tina4-nodejs 3.13.149 → 3.13.151

package/packages/orm/dist/index.js

@@ -51,6 +51,12 @@ var init_types = __esm({
 });
 
 // src/databaseResult.ts
+function stripTypeArgs(colType) {
+  const open = colType.indexOf("(");
+  if (open < 0) return colType;
+  const close = colType.indexOf(")", open);
+  return close < 0 ? colType : colType.slice(0, open) + colType.slice(close + 1);
+}
 var DatabaseResult;
 var init_databaseResult = __esm({
   "src/databaseResult.ts"() {
@@ -233,7 +239,7 @@ var init_databaseResult = __esm({
           const [size, decimals] = this._parseTypeSize(colType);
           return {
             name: col.name,
-            type: colType.replace(/\(.*\)/, ""),
+            type: stripTypeArgs(colType),
             size,
             decimals,
             nullable: col.nullable ?? true,
@@ -790,12 +796,49 @@ var init_point = __esm({
 });
 
 // src/sqlTranslator.ts
-var SQLTranslator, QueryCache;
+function skipQuoted(sql, i, backslashEscapes) {
+  const c = sql[i];
+  const escapeString = c === "'" && (sql[i - 1] === "E" || sql[i - 1] === "e") && !isIdentChar(sql[i - 2]);
+  const backslash = c !== "`" && (escapeString || backslashEscapes);
+  const n = sql.length;
+  i++;
+  while (i < n) {
+    if (backslash && sql[i] === "\\") {
+      i += 2;
+      continue;
+    }
+    if (sql[i] === c) {
+      if (sql[i + 1] === c) {
+        i += 2;
+        continue;
+      }
+      return i + 1;
+    }
+    i++;
+  }
+  return i;
+}
+function skipLineComment(sql, i) {
+  while (i < sql.length && sql[i] !== "\n") i++;
+  return i;
+}
+function skipBlockComment(sql, i) {
+  const end = sql.indexOf("*/", i + 2);
+  return end === -1 ? sql.length : end + 2;
+}
+function skipDollarQuote(sql, i) {
+  const tag = sql.slice(i).match(/^\$([A-Za-z_][A-Za-z0-9_]*)?\$/);
+  if (!tag) return i;
+  const end = sql.indexOf(tag[0], i + tag[0].length);
+  return end === -1 ? sql.length : end + tag[0].length;
+}
+var isIdentChar, SQLTranslator, QueryCache;
 var init_sqlTranslator = __esm({
   "src/sqlTranslator.ts"() {
     "use strict";
     init_databaseUrl();
     init_point();
+    isIdentChar = (ch) => !!ch && /[A-Za-z0-9_]/.test(ch);
     SQLTranslator = class _SQLTranslator {
       static SPATIAL_ENGINES = /* @__PURE__ */ new Set(["postgres", "postgresql"]);
       static SPATIAL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/;
@@ -1076,47 +1119,26 @@ var init_sqlTranslator = __esm({
       static placeholderPositions(sql, options = {}) {
         const positions = [];
         const n = sql.length;
-        const isIdent = (ch) => !!ch && /[A-Za-z0-9_]/.test(ch);
         let i = 0;
         while (i < n) {
           const c = sql[i];
           const next = sql[i + 1];
           if (c === "'" || c === '"' || c === "`") {
-            const prev = sql[i - 1];
-            const escapeString = c === "'" && (prev === "E" || prev === "e") && !isIdent(sql[i - 2]);
-            const backslash = c !== "`" && (escapeString || options.backslashEscapes === true);
-            i++;
-            while (i < n) {
-              if (backslash && sql[i] === "\\") {
-                i += 2;
-                continue;
-              }
-              if (sql[i] === c) {
-                if (sql[i + 1] === c) {
-                  i += 2;
-                  continue;
-                }
-                i++;
-                break;
-              }
-              i++;
-            }
+            i = skipQuoted(sql, i, options.backslashEscapes === true);
             continue;
           }
           if (c === "-" && next === "-") {
-            while (i < n && sql[i] !== "\n") i++;
+            i = skipLineComment(sql, i);
             continue;
           }
           if (c === "/" && next === "*") {
-            const end = sql.indexOf("*/", i + 2);
-            i = end === -1 ? n : end + 2;
+            i = skipBlockComment(sql, i);
             continue;
           }
-          if (c === "$" && !isIdent(sql[i - 1])) {
-            const tag = sql.slice(i).match(/^\$([A-Za-z_][A-Za-z0-9_]*)?\$/);
-            if (tag) {
-              const end = sql.indexOf(tag[0], i + tag[0].length);
-              i = end === -1 ? n : end + tag[0].length;
+          if (c === "$" && !isIdentChar(sql[i - 1])) {
+            const past = skipDollarQuote(sql, i);
+            if (past !== i) {
+              i = past;
               continue;
             }
           }
@@ -1149,7 +1171,7 @@ var init_sqlTranslator = __esm({
        * → { sql: "INSERT INTO t (x) VALUES (1)", columns: ["id", "name"] }
        */
       static parseReturning(sql) {
-        const m = sql.match(/\bRETURNING\s+(.+)$/i);
+        const m = sql.match(/\bRETURNING\s+(\S.*)$/i);
         if (!m) return { sql, columns: [] };
         const columns = m[1].split(",").map((c) => c.trim());
         return {
@@ -1203,7 +1225,12 @@ var init_sqlTranslator = __esm({
       // The `d` flag records group indices, so the head can be sliced at the exact
       // start of the VALUES group rather than by hunting for a parenthesis (the
       // column list has parentheses too).
-      static INSERT_VALUES = /^\s*INSERT\s+INTO\s+.+?\s+VALUES\s*\(([^()]*)\)\s*$/dis;
+      static INSERT_VALUES = (
+        // ReDoS-safe: the table ref matches `\S(?:[\s\S]*?\S)?` (bounded by non-space
+        // at both ends) so the separator `\s+` before VALUES can't overlap it the way
+        // the old `.+?\s+` did (polynomial on `INSERT INTO ` + a long space run).
