tina4-nodejs 3.13.142 → 3.13.143

package/packages/core/dist/index.js

@@ -17430,6 +17430,73 @@ var init_trustedProxy = __esm({
   }
 });
 
+// src/csp.ts
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
+import { randomBytes as randomBytes4 } from "node:crypto";
+function generateNonce() {
+  return randomBytes4(16).toString("base64");
+}
+function runWithCspNonce(nonce, fn) {
+  return nonceStore.run({ nonce }, fn);
+}
+function setCurrentNonce(nonce) {
+  const store = nonceStore.getStore();
+  if (store) store.nonce = nonce;
+  else nonceFallback = nonce;
+}
+function clearCurrentNonce() {
+  setCurrentNonce(void 0);
+}
+function currentCspNonce() {
+  const store = nonceStore.getStore();
+  let value = store ? store.nonce : nonceFallback;
+  if (!value) {
+    value = generateNonce();
+    if (store) store.nonce = value;
+    else nonceFallback = value;
+  }
+  return value;
+}
+function cspNonce() {
+  return currentCspNonce();
+}
+function injectNonceIntoCsp(csp, nonce) {
+  const token = `'nonce-${nonce}'`;
+  const directives = [];
+  for (const rawPart of csp.split(";")) {
+    const part = rawPart.trim();
+    if (!part) continue;
+    const spaceAt = part.search(/\s/);
+    const name = (spaceAt === -1 ? part : part.slice(0, spaceAt)).toLowerCase();
+    const value = spaceAt === -1 ? "" : part.slice(spaceAt + 1).trim();
+    directives.push([name, value]);
+  }
+  const defaultEntry = directives.find(([name]) => name === "default-src");
+  const defaultValue = defaultEntry && defaultEntry[1] ? defaultEntry[1] : "'self'";
+  for (const directive of ["style-src", "script-src"]) {
+    const existing = directives.find(([name]) => name === directive);
+    if (existing) {
+      if (!existing[1].split(/\s+/).includes(token)) {
+        existing[1] = `${existing[1]} ${token}`.trim();
+      }
+    } else {
+      directives.push([directive, `${defaultValue} ${token}`.trim()]);
+    }
+  }
+  return directives.map(([name, value]) => value ? `${name} ${value}` : name).join("; ");
+}
+function resolveCspHeader(nonce) {
+  const csp = process.env.TINA4_CSP || "default-src 'self'";
+  return injectNonceIntoCsp(csp, nonce);
+}
+var nonceStore, nonceFallback;
+var init_csp = __esm({
+  "src/csp.ts"() {
+    "use strict";
+    nonceStore = new AsyncLocalStorage3();
+  }
+});
+
 // ../frond/src/engine.ts
 var engine_exports = {};
 __export(engine_exports, {
@@ -17439,9 +17506,10 @@ __export(engine_exports, {
   expressionFormCache: () => expressionFormCache,
   filterChainCache: () => filterChainCache,
   pathParseCache: () => pathParseCache,
+  setCspNonceProvider: () => setCspNonceProvider,
   setFormTokenSessionId: () => setFormTokenSessionId
 });
-import { createHash as createHash3, createHmac as createHmac3, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash3, createHmac as createHmac3, randomBytes as randomBytes5 } from "node:crypto";
 import { readFileSync as readFileSync6, existsSync as existsSync7, statSync as statSync6, realpathSync } from "node:fs";
 import { join as join10, resolve as resolve6, isAbsolute as isAbsolute4, sep as sep3 } from "node:path";
 function jsonText(value) {
@@ -18508,6 +18576,9 @@ function _b64url(data) {
 function setFormTokenSessionId(sessionId) {
   _formTokenSessionId = sessionId || "";
 }
+function setCspNonceProvider(fn) {
+  _cspNonceProvider = fn;
+}
 function _buildFormTokenJwt(descriptor = "") {
   const secret = process.env.TINA4_SECRET ?? "";
   const secretBytes = Buffer.byteLength(secret, "utf8");
@@ -18519,7 +18590,7 @@ function _buildFormTokenJwt(descriptor = "") {
   const ttlMinutes = parseInt(process.env.TINA4_TOKEN_LIMIT || "60", 10);
   const header = { alg: "HS256", typ: "JWT" };
   const now = Math.floor(Date.now() / 1e3);
-  const payload = { type: "form", nonce: randomBytes4(8).toString("hex"), iat: now, exp: now + ttlMinutes * 60 };
+  const payload = { type: "form", nonce: randomBytes5(8).toString("hex"), iat: now, exp: now + ttlMinutes * 60 };
   if (descriptor) {
     if (descriptor.includes("|")) {
       const [ctx, ref] = descriptor.split("|", 2);
@@ -18546,7 +18617,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FAST_FILTERS, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, EXPR_EVALUATORS, expressionFormCache, VarRef, JS_SAFE_RE, MEDIA_TYPE_RE, SANDBOX_EXPR_KEYWORDS, SANDBOX_IDENT_RE, SANDBOX_STRING_RE, UNSAFE_KEYS, BUILTIN_FILTERS, _formTokenSessionId, Frond;
+var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FAST_FILTERS, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, EXPR_EVALUATORS, expressionFormCache, VarRef, JS_SAFE_RE, MEDIA_TYPE_RE, SANDBOX_EXPR_KEYWORDS, SANDBOX_IDENT_RE, SANDBOX_STRING_RE, UNSAFE_KEYS, BUILTIN_FILTERS, _formTokenSessionId, _cspNonceProvider, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -18900,6 +18971,7 @@ var init_engine = __esm({
       js_escape: (v) => new SafeString(jsEscape(v))
     };
     _formTokenSessionId = "";
+    _cspNonceProvider = () => "";
     Frond = class _Frond {
       // ── Class-level registries ──────────────────────────────────
       // Persist globals, filters, and tests across hot-reloads and at
@@ -19053,6 +19125,7 @@ var init_engine = __esm({
         this.globals.formTokenValue = (descriptor) => _generateFormTokenValue(descriptor || "");
         this.globals.form_token_value = (descriptor) => _generateFormTokenValue(descriptor || "");
         this.globals.dump = (value) => renderDump(value);
+        this.globals.csp_nonce = () => _cspNonceProvider();
         for (const [k, v] of _Frond.classFilters) this.filters[k] = v;
         for (const [k, v] of _Frond.classGlobals) this.globals[k] = v;
         for (const [k, v] of _Frond.classTests) this.tests[k] = v;
@@ -20316,7 +20389,8 @@ async function getFrond() {
   const dir = _defaultTemplatesDir ?? nodePath.resolve(process.cwd(), "src/templates");
   let engine = _frondCache.get(dir);
   if (!engine) {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     engine = new Frond2(dir);
     _frondCache.set(dir, engine);
   }
@@ -20327,7 +20401,8 @@ async function getFrameworkFrond() {
   const frameworkDir = nodePath.resolve(nodePath.dirname(import.meta.url.replace("file://", "")), "..", "templates");
   if (!_frameworkFrond && fs2.existsSync(frameworkDir)) {
     try {
-      const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      setCspNonceProvider2(currentCspNonce);
       _frameworkFrond = new Frond2(frameworkDir);
     } catch {
       return null;
@@ -20427,6 +20502,7 @@ function createResponse(res) {
     return response;
   };
   response.raw = res;
+  response.cspNonce = currentCspNonce();
   response.json = function(data, status2) {
     if (res.headersSent) return response;
     if (status2 !== void 0) res.statusCode = status2;
@@ -20572,7 +20648,8 @@ function createResponse(res) {
   };
   response.render = async function(templateName, data, status2, templateDir) {
     try {
-      const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+      setCspNonceProvider2(currentCspNonce);
       const dir = templateDir ?? _defaultTemplatesDir ?? nodePath.resolve(process.cwd(), "src/templates");
       let engine = _frondCache.get(dir);
       if (!engine) {
@@ -20690,6 +20767,7 @@ var HEADER_TOKEN, _frondCache, _defaultTemplatesDir, _globalFrond, _frameworkFro
 var init_response = __esm({
   "src/response.ts"() {
     "use strict";
+    init_csp();
     HEADER_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
     _frondCache = /* @__PURE__ */ new Map();
     _defaultTemplatesDir = null;
@@ -20901,6 +20979,7 @@ var init_middleware = __esm({
     init_dotenv();
     init_router();
     init_trustedProxy();
+    init_csp();
     init_response();
     MiddlewareChain = class {
       middlewares = [];
@@ -21333,12 +21412,18 @@ var init_middleware = __esm({
        * overrides, WITHOUT Strict-Transport-Security, which depends on the
        * request's scheme. Also what a transport rejection carries (ADR-0068
        * section 4), written before the scheme is known.
