(join18(dir, file), "utf-8"));
                 if (job.status === status2) {
-                  unlinkSync6(join17(dir, file));
+                  unlinkSync6(join18(dir, file));
                   count++;
                 }
               } catch {
@@ -18108,7 +20190,7 @@ var init_liteBackend = __esm({
           const files = readdirSync8(failedDir).filter((f) => f.endsWith(".queue-data"));
           for (const file of files) {
             try {
-              const filePath = join17(failedDir, file);
+              const filePath = join18(failedDir, file);
               const job = JSON.parse(readFileSync14(filePath, "utf-8"));
               if ((job.attempts || 0) >= maxRetries) {
                 continue;
@@ -18118,7 +20200,7 @@ var init_liteBackend = __esm({
               job.createdAt = (/* @__PURE__ */ new Date()).toISOString();
               job.delayUntil = null;
               const prefix = this.nextPrefix();
-              writeFileSync8(join17(queueDir, `${prefix}_${job.id}.queue-data`), JSON.stringify(job, null, 2));
+              writeFileSync9(join18(queueDir, `${prefix}_${job.id}.queue-data`), JSON.stringify(job, null, 2));
               unlinkSync6(filePath);
               count++;
             } catch {
@@ -18138,7 +20220,7 @@ var init_liteBackend = __esm({
         }
         for (const file of files) {
           if (!file.includes(id)) continue;
-          const filePath = join17(dir, file);
+          const filePath = join18(dir, file);
           let job;
           try {
             job = JSON.parse(readFileSync14(filePath, "utf-8"));
@@ -18186,7 +20268,7 @@ var init_liteBackend = __esm({
           error
         };
         const prefix = this.nextPrefix();
-        writeFileSync8(join17(dir, `${prefix}_${job.id}.queue-data`), JSON.stringify(jobData, null, 2));
+        writeFileSync9(join18(dir, `${prefix}_${job.id}.queue-data`), JSON.stringify(jobData, null, 2));
       }
       /**
        * Move the job to the dead-letter (failed/) directory. Terminal until a
@@ -18206,7 +20288,7 @@ var init_liteBackend = __esm({
           error,
           failedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
-        writeFileSync8(join17(failedDir, `${job.id}.queue-data`), JSON.stringify(jobData, null, 2));
+        writeFileSync9(join18(failedDir, `${job.id}.queue-data`), JSON.stringify(jobData, null, 2));
       }
       /**
        * Record a failed attempt.
@@ -18242,7 +20324,7 @@ var init_liteBackend = __esm({
       retryJob(queue, job, delaySeconds) {
         this.clearReservation(queue, job.id);
         try {
-          unlinkSync6(join17(this.ensureFailedDir(queue), `${job.id}.queue-data`));
+          unlinkSync6(join18(this.ensureFailedDir(queue), `${job.id}.queue-data`));
         } catch {
         }
         job.attempts = (job.attempts || 0) + 1;
@@ -18661,7 +20743,7 @@ var init_queue = __esm({
             const jobs = this.popBatch(resolvedBatchSize);
             if (jobs.length === 0) {
               if (resolvedPollInterval <= 0) break;
-              await new Promise((resolve20) => setTimeout(resolve20, resolvedPollInterval));
+              await new Promise((resolve21) => setTimeout(resolve21, resolvedPollInterval));
               continue;
             }
             yield jobs;
@@ -18671,7 +20753,7 @@ var init_queue = __esm({
             const raw = this.pop();
             if (raw === null) {
               if (resolvedPollInterval <= 0) break;
-              await new Promise((resolve20) => setTimeout(resolve20, resolvedPollInterval));
+              await new Promise((resolve21) => setTimeout(resolve21, resolvedPollInterval));
               continue;
             }
             yield createJob(raw, this);
@@ -20746,8 +22828,8 @@ ${end}
 
 // ../core/src/devAdmin.ts
 import { cpus as osCpus } from "node:os";
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync12, existsSync as existsSync19, readdirSync as readdirSync12, mkdirSync as mkdirSync13, copyFileSync, statSync as statSync14 } from "node:fs";
-import { join as join21, dirname as dirname10, resolve as resolve11, relative as relative7 } from "node:path";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync13, existsSync as existsSync20, readdirSync as readdirSync12, mkdirSync as mkdirSync14, copyFileSync, statSync as statSync14 } from "node:fs";
+import { join as join22, dirname as dirname10, resolve as resolve12, relative as relative8 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 function escapeHtml(value) {
@@ -20861,12 +22943,12 @@ function mapQueueJob(job, topic, status2) {
   };
 }
 function readQueueDir(dir, topic, status2) {
-  if (!existsSync19(dir)) return [];
+  if (!existsSync20(dir)) return [];
   const jobs = [];
   for (const filename of readdirSync12(dir).sort()) {
     if (!filename.endsWith(".queue-data")) continue;
     try {
-      jobs.push(mapQueueJob(JSON.parse(readFileSync18(join21(dir, filename), "utf-8")), topic, status2));
+      jobs.push(mapQueueJob(JSON.parse(readFileSync18(join22(dir, filename), "utf-8")), topic, status2));
     } catch {
     }
   }
@@ -20983,8 +23065,8 @@ async function proxyToSupervisor(req2, res, downstreamPath) {
 function resolveDevEnvVar(key) {
   const live = process.env[key];
   if (live !== void 0 && live !== "") return live;
-  const envPath = join21(process.cwd(), ".env");
-  if (!existsSync19(envPath)) return "";
+  const envPath = join22(process.cwd(), ".env");
+  if (!existsSync20(envPath)) return "";
   for (const line of readFileSync18(envPath, "utf-8").split("\n")) {
     const t = line.trim();
     if (!t || t.startsWith("#") || !t.includes("=")) continue;
@@ -20994,8 +23076,8 @@ function resolveDevEnvVar(key) {
   return "";
 }
 function upsertDevEnvVar(key, value) {
-  const envPath = join21(process.cwd(), ".env");
-  const lines = existsSync19(envPath) ? readFileSync18(envPath, "utf-8").split("\n") : [];
+  const envPath = join22(process.cwd(), ".env");
+  const lines = existsSync20(envPath) ? readFileSync18(envPath, "utf-8").split("\n") : [];
   let found = false;
   const out = [];
   for (const line of lines) {
@@ -21010,7 +23092,7 @@ function upsertDevEnvVar(key, value) {
     } else out.push(line);
   }
   if (!found) out.push(`${key}=${value}`);
-  writeFileSync12(envPath, out.join("\n").replace(/\n+$/, "") + "\n");
+  writeFileSync13(envPath, out.join("\n").replace(/\n+$/, "") + "\n");
 }
 function formatUptime(seconds) {
   const d = Math.floor(seconds / 86400);
@@ -21025,9 +23107,9 @@ function formatUptime(seconds) {
   return parts.join(" ");
 }
 function parseEnvFile() {
-  const envPath = join21(process.cwd(), ".env");
+  const envPath = join22(process.cwd(), ".env");
   const result = {};
-  if (!existsSync19(envPath)) return result;
+  if (!existsSync20(envPath)) return result;
   const lines = readFileSync18(envPath, "utf-8").split("\n");
   for (const line of lines) {
     const trimmed = line.trim();
@@ -21039,9 +23121,9 @@ function parseEnvFile() {
 }
 function walkDirRecursive(dir) {
   const results = [];
-  if (!existsSync19(dir)) return results;
+  if (!existsSync20(dir)) return results;
   for (const entry of readdirSync12(dir)) {
-    const full = join21(dir, entry);
+    const full = join22(dir, entry);
     if (statSync14(full).isDirectory()) {
       results.push(...walkDirRecursive(full));
     } else {
@@ -21058,25 +23140,25 @@ function handleGalleryDeploy(router) {
       res.json({ error: "No gallery item specified" }, 400);
       return;
     }
-    const galleryDir = resolve11(__devAdminDirname, "..", "gallery");
-    const gallerySrc = join21(galleryDir, name, "src");
-    if (!existsSync19(gallerySrc)) {
+    const galleryDir = resolve12(__devAdminDirname, "..", "gallery");
+    const gallerySrc = join22(galleryDir, name, "src");
+    if (!existsSync20(gallerySrc)) {
       res.json({ error: `Gallery item '${name}' not found` }, 404);
       return;
     }
-    const projectSrc = resolve11(process.cwd(), "src");
+    const projectSrc = resolve12(process.cwd(), "src");
     const copied = [];
     const allFiles = walkDirRecursive(gallerySrc);
     for (const srcFile of allFiles) {
-      const rel = relative7(gallerySrc, srcFile);
-      const dest = join21(projectSrc, rel);
-      mkdirSync13(dirname10(dest), { recursive: true });
+      const rel = relative8(gallerySrc, srcFile);
+      const dest = join22(projectSrc, rel);
+      mkdirSync14(dirname10(dest), { recursive: true });
       copyFileSync(srcFile, dest);
       copied.push(rel);
     }
     try {
-      const routesDir = resolve11(process.cwd(), "src", "routes");
-      if (existsSync19(routesDir)) {
+      const routesDir = resolve12(process.cwd(), "src", "routes");
+      if (existsSync20(routesDir)) {
         const { discoverRoutes: discoverRoutes2 } = await Promise.resolve().then(() => (init_routeDiscovery(), routeDiscovery_exports));
         const routes = await discoverRoutes2(routesDir);
         for (const route of routes) {
@@ -21092,7 +23174,7 @@ function handleGalleryDeploy(router) {
   };
 }
 function safeJoin(projectRoot3, rel) {
-  const resolved = resolve11(projectRoot3, rel);
+  const resolved = resolve12(projectRoot3, rel);
   if (!resolved.startsWith(projectRoot3)) return null;
   return resolved;
 }
@@ -22055,16 +24137,16 @@ var init_devAdmin = __esm({
           failed: queue.size("failed"),
           reserved: queue.size("reserved")
         };
-        const topicDir = join21(queueBasePath2(), topic);
+        const topicDir = join22(queueBasePath2(), topic);
         const jobs = [];
         if (!statusFilter || statusFilter === "pending") {
           jobs.push(...readQueueDir(topicDir, topic, "pending"));
         }
         if (!statusFilter || statusFilter === "reserved") {
-          jobs.push(...readQueueDir(join21(topicDir, "reserved"), topic, "reserved"));