+        /^\s*INSERT\s+INTO\s+\S(?:[\s\S]*?\S)?\s+VALUES\s*\(([^()]*)\)\s*$/dis
+      );
       /**
        * Engines whose lastInsertId reports the FIRST generated id of a multi-row
        * INSERT rather than the last. Verified live, not assumed: a 3-row insert
@@ -1678,6 +1705,30 @@ var init_sqlDialect = __esm({
   }
 });
 
+// ../core/src/slashTrim.ts
+function rtrimSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === SLASH) end--;
+  return end === s.length ? s : s.slice(0, end);
+}
+function trimChar(s, code) {
+  let start2 = 0;
+  let end = s.length;
+  while (start2 < end && s.charCodeAt(start2) === code) start2++;
+  while (end > start2 && s.charCodeAt(end - 1) === code) end--;
+  return start2 === 0 && end === s.length ? s : s.slice(start2, end);
+}
+function trimSlashes(s) {
+  return trimChar(s, SLASH);
+}
+var SLASH;
+var init_slashTrim = __esm({
+  "../core/src/slashTrim.ts"() {
+    "use strict";
+    SLASH = 47;
+  }
+});
+
 // ../core/src/constants.ts
 var HTTP_OK, HTTP_CREATED, HTTP_ACCEPTED, HTTP_NO_CONTENT, HTTP_MOVED, HTTP_REDIRECT, HTTP_NOT_MODIFIED, HTTP_BAD_REQUEST, HTTP_UNAUTHORIZED, HTTP_FORBIDDEN, HTTP_NOT_FOUND, HTTP_METHOD_NOT_ALLOWED, HTTP_CONFLICT, HTTP_GONE, HTTP_UNPROCESSABLE, HTTP_TOO_MANY, HTTP_SERVER_ERROR, HTTP_BAD_GATEWAY, HTTP_UNAVAILABLE, APPLICATION_JSON, APPLICATION_XML, APPLICATION_FORM, APPLICATION_OCTET, TEXT_HTML, TEXT_PLAIN, TEXT_CSV, TEXT_XML;
 var init_constants = __esm({
@@ -2766,7 +2817,7 @@ function resolveAlgorithm(algorithm) {
   return chosen;
 }
 function base64urlEncode(data) {
-  return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/={1,2}$/, "");
 }
 function base64urlDecode(str) {
   let s = str.replace(/-/g, "+").replace(/_/g, "/");
@@ -3183,6 +3234,7 @@ function mayStore(req2, vary, cacheControl, setCookie) {
   if (requestHeader(req2, "authorization") !== void 0) return sharedCacheAllowed(cacheControl);
   if (requestHeader(req2, "cookie") !== void 0) return sharedCacheAllowed(cacheControl);
   if (hasSetCookie(setCookie)) return sharedCacheAllowed(cacheControl);
+  if (req2.session?.isFresh && !req2.session.isFresh()) return sharedCacheAllowed(cacheControl);
   return true;
 }
 function varyMatches(entry, req2) {
@@ -4535,7 +4587,7 @@ function coerceParam(raw, type2) {
 }
 function joinGroupPath(prefix, path10) {
   const full = `${prefix}/${path10.replace(/^\/+/, "")}`;
-  const trimmed = `/${full.replace(/^\/+|\/+$/g, "")}`;
+  const trimmed = `/${trimSlashes(full)}`;
   return trimmed.replace(/\/+/g, "/");
 }
 async function resolveStringMiddleware(spec) {
@@ -4600,6 +4652,7 @@ var WsRouteRef, RouteRef, Router, RouteGroup, TINA4_DEFAULT_ROUTER, globalRouter
 var init_router = __esm({
   "../core/src/router.ts"() {
     "use strict";
+    init_slashTrim();
     init_dotenv();
     init_middleware();
     WsRouteRef = class {
@@ -4809,7 +4862,7 @@ var init_router = __esm({
           const direct = this.matchRoute(routes, path10);
           if (direct) return direct;
           if (isTrailingSlashRedirectEnabled() && path10.length > 1 && path10.endsWith("/")) {
-            const stripped = path10.replace(/\/+$/, "");
+            const stripped = rtrimSlashes(path10);
             if (stripped.length > 0) {
               const retry = this.matchRoute(routes, stripped);
               if (retry) return retry;
@@ -5488,9 +5541,11 @@ __export(engine_exports, {
   escapeHtml: () => escapeHtml,
   expressionFormCache: () => expressionFormCache,
   filterChainCache: () => filterChainCache,
+  frondRange: () => frondRange,
   pathParseCache: () => pathParseCache,
   setCspNonceProvider: () => setCspNonceProvider,
-  setFormTokenSessionId: () => setFormTokenSessionId
+  setFormTokenSessionId: () => setFormTokenSessionId,
+  setFormTokenSessionProvider: () => setFormTokenSessionProvider
 });
 import { createHash as createHash3, createHmac as createHmac2, randomBytes as randomBytes3 } from "node:crypto";
 import { readFileSync as readFileSync4, existsSync as existsSync5, statSync as statSync4, realpathSync } from "node:fs";
@@ -5575,6 +5630,14 @@ function renderDump(value) {
   const escaped = dumped.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
   return new SafeString(`<pre>${escaped}</pre>`);
 }
+function stripTags(input) {
+  let s = input, prev;
+  do {
+    prev = s;
+    s = s.replace(STRIP_TAGS_RE, "");
+  } while (s !== prev);
+  return s;
+}
 function liveAttr(value) {
   return String(value).replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -5592,35 +5655,58 @@ function sweepExpiredCache(cache) {
     if (expiresAt2 <= now) cache.delete(key);
   }
 }
-function tokenize(source) {
+function extractRawBlocks(source) {
   const rawBlocks = [];
-  source = source.replace(RAW_BLOCK_RE, (_match, content) => {
+  let out = "";
+  let pos = 0;
+  RAW_OPEN_RE.lastIndex = 0;
+  let om;
+  while ((om = RAW_OPEN_RE.exec(source)) !== null) {
+    const openStart = om.index;
+    const openEnd = RAW_OPEN_RE.lastIndex;
+    RAW_CLOSE_RE.lastIndex = openEnd;
+    const cm = RAW_CLOSE_RE.exec(source);
+    if (cm === null) break;
     const idx = rawBlocks.length;
-    rawBlocks.push(content);
-    return `\0RAW_${idx}\0`;
-  });
+    rawBlocks.push(source.slice(openEnd, cm.index));
+    out += source.slice(pos, openStart) + `\0RAW_${idx}\0`;
+    pos = RAW_CLOSE_RE.lastIndex;
+    RAW_OPEN_RE.lastIndex = pos;
+  }
+  out += source.slice(pos);
+  return { source: out, rawBlocks };
+}
+function tokenize(rawSource) {
+  const { source, rawBlocks } = extractRawBlocks(rawSource);
   const tokens = [];
+  const n = source.length;
   let pos = 0;
-  TOKEN_RE.lastIndex = 0;
-  let m;
-  while ((m = TOKEN_RE.exec(source)) !== null) {
-    const start2 = m.index;
-    if (start2 > pos) {
-      tokens.push(["TEXT", source.slice(pos, start2)]);
+  let scan = 0;
+  const exhausted = { "%}": false, "}}": false, "#}": false };
+  while (scan < n) {
+    const brace = source.indexOf("{", scan);
+    if (brace === -1) break;
+    const kind = TAG_KINDS[source[brace + 1]];
+    if (!kind) {
+      scan = brace + 1;
+      continue;
     }
-    const raw = m[0];
-    if (raw.startsWith("{#")) {
-      tokens.push(["COMMENT", raw]);
-    } else if (raw.startsWith("{{")) {
-      tokens.push(["VAR", raw]);
-    } else if (raw.startsWith("{%")) {
-      tokens.push(["BLOCK", raw]);
+    if (exhausted[kind.close]) {
+      scan = brace + 1;
+      continue;
     }
-    pos = m.index + raw.length;
-  }
-  if (pos < source.length) {
-    tokens.push(["TEXT", source.slice(pos)]);
+    const close = source.indexOf(kind.close, brace + 2);
