tina4-nodejs 3.13.141 → 3.13.143

package/packages/core/dist/index.js

@@ -13695,6 +13695,36 @@ var init_shapes = __esm({
   }
 });
 
+// ../orm/src/graph/adapters/rowMapping.ts
+function errorMessage(exc) {
+  if (exc instanceof Error) return exc.message;
+  return String(exc);
+}
+function nodeFromRow(row) {
+  if (row === null || row === void 0) return null;
+  return new GraphNode(
+    String(row.id),
+    row.labels ?? [],
+    row.props ?? {}
+  );
+}
+function edgeFromRow(row) {
+  if (row === null || row === void 0) return null;
+  return new GraphEdge(
+    String(row.id),
+    String(row.type),
+    String(row.f),
+    String(row.t),
+    row.props ?? {}
+  );
+}
+var init_rowMapping = __esm({
+  "../orm/src/graph/adapters/rowMapping.ts"() {
+    "use strict";
+    init_shapes();
+  }
+});
+
 // ../orm/src/graph/connectTimeout.ts
 function resolveGraphConnectTimeout() {
   const raw = (process.env[GRAPH_CONNECT_TIMEOUT_VARIABLE] ?? "").trim();
@@ -13734,15 +13764,12 @@ function propClause(properties) {
   for (const key of keys) params[`p_${key}`] = props[key];
   return { clause: `{${pairs}}`, params };
 }
-function errorMessage(exc) {
-  if (exc instanceof Error) return exc.message;
-  return String(exc);
-}
 var DRIVER_PACKAGE, driver, UltipaClient, UltipaConnectError, UNBOUNDED_CONNECT_SECONDS, UltipaGraphAdapter;
 var init_ultipa = __esm({
   async "../orm/src/graph/adapters/ultipa.ts"() {
     "use strict";
     init_shapes();
+    init_rowMapping();
     init_errors();
     init_connectTimeout2();
     DRIVER_PACKAGE = "tina4-ultipa";
@@ -13800,12 +13827,7 @@ var init_ultipa = __esm({
       }
       // -- portable node/edge/traverse core (GQL) ----------------------------
       nodeFromRow(row) {
-        if (row === null || row === void 0) return null;
-        return new GraphNode(
-          String(row.id),
-          row.labels ?? [],
-          row.props ?? {}
-        );
+        return nodeFromRow(row);
       }
       async addNode(label, properties = null) {
         const { clause, params } = propClause(properties);
@@ -13819,15 +13841,7 @@ var init_ultipa = __esm({
         params.to_id = toId;
         const gql = `MATCH (a), (b) WHERE id(a) = $from_id AND id(b) = $to_id INSERT (a)-[e:\`${type2}\` ${clause}]->(b) RETURN id(e) AS id, type(e) AS type, id(a) AS f, id(b) AS t, properties(e) AS props`;
         const rows = (await this.run(gql, params, false)).dicts();
-        if (rows.length === 0) return null;
-        const row = rows[0];
-        return new GraphEdge(
-          String(row.id),
-          String(row.type),
-          String(row.f),
-          String(row.t),
-          row.props ?? {}
-        );
+        return edgeFromRow(rows[0]);
       }
       async getNode(nodeId) {
         const gql = `MATCH (n) WHERE id(n) = $id RETURN id(n) AS id, labels(n) AS labels, properties(n) AS props`;
@@ -13892,10 +13906,6 @@ var bolt_exports = {};
 __export(bolt_exports, {
   BoltGraphAdapter: () => BoltGraphAdapter
 });
-function errorMessage2(exc) {
-  if (exc instanceof Error) return exc.message;
-  return String(exc);
-}
 function boltId(id) {
   const value = Number(id);
   return Number.isNaN(value) ? -1 : value;
@@ -13905,6 +13915,7 @@ var init_bolt = __esm({
   async "../orm/src/graph/adapters/bolt.ts"() {
     "use strict";
     init_shapes();
+    init_rowMapping();
     init_errors();
     init_connectTimeout2();
     DRIVER_PACKAGE2 = "neo4j-driver";
@@ -13940,7 +13951,7 @@ var init_bolt = __esm({
           const result = await session.run(cypher, params ?? {});
           return result.records.map((record) => record.toObject());
         } catch (exc) {
-          this.lastError = errorMessage2(exc);
+          this.lastError = errorMessage(exc);
           const code = exc?.code ?? "";
           const message = this.lastError.toLowerCase();
           if (code === "ServiceUnavailable" || code === neo4j.error?.SERVICE_UNAVAILABLE || message.includes("timed out") || message.includes("timeout")) {
@@ -13964,12 +13975,7 @@ var init_bolt = __esm({
       }
       // -- portable node/edge/traverse core (Cypher) -------------------------
       nodeFromRow(row) {
-        if (row === null || row === void 0) return null;
-        return new GraphNode(
-          String(row.id),
-          row.labels ?? [],
-          row.props ?? {}
-        );
+        return nodeFromRow(row);
       }
       async addNode(label, properties = null) {
         const cypher = `CREATE (n:\`${label}\` $props) RETURN id(n) AS id, labels(n) AS labels, properties(n) AS props`;
@@ -13983,15 +13989,7 @@ var init_bolt = __esm({
           to_id: boltId(toId),
           props: properties ?? {}
         });
-        if (rows.length === 0) return null;
-        const row = rows[0];
-        return new GraphEdge(
-          String(row.id),
-          String(row.type),
-          String(row.f),
-          String(row.t),
-          row.props ?? {}
-        );
+        return edgeFromRow(rows[0]);
       }
       async getNode(nodeId) {
         const cypher = `MATCH (n) WHERE id(n) = $id RETURN id(n) AS id, labels(n) AS labels, properties(n) AS props`;
@@ -14057,7 +14055,7 @@ function cleanProps(doc) {
   }
   return props;
 }
-function errorMessage3(exc) {
+function errorMessage2(exc) {
   if (exc instanceof Error) return exc.message;
   return String(exc);
 }
@@ -14096,14 +14094,14 @@ var init_arango = __esm({
         this.db = new ArangoDatabase(config);
       }
       connectOrError(exc) {
-        const text = errorMessage3(exc).toLowerCase();
+        const text = errorMessage2(exc).toLowerCase();
         if (text.includes("timed out") || text.includes("timeout") || text.includes("connection") || text.includes("econnrefused") || text.includes("etimedout") || text.includes("max retries")) {
           return new GraphConnectTimeout(
             `Graph connect to ${this.url.host}:${this.url.port} timed out (${GRAPH_CONNECT_TIMEOUT_VARIABLE}). Raise ${GRAPH_CONNECT_TIMEOUT_VARIABLE} if the server is simply slow, or set it to 0 to wait indefinitely.`,
             exc
           );
         }
-        return new GraphError(errorMessage3(exc), exc);
+        return new GraphError(errorMessage2(exc), exc);
       }
       async ensureCollections() {
         if (this.ensured) return;
@@ -14114,7 +14112,7 @@ var init_arango = __esm({
           if (!await edges.exists()) await this.db.createEdgeCollection(EDGE_COLLECTION);
           this.ensured = true;
         } catch (exc) {
-          this.lastError = errorMessage3(exc);
+          this.lastError = errorMessage2(exc);
           throw this.connectOrError(exc);
         }
       }
@@ -14124,7 +14122,7 @@ var init_arango = __esm({
           const cursor = await this.db.query({ query, bindVars: bind2 ?? {} });
           return await cursor.all();
         } catch (exc) {
-          this.lastError = errorMessage3(exc);
+          this.lastError = errorMessage2(exc);
           throw this.connectOrError(exc);
         }
       }
@@ -17432,6 +17430,73 @@ var init_trustedProxy = __esm({
   }
 });
 
+// src/csp.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
+import { randomBytes as randomBytes4 } from "node:crypto";
+function generateNonce() {
+  return randomBytes4(16).toString("base64");
+}
+function runWithCspNonce(nonce, fn) {
+  return nonceStore.run({ nonce }, fn);
+}
+function setCurrentNonce(nonce) {
+  const store = nonceStore.getStore();
+  if (store) store.nonce = nonce;
+  else nonceFallback = nonce;
+}
+function clearCurrentNonce() {
+  setCurrentNonce(void 0);
+}
+function currentCspNonce() {
+  const store = nonceStore.getStore();
+  let value = store ? store.nonce : nonceFallback;
+  if (!value) {
+    value = generateNonce();
+    if (store) store.nonce = value;
+    else nonceFallback = value;
+  }
+  return value;
+}
+function cspNonce() {
+  return currentCspNonce();
+}
+function injectNonceIntoCsp(csp, nonce) {
+  const token = `'nonce-${nonce}'`;
+  const directives = [];
+  for (const rawPart of csp.split(";")) {
+    const part = rawPart.trim();
+    if (!part) continue;
+    const spaceAt = part.search(/\s/);
+    const name = (spaceAt === -1 ? part : part.slice(0, spaceAt)).toLowerCase();
+    const value = spaceAt === -1 ? "" : part.slice(spaceAt + 1).trim();
+    directives.push([name, value]);
+  }
+  const defaultEntry = directives.find(([name]) => name === "default-src");
+  const defaultValue = defaultEntry && defaultEntry[1] ? defaultEntry[1] : "'self'";
+  for (const directive of ["style-src", "script-src"]) {
+    const existing = directives.find(([name]) => name === directive);
+    if (existing) {
+      if (!existing[1].split(/\s+/).includes(token)) {
+        existing[1] = `${existing[1]} ${token}`.trim();
+      }
+    } else {
+      directives.push([directive, `${defaultValue} ${token}`.trim()]);
+    }
+  }
+  return directives.map(([name, value]) => value ? `${name} ${value}` : name).join("; ");
+}
+function resolveCspHeader(nonce) {
+  const csp = process.env.TINA4_CSP || "default-src 'self'";
+  return injectNonceIntoCsp(csp, nonce);
+}
+var nonceStore, nonceFallback;
+var init_csp = __esm({
+  "src/csp.ts"() {
+    "use strict";
+    nonceStore = new AsyncLocalStorage3();
+  }
+});
+
 // ../frond/src/engine.ts
 var engine_exports = {};
 __export(engine_exports, {
@@ -17441,9 +17506,10 @@ __export(engine_exports, {
   expressionFormCache: () => expressionFormCache,
   filterChainCache: () => filterChainCache,
   pathParseCache: () => pathParseCache,
+  setCspNonceProvider: () => setCspNonceProvider,
   setFormTokenSessionId: () => setFormTokenSessionId
 });
