tina4-nodejs 3.13.138 → 3.13.140

package/packages/core/dist/index.js

@@ -950,6 +950,8 @@ var auth_exports = {};
 __export(auth_exports, {
   Auth: () => Auth,
   JWT_LEEWAY_SECONDS: () => JWT_LEEWAY_SECONDS,
+  MIN_SECRET_BYTES: () => MIN_SECRET_BYTES,
+  NON_IDENTITY_TOKEN_TYPES: () => NON_IDENTITY_TOKEN_TYPES,
   algorithmAvailable: () => algorithmAvailable,
   authMiddleware: () => authMiddleware,
   authenticateRequest: () => authenticateRequest,
@@ -959,7 +961,10 @@ __export(auth_exports, {
   getPayload: () => getPayload,
   getToken: () => getToken,
   hashPassword: () => hashPassword,
+  insecureSecretMessage: () => insecureSecretMessage,
+  isIdentityPayload: () => isIdentityPayload,
   refreshToken: () => refreshToken,
+  requireBootSecret: () => requireBootSecret,
   resolveAlgorithm: () => resolveAlgorithm,
   validToken: () => validToken,
   validateApiKey: () => validateApiKey
@@ -995,6 +1000,23 @@ async function _logWarning(message) {
 function _warnBlankSecret() {
   void _logWarning(BLANK_SECRET_WARNING);
 }
+function isIdentityPayload(payload) {
+  return payload != null && !NON_IDENTITY_TOKEN_TYPES.includes(payload.type);
+}
+function insecureSecretMessage(secret) {
+  const length = Buffer.byteLength(secret ?? "", "utf8");
+  if (length >= MIN_SECRET_BYTES) return null;
+  const what = length === 0 ? "is not set" : `is ${length} bytes`;
+  return `Auth: TINA4_SECRET ${what}; an HMAC JWT secret must be at least ${MIN_SECRET_BYTES} bytes. Generate one with \`openssl rand -hex 32\` and set TINA4_SECRET in your environment or .env.`;
+}
+function requireBootSecret() {
+  const algorithm = (process.env.TINA4_JWT_ALGORITHM ?? "").trim() || "HS256";
+  if (RSA_SIGN_ALGORITHMS.has(algorithm)) return;
+  const secret = process.env.TINA4_SECRET ?? "";
+  if (secret === "" && _isDev()) return;
+  const message = insecureSecretMessage(secret);
+  if (message) throw new Error(message);
+}
 function ensureDevSecret(cwd) {
   if (process.env.TINA4_SECRET) return null;
   if (!_isDev() || _isCi() || _isProduction()) {
@@ -1125,6 +1147,13 @@ function validToken(token, secret, algorithm) {
     const [h, p, sig] = parts;
     const header = JSON.parse(base64urlDecode(h).toString());
     if (header.alg !== resolvedAlgorithm) return null;
+    if (HMAC_DIGESTS.has(resolvedAlgorithm)) {
+      const weak = insecureSecretMessage(resolvedSecret);
+      if (weak) {
+        void _logWarning(weak);
+        return null;
+      }
+    }
     const signingInput = `${h}.${p}`;
     if (!verifySignature(signingInput, sig, resolvedSecret, resolvedAlgorithm)) {
       return null;
@@ -1156,6 +1185,8 @@ function getPayload(token) {
 function sign(input, secret, algorithm) {
   const digest = HMAC_DIGESTS.get(algorithm);
   if (digest) {
+    const weak = insecureSecretMessage(secret);
+    if (weak) throw new Error(weak);
     return base64urlEncode(createHmac(digest, secret).update(input).digest());
   }
   const rsaAlgorithm = RSA_SIGN_ALGORITHMS.get(algorithm);
@@ -1213,17 +1244,17 @@ function authMiddleware(secret, algorithm) {
       return;
     }
     const token = authHeader.slice(7);
-    if (!validToken(token, secret, algorithm)) {
+    const payload = validToken(token, secret, algorithm);
+    if (!isIdentityPayload(payload)) {
       res({ error: "Unauthorized" }, 401);
       return;
     }
-    req2.auth = getPayload(token);
+    req2.auth = payload;
     next();
   };
 }
 function refreshToken(token, expiresIn = 60) {
-  if (!validToken(token)) return null;
-  const payload = getPayload(token);
+  const payload = validToken(token);
   if (!payload) return null;
   const { iat: _iat, exp: _exp, ...claims } = payload;
   return getToken(claims, expiresIn);
@@ -1232,7 +1263,8 @@ function authenticateRequest(headers, secret, algorithm) {
   const authHeader = headers.authorization ?? headers.Authorization ?? "";
   if (!authHeader.startsWith("Bearer ")) return null;
   const token = authHeader.slice(7);
-  if (validToken(token, secret, algorithm)) return getPayload(token);
+  const payload = validToken(token, secret, algorithm);
+  if (payload) return isIdentityPayload(payload) ? payload : null;
   if (validateApiKey(token)) {
     return { _auth: "api_key" };
   }
@@ -1246,12 +1278,14 @@ function validateApiKey(provided, expected) {
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
-var BLANK_SECRET_WARNING, HMAC_DIGESTS, RSA_SIGN_ALGORITHMS, KNOWN_ALGORITHMS, ALGORITHM_REMEDY, capabilityCache, JWT_LEEWAY_SECONDS, Auth;
+var BLANK_SECRET_WARNING, NON_IDENTITY_TOKEN_TYPES, MIN_SECRET_BYTES, HMAC_DIGESTS, RSA_SIGN_ALGORITHMS, KNOWN_ALGORITHMS, ALGORITHM_REMEDY, capabilityCache, JWT_LEEWAY_SECONDS, Auth;
 var init_auth = __esm({
   "src/auth.ts"() {
     "use strict";
     init_dotenv();
     BLANK_SECRET_WARNING = "Auth: TINA4_SECRET is not set \u2014 JWT signing is insecure. Set TINA4_SECRET to a random value (e.g. `openssl rand -hex 32`) in your environment or .env before serving traffic. For LOCAL DEV, set TINA4_DEBUG=true and a per-machine secret is generated automatically into .env.local (gitignored). Seeing this warning means the run was NOT detected as dev \u2014 typically a container or CI without TINA4_DEBUG set, or TINA4_ENV=production.";
+    NON_IDENTITY_TOKEN_TYPES = ["form"];
+    MIN_SECRET_BYTES = 32;
     HMAC_DIGESTS = /* @__PURE__ */ new Map([
       ["HS256", "sha256"],
       ["HS384", "sha384"],
@@ -3540,14 +3574,72 @@ var init_cachedDatabase = __esm({
   }
 });
 
+// ../orm/src/adapters/sqlCrud.ts
+function buildInsertRow(dialect, table2, data, suffix = "", options = {}) {
+  const keys = Object.keys(data);
+  const sql = buildInsert(dialect, table2, keys, suffix, options.startAt ?? 1);
+  return { sql, values: Object.values(data) };
+}
+function buildInsertRows(dialect, table2, rows) {
+  if (rows.length === 0) return null;
+  const keys = Object.keys(rows[0]);
+  const sql = buildInsert(dialect, table2, keys);
+  const paramsList = rows.map((row) => keys.map((k) => row[k]));
+  return { sql, paramsList };
+}
+function buildUpdate(dialect, table2, data, filter, params, options = {}) {
+  const startAt = options.startAt ?? 1;
+  const convertFragment = options.convertFragment ?? identityFragment;
+  const dataKeys = Object.keys(data);
+  const setClauses = buildSetClause(dialect, dataKeys, startAt);
+  const whereStart = startAt + dataKeys.length;
+  if (typeof filter === "string") {
+    const where = filter ? ` WHERE ${convertFragment(filter, whereStart)}` : "";
+    return {
+      sql: `UPDATE ${dialect.quote(table2)} SET ${setClauses}${where}`,
+      values: [...Object.values(data), ...params ?? []]
+    };
+  }
+  const whereClauses = buildWhereClause(dialect, Object.keys(filter), whereStart);
+  return {
+    sql: `UPDATE ${dialect.quote(table2)} SET ${setClauses} WHERE ${whereClauses}`,
+    values: [...Object.values(data), ...Object.values(filter)]
+  };
+}
+function buildDelete(dialect, table2, filter, params, options = {}) {
+  const startAt = options.startAt ?? 1;
+  const convertFragment = options.convertFragment ?? identityFragment;
+  if (typeof filter === "string") {
+    const where = filter ? ` WHERE ${convertFragment(filter, startAt)}` : "";
+    return {
+      sql: `DELETE FROM ${dialect.quote(table2)}${where}`,
+      values: params ?? []
+    };
+  }
+  const whereClauses = buildWhereClause(dialect, Object.keys(filter), startAt);
+  return {
+    sql: `DELETE FROM ${dialect.quote(table2)} WHERE ${whereClauses}`,
+    values: Object.values(filter)
+  };
+}
+var identityFragment;
+var init_sqlCrud = __esm({
+  "../orm/src/adapters/sqlCrud.ts"() {
+    "use strict";
+    init_sqlDialect();
+    identityFragment = (fragment) => fragment;
+  }
+});
+
 // ../orm/src/adapters/sqlite.ts
 var sqlite_exports = {};
 __export(sqlite_exports, {
-  SQLiteAdapter: () => SQLiteAdapter
+  SQLiteAdapter: () => SQLiteAdapter,
+  resolveSqlitePath: () => resolveSqlitePath
 });
 import { DatabaseSync } from "node:sqlite";
 import { mkdirSync as mkdirSync2 } from "node:fs";
-import { dirname as dirname3, isAbsolute as isAbsolute2, join as join4, resolve as resolve2 } from "node:path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, join as join4, resolve as resolve2, sep } from "node:path";
 function isIdentifier(str) {
   return /^[A-Za-z_][A-Za-z0-9_]*$/.test(str);
 }
@@ -3578,17 +3670,20 @@ function sqliteVersionAtLeast(major, minor, patch2) {
 }
 function resolveSqlitePath(dbPath) {
   if (dbPath === ":memory:") return dbPath;
-  let path10 = dbPath;
-  if (!isAbsolute2(path10)) {
-    path10 = join4(process.cwd(), path10);
-    mkdirSync2(dirname3(path10), { recursive: true });
-  } else {
-    const cwd = resolve2(process.cwd());
-    const abs = resolve2(path10);
-    if (abs.startsWith(cwd + "/") || abs === cwd) {
-      mkdirSync2(dirname3(abs), { recursive: true });
-    }
+  const isWindowsAbs = /^[A-Za-z]:[\\/]/.test(dbPath);
+  if (isAbsolute2(dbPath) || isWindowsAbs) {
+    return dbPath;
+  }
+  const cwd = resolve2(process.cwd());
+  const path10 = join4(cwd, dbPath);
+  const parent = dirname3(path10);
+  const absParent = resolve2(parent);
+  if (absParent !== cwd && !absParent.startsWith(cwd + sep)) {
+    throw new Error(
+      `SQLite path "${dbPath}" resolves outside the project directory: "${absParent}" is not within "${cwd}". Tina4 refuses to create directories outside the project (ADR-0086). Use an absolute path for a database that lives outside the project.`
+    );
   }
+  mkdirSync2(parent, { recursive: true, mode: 509 });
   return path10;
 }
 function fieldTypeToSQLite(def) {
@@ -3624,6 +3719,7 @@ var init_sqlite = __esm({
   "../orm/src/adapters/sqlite.ts"() {
     "use strict";
     init_sqlDialect();
+    init_sqlCrud();
     init_sqlTranslator();
     _sqliteVersionInfo = null;
     SQLiteAdapter = class {
@@ -3744,16 +3840,12 @@ var init_sqlite = __esm({
       }
       insert(table2, data) {
         if (Array.isArray(data)) {
-          if (data.length === 0) return { success: true, affectedRows: 0 };
-          const keys2 = Object.keys(data[0]);
-          const sql2 = buildInsert(ANSI_DIALECT, table2, keys2);
-          const paramsList = data.map((row) => keys2.map((k) => row[k]));
-          const result = this.executeMany(sql2, paramsList);
+          const batch = buildInsertRows(ANSI_DIALECT, table2, data);
+          if (!batch) return { success: true, affectedRows: 0 };
+          const result = this.executeMany(batch.sql, batch.paramsList);
           return { success: true, affectedRows: result.affectedRows, lastId: result.lastId };
         }
-        const keys = Object.keys(data);
-        const sql = buildInsert(ANSI_DIALECT, table2, keys);
-        const values = Object.values(data);
+        const { sql, values } = buildInsertRow(ANSI_DIALECT, table2, data);
         try {
           const result = this.db.prepare(sql).run(...toSqlParams(values));
           this._lastInsertId = result.lastInsertRowid;
@@ -3763,21 +3855,7 @@ var init_sqlite = __esm({
         }
       }
       update(table2, data, filter, params) {
-        const setClauses = buildSetClause(ANSI_DIALECT, Object.keys(data));
-        if (typeof filter === "string") {
-          const where = filter ? ` WHERE ${filter}` : "";
-          const sql2 = `UPDATE ${ANSI_DIALECT.quote(table2)} SET ${setClauses}${where}`;
-          const values2 = [...Object.values(data), ...params ?? []];
-          try {
-            const result = this.db.prepare(sql2).run(...toSqlParams(values2));
-            return { success: true, affectedRows: Number(result.changes) };
-          } catch (e) {
-            return { success: false, affectedRows: 0, error: e.message };