+          jobs.push(...readQueueDir(join22(topicDir, "reserved"), topic, "reserved"));
         }
         if (!statusFilter || statusFilter === "failed" || statusFilter === "dead") {
-          jobs.push(...readQueueDir(join21(topicDir, "failed"), topic, "dead_letter"));
+          jobs.push(...readQueueDir(join22(topicDir, "failed"), topic, "dead_letter"));
         }
         res.json({ stats, jobs });
       } catch (e) {
@@ -22080,10 +24162,10 @@ var init_devAdmin = __esm({
         const { queueBasePath: queueBasePath2 } = await Promise.resolve().then(() => (init_queue(), queue_exports));
         const queueDir = queueBasePath2();
         let topics = [];
-        if (existsSync19(queueDir)) {
+        if (existsSync20(queueDir)) {
           topics = readdirSync12(queueDir).filter((d) => {
             try {
-              return statSync14(join21(queueDir, d)).isDirectory();
+              return statSync14(join22(queueDir, d)).isDirectory();
             } catch {
               return false;
             }
@@ -22398,7 +24480,7 @@ var init_devAdmin = __esm({
       const count = parseInt(String(body.count ?? "10"), 10) || 10;
       try {
         const orm = await Promise.resolve().then(() => (init_index(), index_exports));
-        const dirs = ["src/orm", "src/models"].map((d) => resolve11(process.cwd(), d)).filter((d) => existsSync19(d));
+        const dirs = ["src/orm", "src/models"].map((d) => resolve12(process.cwd(), d)).filter((d) => existsSync20(d));
         const classes = [];
         for (const dir of dirs) {
           for (const m of await orm.discoverModels(dir)) classes.push(m.modelClass);
@@ -22425,7 +24507,7 @@ var init_devAdmin = __esm({
         const run = promisify(execFile);
         try {
           const { stdout, stderr } = await run("npm", ["test"], {
-            cwd: resolve11(process.cwd()),
+            cwd: resolve12(process.cwd()),
             timeout: 18e4,
             encoding: "utf-8",
             maxBuffer: 8 * 1024 * 1024
@@ -22539,8 +24621,8 @@ var init_devAdmin = __esm({
         return;
       }
       try {
-        const envPath = join21(process.cwd(), ".env");
-        const lines = existsSync19(envPath) ? readFileSync18(envPath, "utf-8").split("\n") : [];
+        const envPath = join22(process.cwd(), ".env");
+        const lines = existsSync20(envPath) ? readFileSync18(envPath, "utf-8").split("\n") : [];
         const keysFound = { TINA4_DATABASE_URL: false, TINA4_DATABASE_USERNAME: false, TINA4_DATABASE_PASSWORD: false };
         const newLines = [];
         for (const line of lines) {
@@ -22567,7 +24649,7 @@ var init_devAdmin = __esm({
         for (const [key, found] of Object.entries(keysFound)) {
           if (!found) newLines.push(`${key}=${values[key]}`);
         }
-        writeFileSync12(envPath, newLines.join("\n") + "\n");
+        writeFileSync13(envPath, newLines.join("\n") + "\n");
         res.json({ success: true });
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
@@ -22577,26 +24659,26 @@ var init_devAdmin = __esm({
     __devAdminFilename = fileURLToPath5(import.meta.url);
     __devAdminDirname = dirname10(__devAdminFilename);
     handleGalleryList = (_req, res) => {
-      const galleryDir = resolve11(__devAdminDirname, "..", "gallery");
+      const galleryDir = resolve12(__devAdminDirname, "..", "gallery");
       const items = [];
-      if (existsSync19(galleryDir)) {
+      if (existsSync20(galleryDir)) {
         const entries = readdirSync12(galleryDir).sort();
         for (const entry of entries) {
-          const entryPath = join21(galleryDir, entry);
-          const metaFile = join21(entryPath, "meta.json");
-          if (statSync14(entryPath).isDirectory() && existsSync19(metaFile)) {
+          const entryPath = join22(galleryDir, entry);
+          const metaFile = join22(entryPath, "meta.json");
+          if (statSync14(entryPath).isDirectory() && existsSync20(metaFile)) {
             try {
               const meta = JSON.parse(readFileSync18(metaFile, "utf-8"));
               meta.id = entry;
-              const srcDir = join21(entryPath, "src");
-              if (existsSync19(srcDir)) {
+              const srcDir = join22(entryPath, "src");
+              if (existsSync20(srcDir)) {
                 const allFiles = walkDirRecursive(srcDir);
-                meta.files = allFiles.map((f) => relative7(srcDir, f));
+                meta.files = allFiles.map((f) => relative8(srcDir, f));
               }
-              const projectSrc = resolve11(process.cwd(), "src");
-              if (existsSync19(srcDir) && meta.files) {
+              const projectSrc = resolve12(process.cwd(), "src");
+              if (existsSync20(srcDir) && meta.files) {
                 meta.deployed = meta.files.every(
-                  (f) => existsSync19(join21(projectSrc, f))
+                  (f) => existsSync20(join22(projectSrc, f))
                 );
               } else {
                 meta.deployed = false;
@@ -22692,10 +24774,10 @@ var init_devAdmin = __esm({
     handleFiles = async (req2, res) => {
       const url = new URL(req2.url ?? "/", "http://localhost");
       const rel = url.searchParams.get("path") ?? ".";
-      const root = resolve11(process.cwd());
+      const root = resolve12(process.cwd());
       const target = safeJoin(root, rel);
       const { branch, gitRoot, status: gitStatus } = await devGitInfo(root);
-      if (!target || !existsSync19(target) || !statSync14(target).isDirectory()) {
+      if (!target || !existsSync20(target) || !statSync14(target).isDirectory()) {
         res.json({ path: rel, branch, entries: [], error: "not a directory" });
         return;
       }
@@ -22708,8 +24790,8 @@ var init_devAdmin = __esm({
       const entries = [];
       for (const name of readdirSync12(target).sort()) {
         if (devFilesHidden(name)) continue;
-        const full = join21(target, name);
-        const entryRel = relative7(root, full).replace(/\\/g, "/");
+        const full = join22(target, name);
+        const entryRel = relative8(root, full).replace(/\\/g, "/");
         if (isSecretPath(entryRel)) continue;
         let isDir = false;
         let size = null;
@@ -22754,7 +24836,7 @@ var init_devAdmin = __esm({
           size
         });
       }
-      res.json({ path: relative7(root, target).replace(/\\/g, "/") || ".", branch, entries });
+      res.json({ path: relative8(root, target).replace(/\\/g, "/") || ".", branch, entries });
     };
     DEV_ADMIN_LANG_MAP = {
       ".py": "python",
@@ -22799,15 +24881,15 @@ var init_devAdmin = __esm({
         res.json({ error: "Refused: secret file", path: rel, content: "", language: "text", bytes: 0 }, 403);
         return;
       }
-      const root = resolve11(process.cwd());
+      const root = resolve12(process.cwd());
       const target = safeJoin(root, rel);
-      if (!target || !existsSync19(target) || !statSync14(target).isFile()) {
+      if (!target || !existsSync20(target) || !statSync14(target).isFile()) {
         res.json({ error: `File not found: ${rel}` }, 404);
         return;
       }
       try {
         const content = readFileSync18(target, "utf-8");
-        const path8 = relative7(root, target);
+        const path8 = relative8(root, target);
         res.json({ path: path8, content, language: devAdminLanguage(path8), bytes: Buffer.byteLength(content, "utf-8") });
       } catch (e) {
         res.json({ error: e.message }, 500);
@@ -22817,22 +24899,22 @@ var init_devAdmin = __esm({
       const body = req2.body || {};
       const rel = body.path || "";
       const content = body.content ?? "";
-      const root = resolve11(process.cwd());
+      const root = resolve12(process.cwd());
       const target = safeJoin(root, rel);
       if (!target) {
         res.json({ error: `Path escapes project directory: ${rel}` }, 400);
         return;
       }
       try {
-        mkdirSync13(dirname10(target), { recursive: true });
-        const existed = existsSync19(target);
-        writeFileSync12(target, content, "utf-8");
+        mkdirSync14(dirname10(target), { recursive: true });
+        const existed = existsSync20(target);
+        writeFileSync13(target, content, "utf-8");
         try {
           const { Plan: Plan2 } = await Promise.resolve().then(() => (init_plan(), plan_exports));
-          Plan2.recordAction(existed ? "patched" : "created", relative7(root, target));
+          Plan2.recordAction(existed ? "patched" : "created", relative8(root, target));
         } catch {
         }
-        res.json({ ok: true, path: relative7(root, target), bytes: Buffer.byteLength(content, "utf-8") });
+        res.json({ ok: true, path: relative8(root, target), bytes: Buffer.byteLength(content, "utf-8") });
       } catch (e) {
         res.json({ error: e.message }, 500);
       }
@@ -22844,9 +24926,9 @@ var init_devAdmin = __esm({
         res.json({ error: "Refused: secret file" }, 403);
         return;
       }
-      const root = resolve11(process.cwd());
+      const root = resolve12(process.cwd());
       const target = safeJoin(root, rel);
-      if (!target || !existsSync19(target) || !statSync14(target).isFile()) {
+      if (!target || !existsSync20(target) || !statSync14(target).isFile()) {
         res.raw.writeHead(404);
         res.raw.end("Not found");
         return;
@@ -22879,22 +24961,22 @@ var init_devAdmin = __esm({
       const body = req2.body || {};
       const from = body.from || "";
       const to = body.to || "";
-      const root = resolve11(process.cwd());
+      const root = resolve12(process.cwd());
       const src = safeJoin(root, from);
       const dst = safeJoin(root, to);
       if (!src || !dst) {
         res.json({ error: "Invalid path" }, 400);
         return;
       }
-      if (!existsSync19(src)) {
