tina4-nodejs 3.13.141 → 3.13.143

package/packages/orm/src/graph/adapters/bolt.ts

@@ -26,6 +26,12 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  * them as strings, so a Cypher `WHERE id(n) = $id` is fed `Number(id)` back.
  */
 import { GraphNode, GraphEdge, GraphResult } from "../shapes.js";
+import {
+  errorMessage,
+  nodeFromRow as toGraphNode,
+  edgeFromRow as toGraphEdge,
+  type DriverRow,
+} from "./rowMapping.js";
 import { GraphError, GraphConnectTimeout } from "../errors.js";
 import {
   resolveGraphConnectTimeout,
@@ -52,20 +58,6 @@ const driverModule: any = await import(DRIVER_PACKAGE);
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const neo4j: any = driverModule.default ?? driverModule;
 
-interface DriverRow {
-  id?: unknown;
-  labels?: unknown;
-  props?: unknown;
-  type?: unknown;
-  f?: unknown;
-  t?: unknown;
-  [key: string]: unknown;
-}
-
-function errorMessage(exc: unknown): string {
-  if (exc instanceof Error) return exc.message;
-  return String(exc);
-}
 
 /**
  * A neutral GraphNode id back to the engine's integer form. Non-numeric ids
@@ -151,12 +143,7 @@ export class BoltGraphAdapter implements GraphAdapter {
 
   // -- portable node/edge/traverse core (Cypher) -------------------------
   private nodeFromRow(row: DriverRow | undefined | null): GraphNode | null {
-    if (row === null || row === undefined) return null;
-    return new GraphNode(
-      String(row.id),
-      (row.labels as string[]) ?? [],
-      (row.props as Record<string, unknown>) ?? {},
-    );
+    return toGraphNode(row);
   }
 
   async addNode(
@@ -185,15 +172,7 @@ export class BoltGraphAdapter implements GraphAdapter {
       to_id: boltId(toId),
       props: properties ?? {},
     });
-    if (rows.length === 0) return null;
-    const row = rows[0];
-    return new GraphEdge(
-      String(row.id),
-      String(row.type),
-      String(row.f),
-      String(row.t),
-      (row.props as Record<string, unknown>) ?? {},
-    );
+    return toGraphEdge(rows[0]);
   }
 
   async getNode(nodeId: string): Promise<GraphNode | null> {

package/packages/orm/src/graph/adapters/rowMapping.ts

@@ -0,0 +1,57 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
+/**
+ * Shared driver-row mapping for the Cypher/GQL graph adapters (Bolt, Ultipa).
+ *
+ * Both drivers return a flat record with the same reserved column names —
+ * `id`, `labels`, `props`, `type`, `f`, `t` — because both adapters run the
+ * same `RETURN ... AS id, ... AS props` projection. Turning such a row into an
+ * engine-neutral GraphNode or GraphEdge is therefore identical work, so it
+ * lives here once rather than in each adapter.
+ */
+import { GraphNode, GraphEdge } from "../shapes.js";
+
+/** A flat driver record from a Cypher/GQL `RETURN ... AS <col>` projection. */
+export interface DriverRow {
+  id?: unknown;
+  labels?: unknown;
+  props?: unknown;
+  type?: unknown;
+  f?: unknown;
+  t?: unknown;
+  [key: string]: unknown;
+}
+
+/** Message of an error value, whether or not it is a real Error. */
+export function errorMessage(exc: unknown): string {
+  if (exc instanceof Error) return exc.message;
+  return String(exc);
+}
+
+/** Build an engine-neutral GraphNode from a driver row, or null when there is none. */
+export function nodeFromRow(row: DriverRow | undefined | null): GraphNode | null {
+  if (row === null || row === undefined) return null;
+  return new GraphNode(
+    String(row.id),
+    (row.labels as string[]) ?? [],
+    (row.props as Record<string, unknown>) ?? {},
+  );
+}
+
+/** Build an engine-neutral GraphEdge from a driver row, or null when there is none. */
+export function edgeFromRow(row: DriverRow | undefined | null): GraphEdge | null {
+  if (row === null || row === undefined) return null;
+  return new GraphEdge(
+    String(row.id),
+    String(row.type),
+    String(row.f),
+    String(row.t),
+    (row.props as Record<string, unknown>) ?? {},
+  );
+}