+    if (close === -1) {
+      exhausted[kind.close] = true;
+      scan = brace + 1;
+      continue;
+    }
+    if (brace > pos) tokens.push(["TEXT", source.slice(pos, brace)]);
+    tokens.push([kind.type, source.slice(brace, close + 2)]);
+    pos = close + 2;
+    scan = close + 2;
   }
+  if (pos < n) tokens.push(["TEXT", source.slice(pos)]);
   if (rawBlocks.length > 0) {
     for (let i = 0; i < tokens.length; i++) {
       if (tokens[i][0] === "TEXT" && tokens[i][1].includes("\0RAW_")) {
@@ -5946,26 +6032,123 @@ function evalConcatOrComparison(expr, context) {
   }
   return EXPR_NOT_MATCHED;
 }
+function topLevelPositions(expr) {
+  const positions = [];
+  let inQuote = null;
+  let depth = 0;
+  for (let pos = 0; pos < expr.length; pos++) {
+    const ch = expr[pos];
+    if (inQuote) {
+      if (ch === inQuote) inQuote = null;
+    } else if (ch === '"' || ch === "'") {
+      inQuote = ch;
+    } else if ("([{".includes(ch)) {
+      depth++;
+    } else if (")]}".includes(ch)) {
+      depth--;
+    } else if (depth === 0) {
+      positions.push(pos);
+    }
+  }
+  return positions;
+}
+function followsOperand(expr, pos) {
+  return /[\w)\]'"]$/.test(expr.slice(0, pos).trimEnd());
+}
+function topLevelArithmeticOperators(expr) {
+  const operators = [];
+  let skipUntil = -1;
+  for (const pos of topLevelPositions(expr)) {
+    if (pos < skipUntil || !"+-*/%".includes(expr[pos])) continue;
+    const pair = expr.slice(pos, pos + 2);
+    const op = pair === "**" || pair === "//" ? pair : expr[pos];
+    skipUntil = pos + op.length;
+    if (followsOperand(expr, pos)) operators.push([pos, op]);
+  }
+  return operators;
+}
+function splitArithmetic(expr) {
+  const operators = topLevelArithmeticOperators(expr);
+  for (const level of ARITHMETIC_LEVELS) {
+    const matches = operators.filter(([, op]) => level.includes(op));
+    if (matches.length > 0) return level[0] === "**" ? matches[0] : matches[matches.length - 1];
+  }
+  return null;
+}
 function evalArithmeticExpression(expr, context) {
-  for (const op of [" + ", " - ", " * ", " // ", " / ", " % ", " ** "]) {
-    const pos = findOutsideQuotes(expr, op);
-    if (pos >= 0) {
-      const left = expr.slice(0, pos).trim();
-      const right = expr.slice(pos + op.length).trim();
-      const lVal = evalExpr(left, context);
-      const rVal = evalExpr(right, context);
-      try {
-        let lNum = lVal != null ? Number(lVal) : 0;
-        let rNum = rVal != null ? Number(rVal) : 0;
-        if (isNaN(lNum)) lNum = 0;
-        if (isNaN(rNum)) rNum = 0;
-        return ARITHMETIC_OPERATIONS[op.trim()](lNum, rNum);
-      } catch {
-        return null;
-      }
+  const split = splitArithmetic(expr);
+  if (!split) return EXPR_NOT_MATCHED;
+  const [pos, op] = split;
+  const lVal = evalExpr(expr.slice(0, pos).trim(), context);
+  const rVal = evalExpr(expr.slice(pos + op.length).trim(), context);
+  let lNum = lVal != null ? Number(lVal) : 0;
+  let rNum = rVal != null ? Number(rVal) : 0;
+  if (isNaN(lNum)) lNum = 0;
+  if (isNaN(rNum)) rNum = 0;
+  return ARITHMETIC_OPERATIONS[op](lNum, rNum);
+}
+function frondRange(start2, end, step = 1) {
+  const numeric = (value) => typeof value === "number" || typeof value === "string" && NUMERIC_RE.test(value);
+  if (!numeric(start2) || !numeric(end) || !numeric(step)) return [];
+  const first = Math.trunc(Number(start2));
+  const last = Math.trunc(Number(end));
+  const stride = Math.abs(Math.trunc(Number(step)));
+  if (stride === 0) return [];
+  const values = [];
+  if (first <= last) for (let value = first; value <= last; value += stride) values.push(value);
+  else for (let value = first; value >= last; value -= stride) values.push(value);
+  return values;
+}
+function findRangeOperator(expr) {
+  let pos = findOutsideQuotes(expr, "..");
+  while (pos >= 0) {
+    const partOfEllipsis = expr.startsWith("...", pos) || pos > 0 && expr[pos - 1] === ".";
+    if (pos > 0 && !partOfEllipsis) return findOutsideQuotes(expr.slice(pos + 2), "|") >= 0 ? -1 : pos;
+    const next = findOutsideQuotes(expr.slice(pos + 2), "..");
+    pos = next >= 0 ? pos + 2 + next : -1;
+  }
+  return -1;
+}
+function evalRangeExpression(expr, context) {
+  const pos = findRangeOperator(expr);
+  if (pos < 0) return EXPR_NOT_MATCHED;
+  return frondRange(evalExpr(expr.slice(0, pos).trim(), context), evalExpr(expr.slice(pos + 2).trim(), context));
+}
+function closingBracketIndex(expr) {
+  let depth = 0;
+  let inQuote = null;
+  for (let i = 0; i < expr.length; i++) {
+    const ch = expr[i];
+    if (inQuote) {
+      if (ch === inQuote) inQuote = null;
+    } else if (ch === '"' || ch === "'") {
+      inQuote = ch;
+    } else if ("([{".includes(ch)) {
+      depth++;
+    } else if (")]}".includes(ch) && --depth === 0) {
+      return i;
     }
   }
-  return EXPR_NOT_MATCHED;
+  return -1;
+}
+function mapLiteralKey(rawKey, context) {
+  const quoted = rawKey.length >= 2 && (rawKey[0] === '"' || rawKey[0] === "'") && rawKey.endsWith(rawKey[0]);
+  if (quoted) return rawKey.slice(1, -1);
+  return BARE_KEY_RE.test(rawKey) ? rawKey : String(evalExpr(rawKey, context));
+}
+function evalMapLiteral(inner, context) {
+  const map = {};
+  for (const pair of inner === "" ? [] : splitArgs(inner)) {
+    const colon = findOutsideQuotes(pair, ":");
+    if (colon > 0) map[mapLiteralKey(pair.slice(0, colon).trim(), context)] = evalExpr(pair.slice(colon + 1).trim(), context);
+  }
+  return map;
+}
+function evalCollectionLiteral(expr, context) {
+  if (expr[0] !== "[" && expr[0] !== "{" || closingBracketIndex(expr) !== expr.length - 1) return EXPR_NOT_MATCHED;
+  const inner = expr.slice(1, -1).trim();
+  if (expr[0] === "{") return evalMapLiteral(inner, context);
+  return inner === "" ? [] : splitArgs(inner).map((item) => evalExpr(item.trim(), context));
 }
 function evalFilterExpression(expr, context) {
   if (findOutsideQuotes(expr, "|") >= 0) {
@@ -6387,12 +6570,12 @@ function splitArgs(raw) {
       current += ch;
       continue;
     }
-    if (ch === "(" || ch === "[") {
+    if (ch === "(" || ch === "[" || ch === "{") {
       depth++;
       current += ch;
       continue;
     }
-    if (ch === ")" || ch === "]") {
+    if (ch === ")" || ch === "]" || ch === "}") {
       depth--;
       current += ch;
       continue;
@@ -6557,11 +6740,14 @@ function formatMatch(match, flags, width, prec, type2, arg) {
   return padFormattedValue(formatValue(type2, precision, arg), flags, width);
 }
 function _b64url(data) {