+      if (!existsSync20(src)) {
         res.json({ error: `Source not found: ${from}` }, 404);
         return;
       }
       try {
         const { renameSync: renameSync3 } = await import("node:fs");
-        mkdirSync13(dirname10(dst), { recursive: true });
+        mkdirSync14(dirname10(dst), { recursive: true });
         renameSync3(src, dst);
-        res.json({ ok: true, from: relative7(root, src), to: relative7(root, dst) });
+        res.json({ ok: true, from: relative8(root, src), to: relative8(root, dst) });
       } catch (e) {
         res.json({ error: e.message }, 500);
       }
@@ -22902,20 +24984,20 @@ var init_devAdmin = __esm({
     handleFileDelete = async (req2, res) => {
       const body = req2.body || {};
       const rel = body.path || "";
-      const root = resolve11(process.cwd());
+      const root = resolve12(process.cwd());
       const target = safeJoin(root, rel);
       if (!target) {
         res.json({ error: "Invalid path" }, 400);
         return;
       }
-      if (!existsSync19(target)) {
+      if (!existsSync20(target)) {
         res.json({ error: `Not found: ${rel}` }, 404);
         return;
       }
       try {
         const { rmSync } = await import("node:fs");
         rmSync(target, { recursive: true, force: true });
-        res.json({ ok: true, deleted: relative7(root, target) });
+        res.json({ ok: true, deleted: relative8(root, target) });
       } catch (e) {
         res.json({ error: e.message }, 500);
       }
@@ -22953,7 +25035,7 @@ var init_devAdmin = __esm({
         const { execFileSync: execFileSync7 } = await import("node:child_process");
         const args = ["install", dev ? "--save-dev" : "--save", pkg];
         const output = execFileSync7("npm", args, {
-          cwd: resolve11(process.cwd()),
+          cwd: resolve12(process.cwd()),
           timeout: 12e4,
           encoding: "utf-8"
         }).toString();
@@ -22965,7 +25047,7 @@ var init_devAdmin = __esm({
     handleGitStatus = async (_req, res) => {
       try {
         const { execFileSync: execFileSync7 } = await import("node:child_process");
-        const cwd = resolve11(process.cwd());
+        const cwd = resolve12(process.cwd());
         try {
           execFileSync7("git", ["rev-parse", "--is-inside-work-tree"], { cwd, timeout: 3e3 });
         } catch {
@@ -23104,7 +25186,7 @@ var init_devAdmin = __esm({
       try {
         const { execFileSync: execFileSync7 } = await import("node:child_process");
         const output = execFileSync7("npx", ["tina4nodejs", "generate", kind, name], {
-          cwd: resolve11(process.cwd()),
+          cwd: resolve12(process.cwd()),
           timeout: 3e4,
           encoding: "utf-8"
         }).toString();
@@ -23249,21 +25331,21 @@ var init_devAdmin = __esm({
       });
     };
     handleDevAdminJs = async (_req, res) => {
-      const { readFileSync: readFileSync27, existsSync: existsSync27 } = await import("node:fs");
-      const { dirname: dirname15, join: join32, resolve: resolve20 } = await import("node:path");
+      const { readFileSync: readFileSync27, existsSync: existsSync28 } = await import("node:fs");
+      const { dirname: dirname15, join: join33, resolve: resolve21 } = await import("node:path");
       const { fileURLToPath: fileURLToPath8 } = await import("node:url");
       const dir = dirname15(fileURLToPath8(import.meta.url));
       const candidates = [
-        join32(dir, "..", "public", "js", "tina4-dev-admin.min.js"),
+        join33(dir, "..", "public", "js", "tina4-dev-admin.min.js"),
         // src/../public/js/
-        join32(dir, "..", "..", "public", "js", "tina4-dev-admin.min.js"),
+        join33(dir, "..", "..", "public", "js", "tina4-dev-admin.min.js"),
         // deeper nesting
-        resolve20(process.cwd(), "node_modules", "tina4-nodejs", "packages", "core", "public", "js", "tina4-dev-admin.min.js"),
-        resolve20(process.cwd(), "public", "js", "tina4-dev-admin.min.js")
+        resolve21(process.cwd(), "node_modules", "tina4-nodejs", "packages", "core", "public", "js", "tina4-dev-admin.min.js"),
+        resolve21(process.cwd(), "public", "js", "tina4-dev-admin.min.js")
         // project public/
       ];
       for (const jsPath of candidates) {
-        if (existsSync27(jsPath)) {
+        if (existsSync28(jsPath)) {
           try {
             const content = readFileSync27(jsPath, "utf-8");
             res.raw.writeHead(200, { "Content-Type": "application/javascript; charset=utf-8", "Cache-Control": "no-cache" });
@@ -23288,8 +25370,8 @@ var init_devAdmin = __esm({
 });
 
 // ../core/src/i18n.ts
-import { readFileSync as readFileSync19, readdirSync as readdirSync13, existsSync as existsSync20 } from "node:fs";
-import { join as join22, resolve as resolve12 } from "node:path";
+import { readFileSync as readFileSync19, readdirSync as readdirSync13, existsSync as existsSync21 } from "node:fs";
+import { join as join23, resolve as resolve13 } from "node:path";
 var I18n;
 var init_i18n = __esm({
   "../core/src/i18n.ts"() {
@@ -23309,7 +25391,7 @@ var init_i18n = __esm({
        * (BUG-7, BREAKING in 3.13.x — was previously (localeDir, defaultLocale)).
        */
       constructor(locale, path8) {
-        this._localeDir = resolve12(
+        this._localeDir = resolve13(
           path8 ?? process.env.TINA4_LOCALE_DIR ?? "src/locales"
         );
         this._defaultLocale = locale ?? process.env.TINA4_LOCALE ?? "en";
@@ -23366,7 +25448,7 @@ var init_i18n = __esm({
       }
       /** List available locale codes based on JSON files in the locale directory. */
       availableLocales() {
-        if (!existsSync20(this._localeDir)) {
+        if (!existsSync21(this._localeDir)) {
           return [this._defaultLocale];
         }
         try {
@@ -23382,8 +25464,8 @@ var init_i18n = __esm({
         if (this._translations.has(locale)) {
           return;
         }
-        const filePath = join22(this._localeDir, `${locale}.json`);
-        if (existsSync20(filePath)) {
+        const filePath = join23(this._localeDir, `${locale}.json`);
+        if (existsSync21(filePath)) {
           try {
             const raw = readFileSync19(filePath, "utf-8");
             const data = JSON.parse(raw);
@@ -23395,8 +25477,8 @@ var init_i18n = __esm({
           }
         }
         for (const ext of [".yml", ".yaml"]) {
-          const yamlPath = join22(this._localeDir, `${locale}${ext}`);
-          if (existsSync20(yamlPath)) {
+          const yamlPath = join23(this._localeDir, `${locale}${ext}`);
+          if (existsSync21(yamlPath)) {
             try {
               const raw = readFileSync19(yamlPath, "utf-8");
               const data = _I18n._parseSimpleYaml(raw);
@@ -23741,7 +25823,7 @@ function sanitizeSecurity(reqs, schemes) {
     return clean;
   });
 }
-function generate(routes, models = []) {
+function generate2(routes, models = []) {
   const info = {
     title: process.env.TINA4_SWAGGER_TITLE ?? "Tina4 API",
     // The app's version, defaulting to 1.0.0 — NOT the framework's (Node shipped
@@ -24189,7 +26271,7 @@ __export(src_exports, {
   addSchema: () => addSchema,
   addSecurityScheme: () => addSecurityScheme,
   createSwaggerRoutes: () => createSwaggerRoutes,
-  generate: () => generate,
+  generate: () => generate2,
   resetRegistry: () => resetRegistry,
   swaggerEnabled: () => swaggerEnabled
 });
@@ -24543,8 +26625,8 @@ function writeMcpDiscovery(projectRoot3, port) {
     const lines = contents.split(/\r?\n/);
     const already = lines.some((l) => l.trim() === GITIGNORE_LINE || l.trim() === ".tina4");
     if (!already) {
-      const sep6 = contents.endsWith("\n") || contents === "" ? "" : "\n";
-      fs8.writeFileSync(gitignorePath, `${contents}${sep6}${GITIGNORE_LINE}
+      const sep7 = contents.endsWith("\n") || contents === "" ? "" : "\n";
+      fs8.writeFileSync(gitignorePath, `${contents}${sep7}${GITIGNORE_LINE}
 `, "utf-8");
     }
   }
@@ -24563,8 +26645,8 @@ var init_docsAutoDiscovery = __esm({
 // ../core/src/server.ts
 import { createServer as createServer2 } from "node:http";
 import { randomBytes as randomBytes6 } from "node:crypto";
-import { resolve as resolve14, dirname as dirname11, join as join24, relative as relative8 } from "node:path";
-import { existsSync as existsSync22, readdirSync as readdirSync14, readFileSync as readFileSync21, statSync as statSync15 } from "node:fs";
+import { resolve as resolve15, dirname as dirname11, join as join25, relative as relative9 } from "node:path";
+import { existsSync as existsSync23, readdirSync as readdirSync14, readFileSync as readFileSync21, statSync as statSync15 } from "node:fs";
 import { isatty } from "node:tty";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { execFileSync as execFileSync3, exec } from "node:child_process";
@@ -24602,8 +26684,8 @@ function swaggerAdvertised() {
   return TRUTHY2.includes(raw);
 }
 async function autoMigrateOnStartup(migrationDir = "migrations", base = process.cwd()) {
-  const dir = resolve14(base, migrationDir);
-  if (!existsSync22(dir)) return;
+  const dir = resolve15(base, migrationDir);
+  if (!existsSync23(dir)) return;
   let hasSql = false;
   try {
     hasSql = readdirSync14(dir).some((f) => f.endsWith(".sql") && !f.endsWith(".down.sql"));
@@ -24744,12 +26826,12 @@ async function renderErrorPage(code, data, templatesDir) {
       }
       return instance;
     };
-    const userTemplatePath = join24(templatesDir, templateFile);
-    if (existsSync22(userTemplatePath)) {
+    const userTemplatePath = join25(templatesDir, templateFile);
+    if (existsSync23(userTemplatePath)) {
       return getCachedFrond(templatesDir).render(templateFile, data);
     }
-    const builtinTemplatePath = join24(BUILTIN_ERROR_TEMPLATES_DIR, templateFile);
-    if (existsSync22(builtinTemplatePath)) {