+       *
+       * Content-Security-Policy always carries a per-response nonce in style-src
+       * AND script-src (ADR-0088), read from the request async-context (minted on
+       * first access), so the framework's own inline content runs under the strict
+       * default without 'unsafe-inline'. The nonce is random per response, so a
+       * caller comparing this header must assert its STRUCTURE, never a byte string.
        */
       static canonicalHeaders() {
         return {
           "X-Frame-Options": process.env.TINA4_FRAME_OPTIONS ?? "SAMEORIGIN",
           "X-Content-Type-Options": "nosniff",
-          "Content-Security-Policy": process.env.TINA4_CSP ?? "default-src 'self'",
+          "Content-Security-Policy": resolveCspHeader(currentCspNonce()),
           "Referrer-Policy": process.env.TINA4_REFERRER_POLICY ?? "strict-origin-when-cross-origin",
           "X-XSS-Protection": "0",
           "Permissions-Policy": process.env.TINA4_PERMISSIONS_POLICY ?? "camera=(), microphone=(), geolocation=()"
@@ -21380,7 +21465,7 @@ var init_middleware = __esm({
       static warnCspDefaultOnce() {
         if (_SecurityHeadersMiddleware.cspDefaultWarned) return;
         _SecurityHeadersMiddleware.cspDefaultWarned = true;
-        const message = `TINA4_CSP is not set, so Tina4 is serving the default Content-Security-Policy "default-src 'self'" on every response. That default blocks runtime-injected inline styles, cross-origin fonts/scripts/CDNs, data: URIs, and cross-origin WebSocket/XHR (e.g. a separate API or LiveKit host). If your app uses any of these, set TINA4_CSP to a policy that allows them (see https://tina4.com); to silence this notice without changing behaviour, set TINA4_CSP="default-src 'self'".`;
+        const message = `TINA4_CSP is not set, so Tina4 is serving the default Content-Security-Policy "default-src 'self'" on every response. The framework injects a per-response nonce into style-src and script-src, so its own inline <style>/<script> (and your templates using the csp_nonce() Frond global) work under this policy. The default still blocks cross-origin fonts/scripts/CDNs, data: URIs, and cross-origin WebSocket/XHR (e.g. a separate API or LiveKit host). If your app uses any of these, set TINA4_CSP to a policy that allows them (see https://tina4.com); to silence this notice without changing behaviour, set TINA4_CSP="default-src 'self'".`;
         try {
           Log.warning(message);
         } catch {
@@ -23773,7 +23858,7 @@ __export(session_exports, {
   sessionCookieName: () => sessionCookieName,
   sessionStrictMode: () => sessionStrictMode
 });
-import { createHash as createHash5, randomBytes as randomBytes5 } from "node:crypto";
+import { createHash as createHash5, randomBytes as randomBytes6 } from "node:crypto";
 import { existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync7, unlinkSync as unlinkSync5, readdirSync as readdirSync6 } from "node:fs";
 import { join as join14 } from "node:path";
 function isValidSessionId(sessionId) {
@@ -23791,6 +23876,20 @@ function resolveBackend(name) {
   }
   return normalised;
 }
+function fingerprint(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return void 0;
+  }
+}
+function fingerprints(data) {
+  const prints = /* @__PURE__ */ new Map();
+  for (const [key, value] of Object.entries(data)) {
+    prints.set(key, fingerprint(value));
+  }
+  return prints;
+}
 function isSecureScheme(forwardedProto, socketEncrypted) {
   const forwarded = (forwardedProto ?? "").trim();
   if (forwarded !== "") {
@@ -23988,6 +24087,29 @@ var init_session = __esm({
        * Lets `start()` tell "no such session" from "the store is unreachable".
        */
       lastReadFailed = false;
+      /**
+       * What this request last saw of the stored record, one fingerprint per key:
+       * taken by start() and again by every save. save() compares the live data
+       * against it to find the keys THIS request changed.
+       */
+      loaded = /* @__PURE__ */ new Map();
+      /**
+       * True when this request is working on a record the store holds: start()
+       * adopted one, or a save has written one since. A save never re-creates such
+       * a record once another request has removed it.
+       */
+      stored = false;
+      /**
+       * True when clear() ran since the last save: the save then replaces the
+       * stored record instead of merging into it.
+       */
+      cleared = false;
+      /**
+       * True once this request found its session ended by another request (the
+       * record it loaded is gone). It stays ended for the rest of the request:
+       * regenerate() mints nothing either.