-  return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/={1,2}$/, "");
 }
 function setFormTokenSessionId(sessionId) {
   _formTokenSessionId = sessionId || "";
 }
+function setFormTokenSessionProvider(fn) {
+  _formTokenSessionProvider = fn;
+}
 function setCspNonceProvider(fn) {
   _cspNonceProvider = fn;
 }
@@ -6586,8 +6772,9 @@ function _buildFormTokenJwt(descriptor = "") {
       payload.context = descriptor;
     }
   }
-  if (_formTokenSessionId) {
-    payload.session_id = _formTokenSessionId;
+  const sessionId = _formTokenSessionProvider() || _formTokenSessionId;
+  if (sessionId) {
+    payload.session_id = sessionId;
   }
   const h2 = _b64url(Buffer.from(JSON.stringify(header)));
   const p = _b64url(Buffer.from(JSON.stringify(payload)));
@@ -6603,7 +6790,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FAST_FILTERS, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, EXPR_EVALUATORS, expressionFormCache, VarRef, JS_SAFE_RE, MEDIA_TYPE_RE, SANDBOX_EXPR_KEYWORDS, SANDBOX_IDENT_RE, SANDBOX_STRING_RE, UNSAFE_KEYS, BUILTIN_FILTERS, _formTokenSessionId, _cspNonceProvider, Frond;
+var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FAST_FILTERS, FORMAT_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, RAW_OPEN_RE, RAW_CLOSE_RE, TAG_KINDS, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, ARITHMETIC_LEVELS, BARE_KEY_RE, EXPR_EVALUATORS, expressionFormCache, VarRef, JS_SAFE_RE, MEDIA_TYPE_RE, SANDBOX_EXPR_KEYWORDS, SANDBOX_IDENT_RE, SANDBOX_STRING_RE, UNSAFE_KEYS, BUILTIN_FILTERS, _formTokenSessionId, _formTokenSessionProvider, _cspNonceProvider, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -6705,7 +6892,7 @@ var init_engine = __esm({
       int: (value) => value ? parseInt(String(value), 10) || 0 : 0,
       float: (value) => value ? parseFloat(String(value)) || 0 : 0,
       abs: (value) => typeof value === "number" ? Math.abs(value) : value,
-      striptags: (value) => String(value).replace(STRIP_TAGS_RE, ""),
+      striptags: (value) => stripTags(String(value)),
       first: (value) => Array.isArray(value) ? value[0] ?? null : null,
       last: (value) => Array.isArray(value) ? value[value.length - 1] ?? null : null,
       keys: (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value) : [],
@@ -6719,20 +6906,23 @@ var init_engine = __esm({
       filter: (value) => Array.isArray(value) ? value.filter(Boolean) : value
     };
     FORMAT_RE = /%%|%([-+ 0]*)(\d+)?(?:\.(\d+))?([sdifFeEgGxXob])/g;
-    LEADING_WS_RE = /^\s+/;
-    TRAILING_WS_RE = /\s+$/;
     THOUSANDS_RE = /\B(?=(\d{3})+(?!\d))/g;
     LIVE_RE = /^live\s+["']([^"']+)["']([\s\S]*)$/;
     LIVE_WS_RE = /ws\s+["']([^"']+)["']/;
     LIVE_SRC_RE = /src\s+["']([^"']+)["']/;
-    EXTENDS_RE = /\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/;
-    EXTENDS_RE_GLOBAL = /\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/g;
+    EXTENDS_RE = /\{%[-\s]*extends\s+["']([^"']+)["']\s*[-]?%\}/;
+    EXTENDS_RE_GLOBAL = /\{%[-\s]*extends\s+["']([^"']+)["']\s*[-]?%\}/g;
     filterChainCache = /* @__PURE__ */ new Map();
     pathParseCache = /* @__PURE__ */ new Map();
     TEMPLATE_CACHE_MAX = 256;
     MEMO_CACHE_MAX = 1024;
-    TOKEN_RE = /(\{%-?\s*[\s\S]*?\s*-?%\})|(\{\{-?\s*[\s\S]*?\s*-?\}\})|(\{#[\s\S]*?#\})/g;
-    RAW_BLOCK_RE = /\{%-?\s*raw\s*-?%\}([\s\S]*?)\{%-?\s*endraw\s*-?%\}/g;
+    RAW_OPEN_RE = /\{%-?\s*raw\s*-?%\}/g;
+    RAW_CLOSE_RE = /\{%-?\s*endraw\s*-?%\}/g;
+    TAG_KINDS = {
+      "%": { close: "%}", type: "BLOCK" },
+      "{": { close: "}}", type: "VAR" },
+      "#": { close: "#}", type: "COMMENT" }
+    };
     EXPR_NOT_MATCHED = /* @__PURE__ */ Symbol("frond-expression-not-matched");
     ARITHMETIC_OPERATIONS = {
       "+": (left, right) => left + right,
@@ -6743,10 +6933,14 @@ var init_engine = __esm({
       "%": (left, right) => right !== 0 ? left % right : 0,
       "**": (left, right) => left ** right
     };
+    ARITHMETIC_LEVELS = [["+", "-"], ["*", "//", "/", "%"], ["**"]];
+    BARE_KEY_RE = /^[A-Za-z_]\w*$/;
     EXPR_EVALUATORS = [
+      evalCollectionLiteral,
       evalPrimary,
       evalConditional,
       evalConcatOrComparison,
+      evalRangeExpression,
       evalArithmeticExpression,
       evalFilterExpression,
       evalFunctionExpression
@@ -6802,8 +6996,8 @@ var init_engine = __esm({
       },
       title: (v) => String(v).replace(TITLE_WORD_RE, (c) => c.toUpperCase()),
       trim: (v) => String(v).trim(),
-      ltrim: (v) => String(v).replace(LEADING_WS_RE, ""),
-      rtrim: (v) => String(v).replace(TRAILING_WS_RE, ""),
+      ltrim: (v) => String(v).trimStart(),
+      rtrim: (v) => String(v).trimEnd(),
       length: (v) => {
         if (Array.isArray(v)) return v.length;
         if (typeof v === "string") return v.length;
@@ -6844,7 +7038,7 @@ var init_engine = __esm({
       safe: (v) => v,
       escape: (v, ...a) => escapeStrategy(v, a[0] ?? "html"),
       e: (v, ...a) => escapeStrategy(v, a[0] ?? "html"),
-      striptags: (v) => String(v).replace(STRIP_TAGS_RE, ""),
+      striptags: (v) => stripTags(String(v)),
       nl2br: (v) => new SafeString(htmlEscape(String(v)).replace(/\n/g, "<br />\n")),
       abs: (v) => typeof v === "number" ? Math.abs(v) : v,
       round: (v, decimals) => {
@@ -6957,6 +7151,7 @@ var init_engine = __esm({
       js_escape: (v) => new SafeString(jsEscape(v))
     };
     _formTokenSessionId = "";
+    _formTokenSessionProvider = () => "";
     _cspNonceProvider = () => "";
     Frond = class _Frond {
       // ── Class-level registries ──────────────────────────────────
@@ -7110,6 +7305,7 @@ var init_engine = __esm({
         this.globals.form_token = (descriptor) => _generateFormToken(descriptor || "");
         this.globals.formTokenValue = (descriptor) => _generateFormTokenValue(descriptor || "");
         this.globals.form_token_value = (descriptor) => _generateFormTokenValue(descriptor || "");
+        this.globals.range = frondRange;
         this.globals.dump = (value) => renderDump(value);
         this.globals.csp_nonce = () => _cspNonceProvider();
         for (const [k, v] of _Frond.classFilters) this.filters[k] = v;
@@ -7446,20 +7642,20 @@ var init_engine = __esm({
       }
       renderVarToken(tokens, index, context, output) {
         const [content, stripB, stripA] = stripTag(tokens[index][1]);
-        if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].replace(TRAILING_WS_RE, "");
+        if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].trimEnd();
         const result = this.evalVar(content, context);