+    const builtinTemplatePath = join25(BUILTIN_ERROR_TEMPLATES_DIR, templateFile);
+    if (existsSync23(builtinTemplatePath)) {
       return getCachedFrond(BUILTIN_ERROR_TEMPLATES_DIR).render(templateFile, data);
     }
     return null;
@@ -24766,29 +26848,29 @@ function injectDevToolbar(html, ctx) {
 }
 function walkGalleryFiles(dir) {
   const results = [];
-  if (!existsSync22(dir)) return results;
+  if (!existsSync23(dir)) return results;
   for (const f of readdirSync14(dir)) {
-    const full = join24(dir, f);
+    const full = join25(dir, f);
     if (statSync15(full).isDirectory()) results.push(...walkGalleryFiles(full));
     else results.push(full);
   }
   return results;
 }
 function getGalleryDeployedState() {
-  const galleryDir = resolve14(__dirname, "..", "gallery");
+  const galleryDir = resolve15(__dirname, "..", "gallery");
   const state = {};
-  if (!existsSync22(galleryDir)) return state;
+  if (!existsSync23(galleryDir)) return state;
   try {
     const entries = readdirSync14(galleryDir).sort();
     for (const entry of entries) {
-      const entryPath = join24(galleryDir, entry);
-      const metaFile = join24(entryPath, "meta.json");
-      if (statSync15(entryPath).isDirectory() && existsSync22(metaFile)) {
-        const srcDir = join24(entryPath, "src");
-        if (existsSync22(srcDir)) {
+      const entryPath = join25(galleryDir, entry);
+      const metaFile = join25(entryPath, "meta.json");
+      if (statSync15(entryPath).isDirectory() && existsSync23(metaFile)) {
+        const srcDir = join25(entryPath, "src");
+        if (existsSync23(srcDir)) {
           const files = walkGalleryFiles(srcDir);
-          const projectSrc = resolve14(process.cwd(), "src");
-          state[entry] = files.every((f) => existsSync22(join24(projectSrc, relative8(srcDir, f))));
+          const projectSrc = resolve15(process.cwd(), "src");
+          state[entry] = files.every((f) => existsSync23(join25(projectSrc, relative9(srcDir, f))));
         } else {
           state[entry] = false;
         }
@@ -24816,9 +26898,9 @@ function resolveTemplate(pathname, templatesDir) {
   const isDev2 = (process.env.TINA4_DEBUG ?? "false").toLowerCase() === "true";
   if (isDev2) {
     if (cleanPath.split("/").some((seg) => seg.startsWith("_"))) return null;
-    const pagesDir = resolve14(templatesDir, TEMPLATE_PAGES_DIR);
+    const pagesDir = resolve15(templatesDir, TEMPLATE_PAGES_DIR);
     for (const ext of [".twig", ".html"]) {
-      if (existsSync22(resolve14(pagesDir, cleanPath + ext))) {
+      if (existsSync23(resolve15(pagesDir, cleanPath + ext))) {
         return `${TEMPLATE_PAGES_DIR}/${cleanPath}${ext}`;
       }
     }
@@ -24826,14 +26908,14 @@ function resolveTemplate(pathname, templatesDir) {
   }
   if (!templateCache) {
     templateCache = /* @__PURE__ */ new Map();
-    const pagesDir = resolve14(templatesDir, TEMPLATE_PAGES_DIR);
-    if (existsSync22(pagesDir)) {
+    const pagesDir = resolve15(templatesDir, TEMPLATE_PAGES_DIR);
+    if (existsSync23(pagesDir)) {
       const scan = (dir, prefix) => {
         for (const entry of readdirSync14(dir, { withFileTypes: true })) {
           if (entry.name.startsWith("_")) continue;
           const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
           if (entry.isDirectory()) {
-            scan(resolve14(dir, entry.name), rel);
+            scan(resolve15(dir, entry.name), rel);
           } else if (entry.name.endsWith(".twig") || entry.name.endsWith(".html")) {
             const urlPath = rel.replace(/\.(twig|html)$/, "");
             if (!templateCache.has(urlPath)) {
@@ -25238,7 +27320,7 @@ function serveTemplateFallback(ctx) {
   if ((ctx.req.method ?? "GET") !== "GET") return false;
   const tplFile = resolveTemplate(ctx.pathname, ctx.templatesDir);
   if (!tplFile) return false;
-  const html = ctx.frondEngine ? ctx.frondEngine.render(tplFile, {}) : readFileSync21(resolve14(ctx.templatesDir, tplFile), "utf-8");
+  const html = ctx.frondEngine ? ctx.frondEngine.render(tplFile, {}) : readFileSync21(resolve15(ctx.templatesDir, tplFile), "utf-8");
   ctx.res.raw.writeHead(200, void 0, { "Content-Type": "text/html; charset=utf-8" });
   ctx.res.raw.end(html);
   return true;
@@ -25277,9 +27359,9 @@ function serveMethodNotAllowed(ctx) {
 }
 function serveStaticAsset(ctx) {
   const custom = process.env.TINA4_PUBLIC_DIR;
-  if (custom && existsSync22(custom) && tryServeStatic(custom, ctx.req, ctx.res)) return true;
-  if (existsSync22(ctx.staticDir) && tryServeStatic(ctx.staticDir, ctx.req, ctx.res)) return true;
-  if (existsSync22(ctx.srcPublicDir) && tryServeStatic(ctx.srcPublicDir, ctx.req, ctx.res)) return true;
+  if (custom && existsSync23(custom) && tryServeStatic(custom, ctx.req, ctx.res)) return true;
+  if (existsSync23(ctx.staticDir) && tryServeStatic(ctx.staticDir, ctx.req, ctx.res)) return true;
+  if (existsSync23(ctx.srcPublicDir) && tryServeStatic(ctx.srcPublicDir, ctx.req, ctx.res)) return true;
   if (ctx.swaggerAssetsEnabled || !isSwaggerAssetPath(ctx.pathname)) {
     if (tryServeStatic(BUILTIN_PUBLIC_DIR, ctx.req, ctx.res)) return true;
   }
@@ -25303,10 +27385,10 @@ async function serveNotFound(ctx) {
   return true;
 }
 async function buildDispatchContext(router, base) {
-  const root = base ? resolve14(base) : process.cwd();
-  const staticDir = resolve14(root, "public");
-  const srcPublicDir = resolve14(root, "src/public");
-  const templatesDir = resolve14(root, "src/templates");
+  const root = base ? resolve15(base) : process.cwd();
+  const staticDir = resolve15(root, "public");
+  const srcPublicDir = resolve15(root, "src/public");
+  const templatesDir = resolve15(root, "src/templates");
   let frondEngine = null;
   try {
     const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
@@ -25470,13 +27552,13 @@ ${reset2}
       };
     }
   }
-  const base = config?.basePath ? resolve14(config.basePath) : process.cwd();
-  const routesDir = resolve14(base, config?.routesDir ?? "src/routes");
-  const modelsDir = resolve14(base, config?.modelsDir ?? "src/models");
-  const ormDir = resolve14(base, "src/orm");
-  const staticDir = resolve14(base, config?.staticDir ?? "public");
-  const srcPublicDir = resolve14(base, "src/public");
-  const templatesDir = resolve14(base, config?.templatesDir ?? "src/templates");
+  const base = config?.basePath ? resolve15(config.basePath) : process.cwd();
+  const routesDir = resolve15(base, config?.routesDir ?? "src/routes");
+  const modelsDir = resolve15(base, config?.modelsDir ?? "src/models");
+  const ormDir = resolve15(base, "src/orm");
+  const staticDir = resolve15(base, config?.staticDir ?? "public");
+  const srcPublicDir = resolve15(base, "src/public");
+  const templatesDir = resolve15(base, config?.templatesDir ?? "src/templates");
   const router = new Router();
   const middleware = new MiddlewareChain();
   globalThis.__tina4_router = router;
@@ -25510,8 +27592,8 @@ ${reset2}
   } catch {
   }
   if (frondEngine) {
-    const localeDir = resolve14(base, process.env.TINA4_LOCALE_DIR ?? "src/locales");
-    if (existsSync22(localeDir)) {
+    const localeDir = resolve15(base, process.env.TINA4_LOCALE_DIR ?? "src/locales");
+    if (existsSync23(localeDir)) {
       try {
         const localeFiles = readdirSync14(localeDir).filter((f) => f.endsWith(".json"));
         if (localeFiles.length > 0 && !frondEngine.globals?.t) {
@@ -25526,7 +27608,7 @@ ${reset2}
   middleware.use(requestLogger());
   middleware.use(rateLimiter());
   MiddlewareRunner.use(SecurityHeadersMiddleware);
-  if (existsSync22(routesDir)) {
+  if (existsSync23(routesDir)) {
     const routes = await discoverRoutes(routesDir);
     for (const route of routes) {
       router.addRoute(route);
@@ -25546,8 +27628,8 @@ ${reset2}
     console.log(`
   \x1B[36mCSRF\x1B[0m protection enabled (TINA4_CSRF)`);
   }
-  const hasOrmDir = existsSync22(ormDir);
-  const hasModelsDir = existsSync22(modelsDir);
+  const hasOrmDir = existsSync23(ormDir);
+  const hasModelsDir = existsSync23(modelsDir);
   if (hasOrmDir || hasModelsDir) {
     try {
       const orm = await Promise.resolve().then(() => (init_index(), index_exports));
@@ -25604,7 +27686,7 @@ ${reset2}
     let modelDefs = [];
     try {
       const orm = await Promise.resolve().then(() => (init_index(), index_exports));
-      const allModelDirs = [ormDir, modelsDir].filter((d) => existsSync22(d));
+      const allModelDirs = [ormDir, modelsDir].filter((d) => existsSync23(d));
       const seenTables = /* @__PURE__ */ new Set();
       for (const dir of allModelDirs) {
         const discovered = await orm.discoverModels(dir);
@@ -25839,8 +27921,8 @@ var init_server = __esm({
     init_version();
     __filename = fileURLToPath6(import.meta.url);
     __dirname = dirname11(__filename);
-    BUILTIN_ERROR_TEMPLATES_DIR = resolve14(__dirname, "..", "templates");
-    BUILTIN_PUBLIC_DIR = resolve14(__dirname, "..", "public");
+    BUILTIN_ERROR_TEMPLATES_DIR = resolve15(__dirname, "..", "templates");
+    BUILTIN_PUBLIC_DIR = resolve15(__dirname, "..", "public");
     swaggerAssetsEnabled = false;
     DEFAULT_SHUTDOWN_TIMEOUT_SECONDS = 30;
     frondCache = /* @__PURE__ */ new Map();
@@ -25996,8 +28078,8 @@ var init_env = __esm({
 
 // ../core/src/fakeData.ts
 import { randomInt, randomUUID as randomUUID6 } from "node:crypto";
-import { existsSync as existsSync23, readdirSync as readdirSync15 } from "node:fs";
-import { resolve as resolve15, join as join25 } from "node:path";
+import { existsSync as existsSync24, readdirSync as readdirSync15 } from "node:fs";
+import { resolve as resolve16, join as join26 } from "node:path";
 function mulberry32(seed) {
   let s = seed | 0;
   return () => {
@@ -26431,12 +28513,12 @@ var init_fakeData = __esm({
        * Returns an array of executed file paths.