-import { createHash as createHash3, createHmac as createHmac3, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash3, createHmac as createHmac3, randomBytes as randomBytes5 } from "node:crypto";
 import { readFileSync as readFileSync6, existsSync as existsSync7, statSync as statSync6, realpathSync } from "node:fs";
 import { join as join10, resolve as resolve6, isAbsolute as isAbsolute4, sep as sep3 } from "node:path";
 function jsonText(value) {
@@ -18510,6 +18576,9 @@ function _b64url(data) {
 function setFormTokenSessionId(sessionId) {
   _formTokenSessionId = sessionId || "";
 }
+function setCspNonceProvider(fn) {
+  _cspNonceProvider = fn;
+}
 function _buildFormTokenJwt(descriptor = "") {
   const secret = process.env.TINA4_SECRET ?? "";
   const secretBytes = Buffer.byteLength(secret, "utf8");
@@ -18521,7 +18590,7 @@ function _buildFormTokenJwt(descriptor = "") {
   const ttlMinutes = parseInt(process.env.TINA4_TOKEN_LIMIT || "60", 10);
   const header = { alg: "HS256", typ: "JWT" };
   const now = Math.floor(Date.now() / 1e3);
-  const payload = { type: "form", nonce: randomBytes4(8).toString("hex"), iat: now, exp: now + ttlMinutes * 60 };
+  const payload = { type: "form", nonce: randomBytes5(8).toString("hex"), iat: now, exp: now + ttlMinutes * 60 };
   if (descriptor) {
     if (descriptor.includes("|")) {
       const [ctx, ref] = descriptor.split("|", 2);
@@ -18548,7 +18617,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FAST_FILTERS, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, EXPR_EVALUATORS, expressionFormCache, VarRef, JS_SAFE_RE, MEDIA_TYPE_RE, SANDBOX_EXPR_KEYWORDS, SANDBOX_IDENT_RE, SANDBOX_STRING_RE, UNSAFE_KEYS, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FAST_FILTERS, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, EXPR_EVALUATORS, expressionFormCache, VarRef, JS_SAFE_RE, MEDIA_TYPE_RE, SANDBOX_EXPR_KEYWORDS, SANDBOX_IDENT_RE, SANDBOX_STRING_RE, UNSAFE_KEYS, BUILTIN_FILTERS, _formTokenSessionId, _cspNonceProvider, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -18902,6 +18971,7 @@ var init_engine = __esm({
       js_escape: (v) => new SafeString(jsEscape(v))
     };
     _formTokenSessionId = "";
+    _cspNonceProvider = () => "";
     Frond = class _Frond {
       // ── Class-level registries ──────────────────────────────────
       // Persist globals, filters, and tests across hot-reloads and at
@@ -19055,6 +19125,7 @@ var init_engine = __esm({
         this.globals.formTokenValue = (descriptor) => _generateFormTokenValue(descriptor || "");
         this.globals.form_token_value = (descriptor) => _generateFormTokenValue(descriptor || "");
         this.globals.dump = (value) => renderDump(value);
+        this.globals.csp_nonce = () => _cspNonceProvider();
         for (const [k, v] of _Frond.classFilters) this.filters[k] = v;
         for (const [k, v] of _Frond.classGlobals) this.globals[k] = v;
         for (const [k, v] of _Frond.classTests) this.tests[k] = v;
@@ -20318,7 +20389,8 @@ async function getFrond() {
   const dir = _defaultTemplatesDir ?? nodePath.resolve(process.cwd(), "src/templates");
   let engine = _frondCache.get(dir);
   if (!engine) {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     engine = new Frond2(dir);
     _frondCache.set(dir, engine);
   }
@@ -20329,7 +20401,8 @@ async function getFrameworkFrond() {
   const frameworkDir = nodePath.resolve(nodePath.dirname(import.meta.url.replace("file://", "")), "..", "templates");
   if (!_frameworkFrond && fs2.existsSync(frameworkDir)) {
     try {
-      const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      setCspNonceProvider2(currentCspNonce);
       _frameworkFrond = new Frond2(frameworkDir);
     } catch {
       return null;
@@ -20429,6 +20502,7 @@ function createResponse(res) {
     return response;
   };
   response.raw = res;
+  response.cspNonce = currentCspNonce();
   response.json = function(data, status2) {
     if (res.headersSent) return response;
     if (status2 !== void 0) res.statusCode = status2;
@@ -20574,7 +20648,8 @@ function createResponse(res) {
   };
   response.render = async function(templateName, data, status2, templateDir) {
     try {
-      const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      setCspNonceProvider2(currentCspNonce);
       const dir = templateDir ?? _defaultTemplatesDir ?? nodePath.resolve(process.cwd(), "src/templates");
       let engine = _frondCache.get(dir);
       if (!engine) {
@@ -20692,6 +20767,7 @@ var HEADER_TOKEN, _frondCache, _defaultTemplatesDir, _globalFrond, _frameworkFro
 var init_response = __esm({
   "src/response.ts"() {
     "use strict";
+    init_csp();
     HEADER_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
     _frondCache = /* @__PURE__ */ new Map();
     _defaultTemplatesDir = null;
@@ -20903,6 +20979,7 @@ var init_middleware = __esm({
     init_dotenv();
     init_router();
     init_trustedProxy();
+    init_csp();
     init_response();
     MiddlewareChain = class {
       middlewares = [];
@@ -21335,12 +21412,18 @@ var init_middleware = __esm({
        * overrides, WITHOUT Strict-Transport-Security, which depends on the
        * request's scheme. Also what a transport rejection carries (ADR-0068
        * section 4), written before the scheme is known.
+       *
+       * Content-Security-Policy always carries a per-response nonce in style-src
+       * AND script-src (ADR-0088), read from the request async-context (minted on
+       * first access), so the framework's own inline content runs under the strict
+       * default without 'unsafe-inline'. The nonce is random per response, so a
+       * caller comparing this header must assert its STRUCTURE, never a byte string.
        */
       static canonicalHeaders() {
         return {
           "X-Frame-Options": process.env.TINA4_FRAME_OPTIONS ?? "SAMEORIGIN",
           "X-Content-Type-Options": "nosniff",
-          "Content-Security-Policy": process.env.TINA4_CSP ?? "default-src 'self'",
+          "Content-Security-Policy": resolveCspHeader(currentCspNonce()),
           "Referrer-Policy": process.env.TINA4_REFERRER_POLICY ?? "strict-origin-when-cross-origin",
           "X-XSS-Protection": "0",
           "Permissions-Policy": process.env.TINA4_PERMISSIONS_POLICY ?? "camera=(), microphone=(), geolocation=()"
@@ -21382,7 +21465,7 @@ var init_middleware = __esm({
       static warnCspDefaultOnce() {
         if (_SecurityHeadersMiddleware.cspDefaultWarned) return;
         _SecurityHeadersMiddleware.cspDefaultWarned = true;
-        const message = `TINA4_CSP is not set, so Tina4 is serving the default Content-Security-Policy "default-src 'self'" on every response. That default blocks runtime-injected inline styles, cross-origin fonts/scripts/CDNs, data: URIs, and cross-origin WebSocket/XHR (e.g. a separate API or LiveKit host). If your app uses any of these, set TINA4_CSP to a policy that allows them (see https://tina4.com); to silence this notice without changing behaviour, set TINA4_CSP="default-src 'self'".`;
+        const message = `TINA4_CSP is not set, so Tina4 is serving the default Content-Security-Policy "default-src 'self'" on every response. The framework injects a per-response nonce into style-src and script-src, so its own inline <style>/<script> (and your templates using the csp_nonce() Frond global) work under this policy. The default still blocks cross-origin fonts/scripts/CDNs, data: URIs, and cross-origin WebSocket/XHR (e.g. a separate API or LiveKit host). If your app uses any of these, set TINA4_CSP to a policy that allows them (see https://tina4.com); to silence this notice without changing behaviour, set TINA4_CSP="default-src 'self'".`;
         try {
           Log.warning(message);
         } catch {
@@ -22387,6 +22470,21 @@ var init_portTakeover = __esm({
   }
 });
 
+// src/etag.ts
+function etagMatches(ifNoneMatch, etag) {
+  const strip = (tag) => tag.trim().replace(/^W\//, "");
+  const target = strip(etag);
+  return ifNoneMatch.split(",").some((candidate) => {
+    const trimmed = candidate.trim();
+    return trimmed === "*" || strip(trimmed) === target;
+  });
+}
+var init_etag = __esm({
+  "src/etag.ts"() {
+    "use strict";
+  }
+});
+
 // src/sessionHandlers/syncBridge.ts
 import { Worker } from "node:worker_threads";
 function getBridge(key, workerSource, workerData) {
@@ -22668,42 +22766,35 @@ var init_respClient = __esm({
   }
 });
 
-// src/sessionHandlers/valkeyHandler.ts
-var ValkeySessionHandler;
-var init_valkeyHandler = __esm({
-  "src/sessionHandlers/valkeyHandler.ts"() {
+// src/sessionHandlers/respSessionHandler.ts
+var RespSessionHandler;
+var init_respSessionHandler = __esm({
+  "src/sessionHandlers/respSessionHandler.ts"() {
     "use strict";
     init_respClient();
-    ValkeySessionHandler = class {
-      host;
-      port;
-      password;
-      prefix;
-      db;
-      constructor(config) {
-        this.host = config?.host ?? process.env.TINA4_SESSION_VALKEY_HOST ?? "127.0.0.1";
-        this.port = config?.port ?? (process.env.TINA4_SESSION_VALKEY_PORT ? parseInt(process.env.TINA4_SESSION_VALKEY_PORT, 10) : 6379);
-        this.password = config?.password ?? process.env.TINA4_SESSION_VALKEY_PASSWORD ?? "";
-        this.prefix = config?.prefix ?? process.env.TINA4_SESSION_VALKEY_PREFIX ?? "tina4:session:";
-        this.db = config?.db ?? (process.env.TINA4_SESSION_VALKEY_DB ? parseInt(process.env.TINA4_SESSION_VALKEY_DB, 10) : 0);
+    RespSessionHandler = class {
+      constructor(conn, label) {
+        this.conn = conn;
+        this.label = label;
       }
+      conn;
+      label;
       /**
-       * Execute a RESP command synchronously against the live Valkey server.