-          }
-        }
-        const whereClauses = buildWhereClause(ANSI_DIALECT, Object.keys(filter));
-        const sql = `UPDATE ${ANSI_DIALECT.quote(table2)} SET ${setClauses} WHERE ${whereClauses}`;
-        const values = [...Object.values(data), ...Object.values(filter)];
+        const { sql, values } = buildUpdate(ANSI_DIALECT, table2, data, filter, params);
         try {
           const result = this.db.prepare(sql).run(...toSqlParams(values));
           return { success: true, affectedRows: Number(result.changes) };
@@ -3794,18 +3872,7 @@ var init_sqlite = __esm({
           }
           return { success: true, affectedRows: totalAffected };
         }
-        if (typeof filter === "string") {
-          const sql2 = filter ? `DELETE FROM "${table2}" WHERE ${filter}` : `DELETE FROM "${table2}"`;
-          try {
-            const result = this.db.prepare(sql2).run(...toSqlParams(params ?? []));
-            return { success: true, affectedRows: Number(result.changes) };
-          } catch (e) {
-            return { success: false, affectedRows: 0, error: e.message };
-          }
-        }
-        const whereClauses = buildWhereClause(ANSI_DIALECT, Object.keys(filter));
-        const sql = `DELETE FROM ${ANSI_DIALECT.quote(table2)} WHERE ${whereClauses}`;
-        const values = Object.values(filter);
+        const { sql, values } = buildDelete(ANSI_DIALECT, table2, filter, params);
         try {
           const result = this.db.prepare(sql).run(...toSqlParams(values));
           return { success: true, affectedRows: Number(result.changes) };
@@ -4097,6 +4164,7 @@ var init_postgres = __esm({
   "../orm/src/adapters/postgres.ts"() {
     "use strict";
     init_sqlDialect();
+    init_sqlCrud();
     init_sqlTranslator();
     init_connectTimeout();
     pg = null;
@@ -4298,21 +4366,17 @@ var init_postgres = __esm({
       async insertAsync(table2, data) {
         this.ensureConnected();
         if (Array.isArray(data)) {
-          if (data.length === 0) return { success: true, affectedRows: 0 };
-          const keys2 = Object.keys(data[0]);
-          const sql2 = buildInsert(ANSI_DIALECT, table2, keys2);
-          const paramsList = data.map((row) => keys2.map((k) => row[k]));
+          const batch = buildInsertRows(ANSI_DIALECT, table2, data);
+          if (!batch) return { success: true, affectedRows: 0 };
           try {
-            const result = await this.executeManyAsync(sql2, paramsList);
+            const result = await this.executeManyAsync(batch.sql, batch.paramsList);
             if (result.lastId !== void 0) this._lastInsertId = result.lastId;
             return { success: true, affectedRows: result.totalAffected, lastId: result.lastId };
           } catch (e) {
             return { success: false, affectedRows: 0, error: e.message };
           }
         }
-        const keys = Object.keys(data);
-        const sql = buildInsert(POSTGRES_DIALECT, table2, keys, " RETURNING *");
-        const values = Object.values(data);
+        const { sql, values } = buildInsertRow(POSTGRES_DIALECT, table2, data, " RETURNING *");
         try {
           const result = await this.client.query(sql, values);
           const insertedRow = result.rows[0];
@@ -4332,26 +4396,10 @@ var init_postgres = __esm({
       }
       async updateAsync(table2, data, filter, params) {
         this.ensureConnected();
-        const dataKeys = Object.keys(data);
-        let paramIndex = 1;
-        const setClauses = buildSetClause(POSTGRES_DIALECT, dataKeys, paramIndex);
-        paramIndex += dataKeys.length;
-        if (typeof filter === "string") {
-          const where = filter ? ` WHERE ${this.convertPlaceholders(filter, paramIndex)}` : "";
-          const sql2 = `UPDATE ${POSTGRES_DIALECT.quote(table2)} SET ${setClauses}${where}`;
-          const values2 = [...Object.values(data), ...params ?? []];
-          try {
-            const result = await this.client.query(sql2, values2);
-            return { success: true, affectedRows: result.rowCount ?? 0 };
-          } catch (e) {
-            return { success: false, affectedRows: 0, error: e.message };
-          }
-        }
-        const filterKeys = Object.keys(filter);
-        const whereClauses = buildWhereClause(POSTGRES_DIALECT, filterKeys, paramIndex);
-        paramIndex += filterKeys.length;
-        const sql = `UPDATE ${POSTGRES_DIALECT.quote(table2)} SET ${setClauses} WHERE ${whereClauses}`;
-        const values = [...Object.values(data), ...Object.values(filter)];
+        const { sql, values } = buildUpdate(POSTGRES_DIALECT, table2, data, filter, params, {
+          startAt: 1,
+          convertFragment: (fragment, startAt) => this.convertPlaceholders(fragment, startAt)
+        });
         try {
           const result = await this.client.query(sql, values);
           return { success: true, affectedRows: result.rowCount ?? 0 };
@@ -4364,21 +4412,10 @@ var init_postgres = __esm({
       }
       async deleteAsync(table2, filter, params) {
         this.ensureConnected();
-        if (typeof filter === "string") {
-          const sql2 = filter ? `DELETE FROM "${table2}" WHERE ${this.bindable(filter, params)}` : `DELETE FROM "${table2}"`;
-          try {
-            const result = await this.client.query(sql2, params ?? []);
-            return { success: true, affectedRows: result.rowCount ?? 0 };
-          } catch (e) {
-            return { success: false, affectedRows: 0, error: e.message };
-          }
-        }
-        const filterKeys = Object.keys(filter);
-        let paramIndex = 1;
-        const whereClauses = buildWhereClause(POSTGRES_DIALECT, filterKeys, paramIndex);
-        paramIndex += filterKeys.length;
-        const sql = `DELETE FROM ${POSTGRES_DIALECT.quote(table2)} WHERE ${whereClauses}`;
-        const values = Object.values(filter);
+        const { sql, values } = buildDelete(POSTGRES_DIALECT, table2, filter, params, {
+          startAt: 1,
+          convertFragment: (fragment) => this.bindable(fragment, params)
+        });
         try {
           const result = await this.client.query(sql, values);
           return { success: true, affectedRows: result.rowCount ?? 0 };
@@ -4552,6 +4589,7 @@ var init_mysql = __esm({
   "../orm/src/adapters/mysql.ts"() {
     "use strict";
     init_sqlDialect();
+    init_sqlCrud();
     init_sqlTranslator();
     init_connectTimeout();
     mysql2 = null;
@@ -4733,21 +4771,17 @@ var init_mysql = __esm({
       async insertAsync(table2, data) {
         this.ensureConnected();
         if (Array.isArray(data)) {
-          if (data.length === 0) return { success: true, affectedRows: 0 };
-          const keys2 = Object.keys(data[0]);
-          const sql2 = buildInsert(MYSQL_DIALECT, table2, keys2);
-          const paramsList = data.map((row) => keys2.map((k) => row[k]));
+          const batch = buildInsertRows(MYSQL_DIALECT, table2, data);
+          if (!batch) return { success: true, affectedRows: 0 };
           try {
-            const result = await this.executeManyAsync(sql2, paramsList);
+            const result = await this.executeManyAsync(batch.sql, batch.paramsList);
             if (result.lastId !== void 0) this._lastInsertId = result.lastId;
             return { success: true, affectedRows: result.totalAffected, lastId: result.lastId };
           } catch (e) {
             return { success: false, affectedRows: 0, error: e.message };
           }
         }
-        const keys = Object.keys(data);
-        const sql = buildInsert(MYSQL_DIALECT, table2, keys);
-        const values = Object.values(data);
+        const { sql, values } = buildInsertRow(MYSQL_DIALECT, table2, data);
         try {
           const result = await this.queryPromise(sql, values);
           this._lastInsertId = result.insertId ?? null;
@@ -4765,21 +4799,7 @@ var init_mysql = __esm({
       }
       async updateAsync(table2, data, filter, params) {
         this.ensureConnected();
-        const setClauses = buildSetClause(MYSQL_DIALECT, Object.keys(data));
-        if (typeof filter === "string") {
-          const where = filter ? ` WHERE ${filter}` : "";
-          const sql2 = `UPDATE ${MYSQL_DIALECT.quote(table2)} SET ${setClauses}${where}`;
-          const values2 = [...Object.values(data), ...params ?? []];
-          try {
-            const result = await this.queryPromise(sql2, values2);
-            return { success: true, affectedRows: result.affectedRows ?? 0 };
-          } catch (e) {
-            return { success: false, affectedRows: 0, error: e.message };
-          }
-        }
-        const whereClauses = buildWhereClause(MYSQL_DIALECT, Object.keys(filter));
-        const sql = `UPDATE ${MYSQL_DIALECT.quote(table2)} SET ${setClauses} WHERE ${whereClauses}`;
-        const values = [...Object.values(data), ...Object.values(filter)];
+        const { sql, values } = buildUpdate(MYSQL_DIALECT, table2, data, filter, params);
         try {
           const result = await this.queryPromise(sql, values);
           return { success: true, affectedRows: result.affectedRows ?? 0 };
@@ -4792,18 +4812,7 @@ var init_mysql = __esm({
       }
       async deleteAsync(table2, filter, params) {
         this.ensureConnected();
-        if (typeof filter === "string") {
-          const sql2 = filter ? `DELETE FROM \`${table2}\` WHERE ${filter}` : `DELETE FROM \`${table2}\``;
-          try {
-            const result = await this.queryPromise(sql2, params ?? []);
-            return { success: true, affectedRows: result.affectedRows ?? 0 };
-          } catch (e) {
-            return { success: false, affectedRows: 0, error: e.message };
-          }
-        }
-        const whereClauses = buildWhereClause(MYSQL_DIALECT, Object.keys(filter));
-        const sql = `DELETE FROM ${MYSQL_DIALECT.quote(table2)} WHERE ${whereClauses}`;
-        const values = Object.values(filter);
+        const { sql, values } = buildDelete(MYSQL_DIALECT, table2, filter, params);
         try {
           const result = await this.queryPromise(sql, values);
           return { success: true, affectedRows: result.affectedRows ?? 0 };
@@ -4955,6 +4964,7 @@ var init_mssql = __esm({
   "../orm/src/adapters/mssql.ts"() {
     "use strict";
     init_sqlDialect();
+    init_sqlCrud();
     init_sqlTranslator();
     init_connectTimeout();
     tedious = null;
@@ -5211,21 +5221,17 @@ var init_mssql = __esm({
       async insertAsync(table2, data) {
         this.ensureConnected();
         if (Array.isArray(data)) {
-          if (data.length === 0) return { success: true, affectedRows: 0 };
-          const keys2 = Object.keys(data[0]);
-          const sql2 = buildInsert({ quote: MSSQL_DIALECT.quote, marker: ANSI_DIALECT.marker }, table2, keys2);
-          const paramsList = data.map((row) => keys2.map((k) => row[k]));
+          const batch = buildInsertRows({ quote: MSSQL_DIALECT.quote, marker: ANSI_DIALECT.marker }, table2, data);
+          if (!batch) return { success: true, affectedRows: 0 };
           try {
-            const result = await this.executeManyAsync(sql2, paramsList);
+            const result = await this.executeManyAsync(batch.sql, batch.paramsList);
             if (result.lastId !== void 0) this._lastInsertId = result.lastId;
             return { success: true, affectedRows: result.totalAffected, lastId: result.lastId };
           } catch (e) {
             return { success: false, affectedRows: 0, error: e.message };
           }
         }
-        const keys = Object.keys(data);
-        const sql = buildInsert(MSSQL_DIALECT, table2, keys, "; SELECT SCOPE_IDENTITY() AS id", 0);