package/packages/orm/src/graph/adapters/ultipa.ts

@@ -23,6 +23,12 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
  * query() is rejected by Ultipa.
  */
 import { GraphNode, GraphEdge, GraphResult } from "../shapes.js";
+import {
+  errorMessage,
+  nodeFromRow as toGraphNode,
+  edgeFromRow as toGraphEdge,
+  type DriverRow,
+} from "./rowMapping.js";
 import { GraphError, GraphConnectTimeout } from "../errors.js";
 import {
   resolveGraphConnectTimeout,
@@ -56,16 +62,6 @@ const UltipaConnectError = driver.UltipaConnectError;
  */
 const UNBOUNDED_CONNECT_SECONDS = 315_360_000; // ~10 years
 
-interface DriverRow {
-  id?: unknown;
-  labels?: unknown;
-  props?: unknown;
-  type?: unknown;
-  f?: unknown;
-  t?: unknown;
-  [key: string]: unknown;
-}
-
 /**
  * Build a GQL property map `{k1: $p_k1, ...}` plus the param dict for it.
  *
@@ -84,11 +80,6 @@ function propClause(
   return { clause: `{${pairs}}`, params };
 }
 
-function errorMessage(exc: unknown): string {
-  if (exc instanceof Error) return exc.message;
-  return String(exc);
-}
-
 export class UltipaGraphAdapter implements GraphAdapter {
   private readonly url: GraphUrl;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -154,12 +145,7 @@ export class UltipaGraphAdapter implements GraphAdapter {
 
   // -- portable node/edge/traverse core (GQL) ----------------------------
   private nodeFromRow(row: DriverRow | undefined | null): GraphNode | null {
-    if (row === null || row === undefined) return null;
-    return new GraphNode(
-      String(row.id),
-      (row.labels as string[]) ?? [],
-      (row.props as Record<string, unknown>) ?? {},
-    );
+    return toGraphNode(row);
   }
 
   async addNode(
@@ -190,15 +176,7 @@ export class UltipaGraphAdapter implements GraphAdapter {
       + `INSERT (a)-[e:\`${type}\` ${clause}]->(b) `
       + `RETURN id(e) AS id, type(e) AS type, id(a) AS f, id(b) AS t, properties(e) AS props`;
     const rows = (await this.run(gql, params, false)).dicts() as DriverRow[];
-    if (rows.length === 0) return null;
-    const row = rows[0];
-    return new GraphEdge(
-      String(row.id),
-      String(row.type),
-      String(row.f),
-      String(row.t),
-      (row.props as Record<string, unknown>) ?? {},
-    );
+    return toGraphEdge(rows[0]);
   }
 
   async getNode(nodeId: string): Promise<GraphNode | null> {

package/packages/swagger/dist/index.js

@@ -487,13 +487,13 @@ function uniqueOperationId(method, openApiPath, seen) {
 function swaggerUiCdn() {
   return (process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5").replace(/\/+$/, "");
 }
-var SWAGGER_UI_HTML = (specUrl) => `<!DOCTYPE html>
+var SWAGGER_UI_HTML = (specUrl, nonce) => `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
   <title>Tina4 API Documentation</title>
   <link rel="stylesheet" href="${swaggerUiCdn()}/swagger-ui.css">
-  <style>
+  <style nonce="${nonce}">
     body { margin: 0; background: #fafafa; }
     .topbar { display: none !important; }
   </style>
@@ -501,7 +501,7 @@ var SWAGGER_UI_HTML = (specUrl) => `<!DOCTYPE html>
 <body>
   <div id="swagger-ui"></div>
   <script src="${swaggerUiCdn()}/swagger-ui-bundle.js"></script>
-  <script>
+  <script nonce="${nonce}">
     SwaggerUIBundle({
       url: "${specUrl}",
       dom_id: '#swagger-ui',
@@ -522,7 +522,7 @@ function swaggerEnabled() {
 }
 function createSwaggerRoutes(getSpec) {
   const serveUi = async (_req, res) => {
-    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json", res.cspNonce));
   };
   return [
     {

package/packages/swagger/src/ui.ts

@@ -18,13 +18,16 @@ function swaggerUiCdn(): string {
   return (process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5").replace(/\/+$/, "");
 }
 