        */
       async seedDir(seedDir) {
-        const dir = resolve15(seedDir ?? "src/seeds");
-        if (!existsSync23(dir)) return [];
+        const dir = resolve16(seedDir ?? "src/seeds");
+        if (!existsSync24(dir)) return [];
         const files = readdirSync15(dir).filter((f) => f.endsWith(".ts") || f.endsWith(".js")).sort();
         const executed = [];
         for (const file of files) {
-          const fullPath = join25(dir, file);
+          const fullPath = join26(dir, file);
           try {
             const mod = await import(fullPath);
             if (typeof mod.default === "function") {
@@ -26535,7 +28617,7 @@ var init_mqttMessage = __esm({
 import net2 from "node:net";
 import tls from "node:tls";
 import { randomBytes as randomBytes7 } from "node:crypto";
-import { existsSync as existsSync24, readFileSync as readFileSync22 } from "node:fs";
+import { existsSync as existsSync25, readFileSync as readFileSync22 } from "node:fs";
 var MqttError, MqttTimeoutError, CONNECT, CONNACK, PUBLISH, PUBACK, SUBSCRIBE, SUBACK, PINGREQ, PINGRESP, DISCONNECT, PROTOCOL_LEVEL, DEFAULT_PORT, DEFAULT_TLS_PORT, DEFAULT_URL, DEFAULT_KEEPALIVE, SUBSCRIPTION_REFUSED, MAX_REMAINING_LENGTH, QOS2_REFUSED_MESSAGE, CONNACK_RETURN_CODES, Mqtt;
 var init_mqtt = __esm({
   "../core/src/mqtt.ts"() {
@@ -26738,7 +28820,7 @@ var init_mqtt = __esm({
        */
       async connect() {
         this.closeSocket();
-        if (this.secure && this.tlsVerify && this.caFile && !existsSync24(this.caFile)) {
+        if (this.secure && this.tlsVerify && this.caFile && !existsSync25(this.caFile)) {
           throw new MqttError(
             `MQTT CA file not found: ${this.caFile} -- TINA4_MQTT_CA_FILE (or caFile) must point at the broker's CA certificate in PEM form`
           );
@@ -26975,7 +29057,7 @@ var init_mqtt = __esm({
        * a later client.
        */
       openSocket() {
-        return new Promise((resolve20, reject) => {
+        return new Promise((resolve21, reject) => {
           let settled = false;
           const settle = (fn) => {
             if (settled) return;
@@ -27001,9 +29083,9 @@ var init_mqtt = __esm({
               rejectUnauthorized: this.tlsVerify
             };
             if (this.tlsVerify && this.caFile) opts.ca = readFileSync22(this.caFile);
-            sock = tls.connect(opts, () => settle(() => resolve20(sock)));
+            sock = tls.connect(opts, () => settle(() => resolve21(sock)));
           } else {
-            sock = net2.createConnection({ host: this.host, port: this.port }, () => settle(() => resolve20(sock)));
+            sock = net2.createConnection({ host: this.host, port: this.port }, () => settle(() => resolve21(sock)));
           }
           sock.once("error", (err) => {
             settle(() => {
@@ -27042,13 +29124,13 @@ var init_mqtt = __esm({
       writePacket(header, body) {
         if (this.socket === null) return Promise.reject(new MqttError("not connected to an MQTT broker"));
         const packet = Buffer.concat([Buffer.from([header]), _Mqtt.encodeRemainingLength(body.length), body]);
-        return new Promise((resolve20, reject) => {
+        return new Promise((resolve21, reject) => {
           this.socket.write(packet, (err) => {
             if (err) {
               reject(new MqttError(`MQTT write failed: ${err.message}`));
             } else {
               this.lastWriteAt = Date.now();
-              resolve20();
+              resolve21();
             }
           });
         });
@@ -27081,7 +29163,7 @@ var init_mqtt = __esm({
         if (this.readBuffer.length >= need) return Promise.resolve(this.take(need));
         if (this.socket === null) return Promise.reject(this.socketError ?? new MqttError("not connected to an MQTT broker"));
         if (this.socketError !== null) return Promise.reject(this.socketError);
-        return new Promise((resolve20, reject) => {
+        return new Promise((resolve21, reject) => {
           let timer = null;
           if (deadline !== null) {
             const remaining = deadline - Date.now();
@@ -27096,7 +29178,7 @@ var init_mqtt = __esm({
               }
             }, remaining);
           }
-          this.waiter = { need, resolve: resolve20, reject, timer };
+          this.waiter = { need, resolve: resolve21, reject, timer };
           this.serviceWaiter();
         });
       }
@@ -27221,7 +29303,7 @@ var init_mqtt = __esm({
 
 // ../core/src/service.ts
 import { readdirSync as readdirSync16, statSync as statSync16, watchFile, unwatchFile } from "node:fs";
-import { join as join26, extname as extname6 } from "node:path";
+import { join as join27, extname as extname6 } from "node:path";
 import { pathToFileURL } from "node:url";
 function matchCronField(field, value) {
   if (field === "*") return true;
@@ -27395,7 +29477,7 @@ var init_service = __esm({
         for (const entry of entries) {
           const ext = extname6(entry);
           if (ext !== ".ts" && ext !== ".js") continue;
-          const fullPath = join26(dir, entry);
+          const fullPath = join27(dir, entry);
           const stat = statSync16(fullPath);
           if (!stat.isFile()) continue;
           try {
@@ -27522,7 +29604,7 @@ var init_service = __esm({
         for (const entry of entries) {
           const ext = extname6(entry);
           if (ext !== ".ts" && ext !== ".js") continue;
-          const fullPath = join26(dir, entry);
+          const fullPath = join27(dir, entry);
           if (watchedFiles.has(fullPath)) continue;
           watchedFiles.add(fullPath);
           watchFile(fullPath, { interval: 1e3 }, async () => {
@@ -28131,7 +30213,7 @@ var init_api = __esm({
        * `res.destroy()`.
        */
       openStreamRequest(method, url, headers, data, connectSec) {
-        return new Promise((resolve20, reject) => {
+        return new Promise((resolve21, reject) => {
           let parsed;
           try {
             parsed = new URL2(url);
@@ -28153,7 +30235,7 @@ var init_api = __esm({
             options.rejectUnauthorized = false;
           }
           const req2 = protocolModule.request(options, (res) => {
-            resolve20({ res });
+            resolve21({ res });
           });
           req2.on("timeout", () => {
             req2.destroy(new ApiStreamError(`stream connect timeout after ${connectSec}s`, null));
@@ -28291,12 +30373,12 @@ var init_api = __esm({
        * authenticate to.
        */
       performRequest(method, url, headers, data, redirectsLeft) {
-        return new Promise((resolve20) => {
+        return new Promise((resolve21) => {
           let parsed;
           try {
             parsed = new URL2(url);
           } catch (err) {
-            resolve20({ kind: "error", error: err instanceof Error ? err.message : String(err) });
+            resolve21({ kind: "error", error: err instanceof Error ? err.message : String(err) });
             return;
           }
           const isHttps = parsed.protocol === "https:";
@@ -28321,7 +30403,7 @@ var init_api = __esm({
               try {
                 nextUrl = new URL2(location, url).toString();
               } catch {
-                resolve20({ kind: "response", res });
+                resolve21({ kind: "response", res });
                 return;
               }
               const crossOrigin = !sameOrigin(url, nextUrl);
@@ -28339,17 +30421,17 @@ var init_api = __esm({
                   deleteHeaderCaseInsensitive(nextHeaders, name);
                 }
               }
-              this.performRequest(nextMethod, nextUrl, nextHeaders, nextData, redirectsLeft - 1).then(resolve20);
+              this.performRequest(nextMethod, nextUrl, nextHeaders, nextData, redirectsLeft - 1).then(resolve21);
               return;
             }
-            resolve20({ kind: "response", res });
+            resolve21({ kind: "response", res });
           });
           req2.on("timeout", () => {
             req2.destroy();
-            resolve20({ kind: "error", error: `Request timed out after ${this.timeout}s` });
+            resolve21({ kind: "error", error: `Request timed out after ${this.timeout}s` });
           });
           req2.on("error", (err) => {
-            resolve20({ kind: "error", error: err.message });
+            resolve21({ kind: "error", error: err.message });
           });
           if (data) {
             req2.write(data);
@@ -28359,7 +30441,7 @@ var init_api = __esm({
       }
       /** Buffer a response body, parse JSON if possible, and store cookies. */
       readResponse(res) {
-        return new Promise((resolve20) => {
+        return new Promise((resolve21) => {
           const chunks = [];
           res.on("data", (chunk) => {
             chunks.push(chunk);
@@ -28374,7 +30456,7 @@ var init_api = __esm({
             } catch {
               parsed = raw;
             }
-            resolve20({
+            resolve21({
               http_code: res.statusCode ?? null,
               body: parsed,
               headers: respHeaders,
@@ -28382,7 +30464,7 @@ var init_api = __esm({
             });
           });
           res.on("error", (err) => {
-            resolve20({ http_code: null, body: null, headers: {}, error: err.message });
+            resolve21({ http_code: null, body: null, headers: {}, error: err.message });
           });
         });
       }
@@ -28446,7 +30528,7 @@ function parseMailRedirectList(raw) {
   return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 }
 function readResponse(socket) {
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve21, reject) => {
     let buffer = "";
     const onData = (chunk) => {
       buffer += chunk.toString("utf-8");
@@ -28458,7 +30540,7 @@ function readResponse(socket) {
         if (line.length >= 4 && line[3] === " ") {
           socket.removeListener("data", onData);
           socket.removeListener("error", onError);
-          resolve20({ code, text: buffer.trim() });
+          resolve21({ code, text: buffer.trim() });
           return;
         }
       }
@@ -28472,10 +30554,10 @@ function readResponse(socket) {
   });
 }
 function sendCommand(socket, command) {
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve21, reject) => {