-        const values = Object.values(data);
+        const { sql, values } = buildInsertRow(MSSQL_DIALECT, table2, data, "; SELECT SCOPE_IDENTITY() AS id", { startAt: 0 });
         try {
           const result = await this.execSqlPromise(sql, values);
           const id = result.rows[0]?.id ?? null;
@@ -5248,26 +5254,10 @@ var init_mssql = __esm({
       }
       async updateAsync(table2, data, filter, params) {
         this.ensureConnected();
-        const dataKeys = Object.keys(data);
-        let paramIndex = 0;
-        const setClauses = buildSetClause(MSSQL_DIALECT, dataKeys, paramIndex);
-        paramIndex += dataKeys.length;
-        if (typeof filter === "string") {
-          const where = filter ? ` WHERE ${this.convertPlaceholders(filter, paramIndex)}` : "";
-          const sql2 = `UPDATE ${MSSQL_DIALECT.quote(table2)} SET ${setClauses}${where}`;
-          const values2 = [...Object.values(data), ...params ?? []];
-          try {
-            const result = await this.execSqlPromise(sql2, values2);
-            return { success: true, affectedRows: result.rowCount };
-          } catch (e) {
-            return { success: false, affectedRows: 0, error: e.message };
-          }
-        }
-        const filterKeys = Object.keys(filter);
-        const whereClauses = buildWhereClause(MSSQL_DIALECT, filterKeys, paramIndex);
-        paramIndex += filterKeys.length;
-        const sql = `UPDATE ${MSSQL_DIALECT.quote(table2)} SET ${setClauses} WHERE ${whereClauses}`;
-        const values = [...Object.values(data), ...Object.values(filter)];
+        const { sql, values } = buildUpdate(MSSQL_DIALECT, table2, data, filter, params, {
+          startAt: 0,
+          convertFragment: (fragment, startAt) => this.convertPlaceholders(fragment, startAt)
+        });
         try {
           const result = await this.execSqlPromise(sql, values);
           return { success: true, affectedRows: result.rowCount };
@@ -5280,21 +5270,10 @@ var init_mssql = __esm({
       }
       async deleteAsync(table2, filter, params) {
         this.ensureConnected();
-        if (typeof filter === "string") {
-          const sql2 = filter ? `DELETE FROM [${table2}] WHERE ${this.bindable(filter, params)}` : `DELETE FROM [${table2}]`;
-          try {
-            const result = await this.execSqlPromise(sql2, params ?? []);
-            return { success: true, affectedRows: result.rowCount };
-          } catch (e) {
-            return { success: false, affectedRows: 0, error: e.message };
-          }
-        }
-        const filterKeys = Object.keys(filter);
-        let paramIndex = 0;
-        const whereClauses = buildWhereClause(MSSQL_DIALECT, filterKeys, paramIndex);
-        paramIndex += filterKeys.length;
-        const sql = `DELETE FROM ${MSSQL_DIALECT.quote(table2)} WHERE ${whereClauses}`;
-        const values = Object.values(filter);
+        const { sql, values } = buildDelete(MSSQL_DIALECT, table2, filter, params, {
+          startAt: 0,
+          convertFragment: (fragment) => this.bindable(fragment, params)
+        });
         try {
           const result = await this.execSqlPromise(sql, values);
           return { success: true, affectedRows: result.rowCount };
@@ -5547,6 +5526,7 @@ var init_firebird = __esm({
   "../orm/src/adapters/firebird.ts"() {
     "use strict";
     init_sqlDialect();
+    init_sqlCrud();
     init_sqlTranslator();
     init_connectTimeout();
     firebird = null;
@@ -5917,17 +5897,13 @@ var init_firebird = __esm({
       async insertAsync(table2, data) {
         this.ensureConnected();
         if (Array.isArray(data)) {
-          if (data.length === 0) return { success: true, affectedRows: 0 };
-          const keys2 = Object.keys(data[0]);
-          const sql2 = buildInsert(FB_DIALECT, table2, keys2);
-          const paramsList = data.map((row) => keys2.map((k) => row[k]));
-          const result = await this.executeManyAsync(sql2, paramsList);
+          const batch = buildInsertRows(FB_DIALECT, table2, data);
+          if (!batch) return { success: true, affectedRows: 0 };
+          const result = await this.executeManyAsync(batch.sql, batch.paramsList);
           const lastId2 = await this.readGeneratorId(table2) ?? result.lastId;
           return { success: true, affectedRows: result.totalAffected, lastId: lastId2 ?? void 0 };
         }
-        const keys = Object.keys(data);
-        const sql = buildInsert(FB_DIALECT, table2, keys);
-        const values = Object.values(data);
+        const { sql, values } = buildInsertRow(FB_DIALECT, table2, data);
         await this.executePromise(sql, values);
         const lastId = await this.readGeneratorId(table2);
         return { success: true, affectedRows: 1, lastId: lastId ?? void 0 };
@@ -5937,18 +5913,7 @@ var init_firebird = __esm({
       }
       async updateAsync(table2, data, filter, params) {
         this.ensureConnected();
-        const setClauses = buildSetClause(FB_DIALECT, Object.keys(data));
-        if (typeof filter === "string") {
-          const where = filter ? ` WHERE ${filter}` : "";
-          const affected2 = await this.executeReturningCount(
-            `UPDATE ${fbQuote(table2)} SET ${setClauses}${where}`,
-            [...Object.values(data), ...params ?? []]
-          );
-          return { success: true, affectedRows: affected2 };
-        }
-        const whereClauses = buildWhereClause(FB_DIALECT, Object.keys(filter));
-        const sql = `UPDATE ${FB_DIALECT.quote(table2)} SET ${setClauses} WHERE ${whereClauses}`;
-        const values = [...Object.values(data), ...Object.values(filter)];
+        const { sql, values } = buildUpdate(FB_DIALECT, table2, data, filter, params);
         const affected = await this.executeReturningCount(sql, values);
         return { success: true, affectedRows: affected };
       }
@@ -5957,14 +5922,7 @@ var init_firebird = __esm({
       }
       async deleteAsync(table2, filter, params) {
         this.ensureConnected();
-        if (typeof filter === "string") {
-          const where = filter ? ` WHERE ${filter}` : "";
-          const affected2 = await this.executeReturningCount(`DELETE FROM ${fbQuote(table2)}${where}`, params ?? []);
-          return { success: true, affectedRows: affected2 };
-        }
-        const whereClauses = buildWhereClause(FB_DIALECT, Object.keys(filter));
-        const sql = `DELETE FROM ${FB_DIALECT.quote(table2)} WHERE ${whereClauses}`;
-        const values = Object.values(filter);
+        const { sql, values } = buildDelete(FB_DIALECT, table2, filter, params);
         const affected = await this.executeReturningCount(sql, values);
         return { success: true, affectedRows: affected };
       }
@@ -6796,6 +6754,7 @@ var init_odbc = __esm({
   "../orm/src/adapters/odbc.ts"() {
     "use strict";
     init_sqlDialect();
+    init_sqlCrud();
     init_sqlTranslator();
     init_connectTimeout();
     odbcModule = null;
@@ -6995,16 +6954,12 @@ var init_odbc = __esm({
       async insertAsync(table2, data) {
         this.ensureConnected();
         if (Array.isArray(data)) {
-          if (data.length === 0) return { success: true, affectedRows: 0 };
-          const keys2 = Object.keys(data[0]);
-          const sql2 = buildInsert(ANSI_DIALECT, table2, keys2);
-          const paramsList = data.map((row) => keys2.map((k) => row[k]));
-          const { totalAffected } = await this.executeManyAsync(sql2, paramsList);
+          const batch = buildInsertRows(ANSI_DIALECT, table2, data);
+          if (!batch) return { success: true, affectedRows: 0 };
+          const { totalAffected } = await this.executeManyAsync(batch.sql, batch.paramsList);
           return { success: true, affectedRows: totalAffected };
         }
-        const keys = Object.keys(data);
-        const sql = buildInsert(ANSI_DIALECT, table2, keys);
-        const values = Object.values(data);
+        const { sql, values } = buildInsertRow(ANSI_DIALECT, table2, data);
         try {
           const result = await this.connection.query(sql, values);
           return { success: true, affectedRows: this.affectedCount(result), lastId: this._lastInsertId ?? void 0 };
@@ -7015,17 +6970,7 @@ var init_odbc = __esm({
       /** Update rows in a table matching filter. */
       async updateAsync(table2, data, filter, params) {
         this.ensureConnected();
-        const setClauses = buildSetClause(ANSI_DIALECT, Object.keys(data));
-        let whereSql;
-        let values;
-        if (typeof filter === "string") {
-          whereSql = filter;
-          values = [...Object.values(data), ...params ?? []];
-        } else {
-          whereSql = buildWhereClause(ANSI_DIALECT, Object.keys(filter));
-          values = [...Object.values(data), ...Object.values(filter)];
-        }
-        const sql = `UPDATE ${ANSI_DIALECT.quote(table2)} SET ${setClauses} WHERE ${whereSql}`;
+        const { sql, values } = buildUpdate(ANSI_DIALECT, table2, data, filter, params);
         try {
           const result = await this.connection.query(sql, values);
           return { success: true, affectedRows: this.affectedCount(result) };
@@ -7044,18 +6989,7 @@ var init_odbc = __esm({
           }
           return { success: true, affectedRows: totalAffected };
         }
-        if (typeof filter === "string") {
-          const sql2 = filter ? `DELETE FROM "${table2}" WHERE ${filter}` : `DELETE FROM "${table2}"`;
-          try {
-            const result = await this.connection.query(sql2, params ?? []);
-            return { success: true, affectedRows: this.affectedCount(result) };
-          } catch (e) {
-            return { success: false, affectedRows: 0, error: e.message };
-          }
-        }
-        const whereClauses = buildWhereClause(ANSI_DIALECT, Object.keys(filter));
-        const sql = `DELETE FROM ${ANSI_DIALECT.quote(table2)} WHERE ${whereClauses}`;
-        const values = Object.values(filter);
+        const { sql, values } = buildDelete(ANSI_DIALECT, table2, filter, params);
         try {
           const result = await this.connection.query(sql, values);
           return { success: true, affectedRows: this.affectedCount(result) };
@@ -10775,11 +10709,11 @@ async function eagerLoadBelongsToRelation(instances, model, relatedClass, relati
   const relatedPkColumn = relatedClass.getDbColumn(relatedPk);
   const related = await eagerQueryRelated(relatedClass, relatedPkColumn, values);
   if (nested.length > 0 && related.length > 0) await relatedClass._eagerLoad(related, nested);
-  const lookup = {};
-  for (const record of related) lookup[_joinKey(record[relatedPk])] = record;
+  const lookup2 = {};
+  for (const record of related) lookup2[_joinKey(record[relatedPk])] = record;
   for (const instance of instances) {
     const value = instance[fkProp];
-    relationshipCache(instance)[relationName] = value !== void 0 && value !== null ? lookup[_joinKey(value)] ?? null : null;
+    relationshipCache(instance)[relationName] = value !== void 0 && value !== null ? lookup2[_joinKey(value)] ?? null : null;
   }
 }
 async function eagerLoadRelation(instances, model, relationName, nested) {
@@ -14466,7 +14400,7 @@ var init_attachment = __esm({
 // ../orm/src/realtime/storage.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2, statSync as statSync4 } from "node:fs";
-import { resolve as resolve5, sep } from "node:path";
+import { resolve as resolve5, sep as sep2 } from "node:path";
 import { createRequire as createRequire6 } from "node:module";
 function loadAwsSdk(packageName) {
   try {
@@ -14519,7 +14453,7 @@ var init_storage = __esm({
       // Resolve inside the root and reject any traversal attempt.
