tina4-nodejs 3.13.141 → 3.13.143

package/packages/cli/dist/bin.js

@@ -1221,8 +1221,8 @@ function hashPassword(password, salt, iterations = 26e4) {
 }
 function checkPassword(password, hash) {
   try {
-    const delimiter5 = hash.includes("$") ? "$" : ":";
-    const parts = hash.split(delimiter5);
+    const delimiter4 = hash.includes("$") ? "$" : ":";
+    const parts = hash.split(delimiter4);
     if (parts.length !== 4 || parts[0] !== "pbkdf2_sha256") return false;
     const iterations = parseInt(parts[1], 10);
     const salt = parts[2];
@@ -8980,7 +8980,7 @@ async function removeMigrationRecord(name) {
     [name]
   );
 }
-async function rollback(migrationsDir, delimiter5) {
+async function rollback(migrationsDir, delimiter4) {
   if (migrationsDir instanceof Map) {
     const downFunctions = migrationsDir;
     const migrations2 = await getLastBatchMigrations();
@@ -8999,7 +8999,7 @@ async function rollback(migrationsDir, delimiter5) {
     return rolledBack2;
   }
   const dir = resolve4(migrationsDir ?? "migrations");
-  const delim = delimiter5 ?? ";";
+  const delim = delimiter4 ?? ";";
   const db = getAdapter();
   const migrations = await getLastBatchMigrations();
   const rolledBack = [];
@@ -9115,13 +9115,13 @@ function consumeSqlDelimiter(state) {
   }
   return true;
 }
-function splitStatements(sql, delimiter5 = ";") {
+function splitStatements(sql, delimiter4 = ";") {
   const state = {
     sql: normalizeQuotes(sql),
     statements: [],
     current: "",
-    delimiter: delimiter5,
-    dlen: delimiter5.length,
+    delimiter: delimiter4,
+    dlen: delimiter4.length,
     i: 0,
     inDollarBlock: false,
     inSlashBlock: false
@@ -9160,7 +9160,7 @@ function warnUnprefixedMigrations(files) {
 async function migrate(adapter, options) {
   const db = adapter ?? getAdapter();
   const dir = resolve4(options?.migrationsDir ?? "migrations");
-  const delimiter5 = options?.delimiter ?? ";";
+  const delimiter4 = options?.delimiter ?? ";";
   const result = { applied: [], skipped: [], failed: [] };
   if (!existsSync5(dir)) {
     return result;
@@ -9203,7 +9203,7 @@ async function migrate(adapter, options) {
       result.skipped.push(file);
       continue;
     }
-    const statements = splitStatements(sqlContent, delimiter5);
+    const statements = splitStatements(sqlContent, delimiter4);
     try {
       await adapterStartTransaction(db);
       for (const stmt of statements) {
@@ -13696,6 +13696,36 @@ var init_shapes = __esm({
   }
 });
 
+// ../orm/src/graph/adapters/rowMapping.ts
+function errorMessage(exc) {
+  if (exc instanceof Error) return exc.message;
+  return String(exc);
+}
+function nodeFromRow(row) {
+  if (row === null || row === void 0) return null;
+  return new GraphNode(
+    String(row.id),
+    row.labels ?? [],
+    row.props ?? {}
+  );
+}
+function edgeFromRow(row) {
+  if (row === null || row === void 0) return null;
+  return new GraphEdge(
+    String(row.id),
+    String(row.type),
+    String(row.f),
+    String(row.t),
+    row.props ?? {}
+  );
+}
+var init_rowMapping = __esm({
+  "../orm/src/graph/adapters/rowMapping.ts"() {
+    "use strict";
+    init_shapes();
+  }
+});
+
 // ../orm/src/graph/connectTimeout.ts
 function resolveGraphConnectTimeout() {
   const raw = (process.env[GRAPH_CONNECT_TIMEOUT_VARIABLE] ?? "").trim();
@@ -13735,15 +13765,12 @@ function propClause(properties) {
   for (const key of keys) params[`p_${key}`] = props[key];
   return { clause: `{${pairs}}`, params };
 }
-function errorMessage(exc) {
-  if (exc instanceof Error) return exc.message;
-  return String(exc);
-}
 var DRIVER_PACKAGE, driver, UltipaClient, UltipaConnectError, UNBOUNDED_CONNECT_SECONDS, UltipaGraphAdapter;
 var init_ultipa = __esm({
   async "../orm/src/graph/adapters/ultipa.ts"() {
     "use strict";
     init_shapes();
+    init_rowMapping();
     init_errors();
     init_connectTimeout2();
     DRIVER_PACKAGE = "tina4-ultipa";
@@ -13801,12 +13828,7 @@ var init_ultipa = __esm({
       }
       // -- portable node/edge/traverse core (GQL) ----------------------------
       nodeFromRow(row) {
-        if (row === null || row === void 0) return null;
-        return new GraphNode(
-          String(row.id),
-          row.labels ?? [],
-          row.props ?? {}
-        );
+        return nodeFromRow(row);
       }
       async addNode(label, properties = null) {
         const { clause, params } = propClause(properties);
@@ -13820,15 +13842,7 @@ var init_ultipa = __esm({
         params.to_id = toId;
         const gql = `MATCH (a), (b) WHERE id(a) = $from_id AND id(b) = $to_id INSERT (a)-[e:\`${type2}\` ${clause}]->(b) RETURN id(e) AS id, type(e) AS type, id(a) AS f, id(b) AS t, properties(e) AS props`;
         const rows = (await this.run(gql, params, false)).dicts();
-        if (rows.length === 0) return null;
-        const row = rows[0];
-        return new GraphEdge(
-          String(row.id),
-          String(row.type),
-          String(row.f),
-          String(row.t),
-          row.props ?? {}
-        );
+        return edgeFromRow(rows[0]);
       }
       async getNode(nodeId) {
         const gql = `MATCH (n) WHERE id(n) = $id RETURN id(n) AS id, labels(n) AS labels, properties(n) AS props`;
@@ -13893,10 +13907,6 @@ var bolt_exports = {};
 __export(bolt_exports, {
   BoltGraphAdapter: () => BoltGraphAdapter
 });
-function errorMessage2(exc) {
-  if (exc instanceof Error) return exc.message;
-  return String(exc);
-}
 function boltId(id) {
   const value = Number(id);
   return Number.isNaN(value) ? -1 : value;
@@ -13906,6 +13916,7 @@ var init_bolt = __esm({
   async "../orm/src/graph/adapters/bolt.ts"() {
     "use strict";
     init_shapes();
+    init_rowMapping();
     init_errors();
     init_connectTimeout2();
     DRIVER_PACKAGE2 = "neo4j-driver";
@@ -13941,7 +13952,7 @@ var init_bolt = __esm({
           const result = await session.run(cypher, params ?? {});
           return result.records.map((record) => record.toObject());
         } catch (exc) {
-          this.lastError = errorMessage2(exc);
+          this.lastError = errorMessage(exc);
           const code = exc?.code ?? "";
           const message = this.lastError.toLowerCase();
           if (code === "ServiceUnavailable" || code === neo4j.error?.SERVICE_UNAVAILABLE || message.includes("timed out") || message.includes("timeout")) {
@@ -13965,12 +13976,7 @@ var init_bolt = __esm({
       }
       // -- portable node/edge/traverse core (Cypher) -------------------------
       nodeFromRow(row) {
-        if (row === null || row === void 0) return null;
-        return new GraphNode(
-          String(row.id),
-          row.labels ?? [],
-          row.props ?? {}
-        );
+        return nodeFromRow(row);
       }
       async addNode(label, properties = null) {
         const cypher = `CREATE (n:\`${label}\` $props) RETURN id(n) AS id, labels(n) AS labels, properties(n) AS props`;
@@ -13984,15 +13990,7 @@ var init_bolt = __esm({
           to_id: boltId(toId),
           props: properties ?? {}
         });
-        if (rows.length === 0) return null;
-        const row = rows[0];
-        return new GraphEdge(
-          String(row.id),
-          String(row.type),
-          String(row.f),
-          String(row.t),
-          row.props ?? {}
-        );
+        return edgeFromRow(rows[0]);
       }
       async getNode(nodeId) {
         const cypher = `MATCH (n) WHERE id(n) = $id RETURN id(n) AS id, labels(n) AS labels, properties(n) AS props`;
@@ -14058,7 +14056,7 @@ function cleanProps(doc) {
   }
   return props;
 }
-function errorMessage3(exc) {
+function errorMessage2(exc) {
   if (exc instanceof Error) return exc.message;
   return String(exc);
 }
@@ -14097,14 +14095,14 @@ var init_arango = __esm({
         this.db = new ArangoDatabase(config);
       }
       connectOrError(exc) {
-        const text = errorMessage3(exc).toLowerCase();
+        const text = errorMessage2(exc).toLowerCase();
         if (text.includes("timed out") || text.includes("timeout") || text.includes("connection") || text.includes("econnrefused") || text.includes("etimedout") || text.includes("max retries")) {
           return new GraphConnectTimeout(
             `Graph connect to ${this.url.host}:${this.url.port} timed out (${GRAPH_CONNECT_TIMEOUT_VARIABLE}). Raise ${GRAPH_CONNECT_TIMEOUT_VARIABLE} if the server is simply slow, or set it to 0 to wait indefinitely.`,
             exc
           );
         }
-        return new GraphError(errorMessage3(exc), exc);
+        return new GraphError(errorMessage2(exc), exc);
       }
       async ensureCollections() {
         if (this.ensured) return;
@@ -14115,7 +14113,7 @@ var init_arango = __esm({
           if (!await edges.exists()) await this.db.createEdgeCollection(EDGE_COLLECTION);
           this.ensured = true;
         } catch (exc) {
-          this.lastError = errorMessage3(exc);
+          this.lastError = errorMessage2(exc);
           throw this.connectOrError(exc);
         }
       }
@@ -14125,7 +14123,7 @@ var init_arango = __esm({
           const cursor = await this.db.query({ query, bindVars: bind2 ?? {} });
           return await cursor.all();
         } catch (exc) {
-          this.lastError = errorMessage3(exc);
+          this.lastError = errorMessage2(exc);
           throw this.connectOrError(exc);
         }
       }
@@ -17433,6 +17431,73 @@ var init_trustedProxy = __esm({
   }
 });
 
+// ../core/src/csp.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
+import { randomBytes as randomBytes4 } from "node:crypto";
+function generateNonce() {
+  return randomBytes4(16).toString("base64");
+}
+function runWithCspNonce(nonce, fn) {
+  return nonceStore.run({ nonce }, fn);
+}
+function setCurrentNonce(nonce) {
+  const store = nonceStore.getStore();
+  if (store) store.nonce = nonce;
+  else nonceFallback = nonce;
+}
+function clearCurrentNonce() {
+  setCurrentNonce(void 0);
+}
+function currentCspNonce() {
+  const store = nonceStore.getStore();
+  let value = store ? store.nonce : nonceFallback;
+  if (!value) {
+    value = generateNonce();
+    if (store) store.nonce = value;
+    else nonceFallback = value;
+  }
+  return value;
+}
+function cspNonce() {
+  return currentCspNonce();
+}
+function injectNonceIntoCsp(csp, nonce) {
+  const token = `'nonce-${nonce}'`;
+  const directives = [];
+  for (const rawPart of csp.split(";")) {
+    const part = rawPart.trim();
+    if (!part) continue;
+    const spaceAt = part.search(/\s/);
+    const name = (spaceAt === -1 ? part : part.slice(0, spaceAt)).toLowerCase();
+    const value = spaceAt === -1 ? "" : part.slice(spaceAt + 1).trim();
+    directives.push([name, value]);
+  }
+  const defaultEntry = directives.find(([name]) => name === "default-src");
+  const defaultValue = defaultEntry && defaultEntry[1] ? defaultEntry[1] : "'self'";
+  for (const directive of ["style-src", "script-src"]) {
+    const existing = directives.find(([name]) => name === directive);
+    if (existing) {
+      if (!existing[1].split(/\s+/).includes(token)) {
+        existing[1] = `${existing[1]} ${token}`.trim();
+      }
+    } else {
+      directives.push([directive, `${defaultValue} ${token}`.trim()]);
+    }
+  }
+  return directives.map(([name, value]) => value ? `${name} ${value}` : name).join("; ");
+}
+function resolveCspHeader(nonce) {
+  const csp = process.env.TINA4_CSP || "default-src 'self'";
+  return injectNonceIntoCsp(csp, nonce);
+}
+var nonceStore, nonceFallback;
+var init_csp = __esm({
+  "../core/src/csp.ts"() {
+    "use strict";
+    nonceStore = new AsyncLocalStorage3();
+  }
+});
+
 // ../frond/src/engine.ts
 var engine_exports = {};
 __export(engine_exports, {
@@ -17442,9 +17507,10 @@ __export(engine_exports, {
   expressionFormCache: () => expressionFormCache,
   filterChainCache: () => filterChainCache,
   pathParseCache: () => pathParseCache,
+  setCspNonceProvider: () => setCspNonceProvider,
   setFormTokenSessionId: () => setFormTokenSessionId
 });
-import { createHash as createHash3, createHmac as createHmac3, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash3, createHmac as createHmac3, randomBytes as randomBytes5 } from "node:crypto";
 import { readFileSync as readFileSync6, existsSync as existsSync8, statSync as statSync6, realpathSync } from "node:fs";
 import { join as join11, resolve as resolve7, isAbsolute as isAbsolute4, sep as sep3 } from "node:path";
 function jsonText(value) {
@@ -18511,6 +18577,9 @@ function _b64url(data) {
 function setFormTokenSessionId(sessionId) {
   _formTokenSessionId = sessionId || "";
 }
+function setCspNonceProvider(fn) {
+  _cspNonceProvider = fn;
+}
 function _buildFormTokenJwt(descriptor = "") {
   const secret = process.env.TINA4_SECRET ?? "";
   const secretBytes = Buffer.byteLength(secret, "utf8");
@@ -18522,7 +18591,7 @@ function _buildFormTokenJwt(descriptor = "") {
   const ttlMinutes = parseInt(process.env.TINA4_TOKEN_LIMIT || "60", 10);
   const header = { alg: "HS256", typ: "JWT" };
   const now = Math.floor(Date.now() / 1e3);
-  const payload = { type: "form", nonce: randomBytes4(8).toString("hex"), iat: now, exp: now + ttlMinutes * 60 };
+  const payload = { type: "form", nonce: randomBytes5(8).toString("hex"), iat: now, exp: now + ttlMinutes * 60 };
   if (descriptor) {
     if (descriptor.includes("|")) {
       const [ctx, ref] = descriptor.split("|", 2);
@@ -18549,7 +18618,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FAST_FILTERS, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, EXPR_EVALUATORS, expressionFormCache, VarRef, JS_SAFE_RE, MEDIA_TYPE_RE, SANDBOX_EXPR_KEYWORDS, SANDBOX_IDENT_RE, SANDBOX_STRING_RE, UNSAFE_KEYS, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FAST_FILTERS, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, EXPR_EVALUATORS, expressionFormCache, VarRef, JS_SAFE_RE, MEDIA_TYPE_RE, SANDBOX_EXPR_KEYWORDS, SANDBOX_IDENT_RE, SANDBOX_STRING_RE, UNSAFE_KEYS, BUILTIN_FILTERS, _formTokenSessionId, _cspNonceProvider, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -18903,6 +18972,7 @@ var init_engine = __esm({
       js_escape: (v) => new SafeString(jsEscape(v))
     };
     _formTokenSessionId = "";
+    _cspNonceProvider = () => "";
     Frond = class _Frond {
       // ── Class-level registries ──────────────────────────────────
       // Persist globals, filters, and tests across hot-reloads and at
@@ -19056,6 +19126,7 @@ var init_engine = __esm({
         this.globals.formTokenValue = (descriptor) => _generateFormTokenValue(descriptor || "");
         this.globals.form_token_value = (descriptor) => _generateFormTokenValue(descriptor || "");
         this.globals.dump = (value) => renderDump(value);
+        this.globals.csp_nonce = () => _cspNonceProvider();
         for (const [k, v] of _Frond.classFilters) this.filters[k] = v;
         for (const [k, v] of _Frond.classGlobals) this.globals[k] = v;
         for (const [k, v] of _Frond.classTests) this.tests[k] = v;
@@ -20319,7 +20390,8 @@ async function getFrond() {
   const dir = _defaultTemplatesDir ?? nodePath.resolve(process.cwd(), "src/templates");
   let engine = _frondCache.get(dir);
   if (!engine) {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     engine = new Frond2(dir);
     _frondCache.set(dir, engine);
   }
@@ -20330,7 +20402,8 @@ async function getFrameworkFrond() {
   const frameworkDir = nodePath.resolve(nodePath.dirname(import.meta.url.replace("file://", "")), "..", "templates");
   if (!_frameworkFrond && fs2.existsSync(frameworkDir)) {
     try {
-      const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      setCspNonceProvider2(currentCspNonce);
       _frameworkFrond = new Frond2(frameworkDir);
     } catch {
       return null;
@@ -20430,6 +20503,7 @@ function createResponse(res) {
     return response;
   };
   response.raw = res;
+  response.cspNonce = currentCspNonce();
   response.json = function(data, status2) {
     if (res.headersSent) return response;
     if (status2 !== void 0) res.statusCode = status2;
@@ -20575,7 +20649,8 @@ function createResponse(res) {
   };
   response.render = async function(templateName, data, status2, templateDir) {
     try {
-      const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      setCspNonceProvider2(currentCspNonce);
       const dir = templateDir ?? _defaultTemplatesDir ?? nodePath.resolve(process.cwd(), "src/templates");
       let engine = _frondCache.get(dir);
       if (!engine) {
@@ -20693,6 +20768,7 @@ var HEADER_TOKEN, _frondCache, _defaultTemplatesDir, _globalFrond, _frameworkFro
 var init_response = __esm({
   "../core/src/response.ts"() {
     "use strict";
+    init_csp();
     HEADER_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
     _frondCache = /* @__PURE__ */ new Map();
     _defaultTemplatesDir = null;
@@ -20904,6 +20980,7 @@ var init_middleware = __esm({
     init_dotenv();
     init_router();
     init_trustedProxy();
+    init_csp();
     init_response();
     MiddlewareChain = class {
       middlewares = [];
@@ -21336,12 +21413,18 @@ var init_middleware = __esm({
        * overrides, WITHOUT Strict-Transport-Security, which depends on the
        * request's scheme. Also what a transport rejection carries (ADR-0068
        * section 4), written before the scheme is known.
+       *
+       * Content-Security-Policy always carries a per-response nonce in style-src
+       * AND script-src (ADR-0088), read from the request async-context (minted on
+       * first access), so the framework's own inline content runs under the strict
+       * default without 'unsafe-inline'. The nonce is random per response, so a
+       * caller comparing this header must assert its STRUCTURE, never a byte string.
        */
       static canonicalHeaders() {
         return {
           "X-Frame-Options": process.env.TINA4_FRAME_OPTIONS ?? "SAMEORIGIN",
           "X-Content-Type-Options": "nosniff",
-          "Content-Security-Policy": process.env.TINA4_CSP ?? "default-src 'self'",
+          "Content-Security-Policy": resolveCspHeader(currentCspNonce()),
           "Referrer-Policy": process.env.TINA4_REFERRER_POLICY ?? "strict-origin-when-cross-origin",
           "X-XSS-Protection": "0",
           "Permissions-Policy": process.env.TINA4_PERMISSIONS_POLICY ?? "camera=(), microphone=(), geolocation=()"
@@ -21383,7 +21466,7 @@ var init_middleware = __esm({
       static warnCspDefaultOnce() {
         if (_SecurityHeadersMiddleware.cspDefaultWarned) return;
         _SecurityHeadersMiddleware.cspDefaultWarned = true;
-        const message = `TINA4_CSP is not set, so Tina4 is serving the default Content-Security-Policy "default-src 'self'" on every response. That default blocks runtime-injected inline styles, cross-origin fonts/scripts/CDNs, data: URIs, and cross-origin WebSocket/XHR (e.g. a separate API or LiveKit host). If your app uses any of these, set TINA4_CSP to a policy that allows them (see https://tina4.com); to silence this notice without changing behaviour, set TINA4_CSP="default-src 'self'".`;
+        const message = `TINA4_CSP is not set, so Tina4 is serving the default Content-Security-Policy "default-src 'self'" on every response. The framework injects a per-response nonce into style-src and script-src, so its own inline <style>/<script> (and your templates using the csp_nonce() Frond global) work under this policy. The default still blocks cross-origin fonts/scripts/CDNs, data: URIs, and cross-origin WebSocket/XHR (e.g. a separate API or LiveKit host). If your app uses any of these, set TINA4_CSP to a policy that allows them (see https://tina4.com); to silence this notice without changing behaviour, set TINA4_CSP="default-src 'self'".`;
         try {
           Log.warning(message);
         } catch {
@@ -21621,14 +21704,14 @@ function extractBoundary(contentType) {
 function parseMultipart(body, boundary) {
   const fields = {};
   const files = {};
-  const delimiter5 = Buffer.from(`--${boundary}`);
+  const delimiter4 = Buffer.from(`--${boundary}`);
   const closeDelimiter = Buffer.from(`--${boundary}--`);
   const crlf = Buffer.from("\r\n");
   const doubleCrlf = Buffer.from("\r\n\r\n");
   let offset = 0;
-  const firstIdx = bufferIndexOf(body, delimiter5, offset);
+  const firstIdx = bufferIndexOf(body, delimiter4, offset);
   if (firstIdx === -1) return { fields, files };
-  offset = firstIdx + delimiter5.length;
+  offset = firstIdx + delimiter4.length;
   if (body[offset] === 13 && body[offset + 1] === 10) {
     offset += 2;
   }
@@ -21637,7 +21720,7 @@ function parseMultipart(body, boundary) {
     if (headersEnd === -1) break;
     const headersStr = body.subarray(offset, headersEnd).toString("utf-8");
     offset = headersEnd + doubleCrlf.length;
-    const nextDelimIdx = bufferIndexOf(body, delimiter5, offset);
+    const nextDelimIdx = bufferIndexOf(body, delimiter4, offset);
     if (nextDelimIdx === -1) break;
     const contentEnd = nextDelimIdx - crlf.length;
     const content = body.subarray(offset, contentEnd);
@@ -21660,7 +21743,7 @@ function parseMultipart(body, boundary) {
     } else if (disposition.name) {
       fields[disposition.name] = content.toString("utf-8");
     }
-    offset = nextDelimIdx + delimiter5.length;
+    offset = nextDelimIdx + delimiter4.length;
     if (body[offset] === 45 && body[offset + 1] === 45) {
       break;
     }
@@ -22408,6 +22491,21 @@ var init_portTakeover = __esm({
   }
 });
 