+       */
+      ended = false;
       constructor(backend, config) {
         const backendType = resolveBackend(
           backend ?? config?.backend ?? process.env.TINA4_SESSION_BACKEND ?? "file"
@@ -24132,6 +24254,10 @@ var init_session = __esm({
             const now2 = Math.floor(Date.now() / 1e3);
             this.data = { _created: now2, _accessed: now2 };
             this.dirty = false;
+            this.stored = false;
+            this.loaded = /* @__PURE__ */ new Map();
+            this.cleared = false;
+            this.ended = false;
             return sessionId;
           }
           if (loaded) {
@@ -24141,14 +24267,22 @@ var init_session = __esm({
             this.data._accessed = now2;
             this.dirty = false;
             this.safeWrite(this.sessionId, this.data, this.ttl);
+            this.stored = true;
+            this.loaded = fingerprints(this.data);
+            this.cleared = false;
+            this.ended = false;
             return sessionId;
           }
         }
-        this.sessionId = randomBytes5(16).toString("hex");
+        this.sessionId = randomBytes6(16).toString("hex");
         const now = Math.floor(Date.now() / 1e3);
         this.data = { _created: now, _accessed: now };
         this.dirty = false;
         this.safeWrite(this.sessionId, this.data, this.ttl);
+        this.stored = false;
+        this.loaded = /* @__PURE__ */ new Map();
+        this.cleared = false;
+        this.ended = false;
         return this.sessionId;
       }
       /**
@@ -24189,9 +24323,7 @@ var init_session = __esm({
         if (this.sessionId) {
           this.safeDestroy(this.sessionId);
         }
-        this.sessionId = null;
-        this.data = null;
-        this.dirty = false;
+        this.forget();
       }
       /**
        * Get all session data (excluding internal keys).
@@ -24214,6 +24346,7 @@ var init_session = __esm({
         const now = Math.floor(Date.now() / 1e3);
         this.data = { _created: this.data._created, _accessed: now };
         this.dirty = true;
+        this.cleared = true;
         this.save();
       }
       /**
@@ -24230,17 +24363,36 @@ var init_session = __esm({
        * session fixation — the pre-auth ID is destroyed and the data is carried
        * onto a fresh, unguessable ID. A backend destroy/write failure is logged
        * (never silent) but does not throw under the default policy.
+       *
+       * What is carried is the session as it is stored now with this request's
+       * own changes applied, the same merge save() does. If another request ended
+       * the session after this one loaded it (a logout, or a regenerate of its
+       * own), it stays ended: nothing is carried, no id is minted and null is
+       * returned, so no cookie goes out to replace the one that request sent.
        */
       regenerate() {
+        if (this.ended) return null;
+        if (this.sessionId && this.stored && this.data) {
+          const current = this.safeRead(this.sessionId);
+          if (!this.lastReadFailed) {
+            if (!current) {
+              this.forget();
+              this.ended = true;
+              return null;
+            }
+            if (!this.cleared) this.data = this.merged(current);
+          }
+        }
         const oldId = this.sessionId;
         const oldData = this.data;
         if (oldId) {
           this.safeDestroy(oldId);
         }
-        this.sessionId = randomBytes5(16).toString("hex");
+        this.sessionId = randomBytes6(16).toString("hex");
         this.data = oldData ?? { _created: Math.floor(Date.now() / 1e3), _accessed: Math.floor(Date.now() / 1e3) };
         this.data._accessed = Math.floor(Date.now() / 1e3);
         this.dirty = true;
+        this.stored = false;
         this.save();
         return this.sessionId;
       }
@@ -24316,17 +24468,84 @@ var init_session = __esm({
        *
        * Returns true on a successful persist, false if the backend was unreachable
        * (logged). The dirty flag is cleared only on success so a later save()
-       * retries once the backend recovers. A nothing-to-persist call returns true.
+       * retries once the backend recovers. A call with no session returns true.
+       *
+       * Other requests on the same session run while this one does, so the save
+       * writes only THIS request's changes, onto the record as it is stored now.
+       * Writing back the whole snapshot start() loaded undid whatever another
+       * request did in between: a logout (destroy, clear, regenerate) or a
+       * privilege change made with set(). A record removed since this request
+       * loaded it is never re-created: the session has ended, for this request
+       * too. A request that has not loaded a stored record (a new session, the new
+       * id regenerate() mints) writes its data whole, as before.
+       *
+       * A session the store already holds is re-written even when this request
+       * changed nothing: that write re-stamps the backend deadline to
+       * now + TINA4_SESSION_TTL, so a session expires after that span of INACTIVITY
+       * rather than that long after its last CHANGE (ADR-0087 — a session's expiry
+       * slides on activity). The re-write is the re-read, merged record, so sliding
+       * the deadline is concurrent-safe: it never clobbers another request's change,
+       * never re-creates an ended record, and TINA4_SESSION_TTL=0 still re-stamps a
+       * never-expires deadline (ADR-0027). A request with no stored session and no
+       * change writes nothing — there is no deadline to move.
        */
       save() {
         if (!this.sessionId || !this.data) return true;
-        if (!this.dirty) return true;
-        if (this.safeWrite(this.sessionId, this.data, this.ttl)) {
+        if (!this.dirty && !this.stored) return true;
+        let record = this.data;
+        if (this.stored) {
+          const current = this.safeRead(this.sessionId);
+          if (this.lastReadFailed) return false;
+          if (!current) {
+            this.forget();
+            this.ended = true;
+            return true;
+          }
+          if (!this.cleared) record = this.merged(current);
+        }
+        if (this.safeWrite(this.sessionId, record, this.ttl)) {
           this.dirty = false;
+          this.stored = true;
+          this.cleared = false;
+          this.loaded = fingerprints(this.data);
           return true;
         }
         return false;
       }
+      /**
+       * The stored record with this request's changes applied: every key whose
+       * value differs from what this request loaded or last saved, and the
+       * removal of every key it deleted. Keys it did not touch keep whatever is
+       * stored now.
+       */
+      merged(current) {
+        const data = this.data;
+        const record = { ...current };
+        for (const [key, value] of Object.entries(data)) {
+          const print = fingerprint(value);
+          if (print === void 0 || !this.loaded.has(key) || this.loaded.get(key) !== print) {
+            record[key] = value;
+          }
+        }
+        for (const key of this.loaded.keys()) {
+          if (!Object.prototype.hasOwnProperty.call(data, key)) {
+            delete record[key];
+          }
+        }
+        return record;
+      }
+      /**
+       * End the session for this request without touching the store: no id and
+       * no data, so nothing more is written and no cookie goes out for it.