       pathFor(key) {
         const target = resolve5(this.directory, key);
-        if (target !== this.directory && !target.startsWith(this.directory + sep)) {
+        if (target !== this.directory && !target.startsWith(this.directory + sep2)) {
           throw new Error(`unsafe storage key: ${JSON.stringify(key)}`);
         }
         return target;
@@ -15036,6 +14970,7 @@ __export(src_exports, {
   resolveDbPool: () => resolveDbPool,
   resolveFirebirdCharset: () => resolveFirebirdCharset,
   resolveGraphConnectTimeout: () => resolveGraphConnectTimeout,
+  resolveSqlitePath: () => resolveSqlitePath,
   rollback: () => rollback,
   seedModels: () => seedModels,
   seedOrm: () => seedOrm,
@@ -15421,9 +15356,9 @@ var init_cache = __esm({
         return entry.value;
       }
       async set(key, value, ttl) {
-        const expiresAt = ttl > 0 ? Date.now() + ttl * 1e3 : 0;
+        const expiresAt2 = ttl > 0 ? Date.now() + ttl * 1e3 : 0;
         this.store.delete(key);
-        this.store.set(key, { value, expiresAt });
+        this.store.set(key, { value, expiresAt: expiresAt2 });
         while (this.store.size > this.maxEntries) {
           const firstKey = this.store.keys().next().value;
           if (firstKey !== void 0) this.store.delete(firstKey);
@@ -15856,8 +15791,8 @@ ${s}\r
             const oldest = files.shift();
             if (oldest) fs.unlinkSync(path.join(this.dir, oldest.name));
           }
-          const expiresAt = ttl > 0 ? Date.now() / 1e3 + ttl : 0;
-          const entry = { key, value, expiresAt };
+          const expiresAt2 = ttl > 0 ? Date.now() / 1e3 + ttl : 0;
+          const entry = { key, value, expiresAt: expiresAt2 };
           fs.writeFileSync(this.keyPath(key), JSON.stringify(entry));
         } catch {
         }
@@ -17510,7 +17445,7 @@ __export(engine_exports, {
 });
 import { createHash as createHash3, createHmac as createHmac3, randomBytes as randomBytes4 } from "node:crypto";
 import { readFileSync as readFileSync6, existsSync as existsSync7, statSync as statSync6, realpathSync } from "node:fs";
-import { join as join10, resolve as resolve6, isAbsolute as isAbsolute4, sep as sep2 } from "node:path";
+import { join as join10, resolve as resolve6, isAbsolute as isAbsolute4, sep as sep3 } from "node:path";
 function jsonText(value) {
   try {
     const text = JSON.stringify(value);
@@ -17604,8 +17539,8 @@ function capCache(cache, maxEntries) {
 }
 function sweepExpiredCache(cache) {
   const now = Date.now();
-  for (const [key, [, expiresAt]] of cache) {
-    if (expiresAt <= now) cache.delete(key);
+  for (const [key, [, expiresAt2]] of cache) {
+    if (expiresAt2 <= now) cache.delete(key);
   }
 }
 function tokenize(source) {
@@ -17851,15 +17786,15 @@ function findOutsideQuotes(expr, needle) {
   }
   return -1;
 }
-function splitOutsideQuotes(expr, sep8) {
-  if (!expr.includes(sep8)) return [expr];
+function splitOutsideQuotes(expr, sep9) {
+  if (!expr.includes(sep9)) return [expr];
   const parts = [];
   let currentStart = 0;
   let inQuote = null;
   let depth = 0;
   let bracketDepth = 0;
   let i = 0;
-  const sepLen = sep8.length;
+  const sepLen = sep9.length;
   const lastStart = expr.length - sepLen;
   while (i <= lastStart) {
     const ch = expr[i];
@@ -17880,7 +17815,7 @@ function splitOutsideQuotes(expr, sep8) {
     else if (ch === ")") depth--;
     else if (ch === "[") bracketDepth++;
     else if (ch === "]") bracketDepth--;
-    if (depth === 0 && bracketDepth === 0 && expr.startsWith(sep8, i)) {
+    if (depth === 0 && bracketDepth === 0 && expr.startsWith(sep9, i)) {
       parts.push(expr.slice(currentStart, i));
       i += sepLen;
       currentStart = i;
@@ -18577,6 +18512,12 @@ function setFormTokenSessionId(sessionId) {
 }
 function _buildFormTokenJwt(descriptor = "") {
   const secret = process.env.TINA4_SECRET ?? "";
+  const secretBytes = Buffer.byteLength(secret, "utf8");
+  if (secretBytes < 32) {
+    throw new Error(
+      `Auth: TINA4_SECRET ${secretBytes === 0 ? "is not set" : `is ${secretBytes} bytes`}; an HMAC JWT secret must be at least 32 bytes. Generate one with \`openssl rand -hex 32\` and set TINA4_SECRET in your environment or .env.`
+    );
+  }
   const ttlMinutes = parseInt(process.env.TINA4_TOKEN_LIMIT || "60", 10);
   const header = { alg: "HS256", typ: "JWT" };
   const now = Math.floor(Date.now() / 1e3);
@@ -18827,8 +18768,8 @@ var init_engine = __esm({
       },
       first: (v) => Array.isArray(v) ? v[0] ?? null : null,
       last: (v) => Array.isArray(v) ? v[v.length - 1] ?? null : null,
-      join: (v, sep8) => Array.isArray(v) ? v.map(String).join(sep8 !== void 0 ? String(sep8) : ", ") : String(v),
-      split: (v, sep8) => String(v).split(sep8 !== void 0 ? String(sep8) : " "),
+      join: (v, sep9) => Array.isArray(v) ? v.map(String).join(sep9 !== void 0 ? String(sep9) : ", ") : String(v),
+      split: (v, sep9) => String(v).split(sep9 !== void 0 ? String(sep9) : " "),
       replace: (v, from, to) => {
         const s = String(v);
         if (from !== void 0 && typeof from === "object" && from !== null && !Array.isArray(from)) {
@@ -19232,7 +19173,7 @@ var init_engine = __esm({
         }
         const root = realpathSync(this.templateDir);
         const real = realpathSync(filePath);
-        if (real !== root && !real.startsWith(root + sep2)) {
+        if (real !== root && !real.startsWith(root + sep3)) {
           throw new Error(`Template path escapes the templates directory: ${name}`);
         }
         return readFileSync6(real, "utf-8");
@@ -20118,8 +20059,8 @@ var init_engine = __esm({
         sweepExpiredCache(this.fragmentCache);
         const cached = this.fragmentCache.get(cacheKey);
         if (cached) {
-          const [htmlContent, expiresAt] = cached;
-          if (Date.now() < expiresAt) {
+          const [htmlContent, expiresAt2] = cached;
+          if (Date.now() < expiresAt2) {
             let i2 = start2 + 1;
             let depth = 0;
             while (i2 < tokens.length) {
@@ -20912,7 +20853,7 @@ function csrfBearerIsValid(req2, secret) {
   const authHeader = req2.headers.authorization ?? "";
   if (!authHeader.startsWith("Bearer ")) return false;
   const bearerToken = authHeader.slice(7).trim();
-  return Boolean(bearerToken && validToken(bearerToken, secret));
+  return Boolean(bearerToken && isIdentityPayload(validToken(bearerToken, secret)));
 }
 function csrfRequestToken(req2) {
   const query = req2.query ?? {};
@@ -22049,6 +21990,22 @@ var init_transport = __esm({
   }
 });
 
+// src/ssoIdentity.ts
+function liveSessionIdentity(stored) {
+  if (!stored || typeof stored !== "object") return null;
+  const identity = stored.identity;
+  if (!identity || typeof identity !== "object" || !identity.issuer || !identity.subject) return null;
+  const expiresAt2 = stored.expires_at ?? 0;
+  if (typeof expiresAt2 !== "number") return null;
+  if (expiresAt2 > 0 && Math.floor(Date.now() / 1e3) >= expiresAt2) return null;
+  return identity;
+}
+var init_ssoIdentity = __esm({
+  "src/ssoIdentity.ts"() {
+    "use strict";
+  }
+});
+
 // src/authGate.ts
 function enforceRouteAuth(req2, res, match, isDevAdmin) {
   if (!(match.secure === true && match.noAuth !== true && !isDevAdmin)) {
@@ -22056,38 +22013,50 @@ function enforceRouteAuth(req2, res, match, isDevAdmin) {
   }
   const authHeader = req2.headers.authorization ?? "";
   const headerToken = authHeader.startsWith("Bearer ") ? authHeader.slice(7) : "";
-  let resolvedToken = "";
+  let payload = null;
   let tokenSource = "";
-  if (headerToken && validToken(headerToken)) {
-    resolvedToken = headerToken;
-    tokenSource = "header";
+  let resolvedToken = "";
+  if (headerToken) {
+    const candidate = validToken(headerToken);
+    if (isIdentityPayload(candidate)) {
+      payload = candidate;
+      tokenSource = "header";
+      resolvedToken = headerToken;
+    }
   }
-  if (!resolvedToken) {
+  if (!payload) {
     const bodyToken = req2.body?.formToken;
-    if (bodyToken && validToken(bodyToken)) {
-      resolvedToken = bodyToken;
-      tokenSource = "body";
+    if (bodyToken) {
+      const candidate = validToken(bodyToken);
+      if (isIdentityPayload(candidate)) {
+        payload = candidate;
+        tokenSource = "body";
+        resolvedToken = bodyToken;
+      }
     }
   }
-  if (!resolvedToken) {
-    const sso = req2.session?.get?.("_tina4_sso");
-    const identity = sso?.identity;
-    if (identity?.issuer && identity?.subject) {
+  if (!payload) {
+    const identity = liveSessionIdentity(req2.session?.get?.("_tina4_sso"));
+    if (identity) {
       req2.user = identity;
       return rbacForbidden(match, identity, res);
     }
     const sessionToken = req2.session?.get?.("token");
-    if (sessionToken && validToken(sessionToken)) {
-      resolvedToken = sessionToken;
-      tokenSource = "session";
+    if (sessionToken) {
+      const candidate = validToken(sessionToken);
+      if (isIdentityPayload(candidate)) {
+        payload = candidate;
+        tokenSource = "session";
+        resolvedToken = sessionToken;
+      }
     }
   }
-  if (!resolvedToken) {
+  if (!payload) {
     res.raw.writeHead(401, { "Content-Type": "application/json" });
     res.raw.end(JSON.stringify({ error: "Unauthorized" }));