+       * Execute a RESP command synchronously against the live server.
        *
-       * Delegates to the shared {@link respCommandSync} transport: a genuine key miss
-       * yields `""`, and a transport/connection FAILURE (server unreachable, rejected
-       * AUTH, timeout) THROWS so the Session boundary can distinguish "not found"
-       * (silent) from "backend failed" (log-loud + degrade). Backend-failure parity.
+       * Delegates to the shared {@link respCommandSync} transport: a genuine key
+       * miss yields `""`, and a transport/connection FAILURE THROWS so the caller
+       * can distinguish "not found" from "backend failed". Backend-failure parity.
        */
       execSync(args) {
         return respCommandSync(
-          { host: this.host, port: this.port, password: this.password, db: this.db },
+          { host: this.conn.host, port: this.conn.port, password: this.conn.password, db: this.conn.db },
           args,
-          "Valkey"
+          this.label
         );
       }
       key(sessionId) {
-        return `${this.prefix}${sessionId}`;
+        return `${this.conn.prefix}${sessionId}`;
       }
       read(sessionId) {
         const raw = this.execSync(["GET", this.key(sessionId)]);
@@ -22714,7 +22805,7 @@ var init_valkeyHandler = __esm({
           return null;
         }
       }
-      write(sessionId, data, ttl) {
+      write(sessionId, data, ttl = 0) {
         const json = JSON.stringify(data);
         if (ttl > 0) {
           this.execSync(["SETEX", this.key(sessionId), String(ttl), json]);
@@ -22729,6 +22820,29 @@ var init_valkeyHandler = __esm({
   }
 });
 
+// src/sessionHandlers/valkeyHandler.ts
+var ValkeySessionHandler;
+var init_valkeyHandler = __esm({
+  "src/sessionHandlers/valkeyHandler.ts"() {
+    "use strict";
+    init_respSessionHandler();
+    ValkeySessionHandler = class extends RespSessionHandler {
+      constructor(config) {
+        super(
+          {
+            host: config?.host ?? process.env.TINA4_SESSION_VALKEY_HOST ?? "127.0.0.1",
+            port: config?.port ?? (process.env.TINA4_SESSION_VALKEY_PORT ? parseInt(process.env.TINA4_SESSION_VALKEY_PORT, 10) : 6379),
+            password: config?.password ?? process.env.TINA4_SESSION_VALKEY_PASSWORD ?? "",
+            prefix: config?.prefix ?? process.env.TINA4_SESSION_VALKEY_PREFIX ?? "tina4:session:",
+            db: config?.db ?? (process.env.TINA4_SESSION_VALKEY_DB ? parseInt(process.env.TINA4_SESSION_VALKEY_DB, 10) : 0)
+          },
+          "Valkey"
+        );
+      }
+    };
+  }
+});
+
 // src/sessionHandlers/memcachedHandler.ts
 import { createHash as createHash4 } from "node:crypto";
 var MAX_KEY_BYTES, MAX_RELATIVE_EXPTIME, MemcachedSessionHandler;
@@ -23744,7 +23858,7 @@ __export(session_exports, {
   sessionCookieName: () => sessionCookieName,
   sessionStrictMode: () => sessionStrictMode
 });
-import { createHash as createHash5, randomBytes as randomBytes5 } from "node:crypto";
+import { createHash as createHash5, randomBytes as randomBytes6 } from "node:crypto";
 import { existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync7, unlinkSync as unlinkSync5, readdirSync as readdirSync6 } from "node:fs";
 import { join as join14 } from "node:path";
 function isValidSessionId(sessionId) {
@@ -23762,6 +23876,20 @@ function resolveBackend(name) {
   }
   return normalised;
 }
+function fingerprint(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return void 0;
+  }
+}
+function fingerprints(data) {
+  const prints = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(data)) {
+    prints.set(key, fingerprint(value));
+  }
+  return prints;
+}
 function isSecureScheme(forwardedProto, socketEncrypted) {
   const forwarded = (forwardedProto ?? "").trim();
   if (forwarded !== "") {
@@ -23794,7 +23922,7 @@ var init_session = __esm({
     "use strict";
     init_logger();
     init_dotenv();
-    init_respClient();
+    init_respSessionHandler();
     init_valkeyHandler();
     init_memcachedHandler();
     init_mongoHandler();
@@ -23920,57 +24048,19 @@ var init_session = __esm({
         }
       }
     };
-    RedisSessionHandler = class {
-      host;
-      port;
-      password;
-      prefix;
-      db;
+    RedisSessionHandler = class extends RespSessionHandler {
       constructor(config) {
-        this.host = config?.redisHost ?? process.env.TINA4_SESSION_REDIS_HOST ?? "127.0.0.1";
-        this.port = config?.redisPort ?? (process.env.TINA4_SESSION_REDIS_PORT ? parseInt(process.env.TINA4_SESSION_REDIS_PORT, 10) : 6379);
-        this.password = config?.redisPassword ?? process.env.TINA4_SESSION_REDIS_PASSWORD ?? "";
-        this.prefix = config?.redisPrefix ?? process.env.TINA4_SESSION_REDIS_PREFIX ?? "tina4:session:";
-        this.db = config?.redisDb ?? (process.env.TINA4_SESSION_REDIS_DB ? parseInt(process.env.TINA4_SESSION_REDIS_DB, 10) : 0);
-      }
-      /**
-       * Execute a Redis command synchronously against the live server.
-       *
-       * Delegates to the shared {@link respCommandSync} transport: a genuine key miss
-       * yields `""`, and a transport/connection FAILURE (server unreachable, rejected
-       * AUTH, timeout) THROWS so the Session boundary can distinguish "not found"
-       * (silent) from "backend failed" (log-loud + degrade). Backend-failure parity.
-       */
-      execSync(args) {
-        return respCommandSync(
-          { host: this.host, port: this.port, password: this.password, db: this.db },
-          args,
+        super(
+          {
+            host: config?.redisHost ?? process.env.TINA4_SESSION_REDIS_HOST ?? "127.0.0.1",
+            port: config?.redisPort ?? (process.env.TINA4_SESSION_REDIS_PORT ? parseInt(process.env.TINA4_SESSION_REDIS_PORT, 10) : 6379),
+            password: config?.redisPassword ?? process.env.TINA4_SESSION_REDIS_PASSWORD ?? "",
+            prefix: config?.redisPrefix ?? process.env.TINA4_SESSION_REDIS_PREFIX ?? "tina4:session:",
+            db: config?.redisDb ?? (process.env.TINA4_SESSION_REDIS_DB ? parseInt(process.env.TINA4_SESSION_REDIS_DB, 10) : 0)
+          },
           "Redis"
         );
       }
-      key(sessionId) {
-        return `${this.prefix}${sessionId}`;
-      }
-      read(sessionId) {
-        const raw = this.execSync(["GET", this.key(sessionId)]);
-        if (!raw) return null;
-        try {
-          return JSON.parse(raw);
-        } catch {
-          return null;
-        }
-      }
-      write(sessionId, data, ttl = 0) {
-        const json = JSON.stringify(data);
-        if (ttl > 0) {
-          this.execSync(["SETEX", this.key(sessionId), String(ttl), json]);
-        } else {
-          this.execSync(["SET", this.key(sessionId), json]);
-        }
-      }
-      destroy(sessionId) {
-        this.execSync(["DEL", this.key(sessionId)]);
-      }
     };
     FLASH_PREFIX = "_flash_";
     Session = class {
@@ -23997,6 +24087,29 @@ var init_session = __esm({
        * Lets `start()` tell "no such session" from "the store is unreachable".
        */
       lastReadFailed = false;
+      /**
+       * What this request last saw of the stored record, one fingerprint per key:
+       * taken by start() and again by every save. save() compares the live data
+       * against it to find the keys THIS request changed.
+       */
+      loaded = /* @__PURE__ */ new Map();
+      /**
+       * True when this request is working on a record the store holds: start()
+       * adopted one, or a save has written one since. A save never re-creates such
+       * a record once another request has removed it.
+       */
+      stored = false;
+      /**
+       * True when clear() ran since the last save: the save then replaces the
+       * stored record instead of merging into it.
+       */
+      cleared = false;
+      /**
+       * True once this request found its session ended by another request (the
+       * record it loaded is gone). It stays ended for the rest of the request:
+       * regenerate() mints nothing either.
+       */
+      ended = false;
       constructor(backend, config) {
         const backendType = resolveBackend(
           backend ?? config?.backend ?? process.env.TINA4_SESSION_BACKEND ?? "file"
@@ -24141,6 +24254,10 @@ var init_session = __esm({
             const now2 = Math.floor(Date.now() / 1e3);
             this.data = { _created: now2, _accessed: now2 };
             this.dirty = false;
+            this.stored = false;
+            this.loaded = /* @__PURE__ */ new Map();
+            this.cleared = false;
+            this.ended = false;
             return sessionId;
           }
           if (loaded) {
@@ -24150,14 +24267,22 @@ var init_session = __esm({
             this.data._accessed = now2;
             this.dirty = false;
             this.safeWrite(this.sessionId, this.data, this.ttl);
+            this.stored = true;
+            this.loaded = fingerprints(this.data);
+            this.cleared = false;
+            this.ended = false;
             return sessionId;
           }
         }
-        this.sessionId = randomBytes5(16).toString("hex");
+        this.sessionId = randomBytes6(16).toString("hex");
         const now = Math.floor(Date.now() / 1e3);
         this.data = { _created: now, _accessed: now };
         this.dirty = false;
         this.safeWrite(this.sessionId, this.data, this.ttl);
+        this.stored = false;
+        this.loaded = /* @__PURE__ */ new Map();
+        this.cleared = false;
+        this.ended = false;
         return this.sessionId;
       }
       /**
@@ -24198,9 +24323,7 @@ var init_session = __esm({
         if (this.sessionId) {
           this.safeDestroy(this.sessionId);
         }
-        this.sessionId = null;
-        this.data = null;
-        this.dirty = false;
+        this.forget();
       }
       /**
        * Get all session data (excluding internal keys).