     socket.write(command + "\r\n", "utf-8", (err) => {
       if (err) return reject(err);
-      readResponse(socket).then(resolve20, reject);
+      readResponse(socket).then(resolve21, reject);
     });
   });
 }
@@ -28575,7 +30657,7 @@ function imapQuote(s) {
   return '"' + s.replace(/\\/g, "\\\\").replace(/"/g, '\\"') + '"';
 }
 function imapReadLine(socket) {
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve21, reject) => {
     let buffer = "";
     const onData = (chunk) => {
       buffer += chunk.toString("utf-8");
@@ -28583,7 +30665,7 @@ function imapReadLine(socket) {
       if (nlIndex !== -1) {
         socket.removeListener("data", onData);
         socket.removeListener("error", onError);
-        resolve20(buffer);
+        resolve21(buffer);
       }
     };
     const onError = (err) => {
@@ -28595,7 +30677,7 @@ function imapReadLine(socket) {
   });
 }
 function imapCommand(socket, command) {
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve21, reject) => {
     imapTagCounter++;
     const tag = `T${imapTagCounter}`;
     const fullCommand = `${tag} ${command}\r
@@ -28606,7 +30688,7 @@ function imapCommand(socket, command) {
       if (buffer.includes(`${tag} OK`)) {
         socket.removeListener("data", onData);
         socket.removeListener("error", onError);
-        resolve20(buffer);
+        resolve21(buffer);
         return;
       }
       if (buffer.includes(`${tag} NO`) || buffer.includes(`${tag} BAD`)) {
@@ -28911,14 +30993,14 @@ var init_messenger = __esm({
           let socket;
           if (this.port === 465) {
             socket = tls2.connect({ host: this.host, port: this.port, rejectUnauthorized: tlsRejectUnauthorized() });
-            await new Promise((resolve20, reject) => {
-              socket.once("secureConnect", resolve20);
+            await new Promise((resolve21, reject) => {
+              socket.once("secureConnect", resolve21);
               socket.once("error", reject);
             });
           } else {
             socket = net3.createConnection({ host: this.host, port: this.port });
-            await new Promise((resolve20, reject) => {
-              socket.once("connect", resolve20);
+            await new Promise((resolve21, reject) => {
+              socket.once("connect", resolve21);
               socket.once("error", reject);
             });
           }
@@ -28942,8 +31024,8 @@ var init_messenger = __esm({
             socket = tls2.connect(
               { socket: plainSocket, host: this.host, rejectUnauthorized: tlsRejectUnauthorized() }
             );
-            await new Promise((resolve20, reject) => {
-              socket.once("secureConnect", resolve20);
+            await new Promise((resolve21, reject) => {
+              socket.once("secureConnect", resolve21);
               socket.once("error", reject);
             });
             const ehlo2 = await sendCommand(socket, `EHLO ${this.host}`);
@@ -29036,14 +31118,14 @@ var init_messenger = __esm({
           let socket;
           if (this.port === 465) {
             socket = tls2.connect({ host: this.host, port: this.port, rejectUnauthorized: tlsRejectUnauthorized() });
-            await new Promise((resolve20, reject) => {
-              socket.once("secureConnect", resolve20);
+            await new Promise((resolve21, reject) => {
+              socket.once("secureConnect", resolve21);
               socket.once("error", reject);
             });
           } else {
             socket = net3.createConnection({ host: this.host, port: this.port });
-            await new Promise((resolve20, reject) => {
-              socket.once("connect", resolve20);
+            await new Promise((resolve21, reject) => {
+              socket.once("connect", resolve21);
               socket.once("error", reject);
             });
           }
@@ -29078,14 +31160,14 @@ var init_messenger = __esm({
         const useTls = this.imapEncryption === "tls" || this.imapEncryption === "ssl" || this.imapEncryption === "" && this.imapPort === 993;
         if (useTls) {
           socket = tls2.connect({ host: this.imapHost, port: this.imapPort, rejectUnauthorized: tlsRejectUnauthorized() });
-          await new Promise((resolve20, reject) => {
-            socket.once("secureConnect", resolve20);
+          await new Promise((resolve21, reject) => {
+            socket.once("secureConnect", resolve21);
             socket.once("error", reject);
           });
         } else {
           socket = net3.createConnection({ host: this.imapHost, port: this.imapPort });
-          await new Promise((resolve20, reject) => {
-            socket.once("connect", resolve20);
+          await new Promise((resolve21, reject) => {
+            socket.once("connect", resolve21);
             socket.once("error", reject);
           });
         }
@@ -29995,16 +32077,16 @@ var init_htmlElement = __esm({
 });
 
 // ../core/src/ai.ts
-import { existsSync as existsSync25, mkdirSync as mkdirSync16, writeFileSync as writeFileSync15, readFileSync as readFileSync24 } from "node:fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync17, writeFileSync as writeFileSync16, readFileSync as readFileSync24 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join27, resolve as resolve16, relative as relative9, dirname as dirname12 } from "node:path";
+import { join as join28, resolve as resolve17, relative as relative10, dirname as dirname12 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { execSync, execFileSync as execFileSync4 } from "node:child_process";
 import { createInterface } from "node:readline";
 function readVersion() {
   try {
     const thisDir = dirname12(fileURLToPath7(import.meta.url));
-    const rootPkg = resolve16(thisDir, "..", "..", "..", "package.json");
+    const rootPkg = resolve17(thisDir, "..", "..", "..", "package.json");
     const pkg = JSON.parse(readFileSync24(rootPkg, "utf-8"));
     return pkg.version ?? "0.0.0";
   } catch {
@@ -30068,8 +32150,8 @@ function downloadSkillsSync(jobs) {
 function installSkills(root = ".", targets) {
   const ref = skillsRef();
   const dests = targets ?? [
-    join27(resolve16(root), ".claude", "skills"),
-    join27(homedir(), ".claude", "skills")
+    join28(resolve17(root), ".claude", "skills"),
+    join28(homedir(), ".claude", "skills")
   ];
   const jobs = [];
   const index = /* @__PURE__ */ new Map();
@@ -30087,9 +32169,9 @@ function installSkills(root = ".", targets) {
     const base = `https://raw.githubusercontent.com/tina4stack/${spec.repo}/${ref}/.claude/skills/${skill}`;
     skillMdUrl[skill] = `${base}/SKILL.md`;
     for (const dest of dests) {
-      add(`${base}/SKILL.md`, join27(dest, skill, "SKILL.md"));
+      add(`${base}/SKILL.md`, join28(dest, skill, "SKILL.md"));
       for (const r of spec.references) {
-        add(`${base}/references/${r}`, join27(dest, skill, "references", r));
+        add(`${base}/references/${r}`, join28(dest, skill, "references", r));
       }
     }
   }
@@ -30101,10 +32183,10 @@ function installSkills(root = ".", targets) {
   return installed;
 }
 function isInstalled(root, tool) {
-  return existsSync25(join27(resolve16(root), tool.contextFile));
+  return existsSync26(join28(resolve17(root), tool.contextFile));
 }
 function showMenu(root = ".") {
-  const r = resolve16(root);
+  const r = resolve17(root);
   console.log("\n  Tina4 AI Context Installer\n");
   for (let i = 0; i < AI_TOOLS.length; i++) {
     const tool = AI_TOOLS[i];
@@ -30122,16 +32204,16 @@ function showMenu(root = ".") {
   const tina4AiMarker = tina4AiInstalled ? `  ${GREEN2}[installed]${RESET2}` : "";
   console.log(`  8. Install tina4-ai tools  (requires Python)${tina4AiMarker}`);
   console.log();
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     rl.question("  Select (comma-separated, or 'all'): ", (answer) => {
       rl.close();
-      resolve20(answer.trim());
+      resolve21(answer.trim());
     });
   });
 }
 function installSelected(root, selection) {
-  const rootPath = resolve16(root);
+  const rootPath = resolve17(root);
   const created = [];
   let indices;
   let doInstallTina4Ai = false;
@@ -30224,35 +32306,35 @@ function looksLikeOldFrameworkInstall(existing) {
 function writeOrMerge(contextPath, contextFile, frameworkGuide) {
   const block = skillBlock(contextFile);
   const [start2, end] = markersFor(contextFile);
-  if (!existsSync25(contextPath)) {
-    writeFileSync15(contextPath, frameworkGuide.replace(/\s+$/, "") + "\n\n" + block + "\n", "utf-8");
+  if (!existsSync26(contextPath)) {
+    writeFileSync16(contextPath, frameworkGuide.replace(/\s+$/, "") + "\n\n" + block + "\n", "utf-8");
     return "Installed";
   }
   const existing = readFileSync24(contextPath, "utf-8");
   if (hasMarkers(existing, start2, end)) {
-    writeFileSync15(contextPath, replaceMarkerBlock(existing, block, start2, end), "utf-8");
+    writeFileSync16(contextPath, replaceMarkerBlock(existing, block, start2, end), "utf-8");
     return "Refreshed skill block in";
   }
   if (looksLikeOldFrameworkInstall(existing)) {
     const head = existing.replace(/^\s+/, "");
     const preamble = existing.slice(0, existing.length - head.length);
     const newContent = (preamble.trim() ? preamble.replace(/\s+$/, "") + "\n\n" : "") + frameworkGuide.replace(/\s+$/, "") + "\n\n" + block + "\n";
-    writeFileSync15(contextPath, newContent, "utf-8");
+    writeFileSync16(contextPath, newContent, "utf-8");
     return "Migrated (replaced old framework dump in)";
   }
-  writeFileSync15(contextPath, existing.replace(/\s+$/, "") + "\n\n" + block + "\n", "utf-8");
+  writeFileSync16(contextPath, existing.replace(/\s+$/, "") + "\n\n" + block + "\n", "utf-8");
   return "Appended skill block to";
 }
 function installForTool(root, tool, context) {
   const created = [];
-  const contextPath = join27(root, tool.contextFile);
+  const contextPath = join28(root, tool.contextFile);
   if (tool.configDir) {
-    mkdirSync16(join27(root, tool.configDir), { recursive: true });
+    mkdirSync17(join28(root, tool.configDir), { recursive: true });
   }
   const parentDir = dirname12(contextPath);
-  mkdirSync16(parentDir, { recursive: true });