+       */
+      forget() {
+        this.sessionId = null;
+        this.data = null;
+        this.dirty = false;
+        this.stored = false;
+        this.cleared = false;
+        this.loaded = /* @__PURE__ */ new Map();
+      }
     };
   }
 });
@@ -24695,11 +24914,11 @@ function formatSourceBlock(filename, lineno) {
   const lines = readSourceLines(filename, lineno);
   if (lines.length === 0) return "";
   const rows = lines.map(([num, text, isError]) => {
-    const bg = isError ? `background:${ERROR_LINE_BG};` : "";
+    const rowClass = isError ? "eo-line eo-line-err" : "eo-line";
     const marker = isError ? "&#x25b6;" : " ";
-    return `<div style="${bg}display:flex;padding:1px 0;"><span style="color:${YELLOW};min-width:3.5em;text-align:right;padding-right:1em;user-select:none;">${num}</span><span style="color:${RED};width:1.2em;user-select:none;">${marker}</span><span style="color:${TEXT};white-space:pre-wrap;tab-size:4;">${esc(text)}</span></div>`;
+    return `<div class="${rowClass}"><span class="eo-ln">${num}</span><span class="eo-marker">${marker}</span><span class="eo-code">${esc(text)}</span></div>`;
   }).join("\n");
-  return `<div style="background:${SURFACE};border-radius:6px;padding:12px;overflow-x:auto;font-family:'SF Mono','Fira Code','Consolas',monospace;font-size:13px;line-height:1.6;">` + rows + `</div>`;
+  return `<div class="eo-source">` + rows + `</div>`;
 }
 function formatFrame(frame, capturedAt = 0) {
   const source = frame.file && frame.line > 0 ? formatSourceBlock(frame.file, frame.line) : "";
@@ -24711,23 +24930,23 @@ function formatFrame(frame, capturedAt = 0) {
       if (mtime > capturedAt + 0.5) {
         const d = new Date(mtime * 1e3);
         const mtimeIso = `${String(d.getUTCHours()).padStart(2, "0")}:${String(d.getUTCMinutes()).padStart(2, "0")}:${String(d.getUTCSeconds()).padStart(2, "0")}`;
-        staleBadge = ` <span style="background:${PEACH};color:${BG};padding:1px 8px;border-radius:3px;font-size:11px;font-weight:700;margin-left:6px;">FILE MODIFIED @ ${mtimeIso} UTC &mdash; source may not match what failed</span>`;
+        staleBadge = ` <span class="eo-stale">FILE MODIFIED @ ${mtimeIso} UTC &mdash; source may not match what failed</span>`;
       }
     } catch {
     }
   }
-  return `<div style="margin-bottom:16px;"><div style="margin-bottom:4px;"><span style="color:${BLUE};">${esc(frame.file)}</span><span style="color:${SUBTEXT};"> : </span><span style="color:${YELLOW};">${frame.line}</span><span style="color:${SUBTEXT};"> in </span><span style="color:${GREEN};">${esc(frame.func)}</span>` + staleBadge + `</div>` + source + `</div>`;
+  return `<div class="eo-frame"><div class="eo-frame-head"><span class="eo-file">${esc(frame.file)}</span><span class="eo-sep"> : </span><span class="eo-lineno">${frame.line}</span><span class="eo-sep"> in </span><span class="eo-fn">${esc(frame.func)}</span>` + staleBadge + `</div>` + source + `</div>`;
 }
 function collapsible(title, content, openByDefault = false) {
   const open = openByDefault ? " open" : "";
-  return `<details style="margin-top:16px;"${open}><summary style="cursor:pointer;color:${LAVENDER};font-weight:600;font-size:15px;padding:8px 0;user-select:none;">${esc(title)}</summary><div style="padding:8px 0;">${content}</div></details>`;
+  return `<details class="eo-details"${open}><summary class="eo-summary">${esc(title)}</summary><div class="eo-details-body">${content}</div></details>`;
 }
 function table(pairs) {
-  if (pairs.length === 0) return `<span style="color:${SUBTEXT};">None</span>`;
+  if (pairs.length === 0) return `<span class="eo-none">None</span>`;
   const rows = pairs.map(
-    ([key, val]) => `<tr><td style="color:${PEACH};padding:4px 16px 4px 0;vertical-align:top;white-space:nowrap;">${esc(key)}</td><td style="color:${TEXT};padding:4px 0;word-break:break-all;">${esc(val)}</td></tr>`
+    ([key, val]) => `<tr><td class="eo-key">${esc(key)}</td><td class="eo-val">${esc(val)}</td></tr>`
   ).join("");
-  return `<table style="border-collapse:collapse;width:100%;">${rows}</table>`;
+  return `<table class="eo-table">${rows}</table>`;
 }
 function renderErrorOverlay(error2, request) {
   const capturedAt = Date.now() / 1e3;
@@ -24740,7 +24959,7 @@ function renderErrorOverlay(error2, request) {
   }
   const hidden = frames.length - Math.min(frames.length, MAX_FRAMES);
   if (hidden > 0) {
-    framesHtml += `<div style="color:${SUBTEXT};padding:8px 0;font-size:13px;">&#8230; ${hidden} more stack frames hidden (truncated at ${MAX_FRAMES})</div>`;
+    framesHtml += `<div class="eo-hidden-frames">&#8230; ${hidden} more stack frames hidden (truncated at ${MAX_FRAMES})</div>`;
   }
   const requestPairs = [];
   if (request != null) {
@@ -24777,37 +24996,72 @@ function renderErrorOverlay(error2, request) {
   ];
   const envSection = collapsible("Environment", table(envPairs));
   const stackSection = collapsible("Stack Trace", framesHtml, true);
+  const nonce = currentCspNonce();
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
 <title>Tina4 Error \u2014 ${esc(excType)}</title>
-<style>
-*{margin:0;padding:0;box-sizing:border-box;}
-body{background:${BG};color:${TEXT};font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;padding:24px;line-height:1.5;}
+<style nonce="${nonce}">
+${overlayStylesheet()}
 </style>
 </head>
 <body>
-<div style="max-width:960px;margin:0 auto;">
-  <div style="margin-bottom:24px;">
-    <div style="display:flex;align-items:center;gap:12px;margin-bottom:12px;">
-      <span style="background:${RED};color:${BG};padding:4px 12px;border-radius:4px;font-weight:700;font-size:13px;text-transform:uppercase;">Error</span>
-      <span style="color:${SUBTEXT};font-size:14px;">Tina4 Debug Overlay</span>
+<div class="eo-wrap">
+  <div class="eo-header">
+    <div class="eo-badge-row">
+      <span class="eo-badge">Error</span>
+      <span class="eo-sub">Tina4 Debug Overlay</span>
     </div>
-    <h1 style="color:${RED};font-size:28px;font-weight:700;margin-bottom:8px;">${esc(excType)}</h1>
-    <p style="color:${TEXT};font-size:18px;font-family:'SF Mono','Fira Code','Consolas',monospace;background:${SURFACE};padding:12px 16px;border-radius:6px;border-left:4px solid ${RED};">${esc(excMsg)}</p>
+    <h1 class="eo-type">${esc(excType)}</h1>
+    <p class="eo-msg">${esc(excMsg)}</p>
   </div>
   ${stackSection}
   ${requestSection}
   ${envSection}
-  <div style="margin-top:32px;padding-top:16px;border-top:1px solid ${OVERLAY};color:${SUBTEXT};font-size:12px;">
+  <div class="eo-footer">
     Tina4 Debug Overlay &mdash; This page is only shown in debug mode. Set TINA4_DEBUG=false in production.