@@ -24223,6 +24346,7 @@ var init_session = __esm({
         const now = Math.floor(Date.now() / 1e3);
         this.data = { _created: this.data._created, _accessed: now };
         this.dirty = true;
+        this.cleared = true;
         this.save();
       }
       /**
@@ -24239,17 +24363,36 @@ var init_session = __esm({
        * session fixation — the pre-auth ID is destroyed and the data is carried
        * onto a fresh, unguessable ID. A backend destroy/write failure is logged
        * (never silent) but does not throw under the default policy.
+       *
+       * What is carried is the session as it is stored now with this request's
+       * own changes applied, the same merge save() does. If another request ended
+       * the session after this one loaded it (a logout, or a regenerate of its
+       * own), it stays ended: nothing is carried, no id is minted and null is
+       * returned, so no cookie goes out to replace the one that request sent.
        */
       regenerate() {
+        if (this.ended) return null;
+        if (this.sessionId && this.stored && this.data) {
+          const current = this.safeRead(this.sessionId);
+          if (!this.lastReadFailed) {
+            if (!current) {
+              this.forget();
+              this.ended = true;
+              return null;
+            }
+            if (!this.cleared) this.data = this.merged(current);
+          }
+        }
         const oldId = this.sessionId;
         const oldData = this.data;
         if (oldId) {
           this.safeDestroy(oldId);
         }
-        this.sessionId = randomBytes5(16).toString("hex");
+        this.sessionId = randomBytes6(16).toString("hex");
         this.data = oldData ?? { _created: Math.floor(Date.now() / 1e3), _accessed: Math.floor(Date.now() / 1e3) };
         this.data._accessed = Math.floor(Date.now() / 1e3);
         this.dirty = true;
+        this.stored = false;
         this.save();
         return this.sessionId;
       }
@@ -24325,17 +24468,84 @@ var init_session = __esm({
        *
        * Returns true on a successful persist, false if the backend was unreachable
        * (logged). The dirty flag is cleared only on success so a later save()
-       * retries once the backend recovers. A nothing-to-persist call returns true.
+       * retries once the backend recovers. A call with no session returns true.
+       *
+       * Other requests on the same session run while this one does, so the save
+       * writes only THIS request's changes, onto the record as it is stored now.
+       * Writing back the whole snapshot start() loaded undid whatever another
+       * request did in between: a logout (destroy, clear, regenerate) or a
+       * privilege change made with set(). A record removed since this request
+       * loaded it is never re-created: the session has ended, for this request
+       * too. A request that has not loaded a stored record (a new session, the new
+       * id regenerate() mints) writes its data whole, as before.
+       *
+       * A session the store already holds is re-written even when this request
+       * changed nothing: that write re-stamps the backend deadline to
+       * now + TINA4_SESSION_TTL, so a session expires after that span of INACTIVITY
+       * rather than that long after its last CHANGE (ADR-0087 — a session's expiry
+       * slides on activity). The re-write is the re-read, merged record, so sliding
+       * the deadline is concurrent-safe: it never clobbers another request's change,
+       * never re-creates an ended record, and TINA4_SESSION_TTL=0 still re-stamps a
+       * never-expires deadline (ADR-0027). A request with no stored session and no
+       * change writes nothing — there is no deadline to move.
        */
       save() {
         if (!this.sessionId || !this.data) return true;
-        if (!this.dirty) return true;
-        if (this.safeWrite(this.sessionId, this.data, this.ttl)) {
+        if (!this.dirty && !this.stored) return true;
+        let record = this.data;
+        if (this.stored) {
+          const current = this.safeRead(this.sessionId);
+          if (this.lastReadFailed) return false;
+          if (!current) {
+            this.forget();
+            this.ended = true;
+            return true;
+          }
+          if (!this.cleared) record = this.merged(current);
+        }
+        if (this.safeWrite(this.sessionId, record, this.ttl)) {
           this.dirty = false;
+          this.stored = true;
+          this.cleared = false;
+          this.loaded = fingerprints(this.data);
           return true;
         }
         return false;
       }
+      /**
+       * The stored record with this request's changes applied: every key whose
+       * value differs from what this request loaded or last saved, and the
+       * removal of every key it deleted. Keys it did not touch keep whatever is
+       * stored now.
+       */
+      merged(current) {
+        const data = this.data;
+        const record = { ...current };
+        for (const [key, value] of Object.entries(data)) {
+          const print = fingerprint(value);
+          if (print === void 0 || !this.loaded.has(key) || this.loaded.get(key) !== print) {
+            record[key] = value;
+          }
+        }
+        for (const key of this.loaded.keys()) {
+          if (!Object.prototype.hasOwnProperty.call(data, key)) {
+            delete record[key];
+          }
+        }
+        return record;
+      }
+      /**
+       * End the session for this request without touching the store: no id and
+       * no data, so nothing more is written and no cookie goes out for it.
+       */
+      forget() {
+        this.sessionId = null;
+        this.data = null;
+        this.dirty = false;
+        this.stored = false;
+        this.cleared = false;
+        this.loaded = /* @__PURE__ */ new Map();
+      }
     };
   }
 });
@@ -24380,14 +24590,6 @@ function headStripIntercept(rawReq, rawRes) {
 function isCompressibleContentType(contentType) {
   return COMPRESSIBLE_PREFIXES.some((prefix) => contentType.includes(prefix));
 }
-function etagMatchesInm(ifNoneMatch, etag) {
-  const strip = (tag) => tag.trim().replace(/^W\//, "");
-  const target = strip(etag);
-  return ifNoneMatch.split(",").some((candidate) => {
-    const trimmed = candidate.trim();
-    return trimmed === "*" || strip(trimmed) === target;
-  });
-}
 function maybeCompressResponse(body, rawReq, rawRes) {
   const acceptEncoding = String(rawReq.headers["accept-encoding"] ?? "");
   const contentTypeHeader = rawRes.getHeader("content-type");
@@ -24403,7 +24605,7 @@ function maybeCompressResponse(body, rawReq, rawRes) {
 }
 function responseIsNotModified(rawReq, rawRes, etag) {
   const ifNoneMatch = String(rawReq.headers["if-none-match"] ?? "");
-  if (ifNoneMatch) return etagMatchesInm(ifNoneMatch, etag);
+  if (ifNoneMatch) return etagMatches(ifNoneMatch, etag);
   const lastModifiedHeader = rawRes.getHeader("last-modified");
   if (typeof lastModifiedHeader !== "string") return false;
   const ifModifiedSince = String(rawReq.headers["if-modified-since"] ?? "");
@@ -24531,6 +24733,7 @@ var init_dispatchPipeline = __esm({
   "src/dispatchPipeline.ts"() {
     "use strict";
     init_logger();
+    init_etag();
     COMPRESSIBLE_PREFIXES = [
       "text/",
       "application/json",
@@ -24626,18 +24829,11 @@ function isNotModified(req2, etag, stat) {
   }
   return false;
 }
-function etagMatches(ifNoneMatch, etag) {
-  const strip = (tag) => tag.trim().replace(/^W\//, "");
-  const target = strip(etag);
-  return ifNoneMatch.split(",").some((candidate) => {
-    const trimmed = candidate.trim();
-    return trimmed === "*" || strip(trimmed) === target;
-  });
-}
 var COMPRESSIBLE_PREFIXES2, MIME_TYPES;
 var init_static = __esm({
   "src/static.ts"() {
     "use strict";
+    init_etag();
     COMPRESSIBLE_PREFIXES2 = [
       "text/",
       "application/json",
@@ -24718,11 +24914,11 @@ function formatSourceBlock(filename, lineno) {
   const lines = readSourceLines(filename, lineno);
   if (lines.length === 0) return "";
   const rows = lines.map(([num, text, isError]) => {
-    const bg = isError ? `background:${ERROR_LINE_BG};` : "";
+    const rowClass = isError ? "eo-line eo-line-err" : "eo-line";
     const marker = isError ? "&#x25b6;" : " ";
-    return `<div style="${bg}display:flex;padding:1px 0;"><span style="color:${YELLOW};min-width:3.5em;text-align:right;padding-right:1em;user-select:none;">${num}</span><span style="color:${RED};width:1.2em;user-select:none;">${marker}</span><span style="color:${TEXT};white-space:pre-wrap;tab-size:4;">${esc(text)}</span></div>`;
+    return `<div class="${rowClass}"><span class="eo-ln">${num}</span><span class="eo-marker">${marker}</span><span class="eo-code">${esc(text)}</span></div>`;
   }).join("\n");
-  return `<div style="background:${SURFACE};border-radius:6px;padding:12px;overflow-x:auto;font-family:'SF Mono','Fira Code','Consolas',monospace;font-size:13px;line-height:1.6;">` + rows + `</div>`;
+  return `<div class="eo-source">` + rows + `</div>`;
 }
 function formatFrame(frame, capturedAt = 0) {
   const source = frame.file && frame.line > 0 ? formatSourceBlock(frame.file, frame.line) : "";
@@ -24734,23 +24930,23 @@ function formatFrame(frame, capturedAt = 0) {
       if (mtime > capturedAt + 0.5) {
         const d = new Date(mtime * 1e3);