+// ../core/src/etag.ts
+function etagMatches(ifNoneMatch, etag) {
+  const strip = (tag) => tag.trim().replace(/^W\//, "");
+  const target = strip(etag);
+  return ifNoneMatch.split(",").some((candidate) => {
+    const trimmed = candidate.trim();
+    return trimmed === "*" || strip(trimmed) === target;
+  });
+}
+var init_etag = __esm({
+  "../core/src/etag.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/sessionHandlers/syncBridge.ts
 import { Worker } from "node:worker_threads";
 function getBridge(key, workerSource, workerData) {
@@ -22689,42 +22787,35 @@ var init_respClient = __esm({
   }
 });
 
-// ../core/src/sessionHandlers/valkeyHandler.ts
-var ValkeySessionHandler;
-var init_valkeyHandler = __esm({
-  "../core/src/sessionHandlers/valkeyHandler.ts"() {
+// ../core/src/sessionHandlers/respSessionHandler.ts
+var RespSessionHandler;
+var init_respSessionHandler = __esm({
+  "../core/src/sessionHandlers/respSessionHandler.ts"() {
     "use strict";
     init_respClient();
-    ValkeySessionHandler = class {
-      host;
-      port;
-      password;
-      prefix;
-      db;
-      constructor(config) {
-        this.host = config?.host ?? process.env.TINA4_SESSION_VALKEY_HOST ?? "127.0.0.1";
-        this.port = config?.port ?? (process.env.TINA4_SESSION_VALKEY_PORT ? parseInt(process.env.TINA4_SESSION_VALKEY_PORT, 10) : 6379);
-        this.password = config?.password ?? process.env.TINA4_SESSION_VALKEY_PASSWORD ?? "";
-        this.prefix = config?.prefix ?? process.env.TINA4_SESSION_VALKEY_PREFIX ?? "tina4:session:";
-        this.db = config?.db ?? (process.env.TINA4_SESSION_VALKEY_DB ? parseInt(process.env.TINA4_SESSION_VALKEY_DB, 10) : 0);
+    RespSessionHandler = class {
+      constructor(conn, label) {
+        this.conn = conn;
+        this.label = label;
       }
+      conn;
+      label;
       /**
-       * Execute a RESP command synchronously against the live Valkey server.
+       * Execute a RESP command synchronously against the live server.
        *
-       * Delegates to the shared {@link respCommandSync} transport: a genuine key miss
-       * yields `""`, and a transport/connection FAILURE (server unreachable, rejected
-       * AUTH, timeout) THROWS so the Session boundary can distinguish "not found"
-       * (silent) from "backend failed" (log-loud + degrade). Backend-failure parity.
+       * Delegates to the shared {@link respCommandSync} transport: a genuine key
+       * miss yields `""`, and a transport/connection FAILURE THROWS so the caller
+       * can distinguish "not found" from "backend failed". Backend-failure parity.
        */
       execSync(args) {
         return respCommandSync(
-          { host: this.host, port: this.port, password: this.password, db: this.db },
+          { host: this.conn.host, port: this.conn.port, password: this.conn.password, db: this.conn.db },
           args,
-          "Valkey"
+          this.label
         );
       }
       key(sessionId) {
-        return `${this.prefix}${sessionId}`;
+        return `${this.conn.prefix}${sessionId}`;
       }
       read(sessionId) {
         const raw = this.execSync(["GET", this.key(sessionId)]);
@@ -22735,7 +22826,7 @@ var init_valkeyHandler = __esm({
           return null;
         }
       }
-      write(sessionId, data, ttl) {
+      write(sessionId, data, ttl = 0) {
         const json = JSON.stringify(data);
         if (ttl > 0) {
           this.execSync(["SETEX", this.key(sessionId), String(ttl), json]);
@@ -22750,6 +22841,29 @@ var init_valkeyHandler = __esm({
   }
 });
 