     return true;
   }
-  req2.user = getPayload(resolvedToken) ?? {};
+  req2.user = payload;
   if (tokenSource === "body") {
     const fresh = refreshToken(resolvedToken);
     if (fresh) {
@@ -22137,6 +22106,7 @@ var init_authGate = __esm({
   "src/authGate.ts"() {
     "use strict";
     init_auth();
+    init_ssoIdentity();
   }
 });
 
@@ -23210,8 +23180,8 @@ var init_mongoHandler = __esm({
         if (!result || result === "__EMPTY__") return null;
         try {
           const doc = JSON.parse(result);
-          const expiresAt = Number(doc?.expires_at ?? 0);
-          if (expiresAt > 0 && Date.now() / 1e3 > expiresAt) {
+          const expiresAt2 = Number(doc?.expires_at ?? 0);
+          if (expiresAt2 > 0 && Date.now() / 1e3 > expiresAt2) {
             this.destroy(sessionId);
             return null;
           }
@@ -23437,6 +23407,9 @@ parentPort.on("message", (message) => {
 
 // src/sessionHandlers/databaseHandler.ts
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
+function sleepSync2(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
 function column(row, name) {
   if (name in row) return row[name];
   return row[name.toUpperCase()];
@@ -23445,7 +23418,7 @@ function schemeOf2(url) {
   const match = url.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):/);
   return match ? match[1].toLowerCase() : "unknown";
 }
-var CREATE_TABLE, DatabaseSessionHandler;
+var CREATE_TABLE, CREATE_ATTEMPTS, CREATE_RETRY_DELAY_MS, DatabaseSessionHandler;
 var init_databaseHandler = __esm({
   "src/sessionHandlers/databaseHandler.ts"() {
     "use strict";
@@ -23525,6 +23498,8 @@ var init_databaseHandler = __esm({
       END
     `
     };
+    CREATE_ATTEMPTS = 5;
+    CREATE_RETRY_DELAY_MS = 50;
     DatabaseSessionHandler = class {
       sqliteHandle = null;
       /** Set for SQLite. Null when this handler talks to a networked engine. */
@@ -23565,6 +23540,7 @@ var init_databaseHandler = __esm({
       get sqlite() {
         if (this.sqliteHandle === null) {
           this.sqliteHandle = new DatabaseSync3(this.dbPath);
+          this.sqliteHandle.exec("PRAGMA busy_timeout = 5000");
           this.sqliteHandle.exec("PRAGMA journal_mode = WAL");
         }
         return this.sqliteHandle;
@@ -23652,15 +23628,55 @@ var init_databaseHandler = __esm({
         sqlCommandSync(this.target, sql, params);
       }
       /**
-       * Ensure the session table exists (called once on first use).
+       * Ensure the session table exists (called once on first use) - safely when
+       * several processes race to create it.
+       *
+       * Every per-engine statement above is check-then-act, so two processes can
+       * both find the table absent and both CREATE; the loser errors, and every
+       * engine spells that differently (a pg_type unique violation on PostgreSQL,
+       * Msg 2714 on SQL Server, an RDB$RELATIONS unique violation on Firebird). So
+       * a failure is judged by RE-CHECKING whether the table now exists, never by
+       * parsing the message - the rescue the Firebird note above has always
+       * assumed, and which was not here. MEASURED on the lab before it: six real
+       * processes racing lost one to five of them on PostgreSQL, SQLite and
+       * Firebird.
+       *
+       * The re-check is RETRIED because the loser can fail BEFORE the winner has
+       * committed. On MySQL, CREATE TABLE IF NOT EXISTS takes a shared metadata
+       * lock, checks, then upgrades it to exclusive; two upgrades deadlock, and when
+       * MySQL cannot back the victim off silently it answers 1213 "Deadlock found"
+       * while the winner's table is still invisible (tina4-php CI run 35972320442).
+       * Bounded, so a genuine failure (no CREATE grant) still throws. Same attempts
+       * and delays in all four frameworks.
        */
       ensureTable() {
         if (this.initialized) return;
         const ddl = CREATE_TABLE[this.engine];
-        if (this.target === null) this.sqlite.exec(ddl);
-        else sqlCommandSync(this.target, ddl, []);
+        for (let attempt = 1; ; attempt++) {
+          try {
+            if (this.target === null) this.sqlite.exec(ddl);
+            else sqlCommandSync(this.target, ddl, []);
+            break;
+          } catch (error2) {
+            if (this.tableExists()) break;
+            if (attempt >= CREATE_ATTEMPTS) throw error2;
+            sleepSync2(CREATE_RETRY_DELAY_MS * attempt);
+          }
+        }
         this.initialized = true;
       }
+      /**
+       * Whether tina4_session exists, asked the one way every engine answers alike:
+       * a query against it that returns no rows succeeds only if it is there.
+       */
+      tableExists() {
+        try {
+          this.query("SELECT 1 FROM tina4_session WHERE 1 = 0", []);
+          return true;
+        } catch {
+          return false;
+        }
+      }
       read(sessionId) {
         this.ensureTable();
         const rows = this.query(
@@ -23670,8 +23686,8 @@ var init_databaseHandler = __esm({
         const row = rows[0];
         if (!row) return null;
         const now = Date.now() / 1e3;
-        const expiresAt = Number(column(row, "expires_at") ?? 0);
-        if (expiresAt > 0 && expiresAt < now) {
+        const expiresAt2 = Number(column(row, "expires_at") ?? 0);
+        if (expiresAt2 > 0 && expiresAt2 < now) {
           this.destroy(sessionId);
           return null;
         }
@@ -23684,7 +23700,7 @@ var init_databaseHandler = __esm({
       write(sessionId, data, ttl) {
         this.ensureTable();
         const json = JSON.stringify(data);
-        const expiresAt = ttl > 0 ? Date.now() / 1e3 + ttl : 0;
+        const expiresAt2 = ttl > 0 ? Date.now() / 1e3 + ttl : 0;
         const existing = this.query(
           "SELECT session_id FROM tina4_session WHERE session_id = ?",
           [sessionId]
@@ -23692,12 +23708,12 @@ var init_databaseHandler = __esm({
         if (existing.length > 0) {
           this.exec(
             "UPDATE tina4_session SET data = ?, expires_at = ? WHERE session_id = ?",
-            [json, expiresAt, sessionId]
+            [json, expiresAt2, sessionId]
           );
         } else {
           this.exec(
             "INSERT INTO tina4_session (session_id, data, expires_at) VALUES (?, ?, ?)",
-            [sessionId, json, expiresAt]
+            [sessionId, json, expiresAt2]
           );
         }
       }
@@ -24527,7 +24543,7 @@ var init_dispatchPipeline = __esm({
 
 // src/static.ts
 import { readFileSync as readFileSync9, realpathSync as realpathSync3, statSync as statSync8 } from "node:fs";
-import { join as join15, extname as extname3, sep as sep3 } from "node:path";
+import { join as join15, extname as extname3, sep as sep4 } from "node:path";
 import { gzipSync as gzipSync2 } from "node:zlib";
 function isCompressible(contentType) {
   return COMPRESSIBLE_PREFIXES2.some((prefix) => contentType.includes(prefix));
@@ -24558,8 +24574,8 @@ function tryServeStatic(staticDir, req2, res) {
     }
     const stat = statSync8(realPath);
     if (!stat.isFile()) continue;
-    if (realPath !== realDir && !realPath.startsWith(realDir + sep3)) continue;
-    if (hasHiddenSegment(realPath.slice(realDir.length + 1), sep3)) continue;
+    if (realPath !== realDir && !realPath.startsWith(realDir + sep4)) continue;
+    if (hasHiddenSegment(realPath.slice(realDir.length + 1), sep4)) continue;
     const ext = extname3(realPath);
     const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
     const etag = `W/"${stat.size}-${Math.floor(stat.mtimeMs / 1e3)}"`;
@@ -25542,7 +25558,7 @@ __export(generate_exports, {
   toTableName: () => toTableName
 });
 import { existsSync as existsSync15, mkdirSync as mkdirSync12, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join20, relative as relative2, resolve as resolve10, sep as sep4 } from "node:path";
+import { join as join20, relative as relative2, resolve as resolve10, sep as sep5 } from "node:path";
 function ensureDir(dir) {
   if (__resolution.dryRun) return;
   if (!existsSync15(dir)) {
@@ -25668,7 +25684,7 @@ function toRelPath(absPath) {
   const cwd = process.cwd();
   const rel = relative2(cwd, absPath);
   if (!rel) return absPath;
-  return sep4 === "/" ? rel : rel.split(sep4).join("/");
+  return sep5 === "/" ? rel : rel.split(sep5).join("/");
 }
 function captureEditHints(absPath, content) {
   if (!/\.(ts|tsx|js|mjs|cjs|jsx|sql|twig|html\.twig)$/.test(absPath)) return;
@@ -25740,12 +25756,6 @@ function printResolution() {
   lines.push("");
   process.stderr.write(lines.join("\n"));
 }
-function toPlural(name) {
-  const lower = name.toLowerCase();
-  if (lower.endsWith("s")) return lower;
-  if (lower.endsWith("y") && !/[aeiou]y$/i.test(lower)) return lower.slice(0, -1) + "ies";
-  return lower + "s";
-}
 function toCamel(name) {
   return name.charAt(0).toLowerCase() + name.slice(1);
 }
@@ -26178,7 +26188,7 @@ ${aiFill(`delete_${singular}`, {
 }
 function generateCrud(name, flags) {
   const table2 = resolveTable(name, flags, { announce: false });
-  const routeName = toPlural(table2);
+  const routeName = pluralizeReserved(toSnake(name));
   const isPublic = Boolean(flags.public);
   if (!__resolution.jsonMode) console.log(`
   Generating CRUD for ${name}...