         output.push(result !== null && result !== void 0 ? String(result) : "");
         if (stripA && index + 1 < tokens.length && tokens[index + 1][0] === "TEXT") {
-          tokens[index + 1] = ["TEXT", tokens[index + 1][1].replace(LEADING_WS_RE, "")];
+          tokens[index + 1] = ["TEXT", tokens[index + 1][1].trimStart()];
         }
         return index + 1;
       }
       renderBlockToken(tokens, index, context, output) {
         const [content, stripB, stripA] = stripTag(tokens[index][1]);
-        if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].replace(TRAILING_WS_RE, "");
+        if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].trimEnd();
         const tag = content.split(/\s+/)[0] || "";
         if (stripA && index + 1 < tokens.length && tokens[index + 1][0] === "TEXT") {
-          tokens[index + 1] = ["TEXT", tokens[index + 1][1].replace(LEADING_WS_RE, "")];
+          tokens[index + 1] = ["TEXT", tokens[index + 1][1].trimStart()];
         }
         let next;
         if (tag === "if" && this.tagPermitted(tag)) {
@@ -7476,7 +7672,7 @@ var init_engine = __esm({
           next = block.next;
         }
         if (stripA && next < tokens.length && tokens[next][0] === "TEXT") {
-          tokens[next] = ["TEXT", tokens[next][1].replace(LEADING_WS_RE, "")];
+          tokens[next] = ["TEXT", tokens[next][1].trimStart()];
         }
         return next;
       }
@@ -7735,7 +7931,7 @@ var init_engine = __esm({
       pushIfBranch(branches, condition, branchTokens, stripBefore) {
         if (stripBefore && branchTokens.length > 0 && branchTokens[branchTokens.length - 1][0] === "TEXT") {
           const last = branchTokens[branchTokens.length - 1];
-          branchTokens[branchTokens.length - 1] = ["TEXT", last[1].replace(TRAILING_WS_RE, "")];
+          branchTokens[branchTokens.length - 1] = ["TEXT", last[1].trimEnd()];
         }
         branches.push([condition, branchTokens]);
       }
@@ -7763,7 +7959,7 @@ var init_engine = __esm({
           } else if (tag === "endif") {
             this.pushIfBranch(branches, currentCond, currentTokens, tagStripB);
             if (tagStripA && i + 1 < tokens.length && tokens[i + 1][0] === "TEXT") {
-              tokens[i + 1] = ["TEXT", tokens[i + 1][1].replace(LEADING_WS_RE, "")];
+              tokens[i + 1] = ["TEXT", tokens[i + 1][1].trimStart()];
             }
             return { branches, next: i + 1 };
           } else if ((tag === "elseif" || tag === "elif") && depth === 0) {
@@ -9412,7 +9608,8 @@ var init_middleware = __esm({
           "Content-Security-Policy": resolveCspHeader(currentCspNonce()),
           "Referrer-Policy": process.env.TINA4_REFERRER_POLICY ?? "strict-origin-when-cross-origin",
           "X-XSS-Protection": "0",
-          "Permissions-Policy": process.env.TINA4_PERMISSIONS_POLICY ?? "camera=(), microphone=(), geolocation=()"
+          "Permissions-Policy": process.env.TINA4_PERMISSIONS_POLICY ?? "camera=(), microphone=(), geolocation=()",
+          "Cross-Origin-Opener-Policy": process.env.TINA4_COOP ?? "same-origin-allow-popups"
         };
       }
       static beforeSecurity(req2, res) {
@@ -9429,7 +9626,7 @@ var init_middleware = __esm({
         if (process.env.TINA4_CSP === void 0) {
           _SecurityHeadersMiddleware.warnCspDefaultOnce();
         }
-        for (const name of ["Content-Security-Policy", "Referrer-Policy", "X-XSS-Protection", "Permissions-Policy"]) {
+        for (const name of ["Content-Security-Policy", "Referrer-Policy", "X-XSS-Protection", "Permissions-Policy", "Cross-Origin-Opener-Policy"]) {
           res.header(name, canonical[name]);
         }
         return [req2, res];
@@ -9513,7 +9710,7 @@ var init_middleware = __esm({
 });
 
 // ../core/src/request.ts
-import { mkdirSync as mkdirSync3, realpathSync as realpathSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { closeSync as closeSync3, constants as constants2, fstatSync as fstatSync2, ftruncateSync, lstatSync, mkdirSync as mkdirSync3, openSync as openSync3, realpathSync as realpathSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname3, join as join6 } from "node:path";
 function makeCaseInsensitiveHeaders(raw) {
   return new Proxy(raw, {
@@ -9549,7 +9746,8 @@ function createRequest(req2) {
   try {
     const url = new URL(req2.url ?? "/", `${proto}://${host}`);
     for (const [key, value] of url.searchParams) {
-      query[key] = value;
+      if (isUnsafeFieldName(key)) continue;
+      Reflect.set(query, key, value);
     }
     path10 = url.pathname;
     queryString = url.search.replace(/^\?/, "");
@@ -9561,7 +9759,8 @@ function createRequest(req2) {
     queryString = questionIdx >= 0 ? rawTarget.slice(questionIdx + 1) : "";
     try {
       for (const [key, value] of new URLSearchParams(queryString)) {
-        query[key] = value;
+        if (isUnsafeFieldName(key)) continue;
+        Reflect.set(query, key, value);
       }
     } catch {
     }
@@ -9580,7 +9779,8 @@ function createRequest(req2) {
   if (cookieHeader) {
     for (const pair of cookieHeader.split(";")) {
       const [k, ...v] = pair.trim().split("=");
-      if (k) cookies[k.trim()] = v.join("=").trim();
+      const name = k ? k.trim() : "";
+      if (name && !isUnsafeFieldName(name)) Reflect.set(cookies, name, v.join("=").trim());
     }
   }
   w.cookies = cookies;
@@ -9671,13 +9871,7 @@ async function parseBody(req2) {
       req2.body = str;
     }
   } else if (contentType.includes("application/x-www-form-urlencoded")) {
-    const str = raw.toString("utf-8");
-    const params = new URLSearchParams(str);
-    const obj = {};
-    for (const [key, value] of params) {
-      obj[key] = value;
-    }
-    req2.body = obj;
+    req2.body = nestFormFields([...new URLSearchParams(raw.toString("utf-8"))]);
   } else {
     req2.body = raw.toString("utf-8");
   }
@@ -9687,7 +9881,7 @@ function extractBoundary(contentType) {
   return match ? match[1] ?? match[2] : null;
 }
 function parseMultipart(body, boundary) {
-  const fields = {};
+  const pairs = [];
   const files = {};
   const delimiter2 = Buffer.from(`--${boundary}`);
   const closeDelimiter = Buffer.from(`--${boundary}--`);
@@ -9695,7 +9889,7 @@ function parseMultipart(body, boundary) {
   const doubleCrlf = Buffer.from("\r\n\r\n");
   let offset = 0;
   const firstIdx = bufferIndexOf(body, delimiter2, offset);
-  if (firstIdx === -1) return { fields, files };
+  if (firstIdx === -1) return { fields: {}, files };
   offset = firstIdx + delimiter2.length;
   if (body[offset] === 13 && body[offset + 1] === 10) {
     offset += 2;