+// ../core/src/sessionHandlers/valkeyHandler.ts
+var ValkeySessionHandler;
+var init_valkeyHandler = __esm({
+  "../core/src/sessionHandlers/valkeyHandler.ts"() {
+    "use strict";
+    init_respSessionHandler();
+    ValkeySessionHandler = class extends RespSessionHandler {
+      constructor(config) {
+        super(
+          {
+            host: config?.host ?? process.env.TINA4_SESSION_VALKEY_HOST ?? "127.0.0.1",
+            port: config?.port ?? (process.env.TINA4_SESSION_VALKEY_PORT ? parseInt(process.env.TINA4_SESSION_VALKEY_PORT, 10) : 6379),
+            password: config?.password ?? process.env.TINA4_SESSION_VALKEY_PASSWORD ?? "",
+            prefix: config?.prefix ?? process.env.TINA4_SESSION_VALKEY_PREFIX ?? "tina4:session:",
+            db: config?.db ?? (process.env.TINA4_SESSION_VALKEY_DB ? parseInt(process.env.TINA4_SESSION_VALKEY_DB, 10) : 0)
+          },
+          "Valkey"
+        );
+      }
+    };
+  }
+});
+
 // ../core/src/sessionHandlers/memcachedHandler.ts
 import { createHash as createHash4 } from "node:crypto";
 var MAX_KEY_BYTES, MAX_RELATIVE_EXPTIME, MemcachedSessionHandler;
@@ -23765,7 +23879,7 @@ __export(session_exports, {
   sessionCookieName: () => sessionCookieName,
   sessionStrictMode: () => sessionStrictMode
 });
-import { createHash as createHash5, randomBytes as randomBytes5 } from "node:crypto";
+import { createHash as createHash5, randomBytes as randomBytes6 } from "node:crypto";
 import { existsSync as existsSync11, mkdirSync as mkdirSync11, readFileSync as readFileSync8, writeFileSync as writeFileSync8, unlinkSync as unlinkSync5, readdirSync as readdirSync6 } from "node:fs";
 import { join as join15 } from "node:path";
 function isValidSessionId(sessionId) {
@@ -23783,6 +23897,20 @@ function resolveBackend(name) {
   }
   return normalised;
 }
+function fingerprint(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return void 0;
+  }
+}
+function fingerprints(data) {
+  const prints = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(data)) {
+    prints.set(key, fingerprint(value));
+  }
+  return prints;
+}
 function isSecureScheme(forwardedProto, socketEncrypted) {
   const forwarded = (forwardedProto ?? "").trim();
   if (forwarded !== "") {
@@ -23815,7 +23943,7 @@ var init_session = __esm({
     "use strict";
     init_logger();
     init_dotenv();
-    init_respClient();
+    init_respSessionHandler();
     init_valkeyHandler();
     init_memcachedHandler();
     init_mongoHandler();
@@ -23941,57 +24069,19 @@ var init_session = __esm({
         }
       }
     };
-    RedisSessionHandler = class {
-      host;
-      port;
-      password;
-      prefix;
-      db;
+    RedisSessionHandler = class extends RespSessionHandler {
       constructor(config) {
-        this.host = config?.redisHost ?? process.env.TINA4_SESSION_REDIS_HOST ?? "127.0.0.1";
-        this.port = config?.redisPort ?? (process.env.TINA4_SESSION_REDIS_PORT ? parseInt(process.env.TINA4_SESSION_REDIS_PORT, 10) : 6379);
-        this.password = config?.redisPassword ?? process.env.TINA4_SESSION_REDIS_PASSWORD ?? "";
-        this.prefix = config?.redisPrefix ?? process.env.TINA4_SESSION_REDIS_PREFIX ?? "tina4:session:";
-        this.db = config?.redisDb ?? (process.env.TINA4_SESSION_REDIS_DB ? parseInt(process.env.TINA4_SESSION_REDIS_DB, 10) : 0);
-      }
-      /**
-       * Execute a Redis command synchronously against the live server.
-       *
-       * Delegates to the shared {@link respCommandSync} transport: a genuine key miss
-       * yields `""`, and a transport/connection FAILURE (server unreachable, rejected
-       * AUTH, timeout) THROWS so the Session boundary can distinguish "not found"
-       * (silent) from "backend failed" (log-loud + degrade). Backend-failure parity.
-       */
-      execSync(args) {
-        return respCommandSync(
-          { host: this.host, port: this.port, password: this.password, db: this.db },
-          args,
+        super(
+          {
+            host: config?.redisHost ?? process.env.TINA4_SESSION_REDIS_HOST ?? "127.0.0.1",
+            port: config?.redisPort ?? (process.env.TINA4_SESSION_REDIS_PORT ? parseInt(process.env.TINA4_SESSION_REDIS_PORT, 10) : 6379),
+            password: config?.redisPassword ?? process.env.TINA4_SESSION_REDIS_PASSWORD ?? "",
+            prefix: config?.redisPrefix ?? process.env.TINA4_SESSION_REDIS_PREFIX ?? "tina4:session:",
+            db: config?.redisDb ?? (process.env.TINA4_SESSION_REDIS_DB ? parseInt(process.env.TINA4_SESSION_REDIS_DB, 10) : 0)
+          },
           "Redis"
         );
       }
-      key(sessionId) {
-        return `${this.prefix}${sessionId}`;
-      }
-      read(sessionId) {
-        const raw = this.execSync(["GET", this.key(sessionId)]);
-        if (!raw) return null;
-        try {
-          return JSON.parse(raw);
-        } catch {
-          return null;
-        }
-      }
-      write(sessionId, data, ttl = 0) {
-        const json = JSON.stringify(data);
-        if (ttl > 0) {
-          this.execSync(["SETEX", this.key(sessionId), String(ttl), json]);
-        } else {
-          this.execSync(["SET", this.key(sessionId), json]);
-        }
-      }
-      destroy(sessionId) {
-        this.execSync(["DEL", this.key(sessionId)]);
-      }
     };
     FLASH_PREFIX = "_flash_";
     Session = class {
@@ -24018,6 +24108,29 @@ var init_session = __esm({
        * Lets `start()` tell "no such session" from "the store is unreachable".
        */
       lastReadFailed = false;
+      /**
+       * What this request last saw of the stored record, one fingerprint per key:
+       * taken by start() and again by every save. save() compares the live data
+       * against it to find the keys THIS request changed.
+       */
+      loaded = /* @__PURE__ */ new Map();
+      /**
+       * True when this request is working on a record the store holds: start()
+       * adopted one, or a save has written one since. A save never re-creates such
+       * a record once another request has removed it.
+       */
+      stored = false;
+      /**
+       * True when clear() ran since the last save: the save then replaces the
+       * stored record instead of merging into it.
+       */
+      cleared = false;
+      /**
+       * True once this request found its session ended by another request (the
+       * record it loaded is gone). It stays ended for the rest of the request:
+       * regenerate() mints nothing either.
+       */
+      ended = false;
       constructor(backend, config) {
         const backendType = resolveBackend(
           backend ?? config?.backend ?? process.env.TINA4_SESSION_BACKEND ?? "file"
@@ -24162,6 +24275,10 @@ var init_session = __esm({
             const now2 = Math.floor(Date.now() / 1e3);
             this.data = { _created: now2, _accessed: now2 };
             this.dirty = false;
+            this.stored = false;
+            this.loaded = /* @__PURE__ */ new Map();
+            this.cleared = false;
+            this.ended = false;
             return sessionId;
           }
           if (loaded) {
@@ -24171,14 +24288,22 @@ var init_session = __esm({
             this.data._accessed = now2;
             this.dirty = false;
             this.safeWrite(this.sessionId, this.data, this.ttl);
+            this.stored = true;
+            this.loaded = fingerprints(this.data);
+            this.cleared = false;
+            this.ended = false;
             return sessionId;
           }
         }
-        this.sessionId = randomBytes5(16).toString("hex");
+        this.sessionId = randomBytes6(16).toString("hex");
         const now = Math.floor(Date.now() / 1e3);
         this.data = { _created: now, _accessed: now };
         this.dirty = false;
         this.safeWrite(this.sessionId, this.data, this.ttl);
+        this.stored = false;
+        this.loaded = /* @__PURE__ */ new Map();
+        this.cleared = false;
+        this.ended = false;
         return this.sessionId;
       }
       /**
@@ -24219,9 +24344,7 @@ var init_session = __esm({
         if (this.sessionId) {
           this.safeDestroy(this.sessionId);
         }
-        this.sessionId = null;
-        this.data = null;
-        this.dirty = false;
+        this.forget();
       }
       /**
        * Get all session data (excluding internal keys).
@@ -24244,6 +24367,7 @@ var init_session = __esm({
         const now = Math.floor(Date.now() / 1e3);
         this.data = { _created: this.data._created, _accessed: now };
         this.dirty = true;
+        this.cleared = true;
         this.save();
       }
       /**
@@ -24260,17 +24384,36 @@ var init_session = __esm({
        * session fixation — the pre-auth ID is destroyed and the data is carried
        * onto a fresh, unguessable ID. A backend destroy/write failure is logged
        * (never silent) but does not throw under the default policy.
+       *
+       * What is carried is the session as it is stored now with this request's
+       * own changes applied, the same merge save() does. If another request ended
+       * the session after this one loaded it (a logout, or a regenerate of its
+       * own), it stays ended: nothing is carried, no id is minted and null is
+       * returned, so no cookie goes out to replace the one that request sent.
        */
       regenerate() {
+        if (this.ended) return null;
+        if (this.sessionId && this.stored && this.data) {
+          const current = this.safeRead(this.sessionId);
+          if (!this.lastReadFailed) {
+            if (!current) {
+              this.forget();
+              this.ended = true;
+              return null;
+            }
+            if (!this.cleared) this.data = this.merged(current);
+          }
+        }
         const oldId = this.sessionId;
         const oldData = this.data;
         if (oldId) {
           this.safeDestroy(oldId);
         }
-        this.sessionId = randomBytes5(16).toString("hex");
+        this.sessionId = randomBytes6(16).toString("hex");
         this.data = oldData ?? { _created: Math.floor(Date.now() / 1e3), _accessed: Math.floor(Date.now() / 1e3) };
         this.data._accessed = Math.floor(Date.now() / 1e3);
         this.dirty = true;
+        this.stored = false;
         this.save();
         return this.sessionId;
       }
@@ -24346,17 +24489,84 @@ var init_session = __esm({
        *
        * Returns true on a successful persist, false if the backend was unreachable
        * (logged). The dirty flag is cleared only on success so a later save()
-       * retries once the backend recovers. A nothing-to-persist call returns true.
+       * retries once the backend recovers. A call with no session returns true.
+       *
+       * Other requests on the same session run while this one does, so the save
+       * writes only THIS request's changes, onto the record as it is stored now.
+       * Writing back the whole snapshot start() loaded undid whatever another
+       * request did in between: a logout (destroy, clear, regenerate) or a
+       * privilege change made with set(). A record removed since this request
+       * loaded it is never re-created: the session has ended, for this request
+       * too. A request that has not loaded a stored record (a new session, the new
+       * id regenerate() mints) writes its data whole, as before.
+       *
+       * A session the store already holds is re-written even when this request
+       * changed nothing: that write re-stamps the backend deadline to
+       * now + TINA4_SESSION_TTL, so a session expires after that span of INACTIVITY
+       * rather than that long after its last CHANGE (ADR-0087 — a session's expiry
+       * slides on activity). The re-write is the re-read, merged record, so sliding
+       * the deadline is concurrent-safe: it never clobbers another request's change,
+       * never re-creates an ended record, and TINA4_SESSION_TTL=0 still re-stamps a
+       * never-expires deadline (ADR-0027). A request with no stored session and no
+       * change writes nothing — there is no deadline to move.
        */
       save() {
         if (!this.sessionId || !this.data) return true;
-        if (!this.dirty) return true;
-        if (this.safeWrite(this.sessionId, this.data, this.ttl)) {
+        if (!this.dirty && !this.stored) return true;
+        let record = this.data;
+        if (this.stored) {
+          const current = this.safeRead(this.sessionId);
+          if (this.lastReadFailed) return false;
+          if (!current) {
+            this.forget();
+            this.ended = true;
+            return true;
+          }
+          if (!this.cleared) record = this.merged(current);
+        }
+        if (this.safeWrite(this.sessionId, record, this.ttl)) {
           this.dirty = false;
+          this.stored = true;
+          this.cleared = false;
+          this.loaded = fingerprints(this.data);
           return true;
         }
         return false;
       }
+      /**
+       * The stored record with this request's changes applied: every key whose
+       * value differs from what this request loaded or last saved, and the
+       * removal of every key it deleted. Keys it did not touch keep whatever is
+       * stored now.
+       */
+      merged(current) {
+        const data = this.data;
+        const record = { ...current };
+        for (const [key, value] of Object.entries(data)) {
+          const print = fingerprint(value);
+          if (print === void 0 || !this.loaded.has(key) || this.loaded.get(key) !== print) {
+            record[key] = value;
+          }
+        }
+        for (const key of this.loaded.keys()) {
+          if (!Object.prototype.hasOwnProperty.call(data, key)) {
+            delete record[key];
+          }
+        }
+        return record;
+      }
+      /**
+       * End the session for this request without touching the store: no id and
+       * no data, so nothing more is written and no cookie goes out for it.
+       */
+      forget() {
+        this.sessionId = null;
+        this.data = null;
+        this.dirty = false;
+        this.stored = false;
+        this.cleared = false;
+        this.loaded = /* @__PURE__ */ new Map();
+      }
     };
   }
 });
@@ -24401,14 +24611,6 @@ function headStripIntercept(rawReq, rawRes) {
 function isCompressibleContentType(contentType) {
   return COMPRESSIBLE_PREFIXES.some((prefix) => contentType.includes(prefix));
 }
-function etagMatchesInm(ifNoneMatch, etag) {
-  const strip = (tag) => tag.trim().replace(/^W\//, "");
-  const target = strip(etag);
-  return ifNoneMatch.split(",").some((candidate) => {
-    const trimmed = candidate.trim();
-    return trimmed === "*" || strip(trimmed) === target;
-  });
-}
 function maybeCompressResponse(body, rawReq, rawRes) {
   const acceptEncoding = String(rawReq.headers["accept-encoding"] ?? "");
   const contentTypeHeader = rawRes.getHeader("content-type");
@@ -24424,7 +24626,7 @@ function maybeCompressResponse(body, rawReq, rawRes) {
 }
 function responseIsNotModified(rawReq, rawRes, etag) {
   const ifNoneMatch = String(rawReq.headers["if-none-match"] ?? "");
-  if (ifNoneMatch) return etagMatchesInm(ifNoneMatch, etag);
+  if (ifNoneMatch) return etagMatches(ifNoneMatch, etag);
   const lastModifiedHeader = rawRes.getHeader("last-modified");
   if (typeof lastModifiedHeader !== "string") return false;
   const ifModifiedSince = String(rawReq.headers["if-modified-since"] ?? "");
@@ -24552,6 +24754,7 @@ var init_dispatchPipeline = __esm({
   "../core/src/dispatchPipeline.ts"() {
     "use strict";
     init_logger();
+    init_etag();
     COMPRESSIBLE_PREFIXES = [
       "text/",
       "application/json",
@@ -24647,18 +24850,11 @@ function isNotModified(req2, etag, stat) {
   }
   return false;
 }
-function etagMatches(ifNoneMatch, etag) {
-  const strip = (tag) => tag.trim().replace(/^W\//, "");
-  const target = strip(etag);
-  return ifNoneMatch.split(",").some((candidate) => {
-    const trimmed = candidate.trim();
-    return trimmed === "*" || strip(trimmed) === target;
-  });
-}
 var COMPRESSIBLE_PREFIXES2, MIME_TYPES;
 var init_static = __esm({
   "../core/src/static.ts"() {
     "use strict";
+    init_etag();
     COMPRESSIBLE_PREFIXES2 = [
       "text/",
       "application/json",
@@ -24739,11 +24935,11 @@ function formatSourceBlock(filename, lineno) {
   const lines = readSourceLines(filename, lineno);
   if (lines.length === 0) return "";
   const rows = lines.map(([num, text, isError]) => {
-    const bg = isError ? `background:${ERROR_LINE_BG};` : "";
+    const rowClass = isError ? "eo-line eo-line-err" : "eo-line";
     const marker = isError ? "&#x25b6;" : " ";
-    return `<div style="${bg}display:flex;padding:1px 0;"><span style="color:${YELLOW};min-width:3.5em;text-align:right;padding-right:1em;user-select:none;">${num}</span><span style="color:${RED};width:1.2em;user-select:none;">${marker}</span><span style="color:${TEXT};white-space:pre-wrap;tab-size:4;">${esc(text)}</span></div>`;
+    return `<div class="${rowClass}"><span class="eo-ln">${num}</span><span class="eo-marker">${marker}</span><span class="eo-code">${esc(text)}</span></div>`;
   }).join("\n");
-  return `<div style="background:${SURFACE};border-radius:6px;padding:12px;overflow-x:auto;font-family:'SF Mono','Fira Code','Consolas',monospace;font-size:13px;line-height:1.6;">` + rows + `</div>`;
+  return `<div class="eo-source">` + rows + `</div>`;
 }
 function formatFrame(frame, capturedAt = 0) {
   const source = frame.file && frame.line > 0 ? formatSourceBlock(frame.file, frame.line) : "";
@@ -24755,23 +24951,23 @@ function formatFrame(frame, capturedAt = 0) {
       if (mtime > capturedAt + 0.5) {
         const d = new Date(mtime * 1e3);
         const mtimeIso = `${String(d.getUTCHours()).padStart(2, "0")}:${String(d.getUTCMinutes()).padStart(2, "0")}:${String(d.getUTCSeconds()).padStart(2, "0")}`;
-        staleBadge = ` <span style="background:${PEACH};color:${BG};padding:1px 8px;border-radius:3px;font-size:11px;font-weight:700;margin-left:6px;">FILE MODIFIED @ ${mtimeIso} UTC &mdash; source may not match what failed</span>`;
+        staleBadge = ` <span class="eo-stale">FILE MODIFIED @ ${mtimeIso} UTC &mdash; source may not match what failed</span>`;
       }
     } catch {
     }
   }
-  return `<div style="margin-bottom:16px;"><div style="margin-bottom:4px;"><span style="color:${BLUE};">${esc(frame.file)}</span><span style="color:${SUBTEXT};"> : </span><span style="color:${YELLOW};">${frame.line}</span><span style="color:${SUBTEXT};"> in </span><span style="color:${GREEN};">${esc(frame.func)}</span>` + staleBadge + `</div>` + source + `</div>`;
+  return `<div class="eo-frame"><div class="eo-frame-head"><span class="eo-file">${esc(frame.file)}</span><span class="eo-sep"> : </span><span class="eo-lineno">${frame.line}</span><span class="eo-sep"> in </span><span class="eo-fn">${esc(frame.func)}</span>` + staleBadge + `</div>` + source + `</div>`;
 }
 function collapsible(title, content, openByDefault = false) {
   const open = openByDefault ? " open" : "";
-  return `<details style="margin-top:16px;"${open}><summary style="cursor:pointer;color:${LAVENDER};font-weight:600;font-size:15px;padding:8px 0;user-select:none;">${esc(title)}</summary><div style="padding:8px 0;">${content}</div></details>`;
+  return `<details class="eo-details"${open}><summary class="eo-summary">${esc(title)}</summary><div class="eo-details-body">${content}</div></details>`;
 }
 function table(pairs) {
-  if (pairs.length === 0) return `<span style="color:${SUBTEXT};">None</span>`;
+  if (pairs.length === 0) return `<span class="eo-none">None</span>`;
   const rows = pairs.map(
-    ([key, val]) => `<tr><td style="color:${PEACH};padding:4px 16px 4px 0;vertical-align:top;white-space:nowrap;">${esc(key)}</td><td style="color:${TEXT};padding:4px 0;word-break:break-all;">${esc(val)}</td></tr>`
+    ([key, val]) => `<tr><td class="eo-key">${esc(key)}</td><td class="eo-val">${esc(val)}</td></tr>`
   ).join("");
-  return `<table style="border-collapse:collapse;width:100%;">${rows}</table>`;
+  return `<table class="eo-table">${rows}</table>`;
 }
 function renderErrorOverlay(error2, request) {
   const capturedAt = Date.now() / 1e3;
@@ -24784,7 +24980,7 @@ function renderErrorOverlay(error2, request) {
   }
   const hidden = frames.length - Math.min(frames.length, MAX_FRAMES);
   if (hidden > 0) {
-    framesHtml += `<div style="color:${SUBTEXT};padding:8px 0;font-size:13px;">&#8230; ${hidden} more stack frames hidden (truncated at ${MAX_FRAMES})</div>`;
+    framesHtml += `<div class="eo-hidden-frames">&#8230; ${hidden} more stack frames hidden (truncated at ${MAX_FRAMES})</div>`;
   }
   const requestPairs = [];
   if (request != null) {
@@ -24821,37 +25017,72 @@ function renderErrorOverlay(error2, request) {
   ];
   const envSection = collapsible("Environment", table(envPairs));
   const stackSection = collapsible("Stack Trace", framesHtml, true);
+  const nonce = currentCspNonce();
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Tina4 Error \u2014 ${esc(excType)}</title>
-<style>
-*{margin:0;padding:0;box-sizing:border-box;}
-body{background:${BG};color:${TEXT};font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;padding:24px;line-height:1.5;}
+<style nonce="${nonce}">
+${overlayStylesheet()}
 </style>
 </head>
 <body>
-<div style="max-width:960px;margin:0 auto;">
-  <div style="margin-bottom:24px;">
-    <div style="display:flex;align-items:center;gap:12px;margin-bottom:12px;">
-      <span style="background:${RED};color:${BG};padding:4px 12px;border-radius:4px;font-weight:700;font-size:13px;text-transform:uppercase;">Error</span>
-      <span style="color:${SUBTEXT};font-size:14px;">Tina4 Debug Overlay</span>
+<div class="eo-wrap">
+  <div class="eo-header">
+    <div class="eo-badge-row">
+      <span class="eo-badge">Error</span>
+      <span class="eo-sub">Tina4 Debug Overlay</span>
     </div>
-    <h1 style="color:${RED};font-size:28px;font-weight:700;margin-bottom:8px;">${esc(excType)}</h1>
-    <p style="color:${TEXT};font-size:18px;font-family:'SF Mono','Fira Code','Consolas',monospace;background:${SURFACE};padding:12px 16px;border-radius:6px;border-left:4px solid ${RED};">${esc(excMsg)}</p>
+    <h1 class="eo-type">${esc(excType)}</h1>
+    <p class="eo-msg">${esc(excMsg)}</p>
   </div>
   ${stackSection}
   ${requestSection}
   ${envSection}
-  <div style="margin-top:32px;padding-top:16px;border-top:1px solid ${OVERLAY};color:${SUBTEXT};font-size:12px;">
+  <div class="eo-footer">
     Tina4 Debug Overlay &mdash; This page is only shown in debug mode. Set TINA4_DEBUG=false in production.
   </div>
 </div>
 </body>
 </html>`;
 }
+function overlayStylesheet() {
+  return `
+*{margin:0;padding:0;box-sizing:border-box;}
+body{background:${BG};color:${TEXT};font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;padding:24px;line-height:1.5;}
+.eo-wrap{max-width:960px;margin:0 auto;}
+.eo-header{margin-bottom:24px;}
+.eo-badge-row{display:flex;align-items:center;gap:12px;margin-bottom:12px;}
+.eo-badge{background:${RED};color:${BG};padding:4px 12px;border-radius:4px;font-weight:700;font-size:13px;text-transform:uppercase;}
+.eo-sub{color:${SUBTEXT};font-size:14px;}
+.eo-type{color:${RED};font-size:28px;font-weight:700;margin-bottom:8px;}
+.eo-msg{color:${TEXT};font-size:18px;font-family:'SF Mono','Fira Code','Consolas',monospace;background:${SURFACE};padding:12px 16px;border-radius:6px;border-left:4px solid ${RED};}
+.eo-footer{margin-top:32px;padding-top:16px;border-top:1px solid ${OVERLAY};color:${SUBTEXT};font-size:12px;}
+.eo-source{background:${SURFACE};border-radius:6px;padding:12px;overflow-x:auto;font-family:'SF Mono','Fira Code','Consolas',monospace;font-size:13px;line-height:1.6;}
+.eo-line{display:flex;padding:1px 0;}
+.eo-line-err{background:${ERROR_LINE_BG};}
+.eo-ln{color:${YELLOW};min-width:3.5em;text-align:right;padding-right:1em;user-select:none;}
+.eo-marker{color:${RED};width:1.2em;user-select:none;}
+.eo-code{color:${TEXT};white-space:pre-wrap;tab-size:4;}
+.eo-frame{margin-bottom:16px;}
+.eo-frame-head{margin-bottom:4px;}
+.eo-file{color:${BLUE};}
+.eo-sep{color:${SUBTEXT};}
+.eo-lineno{color:${YELLOW};}
+.eo-fn{color:${GREEN};}
+.eo-stale{background:${PEACH};color:${BG};padding:1px 8px;border-radius:3px;font-size:11px;font-weight:700;margin-left:6px;}
+.eo-details{margin-top:16px;}
+.eo-summary{cursor:pointer;color:${LAVENDER};font-weight:600;font-size:15px;padding:8px 0;user-select:none;}
+.eo-details-body{padding:8px 0;}
+.eo-table{border-collapse:collapse;width:100%;}
+.eo-key{color:${PEACH};padding:4px 16px 4px 0;vertical-align:top;white-space:nowrap;}
+.eo-val{color:${TEXT};padding:4px 0;word-break:break-all;}
+.eo-none{color:${SUBTEXT};}
+.eo-hidden-frames{color:${SUBTEXT};padding:8px 0;font-size:13px;}
+`;
+}
 function isDebugMode() {
   return isTruthy(process.env.TINA4_DEBUG);
 }
@@ -24860,6 +25091,7 @@ var init_errorOverlay = __esm({
   "../core/src/errorOverlay.ts"() {
     "use strict";
     init_dotenv();
+    init_csp();
     MAX_FRAMES = 50;
     SENSITIVE_KEY_RE = /password|passwd|secret|token|authorization|cookie|key/i;
     REDACTED2 = "[redacted]";
@@ -25235,6 +25467,25 @@ Generated by DevMailbox.seed() for development purposes.`,
   }
 });
 
+// ../core/src/upstreamResponse.ts
+async function relayUpstreamResponse(res, upstream) {
+  const raw = await upstream.text();
+  const status2 = upstream.status || 200;
+  try {
+    res.json(JSON.parse(raw), status2);
+  } catch {
+    res.raw.writeHead(status2, {
+      "Content-Type": upstream.headers.get("content-type") ?? "text/plain; charset=utf-8"
+    });
+    res.raw.end(raw);
+  }
+}
+var init_upstreamResponse = __esm({
+  "../core/src/upstreamResponse.ts"() {
+    "use strict";
+  }
+});
+
 // ../core/src/metrics.ts
 import * as fs3 from "node:fs";
 import * as path2 from "node:path";
@@ -25450,6 +25701,7 @@ var init_feedback = __esm({
     "use strict";
     init_auth();
     init_devAdmin();
+    init_upstreamResponse();
     RATE_LIMIT_WINDOW_SEC = 3600;
     RATE_LIMIT_MAX = 5;
     _rateLimitHits = /* @__PURE__ */ new Map();
@@ -25496,16 +25748,7 @@ var init_feedback = __esm({
         return;
       }
       clearTimeout(timer);
-      const raw = await upstream.text();
-      const status2 = upstream.status || 200;
-      try {
-        res.json(JSON.parse(raw), status2);
-      } catch {
-        res.raw.writeHead(status2, {
-          "Content-Type": upstream.headers.get("content-type") ?? "text/plain; charset=utf-8"
-        });
-        res.raw.end(raw);
-      }
+      await relayUpstreamResponse(res, upstream);
     };
     __feedbackDirname = dirname8(fileURLToPath3(import.meta.url));
     WIDGET_BUNDLE_PATH = resolve10(__feedbackDirname, "__feedback", "widget.js");
@@ -25555,6 +25798,61 @@ var init_version = __esm({
   }
 });
 