         const mtimeIso = `${String(d.getUTCHours()).padStart(2, "0")}:${String(d.getUTCMinutes()).padStart(2, "0")}:${String(d.getUTCSeconds()).padStart(2, "0")}`;
-        staleBadge = ` <span style="background:${PEACH};color:${BG};padding:1px 8px;border-radius:3px;font-size:11px;font-weight:700;margin-left:6px;">FILE MODIFIED @ ${mtimeIso} UTC &mdash; source may not match what failed</span>`;
+        staleBadge = ` <span class="eo-stale">FILE MODIFIED @ ${mtimeIso} UTC &mdash; source may not match what failed</span>`;
       }
     } catch {
     }
   }
-  return `<div style="margin-bottom:16px;"><div style="margin-bottom:4px;"><span style="color:${BLUE};">${esc(frame.file)}</span><span style="color:${SUBTEXT};"> : </span><span style="color:${YELLOW};">${frame.line}</span><span style="color:${SUBTEXT};"> in </span><span style="color:${GREEN};">${esc(frame.func)}</span>` + staleBadge + `</div>` + source + `</div>`;
+  return `<div class="eo-frame"><div class="eo-frame-head"><span class="eo-file">${esc(frame.file)}</span><span class="eo-sep"> : </span><span class="eo-lineno">${frame.line}</span><span class="eo-sep"> in </span><span class="eo-fn">${esc(frame.func)}</span>` + staleBadge + `</div>` + source + `</div>`;
 }
 function collapsible(title, content, openByDefault = false) {
   const open = openByDefault ? " open" : "";
-  return `<details style="margin-top:16px;"${open}><summary style="cursor:pointer;color:${LAVENDER};font-weight:600;font-size:15px;padding:8px 0;user-select:none;">${esc(title)}</summary><div style="padding:8px 0;">${content}</div></details>`;
+  return `<details class="eo-details"${open}><summary class="eo-summary">${esc(title)}</summary><div class="eo-details-body">${content}</div></details>`;
 }
 function table(pairs) {
-  if (pairs.length === 0) return `<span style="color:${SUBTEXT};">None</span>`;
+  if (pairs.length === 0) return `<span class="eo-none">None</span>`;
   const rows = pairs.map(
-    ([key, val]) => `<tr><td style="color:${PEACH};padding:4px 16px 4px 0;vertical-align:top;white-space:nowrap;">${esc(key)}</td><td style="color:${TEXT};padding:4px 0;word-break:break-all;">${esc(val)}</td></tr>`
+    ([key, val]) => `<tr><td class="eo-key">${esc(key)}</td><td class="eo-val">${esc(val)}</td></tr>`
   ).join("");
-  return `<table style="border-collapse:collapse;width:100%;">${rows}</table>`;
+  return `<table class="eo-table">${rows}</table>`;
 }
 function renderErrorOverlay(error2, request) {
   const capturedAt = Date.now() / 1e3;
@@ -24763,7 +24959,7 @@ function renderErrorOverlay(error2, request) {
   }
   const hidden = frames.length - Math.min(frames.length, MAX_FRAMES);
   if (hidden > 0) {
-    framesHtml += `<div style="color:${SUBTEXT};padding:8px 0;font-size:13px;">&#8230; ${hidden} more stack frames hidden (truncated at ${MAX_FRAMES})</div>`;
+    framesHtml += `<div class="eo-hidden-frames">&#8230; ${hidden} more stack frames hidden (truncated at ${MAX_FRAMES})</div>`;
   }
   const requestPairs = [];
   if (request != null) {
@@ -24800,37 +24996,72 @@ function renderErrorOverlay(error2, request) {
   ];
   const envSection = collapsible("Environment", table(envPairs));
   const stackSection = collapsible("Stack Trace", framesHtml, true);
+  const nonce = currentCspNonce();
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Tina4 Error \u2014 ${esc(excType)}</title>
-<style>
-*{margin:0;padding:0;box-sizing:border-box;}
-body{background:${BG};color:${TEXT};font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;padding:24px;line-height:1.5;}
+<style nonce="${nonce}">
+${overlayStylesheet()}
 </style>
 </head>
 <body>
-<div style="max-width:960px;margin:0 auto;">
-  <div style="margin-bottom:24px;">
-    <div style="display:flex;align-items:center;gap:12px;margin-bottom:12px;">
-      <span style="background:${RED};color:${BG};padding:4px 12px;border-radius:4px;font-weight:700;font-size:13px;text-transform:uppercase;">Error</span>
-      <span style="color:${SUBTEXT};font-size:14px;">Tina4 Debug Overlay</span>
+<div class="eo-wrap">
+  <div class="eo-header">
+    <div class="eo-badge-row">
+      <span class="eo-badge">Error</span>
+      <span class="eo-sub">Tina4 Debug Overlay</span>
     </div>
-    <h1 style="color:${RED};font-size:28px;font-weight:700;margin-bottom:8px;">${esc(excType)}</h1>
-    <p style="color:${TEXT};font-size:18px;font-family:'SF Mono','Fira Code','Consolas',monospace;background:${SURFACE};padding:12px 16px;border-radius:6px;border-left:4px solid ${RED};">${esc(excMsg)}</p>
+    <h1 class="eo-type">${esc(excType)}</h1>
+    <p class="eo-msg">${esc(excMsg)}</p>
   </div>
   ${stackSection}
   ${requestSection}
   ${envSection}
-  <div style="margin-top:32px;padding-top:16px;border-top:1px solid ${OVERLAY};color:${SUBTEXT};font-size:12px;">
+  <div class="eo-footer">
     Tina4 Debug Overlay &mdash; This page is only shown in debug mode. Set TINA4_DEBUG=false in production.
   </div>
 </div>
 </body>
 </html>`;
 }
+function overlayStylesheet() {
+  return `
+*{margin:0;padding:0;box-sizing:border-box;}
+body{background:${BG};color:${TEXT};font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;padding:24px;line-height:1.5;}
+.eo-wrap{max-width:960px;margin:0 auto;}
+.eo-header{margin-bottom:24px;}
+.eo-badge-row{display:flex;align-items:center;gap:12px;margin-bottom:12px;}
+.eo-badge{background:${RED};color:${BG};padding:4px 12px;border-radius:4px;font-weight:700;font-size:13px;text-transform:uppercase;}
+.eo-sub{color:${SUBTEXT};font-size:14px;}
+.eo-type{color:${RED};font-size:28px;font-weight:700;margin-bottom:8px;}
+.eo-msg{color:${TEXT};font-size:18px;font-family:'SF Mono','Fira Code','Consolas',monospace;background:${SURFACE};padding:12px 16px;border-radius:6px;border-left:4px solid ${RED};}
+.eo-footer{margin-top:32px;padding-top:16px;border-top:1px solid ${OVERLAY};color:${SUBTEXT};font-size:12px;}
+.eo-source{background:${SURFACE};border-radius:6px;padding:12px;overflow-x:auto;font-family:'SF Mono','Fira Code','Consolas',monospace;font-size:13px;line-height:1.6;}
+.eo-line{display:flex;padding:1px 0;}
+.eo-line-err{background:${ERROR_LINE_BG};}
+.eo-ln{color:${YELLOW};min-width:3.5em;text-align:right;padding-right:1em;user-select:none;}
+.eo-marker{color:${RED};width:1.2em;user-select:none;}
+.eo-code{color:${TEXT};white-space:pre-wrap;tab-size:4;}
+.eo-frame{margin-bottom:16px;}
+.eo-frame-head{margin-bottom:4px;}
+.eo-file{color:${BLUE};}
+.eo-sep{color:${SUBTEXT};}
+.eo-lineno{color:${YELLOW};}
+.eo-fn{color:${GREEN};}
+.eo-stale{background:${PEACH};color:${BG};padding:1px 8px;border-radius:3px;font-size:11px;font-weight:700;margin-left:6px;}
+.eo-details{margin-top:16px;}
+.eo-summary{cursor:pointer;color:${LAVENDER};font-weight:600;font-size:15px;padding:8px 0;user-select:none;}
+.eo-details-body{padding:8px 0;}
+.eo-table{border-collapse:collapse;width:100%;}
+.eo-key{color:${PEACH};padding:4px 16px 4px 0;vertical-align:top;white-space:nowrap;}
+.eo-val{color:${TEXT};padding:4px 0;word-break:break-all;}
+.eo-none{color:${SUBTEXT};}
+.eo-hidden-frames{color:${SUBTEXT};padding:8px 0;font-size:13px;}
+`;
+}
 function isDebugMode() {
   return isTruthy(process.env.TINA4_DEBUG);
 }
@@ -24839,6 +25070,7 @@ var init_errorOverlay = __esm({
   "src/errorOverlay.ts"() {
     "use strict";
     init_dotenv();
+    init_csp();
     MAX_FRAMES = 50;
     SENSITIVE_KEY_RE = /password|passwd|secret|token|authorization|cookie|key/i;
     REDACTED2 = "[redacted]";
@@ -25214,6 +25446,25 @@ Generated by DevMailbox.seed() for development purposes.`,
   }
 });
 
+// src/upstreamResponse.ts
+async function relayUpstreamResponse(res, upstream) {
+  const raw = await upstream.text();
+  const status2 = upstream.status || 200;
+  try {
+    res.json(JSON.parse(raw), status2);
+  } catch {
+    res.raw.writeHead(status2, {
+      "Content-Type": upstream.headers.get("content-type") ?? "text/plain; charset=utf-8"
+    });
+    res.raw.end(raw);
+  }
+}
+var init_upstreamResponse = __esm({
+  "src/upstreamResponse.ts"() {
+    "use strict";
+  }
+});
+
 // src/metrics.ts
 import * as fs3 from "node:fs";
 import * as path2 from "node:path";
@@ -25429,6 +25680,7 @@ var init_feedback = __esm({
     "use strict";
     init_auth();
     init_devAdmin();
+    init_upstreamResponse();
     RATE_LIMIT_WINDOW_SEC = 3600;
     RATE_LIMIT_MAX = 5;
     _rateLimitHits = /* @__PURE__ */ new Map();
@@ -25475,16 +25727,7 @@ var init_feedback = __esm({
         return;
       }
       clearTimeout(timer);
-      const raw = await upstream.text();
-      const status2 = upstream.status || 200;
-      try {
-        res.json(JSON.parse(raw), status2);
-      } catch {
-        res.raw.writeHead(status2, {
-          "Content-Type": upstream.headers.get("content-type") ?? "text/plain; charset=utf-8"
-        });
-        res.raw.end(raw);
-      }
+      await relayUpstreamResponse(res, upstream);
     };
     __feedbackDirname = dirname7(fileURLToPath2(import.meta.url));
     WIDGET_BUNDLE_PATH = resolve9(__feedbackDirname, "__feedback", "widget.js");
@@ -25534,6 +25777,38 @@ var init_version = __esm({
   }
 });
 
+// ../cli/src/util.ts
+function parseFlags(args, booleanFlags) {
+  const flags = {};
+  const positional = [];
+  let i = 0;
+  while (i < args.length) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      const key = arg.slice(2);
+      if (booleanFlags?.has(key)) {