@@ -9719,14 +9913,15 @@ function parseMultipart(body, boundary) {
         content: Buffer.from(content),
         size: content.length
       };
-      if (files[disposition.name]) {
+      if (isUnsafeFieldName(disposition.name)) {
+      } else if (files[disposition.name]) {
         const existing = files[disposition.name];
-        files[disposition.name] = Array.isArray(existing) ? [...existing, file] : [existing, file];
+        Reflect.set(files, disposition.name, Array.isArray(existing) ? [...existing, file] : [existing, file]);
       } else {
-        files[disposition.name] = file;
+        Reflect.set(files, disposition.name, file);
       }
     } else if (disposition.name) {
-      fields[disposition.name] = content.toString("utf-8");
+      pairs.push([disposition.name, content.toString("utf-8")]);
     }
     offset = nextDelimIdx + delimiter2.length;
     if (body[offset] === 45 && body[offset + 1] === 45) {
@@ -9736,7 +9931,7 @@ function parseMultipart(body, boundary) {
       offset += 2;
     }
   }
-  return { fields, files };
+  return { fields: nestFormFields(pairs), files };
 }
 function saveUpload(file, targetDir, filename) {
   const raw = String(filename ?? file.filename ?? "");
@@ -9752,7 +9947,21 @@ function saveUpload(file, targetDir, filename) {
   if (realParent !== realDir) {
     throw new Error(`refusing to write outside ${targetDir}: ${JSON.stringify(raw)}`);
   }
-  writeFileSync2(dest, file.content);
+  if (lstatSync(dest, { throwIfNoEntry: false })?.isSymbolicLink()) unlinkSync3(dest);
+  const flags = constants2.O_WRONLY | constants2.O_CREAT | (constants2.O_NOFOLLOW ?? 0);
+  let fd = openSync3(dest, flags, 384);
+  try {
+    if (fstatSync2(fd).nlink > 1) {
+      closeSync3(fd);
+      fd = -1;
+      unlinkSync3(dest);
+      fd = openSync3(dest, flags | constants2.O_EXCL, 384);
+    }
+    ftruncateSync(fd, 0);
+    writeFileSync2(fd, file.content);
+  } finally {
+    if (fd >= 0) closeSync3(fd);
+  }
   return dest;
 }
 function bufferIndexOf(haystack, needle, offset) {
@@ -9777,10 +9986,98 @@ function parseDisposition(headers) {
   };
 }
 function parsePartContentType(headers) {
-  const match = headers.match(/Content-Type:\s*(.+?)(?:\r?\n|$)/i);
-  return match?.[1]?.trim() ?? null;
+  const match = headers.match(/Content-Type:([^\r\n]*)/i);
+  const value = match?.[1]?.trim();
+  return value ? value : null;
+}
+function nestFormFields(pairs) {
+  const kept = pairs.filter(([name]) => !/(^|[[\]])__proto__([[\]]|$)/.test(name));
+  if (kept.length > FORM_FIELD_LIMIT) return Object.fromEntries(kept);
+  const nested = /* @__PURE__ */ new WeakSet();
+  const node = () => {
+    const created = /* @__PURE__ */ Object.create(null);
+    nested.add(created);
+    return created;
+  };
+  const isNode = (value) => typeof value === "object" && value !== null && nested.has(value);
+  const own = (params, key) => Object.prototype.hasOwnProperty.call(params, key) ? params[key] : void 0;
+  const list = (params, key) => {
+    let current = own(params, key);
+    if (current === void 0) {
+      current = [];
+      Reflect.set(params, key, current);
+    }
+    if (!Array.isArray(current)) throw new RangeError(`expected an array for '${key}'`);
+    return current;
+  };
+  const object = (params, key) => {
+    let current = own(params, key);
+    if (current === void 0) {
+      current = node();
+      Reflect.set(params, key, current);
+    }
+    if (!isNode(current)) throw new RangeError(`expected an object for '${key}'`);
+    return current;
+  };
+  const hasKey = (params, key) => {
+    if (key.includes("[]")) return false;
+    let level = params;
+    for (const part of key.split(/[[\]]+/).filter(Boolean)) {
+      if (!isNode(level) || own(level, part) === void 0) return false;
+      level = level[part];
+    }
+    return true;
+  };
+  const splitName = (name, depth) => {
+    if (depth === 0) {
+      const start2 = name.indexOf("[", 1);
+      return start2 === -1 ? [name, ""] : [name.slice(0, start2), name.slice(start2)];
+    }
+    if (name.startsWith("[]")) return ["[]", name.slice(2)];
+    const close = name.indexOf("]", 1);
+    return name.startsWith("[") && close !== -1 ? [name.slice(1, close), name.slice(close + 1)] : [name, ""];
+  };
+  const putListItem = (items, after, value, depth) => {
+    let childKey = after[2] === "[" && after.endsWith("]") ? after.slice(3, -1) : "";
+    if (childKey === "" || childKey.includes("[") || childKey.includes("]")) childKey = after.slice(2);
+    const last = items[items.length - 1];
+    if (isNode(last) && !hasKey(last, childKey)) put2(last, childKey, value, depth + 1);
+    else items.push(put2(node(), childKey, value, depth + 1));
+  };
+  const put2 = (params, name, value, depth) => {
+    const [key, after] = splitName(name, depth);
+    if (key === "") return void 0;
+    if (after === "" && key === "[]" && depth !== 0) return [value];
+    if (after === "") Reflect.set(params, key, value);
+    else if (after === "[") Reflect.set(params, name, value);
+    else if (after === "[]") list(params, key).push(value);
+    else if (after.startsWith("[]")) putListItem(list(params, key), after, value, depth);
+    else put2(object(params, key), after, value, depth + 1);
+    return params;
+  };
+  const tooDeep = (name) => {
+    let count = 0;
+    for (let at = name.indexOf("["); at !== -1; at = name.indexOf("[", at + 1)) {
+      if (++count >= FORM_DEPTH_LIMIT) return true;
+    }
+    return false;
+  };
+  const fields = node();
+  for (const [name, value] of kept) {
+    if (name.length > FORM_NAME_LIMIT || tooDeep(name)) {
+      Reflect.set(fields, name, value);
+      continue;
+    }
+    try {
+      put2(fields, name, value, 0);
+    } catch (error2) {
+      if (!(error2 instanceof RangeError)) throw error2;
+      Reflect.set(fields, name, value);
+    }
+  }
+  return fields;
 }
-var DEFAULT_MAX_UPLOAD_SIZE, warnedLimits, PayloadTooLargeError;
+var DEFAULT_MAX_UPLOAD_SIZE, warnedLimits, PayloadTooLargeError, FORM_DEPTH_LIMIT, FORM_FIELD_LIMIT, FORM_NAME_LIMIT, isUnsafeFieldName;
 var init_request = __esm({
   "../core/src/request.ts"() {
     "use strict";
@@ -9795,6 +10092,10 @@ var init_request = __esm({
         this.name = "PayloadTooLargeError";
       }
     };
+    FORM_DEPTH_LIMIT = 32;
+    FORM_FIELD_LIMIT = 4096;
+    FORM_NAME_LIMIT = 1024;
+    isUnsafeFieldName = (key) => key === "__proto__" || key === "constructor" || key === "prototype";
   }
 });
 
@@ -10301,7 +10602,7 @@ var init_routeDiscovery = __esm({
 
 // ../core/src/portTakeover.ts