+// src/util.ts
+import { delimiter as delimiter2, join as join21 } from "node:path";
+import { statSync as statSync11 } from "node:fs";
+function parseFlags(args, booleanFlags) {
+  const flags = {};
+  const positional = [];
+  let i = 0;
+  while (i < args.length) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      const key = arg.slice(2);
+      if (booleanFlags?.has(key)) {
+        flags[key] = true;
+        i += 1;
+      } else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
+        flags[key] = args[i + 1];
+        i += 2;
+      } else {
+        flags[key] = true;
+        i += 1;
+      }
+    } else {
+      positional.push(arg);
+      i += 1;
+    }
+  }
+  return { flags, positional };
+}
+function findOnPath(names) {
+  for (const dir of (process.env.PATH ?? "").split(delimiter2)) {
+    if (!dir) continue;
+    for (const name of names) {
+      const candidate = join21(dir, name);
+      try {
+        if (statSync11(candidate).isFile()) return candidate;
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+async function initDatabaseOrExit(initDatabase2) {
+  try {
+    await initDatabase2();
+  } catch (err) {
+    console.error(`  Error initialising database: ${err instanceof Error ? err.message : String(err)}`);
+    process.exit(1);
+  }
+}
+var init_util = __esm({
+  "src/util.ts"() {
+    "use strict";
+  }
+});
+
 // src/commands/generate.ts
 var generate_exports = {};
 __export(generate_exports, {
@@ -25579,7 +25877,7 @@ __export(generate_exports, {
   toTableName: () => toTableName
 });
 import { existsSync as existsSync16, mkdirSync as mkdirSync13, writeFileSync as writeFileSync10 } from "node:fs";
-import { join as join21, relative as relative2, resolve as resolve11, sep as sep5 } from "node:path";
+import { join as join22, relative as relative2, resolve as resolve11, sep as sep5 } from "node:path";
 function ensureDir(dir) {
   if (__resolution.dryRun) return;
   if (!existsSync16(dir)) {
@@ -25819,28 +26117,7 @@ function parseCliArgs(args) {
     "json",
     "dry-run"
   ]);
-  const flags = {};
-  const positional = [];
-  let i = 0;
-  while (i < args.length) {
-    if (args[i].startsWith("--")) {
-      const key = args[i].slice(2);
-      if (booleanFlags.has(key)) {
-        flags[key] = true;
-        i += 1;
-      } else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
-        flags[key] = args[i + 1];
-        i += 2;
-      } else {
-        flags[key] = true;
-        i += 1;
-      }
-    } else {
-      positional.push(args[i]);
-      i += 1;
-    }
-  }
-  return { flags, positional };
+  return parseFlags(args, booleanFlags);
 }
 function parseEvery(every) {
   if (!every || every === true) return 60;
@@ -25939,7 +26216,7 @@ function generateModel(name, flags, emitTest = true) {
   const table2 = resolveTable(name, flags, { announce: true });
   const dir = resolve11("src/models");
   ensureDir(dir);
-  const path10 = join21(dir, `${name}.ts`);
+  const path10 = join22(dir, `${name}.ts`);
   setResolutionField("class_name", name);
   setResolutionField("table_name", table2);
   setResolutionField("file_path", `src/models/${name}.ts`);
@@ -25979,7 +26256,7 @@ function generateRoute(name, flags, emitTest = true) {
   const model = flags.model;
   const isPublic = Boolean(flags.public);
   const base = resolve11("src/routes/api", routePath);
-  const idDir = join21(base, "[id]");
+  const idDir = join22(base, "[id]");
   ensureDir(base);
   ensureDir(idDir);
   pushRoute(`/api/${routePath}`);
@@ -25995,7 +26272,7 @@ function generateRoute(name, flags, emitTest = true) {
   const writeDoc = isPublic ? "Public (--public): no token required." : "Secure by default: requires a Bearer token (use --public to open).";
   if (model) {
     writeFileSafe(
-      join21(base, "get.ts"),
+      join22(base, "get.ts"),
       `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 ${modelImportBase}
 export const meta = { summary: "List all ${routePath}", tags: ["${routePath}"] };
@@ -26012,7 +26289,7 @@ export default async function (req: Tina4Request, res: Tina4Response) {
     );
   } else {
     writeFileSafe(
-      join21(base, "get.ts"),
+      join22(base, "get.ts"),
       `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 
 export const meta = { summary: "List all ${routePath}", tags: ["${routePath}"] };
@@ -26031,7 +26308,7 @@ ${aiFill(`list_${routePath}`, {
   }
   if (model) {
     writeFileSafe(
-      join21(base, "post.ts"),
+      join22(base, "post.ts"),
       `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 ${modelImportBase}${secureOptOut(isPublic)}export const meta = { summary: "Create a new ${singular}", tags: ["${routePath}"] };
 
@@ -26054,7 +26331,7 @@ ${extend(
     );
   } else {
     writeFileSafe(
-      join21(base, "post.ts"),
+      join22(base, "post.ts"),
       `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 
 ${secureOptOut(isPublic)}export const meta = { summary: "Create a new ${singular}", tags: ["${routePath}"] };
@@ -26075,7 +26352,7 @@ ${aiFill(`create_${singular}`, {
   }
   if (model) {
     writeFileSafe(
-      join21(idDir, "get.ts"),
+      join22(idDir, "get.ts"),
       `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 ${modelImportId}
 export const meta = { summary: "Get a ${singular} by ID", tags: ["${routePath}"] };
@@ -26093,7 +26370,7 @@ export default async function (req: Tina4Request, res: Tina4Response) {
     );
   } else {
     writeFileSafe(
-      join21(idDir, "get.ts"),
+      join22(idDir, "get.ts"),
       `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 
 export const meta = { summary: "Get a ${singular} by ID", tags: ["${routePath}"] };
@@ -26112,7 +26389,7 @@ ${aiFill(`get_${singular}`, {
   }
   if (model) {
     writeFileSafe(
-      join21(idDir, "put.ts"),
+      join22(idDir, "put.ts"),
       `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 ${modelImportId}${secureOptOut(isPublic)}export const meta = { summary: "Update a ${singular} by ID", tags: ["${routePath}"] };
 
@@ -26141,7 +26418,7 @@ ${extend(
     );
   } else {
     writeFileSafe(
-      join21(idDir, "put.ts"),
+      join22(idDir, "put.ts"),
       `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 
 ${secureOptOut(isPublic)}export const meta = { summary: "Update a ${singular} by ID", tags: ["${routePath}"] };
@@ -26162,7 +26439,7 @@ ${aiFill(`update_${singular}`, {
   }
   if (model) {
     writeFileSafe(
-      join21(idDir, "delete.ts"),
+      join22(idDir, "delete.ts"),
       `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 ${modelImportId}${secureOptOut(isPublic)}export const meta = { summary: "Delete a ${singular} by ID", tags: ["${routePath}"] };
 
@@ -26181,7 +26458,7 @@ export default async function (req: Tina4Request, res: Tina4Response) {
     );
   } else {
     writeFileSafe(
-      join21(idDir, "delete.ts"),
+      join22(idDir, "delete.ts"),
       `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 
 ${secureOptOut(isPublic)}export const meta = { summary: "Delete a ${singular} by ID", tags: ["${routePath}"] };
@@ -26243,7 +26520,7 @@ function generateMigration(name, flags, fieldsOverride, tableOverride, emitTest
   const fields = fieldsOverride || parseFields(flags.fields || "");
   const isCreate = name.startsWith("create_") || fieldsOverride !== void 0;
   const fileName = `${ts}_${name}.sql`;
-  const path10 = join21(dir, fileName);
+  const path10 = join22(dir, fileName);
   setResolutionField("migration_path", `migrations/${fileName}`);
   if (__resolution.target === "migration") {
     setResolutionField("file_path", `migrations/${fileName}`);
@@ -26282,7 +26559,7 @@ ${upSql}
 ${downSql}
 `;
   writeFileSafe(path10, content);
-  const downPath = join21(dir, `${ts}_${name}.down.sql`);
+  const downPath = join22(dir, `${ts}_${name}.down.sql`);
   const downContent = `-- Rollback: ${name}
 -- Created: ${now}
 
@@ -26295,7 +26572,7 @@ function generateMiddleware(name, _flags) {
   const snake = toSnake(name);
   const dir = resolve11("src/middleware");
   ensureDir(dir);
-  const path10 = join21(dir, `${snake}.ts`);
+  const path10 = join22(dir, `${snake}.ts`);
   if (__resolution.target === "middleware") {
     setResolutionField("class_name", name);
     setResolutionField("file_path", `src/middleware/${snake}.ts`);
@@ -26342,7 +26619,7 @@ function generateTest(name, flags) {
   const model = flags.model;
   const dir = resolve11("tests");
   ensureDir(dir);
-  const path10 = join21(dir, `${snake}.test.ts`);
+  const path10 = join22(dir, `${snake}.test.ts`);
   if (model && flags["secure-writes"]) {
     const isPublic = Boolean(flags.public);
     const posture = isPublic ? "open (--public)" : "gated";
@@ -26480,7 +26757,7 @@ function generateForm(name, flags) {
   };
   const dir = resolve11("src/templates/forms");
   ensureDir(dir);
-  const path10 = join21(dir, `${table2}.twig`);
+  const path10 = join22(dir, `${table2}.twig`);
   let fieldHtml = "";
   for (const [fname, ftype] of fields) {
     const itype = inputTypes[ftype] || "text";
@@ -26533,7 +26810,7 @@ function generateView(name, flags) {
   const cols = fields.map(([f]) => f);
   const dir = resolve11("src/templates/pages");
   ensureDir(dir);
-  const listPath = join21(dir, `${routeName}.twig`);
+  const listPath = join22(dir, `${routeName}.twig`);
   const th = cols.map((c) => `                <th>${c.replace(/_/g, " ").replace(/\b\w/g, (ch) => ch.toUpperCase())}</th>`).join("\n");
   const td = cols.map((c) => `                <td>{{ item.${c} }}</td>`).join("\n");
   const listContent = `{% extends "base.twig" %}
@@ -26570,7 +26847,7 @@ ${td}
 {% endblock %}
 `;
   writeFileSafe(listPath, listContent);
-  const detailPath = join21(dir, `${table2}.twig`);
+  const detailPath = join22(dir, `${table2}.twig`);
   const detailFields = cols.map((c) => `    <div class="mb-3"><strong>${c.replace(/_/g, " ").replace(/\b\w/g, (ch) => ch.toUpperCase())}:</strong> {{ item.${c} }}</div>`).join("\n");
   const detailContent = `{% extends "base.twig" %}
 {% block title %}${name} Detail{% endblock %}
@@ -26600,7 +26877,7 @@ function generateAuth(_flags) {
   ensureDir(loginDir);
   ensureDir(meDir);
   writeFileSafe(
-    join21(registerDir, "post.ts"),
+    join22(registerDir, "post.ts"),
     `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 import { hashPassword } from "tina4-nodejs";
 import User from "../../../../models/User.js";
@@ -26632,7 +26909,7 @@ export default async function (req: Tina4Request, res: Tina4Response) {
 `
   );
   writeFileSafe(
-    join21(loginDir, "post.ts"),
+    join22(loginDir, "post.ts"),
     `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 import { checkPassword, getToken } from "tina4-nodejs";
 import User from "../../../../models/User.js";
@@ -26665,7 +26942,7 @@ export default async function (req: Tina4Request, res: Tina4Response) {
 `
   );
   writeFileSafe(
-    join21(meDir, "get.ts"),
+    join22(meDir, "get.ts"),
     `import type { Tina4Request, Tina4Response } from "tina4-nodejs";
 import { authenticateRequest } from "tina4-nodejs";
 
@@ -26684,11 +26961,15 @@ export default async function (req: Tina4Request, res: Tina4Response) {
   const formsDir = resolve11("src/templates/forms");
   ensureDir(formsDir);
   writeFileSafe(
-    join21(formsDir, "login.twig"),
+    join22(formsDir, "login.twig"),
     `{% extends "base.twig" %}
 {% block title %}Login{% endblock %}
 {% block content %}
-<div class="container mt-4" style="max-width:400px">
+{# No inline style attribute: a nonce lets this <style> block run under the
+   strict default Content-Security-Policy. csp_nonce() is a built-in Frond global
+   that returns this response's nonce (ADR-0088). #}
+<style nonce="{{ csp_nonce() }}">.auth-form{max-width:400px;margin:0 auto}</style>
+<div class="container mt-4 auth-form">
     <h1>Login</h1>
     <form method="post" action="/api/auth/login">
         {{ form_token() }}
@@ -26708,11 +26989,12 @@ export default async function (req: Tina4Request, res: Tina4Response) {
 `
   );
   writeFileSafe(
-    join21(formsDir, "register.twig"),
+    join22(formsDir, "register.twig"),
     `{% extends "base.twig" %}
 {% block title %}Register{% endblock %}
 {% block content %}
-<div class="container mt-4" style="max-width:400px">
+<style nonce="{{ csp_nonce() }}">.auth-form{max-width:400px;margin:0 auto}</style>
+<div class="container mt-4 auth-form">
     <h1>Register</h1>
     <form method="post" action="/api/auth/register">
         {{ form_token() }}
@@ -26746,7 +27028,7 @@ function generateService(name, flags) {
   const cron = flags.cron;
   const dir = resolve11("src/services");
   ensureDir(dir);
-  const path10 = join21(dir, `${snake}.ts`);
+  const path10 = join22(dir, `${snake}.ts`);
   let scheduleField;
   let note;
   if (cron && cron !== true) {
@@ -26798,7 +27080,7 @@ function generateQueue(name, _flags) {
   const pascal = toPascal(topic) || "Topic";
   const dir = resolve11("src/services");
   ensureDir(dir);
-  const path10 = join21(dir, `${slug}_consumer.ts`);
+  const path10 = join22(dir, `${slug}_consumer.ts`);
   const body = aiFill(`handle${pascal}`, {
     intent: `process ONE ${topic} job payload`,
     given: "payload -> the produced job data (job.payload)",
@@ -26859,7 +27141,7 @@ export default {
 function generateValidator(name, _flags) {
   const dir = resolve11("src/validators");
   ensureDir(dir);
-  const path10 = join21(dir, `${toSnake(name)}.ts`);
+  const path10 = join22(dir, `${toSnake(name)}.ts`);
   const rules = extend(
     "add / adjust the validation rules for this payload",
     `e.g. .email("email").minLength("name", 2).integer("age"); ground: tina4_context("validate request body with Validator", "nodejs")`
@@ -26887,7 +27169,7 @@ function generateSeeder(name, flags) {
   const table2 = resolveTable(name, flags, { announce: false });
   const dir = resolve11("src/seeds");
   ensureDir(dir);
-  const path10 = join21(dir, `${table2}_seeder.ts`);
+  const path10 = join22(dir, `${table2}_seeder.ts`);
   const overrides = extend(
     "override fields that need a specific shape (seedOrm auto-fills the rest)",
     `e.g. return { email: (f) => f.email(), status: "active" }; ground: tina4_context("seed ORM model with FakeData", "nodejs")`
@@ -26932,7 +27214,7 @@ function generateWebsocket(name, _flags) {
   const handlerName = `${toCamel(toPascal(base))}Ws`;
   const dir = resolve11("src/routes");
   ensureDir(dir);
-  const path10 = join21(dir, `ws_${base}.ts`);
+  const path10 = join22(dir, `ws_${base}.ts`);
   const body = aiFill(handlerName, {
     intent: `handle an inbound "message" frame on ${wsPath}`,
     given: "data -> the message payload (string); connection -> WebSocketConnection",
@@ -26983,7 +27265,7 @@ function generateListener(name, _flags) {
   const handlerName = `on${toPascal(slug)}`;
   const dir = resolve11("src/listeners");
   ensureDir(dir);
-  const path10 = join21(dir, `${slug}.ts`);
+  const path10 = join22(dir, `${slug}.ts`);
   const body = aiFill(handlerName, {
     intent: `react to the '${event}' event`,
     given: `args -> whatever Events.emit("${event}", ...args) passed`,
@@ -27015,7 +27297,7 @@ Events.on("${event}", ${handlerName});
 function writeTest(testName, content) {
   const dir = resolve11("tests");
   ensureDir(dir);
-  writeFileSafe(join21(dir, `${testName}.test.ts`), content);
+  writeFileSafe(join22(dir, `${testName}.test.ts`), content);
 }
 function standaloneTest(doc, body) {
   return `${doc}
@@ -27401,6 +27683,7 @@ var FIELD_TYPE_MAP, SQL_RESERVED_TABLE_NAMES, RESOLUTION_ENVELOPE_VERSION, __res
 var init_generate = __esm({
   "src/commands/generate.ts"() {
     "use strict";
+    init_util();
     FIELD_TYPE_MAP = {
       string: { orm: '"string"', sql: "VARCHAR(255)", defaultVal: "''" },
       str: { orm: '"string"', sql: "VARCHAR(255)", defaultVal: "''" },
@@ -27648,7 +27931,7 @@ import * as path3 from "node:path";
 import * as os from "node:os";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createRequire as createRequire8 } from "node:module";
-import { randomBytes as randomBytes6 } from "node:crypto";
+import { randomBytes as randomBytes7 } from "node:crypto";
 function reqSibling(pkg) {
   return req(`../../${pkg}/src/index.ts`);
 }
@@ -28970,7 +29253,7 @@ var init_mcp = __esm({
       // ── Session lifecycle + protocol negotiation ──────────────────
       /** Mint a new session id and remember it. Called on `initialize`. */
       openSession() {
-        const sid = randomBytes6(16).toString("hex");
+        const sid = randomBytes7(16).toString("hex");
         this._sessions.set(sid, Date.now());
         return sid;
       }
@@ -30459,7 +30742,7 @@ __export(context_exports, {
 });
 import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 import { existsSync as existsSync18, mkdirSync as mkdirSync15, readFileSync as readFileSync15, readdirSync as readdirSync10, realpathSync as realpathSync5 } from "node:fs";
-import { basename as basename5, dirname as dirname11, extname as extname5, isAbsolute as isAbsolute6, join as join23, relative as relative4, resolve as resolve13 } from "node:path";
+import { basename as basename5, dirname as dirname11, extname as extname5, isAbsolute as isAbsolute6, join as join24, relative as relative4, resolve as resolve13 } from "node:path";
 function fts5Supported() {
   try {
     const conn = new DatabaseSync4(":memory:");
@@ -30482,13 +30765,13 @@ function realResolve(abs) {
   } catch {
   }
   try {
-    return join23(realpathSync5(dirname11(abs)), basename5(abs));
+    return join24(realpathSync5(dirname11(abs)), basename5(abs));
   } catch {
     return abs;
   }
 }
 function dbKey(db) {
-  return resolve13(db ? String(db) : join23(process.cwd(), ".tina4", "context.db"));
+  return resolve13(db ? String(db) : join24(process.cwd(), ".tina4", "context.db"));
 }
 function defaultContext(root, db) {
   const key = dbKey(db);
@@ -30661,11 +30944,11 @@ var init_context = __esm({
           files.sort();
           for (const fn of files) {
             if (!_Context.eligible(fn)) continue;
-            const full = join23(dir, fn);
+            const full = join24(dir, fn);
             const rel = relative4(rootAbs, full);
             total += this.indexPath(full, rel);
           }
-          for (const d of subdirs) walk2(join23(dir, d));
+          for (const d of subdirs) walk2(join24(dir, d));
         };
         walk2(rootAbs);
         return total;
@@ -30681,7 +30964,7 @@ var init_context = __esm({
       reindexFile(changedPath) {
         if (!this.available || this.root === null) return -1;
         const raw = String(changedPath);
-        const abs = isAbsolute6(raw) ? raw : join23(process.cwd(), raw);
+        const abs = isAbsolute6(raw) ? raw : join24(process.cwd(), raw);
         const resolved = realResolve(resolve13(abs));
         const rel = relative4(this.root, resolved);
         if (rel === "" || rel.startsWith("..") || isAbsolute6(rel)) {
@@ -31019,6 +31302,7 @@ __export(websocket_exports, {
   CLOSE_NORMAL: () => CLOSE_NORMAL,
   CLOSE_POLICY_VIOLATION: () => CLOSE_POLICY_VIOLATION,
   CLOSE_PROTOCOL_ERROR: () => CLOSE_PROTOCOL_ERROR,
+  MessageAssembler: () => MessageAssembler,
   OP_BINARY: () => OP_BINARY,
   OP_CLOSE: () => OP_CLOSE,
   OP_CONTINUATION: () => OP_CONTINUATION,
@@ -31276,21 +31560,24 @@ function serveWebSocketRoute(req2, socket, head) {
     state.closed = true;
     void Promise.resolve().then(() => conn._onClose ? conn._onClose() : handler(conn, "close", "")).catch((e) => Log.error(`WebSocket close handler error: ${e.message}`)).finally(() => wsRouteManager.remove(conn.id));
   };
+  const assembler = new MessageAssembler();
   socket.on("data", (chunk) => {
     buffer = Buffer.concat([buffer, chunk]);
     while (buffer.length > 0) {
       const frame = parseFrame(buffer);
       if (!frame) break;
       buffer = buffer.subarray(frame.bytesConsumed);
-      switch (frame.opcode) {
+      const whole = assembler.push(frame);
+      if (!whole) continue;
+      switch (whole.opcode) {
         case OP_TEXT: {
-          const text = frame.payload.toString("utf-8");
+          const text = whole.payload.toString("utf-8");
           void Promise.resolve().then(() => conn._onMessage ? conn._onMessage(text) : handler(conn, "message", text)).catch((e) => Log.error(`WebSocket message handler error: ${e.message}`));
           break;
         }
         case OP_PING:
           try {
-            socket.write(buildFrame(OP_PONG, frame.payload));
+            socket.write(buildFrame(OP_PONG, whole.payload));
           } catch {
           }
           break;
@@ -31309,7 +31596,7 @@ function serveWebSocketRoute(req2, socket, head) {
   socket.on("error", fireClose);
   return true;
 }
-var MAGIC_STRING, OP_CONTINUATION, OP_TEXT, OP_BINARY, OP_CLOSE, OP_PING, OP_PONG, CLOSE_NORMAL, CLOSE_GOING_AWAY, CLOSE_PROTOCOL_ERROR, CLOSE_POLICY_VIOLATION, WebSocketServer, WsRouteManager, wsRouteManager, DevReloadWsManager, devReloadWs;
+var MAGIC_STRING, OP_CONTINUATION, OP_TEXT, OP_BINARY, OP_CLOSE, OP_PING, OP_PONG, CLOSE_NORMAL, CLOSE_GOING_AWAY, CLOSE_PROTOCOL_ERROR, CLOSE_POLICY_VIOLATION, MessageAssembler, WebSocketServer, WsRouteManager, wsRouteManager, DevReloadWsManager, devReloadWs;
 var init_websocket = __esm({
   "../core/src/websocket.ts"() {
     "use strict";
@@ -31328,6 +31615,30 @@ var init_websocket = __esm({
     CLOSE_GOING_AWAY = 1001;
     CLOSE_PROTOCOL_ERROR = 1002;
     CLOSE_POLICY_VIOLATION = 1008;
+    MessageAssembler = class {
+      parts = [];
+      opcode = 0;
+      push(frame) {
+        if (frame.opcode >= 8) return { opcode: frame.opcode, payload: frame.payload };
+        if (frame.opcode === OP_CONTINUATION) {
+          if (!this.opcode) return null;
+          this.parts.push(frame.payload);
+          if (!frame.fin) return null;
+          const whole = { opcode: this.opcode, payload: Buffer.concat(this.parts) };
+          this.parts = [];
+          this.opcode = 0;
+          return whole;
+        }
+        if (frame.fin) {
+          this.parts = [];
+          this.opcode = 0;
+          return { opcode: frame.opcode, payload: frame.payload };
+        }
+        this.opcode = frame.opcode;
+        this.parts = [frame.payload];
+        return null;
+      }
+    };
     WebSocketServer = class {
       port;
       server = null;
@@ -31770,6 +32081,15 @@ var init_websocket = __esm({
           this.emit("error", err, client);
         });
       }
+      assemblers = /* @__PURE__ */ new WeakMap();
+      assemblerFor(client) {
+        let a = this.assemblers.get(client);
+        if (!a) {
+          a = new MessageAssembler();
+          this.assemblers.set(client, a);
+        }
+        return a;
+      }
       processBuffer(client, buffer, setBuffer) {
         let remaining = buffer;
         while (remaining.length > 0) {
@@ -31777,15 +32097,17 @@ var init_websocket = __esm({
           if (!frame) break;
           remaining = remaining.subarray(frame.bytesConsumed);
           client.lastActivity = Date.now();
-          switch (frame.opcode) {
+          const whole = this.assemblerFor(client).push(frame);
+          if (!whole) continue;
+          switch (whole.opcode) {
             case OP_TEXT:
-              this.emit("message", client, frame.payload.toString("utf-8"));
+              this.emit("message", client, whole.payload.toString("utf-8"));
               break;
             case OP_BINARY:
-              this.emit("message", client, frame.payload);
+              this.emit("message", client, whole.payload);
               break;
             case OP_PING: {
-              const pongFrame = buildFrame(OP_PONG, frame.payload);
+              const pongFrame = buildFrame(OP_PONG, whole.payload);
               try {
                 client.socket.write(pongFrame);
               } catch {
@@ -32704,7 +33026,7 @@ var init_job = __esm({
 