   </div>
 </div>
 </body>
 </html>`;
 }
+function overlayStylesheet() {
+  return `
+*{margin:0;padding:0;box-sizing:border-box;}
+body{background:${BG};color:${TEXT};font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;padding:24px;line-height:1.5;}
+.eo-wrap{max-width:960px;margin:0 auto;}
+.eo-header{margin-bottom:24px;}
+.eo-badge-row{display:flex;align-items:center;gap:12px;margin-bottom:12px;}
+.eo-badge{background:${RED};color:${BG};padding:4px 12px;border-radius:4px;font-weight:700;font-size:13px;text-transform:uppercase;}
+.eo-sub{color:${SUBTEXT};font-size:14px;}
+.eo-type{color:${RED};font-size:28px;font-weight:700;margin-bottom:8px;}
+.eo-msg{color:${TEXT};font-size:18px;font-family:'SF Mono','Fira Code','Consolas',monospace;background:${SURFACE};padding:12px 16px;border-radius:6px;border-left:4px solid ${RED};}
+.eo-footer{margin-top:32px;padding-top:16px;border-top:1px solid ${OVERLAY};color:${SUBTEXT};font-size:12px;}
+.eo-source{background:${SURFACE};border-radius:6px;padding:12px;overflow-x:auto;font-family:'SF Mono','Fira Code','Consolas',monospace;font-size:13px;line-height:1.6;}
+.eo-line{display:flex;padding:1px 0;}
+.eo-line-err{background:${ERROR_LINE_BG};}
+.eo-ln{color:${YELLOW};min-width:3.5em;text-align:right;padding-right:1em;user-select:none;}
+.eo-marker{color:${RED};width:1.2em;user-select:none;}
+.eo-code{color:${TEXT};white-space:pre-wrap;tab-size:4;}
+.eo-frame{margin-bottom:16px;}
+.eo-frame-head{margin-bottom:4px;}
+.eo-file{color:${BLUE};}
+.eo-sep{color:${SUBTEXT};}
+.eo-lineno{color:${YELLOW};}
+.eo-fn{color:${GREEN};}
+.eo-stale{background:${PEACH};color:${BG};padding:1px 8px;border-radius:3px;font-size:11px;font-weight:700;margin-left:6px;}
+.eo-details{margin-top:16px;}
+.eo-summary{cursor:pointer;color:${LAVENDER};font-weight:600;font-size:15px;padding:8px 0;user-select:none;}
+.eo-details-body{padding:8px 0;}
+.eo-table{border-collapse:collapse;width:100%;}
+.eo-key{color:${PEACH};padding:4px 16px 4px 0;vertical-align:top;white-space:nowrap;}
+.eo-val{color:${TEXT};padding:4px 0;word-break:break-all;}
+.eo-none{color:${SUBTEXT};}
+.eo-hidden-frames{color:${SUBTEXT};padding:8px 0;font-size:13px;}
+`;
+}
 function isDebugMode() {
   return isTruthy(process.env.TINA4_DEBUG);
 }
@@ -24816,6 +25070,7 @@ var init_errorOverlay = __esm({
   "src/errorOverlay.ts"() {
     "use strict";
     init_dotenv();
+    init_csp();
     MAX_FRAMES = 50;
     SENSITIVE_KEY_RE = /password|passwd|secret|token|authorization|cookie|key/i;
     REDACTED2 = "[redacted]";
@@ -26666,7 +26921,11 @@ export default async function (req: Tina4Request, res: Tina4Response) {
     `{% extends "base.twig" %}
 {% block title %}Login{% endblock %}
 {% block content %}
-<div class="container mt-4" style="max-width:400px">
+{# No inline style attribute: a nonce lets this <style> block run under the
+   strict default Content-Security-Policy. csp_nonce() is a built-in Frond global
+   that returns this response's nonce (ADR-0088). #}
+<style nonce="{{ csp_nonce() }}">.auth-form{max-width:400px;margin:0 auto}</style>
+<div class="container mt-4 auth-form">
     <h1>Login</h1>
     <form method="post" action="/api/auth/login">
         {{ form_token() }}
@@ -26690,7 +26949,8 @@ export default async function (req: Tina4Request, res: Tina4Response) {
     `{% extends "base.twig" %}
 {% block title %}Register{% endblock %}
 {% block content %}
-<div class="container mt-4" style="max-width:400px">
+<style nonce="{{ csp_nonce() }}">.auth-form{max-width:400px;margin:0 auto}</style>
+<div class="container mt-4 auth-form">
     <h1>Register</h1>
     <form method="post" action="/api/auth/register">
         {{ form_token() }}
@@ -27627,7 +27887,7 @@ import * as path3 from "node:path";
 import * as os from "node:os";
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { createRequire as createRequire8 } from "node:module";
-import { randomBytes as randomBytes6 } from "node:crypto";
+import { randomBytes as randomBytes7 } from "node:crypto";
 function reqSibling(pkg) {
   return req(`../../${pkg}/src/index.ts`);
 }
@@ -28949,7 +29209,7 @@ var init_mcp = __esm({
       // ── Session lifecycle + protocol negotiation ──────────────────
       /** Mint a new session id and remember it. Called on `initialize`. */
       openSession() {
-        const sid = randomBytes6(16).toString("hex");
+        const sid = randomBytes7(16).toString("hex");
         this._sessions.set(sid, Date.now());
         return sid;
       }
@@ -36725,8 +36985,8 @@ var init_devAdmin = __esm({
        * Duplicate errors (same message) increment count and update last_seen.