+  mkdirSync17(parentDir, { recursive: true });
   const action = writeOrMerge(contextPath, tool.contextFile, context);
-  const rel = relative9(root, contextPath);
+  const rel = relative10(root, contextPath);
   created.push(rel);
   console.log(`  ${GREEN2}\u2713${RESET2} ${action} ${rel}`);
   if (tool.name === "claude-code") {
@@ -30285,7 +32367,7 @@ function installTina4Ai() {
 function installClaudeSkills(root) {
   const created = [];
   for (const skill of installSkills(root)) {
-    created.push(join27(".claude", "skills", skill));
+    created.push(join28(".claude", "skills", skill));
     console.log(`  ${GREEN2}\u2713${RESET2} Installed .claude/skills/${skill}  (project + global)`);
   }
   return created;
@@ -30627,9 +32709,9 @@ import { tests, assertEqual, runAll } from "tina4-nodejs";
 function generateClaudeCodeContext() {
   try {
     const thisDir = dirname12(fileURLToPath7(import.meta.url));
-    const repoRoot = resolve16(thisDir, "..", "..", "..");
-    const claudeMdPath = join27(repoRoot, "CLAUDE.md");
-    if (existsSync25(claudeMdPath)) {
+    const repoRoot = resolve17(thisDir, "..", "..", "..");
+    const claudeMdPath = join28(repoRoot, "CLAUDE.md");
+    if (existsSync26(claudeMdPath)) {
       return readFileSync24(claudeMdPath, "utf-8");
     }
   } catch {
@@ -31176,11 +33258,11 @@ var init_aiClient = __esm({
         const payload = JSON.stringify(body);
         const controller = new AbortController();
         const totalTimer = setTimeout(() => controller.abort(new AiTimeoutError("AI total request timeout expired")), remainingMs);
-        return new Promise((resolve20, reject) => {
+        return new Promise((resolve21, reject) => {
           const client = url.protocol === "https:" ? https2 : http2;
           const request = client.request(url, { method: "POST", headers: { ...headers, "content-length": Buffer.byteLength(payload) }, signal: controller.signal }, (response) => {
             clearTimeout(connectTimer);
-            resolve20({ response, cleanup: () => {
+            resolve21({ response, cleanup: () => {
               clearTimeout(totalTimer);
               clearTimeout(connectTimer);
             } });
@@ -31209,7 +33291,7 @@ var init_aiClient = __esm({
         const value = Array.isArray(headers["retry-after"]) ? headers["retry-after"][0] : headers["retry-after"];
         const requested = value !== void 0 && Number.isFinite(Number(value)) ? Math.max(0, Number(value) * 1e3) : 100;
         const delay = Math.min(requested, Math.max(0, deadline - performance.now()));
-        return new Promise((resolve20) => setTimeout(resolve20, delay));
+        return new Promise((resolve21) => setTimeout(resolve21, delay));
       }
       static async requestJson(config, headers, body) {
         const deadline = performance.now() + config.totalTimeout * 1e3;
@@ -34153,8 +36235,8 @@ __export(sqlite_exports, {
   SQLiteAdapter: () => SQLiteAdapter
 });
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
-import { mkdirSync as mkdirSync17 } from "node:fs";
-import { dirname as dirname13, isAbsolute as isAbsolute5, join as join28, resolve as resolve17 } from "node:path";
+import { mkdirSync as mkdirSync18 } from "node:fs";
+import { dirname as dirname13, isAbsolute as isAbsolute5, join as join29, resolve as resolve18 } from "node:path";
 function isIdentifier(str) {
   return /^[A-Za-z_][A-Za-z0-9_]*$/.test(str);
 }
@@ -34187,13 +36269,13 @@ function resolveSqlitePath(dbPath) {
   if (dbPath === ":memory:") return dbPath;
   let path8 = dbPath;
   if (!isAbsolute5(path8)) {
-    path8 = join28(process.cwd(), path8);
-    mkdirSync17(dirname13(path8), { recursive: true });
+    path8 = join29(process.cwd(), path8);
+    mkdirSync18(dirname13(path8), { recursive: true });
   } else {
-    const cwd = resolve17(process.cwd());
-    const abs = resolve17(path8);
+    const cwd = resolve18(process.cwd());
+    const abs = resolve18(path8);
     if (abs.startsWith(cwd + "/") || abs === cwd) {
-      mkdirSync17(dirname13(abs), { recursive: true });
+      mkdirSync18(dirname13(abs), { recursive: true });
     }
   }
   return path8;
@@ -34591,7 +36673,7 @@ function withConnectTimeout(attempt, budgetMs, host, port, abandon) {
   const elapsedMs = () => performance.now() - startedAt;
   if (budgetMs === null) return attempt();
   const started = attempt();
-  return new Promise((resolve20, reject) => {
+  return new Promise((resolve21, reject) => {
     let expired = false;
     const timer = setTimeout(() => {
       expired = true;
@@ -34601,7 +36683,7 @@ function withConnectTimeout(attempt, budgetMs, host, port, abandon) {
       (arrived) => {
         clearTimeout(timer);
         if (expired) abandon?.(arrived);
-        else resolve20(arrived);
+        else resolve21(arrived);
       },
       (failure) => {
         clearTimeout(timer);
@@ -35190,10 +37272,10 @@ var init_mysql = __esm({
                 ...timeoutOption
               });
             }
-            return new Promise((resolve20, reject) => {
+            return new Promise((resolve21, reject) => {
               this.connection.connect((err) => {
                 if (err) reject(err);
-                else resolve20();
+                else resolve21();
               });
             });
           },
@@ -35215,10 +37297,10 @@ var init_mysql = __esm({
         }
       }
       queryPromise(sql, params) {
-        return new Promise((resolve20, reject) => {
+        return new Promise((resolve21, reject) => {
           this.connection.query(sql, params ?? [], (err, results) => {
             if (err) reject(err);
-            else resolve20(results);
+            else resolve21(results);
           });
         });
       }
@@ -35604,11 +37686,11 @@ var init_mssql = __esm({
           };
         }
         await withConnectTimeout(
-          () => new Promise((resolve20, reject) => {
+          () => new Promise((resolve21, reject) => {
             this.connection = new Connection(tediousConfig);
             this.connection.on("connect", (err) => {
               if (err) reject(err);
-              else resolve20();
+              else resolve21();
             });
             this.connection.connect();
           }),
@@ -35653,11 +37735,11 @@ var init_mssql = __esm({
         const tediousModule = requireTedious();
         const Request = tediousModule.Request;
         const TYPES = tediousModule.TYPES;
-        return new Promise((resolve20, reject) => {
+        return new Promise((resolve21, reject) => {
           const rows = [];
           const request = new Request(sql, (err, rowCount) => {
             if (err) reject(err);
-            else resolve20({ rows, rowCount });
+            else resolve21({ rows, rowCount });
           });
           if (params) {
             params.forEach((p, i) => {
@@ -35859,8 +37941,8 @@ var init_mssql = __esm({
         throw new Error("Use startTransactionAsync() for MSSQL.");
       }
       async startTransactionAsync() {
-        await new Promise((resolve20, reject) => {
-          this.connection.beginTransaction((err) => err ? reject(err) : resolve20());
+        await new Promise((resolve21, reject) => {
+          this.connection.beginTransaction((err) => err ? reject(err) : resolve21());
         });
         this._inTransaction = true;
       }
@@ -35868,8 +37950,8 @@ var init_mssql = __esm({
         throw new Error("Use commitAsync() for MSSQL.");
       }
       async commitAsync() {
-        await new Promise((resolve20, reject) => {
-          this.connection.commitTransaction((err) => err ? reject(err) : resolve20());
+        await new Promise((resolve21, reject) => {
+          this.connection.commitTransaction((err) => err ? reject(err) : resolve21());
         });
         this._inTransaction = false;
       }
@@ -35877,8 +37959,8 @@ var init_mssql = __esm({
         throw new Error("Use rollbackAsync() for MSSQL.");
       }
       async rollbackAsync() {
-        await new Promise((resolve20, reject) => {
-          this.connection.rollbackTransaction((err) => err ? reject(err) : resolve20());
+        await new Promise((resolve21, reject) => {
+          this.connection.rollbackTransaction((err) => err ? reject(err) : resolve21());
         });
         this._inTransaction = false;
       }
@@ -36203,8 +38285,8 @@ var init_firebird = __esm({
       }
       attachOnce(config) {
         const fb = requireFirebird();
-        return new Promise((resolve20, reject) => {
-          fb.attach(config, (err, db) => err ? reject(err) : resolve20(db));
+        return new Promise((resolve21, reject) => {
+          fb.attach(config, (err, db) => err ? reject(err) : resolve21(db));
         });
       }
       /**
@@ -36223,7 +38305,7 @@ var init_firebird = __esm({
           } catch (err) {
             lastError = err;
             if (attempt < attempts - 1) {
-              await new Promise((resolve20) => setTimeout(resolve20, 100 * (attempt + 1)));
+              await new Promise((resolve21) => setTimeout(resolve21, 100 * (attempt + 1)));
             }
           }
         }
@@ -36306,19 +38388,19 @@ var init_firebird = __esm({
       }
       queryPromise(sql, params) {
         const translated = this.translateSql(sql);
-        return this.withReconnect(() => new Promise((resolve20, reject) => {
+        return this.withReconnect(() => new Promise((resolve21, reject) => {
           this.statementHandle().query(translated, params ?? [], (err, result) => {
             if (err) reject(err);
-            else resolve20(result ?? []);
+            else resolve21(result ?? []);
           });
         }));
       }
       executePromise(sql, params) {
         const translated = this.translateSql(sql);
-        return this.withReconnect(() => new Promise((resolve20, reject) => {
+        return this.withReconnect(() => new Promise((resolve21, reject) => {
           this.statementHandle().execute(translated, params ?? [], (err) => {
             if (err) reject(err);
-            else resolve20();
+            else resolve21();
           });
         }));
       }
@@ -36357,13 +38439,13 @@ var init_firebird = __esm({
        * and no bytes round-tripped (FB-BLOB-SRP-UNVERIFIED).