 // ../core/src/queueBackends/liteBackend.ts
 import { mkdirSync as mkdirSync16, readdirSync as readdirSync11, readFileSync as readFileSync16, writeFileSync as writeFileSync12, unlinkSync as unlinkSync7, existsSync as existsSync19 } from "node:fs";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 import { randomUUID as randomUUID6 } from "node:crypto";
 var LiteBackend;
 var init_liteBackend = __esm({
@@ -32728,22 +33050,22 @@ var init_liteBackend = __esm({
         this.visibilityTimeout = visibilityTimeout;
       }
       ensureDir(queue) {
-        const dir = join24(this.basePath, queue);
+        const dir = join25(this.basePath, queue);
         mkdirSync16(dir, { recursive: true });
         return dir;
       }
       ensureFailedDir(queue) {
-        const dir = join24(this.basePath, queue, "failed");
+        const dir = join25(this.basePath, queue, "failed");
         mkdirSync16(dir, { recursive: true });
         return dir;
       }
       ensureReservedDir(queue) {
-        const dir = join24(this.basePath, queue, "reserved");
+        const dir = join25(this.basePath, queue, "reserved");
         mkdirSync16(dir, { recursive: true });
         return dir;
       }
       reservedPath(queue, jobId) {
-        return join24(this.ensureReservedDir(queue), `${jobId}.queue-data`);
+        return join25(this.ensureReservedDir(queue), `${jobId}.queue-data`);
       }
       nowIso() {
         return (/* @__PURE__ */ new Date()).toISOString();
@@ -32781,7 +33103,7 @@ var init_liteBackend = __esm({
           error: void 0
         };
         const prefix = this.nextPrefix();
-        writeFileSync12(join24(dir, `${prefix}_${id}.queue-data`), JSON.stringify(job, null, 2));
+        writeFileSync12(join25(dir, `${prefix}_${id}.queue-data`), JSON.stringify(job, null, 2));
         return id;
       }
       /**
@@ -32800,7 +33122,7 @@ var init_liteBackend = __esm({
         }
         const candidates = [];
         for (const filename of filenames) {
-          const filePath = join24(dir, filename);
+          const filePath = join25(dir, filename);
           let job;
           try {
             job = JSON.parse(readFileSync16(filePath, "utf-8"));
@@ -32864,7 +33186,7 @@ var init_liteBackend = __esm({
           return;
         }
         for (const filename of filenames) {
-          const filePath = join24(reservedDir, filename);
+          const filePath = join25(reservedDir, filename);
           let record;
           try {
             record = JSON.parse(readFileSync16(filePath, "utf-8"));
@@ -32902,7 +33224,7 @@ var init_liteBackend = __esm({
         this.reclaimExpired(queue, bridge.getMaxRetries(), this.nowIso());
         const now = this.nowIso();
         for (const [filename, job] of this.availableCandidates(queue, now)) {
-          const filePath = join24(dir, filename);
+          const filePath = join25(dir, filename);
           job.topic = queue;
           job.priority = job.priority ?? 0;
           this.writeReserved(queue, job);
@@ -32927,7 +33249,7 @@ var init_liteBackend = __esm({
         const results = [];
         for (const [filename, job] of this.availableCandidates(queue, now)) {
           if (results.length >= count) break;
-          const filePath = join24(dir, filename);
+          const filePath = join25(dir, filename);
           job.topic = queue;
           job.priority = job.priority ?? 0;
           this.writeReserved(queue, job);
@@ -32980,7 +33302,7 @@ var init_liteBackend = __esm({
         let count = 0;
         for (const file of files) {
           try {
-            const job = JSON.parse(readFileSync16(join24(scanDir, file), "utf-8"));
+            const job = JSON.parse(readFileSync16(join25(scanDir, file), "utf-8"));
             if (job.status === status2) count++;
           } catch {
           }
@@ -32993,28 +33315,28 @@ var init_liteBackend = __esm({
         try {
           const files = readdirSync11(dir).filter((f) => f.endsWith(".queue-data"));
           for (const file of files) {
-            unlinkSync7(join24(dir, file));
+            unlinkSync7(join25(dir, file));
             count++;
           }
         } catch {
         }
-        const failedDir = join24(dir, "failed");
+        const failedDir = join25(dir, "failed");
         try {
           if (existsSync19(failedDir)) {
             const files = readdirSync11(failedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
-              unlinkSync7(join24(failedDir, file));
+              unlinkSync7(join25(failedDir, file));
               count++;
             }
           }
         } catch {
         }
-        const reservedDir = join24(dir, "reserved");
+        const reservedDir = join25(dir, "reserved");
         try {
           if (existsSync19(reservedDir)) {
             const files = readdirSync11(reservedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
-              unlinkSync7(join24(reservedDir, file));
+              unlinkSync7(join25(reservedDir, file));
               count++;
             }
           }
@@ -33037,7 +33359,7 @@ var init_liteBackend = __esm({
           const files = readdirSync11(dir).filter((f) => f.endsWith(".queue-data")).sort();
           for (const file of files) {
             try {
-              const job = JSON.parse(readFileSync16(join24(dir, file), "utf-8"));
+              const job = JSON.parse(readFileSync16(join25(dir, file), "utf-8"));
               const attempts = job.attempts || 0;
               if (attempts > 0 && attempts < maxRetries) {
                 results.push(job);
@@ -33060,8 +33382,8 @@ var init_liteBackend = __esm({
         try {
           const queues = readdirSync11(this.basePath);
           for (const q of queues) {
-            const failedDir = join24(this.basePath, q, "failed");
-            const filePath = join24(failedDir, `${jobId}.queue-data`);
+            const failedDir = join25(this.basePath, q, "failed");
+            const filePath = join25(failedDir, `${jobId}.queue-data`);
             if (existsSync19(filePath)) {
               const job = JSON.parse(readFileSync16(filePath, "utf-8"));
               job.status = "pending";
@@ -33070,8 +33392,8 @@ var init_liteBackend = __esm({
               job.createdAt = (/* @__PURE__ */ new Date()).toISOString();
               job.delayUntil = delaySeconds ? new Date(Date.now() + delaySeconds * 1e3).toISOString() : null;
               const prefix = this.nextPrefix();
-              const queueDir = join24(this.basePath, q);
-              writeFileSync12(join24(queueDir, `${prefix}_${jobId}.queue-data`), JSON.stringify(job, null, 2));
+              const queueDir = join25(this.basePath, q);
+              writeFileSync12(join25(queueDir, `${prefix}_${jobId}.queue-data`), JSON.stringify(job, null, 2));
               unlinkSync7(filePath);
               return true;
             }
@@ -33087,7 +33409,7 @@ var init_liteBackend = __esm({
           const files = readdirSync11(failedDir).filter((f) => f.endsWith(".queue-data")).sort();
           for (const file of files) {
             try {
-              const job = JSON.parse(readFileSync16(join24(failedDir, file), "utf-8"));
+              const job = JSON.parse(readFileSync16(join25(failedDir, file), "utf-8"));
               if ((job.attempts || 0) >= maxRetries) {
                 job.status = "dead";
                 results.push(job);
@@ -33108,7 +33430,7 @@ var init_liteBackend = __esm({
             const files = readdirSync11(failedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
               try {
-                unlinkSync7(join24(failedDir, file));
+                unlinkSync7(join25(failedDir, file));
                 count++;
               } catch {
               }
@@ -33121,9 +33443,9 @@ var init_liteBackend = __esm({
             const files = readdirSync11(dir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
               try {
-                const job = JSON.parse(readFileSync16(join24(dir, file), "utf-8"));
+                const job = JSON.parse(readFileSync16(join25(dir, file), "utf-8"));
                 if (job.status === status2) {
-                  unlinkSync7(join24(dir, file));
+                  unlinkSync7(join25(dir, file));
                   count++;
                 }
               } catch {
@@ -33147,7 +33469,7 @@ var init_liteBackend = __esm({
           const files = readdirSync11(failedDir).filter((f) => f.endsWith(".queue-data"));
           for (const file of files) {
             try {
-              const filePath = join24(failedDir, file);
+              const filePath = join25(failedDir, file);
               const job = JSON.parse(readFileSync16(filePath, "utf-8"));
               if ((job.attempts || 0) >= maxRetries) {
                 continue;
@@ -33157,7 +33479,7 @@ var init_liteBackend = __esm({
               job.createdAt = (/* @__PURE__ */ new Date()).toISOString();
               job.delayUntil = null;
               const prefix = this.nextPrefix();
-              writeFileSync12(join24(queueDir, `${prefix}_${job.id}.queue-data`), JSON.stringify(job, null, 2));
+              writeFileSync12(join25(queueDir, `${prefix}_${job.id}.queue-data`), JSON.stringify(job, null, 2));
               unlinkSync7(filePath);
               count++;
             } catch {
@@ -33177,7 +33499,7 @@ var init_liteBackend = __esm({
         }
         for (const file of files) {
           if (!file.includes(id)) continue;
-          const filePath = join24(dir, file);
+          const filePath = join25(dir, file);
           let job;
           try {
             job = JSON.parse(readFileSync16(filePath, "utf-8"));
@@ -33225,7 +33547,7 @@ var init_liteBackend = __esm({
           error: error2
         };
         const prefix = this.nextPrefix();
-        writeFileSync12(join24(dir, `${prefix}_${job.id}.queue-data`), JSON.stringify(jobData, null, 2));
+        writeFileSync12(join25(dir, `${prefix}_${job.id}.queue-data`), JSON.stringify(jobData, null, 2));
       }
       /**
        * Move the job to the dead-letter (failed/) directory. Terminal until a
@@ -33245,7 +33567,7 @@ var init_liteBackend = __esm({
           error: error2,
           failedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
-        writeFileSync12(join24(failedDir, `${job.id}.queue-data`), JSON.stringify(jobData, null, 2));
+        writeFileSync12(join25(failedDir, `${job.id}.queue-data`), JSON.stringify(jobData, null, 2));
       }
       /**
        * Record a failed attempt.
@@ -33295,7 +33617,7 @@ var init_liteBackend = __esm({
       retryJob(queue, job, delaySeconds) {
         this.clearReservation(queue, job.id);
         try {
-          unlinkSync7(join24(this.ensureFailedDir(queue), `${job.id}.queue-data`));
+          unlinkSync7(join25(this.ensureFailedDir(queue), `${job.id}.queue-data`));
         } catch {
         }
         job.attempts = (job.attempts || 0) + 1;
@@ -35915,8 +36237,8 @@ ${end}
 