-const SWAGGER_UI_HTML = (specUrl: string) => `<!DOCTYPE html>
+// The inline <style> and the inline SwaggerUIBundle(...) <script> carry this
+// response's CSP nonce (ADR-0088) so they run under the strict default
+// Content-Security-Policy; the external <script src>/<link> need none.
+const SWAGGER_UI_HTML = (specUrl: string, nonce: string) => `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
   <title>Tina4 API Documentation</title>
   <link rel="stylesheet" href="${swaggerUiCdn()}/swagger-ui.css">
-  <style>
+  <style nonce="${nonce}">
     body { margin: 0; background: #fafafa; }
     .topbar { display: none !important; }
   </style>
@@ -32,7 +35,7 @@ const SWAGGER_UI_HTML = (specUrl: string) => `<!DOCTYPE html>
 <body>
   <div id="swagger-ui"></div>
   <script src="${swaggerUiCdn()}/swagger-ui-bundle.js"></script>
-  <script>
+  <script nonce="${nonce}">
     SwaggerUIBundle({
       url: "${specUrl}",
       dom_id: '#swagger-ui',
@@ -65,7 +68,7 @@ export function createSwaggerRoutes(
   getSpec: () => unknown
 ): RouteDefinition[] {
   const serveUi = async (_req: Tina4Request, res: Tina4Response): Promise<void> => {
-    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json", res.cspNonce));
   };
 
   return [

package/types/cli/src/util.d.ts

@@ -0,0 +1,28 @@
+/** Flags and positional arguments split out of a command's argv slice. */
+export interface ParsedFlags {
+    flags: Record<string, string | boolean>;
+    positional: string[];
+}
+/**
+ * Parse `--key value` and bare `--flag` arguments into flags plus positionals.
+ *
+ * A name listed in `booleanFlags` never consumes the next token; every other
+ * `--key` takes the following token as its value unless that token is itself a
+ * `--flag` (or the argv ends), in which case the key is a bare boolean.
+ */
+export declare function parseFlags(args: string[], booleanFlags?: ReadonlySet<string>): ParsedFlags;
+/**
+ * Absolute path of the first of `names` found on PATH, or null.
+ *
+ * Scans PATH directories directly (no `which` shell-out) so it behaves the same
+ * on every platform and honours a deliberately emptied PATH. Callers pass the
+ * platform-specific candidate names (e.g. `["npm.cmd", "npm.exe", "npm"]`).
+ */
+export declare function findOnPath(names: string[]): string | null;
+/**
+ * Await the ORM's async `initDatabase()` and exit(1) with a clear message on
+ * failure. The await matters: initDatabase() calls setAdapter() inside the
+ * promise, so without it the next getAdapter() throws "No database adapter
+ * configured." Shared by the migrate, rollback, and status commands.
+ */
+export declare function initDatabaseOrExit(initDatabase: () => Promise<unknown>): Promise<void>;