        */
       readBlob(blobFn) {
-        return new Promise((resolve20, reject) => {
+        return new Promise((resolve21, reject) => {
           blobFn((err, _name, emitter) => {
             if (err) return reject(err);
-            if (!emitter) return resolve20(null);
+            if (!emitter) return resolve21(null);
             const chunks = [];
             emitter.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
-            emitter.on("end", () => resolve20(Buffer.concat(chunks)));
+            emitter.on("end", () => resolve21(Buffer.concat(chunks)));
             emitter.on("error", (streamErr) => reject(streamErr));
           });
         });
@@ -36499,12 +38581,12 @@ var init_firebird = __esm({
       }
       async startTransactionAsync() {
         this.ensureConnected();
-        await new Promise((resolve20, reject) => {
+        await new Promise((resolve21, reject) => {
           this.db.transaction(0, (err, transaction) => {
             if (err) reject(err);
             else {
               this.transaction = transaction;
-              resolve20();
+              resolve21();
             }
           });
         });
@@ -36514,12 +38596,12 @@ var init_firebird = __esm({
       }
       async commitAsync() {
         if (!this.transaction) throw new Error("No active transaction to commit.");
-        await new Promise((resolve20, reject) => {
+        await new Promise((resolve21, reject) => {
           this.transaction.commit((err) => {
             if (err) reject(err);
             else {
               this.transaction = null;
-              resolve20();
+              resolve21();
             }
           });
         });
@@ -36529,12 +38611,12 @@ var init_firebird = __esm({
       }
       async rollbackAsync() {
         if (!this.transaction) throw new Error("No active transaction to rollback.");
-        await new Promise((resolve20, reject) => {
+        await new Promise((resolve21, reject) => {
           this.transaction.rollback((err) => {
             if (err) reject(err);
             else {
               this.transaction = null;
-              resolve20();
+              resolve21();
             }
           });
         });
@@ -39014,7 +41096,7 @@ var init_database = __esm({
 
 // src/model.ts
 import { readdirSync as readdirSync17, statSync as statSync17 } from "node:fs";
-import { join as join29, extname as extname7 } from "node:path";
+import { join as join30, extname as extname7 } from "node:path";
 async function discoverModels(modelsDir) {
   const models = [];
   let files;
@@ -39024,7 +41106,7 @@ async function discoverModels(modelsDir) {
     return models;
   }
   for (const file of files) {
-    const filePath = join29(modelsDir, file);
+    const filePath = join30(modelsDir, file);
     const stat = statSync17(filePath);
     if (!stat.isFile()) continue;
     const ext = extname7(file);
@@ -39066,8 +41148,8 @@ var init_model = __esm({
 });
 
 // src/migration.ts
-import { existsSync as existsSync26, readdirSync as readdirSync18, readFileSync as readFileSync25, mkdirSync as mkdirSync18, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join30, resolve as resolve18 } from "node:path";
+import { existsSync as existsSync27, readdirSync as readdirSync18, readFileSync as readFileSync25, mkdirSync as mkdirSync19, writeFileSync as writeFileSync17 } from "node:fs";
+import { join as join31, resolve as resolve19 } from "node:path";
 function unwrapAdapter(db) {
   let cur = db;
   while (cur && cur.constructor?.name === "CachedDatabaseAdapter" && cur.adapter) {
@@ -39383,15 +41465,15 @@ async function rollback(migrationsDir, delimiter2) {
     }
     return rolledBack2;
   }
-  const dir = resolve18(migrationsDir ?? "migrations");
+  const dir = resolve19(migrationsDir ?? "migrations");
   const delim = delimiter2 ?? ";";
   const db = getAdapter();
   const migrations = await getLastBatchMigrations();
   const rolledBack = [];
   for (const migration of migrations) {
     const downFile = `${migration.migration_name}.down.sql`;
-    const downPath = join30(dir, downFile);
-    if (!existsSync26(downPath)) {
+    const downPath = join31(dir, downFile);
+    if (!existsSync27(downPath)) {
       throw new Error(
         `Cannot rollback ${migration.migration_name}: no .down.sql file found`
       );
@@ -39555,10 +41637,10 @@ function warnUnprefixedMigrations(files) {
 }
 async function migrate(adapter, options) {
   const db = adapter ?? getAdapter();
-  const dir = resolve18(options?.migrationsDir ?? "migrations");
+  const dir = resolve19(options?.migrationsDir ?? "migrations");
   const delimiter2 = options?.delimiter ?? ";";
   const result = { applied: [], skipped: [], failed: [] };
-  if (!existsSync26(dir)) {
+  if (!existsSync27(dir)) {
     return result;
   }
   await ensureMigrationTableOn(db);
@@ -39594,7 +41676,7 @@ async function migrate(adapter, options) {
       result.skipped.push(file);
       continue;
     }
-    const sqlContent = readFileSync25(join30(dir, file), "utf-8").trim();
+    const sqlContent = readFileSync25(join31(dir, file), "utf-8").trim();
     if (!sqlContent) {
       result.skipped.push(file);
       continue;
@@ -39629,9 +41711,9 @@ async function migrate(adapter, options) {
 }
 async function status(adapter, options) {
   const db = adapter ?? getAdapter();
-  const dir = resolve18(options?.migrationsDir ?? "migrations");
+  const dir = resolve19(options?.migrationsDir ?? "migrations");
   const result = { completed: [], pending: [] };
-  if (!existsSync26(dir)) {
+  if (!existsSync27(dir)) {
     return result;
   }
   if (!await adapterTableExists(db, MIGRATION_TABLE)) {
@@ -39677,13 +41759,13 @@ async function createMigration(description, options) {
   if (kind === "code" || kind === "class") {
     return createClassMigration(description, options);
   }
-  const dir = resolve18(options?.migrationsDir ?? "migrations");
-  if (!existsSync26(dir)) {
-    mkdirSync18(dir, { recursive: true });
+  const dir = resolve19(options?.migrationsDir ?? "migrations");
+  if (!existsSync27(dir)) {
+    mkdirSync19(dir, { recursive: true });
   }
   const safeName = description.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "");
   const now = /* @__PURE__ */ new Date();
-  const timestamp = [
+  const timestamp2 = [
     now.getFullYear(),
     String(now.getMonth() + 1).padStart(2, "0"),
     String(now.getDate()).padStart(2, "0"),
@@ -39691,10 +41773,10 @@ async function createMigration(description, options) {
     String(now.getMinutes()).padStart(2, "0"),
     String(now.getSeconds()).padStart(2, "0")
   ].join("");
-  const upFileName = `${timestamp}_${safeName}.sql`;
-  const downFileName = `${timestamp}_${safeName}.down.sql`;
-  const upPath = join30(dir, upFileName);
-  const downPath = join30(dir, downFileName);
+  const upFileName = `${timestamp2}_${safeName}.sql`;
+  const downFileName = `${timestamp2}_${safeName}.down.sql`;
+  const upPath = join31(dir, upFileName);
+  const downPath = join31(dir, downFileName);
   const upTemplate = `-- Migration: ${description}
 -- Created: ${now.toISOString()}
 
@@ -39703,19 +41785,19 @@ async function createMigration(description, options) {
 -- Created: ${now.toISOString()}
 
 `;
-  writeFileSync16(upPath, upTemplate, "utf-8");
-  writeFileSync16(downPath, downTemplate, "utf-8");
+  writeFileSync17(upPath, upTemplate, "utf-8");
+  writeFileSync17(downPath, downTemplate, "utf-8");
   return { upPath, downPath };
 }
 async function createClassMigration(description, options) {
-  const dir = resolve18(options?.migrationsDir ?? "migrations");
-  if (!existsSync26(dir)) {
-    mkdirSync18(dir, { recursive: true });
+  const dir = resolve19(options?.migrationsDir ?? "migrations");
+  if (!existsSync27(dir)) {
+    mkdirSync19(dir, { recursive: true });
   }
   const safeName = description.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_|_$/g, "");
   const className = description.replace(/[^a-zA-Z0-9 ]+/g, " ").trim().split(/\s+/).map((w) => w.charAt(0).toUpperCase() + w.slice(1).toLowerCase()).join("");
   const now = /* @__PURE__ */ new Date();
-  const timestamp = [
+  const timestamp2 = [
     now.getFullYear(),
     String(now.getMonth() + 1).padStart(2, "0"),
     String(now.getDate()).padStart(2, "0"),
@@ -39723,8 +41805,8 @@ async function createClassMigration(description, options) {
     String(now.getMinutes()).padStart(2, "0"),
     String(now.getSeconds()).padStart(2, "0")
   ].join("");
-  const fileName = `${timestamp}_${safeName}.ts`;
-  const filePath = join30(dir, fileName);
+  const fileName = `${timestamp2}_${safeName}.ts`;
+  const filePath = join31(dir, fileName);
   const content = `// Migration: ${description}
 // Created: ${now.toISOString()}
 
@@ -39740,7 +41822,7 @@ export class ${className} {
   }
 }
 `;
-  writeFileSync16(filePath, content, "utf-8");
+  writeFileSync17(filePath, content, "utf-8");
   return filePath;
 }
 var ALTER_ADD_RE, CREATE_TABLE_RE, MIGRATION_TABLE, SMART_QUOTES, SMART_QUOTE_RE, SET_TERM_RE, Migration;
@@ -39821,8 +41903,8 @@ var init_migration = __esm({
       }
       /** Return sorted list of all migration files on disk (excludes .down.sql). */
       getFiles() {
-        const dir = resolve18(this.dir);
-        if (!existsSync26(dir)) return [];
+        const dir = resolve19(this.dir);
+        if (!existsSync27(dir)) return [];
         return sortMigrationFiles(
           readdirSync18(dir).filter((f) => f.endsWith(".sql") && !f.endsWith(".down.sql"))
         );
@@ -42606,8 +44688,8 @@ var init_seeder = __esm({
 // src/docstore.ts
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 import { randomBytes as randomBytes9 } from "node:crypto";
-import { mkdirSync as mkdirSync19 } from "node:fs";
-import { dirname as dirname14, isAbsolute as isAbsolute6, join as join31 } from "node:path";
+import { mkdirSync as mkdirSync20 } from "node:fs";
+import { dirname as dirname14, isAbsolute as isAbsolute6, join as join32 } from "node:path";
 function iso(d) {
   return d.toISOString();
 }
@@ -42872,8 +44954,8 @@ function resolveStorePath(dbPath) {
   if (dbPath === ":memory:") return dbPath;
   let path8 = dbPath;
   if (!isAbsolute6(path8)) {
-    path8 = join31(process.cwd(), path8);
-    mkdirSync19(dirname14(path8), { recursive: true });
+    path8 = join32(process.cwd(), path8);
+    mkdirSync20(dirname14(path8), { recursive: true });
   }
   return path8;
 }
@@ -44156,8 +46238,8 @@ var init_attachment = __esm({
 
 // src/realtime/storage.ts
 import { randomBytes as randomBytes10 } from "node:crypto";
-import { mkdirSync as mkdirSync20, readFileSync as readFileSync26, writeFileSync as writeFileSync17, unlinkSync as unlinkSync8, statSync as statSync18 } from "node:fs";
-import { resolve as resolve19, sep as sep5 } from "node:path";
+import { mkdirSync as mkdirSync21, readFileSync as readFileSync26, writeFileSync as writeFileSync18, unlinkSync as unlinkSync8, statSync as statSync18 } from "node:fs";
+import { resolve as resolve20, sep as sep6 } from "node:path";
 import { createRequire as createRequire8 } from "node:module";
 function storageKey(filename = "") {
   let ext = "";
@@ -44193,19 +46275,19 @@ var init_storage = __esm({
     LocalStorage = class {
       directory;
       constructor(directory) {
-        this.directory = resolve19(directory || process.env.TINA4_STORAGE_DIR || "data/rt_storage");
-        mkdirSync20(this.directory, { recursive: true });
+        this.directory = resolve20(directory || process.env.TINA4_STORAGE_DIR || "data/rt_storage");
+        mkdirSync21(this.directory, { recursive: true });
       }
       // Resolve inside the root and reject any traversal attempt.
       pathFor(key) {
-        const target = resolve19(this.directory, key);
-        if (target !== this.directory && !target.startsWith(this.directory + sep5)) {
+        const target = resolve20(this.directory, key);
+        if (target !== this.directory && !target.startsWith(this.directory + sep6)) {
           throw new Error(`unsafe storage key: ${JSON.stringify(key)}`);
         }
         return target;
       }
       put(key, data) {
-        writeFileSync17(this.pathFor(key), data);
+        writeFileSync18(this.pathFor(key), data);
       }
       get(key) {
         try {