+        flags[key] = true;
+        i += 1;
+      } else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
+        flags[key] = args[i + 1];
+        i += 2;
+      } else {
+        flags[key] = true;
+        i += 1;
+      }
+    } else {
+      positional.push(arg);
+      i += 1;
+    }
+  }
+  return { flags, positional };
+}
+var init_util = __esm({
+  "../cli/src/util.ts"() {
+    "use strict";
+  }
+});
+
 // ../cli/src/commands/generate.ts
 var generate_exports = {};
 __export(generate_exports, {
@@ -25798,28 +26073,7 @@ function parseCliArgs(args) {
     "json",
     "dry-run"
   ]);
-  const flags = {};
-  const positional = [];
-  let i = 0;
-  while (i < args.length) {
-    if (args[i].startsWith("--")) {
-      const key = args[i].slice(2);
-      if (booleanFlags.has(key)) {
-        flags[key] = true;
-        i += 1;
-      } else if (i + 1 < args.length && !args[i + 1].startsWith("--")) {
-        flags[key] = args[i + 1];
-        i += 2;
-      } else {
-        flags[key] = true;
-        i += 1;
-      }
-    } else {
-      positional.push(args[i]);
-      i += 1;
-    }
-  }
-  return { flags, positional };
+  return parseFlags(args, booleanFlags);
 }
 function parseEvery(every) {
   if (!every || every === true) return 60;
@@ -26667,7 +26921,11 @@ export default async function (req: Tina4Request, res: Tina4Response) {
     `{% extends "base.twig" %}
 {% block title %}Login{% endblock %}
 {% block content %}
-<div class="container mt-4" style="max-width:400px">
+{# No inline style attribute: a nonce lets this <style> block run under the
+   strict default Content-Security-Policy. csp_nonce() is a built-in Frond global
+   that returns this response's nonce (ADR-0088). #}
+<style nonce="{{ csp_nonce() }}">.auth-form{max-width:400px;margin:0 auto}</style>
+<div class="container mt-4 auth-form">
     <h1>Login</h1>
     <form method="post" action="/api/auth/login">
         {{ form_token() }}
@@ -26691,7 +26949,8 @@ export default async function (req: Tina4Request, res: Tina4Response) {
     `{% extends "base.twig" %}
 {% block title %}Register{% endblock %}
 {% block content %}
-<div class="container mt-4" style="max-width:400px">
+<style nonce="{{ csp_nonce() }}">.auth-form{max-width:400px;margin:0 auto}</style>
+<div class="container mt-4 auth-form">
     <h1>Register</h1>
     <form method="post" action="/api/auth/register">
         {{ form_token() }}
@@ -27380,6 +27639,7 @@ var FIELD_TYPE_MAP, SQL_RESERVED_TABLE_NAMES, RESOLUTION_ENVELOPE_VERSION, __res
 var init_generate = __esm({
   "../cli/src/commands/generate.ts"() {
     "use strict";
+    init_util();
     FIELD_TYPE_MAP = {
       string: { orm: '"string"', sql: "VARCHAR(255)", defaultVal: "''" },
       str: { orm: '"string"', sql: "VARCHAR(255)", defaultVal: "''" },
@@ -27627,7 +27887,7 @@ import * as path3 from "node:path";
 import * as os from "node:os";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createRequire as createRequire8 } from "node:module";
-import { randomBytes as randomBytes6 } from "node:crypto";
+import { randomBytes as randomBytes7 } from "node:crypto";
 function reqSibling(pkg) {
   return req(`../../${pkg}/src/index.ts`);
 }
@@ -28949,7 +29209,7 @@ var init_mcp = __esm({
       // ── Session lifecycle + protocol negotiation ──────────────────
       /** Mint a new session id and remember it. Called on `initialize`. */
       openSession() {
-        const sid = randomBytes6(16).toString("hex");
+        const sid = randomBytes7(16).toString("hex");
         this._sessions.set(sid, Date.now());
         return sid;
       }
@@ -30998,6 +31258,7 @@ __export(websocket_exports, {
   CLOSE_NORMAL: () => CLOSE_NORMAL,
   CLOSE_POLICY_VIOLATION: () => CLOSE_POLICY_VIOLATION,
   CLOSE_PROTOCOL_ERROR: () => CLOSE_PROTOCOL_ERROR,
+  MessageAssembler: () => MessageAssembler,
   OP_BINARY: () => OP_BINARY,
   OP_CLOSE: () => OP_CLOSE,
   OP_CONTINUATION: () => OP_CONTINUATION,
@@ -31255,21 +31516,24 @@ function serveWebSocketRoute(req2, socket, head) {
     state.closed = true;
     void Promise.resolve().then(() => conn._onClose ? conn._onClose() : handler(conn, "close", "")).catch((e) => Log.error(`WebSocket close handler error: ${e.message}`)).finally(() => wsRouteManager.remove(conn.id));
   };
+  const assembler = new MessageAssembler();
   socket.on("data", (chunk) => {
     buffer = Buffer.concat([buffer, chunk]);
     while (buffer.length > 0) {
       const frame = parseFrame(buffer);
       if (!frame) break;
       buffer = buffer.subarray(frame.bytesConsumed);
-      switch (frame.opcode) {
+      const whole = assembler.push(frame);
+      if (!whole) continue;
+      switch (whole.opcode) {
         case OP_TEXT: {
-          const text = frame.payload.toString("utf-8");
+          const text = whole.payload.toString("utf-8");
           void Promise.resolve().then(() => conn._onMessage ? conn._onMessage(text) : handler(conn, "message", text)).catch((e) => Log.error(`WebSocket message handler error: ${e.message}`));
           break;
         }
         case OP_PING:
           try {
-            socket.write(buildFrame(OP_PONG, frame.payload));
+            socket.write(buildFrame(OP_PONG, whole.payload));
           } catch {
           }
           break;
@@ -31288,7 +31552,7 @@ function serveWebSocketRoute(req2, socket, head) {
   socket.on("error", fireClose);
   return true;
 }
-var MAGIC_STRING, OP_CONTINUATION, OP_TEXT, OP_BINARY, OP_CLOSE, OP_PING, OP_PONG, CLOSE_NORMAL, CLOSE_GOING_AWAY, CLOSE_PROTOCOL_ERROR, CLOSE_POLICY_VIOLATION, WebSocketServer, WsRouteManager, wsRouteManager, DevReloadWsManager, devReloadWs;
+var MAGIC_STRING, OP_CONTINUATION, OP_TEXT, OP_BINARY, OP_CLOSE, OP_PING, OP_PONG, CLOSE_NORMAL, CLOSE_GOING_AWAY, CLOSE_PROTOCOL_ERROR, CLOSE_POLICY_VIOLATION, MessageAssembler, WebSocketServer, WsRouteManager, wsRouteManager, DevReloadWsManager, devReloadWs;
 var init_websocket = __esm({
   "src/websocket.ts"() {
     "use strict";
@@ -31307,6 +31571,30 @@ var init_websocket = __esm({
     CLOSE_GOING_AWAY = 1001;
     CLOSE_PROTOCOL_ERROR = 1002;
     CLOSE_POLICY_VIOLATION = 1008;
+    MessageAssembler = class {
+      parts = [];
+      opcode = 0;
+      push(frame) {
+        if (frame.opcode >= 8) return { opcode: frame.opcode, payload: frame.payload };
+        if (frame.opcode === OP_CONTINUATION) {
+          if (!this.opcode) return null;
+          this.parts.push(frame.payload);
+          if (!frame.fin) return null;
+          const whole = { opcode: this.opcode, payload: Buffer.concat(this.parts) };
+          this.parts = [];
+          this.opcode = 0;
+          return whole;
+        }
+        if (frame.fin) {
+          this.parts = [];
+          this.opcode = 0;
+          return { opcode: frame.opcode, payload: frame.payload };
+        }
+        this.opcode = frame.opcode;
+        this.parts = [frame.payload];
+        return null;
+      }
+    };
     WebSocketServer = class {
       port;
       server = null;
@@ -31749,6 +32037,15 @@ var init_websocket = __esm({
           this.emit("error", err, client);
         });
       }
+      assemblers = /* @__PURE__ */ new WeakMap();
+      assemblerFor(client) {
+        let a = this.assemblers.get(client);
+        if (!a) {
+          a = new MessageAssembler();
+          this.assemblers.set(client, a);
+        }
+        return a;
+      }
       processBuffer(client, buffer, setBuffer) {
         let remaining = buffer;
         while (remaining.length > 0) {
@@ -31756,15 +32053,17 @@ var init_websocket = __esm({
           if (!frame) break;
           remaining = remaining.subarray(frame.bytesConsumed);
           client.lastActivity = Date.now();
-          switch (frame.opcode) {
+          const whole = this.assemblerFor(client).push(frame);
+          if (!whole) continue;
+          switch (whole.opcode) {
             case OP_TEXT:
-              this.emit("message", client, frame.payload.toString("utf-8"));
+              this.emit("message", client, whole.payload.toString("utf-8"));
               break;
             case OP_BINARY:
-              this.emit("message", client, frame.payload);
+              this.emit("message", client, whole.payload);
               break;
             case OP_PING: {
-              const pongFrame = buildFrame(OP_PONG, frame.payload);
+              const pongFrame = buildFrame(OP_PONG, whole.payload);
               try {
                 client.socket.write(pongFrame);
               } catch {
@@ -36142,16 +36441,7 @@ async function proxyToSupervisor(req2, res, downstreamPath) {
     return;
   }
   clearTimeout(timer);
-  const raw = await upstream.text();
-  const status2 = upstream.status || 200;
-  try {
-    res.json(JSON.parse(raw), status2);
-  } catch {
-    res.raw.writeHead(status2, {
-      "Content-Type": upstream.headers.get("content-type") ?? "text/plain; charset=utf-8"
-    });
-    res.raw.end(raw);
-  }
+  await relayUpstreamResponse(res, upstream);
 }
 function resolveDevEnvVar(key) {
   const live = process.env[key];
@@ -36593,6 +36883,7 @@ var init_devAdmin = __esm({
   "src/devAdmin.ts"() {
     "use strict";
     init_devMailbox();
+    init_upstreamResponse();
     init_dotenv();
     init_metrics();
     init_feedback();
@@ -36694,8 +36985,8 @@ var init_devAdmin = __esm({
        * Duplicate errors (same message) increment count and update last_seen.