package/types/core/src/csp.d.ts

@@ -0,0 +1,42 @@
+/** Return a fresh cryptographically-random nonce (128 bits, base64). */
+export declare function generateNonce(): string;
+/** Run `fn` with `nonce` established as the request-scoped CSP nonce. */
+export declare function runWithCspNonce<T>(nonce: string, fn: () => T): T;
+/** Set the nonce for the current request context (mirrors Log.setRequestId). */
+export declare function setCurrentNonce(nonce: string | undefined): void;
+/** Clear the nonce (mirrors Log.clearRequestId); the scope ends on its own. */
+export declare function clearCurrentNonce(): void;
+/**
+ * Return the current request's nonce, minting one on first access.
+ *
+ * Generate-on-first-access makes the value independent of ordering: whether the
+ * inline body or the CSP header is built first, both read the same nonce.
+ */
+export declare function currentCspNonce(): string;
+/**
+ * Frond global `csp_nonce()`: the current response's CSP nonce.
+ *
+ * Use it on any inline element a template emits:
+ *
+ *   <style nonce="{{ csp_nonce() }}"> ... </style>
+ *   <script nonce="{{ csp_nonce() }}"> ... </script>
+ */
+export declare function cspNonce(): string;
+/**
+ * Return `csp` with `'nonce-<nonce>'` present in style-src AND script-src.
+ *
+ * For the default `default-src 'self'` this yields
+ * `default-src 'self'; style-src 'self' 'nonce-X'; script-src 'self' 'nonce-X'`.
+ * When a directive is absent it is derived from `default-src` (falling back to
+ * `'self'`) so the framework's own nonce'd content always works; when present
+ * the nonce is appended (idempotently). Every other directive is kept, in order.
+ */
+export declare function injectNonceIntoCsp(csp: string, nonce: string): string;
+/**
+ * Build the CSP header value for `nonce` from the environment.
+ *
+ * Honours `TINA4_CSP` (default `default-src 'self'`) and always injects the
+ * nonce into style-src and script-src. An empty `TINA4_CSP` is treated as the
+ * default policy, matching how the warn-once gate reads "unset".
+ */
+export declare function resolveCspHeader(nonce: string): string;

package/types/core/src/etag.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Does an `If-None-Match` header match the response ETag?
+ *
+ * The header may be `*`, a single tag, or a comma-separated list; the `W/`
+ * weak prefix is stripped on both sides before comparing (RFC 7232 §2.3.2
+ * weak comparison). Shared by the static file server and the compression
+ * interceptor so both answer 304 the same way.
+ */
+export declare function etagMatches(ifNoneMatch: string, etag: string): boolean;

package/types/core/src/index.d.ts

@@ -54,6 +54,7 @@ export { WSDLService, WSDLOperation } from "./wsdl.js";
 export type { WSDLOperationMeta } from "./wsdl.js";
 export { HtmlElement, htmlElement, addHtmlHelpers, Raw, SafeString } from "./htmlElement.js";
 export { renderErrorOverlay, isDebugMode } from "./errorOverlay.js";
+export { cspNonce, currentCspNonce, generateNonce, injectNonceIntoCsp, resolveCspHeader, runWithCspNonce, setCurrentNonce, clearCurrentNonce, } from "./csp.js";
 export { AI_TOOLS, isInstalled, showMenu, installSelected, installAll, generateContext } from "./ai.js";
 export type { AiTool } from "./ai.js";
 export { Sso, SSO, SsoError } from "./sso.js";

package/types/core/src/middleware.d.ts

@@ -344,6 +344,12 @@ export declare class SecurityHeadersMiddleware {
      * overrides, WITHOUT Strict-Transport-Security, which depends on the
      * request's scheme. Also what a transport rejection carries (ADR-0068
      * section 4), written before the scheme is known.
+     *
+     * Content-Security-Policy always carries a per-response nonce in style-src
+     * AND script-src (ADR-0088), read from the request async-context (minted on
+     * first access), so the framework's own inline content runs under the strict
+     * default without 'unsafe-inline'. The nonce is random per response, so a
+     * caller comparing this header must assert its STRUCTURE, never a byte string.
      */
     static canonicalHeaders(): Record<string, string>;
     static beforeSecurity(req: Tina4Request, res: Tina4Response): [Tina4Request, Tina4Response];