        */
       static capture(errorType, message, traceback = "", file = "", line = 0) {
-        const fingerprint = `${errorType}|${message}|${file}|${line}`;
-        const existing = this.errors.find((e) => e.fingerprint === fingerprint);
+        const fingerprint2 = `${errorType}|${message}|${file}|${line}`;
+        const existing = this.errors.find((e) => e.fingerprint === fingerprint2);
         const now = (/* @__PURE__ */ new Date()).toISOString();
         if (existing) {
           existing.count = (existing.count || 1) + 1;
@@ -36739,7 +36999,7 @@ var init_devAdmin = __esm({
             message,
             stack: traceback || void 0,
             resolved: false,
-            ...{ fingerprint, error_type: errorType, file, line, count: 1, first_seen: now, last_seen: now }
+            ...{ fingerprint: fingerprint2, error_type: errorType, file, line, count: 1, first_seen: now, last_seen: now }
           });
           if (this.errors.length > this.maxErrors) {
             this.errors = this.errors.slice(-this.maxErrors);
@@ -39418,7 +39678,7 @@ function swaggerEnabled() {
 }
 function createSwaggerRoutes(getSpec) {
   const serveUi = async (_req, res) => {
-    res.html(SWAGGER_UI_HTML("/swagger/openapi.json"));
+    res.html(SWAGGER_UI_HTML("/swagger/openapi.json", res.cspNonce));
   };
   return [
     {
@@ -39462,13 +39722,13 @@ var SWAGGER_UI_HTML;
 var init_ui = __esm({
   "../swagger/src/ui.ts"() {
     "use strict";
-    SWAGGER_UI_HTML = (specUrl) => `<!DOCTYPE html>
+    SWAGGER_UI_HTML = (specUrl, nonce) => `<!DOCTYPE html>
 <html lang="en">
 <head>
   <meta charset="UTF-8">
   <title>Tina4 API Documentation</title>
   <link rel="stylesheet" href="${swaggerUiCdn()}/swagger-ui.css">
-  <style>
+  <style nonce="${nonce}">
     body { margin: 0; background: #fafafa; }
     .topbar { display: none !important; }
   </style>
@@ -39476,7 +39736,7 @@ var init_ui = __esm({
 <body>
   <div id="swagger-ui"></div>
   <script src="${swaggerUiCdn()}/swagger-ui-bundle.js"></script>
-  <script>
+  <script nonce="${nonce}">
     SwaggerUIBundle({
       url: "${specUrl}",
       dom_id: '#swagger-ui',
@@ -39516,7 +39776,7 @@ __export(sso_exports, {
   SsoError: () => SsoError,
   liveSessionIdentity: () => liveSessionIdentity
 });
-import { createHash as createHash9, randomBytes as randomBytes7, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { createHash as createHash9, randomBytes as randomBytes8, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 function expiresAt(tokens) {
   const lifetime = Number(tokens.expires_in ?? 0);
   return lifetime > 0 ? Math.floor(Date.now() / 1e3) + lifetime : 0;
@@ -39644,9 +39904,9 @@ var init_sso = __esm({
       async login(requestOrSession, returnTo = "/") {
         const session = this.session(requestOrSession);
         if (!session) throw new SsoError("SSO login requires a Tina4 Session");
-        const state = randomBytes7(32).toString("base64url");
-        const nonce = randomBytes7(32).toString("base64url");
-        const verifier = randomBytes7(64).toString("base64url");
+        const state = randomBytes8(32).toString("base64url");
+        const nonce = randomBytes8(32).toString("base64url");
+        const verifier = randomBytes8(64).toString("base64url");
         const challenge = createHash9("sha256").update(verifier).digest("base64url");
         session.set(_Sso.PENDING_KEY, { state, nonce, verifier, return_to: _Sso.safeReturn(returnTo), created_at: Math.floor(Date.now() / 1e3) });
         const metadata = await this.discover();
@@ -39874,7 +40134,7 @@ var init_docsAutoDiscovery = __esm({
 });
 
 // src/server.ts
-import { randomBytes as randomBytes8 } from "node:crypto";
+import { randomBytes as randomBytes9 } from "node:crypto";
 import { resolve as resolve19, dirname as dirname13, join as join30, relative as relative10 } from "node:path";
 import { existsSync as existsSync25, readdirSync as readdirSync17, readFileSync as readFileSync23, statSync as statSync18 } from "node:fs";
 import { isatty } from "node:tty";
@@ -40054,7 +40314,8 @@ function isDevMode() {
 }
 async function renderErrorPage(code, data, templatesDir) {
   try {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     const templateFile = `errors/${code}.twig`;
     const getCachedFrond = (dir) => {
       let instance = frondCache.get(dir);
@@ -40170,6 +40431,7 @@ function resolveTemplate(pathname, templatesDir) {
 }
 function renderLandingPage(port = 7148) {
   const version = TINA4_VERSION;
+  const nonce = currentCspNonce();
   const galleryItems = [
     { id: "rest-api", icon: "&#128640;", name: "REST API", desc: "A simple JSON API with GET and POST endpoints", accent: "accent-blue", tryUrl: "/api/gallery/hello" },
     { id: "orm", icon: "&#128451;", name: "ORM", desc: "Product model with CRUD endpoints", accent: "accent-green", tryUrl: "/api/gallery/products" },
@@ -40184,7 +40446,7 @@ function renderLandingPage(port = 7148) {
     const isDeployed = deployed[item.id] === true;
     const tryBtn = isDeployed ? `<a href="${item.tryUrl}" class="gbtn gbtn-try" target="_blank">Try It</a>` : "";
     const viewBtn = isDeployed ? `<a href="${item.tryUrl}" class="gbtn gbtn-view" target="_blank">View</a>` : "";
-    const deployBtn = isDeployed ? `<span class="gbtn gbtn-deployed">Deployed</span>` : `<button class="gbtn gbtn-deploy" onclick="deployGallery('${item.id}')">Deploy</button>`;
+    const deployBtn = isDeployed ? `<span class="gbtn gbtn-deployed">Deployed</span>` : `<button class="gbtn gbtn-deploy" data-deploy="${item.id}">Deploy</button>`;
     return `<div class="gallery-card">
             <div class="accent ${item.accent}"></div>
             <div class="icon">${item.icon}</div>
@@ -40199,7 +40461,7 @@ function renderLandingPage(port = 7148) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>Tina4NodeJs</title>
-<style>
+<style nonce="${nonce}">
 *{margin:0;padding:0;box-sizing:border-box}
 body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:#0f172a;color:#e2e8f0;min-height:100vh;display:flex;flex-direction:column;align-items:center;position:relative}
 .bg-watermark{position:fixed;bottom:-5%;right:-5%;width:45%;opacity:0.04;pointer-events:none;z-index:0}
@@ -40238,6 +40500,11 @@ h1{font-size:3rem;font-weight:700;margin-bottom:0.25rem;letter-spacing:-1px}
 .gbtn-deployed{background:transparent;border:1px solid #22c55e;color:#22c55e;cursor:default;font-size:0.7rem}
 @keyframes wiggle{0%{transform:rotate(0deg)}15%{transform:rotate(14deg)}30%{transform:rotate(-10deg)}45%{transform:rotate(8deg)}60%{transform:rotate(-4deg)}75%{transform:rotate(2deg)}100%{transform:rotate(0deg)}}
 .star-wiggle{display:inline-block;transform-origin:center}
+.gallery-cards{display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:1rem}
+.tok-comment{color:#64748b}
+.tok-kw{color:#c084fc}
+.tok-str{color:#4ade80}
+.tok-fn{color:#38bdf8}
 </style>
 </head>
 <body>
@@ -40263,23 +40530,23 @@ h1{font-size:3rem;font-weight:700;margin-bottom:0.25rem;letter-spacing:-1px}
 <div class="section">
     <div class="card">
         <h2>Getting Started</h2>
-        <pre class="code-block"><code><span style="color:#64748b">// app.ts</span>
-<span style="color:#c084fc">import</span> { startServer, Router } <span style="color:#c084fc">from</span> <span style="color:#4ade80">"tina4-nodejs"</span>;
+        <pre class="code-block"><code><span class="tok-comment">// app.ts</span>
+<span class="tok-kw">import</span> { startServer, Router } <span class="tok-kw">from</span> <span class="tok-str">"tina4-nodejs"</span>;
 
-Router.get(<span style="color:#4ade80">"/hello"</span>, <span style="color:#c084fc">async</span> (<span style="color:#38bdf8">req</span>, <span style="color:#38bdf8">res</span>) =&gt; {
-    <span style="color:#c084fc">return</span> res.json({ message: <span style="color:#4ade80">"Hello World!"</span> });
+Router.get(<span class="tok-str">"/hello"</span>, <span class="tok-kw">async</span> (<span class="tok-fn">req</span>, <span class="tok-fn">res</span>) =&gt; {
+    <span class="tok-kw">return</span> res.json({ message: <span class="tok-str">"Hello World!"</span> });
 });
 
-startServer({ port: 7148 });  <span style="color:#64748b">// starts on port 7148</span></code></pre>
+startServer({ port: 7148 });  <span class="tok-comment">// starts on port 7148</span></code></pre>
     </div>
 </div>
 <div class="gallery">
     <h2 id="gallery">What You Can Build</h2>
-    <div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:1rem;">
+    <div class="gallery-cards">
         ${galleryCards}
     </div>
 </div>
-<script>
+<script nonce="${nonce}">
 function deployGallery(name) {
     if (!confirm('Deploy the "' + name + '" gallery example into your project? This will copy files into src/.')) return;
     fetch('/__dev/api/gallery/deploy', {
@@ -40314,6 +40581,12 @@ function deployGallery(name) {
     }
     setTimeout(doWiggle,3000);
 })();
+// CSP-clean wiring: no inline onclick handlers \u2014 bind every Deploy button from
+// its data-deploy attribute (a nonce covers script elements, not event-handler
+// attributes).