        */
       static capture(errorType, message, traceback = "", file = "", line = 0) {
-        const fingerprint = `${errorType}|${message}|${file}|${line}`;
-        const existing = this.errors.find((e) => e.fingerprint === fingerprint);
+        const fingerprint2 = `${errorType}|${message}|${file}|${line}`;
+        const existing = this.errors.find((e) => e.fingerprint === fingerprint2);
         const now = (/* @__PURE__ */ new Date()).toISOString();
         if (existing) {
           existing.count = (existing.count || 1) + 1;
@@ -36708,7 +36999,7 @@ var init_devAdmin = __esm({
             message,
             stack: traceback || void 0,
             resolved: false,
-            ...{ fingerprint, error_type: errorType, file, line, count: 1, first_seen: now, last_seen: now }
+            ...{ fingerprint: fingerprint2, error_type: errorType, file, line, count: 1, first_seen: now, last_seen: now }
           });
           if (this.errors.length > this.maxErrors) {
             this.errors = this.errors.slice(-this.maxErrors);
@@ -39387,7 +39678,7 @@ function swaggerEnabled() {
 }
 function createSwaggerRoutes(getSpec) {
   const serveUi = async (_req, res) => {
-    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json", res.cspNonce));
   };
   return [
     {
@@ -39431,13 +39722,13 @@ var SWAGGER_UI_HTML;
 var init_ui = __esm({
   "../swagger/src/ui.ts"() {
     "use strict";
-    SWAGGER_UI_HTML = (specUrl) => `<!DOCTYPE html>
+    SWAGGER_UI_HTML = (specUrl, nonce) => `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
   <title>Tina4 API Documentation</title>
   <link rel="stylesheet" href="${swaggerUiCdn()}/swagger-ui.css">
-  <style>
+  <style nonce="${nonce}">
     body { margin: 0; background: #fafafa; }
     .topbar { display: none !important; }
   </style>
@@ -39445,7 +39736,7 @@ var init_ui = __esm({
 <body>
   <div id="swagger-ui"></div>
   <script src="${swaggerUiCdn()}/swagger-ui-bundle.js"></script>
-  <script>
+  <script nonce="${nonce}">
     SwaggerUIBundle({
       url: "${specUrl}",
       dom_id: '#swagger-ui',
@@ -39485,7 +39776,7 @@ __export(sso_exports, {
   SsoError: () => SsoError,
   liveSessionIdentity: () => liveSessionIdentity
 });
-import { createHash as createHash9, randomBytes as randomBytes7, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { createHash as createHash9, randomBytes as randomBytes8, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 function expiresAt(tokens) {
   const lifetime = Number(tokens.expires_in ?? 0);
   return lifetime > 0 ? Math.floor(Date.now() / 1e3) + lifetime : 0;
@@ -39613,9 +39904,9 @@ var init_sso = __esm({
       async login(requestOrSession, returnTo = "/") {
         const session = this.session(requestOrSession);
         if (!session) throw new SsoError("SSO login requires a Tina4 Session");
-        const state = randomBytes7(32).toString("base64url");
-        const nonce = randomBytes7(32).toString("base64url");
-        const verifier = randomBytes7(64).toString("base64url");
+        const state = randomBytes8(32).toString("base64url");
+        const nonce = randomBytes8(32).toString("base64url");
+        const verifier = randomBytes8(64).toString("base64url");
         const challenge = createHash9("sha256").update(verifier).digest("base64url");
         session.set(_Sso.PENDING_KEY, { state, nonce, verifier, return_to: _Sso.safeReturn(returnTo), created_at: Math.floor(Date.now() / 1e3) });
         const metadata = await this.discover();
@@ -39843,7 +40134,7 @@ var init_docsAutoDiscovery = __esm({
 });
 
 // src/server.ts
-import { randomBytes as randomBytes8 } from "node:crypto";
+import { randomBytes as randomBytes9 } from "node:crypto";
 import { resolve as resolve19, dirname as dirname13, join as join30, relative as relative10 } from "node:path";
 import { existsSync as existsSync25, readdirSync as readdirSync17, readFileSync as readFileSync23, statSync as statSync18 } from "node:fs";
 import { isatty } from "node:tty";
@@ -40023,7 +40314,8 @@ function isDevMode() {
 }
 async function renderErrorPage(code, data, templatesDir) {
   try {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     const templateFile = `errors/${code}.twig`;
     const getCachedFrond = (dir) => {
       let instance = frondCache.get(dir);
@@ -40139,6 +40431,7 @@ function resolveTemplate(pathname, templatesDir) {
 }
 function renderLandingPage(port = 7148) {
   const version = TINA4_VERSION;
+  const nonce = currentCspNonce();
   const galleryItems = [
     { id: "rest-api", icon: "&#128640;", name: "REST API", desc: "A simple JSON API with GET and POST endpoints", accent: "accent-blue", tryUrl: "/api/gallery/hello" },
     { id: "orm", icon: "&#128451;", name: "ORM", desc: "Product model with CRUD endpoints", accent: "accent-green", tryUrl: "/api/gallery/products" },
@@ -40153,7 +40446,7 @@ function renderLandingPage(port = 7148) {
     const isDeployed = deployed[item.id] === true;
     const tryBtn = isDeployed ? `<a href="${item.tryUrl}" class="gbtn gbtn-try" target="_blank">Try It</a>` : "";
     const viewBtn = isDeployed ? `<a href="${item.tryUrl}" class="gbtn gbtn-view" target="_blank">View</a>` : "";
-    const deployBtn = isDeployed ? `<span class="gbtn gbtn-deployed">Deployed</span>` : `<button class="gbtn gbtn-deploy" onclick="deployGallery('${item.id}')">Deploy</button>`;
+    const deployBtn = isDeployed ? `<span class="gbtn gbtn-deployed">Deployed</span>` : `<button class="gbtn gbtn-deploy" data-deploy="${item.id}">Deploy</button>`;
     return `<div class="gallery-card">
             <div class="accent ${item.accent}"></div>
             <div class="icon">${item.icon}</div>
@@ -40168,7 +40461,7 @@ function renderLandingPage(port = 7148) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Tina4NodeJs</title>
-<style>
+<style nonce="${nonce}">
 *{margin:0;padding:0;box-sizing:border-box}
 body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:#0f172a;color:#e2e8f0;min-height:100vh;display:flex;flex-direction:column;align-items:center;position:relative}
 .bg-watermark{position:fixed;bottom:-5%;right:-5%;width:45%;opacity:0.04;pointer-events:none;z-index:0}
@@ -40207,6 +40500,11 @@ h1{font-size:3rem;font-weight:700;margin-bottom:0.25rem;letter-spacing:-1px}
 .gbtn-deployed{background:transparent;border:1px solid #22c55e;color:#22c55e;cursor:default;font-size:0.7rem}
 @keyframes wiggle{0%{transform:rotate(0deg)}15%{transform:rotate(14deg)}30%{transform:rotate(-10deg)}45%{transform:rotate(8deg)}60%{transform:rotate(-4deg)}75%{transform:rotate(2deg)}100%{transform:rotate(0deg)}}
 .star-wiggle{display:inline-block;transform-origin:center}
+.gallery-cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:1rem}
+.tok-comment{color:#64748b}
+.tok-kw{color:#c084fc}
+.tok-str{color:#4ade80}
+.tok-fn{color:#38bdf8}
 </style>
 </head>
 <body>
@@ -40232,23 +40530,23 @@ h1{font-size:3rem;font-weight:700;margin-bottom:0.25rem;letter-spacing:-1px}
 <div class="section">
     <div class="card">
         <h2>Getting Started</h2>
-        <pre class="code-block"><code><span style="color:#64748b">// app.ts</span>
-<span style="color:#c084fc">import</span> { startServer, Router } <span style="color:#c084fc">from</span> <span style="color:#4ade80">"tina4-nodejs"</span>;
+        <pre class="code-block"><code><span class="tok-comment">// app.ts</span>
+<span class="tok-kw">import</span> { startServer, Router } <span class="tok-kw">from</span> <span class="tok-str">"tina4-nodejs"</span>;
 
-Router.get(<span style="color:#4ade80">"/hello"</span>, <span style="color:#c084fc">async</span> (<span style="color:#38bdf8">req</span>, <span style="color:#38bdf8">res</span>) =&gt; {
-    <span style="color:#c084fc">return</span> res.json({ message: <span style="color:#4ade80">"Hello World!"</span> });
+Router.get(<span class="tok-str">"/hello"</span>, <span class="tok-kw">async</span> (<span class="tok-fn">req</span>, <span class="tok-fn">res</span>) =&gt; {
+    <span class="tok-kw">return</span> res.json({ message: <span class="tok-str">"Hello World!"</span> });
 });
 
-startServer({ port: 7148 });  <span style="color:#64748b">// starts on port 7148</span></code></pre>
+startServer({ port: 7148 });  <span class="tok-comment">// starts on port 7148</span></code></pre>
     </div>
 </div>
 <div class="gallery">
     <h2 id="gallery">What You Can Build</h2>
-    <div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:1rem;">
+    <div class="gallery-cards">
         ${galleryCards}
     </div>
 </div>
-<script>
+<script nonce="${nonce}">
 function deployGallery(name) {
     if (!confirm('Deploy the "' + name + '" gallery example into your project? This will copy files into src/.')) return;
     fetch('/__dev/api/gallery/deploy', {
@@ -40283,6 +40581,12 @@ function deployGallery(name) {
     }
     setTimeout(doWiggle,3000);
 })();
+// CSP-clean wiring: no inline onclick handlers \u2014 bind every Deploy button from
+// its data-deploy attribute (a nonce covers script elements, not event-handler
+// attributes).