package/types/core/src/session.d.ts

@@ -1,3 +1,4 @@
+import { RespSessionHandler } from "./sessionHandlers/respSessionHandler.js";
 export interface SessionConfig {
     /** Session backend type: "file", "redis", "valkey", "mongo", "memcached", "database" (or "db") */
     backend?: string;
@@ -95,26 +96,8 @@ export declare class FileSessionHandler implements SessionHandler {
  *
  * Or pass via SessionConfig.
  */
-export declare class RedisSessionHandler implements SessionHandler {
-    private host;
-    private port;
-    private password;
-    private prefix;
-    private db;
+export declare class RedisSessionHandler extends RespSessionHandler {
     constructor(config?: SessionConfig);
-    /**
-     * Execute a Redis command synchronously against the live server.
-     *
-     * Delegates to the shared {@link respCommandSync} transport: a genuine key miss
-     * yields `""`, and a transport/connection FAILURE (server unreachable, rejected
-     * AUTH, timeout) THROWS so the Session boundary can distinguish "not found"
-     * (silent) from "backend failed" (log-loud + degrade). Backend-failure parity.
-     */
-    private execSync;
-    private key;
-    read(sessionId: string): SessionData | null;
-    write(sessionId: string, data: SessionData, ttl?: number): void;
-    destroy(sessionId: string): void;
 }
 export declare class Session {
     private handler;
@@ -140,6 +123,29 @@ export declare class Session {
      * Lets `start()` tell "no such session" from "the store is unreachable".
      */
     private lastReadFailed;
+    /**
+     * What this request last saw of the stored record, one fingerprint per key:
+     * taken by start() and again by every save. save() compares the live data
+     * against it to find the keys THIS request changed.
+     */
+    private loaded;
+    /**
+     * True when this request is working on a record the store holds: start()
+     * adopted one, or a save has written one since. A save never re-creates such
+     * a record once another request has removed it.
+     */
+    private stored;
+    /**
+     * True when clear() ran since the last save: the save then replaces the
+     * stored record instead of merging into it.
+     */
+    private cleared;
+    /**
+     * True once this request found its session ended by another request (the
+     * record it loaded is gone). It stays ended for the rest of the request:
+     * regenerate() mints nothing either.
+     */
+    private ended;
     constructor(backend?: string, config?: SessionConfig);
     /**
      * Use a custom session handler (for advanced use cases).
@@ -226,8 +232,14 @@ export declare class Session {
      * session fixation — the pre-auth ID is destroyed and the data is carried
      * onto a fresh, unguessable ID. A backend destroy/write failure is logged
      * (never silent) but does not throw under the default policy.
+     *
+     * What is carried is the session as it is stored now with this request's
+     * own changes applied, the same merge save() does. If another request ended
+     * the session after this one loaded it (a logout, or a regenerate of its
+     * own), it stays ended: nothing is carried, no id is minted and null is
+     * returned, so no cookie goes out to replace the one that request sent.
      */
-    regenerate(): string;
+    regenerate(): string | null;
     /**
      * Dual-mode flash: set with value, get+remove without.
      *
@@ -273,9 +285,40 @@ export declare class Session {
      *
      * Returns true on a successful persist, false if the backend was unreachable
      * (logged). The dirty flag is cleared only on success so a later save()
-     * retries once the backend recovers. A nothing-to-persist call returns true.
+     * retries once the backend recovers. A call with no session returns true.
+     *
+     * Other requests on the same session run while this one does, so the save
+     * writes only THIS request's changes, onto the record as it is stored now.
+     * Writing back the whole snapshot start() loaded undid whatever another
+     * request did in between: a logout (destroy, clear, regenerate) or a
+     * privilege change made with set(). A record removed since this request
+     * loaded it is never re-created: the session has ended, for this request
+     * too. A request that has not loaded a stored record (a new session, the new
+     * id regenerate() mints) writes its data whole, as before.
+     *
+     * A session the store already holds is re-written even when this request
+     * changed nothing: that write re-stamps the backend deadline to
+     * now + TINA4_SESSION_TTL, so a session expires after that span of INACTIVITY
+     * rather than that long after its last CHANGE (ADR-0087 — a session's expiry
+     * slides on activity). The re-write is the re-read, merged record, so sliding
+     * the deadline is concurrent-safe: it never clobbers another request's change,
+     * never re-creates an ended record, and TINA4_SESSION_TTL=0 still re-stamps a
+     * never-expires deadline (ADR-0027). A request with no stored session and no
+     * change writes nothing — there is no deadline to move.
      */
     save(): boolean;
+    /**
+     * The stored record with this request's changes applied: every key whose
+     * value differs from what this request loaded or last saved, and the
+     * removal of every key it deleted. Keys it did not touch keep whatever is
+     * stored now.
+     */
+    private merged;
+    /**
+     * End the session for this request without touching the store: no id and
+     * no data, so nothing more is written and no cookie goes out for it.
+     */
+    private forget;
 }
 /**
  * Is the client's scheme HTTPS? Proxy-aware.