+document.querySelectorAll('.gbtn-deploy[data-deploy]').forEach(function(btn){
+    btn.addEventListener('click', function(){ deployGallery(btn.dataset.deploy); });
+});
 </script>
 </body>
 </html>`;
@@ -40530,7 +40803,7 @@ async function renderDispatchError(err, req2, res, templatesDir) {
       }
     }
   }
-  const requestId = Log.getRequestId() ?? randomBytes8(4).toString("hex");
+  const requestId = Log.getRequestId() ?? randomBytes9(4).toString("hex");
   if (wantsJson(req2)) {
     const body = negotiatedErrorBody(500, "Internal Server Error", requestId);
     res.raw.writeHead(500, { "Content-Type": "application/json" });
@@ -40601,7 +40874,7 @@ function serveStaticAsset(ctx) {
   return false;
 }
 async function serveNotFound(ctx) {
-  const requestId = Log.getRequestId() ?? randomBytes8(4).toString("hex");
+  const requestId = Log.getRequestId() ?? randomBytes9(4).toString("hex");
   if (wantsJson(ctx.req)) {
     const body = negotiatedErrorBody(404, "Not Found", requestId);
     ctx.res.raw.writeHead(404, httpReason(404), { "Content-Type": "application/json" });
@@ -40624,7 +40897,8 @@ async function buildDispatchContext(router, base) {
   const templatesDir = resolve19(root, "src/templates");
   let frondEngine = null;
   try {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     frondEngine = new Frond2(templatesDir);
   } catch {
   }
@@ -40734,9 +41008,13 @@ async function dispatchInner(ctx, rawReq, rawRes, requestId) {
   }
 }
 async function runDispatch(ctx, rawReq, rawRes) {
-  const requestId = Log.sanitizeRequestId(rawReq.headers["x-request-id"]) ?? randomBytes8(4).toString("hex");
+  const requestId = Log.sanitizeRequestId(rawReq.headers["x-request-id"]) ?? randomBytes9(4).toString("hex");
   if (!rawRes.headersSent) rawRes.setHeader("x-request-id", requestId);
-  return Log.runWithRequestId(requestId, () => dispatchInner(ctx, rawReq, rawRes, requestId));
+  const requestNonce = generateNonce();
+  return Log.runWithRequestId(
+    requestId,
+    () => runWithCspNonce(requestNonce, () => dispatchInner(ctx, rawReq, rawRes, requestId))
+  );
 }
 function loopbackBindHosts(host) {
   const normalized = host.trim().replace(/^\[|\]$/g, "").toLowerCase();
@@ -40863,7 +41141,8 @@ async function startServer(config) {
   let frondEngine = null;
   setDefaultTemplatesDir(templatesDir);
   try {
-    const { Frond: Frond2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    setCspNonceProvider2(currentCspNonce);
     frondEngine = new Frond2(templatesDir);
     router.addRoute({
       method: "GET",
@@ -41004,10 +41283,12 @@ async function startServer(config) {
           }
         });
         aiServer.on("error", (err) => {
-          if (err.code === "EADDRINUSE") {
+          if (err?.code === "EADDRINUSE") {
             Log.warning(`Test port ${testPort} in use \u2014 skipping`);
-            aiServer = null;
+          } else {
+            Log.error(`Test port ${testPort} bind failed (${err?.code ?? err}) \u2014 skipping`);
           }
+          aiServer = null;
         });
         aiServer.listen(testPort, host);
       }
@@ -41222,6 +41503,7 @@ var init_server = __esm({
     init_static();
     init_dotenv();
     init_errorOverlay();
+    init_csp();
     init_health();
     init_rateLimiter();
     init_logger();
@@ -41471,7 +41753,7 @@ var init_mqttMessage = __esm({
 // src/mqtt.ts
 import net2 from "node:net";
 import tls from "node:tls";
-import { randomBytes as randomBytes9 } from "node:crypto";
+import { randomBytes as randomBytes10 } from "node:crypto";
 import { existsSync as existsSync26, readFileSync as readFileSync24 } from "node:fs";
 var MqttError, MqttTimeoutError, CONNECT, CONNACK, PUBLISH, PUBACK, SUBSCRIBE, SUBACK, PINGREQ, PINGRESP, DISCONNECT, PROTOCOL_LEVEL, DEFAULT_PORT, DEFAULT_TLS_PORT, DEFAULT_URL, DEFAULT_KEEPALIVE, SUBSCRIPTION_REFUSED, MAX_REMAINING_LENGTH, QOS2_REFUSED_MESSAGE, CONNACK_RETURN_CODES, Mqtt;
 var init_mqtt = __esm({
@@ -41559,7 +41841,7 @@ var init_mqtt = __esm({
         this.caFile = options.caFile ?? (Env.str("TINA4_MQTT_CA_FILE") || null);
         this.tlsVerify = options.tlsVerify ?? Env.bool("TINA4_MQTT_TLS_VERIFY", true);
         let cid = options.clientId ?? (Env.str("TINA4_MQTT_CLIENT_ID") || null);
-        if (cid === null || cid === "") cid = "tina4-" + randomBytes9(8).toString("hex");
+        if (cid === null || cid === "") cid = "tina4-" + randomBytes10(8).toString("hex");
         this.clientId = cid;
         this.keepalive = options.keepalive ?? Env.int("TINA4_MQTT_KEEPALIVE", DEFAULT_KEEPALIVE);
         this.cleanSession = options.cleanSession ?? true;
@@ -42673,7 +42955,7 @@ var init_ssrf = __esm({
 import http from "node:http";
 import https from "node:https";
 import { URL as URL2 } from "node:url";
-import { randomBytes as randomBytes10 } from "node:crypto";
+import { randomBytes as randomBytes11 } from "node:crypto";
 import { promises as fsp, createWriteStream } from "node:fs";
 import { basename as basename6 } from "node:path";
 import { pipeline } from "node:stream/promises";
@@ -43065,7 +43347,7 @@ var init_api = __esm({