 // ../core/src/devAdmin.ts
 import { cpus as osCpus } from "node:os";
-import { readFileSync as readFileSync20, writeFileSync as writeFileSync16, existsSync as existsSync23, readdirSync as readdirSync15, mkdirSync as mkdirSync19, copyFileSync as copyFileSync2, statSync as statSync17, openSync as openSync4, closeSync as closeSync4, fstatSync as fstatSync2, fchmodSync as fchmodSync2, ftruncateSync, constants as constants3, realpathSync as realpathSync6, lstatSync } from "node:fs";
-import { join as join28, dirname as dirname13, resolve as resolve17, relative as relative9, sep as sep8, basename as basename6 } from "node:path";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync16, existsSync as existsSync23, readdirSync as readdirSync15, mkdirSync as mkdirSync19, copyFileSync as copyFileSync2, statSync as statSync18, openSync as openSync4, closeSync as closeSync4, fstatSync as fstatSync2, fchmodSync as fchmodSync2, ftruncateSync, constants as constants3, realpathSync as realpathSync6, lstatSync } from "node:fs";
+import { join as join29, dirname as dirname13, resolve as resolve17, relative as relative9, sep as sep8, basename as basename6 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 function escapeHtml(value) {
@@ -36060,7 +36382,7 @@ function readQueueDir(dir, topic, status2) {
   for (const filename of readdirSync15(dir).sort()) {
     if (!filename.endsWith(".queue-data")) continue;
     try {
-      jobs.push(mapQueueJob(JSON.parse(readFileSync20(join28(dir, filename), "utf-8")), topic, status2));
+      jobs.push(mapQueueJob(JSON.parse(readFileSync20(join29(dir, filename), "utf-8")), topic, status2));
     } catch {
     }
   }
@@ -36163,21 +36485,12 @@ async function proxyToSupervisor(req2, res, downstreamPath) {
     return;
   }
   clearTimeout(timer);
-  const raw = await upstream.text();
-  const status2 = upstream.status || 200;
-  try {
-    res.json(JSON.parse(raw), status2);
-  } catch {
-    res.raw.writeHead(status2, {
-      "Content-Type": upstream.headers.get("content-type") ?? "text/plain; charset=utf-8"
-    });
-    res.raw.end(raw);
-  }
+  await relayUpstreamResponse(res, upstream);
 }
 function resolveDevEnvVar(key) {
   const live = process.env[key];
   if (live !== void 0 && live !== "") return live;
-  const envPath = join28(process.cwd(), ".env");
+  const envPath = join29(process.cwd(), ".env");
   if (!existsSync23(envPath)) return "";
   for (const line of readFileSync20(envPath, "utf-8").split("\n")) {
     const t = line.trim();
@@ -36188,7 +36501,7 @@ function resolveDevEnvVar(key) {
   return "";
 }
 function upsertDevEnvVar(key, value) {
-  const envPath = join28(process.cwd(), ".env");
+  const envPath = join29(process.cwd(), ".env");
   const lines = existsSync23(envPath) ? readFileSync20(envPath, "utf-8").split("\n") : [];
   let found = false;
   const out = [];
@@ -36219,7 +36532,7 @@ function formatUptime(seconds) {
   return parts.join(" ");
 }
 function parseEnvFile() {
-  const envPath = join28(process.cwd(), ".env");
+  const envPath = join29(process.cwd(), ".env");
   const result = {};
   if (!existsSync23(envPath)) return result;
   const lines = readFileSync20(envPath, "utf-8").split("\n");
@@ -36235,8 +36548,8 @@ function walkDirRecursive(dir) {
   const results = [];
   if (!existsSync23(dir)) return results;
   for (const entry of readdirSync15(dir)) {
-    const full = join28(dir, entry);
-    if (statSync17(full).isDirectory()) {
+    const full = join29(dir, entry);
+    if (statSync18(full).isDirectory()) {
       results.push(...walkDirRecursive(full));
     } else {
       results.push(full);
@@ -36253,7 +36566,7 @@ function handleGalleryDeploy(router) {
       return;
     }
     const galleryDir = resolve17(__devAdminDirname, "..", "gallery");
-    const gallerySrc = join28(galleryDir, name, "src");
+    const gallerySrc = join29(galleryDir, name, "src");
     if (!existsSync23(gallerySrc)) {
       res.json({ error: `Gallery item '${name}' not found` }, 404);
       return;
@@ -36263,7 +36576,7 @@ function handleGalleryDeploy(router) {
     const allFiles = walkDirRecursive(gallerySrc);
     for (const srcFile of allFiles) {
       const rel = relative9(gallerySrc, srcFile);
-      const dest = join28(projectSrc, rel);
+      const dest = join29(projectSrc, rel);
       mkdirSync19(dirname13(dest), { recursive: true });
       copyFileSync2(srcFile, dest);
       copied.push(rel);
@@ -36299,7 +36612,7 @@ function realPathOf(target) {
     tail.unshift(basename6(existing));
     existing = dirname13(existing);
   }
-  return join28(realpathSync6(existing), ...tail);
+  return join29(realpathSync6(existing), ...tail);
 }
 function safeJoin(projectRoot3, rel, extraRoots = []) {
   try {
@@ -36614,6 +36927,7 @@ var init_devAdmin = __esm({
   "../core/src/devAdmin.ts"() {
     "use strict";
     init_devMailbox();
+    init_upstreamResponse();
     init_dotenv();
     init_metrics();
     init_feedback();
@@ -36715,8 +37029,8 @@ var init_devAdmin = __esm({
        * Duplicate errors (same message) increment count and update last_seen.
        */
       static capture(errorType, message, traceback = "", file = "", line = 0) {
-        const fingerprint = `${errorType}|${message}|${file}|${line}`;
-        const existing = this.errors.find((e) => e.fingerprint === fingerprint);
+        const fingerprint2 = `${errorType}|${message}|${file}|${line}`;
+        const existing = this.errors.find((e) => e.fingerprint === fingerprint2);
         const now = (/* @__PURE__ */ new Date()).toISOString();
         if (existing) {
           existing.count = (existing.count || 1) + 1;
@@ -36729,7 +37043,7 @@ var init_devAdmin = __esm({
             message,
             stack: traceback || void 0,
             resolved: false,
-            ...{ fingerprint, error_type: errorType, file, line, count: 1, first_seen: now, last_seen: now }
+            ...{ fingerprint: fingerprint2, error_type: errorType, file, line, count: 1, first_seen: now, last_seen: now }
           });
           if (this.errors.length > this.maxErrors) {
             this.errors = this.errors.slice(-this.maxErrors);
@@ -36981,7 +37295,7 @@ var init_devAdmin = __esm({
             const p = (url.searchParams.get("path") || "").toString();
             const scanRoot = metricsScanRoot();
             let target = p ? safeJoin(process.cwd(), p, [scanRoot]) : "";
-            if (target === null && scanRoot) target = safeJoin(process.cwd(), join28(scanRoot, p), [scanRoot]);
+            if (target === null && scanRoot) target = safeJoin(process.cwd(), join29(scanRoot, p), [scanRoot]);
             if (target === null) {
               res.status(403).json({ error: "Path outside project" });
               return;
@@ -37296,16 +37610,16 @@ var init_devAdmin = __esm({
           failed: queue.size("failed"),
           reserved: queue.size("reserved")
         };
-        const topicDir = join28(queueBasePath2(), topic);
+        const topicDir = join29(queueBasePath2(), topic);
         const jobs = [];
         if (!statusFilter || statusFilter === "pending") {
           jobs.push(...readQueueDir(topicDir, topic, "pending"));
         }
         if (!statusFilter || statusFilter === "reserved") {
-          jobs.push(...readQueueDir(join28(topicDir, "reserved"), topic, "reserved"));
+          jobs.push(...readQueueDir(join29(topicDir, "reserved"), topic, "reserved"));
         }
         if (!statusFilter || statusFilter === "failed" || statusFilter === "dead") {
-          jobs.push(...readQueueDir(join28(topicDir, "failed"), topic, "dead_letter"));
+          jobs.push(...readQueueDir(join29(topicDir, "failed"), topic, "dead_letter"));
         }
         res.json({ stats, jobs });
       } catch (e) {
@@ -37324,7 +37638,7 @@ var init_devAdmin = __esm({
         if (existsSync23(queueDir)) {
           topics = readdirSync15(queueDir).filter((d) => {
             try {
-              return statSync17(join28(queueDir, d)).isDirectory();
+              return statSync18(join29(queueDir, d)).isDirectory();
             } catch {
               return false;
             }
@@ -37782,7 +38096,7 @@ var init_devAdmin = __esm({
         return;
       }
       try {
-        const envPath = join28(process.cwd(), ".env");
+        const envPath = join29(process.cwd(), ".env");
         const fd = openSync4(envPath, constants3.O_RDWR | constants3.O_APPEND | constants3.O_CREAT | (constants3.O_NOFOLLOW ?? 0) | (constants3.O_NONBLOCK ?? 0), 384);
         try {
           const info = fstatSync2(fd);
@@ -37834,13 +38148,13 @@ var init_devAdmin = __esm({
       if (existsSync23(galleryDir)) {
         const entries = readdirSync15(galleryDir).sort();
         for (const entry of entries) {
-          const entryPath = join28(galleryDir, entry);
-          const metaFile = join28(entryPath, "meta.json");
-          if (statSync17(entryPath).isDirectory() && existsSync23(metaFile)) {
+          const entryPath = join29(galleryDir, entry);
+          const metaFile = join29(entryPath, "meta.json");
+          if (statSync18(entryPath).isDirectory() && existsSync23(metaFile)) {
             try {
               const meta = JSON.parse(readFileSync20(metaFile, "utf-8"));
               meta.id = entry;
-              const srcDir = join28(entryPath, "src");
+              const srcDir = join29(entryPath, "src");
               if (existsSync23(srcDir)) {
                 const allFiles = walkDirRecursive(srcDir);
                 meta.files = allFiles.map((f) => relative9(srcDir, f));
@@ -37848,7 +38162,7 @@ var init_devAdmin = __esm({
               const projectSrc = resolve17(process.cwd(), "src");
               if (existsSync23(srcDir) && meta.files) {
                 meta.deployed = meta.files.every(
-                  (f) => existsSync23(join28(projectSrc, f))
+                  (f) => existsSync23(join29(projectSrc, f))
                 );
               } else {
                 meta.deployed = false;
@@ -37925,7 +38239,7 @@ var init_devAdmin = __esm({
       const root = resolve17(process.cwd());
       const target = safeJoin(root, rel);
       const { branch, gitRoot, status: gitStatus } = await devGitInfo(root);
-      if (!target || !existsSync23(target) || !statSync17(target).isDirectory()) {
+      if (!target || !existsSync23(target) || !statSync18(target).isDirectory()) {
         res.json({ path: rel, branch, entries: [], error: "not a directory" });
         return;
       }
@@ -37938,13 +38252,13 @@ var init_devAdmin = __esm({
       const entries = [];
       for (const name of readdirSync15(target).sort()) {
         if (devFilesHidden(name)) continue;
-        const full = join28(target, name);
+        const full = join29(target, name);
         const entryRel = relative9(root, full).replace(/\\/g, "/");
         if (isSecretPath(entryRel)) continue;
         let isDir = false;
         let size = null;
         try {
-          const st = statSync17(full);
+          const st = statSync18(full);
           isDir = st.isDirectory();
           if (!isDir) size = st.size;
         } catch {
@@ -38489,13 +38803,13 @@ var init_devAdmin = __esm({
     };
     handleDevAdminJs = async (_req, res) => {
       const { readFileSync: readFileSync30, existsSync: existsSync37 } = await import("node:fs");
-      const { dirname: dirname18, join: join40, resolve: resolve29 } = await import("node:path");
+      const { dirname: dirname18, join: join41, resolve: resolve29 } = await import("node:path");
       const { fileURLToPath: fileURLToPath10 } = await import("node:url");
       const dir = dirname18(fileURLToPath10(import.meta.url));
       const candidates = [
-        join40(dir, "..", "public", "js", "tina4-dev-admin.min.js"),
+        join41(dir, "..", "public", "js", "tina4-dev-admin.min.js"),
         // src/../public/js/
-        join40(dir, "..", "..", "public", "js", "tina4-dev-admin.min.js"),
+        join41(dir, "..", "..", "public", "js", "tina4-dev-admin.min.js"),
         // deeper nesting
         resolve29(process.cwd(), "node_modules", "tina4-nodejs", "packages", "core", "public", "js", "tina4-dev-admin.min.js"),
         resolve29(process.cwd(), "public", "js", "tina4-dev-admin.min.js")
@@ -38528,7 +38842,7 @@ var init_devAdmin = __esm({
 
 // ../core/src/i18n.ts
 import { readFileSync as readFileSync21, readdirSync as readdirSync16, existsSync as existsSync24 } from "node:fs";
-import { join as join29, resolve as resolve18 } from "node:path";
+import { join as join30, resolve as resolve18 } from "node:path";
 var I18n;
 var init_i18n = __esm({
   "../core/src/i18n.ts"() {
@@ -38621,7 +38935,7 @@ var init_i18n = __esm({
         if (this._translations.has(locale)) {
           return;
         }
-        const filePath = join29(this._localeDir, `${locale}.json`);
+        const filePath = join30(this._localeDir, `${locale}.json`);
         if (existsSync24(filePath)) {
           try {
             const raw = readFileSync21(filePath, "utf-8");
@@ -38634,7 +38948,7 @@ var init_i18n = __esm({
           }
         }
         for (const ext of [".yml", ".yaml"]) {
-          const yamlPath = join29(this._localeDir, `${locale}${ext}`);
+          const yamlPath = join30(this._localeDir, `${locale}${ext}`);
           if (existsSync24(yamlPath)) {
             try {
               const raw = readFileSync21(yamlPath, "utf-8");
@@ -39408,7 +39722,7 @@ function swaggerEnabled() {
 }
 function createSwaggerRoutes(getSpec) {
   const serveUi = async (_req, res) => {
-    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json", res.cspNonce));
   };
   return [
     {
@@ -39452,13 +39766,13 @@ var SWAGGER_UI_HTML;
 var init_ui = __esm({
   "../swagger/src/ui.ts"() {
     "use strict";
-    SWAGGER_UI_HTML = (specUrl) => `<!DOCTYPE html>
+    SWAGGER_UI_HTML = (specUrl, nonce) => `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
   <title>Tina4 API Documentation</title>
   <link rel="stylesheet" href="${swaggerUiCdn()}/swagger-ui.css">
-  <style>
+  <style nonce="${nonce}">
     body { margin: 0; background: #fafafa; }
     .topbar { display: none !important; }
   </style>
@@ -39466,7 +39780,7 @@ var init_ui = __esm({
 <body>
   <div id="swagger-ui"></div>
   <script src="${swaggerUiCdn()}/swagger-ui-bundle.js"></script>
-  <script>
+  <script nonce="${nonce}">
     SwaggerUIBundle({
       url: "${specUrl}",
       dom_id: '#swagger-ui',
@@ -39506,7 +39820,7 @@ __export(sso_exports, {
   SsoError: () => SsoError,
   liveSessionIdentity: () => liveSessionIdentity
 });
-import { createHash as createHash9, randomBytes as randomBytes7, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { createHash as createHash9, randomBytes as randomBytes8, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 function expiresAt(tokens) {
   const lifetime = Number(tokens.expires_in ?? 0);
   return lifetime > 0 ? Math.floor(Date.now() / 1e3) + lifetime : 0;
@@ -39634,9 +39948,9 @@ var init_sso = __esm({
       async login(requestOrSession, returnTo = "/") {
         const session = this.session(requestOrSession);
         if (!session) throw new SsoError("SSO login requires a Tina4 Session");
-        const state = randomBytes7(32).toString("base64url");
-        const nonce = randomBytes7(32).toString("base64url");
-        const verifier = randomBytes7(64).toString("base64url");
+        const state = randomBytes8(32).toString("base64url");
+        const nonce = randomBytes8(32).toString("base64url");
+        const verifier = randomBytes8(64).toString("base64url");
         const challenge = createHash9("sha256").update(verifier).digest("base64url");
         session.set(_Sso.PENDING_KEY, { state, nonce, verifier, return_to: _Sso.safeReturn(returnTo), created_at: Math.floor(Date.now() / 1e3) });
         const metadata = await this.discover();
@@ -39864,9 +40178,9 @@ var init_docsAutoDiscovery = __esm({
 });
 
 // ../core/src/server.ts
-import { randomBytes as randomBytes8 } from "node:crypto";
-import { resolve as resolve20, dirname as dirname14, join as join31, relative as relative10 } from "node:path";
-import { existsSync as existsSync26, readdirSync as readdirSync17, readFileSync as readFileSync23, statSync as statSync18 } from "node:fs";
+import { randomBytes as randomBytes9 } from "node:crypto";
+import { resolve as resolve20, dirname as dirname14, join as join32, relative as relative10 } from "node:path";
+import { existsSync as existsSync26, readdirSync as readdirSync17, readFileSync as readFileSync23, statSync as statSync19 } from "node:fs";
 import { isatty } from "node:tty";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { execFileSync as execFileSync3, exec } from "node:child_process";
@@ -40044,7 +40358,8 @@ function isDevMode() {
 }
 async function renderErrorPage(code, data, templatesDir) {
   try {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     const templateFile = `errors/${code}.twig`;
     const getCachedFrond = (dir) => {
       let instance = frondCache.get(dir);
@@ -40054,11 +40369,11 @@ async function renderErrorPage(code, data, templatesDir) {
       }
       return instance;
     };
-    const userTemplatePath = join31(templatesDir, templateFile);
+    const userTemplatePath = join32(templatesDir, templateFile);
     if (existsSync26(userTemplatePath)) {
       return getCachedFrond(templatesDir).render(templateFile, data);
     }
-    const builtinTemplatePath = join31(BUILTIN_ERROR_TEMPLATES_DIR, templateFile);
+    const builtinTemplatePath = join32(BUILTIN_ERROR_TEMPLATES_DIR, templateFile);
     if (existsSync26(builtinTemplatePath)) {
       return getCachedFrond(BUILTIN_ERROR_TEMPLATES_DIR).render(templateFile, data);
     }
@@ -40078,8 +40393,8 @@ function walkGalleryFiles(dir) {
   const results = [];
   if (!existsSync26(dir)) return results;
   for (const f of readdirSync17(dir)) {
-    const full = join31(dir, f);
-    if (statSync18(full).isDirectory()) results.push(...walkGalleryFiles(full));
+    const full = join32(dir, f);
+    if (statSync19(full).isDirectory()) results.push(...walkGalleryFiles(full));
     else results.push(full);
   }
   return results;
@@ -40091,14 +40406,14 @@ function getGalleryDeployedState() {
   try {
     const entries = readdirSync17(galleryDir).sort();
     for (const entry of entries) {
-      const entryPath = join31(galleryDir, entry);
-      const metaFile = join31(entryPath, "meta.json");
-      if (statSync18(entryPath).isDirectory() && existsSync26(metaFile)) {
-        const srcDir = join31(entryPath, "src");
+      const entryPath = join32(galleryDir, entry);
+      const metaFile = join32(entryPath, "meta.json");
+      if (statSync19(entryPath).isDirectory() && existsSync26(metaFile)) {
+        const srcDir = join32(entryPath, "src");
         if (existsSync26(srcDir)) {
           const files = walkGalleryFiles(srcDir);
           const projectSrc = resolve20(process.cwd(), "src");
-          state[entry] = files.every((f) => existsSync26(join31(projectSrc, relative10(srcDir, f))));
+          state[entry] = files.every((f) => existsSync26(join32(projectSrc, relative10(srcDir, f))));
         } else {
           state[entry] = false;
         }
@@ -40160,6 +40475,7 @@ function resolveTemplate(pathname, templatesDir) {
 }
 function renderLandingPage(port = 7148) {
   const version = TINA4_VERSION;
+  const nonce = currentCspNonce();
   const galleryItems = [
     { id: "rest-api", icon: "&#128640;", name: "REST API", desc: "A simple JSON API with GET and POST endpoints", accent: "accent-blue", tryUrl: "/api/gallery/hello" },
     { id: "orm", icon: "&#128451;", name: "ORM", desc: "Product model with CRUD endpoints", accent: "accent-green", tryUrl: "/api/gallery/products" },
@@ -40174,7 +40490,7 @@ function renderLandingPage(port = 7148) {
     const isDeployed = deployed[item.id] === true;
     const tryBtn = isDeployed ? `<a href="${item.tryUrl}" class="gbtn gbtn-try" target="_blank">Try It</a>` : "";
     const viewBtn = isDeployed ? `<a href="${item.tryUrl}" class="gbtn gbtn-view" target="_blank">View</a>` : "";
-    const deployBtn = isDeployed ? `<span class="gbtn gbtn-deployed">Deployed</span>` : `<button class="gbtn gbtn-deploy" onclick="deployGallery('${item.id}')">Deploy</button>`;
+    const deployBtn = isDeployed ? `<span class="gbtn gbtn-deployed">Deployed</span>` : `<button class="gbtn gbtn-deploy" data-deploy="${item.id}">Deploy</button>`;
     return `<div class="gallery-card">
             <div class="accent ${item.accent}"></div>
             <div class="icon">${item.icon}</div>
@@ -40189,7 +40505,7 @@ function renderLandingPage(port = 7148) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Tina4NodeJs</title>
-<style>
+<style nonce="${nonce}">
 *{margin:0;padding:0;box-sizing:border-box}
 body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:#0f172a;color:#e2e8f0;min-height:100vh;display:flex;flex-direction:column;align-items:center;position:relative}
 .bg-watermark{position:fixed;bottom:-5%;right:-5%;width:45%;opacity:0.04;pointer-events:none;z-index:0}
@@ -40228,6 +40544,11 @@ h1{font-size:3rem;font-weight:700;margin-bottom:0.25rem;letter-spacing:-1px}
 .gbtn-deployed{background:transparent;border:1px solid #22c55e;color:#22c55e;cursor:default;font-size:0.7rem}
 @keyframes wiggle{0%{transform:rotate(0deg)}15%{transform:rotate(14deg)}30%{transform:rotate(-10deg)}45%{transform:rotate(8deg)}60%{transform:rotate(-4deg)}75%{transform:rotate(2deg)}100%{transform:rotate(0deg)}}
 .star-wiggle{display:inline-block;transform-origin:center}
+.gallery-cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:1rem}
+.tok-comment{color:#64748b}
+.tok-kw{color:#c084fc}
+.tok-str{color:#4ade80}
+.tok-fn{color:#38bdf8}
 </style>
 </head>
 <body>
@@ -40253,23 +40574,23 @@ h1{font-size:3rem;font-weight:700;margin-bottom:0.25rem;letter-spacing:-1px}
 <div class="section">
     <div class="card">
         <h2>Getting Started</h2>
-        <pre class="code-block"><code><span style="color:#64748b">// app.ts</span>
-<span style="color:#c084fc">import</span> { startServer, Router } <span style="color:#c084fc">from</span> <span style="color:#4ade80">"tina4-nodejs"</span>;
+        <pre class="code-block"><code><span class="tok-comment">// app.ts</span>
+<span class="tok-kw">import</span> { startServer, Router } <span class="tok-kw">from</span> <span class="tok-str">"tina4-nodejs"</span>;
 