+document.querySelectorAll('.gbtn-deploy[data-deploy]').forEach(function(btn){
+    btn.addEventListener('click', function(){ deployGallery(btn.dataset.deploy); });
+});
 </script>
 </body>
 </html>`;
@@ -40499,7 +40803,7 @@ async function renderDispatchError(err, req2, res, templatesDir) {
       }
     }
   }
-  const requestId = Log.getRequestId() ?? randomBytes8(4).toString("hex");
+  const requestId = Log.getRequestId() ?? randomBytes9(4).toString("hex");
   if (wantsJson(req2)) {
     const body = negotiatedErrorBody(500, "Internal Server Error", requestId);
     res.raw.writeHead(500, { "Content-Type": "application/json" });
@@ -40570,7 +40874,7 @@ function serveStaticAsset(ctx) {
   return false;
 }
 async function serveNotFound(ctx) {
-  const requestId = Log.getRequestId() ?? randomBytes8(4).toString("hex");
+  const requestId = Log.getRequestId() ?? randomBytes9(4).toString("hex");
   if (wantsJson(ctx.req)) {
     const body = negotiatedErrorBody(404, "Not Found", requestId);
     ctx.res.raw.writeHead(404, httpReason(404), { "Content-Type": "application/json" });
@@ -40593,7 +40897,8 @@ async function buildDispatchContext(router, base) {
   const templatesDir = resolve19(root, "src/templates");
   let frondEngine = null;
   try {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     frondEngine = new Frond2(templatesDir);
   } catch {
   }
@@ -40703,9 +41008,13 @@ async function dispatchInner(ctx, rawReq, rawRes, requestId) {
   }
 }
 async function runDispatch(ctx, rawReq, rawRes) {
-  const requestId = Log.sanitizeRequestId(rawReq.headers["x-request-id"]) ?? randomBytes8(4).toString("hex");
+  const requestId = Log.sanitizeRequestId(rawReq.headers["x-request-id"]) ?? randomBytes9(4).toString("hex");
   if (!rawRes.headersSent) rawRes.setHeader("x-request-id", requestId);
-  return Log.runWithRequestId(requestId, () => dispatchInner(ctx, rawReq, rawRes, requestId));
+  const requestNonce = generateNonce();
+  return Log.runWithRequestId(
+    requestId,
+    () => runWithCspNonce(requestNonce, () => dispatchInner(ctx, rawReq, rawRes, requestId))
+  );
 }
 function loopbackBindHosts(host) {
   const normalized = host.trim().replace(/^\[|\]$/g, "").toLowerCase();
@@ -40832,7 +41141,8 @@ async function startServer(config) {
   let frondEngine = null;
   setDefaultTemplatesDir(templatesDir);
   try {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     frondEngine = new Frond2(templatesDir);
     router.addRoute({
       method: "GET",
@@ -40973,10 +41283,12 @@ async function startServer(config) {
           }
         });
         aiServer.on("error", (err) => {
-          if (err.code === "EADDRINUSE") {
+          if (err?.code === "EADDRINUSE") {
             Log.warning(`Test port ${testPort} in use \u2014 skipping`);
-            aiServer = null;
+          } else {
+            Log.error(`Test port ${testPort} bind failed (${err?.code ?? err}) \u2014 skipping`);
           }
+          aiServer = null;
         });
         aiServer.listen(testPort, host);
       }
@@ -41191,6 +41503,7 @@ var init_server = __esm({
     init_static();
     init_dotenv();
     init_errorOverlay();
+    init_csp();
     init_health();
     init_rateLimiter();
     init_logger();
@@ -41440,7 +41753,7 @@ var init_mqttMessage = __esm({
 // src/mqtt.ts
 import net2 from "node:net";
 import tls from "node:tls";
-import { randomBytes as randomBytes9 } from "node:crypto";
+import { randomBytes as randomBytes10 } from "node:crypto";
 import { existsSync as existsSync26, readFileSync as readFileSync24 } from "node:fs";
 var MqttError, MqttTimeoutError, CONNECT, CONNACK, PUBLISH, PUBACK, SUBSCRIBE, SUBACK, PINGREQ, PINGRESP, DISCONNECT, PROTOCOL_LEVEL, DEFAULT_PORT, DEFAULT_TLS_PORT, DEFAULT_URL, DEFAULT_KEEPALIVE, SUBSCRIPTION_REFUSED, MAX_REMAINING_LENGTH, QOS2_REFUSED_MESSAGE, CONNACK_RETURN_CODES, Mqtt;
 var init_mqtt = __esm({
@@ -41528,7 +41841,7 @@ var init_mqtt = __esm({
         this.caFile = options.caFile ?? (Env.str("TINA4_MQTT_CA_FILE") || null);
         this.tlsVerify = options.tlsVerify ?? Env.bool("TINA4_MQTT_TLS_VERIFY", true);
         let cid = options.clientId ?? (Env.str("TINA4_MQTT_CLIENT_ID") || null);
-        if (cid === null || cid === "") cid = "tina4-" + randomBytes9(8).toString("hex");
+        if (cid === null || cid === "") cid = "tina4-" + randomBytes10(8).toString("hex");
         this.clientId = cid;
         this.keepalive = options.keepalive ?? Env.int("TINA4_MQTT_KEEPALIVE", DEFAULT_KEEPALIVE);
         this.cleanSession = options.cleanSession ?? true;
@@ -42642,7 +42955,7 @@ var init_ssrf = __esm({
 import http from "node:http";
 import https from "node:https";
 import { URL as URL2 } from "node:url";
-import { randomBytes as randomBytes10 } from "node:crypto";
+import { randomBytes as randomBytes11 } from "node:crypto";
 import { promises as fsp, createWriteStream } from "node:fs";
 import { basename as basename6 } from "node:path";
 import { pipeline } from "node:stream/promises";
@@ -43034,7 +43347,7 @@ var init_api = __esm({
           return { http_code: null, body: null, headers: {}, error: "upload requires filePath or fileBytes" };
         }
         const partContentType = guessContentType(uploadName);
-        const boundary = "----Tina4Boundary" + randomBytes10(16).toString("hex");
+        const boundary = "----Tina4Boundary" + randomBytes11(16).toString("hex");
         const bodyBuffer = buildMultipartBody(boundary, fieldName, uploadName, content, partContentType, extraFields);
         const contentType = `multipart/form-data; boundary=${boundary}`;
         return this.execute("POST", this.buildUrl(path10), bodyBuffer, contentType, headers);
@@ -45998,7 +46311,7 @@ import {
   createHmac as createHmac4,
   createPrivateKey,
   createSign as createSign2,
-  randomBytes as randomBytes11
+  randomBytes as randomBytes12
 } from "node:crypto";
 function encodeBase64Url(value) {
   return Buffer.from(value).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
@@ -46078,7 +46391,7 @@ function encryptPayload(payload, subscription) {
   ]);
   const prkKey = hmac(authSecret, sharedSecret);
   const ikm = hkdfExpand(prkKey, keyInfo, 32);
-  const salt = randomBytes11(16);
+  const salt = randomBytes12(16);
   const contentPrk = hmac(salt, ikm);
   const cek = hkdfExpand(contentPrk, Buffer.from("Content-Encoding: aes128gcm\0", "ascii"), 16);
   const nonce = hkdfExpand(contentPrk, Buffer.from("Content-Encoding: nonce\0", "ascii"), 12);
@@ -48835,6 +49148,7 @@ __export(index_exports, {
   cacheStats: () => cacheStats,
   checkPassword: () => checkPassword,
   clearCache: () => clearCache,
+  clearCurrentNonce: () => clearCurrentNonce,
   computeAcceptKey: () => computeAcceptKey,
   container: () => container,
   cors: () => cors,
@@ -48846,6 +49160,8 @@ __export(index_exports, {
   createMessenger: () => createMessenger,
   createRequest: () => createRequest,
   createResponse: () => createResponse,
+  cspNonce: () => cspNonce,
+  currentCspNonce: () => currentCspNonce,
   decodeRequest: () => decodeRequest,
   defaultContext: () => defaultContext,
   defaultRouter: () => defaultRouter,
@@ -48871,6 +49187,7 @@ __export(index_exports, {
   feedbackWhitelist: () => feedbackWhitelist,
   fts5Supported: () => fts5Supported,
   generateContext: () => generateContext,
+  generateNonce: () => generateNonce,
   generateVapidKeys: () => generateVapidKeys,
   get: () => get,
   getDefaultDevServer: () => getDefaultDevServer,
@@ -48893,6 +49210,7 @@ __export(index_exports, {
   httpReason: () => httpReason,
   inContainer: () => inContainer,
   injectFeedbackWidget: () => injectFeedbackWidget,
+  injectNonceIntoCsp: () => injectNonceIntoCsp,
   installAll: () => installAll,
   installSelected: () => installSelected,
   isBannerSuppressed: () => isBannerSuppressed,
@@ -48947,6 +49265,7 @@ __export(index_exports, {
   resetTrustedProxyCache: () => resetTrustedProxyCache,
   resolveAlgorithm: () => resolveAlgorithm,
   resolveClientIp: () => resolveClientIp,
+  resolveCspHeader: () => resolveCspHeader,
   resolveFrameworkVersion: () => resolveFrameworkVersion,
   resolvePortAndHost: () => resolvePortAndHost,
   resolveStringMiddleware: () => resolveStringMiddleware,
@@ -48954,12 +49273,14 @@ __export(index_exports, {
   responseCache: () => responseCache,
   runAll: () => runAll,
   runRouteMiddlewares: () => runRouteMiddlewares,
+  runWithCspNonce: () => runWithCspNonce,
   runtimeDir: () => runtimeDir,
   saveUpload: () => saveUpload,
   schemaFromParams: () => schemaFromParams,
   selectablePids: () => selectablePids,
   serveWebSocketRoute: () => serveWebSocketRoute,
   sessionCookieName: () => sessionCookieName,
+  setCurrentNonce: () => setCurrentNonce,
   setDefaultTemplatesDir: () => setDefaultTemplatesDir,
   setFrond: () => setFrond,
   showMenu: () => showMenu,
@@ -49025,6 +49346,7 @@ var init_index = __esm({
     init_wsdl();
     init_htmlElement();
     init_errorOverlay();
+    init_csp();
     init_ai();
     init_sso();
     init_push();
@@ -49215,6 +49537,7 @@ export {
   cacheStats,
   checkPassword,
   clearCache,
+  clearCurrentNonce,
   computeAcceptKey,
   container,
   cors,
@@ -49226,6 +49549,8 @@ export {
   createMessenger,
   createRequest,
   createResponse,
+  cspNonce,
+  currentCspNonce,
   decodeRequest,
   defaultContext,
   defaultRouter,
@@ -49251,6 +49576,7 @@ export {
   feedbackWhitelist,
   fts5Supported,
   generateContext,
+  generateNonce,
   generateVapidKeys,
   get,
   getDefaultDevServer,
@@ -49273,6 +49599,7 @@ export {
   httpReason,
   inContainer,
   injectFeedbackWidget,
+  injectNonceIntoCsp,
   installAll,
   installSelected,
   isBannerSuppressed,
@@ -49327,6 +49654,7 @@ export {
   resetTrustedProxyCache,
   resolveAlgorithm,
   resolveClientIp,
+  resolveCspHeader,
   resolveFrameworkVersion,
   resolvePortAndHost,
   resolveStringMiddleware,
@@ -49334,12 +49662,14 @@ export {
   responseCache,
   runAll,
   runRouteMiddlewares,
+  runWithCspNonce,
   runtimeDir,
   saveUpload,
   schemaFromParams,
   selectablePids,
   serveWebSocketRoute,
   sessionCookieName,
+  setCurrentNonce,
   setDefaultTemplatesDir,
   setFrond,
   showMenu,