@@ -26432,7 +26442,7 @@ void test${titleName};
 function generateForm(name, flags) {
   const fields = fieldsOrDefault(flags.fields || "");
   const table2 = resolveTable(name, flags, { announce: false });
-  const routeName = toPlural(table2);
+  const routeName = pluralizeReserved(toSnake(name));
   const inputTypes = {
     string: "text",
     str: "text",
@@ -26498,7 +26508,7 @@ function generateForm(name, flags) {
 function generateView(name, flags) {
   const fields = fieldsOrDefault(flags.fields || "");
   const table2 = resolveTable(name, flags, { announce: false });
-  const routeName = toPlural(table2);
+  const routeName = pluralizeReserved(toSnake(name));
   const cols = fields.map(([f]) => f);
   const dir = resolve10("src/templates/pages");
   ensureDir(dir);
@@ -27510,7 +27520,7 @@ var init_generate = __esm({
       crud: ({ name, table: table2 }) => [
         `Apply the migration:   npx tina4nodejs migrate`,
         `Serve and try:         npx tina4nodejs serve  ->  visit /swagger`,
-        `Run the gate test:     npx tsx tests/${toPlural(table2)}.test.ts`,
+        `Run the gate test:     npx tsx tests/${pluralizeReserved(toSnake(name))}.test.ts`,
         `Change fields: edit src/models/${name}.ts then re-run generate crud`
       ],
       migration: () => [
@@ -27528,10 +27538,10 @@ var init_generate = __esm({
       ],
       form: ({ name, table: table2 }) => [
         `Render from a route:  res.render("forms/${table2}.twig", { item })`,
-        `Add the POST route:   npx tina4nodejs generate route ${toPlural(table2)} --model ${name}`
+        `Add the POST route:   npx tina4nodejs generate route ${pluralizeReserved(toSnake(name))} --model ${name}`
       ],
-      view: ({ table: table2 }) => [
-        `Wire routes to render list -> ${toPlural(table2)}.twig, detail -> ${table2}.twig`,
+      view: ({ name, table: table2 }) => [
+        `Wire routes to render list -> ${pluralizeReserved(toSnake(name))}.twig, detail -> ${table2}.twig`,
         `Customize the templates in src/templates/pages/`
       ],
       auth: () => [
@@ -27692,7 +27702,7 @@ function envTruthy(val) {
   return ["true", "1", "yes", "on"].includes(val.trim().toLowerCase());
 }
 function isLoopback(ip) {
-  if (ip == null || ip === "") return true;
+  if (ip == null || ip === "") return false;
   let addr = ip.trim().toLowerCase();
   if (addr.startsWith("::ffff:")) addr = addr.slice(7);
   return addr === "::1" || addr === "localhost" || addr.startsWith("127.");
@@ -29283,6 +29293,7 @@ __export(graphql_exports, {
   graphqlAutoSchemaEnabled: () => graphqlAutoSchemaEnabled,
   graphqlEndpoint: () => graphqlEndpoint,
   graphqlMaxDepth: () => graphqlMaxDepth,
+  graphqlMaxNodes: () => graphqlMaxNodes,
   tokenize: () => tokenize2
 });
 function tokenize2(source) {
@@ -29322,7 +29333,12 @@ function graphqlMaxDepth() {
   const n = parseInt(raw, 10);
   return Number.isNaN(n) ? 50 : n;
 }
-var TOKEN_PATTERNS, ParseError, Parser, GraphQL, GraphQLType;
+function graphqlMaxNodes() {
+  const raw = (process.env.TINA4_GRAPHQL_MAX_NODES ?? "1000").trim();
+  const n = parseInt(raw, 10);
+  return Number.isNaN(n) ? 1e3 : n;
+}
+var TOKEN_PATTERNS, ParseError, Parser, ComplexityError, GraphQL, GraphQLType;
 var init_graphql = __esm({
   "src/graphql.ts"() {
     "use strict";
@@ -29361,9 +29377,16 @@ var init_graphql = __esm({
     Parser = class {
       tokens;
       pos;
+      // F2: bound the parser's own recursion. A deeply nested query
+      // ("{a{a{a...}}}") otherwise recurses in parseSelectionSet until the call
+      // stack overflows — BEFORE the execution-time depth guard can run. Reusing
+      // TINA4_GRAPHQL_MAX_DEPTH keeps parse and execution on one bound.
+      depth = 0;
+      maxDepth;
       constructor(tokens) {
         this.tokens = tokens;
         this.pos = 0;
+        this.maxDepth = graphqlMaxDepth();
       }
       peek() {
         return this.pos < this.tokens.length ? this.tokens[this.pos] : null;
@@ -29445,6 +29468,17 @@ var init_graphql = __esm({
         };
       }
       parseSelectionSet() {
+        this.depth++;
+        if (this.maxDepth > 0 && this.depth > this.maxDepth) {
+          throw new Error(`Query exceeds maximum depth of ${this.maxDepth}`);
+        }
+        try {
+          return this.parseSelectionSetInner();
+        } finally {
+          this.depth--;
+        }
+      }
+      parseSelectionSetInner() {
         this.expect("LBRACE");
         const selections = [];
         while (!this.match("RBRACE")) {
@@ -29599,6 +29633,8 @@ var init_graphql = __esm({
         return t;
       }
     };
+    ComplexityError = class extends Error {
+    };
     GraphQL = class _GraphQL {
       types = /* @__PURE__ */ new Map();
       queries = /* @__PURE__ */ new Map();
@@ -29621,6 +29657,12 @@ var init_graphql = __esm({
        * spread / inline fragment, so circular fragments are caught too.
        */
       maxDepth = graphqlMaxDepth();
+      /**
+       * Maximum expanded selection nodes per query (from `TINA4_GRAPHQL_MAX_NODES`,
+       * default 1000; `<= 0` disables). Bounds query WIDTH — fragment bombs and
+       * alias explosions — which the depth guard does not. See {@link graphqlMaxNodes}.
+       */
+      maxNodes = graphqlMaxNodes();
       /**
        * Decorator-style resolver registration.
        *
@@ -29768,6 +29810,16 @@ var init_graphql = __esm({
           return { data: null, errors: [{ message: "No operation found" }] };
         }
         const op = operations[0];
+        if (this.maxNodes > 0) {
+          try {
+            this.assertComplexity(op.selections, fragments);
+          } catch (e) {
+            if (e instanceof ComplexityError) {
+              return { data: null, errors: [{ message: e.message }] };
+            }
+            throw e;
+          }
+        }
         const resolvers = op.operation === "query" ? this.queries : this.mutations;
         for (const vdef of op.variables) {
           if (!(vdef.name in vars) && vdef.default !== void 0) {
@@ -29793,6 +29845,36 @@ var init_graphql = __esm({
        * instead of recursing until the interpreter stack overflows. Top-level
        * starts at depth 1; `maxDepth <= 0` disables the guard.
        */
+      /**
+       * Count the expanded selection nodes, throwing {@link ComplexityError} past
+       * `maxNodes` (F2). Fragment spreads are expanded (so a fragment bomb is
+       * counted, not the small unexpanded document) and every field — including
+       * each alias — counts once. The count is capped by `maxNodes` and the walk by
+       * `maxDepth`, so a circular fragment trips the budget instead of looping and
+       * the check itself can never cost more than the budget.
+       */
+      assertComplexity(selections, fragments) {
+        const depthCap = this.maxDepth > 0 ? this.maxDepth : 1e3;
+        let count = 0;
+        const walk2 = (sels, depth) => {
+          if (depth > depthCap) return;
+          for (const sel of sels) {
+            count++;
+            if (count > this.maxNodes) {
+              throw new ComplexityError(`Query exceeds maximum complexity of ${this.maxNodes} nodes`);
+            }
+            if (sel.kind === "fragment_spread") {
+              const frag = fragments.get(sel.name);
+              if (frag) walk2(frag.selections, depth + 1);
+            } else if (sel.kind === "inline_fragment") {
+              walk2(sel.selections, depth + 1);
+            } else if (sel.kind === "field" && sel.selections) {
+              walk2(sel.selections, depth + 1);
+            }
+          }
+        };
+        walk2(selections, 1);
+      }
       async resolveSelectionsInto(selections, resolvers, parent, variables, context, fragments, target, depth) {
         const errors = [];
         if (this.maxDepth > 0 && depth > this.maxDepth) {
@@ -30995,7 +31077,8 @@ function wsAuthorized(route, headers, queryString = "", subprotocol = "") {
   const token = wsToken(headers, queryString, subprotocol);
   if (!token) return [null, false];
   const payload = validToken(token);
-  return [payload, payload !== null];
+  if (!isIdentityPayload(payload)) return [null, false];
+  return [payload, true];
 }
 function offeredBearerSubprotocol(subprotocol) {
   return subprotocol.split(",").some((p) => p.trim().toLowerCase() === "bearer");
@@ -32190,12 +32273,36 @@ var init_mongoBackend = __esm({
             }
           }
           else if (operation === "size") {
-            const count = await col.countDocuments({
-              queue: queueName,
-              status: "pending",
-            });
+            // ADR-0022 dec 7: size(status) must not answer a different question.
+            // The dead aliases count the .dead_letter store (== deadLetters().length);
+            // reserved/completed count by status; else pending. data = status.
+            const status = data || "pending";
+            let count: number;
+            if (status === "dead" || status === "failed" || status === "dead_letter") {
+              count = await col.countDocuments({ queue: queueName + ".dead_letter" });
+            } else if (status === "reserved" || status === "completed") {
+              count = await col.countDocuments({ queue: queueName, status });
+            } else {
+              count = await col.countDocuments({ queue: queueName, status: "pending" });
+            }
             process.stdout.write(String(count));
           }
+          else if (operation === "reject") {
+            // Dead-letter NOW, no retry (ADR-0023). Floor attempts at maxRetries
+            // so it reads as exhausted (parity with fail()'s dead-letter branch
+            // and size("dead")). data = JSON { id, reason, maxRetries }.
+            const info = JSON.parse(data);
+            const doc = await col.findOne({ queue: queueName, id: info.id });
+            if (doc) {
+              const attempts = Math.max((doc.attempts || 0) + 1, info.maxRetries);
+              await col.insertOne({
+                ...doc, _id: undefined, attempts,
+                status: "dead", queue: queueName + ".dead_letter", error: info.reason,
+              });
+              await col.deleteOne({ _id: doc._id, queue: queueName });
+            }
+            process.stdout.write("__OK__");
+          }
           else if (operation === "clear") {
             await col.deleteMany({ queue: queueName });
             process.stdout.write("__CLEARED__");
@@ -32431,11 +32538,20 @@ var init_mongoBackend = __esm({
           return null;
         }
       }
-      size(queue) {
-        const result = this.execSync("size", queue);
+      size(queue, status2 = "pending") {
+        const result = this.execSync("size", queue, status2);
         const num = parseInt(result, 10);
         return isNaN(num) ? 0 : num;
       }
+      /**
+       * Dead-letter a job immediately — no retry (ADR-0023 reject()). Distinct from
+       * fail(): fail() requeues until maxRetries is spent. attempts is floored at
+       * maxRetries so deadLetters()/size("dead") (which filter/scope to the
+       * dead-letter store) see it.
+       */
+      reject(queue, id, reason, maxRetries) {
+        this.execSync("reject", queue, JSON.stringify({ id, reason, maxRetries }));
+      }
       clear(queue) {
         this.execSync("clear", queue);
       }
@@ -32530,7 +32646,9 @@ function createJob(data, queue) {
       queue._failJob(job.topic, job, reason, queue.getMaxRetries());
     },
     reject(reason = "") {
-      job.fail(reason);
+      job.status = "dead";
+      job.error = reason;
+      queue._rejectJob(job.topic, job, reason, queue.getMaxRetries());
     },
     retry(delaySeconds) {
       queue._retryJob(job.topic, job, delaySeconds);
@@ -33139,6 +33257,20 @@ var init_liteBackend = __esm({
        * dead-letter file -- two spellings of the same intent that previously
        * diverged.