-Router.get(<span style="color:#4ade80">"/hello"</span>, <span style="color:#c084fc">async</span> (<span style="color:#38bdf8">req</span>, <span style="color:#38bdf8">res</span>) =&gt; {
-    <span style="color:#c084fc">return</span> res.json({ message: <span style="color:#4ade80">"Hello World!"</span> });
+Router.get(<span class="tok-str">"/hello"</span>, <span class="tok-kw">async</span> (<span class="tok-fn">req</span>, <span class="tok-fn">res</span>) =&gt; {
+    <span class="tok-kw">return</span> res.json({ message: <span class="tok-str">"Hello World!"</span> });
 });
 
-startServer({ port: 7148 });  <span style="color:#64748b">// starts on port 7148</span></code></pre>
+startServer({ port: 7148 });  <span class="tok-comment">// starts on port 7148</span></code></pre>
     </div>
 </div>
 <div class="gallery">
     <h2 id="gallery">What You Can Build</h2>
-    <div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:1rem;">
+    <div class="gallery-cards">
         ${galleryCards}
     </div>
 </div>
-<script>
+<script nonce="${nonce}">
 function deployGallery(name) {
     if (!confirm('Deploy the "' + name + '" gallery example into your project? This will copy files into src/.')) return;
     fetch('/__dev/api/gallery/deploy', {
@@ -40304,6 +40625,12 @@ function deployGallery(name) {
     }
     setTimeout(doWiggle,3000);
 })();
+// CSP-clean wiring: no inline onclick handlers \u2014 bind every Deploy button from
+// its data-deploy attribute (a nonce covers script elements, not event-handler
+// attributes).
+document.querySelectorAll('.gbtn-deploy[data-deploy]').forEach(function(btn){
+    btn.addEventListener('click', function(){ deployGallery(btn.dataset.deploy); });
+});
 </script>
 </body>
 </html>`;
@@ -40520,7 +40847,7 @@ async function renderDispatchError(err, req2, res, templatesDir) {
       }
     }
   }
-  const requestId = Log.getRequestId() ?? randomBytes8(4).toString("hex");
+  const requestId = Log.getRequestId() ?? randomBytes9(4).toString("hex");
   if (wantsJson(req2)) {
     const body = negotiatedErrorBody(500, "Internal Server Error", requestId);
     res.raw.writeHead(500, { "Content-Type": "application/json" });
@@ -40591,7 +40918,7 @@ function serveStaticAsset(ctx) {
   return false;
 }
 async function serveNotFound(ctx) {
-  const requestId = Log.getRequestId() ?? randomBytes8(4).toString("hex");
+  const requestId = Log.getRequestId() ?? randomBytes9(4).toString("hex");
   if (wantsJson(ctx.req)) {
     const body = negotiatedErrorBody(404, "Not Found", requestId);
     ctx.res.raw.writeHead(404, httpReason(404), { "Content-Type": "application/json" });
@@ -40614,7 +40941,8 @@ async function buildDispatchContext(router, base) {
   const templatesDir = resolve20(root, "src/templates");
   let frondEngine = null;
   try {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     frondEngine = new Frond2(templatesDir);
   } catch {
   }
@@ -40724,9 +41052,13 @@ async function dispatchInner(ctx, rawReq, rawRes, requestId) {
   }
 }
 async function runDispatch(ctx, rawReq, rawRes) {
-  const requestId = Log.sanitizeRequestId(rawReq.headers["x-request-id"]) ?? randomBytes8(4).toString("hex");
+  const requestId = Log.sanitizeRequestId(rawReq.headers["x-request-id"]) ?? randomBytes9(4).toString("hex");
   if (!rawRes.headersSent) rawRes.setHeader("x-request-id", requestId);
-  return Log.runWithRequestId(requestId, () => dispatchInner(ctx, rawReq, rawRes, requestId));
+  const requestNonce = generateNonce();
+  return Log.runWithRequestId(
+    requestId,
+    () => runWithCspNonce(requestNonce, () => dispatchInner(ctx, rawReq, rawRes, requestId))
+  );
 }
 function loopbackBindHosts(host) {
   const normalized = host.trim().replace(/^\[|\]$/g, "").toLowerCase();
@@ -40853,7 +41185,8 @@ async function startServer(config) {
   let frondEngine = null;
   setDefaultTemplatesDir(templatesDir);
   try {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     frondEngine = new Frond2(templatesDir);
     router.addRoute({
       method: "GET",
@@ -40994,10 +41327,12 @@ async function startServer(config) {
           }
         });
         aiServer.on("error", (err) => {
-          if (err.code === "EADDRINUSE") {
+          if (err?.code === "EADDRINUSE") {
             Log.warning(`Test port ${testPort} in use \u2014 skipping`);
-            aiServer = null;
+          } else {
+            Log.error(`Test port ${testPort} bind failed (${err?.code ?? err}) \u2014 skipping`);
           }
+          aiServer = null;
         });
         aiServer.listen(testPort, host);
       }
@@ -41212,6 +41547,7 @@ var init_server = __esm({
     init_static();
     init_dotenv();
     init_errorOverlay();
+    init_csp();
     init_health();
     init_rateLimiter();
     init_logger();
@@ -41461,7 +41797,7 @@ var init_mqttMessage = __esm({
 // ../core/src/mqtt.ts
 import net2 from "node:net";
 import tls from "node:tls";
-import { randomBytes as randomBytes9 } from "node:crypto";
+import { randomBytes as randomBytes10 } from "node:crypto";
 import { existsSync as existsSync27, readFileSync as readFileSync24 } from "node:fs";
 var MqttError, MqttTimeoutError, CONNECT, CONNACK, PUBLISH, PUBACK, SUBSCRIBE, SUBACK, PINGREQ, PINGRESP, DISCONNECT, PROTOCOL_LEVEL, DEFAULT_PORT, DEFAULT_TLS_PORT, DEFAULT_URL, DEFAULT_KEEPALIVE, SUBSCRIPTION_REFUSED, MAX_REMAINING_LENGTH, QOS2_REFUSED_MESSAGE, CONNACK_RETURN_CODES, Mqtt;
 var init_mqtt = __esm({
@@ -41549,7 +41885,7 @@ var init_mqtt = __esm({
         this.caFile = options.caFile ?? (Env.str("TINA4_MQTT_CA_FILE") || null);
         this.tlsVerify = options.tlsVerify ?? Env.bool("TINA4_MQTT_TLS_VERIFY", true);
         let cid = options.clientId ?? (Env.str("TINA4_MQTT_CLIENT_ID") || null);
-        if (cid === null || cid === "") cid = "tina4-" + randomBytes9(8).toString("hex");
+        if (cid === null || cid === "") cid = "tina4-" + randomBytes10(8).toString("hex");
         this.clientId = cid;
         this.keepalive = options.keepalive ?? Env.int("TINA4_MQTT_KEEPALIVE", DEFAULT_KEEPALIVE);
         this.cleanSession = options.cleanSession ?? true;
@@ -42147,8 +42483,8 @@ var init_mqtt = __esm({
 });
 
 // ../core/src/service.ts
-import { readdirSync as readdirSync18, statSync as statSync19, watchFile, unwatchFile } from "node:fs";
-import { join as join32, extname as extname8 } from "node:path";
+import { readdirSync as readdirSync18, statSync as statSync20, watchFile, unwatchFile } from "node:fs";
+import { join as join33, extname as extname8 } from "node:path";
 import { pathToFileURL } from "node:url";
 function matchCronField(field, value) {
   if (field === "*") return true;
@@ -42322,8 +42658,8 @@ var init_service = __esm({
         for (const entry of entries) {
           const ext = extname8(entry);
           if (ext !== ".ts" && ext !== ".js") continue;
-          const fullPath = join32(dir, entry);
-          const stat = statSync19(fullPath);
+          const fullPath = join33(dir, entry);
+          const stat = statSync20(fullPath);
           if (!stat.isFile()) continue;
           try {
             const fileUrl = pathToFileURL(fullPath).href;
@@ -42449,7 +42785,7 @@ var init_service = __esm({
         for (const entry of entries) {
           const ext = extname8(entry);
           if (ext !== ".ts" && ext !== ".js") continue;
-          const fullPath = join32(dir, entry);
+          const fullPath = join33(dir, entry);
           if (watchedFiles.has(fullPath)) continue;
           watchedFiles.add(fullPath);
           watchFile(fullPath, { interval: 1e3 }, async () => {
@@ -42663,7 +42999,7 @@ var init_ssrf = __esm({
 import http from "node:http";
 import https from "node:https";
 import { URL as URL2 } from "node:url";
-import { randomBytes as randomBytes10 } from "node:crypto";
+import { randomBytes as randomBytes11 } from "node:crypto";
 import { promises as fsp, createWriteStream } from "node:fs";
 import { basename as basename7 } from "node:path";
 import { pipeline } from "node:stream/promises";
@@ -42709,23 +43045,23 @@ function guessContentType(filename) {
 }
 function buildMultipartBody(boundary, fieldName, filename, fileContent, contentType, extraFields) {
   const crlf = "\r\n";
-  const delimiter5 = `--${boundary}`;
+  const delimiter4 = `--${boundary}`;
   const parts = [];
   if (extraFields) {
     for (const [key, value] of Object.entries(extraFields)) {
-      parts.push(Buffer.from(delimiter5 + crlf, "utf-8"));
+      parts.push(Buffer.from(delimiter4 + crlf, "utf-8"));
       parts.push(Buffer.from(`Content-Disposition: form-data; name="${key}"` + crlf + crlf, "utf-8"));
       parts.push(Buffer.from(String(value) + crlf, "utf-8"));
     }
   }
-  parts.push(Buffer.from(delimiter5 + crlf, "utf-8"));
+  parts.push(Buffer.from(delimiter4 + crlf, "utf-8"));
   parts.push(
     Buffer.from(`Content-Disposition: form-data; name="${fieldName}"; filename="${filename}"` + crlf, "utf-8")
   );
   parts.push(Buffer.from(`Content-Type: ${contentType}` + crlf + crlf, "utf-8"));
   parts.push(fileContent);
   parts.push(Buffer.from(crlf, "utf-8"));
-  parts.push(Buffer.from(delimiter5 + "--" + crlf, "utf-8"));
+  parts.push(Buffer.from(delimiter4 + "--" + crlf, "utf-8"));
   return Buffer.concat(parts);
 }
 async function* parseLineStream(chunks) {
@@ -43055,7 +43391,7 @@ var init_api = __esm({
           return { http_code: null, body: null, headers: {}, error: "upload requires filePath or fileBytes" };
         }
         const partContentType = guessContentType(uploadName);
-        const boundary = "----Tina4Boundary" + randomBytes10(16).toString("hex");
+        const boundary = "----Tina4Boundary" + randomBytes11(16).toString("hex");
         const bodyBuffer = buildMultipartBody(boundary, fieldName, uploadName, content, partContentType, extraFields);
         const contentType = `multipart/form-data; boundary=${boundary}`;
         return this.execute("POST", this.buildUrl(path10), bodyBuffer, contentType, headers);
@@ -45203,7 +45539,7 @@ __export(ai_exports, {
 });
 import { existsSync as existsSync28, mkdirSync as mkdirSync22, writeFileSync as writeFileSync19, readFileSync as readFileSync26 } from "node:fs";
 import { homedir } from "node:os";
-import { join as join33, resolve as resolve21, relative as relative11, dirname as dirname15 } from "node:path";
+import { join as join34, resolve as resolve21, relative as relative11, dirname as dirname15 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { execSync as execSync2, execFileSync as execFileSync4 } from "node:child_process";
 import { createInterface } from "node:readline";
@@ -45274,8 +45610,8 @@ function downloadSkillsSync(jobs) {
 function installSkills(root = ".", targets) {
   const ref = skillsRef();
   const dests = targets ?? [
-    join33(resolve21(root), ".claude", "skills"),
-    join33(homedir(), ".claude", "skills")
+    join34(resolve21(root), ".claude", "skills"),
+    join34(homedir(), ".claude", "skills")
   ];
   const jobs = [];
   const index = /* @__PURE__ */ new Map();
@@ -45293,9 +45629,9 @@ function installSkills(root = ".", targets) {
     const base = `https://raw.githubusercontent.com/tina4stack/${spec.repo}/${ref}/.claude/skills/${skill}`;
     skillMdUrl[skill] = `${base}/SKILL.md`;
     for (const dest of dests) {
-      add(`${base}/SKILL.md`, join33(dest, skill, "SKILL.md"));
+      add(`${base}/SKILL.md`, join34(dest, skill, "SKILL.md"));
       for (const r of spec.references) {
-        add(`${base}/references/${r}`, join33(dest, skill, "references", r));
+        add(`${base}/references/${r}`, join34(dest, skill, "references", r));
       }
     }
   }
@@ -45307,7 +45643,7 @@ function installSkills(root = ".", targets) {
   return installed;
 }
 function isInstalled(root, tool) {
-  return existsSync28(join33(resolve21(root), tool.contextFile));
+  return existsSync28(join34(resolve21(root), tool.contextFile));
 }
 function showMenu(root = ".") {
   const r = resolve21(root);
@@ -45451,9 +45787,9 @@ function writeOrMerge(contextPath, contextFile, frameworkGuide) {
 }
 function installForTool(root, tool, context) {
   const created = [];
-  const contextPath = join33(root, tool.contextFile);
+  const contextPath = join34(root, tool.contextFile);
   if (tool.configDir) {
-    mkdirSync22(join33(root, tool.configDir), { recursive: true });
+    mkdirSync22(join34(root, tool.configDir), { recursive: true });
   }
   const parentDir = dirname15(contextPath);
   mkdirSync22(parentDir, { recursive: true });
@@ -45491,7 +45827,7 @@ function installTina4Ai() {
 function installClaudeSkills(root) {
   const created = [];
   for (const skill of installSkills(root)) {
-    created.push(join33(".claude", "skills", skill));
+    created.push(join34(".claude", "skills", skill));
     console.log(`  ${GREEN2}\u2713${RESET2} Installed .claude/skills/${skill}  (project + global)`);
   }
   return created;
@@ -45834,7 +46170,7 @@ function generateClaudeCodeContext() {
   try {
     const thisDir = dirname15(fileURLToPath8(import.meta.url));
     const repoRoot = resolve21(thisDir, "..", "..", "..");
-    const claudeMdPath = join33(repoRoot, "CLAUDE.md");
+    const claudeMdPath = join34(repoRoot, "CLAUDE.md");
     if (existsSync28(claudeMdPath)) {
       return readFileSync26(claudeMdPath, "utf-8");
     }
@@ -46037,7 +46373,7 @@ import {
   createHmac as createHmac4,
   createPrivateKey,
   createSign as createSign2,
-  randomBytes as randomBytes11
+  randomBytes as randomBytes12
 } from "node:crypto";
 function encodeBase64Url(value) {
   return Buffer.from(value).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
@@ -46117,7 +46453,7 @@ function encryptPayload(payload, subscription) {
   ]);
   const prkKey = hmac(authSecret, sharedSecret);
   const ikm = hkdfExpand(prkKey, keyInfo, 32);
-  const salt = randomBytes11(16);
+  const salt = randomBytes12(16);
   const contentPrk = hmac(salt, ikm);
   const cek = hkdfExpand(contentPrk, Buffer.from("Content-Encoding: aes128gcm\0", "ascii"), 16);
   const nonce = hkdfExpand(contentPrk, Buffer.from("Content-Encoding: nonce\0", "ascii"), 12);
@@ -48874,6 +49210,7 @@ __export(src_exports3, {
   cacheStats: () => cacheStats,
   checkPassword: () => checkPassword,
   clearCache: () => clearCache,
+  clearCurrentNonce: () => clearCurrentNonce,
   computeAcceptKey: () => computeAcceptKey,
   container: () => container,
   cors: () => cors,
@@ -48885,6 +49222,8 @@ __export(src_exports3, {
   createMessenger: () => createMessenger,
   createRequest: () => createRequest,
   createResponse: () => createResponse,
+  cspNonce: () => cspNonce,
+  currentCspNonce: () => currentCspNonce,
   decodeRequest: () => decodeRequest,
   defaultContext: () => defaultContext,
   defaultRouter: () => defaultRouter,
@@ -48910,6 +49249,7 @@ __export(src_exports3, {
   feedbackWhitelist: () => feedbackWhitelist,
   fts5Supported: () => fts5Supported,
   generateContext: () => generateContext,
+  generateNonce: () => generateNonce,
   generateVapidKeys: () => generateVapidKeys,
   get: () => get,
   getDefaultDevServer: () => getDefaultDevServer,
@@ -48932,6 +49272,7 @@ __export(src_exports3, {
   httpReason: () => httpReason,
   inContainer: () => inContainer,
   injectFeedbackWidget: () => injectFeedbackWidget,
+  injectNonceIntoCsp: () => injectNonceIntoCsp,
   installAll: () => installAll,
   installSelected: () => installSelected,
   isBannerSuppressed: () => isBannerSuppressed,
@@ -48986,6 +49327,7 @@ __export(src_exports3, {
   resetTrustedProxyCache: () => resetTrustedProxyCache,
   resolveAlgorithm: () => resolveAlgorithm,
   resolveClientIp: () => resolveClientIp,
+  resolveCspHeader: () => resolveCspHeader,
   resolveFrameworkVersion: () => resolveFrameworkVersion,
   resolvePortAndHost: () => resolvePortAndHost,
   resolveStringMiddleware: () => resolveStringMiddleware,
@@ -48993,12 +49335,14 @@ __export(src_exports3, {
   responseCache: () => responseCache,
   runAll: () => runAll,
   runRouteMiddlewares: () => runRouteMiddlewares,
+  runWithCspNonce: () => runWithCspNonce,
   runtimeDir: () => runtimeDir,
   saveUpload: () => saveUpload,
   schemaFromParams: () => schemaFromParams,
   selectablePids: () => selectablePids,
   serveWebSocketRoute: () => serveWebSocketRoute,
   sessionCookieName: () => sessionCookieName,
+  setCurrentNonce: () => setCurrentNonce,
   setDefaultTemplatesDir: () => setDefaultTemplatesDir,
   setFrond: () => setFrond,
   showMenu: () => showMenu,
@@ -49065,6 +49409,7 @@ var init_src3 = __esm({
     init_wsdl();
     init_htmlElement();
     init_errorOverlay();
+    init_csp();
     init_ai();
     init_sso();
     init_push();
@@ -49273,6 +49618,15 @@ export default async function (req: Tina4Request, res: Tina4Response): Promise<v
   <p>The Intelligent Native Application 4ramework</p>
 </body>
 </html>
+`
+  );
+  writeFileSync(
+    join(targetDir, "public/style.css"),
+    `body { font-family: -apple-system, sans-serif; max-width: 600px; margin: 80px auto; padding: 0 20px; color: #333; }
+h1 { font-size: 2.5em; margin-bottom: 0.2em; }
+p { color: #666; font-size: 1.1em; }
+code { background: #f4f4f4; padding: 2px 6px; border-radius: 3px; font-size: 0.9em; }
+a { color: #2563eb; }
 `
   );
   writeFileSync(
@@ -49281,13 +49635,7 @@ export default async function (req: Tina4Request, res: Tina4Response): Promise<v
 <html>
 <head>
   <title>Tina4</title>
-  <style>
-    body { font-family: -apple-system, sans-serif; max-width: 600px; margin: 80px auto; padding: 0 20px; color: #333; }
-    h1 { font-size: 2.5em; margin-bottom: 0.2em; }
-    p { color: #666; font-size: 1.1em; }
-    code { background: #f4f4f4; padding: 2px 6px; border-radius: 3px; font-size: 0.9em; }
-    a { color: #2563eb; }
-  </style>
+  <link rel="stylesheet" href="/style.css">
 </head>
 <body>
   <h1>tina4</h1>
@@ -49358,6 +49706,7 @@ async function serveProject(options) {
 