package/types/core/src/sessionHandlers/respSessionHandler.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Tina4 RESP Session Handler base — the shared store logic behind Redis and
+ * Valkey, zero dependencies.
+ *
+ * Redis and Valkey speak the same RESP protocol, so the read/write/destroy
+ * transport is byte-for-byte identical between them — only the configuration
+ * variable names and the log label differ. That difference lives entirely in
+ * each subclass constructor; everything the session store actually DOES lives
+ * here, once. A subclass resolves its own host/port/password/prefix/db from
+ * config or environment, then hands a {@link RespConnection} plus a label to
+ * `super()`.
+ */
+import type { SessionHandler } from "../session.js";
+interface SessionData {
+    _created: number;
+    _accessed: number;
+    [key: string]: unknown;
+}
+/** Resolved connection details a RESP session handler needs. */
+export interface RespConnection {
+    host: string;
+    port: number;
+    password: string;
+    prefix: string;
+    db: number;
+}
+/**
+ * RESP (Redis/Valkey) session handler using raw TCP — no external client.
+ *
+ * Stores session data as JSON strings with a server-side TTL for automatic
+ * expiry. A genuine key miss yields `null`; a transport/connection FAILURE
+ * (server unreachable, rejected AUTH, timeout) THROWS so the Session boundary
+ * can tell "not found" (silent) from "backend failed" (log-loud + degrade).
+ */
+export declare abstract class RespSessionHandler implements SessionHandler {
+    private readonly conn;
+    private readonly label;
+    protected constructor(conn: RespConnection, label: string);
+    /**
+     * Execute a RESP command synchronously against the live server.
+     *
+     * Delegates to the shared {@link respCommandSync} transport: a genuine key
+     * miss yields `""`, and a transport/connection FAILURE THROWS so the caller
+     * can distinguish "not found" from "backend failed". Backend-failure parity.
+     */
+    private execSync;
+    private key;
+    read(sessionId: string): SessionData | null;
+    write(sessionId: string, data: SessionData, ttl?: number): void;
+    destroy(sessionId: string): void;
+}
+export {};

package/types/core/src/sessionHandlers/valkeyHandler.d.ts

@@ -11,12 +11,7 @@
  *   TINA4_SESSION_VALKEY_PREFIX   (default: "tina4:session:")
  *   TINA4_SESSION_VALKEY_DB       (default: 0)
  */
-import type { SessionHandler } from "../session.js";
-interface SessionData {
-    _created: number;
-    _accessed: number;
-    [key: string]: unknown;
-}
+import { RespSessionHandler } from "./respSessionHandler.js";
 export interface ValkeySessionConfig {
     host?: string;
     port?: number;
@@ -41,25 +36,6 @@ export interface ValkeySessionConfig {
  * Valkey uses the same RESP protocol as Redis, so this handler is functionally
  * identical to RedisSessionHandler but with VALKEY config variable names.
  */
-export declare class ValkeySessionHandler implements SessionHandler {
-    private host;
-    private port;
-    private password;
-    private prefix;
-    private db;
+export declare class ValkeySessionHandler extends RespSessionHandler {
     constructor(config?: ValkeySessionConfig);
-    /**
-     * Execute a RESP command synchronously against the live Valkey server.
-     *
-     * Delegates to the shared {@link respCommandSync} transport: a genuine key miss
-     * yields `""`, and a transport/connection FAILURE (server unreachable, rejected
-     * AUTH, timeout) THROWS so the Session boundary can distinguish "not found"
-     * (silent) from "backend failed" (log-loud + degrade). Backend-failure parity.
-     */
-    private execSync;
-    private key;
-    read(sessionId: string): SessionData | null;
-    write(sessionId: string, data: SessionData, ttl: number): void;
-    destroy(sessionId: string): void;
 }
-export {};