        */
+      /**
+       * Reject a job permanently — dead-letter it NOW, no retry (ADR-0023).
+       *
+       * Unlike failJob(), which requeues until maxRetries is spent, rejectJob()
+       * moves a known-poison job straight to the dead-letter store. attempts is
+       * floored at maxRetries so deadLetters() (attempts >= maxRetries) returns it
+       * and size("dead") agrees.
+       */
+      rejectJob(queue, job, reason, maxRetries) {
+        this.clearReservation(queue, job.id);
+        job.attempts = Math.max((job.attempts || 0) + 1, maxRetries);
+        job.error = reason;
+        this.deadLetter(queue, job, reason);
+      }
       retryJob(queue, job, delaySeconds) {
         this.clearReservation(queue, job.id);
         try {
@@ -33360,7 +33492,7 @@ var init_queue = __esm({
       size(status2 = "pending") {
         const q = this.topic;
         if (this.externalBackend) {
-          return this.externalBackend.size(q);
+          return this.externalBackend.size(q, status2);
         }
         return this.liteBackend.size(q, status2);
       }
@@ -33628,6 +33760,17 @@ var init_queue = __esm({
         }
         this.liteBackend.failJob(queue, job, error2, maxRetries, this._retryBackoff);
       }
+      /**
+       * Dead-letter a job immediately — no retry (ADR-0023 reject()). Distinct from
+       * _failJob, which retries until maxRetries is spent.
+       */
+      _rejectJob(queue, job, reason, maxRetries) {
+        if (this.externalBackend?.reject) {
+          this.externalBackend.reject(queue, job.id, reason, maxRetries);
+          return;
+        }
+        this.liteBackend.rejectJob(queue, job, reason, maxRetries);
+      }
       /**
        * Re-queue a job back to the main queue directory with incremented attempts.
        */
@@ -35752,7 +35895,7 @@ ${end}
 // src/devAdmin.ts
 import { cpus as osCpus } from "node:os";
 import { readFileSync as readFileSync20, writeFileSync as writeFileSync15, existsSync as existsSync22, readdirSync as readdirSync15, mkdirSync as mkdirSync18, copyFileSync, statSync as statSync17, openSync as openSync4, closeSync as closeSync4, fstatSync as fstatSync2, fchmodSync as fchmodSync2, ftruncateSync, constants as constants3, realpathSync as realpathSync6, lstatSync } from "node:fs";
-import { join as join27, dirname as dirname12, resolve as resolve16, relative as relative9, sep as sep7, basename as basename5 } from "node:path";
+import { join as join27, dirname as dirname12, resolve as resolve16, relative as relative9, sep as sep8, basename as basename5 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 function escapeHtml(value) {
@@ -36143,7 +36286,7 @@ function safeJoin(projectRoot3, rel, extraRoots = []) {
     const resolved = realPathOf(resolve16(root, rel));
     const roots = [root, ...extraRoots.filter(Boolean).map((r) => realPathOf(resolve16(r)))];
     for (const r of roots) {
-      if (resolved === r || resolved.startsWith(r.endsWith(sep7) ? r : r + sep7)) return resolved;
+      if (resolved === r || resolved.startsWith(r.endsWith(sep8) ? r : r + sep8)) return resolved;
     }
   } catch {
   }
@@ -39339,13 +39482,20 @@ var sso_exports = {};
 __export(sso_exports, {
   SSO: () => Sso,
   Sso: () => Sso,
-  SsoError: () => SsoError
+  SsoError: () => SsoError,
+  liveSessionIdentity: () => liveSessionIdentity
 });
 import { createHash as createHash9, randomBytes as randomBytes7, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+function expiresAt(tokens) {
+  const lifetime = Number(tokens.expires_in ?? 0);
+  return lifetime > 0 ? Math.floor(Date.now() / 1e3) + lifetime : 0;
+}
 var SsoError, Sso;
 var init_sso = __esm({
   "src/sso.ts"() {
     "use strict";
+    init_ssoIdentity();
+    init_ssoIdentity();
     SsoError = class extends Error {
     };
     Sso = class _Sso {
@@ -39551,13 +39701,12 @@ var init_sso = __esm({
           access_token: tokens.access_token,
           refresh_token: tokens.refresh_token,
           id_token: tokens.id_token,
-          expires_at: Math.floor(Date.now() / 1e3) + Number(tokens.expires_in ?? 0)
+          expires_at: expiresAt(tokens)
         });
         return { identity, return_to: _Sso.safeReturn(pending.return_to) };
       }
       identity(requestOrSession) {
-        const stored = this.session(requestOrSession)?.get(_Sso.SESSION_KEY);
-        const identity = stored?.identity ?? null;
+        const identity = liveSessionIdentity(this.session(requestOrSession)?.get(_Sso.SESSION_KEY));
         if (identity && requestOrSession?.session) requestOrSession.user = identity;
         return identity;
       }
@@ -39584,7 +39733,7 @@ var init_sso = __esm({
             access_token: tokens.access_token,
             refresh_token: tokens.refresh_token ?? stored.refresh_token,
             id_token: tokens.id_token ?? stored.id_token,
-            expires_at: Math.floor(Date.now() / 1e3) + Number(tokens.expires_in ?? 0)
+            expires_at: expiresAt(tokens)
           });
           return identity;
         } catch (error2) {
@@ -39676,8 +39825,8 @@ function writeMcpDiscovery(projectRoot3, port) {
     const lines = contents.split(/\r?\n/);
     const already = lines.some((l) => l.trim() === GITIGNORE_LINE || l.trim() === ".tina4");
     if (!already) {
-      const sep8 = contents.endsWith("\n") || contents === "" ? "" : "\n";
-      fs9.writeFileSync(gitignorePath, `${contents}${sep8}${GITIGNORE_LINE}
+      const sep9 = contents.endsWith("\n") || contents === "" ? "" : "\n";
+      fs9.writeFileSync(gitignorePath, `${contents}${sep9}${GITIGNORE_LINE}
 `, "utf-8");
     }
   }
@@ -39726,12 +39875,12 @@ function bannerSurfaceLines(port, opts) {
   ];
 }
 function swaggerAdvertised() {
-  const TRUTHY2 = ["true", "1", "yes", "on"];
+  const TRUTHY3 = ["true", "1", "yes", "on"];
   const raw = (process.env.TINA4_SWAGGER_ENABLED ?? "").trim().toLowerCase();
   if (raw === "") {
-    return TRUTHY2.includes((process.env.TINA4_DEBUG ?? "").trim().toLowerCase());
+    return TRUTHY3.includes((process.env.TINA4_DEBUG ?? "").trim().toLowerCase());
   }
-  return TRUTHY2.includes(raw);
+  return TRUTHY3.includes(raw);
 }
 async function autoMigrateOnStartup(migrationDir = "migrations", base = process.cwd()) {
   const dir = resolve19(base, migrationDir);
@@ -40650,8 +40799,9 @@ function wireLocaleGlobal(frondEngine, base) {
 async function startServer(config) {
   loadEnv(".env.local");
   loadEnv();
-  const { ensureDevSecret: ensureDevSecret2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
+  const { ensureDevSecret: ensureDevSecret2, requireBootSecret: requireBootSecret2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
   ensureDevSecret2();
+  requireBootSecret2();
   _checkLegacyEnvVars();
   const resolved = resolvePortAndHost(config);
   const host = resolved.host;
@@ -42316,6 +42466,178 @@ var init_service = __esm({
   }
 });
 
+// src/ssrf.ts
+import { isIP } from "node:net";
+import { lookup } from "node:dns/promises";
+function v4ToBytes(ip) {
+  const parts = ip.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = new Uint8Array(4);
+  for (let i = 0; i < 4; i++) {
+    const n = Number(parts[i]);
+    if (!Number.isInteger(n) || n < 0 || n > 255 || !/^\d+$/.test(parts[i])) return null;
+    bytes[i] = n;
+  }
+  return bytes;
+}
+function v6ToBytes(input) {
+  let ip = input.split("%")[0];
+  const lastColon = ip.lastIndexOf(":");
+  const tail = ip.slice(lastColon + 1);
+  if (tail.includes(".")) {
+    const v4 = v4ToBytes(tail);
+    if (!v4) return null;
+    const hextetA = (v4[0] << 8 | v4[1]).toString(16);
+    const hextetB = (v4[2] << 8 | v4[3]).toString(16);
+    ip = ip.slice(0, lastColon + 1) + hextetA + ":" + hextetB;
+  }
+  const halves = ip.split("::");
+  if (halves.length > 2) return null;
+  const head = halves[0] ? halves[0].split(":") : [];
+  const back = halves.length === 2 ? halves[1] ? halves[1].split(":") : [] : [];
+  let groups;
+  if (halves.length === 1) {
+    if (head.length !== 8) return null;
+    groups = head;
+  } else {
+    const missing = 8 - (head.length + back.length);
+    if (missing < 0) return null;
+    groups = [...head, ...Array(missing).fill("0"), ...back];
+  }
+  if (groups.length !== 8) return null;
+  const bytes = new Uint8Array(16);
+  for (let i = 0; i < 8; i++) {
+    if (!/^[0-9a-fA-F]{1,4}$/.test(groups[i])) return null;
+    const g = parseInt(groups[i], 16);
+    bytes[i * 2] = g >> 8 & 255;
+    bytes[i * 2 + 1] = g & 255;
+  }
+  return bytes;
+}
+function ipToBytes(ip) {
+  const cleaned = ip.split("%")[0];
+  const family = isIP(cleaned);
+  if (family === 4) return v4ToBytes(cleaned);
+  if (family === 6) {
+    const bytes = v6ToBytes(cleaned);
+    if (!bytes) return null;
+    const isMapped = bytes.subarray(0, 10).every((b) => b === 0) && bytes[10] === 255 && bytes[11] === 255;
+    return isMapped ? bytes.subarray(12) : bytes;
+  }
+  return null;
+}
+function parseCidr(cidr) {
+  const [netStr, bitsStr] = cidr.split("/");
+  const net4 = ipToBytes(netStr);
+  if (!net4) return null;
+  return { net: net4, bits: Number(bitsStr) };
+}
+function inCidr(packed, cidr) {
+  if (packed.length !== cidr.net.length) return false;
+  const whole = Math.floor(cidr.bits / 8);
+  const remainder = cidr.bits % 8;
+  for (let i = 0; i < whole; i++) {
+    if (packed[i] !== cidr.net[i]) return false;
+  }
+  if (remainder === 0) return true;
+  const mask = 255 << 8 - remainder & 255;
+  return (packed[whole] & mask) === (cidr.net[whole] & mask);
+}
+function allowPrivateRequests() {
+  return TRUTHY2.has((process.env[ALLOW_PRIVATE_ENV] ?? "").trim().toLowerCase());
+}
+function isBlockedAddress(ip) {
+  const packed = ipToBytes(ip);
+  if (!packed) return true;
+  return BLOCKED.some((cidr) => inCidr(packed, cidr));
+}
+function matchesAllowList(host, port, resolved, allowHosts) {
+  const hostLower = host.toLowerCase();
+  for (const raw of allowHosts ?? []) {