 // src/commands/migrate.ts
 init_dotenv();
+init_util();
 import { existsSync as existsSync30 } from "node:fs";
 import { resolve as resolve23 } from "node:path";
 async function runMigrations(migrationDir) {
@@ -49377,12 +49726,7 @@ async function runMigrations(migrationDir) {
     console.error("  Error: @tina4/orm is required to run migrations.");
     process.exit(1);
   }
-  try {
-    await initDatabase2();
-  } catch (err) {
-    console.error(`  Error initialising database: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
-  }
+  await initDatabaseOrExit(initDatabase2);
   const result = await migrate2(void 0, { migrationsDir: dir });
   if (result.applied.length === 0 && result.failed.length === 0) {
     console.log("  Nothing to migrate \u2014 all migrations already applied.");
@@ -49421,6 +49765,7 @@ async function createMigration2(args = []) {
 
 // src/commands/migrateStatus.ts
 init_dotenv();
+init_util();
 import { resolve as resolve24 } from "node:path";
 async function migrateStatus(migrationDir) {
   loadEnv();
@@ -49437,12 +49782,7 @@ async function migrateStatus(migrationDir) {
     console.error("  Error: @tina4/orm is required to check migration status.");
     process.exit(1);
   }
-  try {
-    await initDatabase2();
-  } catch (err) {
-    console.error(`  Error initialising database: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
-  }
+  await initDatabaseOrExit(initDatabase2);
   ensureMigrationTable2();
   const result = await statusFn(void 0, { migrationsDir: dir });
   console.log("");
@@ -49469,6 +49809,7 @@ async function migrateStatus(migrationDir) {
 
 // src/commands/migrateRollback.ts
 init_dotenv();
+init_util();
 import { resolve as resolve25 } from "node:path";
 async function migrateRollback(migrationDir) {
   loadEnv();
@@ -49487,12 +49828,7 @@ async function migrateRollback(migrationDir) {
     console.error("  Error: @tina4/orm is required to rollback migrations.");
     process.exit(1);
   }
-  try {
-    await initDatabase2();
-  } catch (err) {
-    console.error(`  Error initialising database: ${err instanceof Error ? err.message : String(err)}`);
-    process.exit(1);
-  }
+  await initDatabaseOrExit(initDatabase2);
   await ensureMigrationTable2();
   const lastBatch = await getLastBatchMigrations2();
   if (lastBatch.length === 0) {
@@ -49562,8 +49898,8 @@ async function listRoutes() {
 }
 
 // src/commands/test.ts
-import { existsSync as existsSync32, readdirSync as readdirSync19, readFileSync as readFileSync27, statSync as statSync20 } from "node:fs";
-import { resolve as resolve27, join as join34 } from "node:path";
+import { existsSync as existsSync32, readdirSync as readdirSync19, readFileSync as readFileSync27, statSync as statSync21 } from "node:fs";
+import { resolve as resolve27, join as join35 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 import { execSync as execSync3 } from "node:child_process";
 function walkSource(dir) {
@@ -49575,10 +49911,10 @@ function walkSource(dir) {
     return out;
   }
   for (const name of entries) {
-    const full = join34(dir, name);
+    const full = join35(dir, name);
     let st;
     try {
-      st = statSync20(full);
+      st = statSync21(full);
     } catch {
       continue;
     }
@@ -49646,7 +49982,7 @@ async function runTests(testPath) {
       break;
     }
     try {
-      const files = readdirSync19(fullPath).filter((f) => f.endsWith(".ts")).map((f) => join34(fullPath, f));
+      const files = readdirSync19(fullPath).filter((f) => f.endsWith(".ts")).map((f) => join35(fullPath, f));
       testFiles.push(...files);
     } catch {
     }
@@ -49675,9 +50011,10 @@ async function runTests(testPath) {
 }
 
 // src/commands/lint.ts
-import { existsSync as existsSync33, readdirSync as readdirSync20, readFileSync as readFileSync28, statSync as statSync21, writeFileSync as writeFileSync20 } from "node:fs";
+init_util();
+import { existsSync as existsSync33, readdirSync as readdirSync20, readFileSync as readFileSync28, statSync as statSync22, writeFileSync as writeFileSync20 } from "node:fs";
 import { createRequire as createRequire9 } from "node:module";
-import { delimiter as delimiter2, dirname as dirname16, join as join35, relative as relative12 } from "node:path";
+import { dirname as dirname16, join as join36, relative as relative12 } from "node:path";
 import { spawnSync as spawnSync3 } from "node:child_process";
 var LINT_EXTENSIONS = [".ts", ".mts", ".cts", ".js", ".mjs", ".cjs"];
 var JS_EXTENSIONS = [".js", ".mjs", ".cjs"];
@@ -49695,10 +50032,10 @@ function walkSource2(dir, out) {
   }
   for (const name of entries) {
     if (SKIP_DIRS3.has(name)) continue;
-    const full = join35(dir, name);
+    const full = join36(dir, name);
     let st;
     try {
-      st = statSync21(full);
+      st = statSync22(full);
     } catch {
       continue;
     }
@@ -49711,15 +50048,15 @@ function walkSource2(dir, out) {
 }
 function collectAppFiles(cwd) {
   const files = [];
-  const srcDir = join35(cwd, "src");
+  const srcDir = join36(cwd, "src");
   try {
-    if (statSync21(srcDir).isDirectory()) walkSource2(srcDir, files);
+    if (statSync22(srcDir).isDirectory()) walkSource2(srcDir, files);
   } catch {
   }
   for (const entry of ["app.ts", "app.mts", "app.js", "app.mjs"]) {
-    const p = join35(cwd, entry);
+    const p = join36(cwd, entry);
     try {
-      if (statSync21(p).isFile()) files.push(p);
+      if (statSync22(p).isFile()) files.push(p);
     } catch {
     }
   }
@@ -49740,15 +50077,15 @@ export default [js.configs.recommended, ...tseslint.configs.recommended];
 `;
 function findEslintConfig(cwd) {
   for (const name of ESLINT_FLAT_CONFIGS) {
-    const p = join35(cwd, name);
+    const p = join36(cwd, name);
     if (existsSync33(p)) return p;
   }
   return null;
 }
 function resolvePackageBin(cwd, pkg, binRelative) {
-  const direct = join35(cwd, "node_modules", pkg, binRelative);
+  const direct = join36(cwd, "node_modules", pkg, binRelative);
   if (existsSync33(direct)) return direct;
-  const require3 = createRequire9(join35(cwd, "package.json"));
+  const require3 = createRequire9(join36(cwd, "package.json"));
   let entry;
   try {
     entry = require3.resolve(pkg);
@@ -49757,11 +50094,11 @@ function resolvePackageBin(cwd, pkg, binRelative) {
   }
   let dir = dirname16(entry);
   for (let i = 0; i < 8; i++) {
-    const pkgJson = join35(dir, "package.json");
+    const pkgJson = join36(dir, "package.json");
     if (existsSync33(pkgJson)) {
       try {
         if (JSON.parse(readFileSync28(pkgJson, "utf-8")).name === pkg) {
-          const bin = join35(dir, binRelative);
+          const bin = join36(dir, binRelative);
           return existsSync33(bin) ? bin : null;
         }
       } catch {
@@ -49777,22 +50114,12 @@ function resolveEslintBin(cwd) {
   return resolvePackageBin(cwd, "eslint", "bin/eslint.js");
 }
 function hasPackage(cwd, pkg) {
-  return existsSync33(join35(cwd, "node_modules", ...pkg.split("/"), "package.json"));
+  return existsSync33(join36(cwd, "node_modules", ...pkg.split("/"), "package.json"));
 }
 function resolveNpm() {
   const windows = process.platform === "win32";
   const names = windows ? ["npm.cmd", "npm.exe", "npm"] : ["npm"];
-  for (const dir of (process.env.PATH ?? "").split(delimiter2)) {
-    if (!dir) continue;
-    for (const name of names) {
-      const candidate = join35(dir, name);
-      try {
-        if (statSync21(candidate).isFile()) return candidate;
-      } catch {
-      }
-    }
-  }
-  return null;
+  return findOnPath(names);
 }
 function bootstrapEslint(cwd, noInstall) {
   let bin = resolveEslintBin(cwd);
@@ -49810,7 +50137,7 @@ function bootstrapEslint(cwd, noInstall) {
     else console.log("  \xB7 could not install eslint \u2014 using the zero-dependency baseline.");
   }
   if (bin && !config && hasPackage(cwd, "@eslint/js") && hasPackage(cwd, "typescript-eslint")) {
-    const scaffold = join35(cwd, ESLINT_SCAFFOLD_FILE);
+    const scaffold = join36(cwd, ESLINT_SCAFFOLD_FILE);
     try {
       writeFileSync20(scaffold, ESLINT_SCAFFOLD, "utf-8");
       config = scaffold;
@@ -49879,7 +50206,7 @@ function runLint(args) {
   if (fix) {
     console.log("  \xB7 --fix needs eslint \u2014 the baseline check has no autofix.");
   }
-  if (existsSync33(join35(cwd, "tsconfig.json")) && runTypescript(cwd, files)) return;
+  if (existsSync33(join36(cwd, "tsconfig.json")) && runTypescript(cwd, files)) return;
   runJavaScript(cwd, files);
 }
 
@@ -49888,7 +50215,7 @@ init_generate();
 
 // src/commands/seed.ts
 import { existsSync as existsSync34, readdirSync as readdirSync21 } from "node:fs";
-import { resolve as resolve28, join as join36 } from "node:path";
+import { resolve as resolve28, join as join37 } from "node:path";
 import { execSync as execSync4 } from "node:child_process";
 async function runSeeds(seedPath) {
   const cwd = process.cwd();
@@ -49915,7 +50242,7 @@ async function runSeeds(seedPath) {
   }
   let seedFiles;
   try {
-    seedFiles = readdirSync21(seedDir).filter((f) => f.endsWith(".ts")).sort().map((f) => join36(seedDir, f));
+    seedFiles = readdirSync21(seedDir).filter((f) => f.endsWith(".ts")).sort().map((f) => join37(seedDir, f));
   } catch {
     console.log("  Could not read src/seeds/ directory.");
     return;
@@ -49946,39 +50273,16 @@ async function runSeeds(seedPath) {
 // src/commands/queue.ts
 init_dotenv();
 init_queue();
-import { readdirSync as readdirSync22, statSync as statSync22 } from "node:fs";
-import { extname as extname9, join as join37 } from "node:path";
+init_util();
+import { readdirSync as readdirSync22, statSync as statSync23 } from "node:fs";
+import { extname as extname9, join as join38 } from "node:path";
 import { pathToFileURL as pathToFileURL3 } from "node:url";
 var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["once", "json"]);
-function parseFlags(args) {
-  const flags = {};
-  const positional = [];
-  let i = 0;
-  while (i < args.length) {
-    const arg = args[i];
-    if (arg.startsWith("--")) {
-      const key = arg.slice(2);
-      if (BOOLEAN_FLAGS.has(key)) {
-        flags[key] = true;
-        i += 1;
-      } else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
-        flags[key] = args[i + 1];
-        i += 2;
-      } else {
-        flags[key] = true;
-        i += 1;
-      }
-    } else {
-      positional.push(arg);
-      i += 1;
-    }
-  }
-  return { flags, positional };
-}
+var parseFlags2 = (args) => parseFlags(args, BOOLEAN_FLAGS);
 async function resolveQueueHandler(servicesDir, topic) {
   let entries;
   try {
-    if (!statSync22(servicesDir).isDirectory()) return null;
+    if (!statSync23(servicesDir).isDirectory()) return null;
     entries = readdirSync22(servicesDir);
   } catch {
     return null;
@@ -49987,9 +50291,9 @@ async function resolveQueueHandler(servicesDir, topic) {
     if (entry.startsWith("_")) continue;
     const ext = extname9(entry);
     if (ext !== ".ts" && ext !== ".js") continue;
-    const fullPath = join37(servicesDir, entry);
+    const fullPath = join38(servicesDir, entry);
     try {
-      if (!statSync22(fullPath).isFile()) continue;
+      if (!statSync23(fullPath).isFile()) continue;
       const mod = await import(pathToFileURL3(fullPath).href);
       const config = mod.default ?? mod;
       if (config && typeof config === "object" && config.topic === topic && typeof config.handle === "function") {
@@ -50006,7 +50310,7 @@ function firstJob(yielded) {
 }
 async function queueWork(args) {
   loadEnv();
-  const { flags, positional } = parseFlags(args);
+  const { flags, positional } = parseFlags2(args);
   const topic = positional[0] ?? "default";
   const once2 = Boolean(flags.once);
   let pollSeconds;
@@ -50058,7 +50362,7 @@ async function queueWork(args) {
 }
 async function queueStats(args) {
   loadEnv();
-  const { flags, positional } = parseFlags(args);
+  const { flags, positional } = parseFlags2(args);
   const topic = positional[0] ?? "default";
   const queue = new Queue({ topic });
   const stats = {
@@ -50089,7 +50393,7 @@ async function queueStats(args) {
 }
 async function queueRetry(args) {
   loadEnv();
-  const { positional } = parseFlags(args);
+  const { positional } = parseFlags2(args);
   const topic = positional[0] ?? "default";
   const queue = new Queue({ topic });
   const dead = queue.deadLetters(0);
@@ -50105,7 +50409,7 @@ async function queueRetry(args) {
 }
 async function queueClear(args) {
   loadEnv();
-  const { positional } = parseFlags(args);
+  const { positional } = parseFlags2(args);
   const status2 = positional[0] ?? "completed";
   const topic = positional[1] ?? "default";
   const queue = new Queue({ topic });
@@ -50139,28 +50443,12 @@ async function queueCommand(args = []) {
 }
 
 // src/commands/build.ts
-import { accessSync as accessSync2, constants as constants4, existsSync as existsSync35, statSync as statSync23 } from "node:fs";
-import { basename as basename9, delimiter as delimiter3, join as join38 } from "node:path";
+init_util();
+import { accessSync as accessSync2, constants as constants4, existsSync as existsSync35, statSync as statSync24 } from "node:fs";
+import { basename as basename9, delimiter as delimiter3, join as join39 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
-function parseFlags2(args) {
-  const flags = {};
-  let i = 0;
-  while (i < args.length) {
-    const arg = args[i];
-    if (arg.startsWith("--")) {
-      const key = arg.slice(2);
-      if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
-        flags[key] = args[i + 1];
-        i += 2;
-      } else {
-        flags[key] = true;
-        i += 1;
-      }
-    } else {
-      i += 1;
-    }
-  }
-  return flags;
+function parseFlags3(args) {
+  return parseFlags(args).flags;
 }
 function whichDocker() {
   const pathValue = process.env.PATH || process.env.Path || "";
@@ -50169,10 +50457,10 @@ function whichDocker() {
   for (const dir of pathValue.split(delimiter3)) {
     if (!dir) continue;
     for (const ext of exts) {
-      const candidate = join38(dir, `docker${ext}`);
+      const candidate = join39(dir, `docker${ext}`);
       try {
         accessSync2(candidate, constants4.X_OK);
-        if (statSync23(candidate).isFile()) return candidate;
+        if (statSync24(candidate).isFile()) return candidate;
       } catch {
       }
     }
@@ -50180,14 +50468,14 @@ function whichDocker() {
   return null;
 }
 function buildImage(args) {
-  const flags = parseFlags2(args);
+  const flags = parseFlags3(args);
   let tag = typeof flags.tag === "string" ? flags.tag : "";
   if (!tag) {
     const dirName = basename9(process.cwd()).toLowerCase();
     tag = `${dirName || "tina4app"}:latest`;
   }
   const dockerfile = typeof flags.file === "string" && flags.file ? flags.file : "Dockerfile";
-  if (!existsSync35(dockerfile) || !statSync23(dockerfile).isFile()) {
+  if (!existsSync35(dockerfile) || !statSync24(dockerfile).isFile()) {
     console.log(`  \u2717 No ${dockerfile} found.`);
     console.log("  A Tina4 app deploys as a container. Scaffold a Dockerfile first:");
     console.log("      tina4 deploy docker        (or: tina4nodejs init)");
@@ -50214,14 +50502,15 @@ function buildImage(args) {
 }
 
 // src/bin.ts
+init_util();
 import { spawnSync as spawnSync5 } from "node:child_process";
-import { existsSync as existsSync36, readFileSync as readFileSync29, statSync as statSync24 } from "node:fs";
-import { delimiter as delimiter4, dirname as dirname17, join as join39 } from "node:path";
+import { existsSync as existsSync36, readFileSync as readFileSync29 } from "node:fs";
+import { dirname as dirname17, join as join40 } from "node:path";
 import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL4 } from "node:url";
 function readCliVersion() {
   let dir = dirname17(fileURLToPath9(import.meta.url));
   for (let i = 0; i < 6; i++) {
-    const pkgPath = join39(dir, "package.json");
+    const pkgPath = join40(dir, "package.json");
     if (existsSync36(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync29(pkgPath, "utf-8"));
@@ -50526,17 +50815,7 @@ var CLIENT_INSTALL_HINT = "  Install it:  curl -fsSL https://tina4.com/install.s
 function findClient() {
   const windows = process.platform === "win32";
   const names = windows ? [`${CLIENT_BINARY}.exe`, `${CLIENT_BINARY}.cmd`, `${CLIENT_BINARY}.bat`] : [CLIENT_BINARY];
-  for (const dir of (process.env.PATH ?? "").split(delimiter4)) {
-    if (!dir) continue;
-    for (const name of names) {
-      const candidate = join39(dir, name);
-      try {
-        if (statSync24(candidate).isFile()) return candidate;
-      } catch {
-      }
-    }
-  }
-  return null;
+  return findOnPath(names);
 }
 function delegateToClient(command, args) {
   if (process.env[DELEGATION_GUARD_ENV] === command) {