package/types/core/src/types.d.ts

@@ -116,6 +116,14 @@ export interface Tina4ResponseMethods {
     stream(source: AsyncIterable<string | Buffer>, contentType?: string): Promise<Tina4Response>;
     /** The underlying ServerResponse for advanced use */
     raw: ServerResponse;
+    /**
+     * This response's Content-Security-Policy nonce (ADR-0088). `runDispatch()`
+     * mints one per request and publishes it on the async-context (csp.ts) so the
+     * framework's inline `<style>`/`<script>`, the Frond `csp_nonce()` global, and
+     * the value the security middleware names in the header all agree. Stamp it on
+     * any inline block a route emits: `<script nonce="${res.cspNonce}">`.
+     */
+    cspNonce: string;
 }
 /**
  * Tina4 Response — callable AND has methods.

package/types/core/src/upstreamResponse.d.ts

@@ -0,0 +1,10 @@
+import type { Tina4Response } from "./types.js";
+/**
+ * Relay a drained upstream (proxied) response to the client.
+ *
+ * The body is read to a string once, then returned as JSON when it parses and
+ * as raw text with the upstream Content-Type otherwise, keeping the upstream
+ * status either way. Shared by the dev-admin supervisor proxy and the feedback
+ * agent proxy so both pass a backend response through identically.
+ */
+export declare function relayUpstreamResponse(res: Tina4Response, upstream: Response): Promise<void>;

package/types/core/src/websocket.d.ts

@@ -131,6 +131,25 @@ export declare function parseFrame(data: Buffer): {
     payload: Buffer;
     bytesConsumed: number;
 } | null;
+/**
+ * Reassembles fragmented messages (RFC 6455 section 5.4). A browser sends a large message - a pasted image in a chat,
+ * base64 inside JSON - as a TEXT or BINARY frame with FIN clear, then CONTINUATION frames; control frames may arrive
+ * between the pieces. Returns a complete message when one is done, a control frame as it comes, and null while a
+ * message is still arriving. A CONTINUATION with no message started is dropped. Mirrors the Python master
+ * (tina4_python.websocket _handle_frame). One per connection.
+ */
+export declare class MessageAssembler {
+    private parts;
+    private opcode;
+    push(frame: {
+        fin: boolean;
+        opcode: number;
+        payload: Buffer;
+    }): {
+        opcode: number;
+        payload: Buffer;
+    } | null;
+}
 export declare class WebSocketServer {
     private port;
     private server;
@@ -271,6 +290,8 @@ export declare class WebSocketServer {
      */
     private startIdleReaper;
     private handleUpgrade;
+    private readonly assemblers;
+    private assemblerFor;
     private processBuffer;
     private removeClientFromAllRooms;
 }

package/types/frond/src/engine.d.ts

@@ -53,6 +53,13 @@ export declare const expressionFormCache: Map<string, number>;
  * Set the session ID used by formToken() / form_token() for CSRF session binding.
  */
 export declare function setFormTokenSessionId(sessionId: string): void;
+/**
+ * Register the function that backs the `{{ csp_nonce() }}` template global.
+ * @tina4/core calls this once with its request-scoped nonce source so every
+ * Frond instance (framework templates AND the app's) resolves the same nonce
+ * the Content-Security-Policy header names.
+ */
+export declare function setCspNonceProvider(fn: () => string): void;
 export declare class Frond {
     private static classFilters;
     private static classGlobals;