 import { execFileSync } from "node:child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, unlinkSync as unlinkSync3 } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5, unlinkSync as unlinkSync4 } from "node:fs";
 import { join as join8 } from "node:path";
 function isTruthy2(value) {
   return ["true", "1", "yes", "on"].includes(String(value ?? "").trim().toLowerCase());
@@ -10355,7 +10656,7 @@ function readPidfile(port, baseDir) {
 }
 function removePidfile(port, baseDir) {
   try {
-    unlinkSync3(pidfilePath(port, baseDir));
+    unlinkSync4(pidfilePath(port, baseDir));
   } catch {
   }
 }
@@ -10456,21 +10757,6 @@ var init_portTakeover = __esm({
   }
 });
 
-// ../core/src/etag.ts
-function etagMatches(ifNoneMatch, etag) {
-  const strip = (tag) => tag.trim().replace(/^W\//, "");
-  const target = strip(etag);
-  return ifNoneMatch.split(",").some((candidate) => {
-    const trimmed = candidate.trim();
-    return trimmed === "*" || strip(trimmed) === target;
-  });
-}
-var init_etag = __esm({
-  "../core/src/etag.ts"() {
-    "use strict";
-  }
-});
-
 // ../core/src/sessionHandlers/syncBridge.ts
 import { Worker } from "node:worker_threads";
 function getBridge(key, workerSource, workerData) {
@@ -11839,14 +12125,18 @@ __export(session_exports, {
   Session: () => Session,
   VALID_SESSION_BACKENDS: () => VALID_SESSION_BACKENDS,
   buildSessionCookie: () => buildSessionCookie,
+  currentFormTokenSessionId: () => currentFormTokenSessionId,
   isSecureScheme: () => isSecureScheme,
   isValidSessionId: () => isValidSessionId,
+  runWithFormTokenSession: () => runWithFormTokenSession,
   sessionCookieName: () => sessionCookieName,
   sessionCookieToSend: () => sessionCookieToSend,
-  sessionStrictMode: () => sessionStrictMode
+  sessionStrictMode: () => sessionStrictMode,
+  setFormTokenSession: () => setFormTokenSession
 });
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
 import { createHash as createHash5, randomBytes as randomBytes4 } from "node:crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5, unlinkSync as unlinkSync4, readdirSync as readdirSync3 } from "node:fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5, unlinkSync as unlinkSync5, readdirSync as readdirSync3 } from "node:fs";
 import { join as join9 } from "node:path";
 function isValidSessionId(sessionId) {
   return typeof sessionId === "string" && SESSION_ID_PATTERN.test(sessionId);
@@ -11912,7 +12202,21 @@ function sessionCookieToSend(sess, existingSid, rawReq, rawRes) {
   const socketEncrypted = rawReq.socket?.encrypted === true;
   return buildSessionCookie(newSid, ttl, void 0, forwardedProto, socketEncrypted);
 }
-var SESSION_ID_PATTERN, VALID_SESSION_BACKENDS, CANONICAL_SESSION_BACKENDS, RETIRED_SESSION_BACKENDS, FileSessionHandler, RedisSessionHandler, FLASH_PREFIX, Session;
+function runWithFormTokenSession(fn) {
+  return sessionStore.run({ session: null }, fn);
+}
+function setFormTokenSession(session) {
+  const store = sessionStore.getStore();
+  if (store) store.session = session;
+}
+function currentFormTokenSessionId() {
+  const session = sessionStore.getStore()?.session;
+  const sid = session?.getSessionId();
+  if (!session || !sid) return "";
+  if (session.isFresh()) session.set("_tina4_csrf", true);
+  return sid;
+}
+var SESSION_ID_PATTERN, VALID_SESSION_BACKENDS, CANONICAL_SESSION_BACKENDS, RETIRED_SESSION_BACKENDS, FileSessionHandler, RedisSessionHandler, FLASH_PREFIX, Session, sessionStore;
 var init_session = __esm({
   "../core/src/session.ts"() {
     "use strict";
@@ -11996,7 +12300,7 @@ var init_session = __esm({
           const wrapper = JSON.parse(raw);
           if (wrapper._expires && wrapper._expires > 0 && Date.now() / 1e3 > wrapper._expires) {
             try {
-              unlinkSync4(filePath);
+              unlinkSync5(filePath);
             } catch {
             }
             return null;
@@ -12015,7 +12319,7 @@ var init_session = __esm({
       destroy(sessionId) {
         const filePath = this.filePath(sessionId);
         try {
-          if (existsSync8(filePath)) unlinkSync4(filePath);
+          if (existsSync8(filePath)) unlinkSync5(filePath);
         } catch {
         }
       }
@@ -12031,11 +12335,11 @@ var init_session = __esm({
               const raw = readFileSync6(fullPath, "utf-8");
               const wrapper = JSON.parse(raw);
               if (wrapper._expires && wrapper._expires > 0 && now > wrapper._expires) {
-                unlinkSync4(fullPath);
+                unlinkSync5(fullPath);
               }
             } catch {
               try {
-                unlinkSync4(fullPath);
+                unlinkSync5(fullPath);
               } catch {
               }
             }
@@ -12555,6 +12859,22 @@ var init_session = __esm({
         this.loaded = /* @__PURE__ */ new Map();
       }
     };
+    sessionStore = new AsyncLocalStorage3();
+  }
+});
+
+// ../core/src/etag.ts
+function etagMatches(ifNoneMatch, etag) {
+  const strip = (tag) => tag.trim().replace(/^W\//, "");
+  const target = strip(etag);
+  return ifNoneMatch.split(",").some((candidate) => {
+    const trimmed = candidate.trim();
+    return trimmed === "*" || strip(trimmed) === target;
+  });
+}
+var init_etag = __esm({
+  "../core/src/etag.ts"() {
+    "use strict";
   }
 });
 
@@ -12708,6 +13028,7 @@ async function sessionAutoStart(rawReq, rawRes, req2) {
     return;
   }
   req2.session = sess;
+  setFormTokenSession(sess);
   const origEnd = rawRes.end.bind(rawRes);
   let finalised = false;
   rawRes.end = function(...args) {
@@ -12736,6 +13057,7 @@ var _resetRequestCaches, COMPRESSIBLE_PREFIXES;
 var init_dispatchPipeline = __esm({
   "../core/src/dispatchPipeline.ts"() {
     "use strict";
+    init_session();
     init_logger();
     init_etag();
     COMPRESSIBLE_PREFIXES = [
@@ -12885,14 +13207,21 @@ function parseStack(stack) {
   const frames = [];
   const lines = stack.split("\n");
   for (const line of lines) {
-    let match = line.match(/^\s*at\s+(.+?)\s+\((.+?):(\d+):(\d+)\)/);
-    if (match) {
-      frames.push({ func: match[1], file: match[2], line: parseInt(match[3], 10), column: parseInt(match[4], 10) });
-      continue;
+    const t = line.trim();
+    if (!t.startsWith("at ")) continue;
+    const rest = t.slice(3);
+    let func = "{anonymous}";
+    let loc = rest;
+    if (rest.endsWith(")")) {
+      const open = rest.lastIndexOf(" (");
+      if (open >= 0) {
+        func = rest.slice(0, open);
+        loc = rest.slice(open + 2, -1);
+      }
     }
-    match = line.match(/^\s*at\s+(.+?):(\d+):(\d+)/);