+    const entry = String(raw).trim().toLowerCase();
+    if (!entry) continue;
+    if (entry === hostLower || entry === `${hostLower}:${port}`) return true;
+    if (entry.includes("/")) {
+      const cidr = parseCidr(entry);
+      if (cidr && resolved.some((ip) => {
+        const packed = ipToBytes(ip);
+        return packed !== null && inCidr(packed, cidr);
+      })) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+function logBlock(host, ip) {
+  void Promise.resolve().then(() => (init_logger(), logger_exports)).then((mod) => mod.Log?.warning?.(`SSRF guard blocked outbound request to ${host} (${ip})`)).catch(() => void 0);
+}
+async function guardUrl(url, allowHosts) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new SsrfError(`Blocked request: '${url}' is not a valid URL`);
+  }
+  const scheme = parsed.protocol.replace(/:$/, "").toLowerCase();
+  if (scheme !== "http" && scheme !== "https") {
+    throw new SsrfError(`Blocked request: URL scheme '${scheme || "(none)"}' is not http or https`);
+  }
+  const host = parsed.hostname.replace(/^\[|\]$/g, "");
+  if (!host) {
+    throw new SsrfError("Blocked request: URL has no host");
+  }
+  const port = parsed.port ? Number(parsed.port) : scheme === "https" ? 443 : 80;
+  if (allowPrivateRequests()) return;
+  let resolved;
+  try {
+    const results = await lookup(host, { all: true });
+    resolved = results.map((r) => r.address);
+  } catch {
+    throw new SsrfError(`Blocked request to ${host}: cannot resolve host`);
+  }
+  if (resolved.length === 0) {
+    throw new SsrfError(`Blocked request to ${host}: cannot resolve host`);
+  }
+  if (matchesAllowList(host, port, resolved, allowHosts)) return;
+  for (const ip of resolved) {
+    if (isBlockedAddress(ip)) {
+      logBlock(host, ip);
+      throw new SsrfError(
+        `Blocked request to private/internal address ${ip} (host ${host}): set ${ALLOW_PRIVATE_ENV}=true to allow, or pass an allow-list.`
+      );
+    }
+  }
+}
+var ALLOW_PRIVATE_ENV, TRUTHY2, SsrfError, BLOCKED_CIDRS, BLOCKED;
+var init_ssrf = __esm({
+  "src/ssrf.ts"() {
+    "use strict";
+    ALLOW_PRIVATE_ENV = "TINA4_ALLOW_PRIVATE_REQUESTS";
+    TRUTHY2 = /* @__PURE__ */ new Set(["1", "true", "yes", "on"]);
+    SsrfError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "SsrfError";
+      }
+    };
+    BLOCKED_CIDRS = [
+      "0.0.0.0/8",
+      "10.0.0.0/8",
+      "127.0.0.0/8",
+      "169.254.0.0/16",
+      "172.16.0.0/12",
+      "192.168.0.0/16",
+      "100.64.0.0/10",
+      "::1/128",
+      "::/128",
+      "fc00::/7",
+      "fe80::/10"
+    ];
+    BLOCKED = BLOCKED_CIDRS.map(parseCidr).filter((c) => c !== null);
+  }
+});
+
 // src/api.ts
 import http from "node:http";
 import https from "node:https";
@@ -42472,6 +42794,7 @@ var init_api = __esm({
   "src/api.ts"() {
     "use strict";
     init_version();
+    init_ssrf();
     ApiStreamError = class extends Error {
       constructor(message, status2 = null) {
         super(message);
@@ -42526,6 +42849,7 @@ var init_api = __esm({
       transportFn;
       cookiesEnabled;
       cookies;
+      allowHosts;
       /**
        * Construct an Api client.
        *
@@ -42565,6 +42889,7 @@ var init_api = __esm({
         this.transportFn = void 0;
         this.cookiesEnabled = false;
         this.cookies = {};
+        this.allowHosts = [];
         if (typeof authHeaderOrOptions === "object" && authHeaderOrOptions !== null) {
           const opts = authHeaderOrOptions;
           this.authHeader = opts.authHeader ?? "";
@@ -42574,6 +42899,7 @@ var init_api = __esm({
           this.retryBackoff = opts.retryBackoff ?? 0.5;
           this.transportFn = opts.transport;
           this.cookiesEnabled = opts.cookies ?? false;
+          this.allowHosts = opts.allowHosts ?? [];
           if (opts.bearerToken != null) {
             this.setBearerToken(opts.bearerToken);
           } else if (opts.username != null && opts.password != null) {
@@ -42887,7 +43213,12 @@ var init_api = __esm({
        * body-phase timeout is applied by the caller (streamBytes) via
        * `res.destroy()`.
        */
-      openStreamRequest(method, url, headers, data, connectSec) {
+      async openStreamRequest(method, url, headers, data, connectSec) {
+        try {
+          await guardUrl(url, this.allowHosts);
+        } catch (err) {
+          throw new ApiStreamError(err instanceof Error ? err.message : String(err), null);
+        }
         return new Promise((resolve21, reject) => {
           let parsed;
           try {
@@ -42946,10 +43277,11 @@ var init_api = __esm({
        */
       buildRequest(method, contentType, body, extraHeaders, targetUrl) {
         const headers = { "User-Agent": `Tina4/${TINA4_VERSION}`, ...this.headers };
-        if (this.authHeader) {
+        const sameOriginAsBase = targetUrl === void 0 || sameOrigin(targetUrl, this.baseUrl);
+        if (this.authHeader && sameOriginAsBase) {
           headers["Authorization"] = this.authHeader;
         }
-        if (this.cookiesEnabled) {
+        if (this.cookiesEnabled && sameOriginAsBase) {
           const cookieHeader = this.cookieHeader();
           if (cookieHeader) {
             headers["Cookie"] = cookieHeader;
@@ -43050,7 +43382,12 @@ var init_api = __esm({
        * bearer token / session cookie never leaks to a host you didn't
        * authenticate to.
        */
-      performRequest(method, url, headers, data, redirectsLeft) {
+      async performRequest(method, url, headers, data, redirectsLeft) {
+        try {
+          await guardUrl(url, this.allowHosts);
+        } catch (err) {
+          return { kind: "error", error: err instanceof Error ? err.message : String(err) };
+        }
         return new Promise((resolve21) => {
           let parsed;
           try {
@@ -45790,6 +46127,7 @@ var CURVE, RECORD_SIZE, MAX_PAYLOAD, PushError, Push;
 var init_push = __esm({
   "src/push.ts"() {
     "use strict";
+    init_ssrf();
     CURVE = "prime256v1";
     RECORD_SIZE = 4096;
     MAX_PAYLOAD = RECORD_SIZE - 17;
@@ -45864,10 +46202,19 @@ var init_push = __esm({
         return { rawPublic, rawPrivate };
       }
       async deliver(endpoint, config, keys, body) {
+        try {
+          await guardUrl(endpoint.toString(), this.options.allowHosts);
+        } catch (error2) {
+          if (error2 instanceof SsrfError) throw new PushError(error2.message);
+          throw error2;
+        }
         let response;
         try {
           response = await fetch(endpoint, {
             method: "POST",
+            // A real push service answers the POST directly; a redirect from a push
+            // endpoint is not followed to a private address (ADR-0084).
+            redirect: "manual",
             headers: {
               Authorization: `vapid t=${vapidToken(endpoint.toString(), config.subject, keys.rawPrivate, keys.rawPublic)}, k=${config.publicKey}`,
               "Content-Encoding": "aes128gcm",
@@ -47954,6 +48301,7 @@ var init_testClient = __esm({
           reqHeaders["content-length"] = String(Buffer.byteLength(rawBody));
         }
         const socket = new Socket();
+        Object.defineProperty(socket, "remoteAddress", { value: "127.0.0.1" });
         const rawReq = new IncomingMessage2(socket);
         rawReq.method = method.toUpperCase();
         rawReq.url = path10;
@@ -48326,6 +48674,7 @@ var init_validator = __esm({
 var index_exports = {};
 __export(index_exports, {
   AI_TOOLS: () => AI_TOOLS,
+  ALLOW_PRIVATE_ENV: () => ALLOW_PRIVATE_ENV,
   APPLICATION_FORM: () => APPLICATION_FORM,
   APPLICATION_JSON: () => APPLICATION_JSON,
   APPLICATION_OCTET: () => APPLICATION_OCTET,
@@ -48433,6 +48782,7 @@ __export(index_exports, {
   Session: () => Session,
   Sso: () => Sso,
   SsoError: () => SsoError,
+  SsrfError: () => SsrfError,
   TAKEOVER_KILLED: () => TAKEOVER_KILLED,
   TAKEOVER_NOTHING: () => TAKEOVER_NOTHING,
   TAKEOVER_REFUSALS: () => TAKEOVER_REFUSALS,
@@ -48466,6 +48816,7 @@ __export(index_exports, {
   addHtmlHelpers: () => addHtmlHelpers,
   algorithmAvailable: () => algorithmAvailable,
   allEnv: () => allEnv,
+  allowPrivateRequests: () => allowPrivateRequests,
   any: () => any,
   attachCsrfFromEnv: () => attachCsrfFromEnv,
   authMiddleware: () => authMiddleware,
@@ -48531,6 +48882,7 @@ __export(index_exports, {
   graphqlAutoSchemaEnabled: () => graphqlAutoSchemaEnabled,
   graphqlEndpoint: () => graphqlEndpoint,
   graphqlMaxDepth: () => graphqlMaxDepth,
+  guardUrl: () => guardUrl,
   handle: () => handle,
   handleFeedbackTurn: () => handleFeedbackTurn,
   handleFeedbackWidgetJs: () => handleFeedbackWidgetJs,
@@ -48544,6 +48896,7 @@ __export(index_exports, {
   installAll: () => installAll,
   installSelected: () => installSelected,
   isBannerSuppressed: () => isBannerSuppressed,
+  isBlockedAddress: () => isBlockedAddress,
   isDebugMode: () => isDebugMode,
   isDev: () => isDev,
   isInstalled: () => isInstalled,
@@ -48662,6 +49015,7 @@ var init_index = __esm({
     init_service();
     init_cache();
     init_api();
+    init_ssrf();
     init_context();
     init_events();
     init_devAdmin();
@@ -48700,6 +49054,7 @@ var init_index = __esm({
 init_index();
 export {
   AI_TOOLS,
+  ALLOW_PRIVATE_ENV,
   APPLICATION_FORM,
   APPLICATION_JSON,
   APPLICATION_OCTET,
@@ -48807,6 +49162,7 @@ export {
   Session,
   Sso,
   SsoError,
+  SsrfError,
   TAKEOVER_KILLED,
   TAKEOVER_NOTHING,
   TAKEOVER_REFUSALS,
@@ -48840,6 +49196,7 @@ export {
   addHtmlHelpers,
   algorithmAvailable,
   allEnv,
+  allowPrivateRequests,
   any,
   attachCsrfFromEnv,
   authMiddleware,
@@ -48905,6 +49262,7 @@ export {
   graphqlAutoSchemaEnabled,
   graphqlEndpoint,
   graphqlMaxDepth,
+  guardUrl,
   handle,
   handleFeedbackTurn,
   handleFeedbackWidgetJs,
@@ -48918,6 +49276,7 @@ export {
   installAll,
   installSelected,
   isBannerSuppressed,
+  isBlockedAddress,
   isDebugMode,
   isDev,
   isInstalled,