           return { http_code: null, body: null, headers: {}, error: "upload requires filePath or fileBytes" };
         }
         const partContentType = guessContentType(uploadName);
-        const boundary = "----Tina4Boundary" + randomBytes10(16).toString("hex");
+        const boundary = "----Tina4Boundary" + randomBytes11(16).toString("hex");
         const bodyBuffer = buildMultipartBody(boundary, fieldName, uploadName, content, partContentType, extraFields);
         const contentType = `multipart/form-data; boundary=${boundary}`;
         return this.execute("POST", this.buildUrl(path10), bodyBuffer, contentType, headers);
@@ -46029,7 +46311,7 @@ import {
   createHmac as createHmac4,
   createPrivateKey,
   createSign as createSign2,
-  randomBytes as randomBytes11
+  randomBytes as randomBytes12
 } from "node:crypto";
 function encodeBase64Url(value) {
   return Buffer.from(value).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
@@ -46109,7 +46391,7 @@ function encryptPayload(payload, subscription) {
   ]);
   const prkKey = hmac(authSecret, sharedSecret);
   const ikm = hkdfExpand(prkKey, keyInfo, 32);
-  const salt = randomBytes11(16);
+  const salt = randomBytes12(16);
   const contentPrk = hmac(salt, ikm);
   const cek = hkdfExpand(contentPrk, Buffer.from("Content-Encoding: aes128gcm\0", "ascii"), 16);
   const nonce = hkdfExpand(contentPrk, Buffer.from("Content-Encoding: nonce\0", "ascii"), 12);
@@ -48866,6 +49148,7 @@ __export(index_exports, {
   cacheStats: () => cacheStats,
   checkPassword: () => checkPassword,
   clearCache: () => clearCache,
+  clearCurrentNonce: () => clearCurrentNonce,
   computeAcceptKey: () => computeAcceptKey,
   container: () => container,
   cors: () => cors,
@@ -48877,6 +49160,8 @@ __export(index_exports, {
   createMessenger: () => createMessenger,
   createRequest: () => createRequest,
   createResponse: () => createResponse,
+  cspNonce: () => cspNonce,
+  currentCspNonce: () => currentCspNonce,
   decodeRequest: () => decodeRequest,
   defaultContext: () => defaultContext,
   defaultRouter: () => defaultRouter,
@@ -48902,6 +49187,7 @@ __export(index_exports, {
   feedbackWhitelist: () => feedbackWhitelist,
   fts5Supported: () => fts5Supported,
   generateContext: () => generateContext,
+  generateNonce: () => generateNonce,
   generateVapidKeys: () => generateVapidKeys,
   get: () => get,
   getDefaultDevServer: () => getDefaultDevServer,
@@ -48924,6 +49210,7 @@ __export(index_exports, {
   httpReason: () => httpReason,
   inContainer: () => inContainer,
   injectFeedbackWidget: () => injectFeedbackWidget,
+  injectNonceIntoCsp: () => injectNonceIntoCsp,
   installAll: () => installAll,
   installSelected: () => installSelected,
   isBannerSuppressed: () => isBannerSuppressed,
@@ -48978,6 +49265,7 @@ __export(index_exports, {
   resetTrustedProxyCache: () => resetTrustedProxyCache,
   resolveAlgorithm: () => resolveAlgorithm,
   resolveClientIp: () => resolveClientIp,
+  resolveCspHeader: () => resolveCspHeader,
   resolveFrameworkVersion: () => resolveFrameworkVersion,
   resolvePortAndHost: () => resolvePortAndHost,
   resolveStringMiddleware: () => resolveStringMiddleware,
@@ -48985,12 +49273,14 @@ __export(index_exports, {
   responseCache: () => responseCache,
   runAll: () => runAll,
   runRouteMiddlewares: () => runRouteMiddlewares,
+  runWithCspNonce: () => runWithCspNonce,
   runtimeDir: () => runtimeDir,
   saveUpload: () => saveUpload,
   schemaFromParams: () => schemaFromParams,
   selectablePids: () => selectablePids,
   serveWebSocketRoute: () => serveWebSocketRoute,
   sessionCookieName: () => sessionCookieName,
+  setCurrentNonce: () => setCurrentNonce,
   setDefaultTemplatesDir: () => setDefaultTemplatesDir,
   setFrond: () => setFrond,
   showMenu: () => showMenu,
@@ -49056,6 +49346,7 @@ var init_index = __esm({
     init_wsdl();
     init_htmlElement();
     init_errorOverlay();
+    init_csp();
     init_ai();
     init_sso();
     init_push();
@@ -49246,6 +49537,7 @@ export {
   cacheStats,
   checkPassword,
   clearCache,
+  clearCurrentNonce,
   computeAcceptKey,
   container,
   cors,
@@ -49257,6 +49549,8 @@ export {
   createMessenger,
   createRequest,
   createResponse,
+  cspNonce,
+  currentCspNonce,
   decodeRequest,
   defaultContext,
   defaultRouter,
@@ -49282,6 +49576,7 @@ export {
   feedbackWhitelist,
   fts5Supported,
   generateContext,
+  generateNonce,
   generateVapidKeys,
   get,
   getDefaultDevServer,
@@ -49304,6 +49599,7 @@ export {
   httpReason,
   inContainer,
   injectFeedbackWidget,
+  injectNonceIntoCsp,
   installAll,
   installSelected,
   isBannerSuppressed,
@@ -49358,6 +49654,7 @@ export {
   resetTrustedProxyCache,
   resolveAlgorithm,
   resolveClientIp,
+  resolveCspHeader,
   resolveFrameworkVersion,
   resolvePortAndHost,
   resolveStringMiddleware,
@@ -49365,12 +49662,14 @@ export {
   responseCache,
   runAll,
   runRouteMiddlewares,
+  runWithCspNonce,
   runtimeDir,
   saveUpload,
   schemaFromParams,
   selectablePids,
   serveWebSocketRoute,
   sessionCookieName,
+  setCurrentNonce,
   setDefaultTemplatesDir,
   setFrond,
   showMenu,