-    if (match) {
-      frames.push({ func: "{anonymous}", file: match[1], line: parseInt(match[2], 10), column: parseInt(match[3], 10) });
+    const lc = loc.match(/:(\d+):(\d+)$/);
+    if (lc && lc.index !== void 0) {
+      frames.push({ func, file: loc.slice(0, lc.index), line: parseInt(lc[1], 10), column: parseInt(lc[2], 10) });
     }
   }
   return frames;
@@ -13217,7 +13546,7 @@ var init_rateLimiter = __esm({
 });
 
 // ../core/src/devMailbox.ts
-import { mkdirSync as mkdirSync7, readdirSync as readdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync6, unlinkSync as unlinkSync5, existsSync as existsSync9 } from "node:fs";
+import { mkdirSync as mkdirSync7, readdirSync as readdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync6, unlinkSync as unlinkSync6, existsSync as existsSync9 } from "node:fs";
 import { join as join11 } from "node:path";
 import { randomUUID } from "node:crypto";
 var DevMailbox;
@@ -13349,7 +13678,7 @@ var init_devMailbox = __esm({
           const filePath = join11(this.mailboxDir, folder, `${msgId}.json`);
           if (existsSync9(filePath)) {
             try {
-              unlinkSync5(filePath);
+              unlinkSync6(filePath);
               deleted = true;
             } catch {
             }
@@ -13368,7 +13697,7 @@ var init_devMailbox = __esm({
             if (existsSync9(dir)) {
               const files = readdirSync4(dir).filter((file) => file.endsWith(".json"));
               for (const file of files) {
-                unlinkSync5(join11(dir, file));
+                unlinkSync6(join11(dir, file));
               }
             }
           } catch {
@@ -13512,7 +13841,7 @@ function enginePath() {
 function runEngine(target) {
   const binary = enginePath();
   if (!binary) throw new MetricsEngineError(`tina4 not found on PATH - ${INSTALL_HINT}`);
-  const processResult = spawnSync(binary, ["metrics", "--path", target, "--json"], {
+  const processResult = spawnSync(binary, ["metrics", "--path", target, "--json", "--no-history"], {
     encoding: "utf8",
     timeout: 6e4,
     maxBuffer: 64 * 1024 * 1024
@@ -16173,21 +16502,45 @@ function safePath(projectRoot3, relPath) {
   if (resolved !== projectRoot3 && !resolved.startsWith(rootPrefix)) {
     throw new Error(`Path escapes project directory: ${relPath}`);
   }
-  let real = null;
+  let realRoot;
   try {
-    real = fs4.realpathSync(resolved);
+    realRoot = fs4.realpathSync(projectRoot3);
   } catch {
-    real = null;
+    return resolved;
   }
-  if (real !== null) {
-    const realRoot = fs4.realpathSync(projectRoot3);
-    const realPrefix = realRoot.endsWith(path3.sep) ? realRoot : realRoot + path3.sep;
-    if (real !== realRoot && !real.startsWith(realPrefix)) {
-      throw new Error(`Path escapes project directory: ${relPath}`);
-    }
+  const real = realPathOf(resolved);
+  const realPrefix = realRoot.endsWith(path3.sep) ? realRoot : realRoot + path3.sep;
+  if (real === null || real !== realRoot && !real.startsWith(realPrefix)) {
+    throw new Error(`Path escapes project directory: ${relPath}`);
   }
   return resolved;
 }
+function realPathOf(p, hops = 0) {
+  let probe = p;
+  while (!fs4.existsSync(probe) && !isSymlink(probe) && path3.dirname(probe) !== probe) {
+    probe = path3.dirname(probe);
+  }
+  try {
+    return fs4.realpathSync.native(probe);
+  } catch {
+    if (hops >= 40) return null;
+    let target;
+    try {
+      target = fs4.readlinkSync(probe);
+    } catch {
+      return null;
+    }
+    const base = path3.isAbsolute(target) ? target : path3.dirname(probe) + path3.sep + target;
+    return realPathOf(base + p.slice(probe.length), hops + 1);
+  }
+}
+function isSymlink(p) {
+  try {
+    return fs4.lstatSync(p).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
 function redactEnv(key, value) {
   const sensitive = ["secret", "password", "token", "key", "credential", "api_key"];
   if (sensitive.some((s) => key.toLowerCase().includes(s))) {
@@ -17032,8 +17385,10 @@ function registerDevTools(server) {
           return { error: `Invalid path ${JSON.stringify(rel)}: ${proseErr}` };
         }
         rel = normalizeCoderPath(projectRoot4, rel);
-        const resolved = path3.resolve(projectRoot4, rel);
-        if (!resolved.startsWith(projectRoot4)) {
+        let resolved;
+        try {
+          resolved = safePath(projectRoot4, rel);
+        } catch {
           return { error: `Path escapes project directory: ${rel}` };
         }
         if (!fs4.existsSync(resolved) || !fs4.statSync(resolved).isFile()) {
@@ -17330,6 +17685,7 @@ var req, PARSE_ERROR, INVALID_REQUEST, METHOD_NOT_FOUND, INVALID_PARAMS, INTERNA
 var init_mcp = __esm({
   "../core/src/mcp.ts"() {
     "use strict";
+    init_slashTrim();
     init_version();
     req = createRequire2(import.meta.url);
     PARSE_ERROR = -32700;
@@ -17356,7 +17712,7 @@ var init_mcp = __esm({
       // threaded, so this in-process map is the whole coordination mechanism.
       _sseChannels = /* @__PURE__ */ new Map();
       constructor(mcpPath, name = "Tina4 MCP", version = "1.0.0") {
-        this.path = mcpPath.replace(/\/+$/, "");
+        this.path = rtrimSlashes(mcpPath);
         this.name = name;
         this.version = version;
         _McpServer._instances.push(this);
@@ -21140,7 +21496,7 @@ var init_job = __esm({
 });
 
 // ../core/src/queueBackends/liteBackend.ts
-import { mkdirSync as mkdirSync11, readdirSync as readdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync9, unlinkSync as unlinkSync6, existsSync as existsSync16 } from "node:fs";
+import { mkdirSync as mkdirSync11, readdirSync as readdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync9, unlinkSync as unlinkSync7, existsSync as existsSync16 } from "node:fs";
 import { join as join18 } from "node:path";
 import { randomUUID as randomUUID5 } from "node:crypto";
 var LiteBackend;
@@ -21310,7 +21666,7 @@ var init_liteBackend = __esm({
           }
           if (record.availableAt && record.availableAt > now) continue;
           try {
-            unlinkSync6(filePath);
+            unlinkSync7(filePath);
           } catch {
             continue;
           }
@@ -21344,10 +21700,10 @@ var init_liteBackend = __esm({
           job.priority = job.priority ?? 0;
           this.writeReserved(queue, job);
           try {
-            unlinkSync6(filePath);
+            unlinkSync7(filePath);
           } catch {
             try {
-              unlinkSync6(this.reservedPath(queue, job.id));
+              unlinkSync7(this.reservedPath(queue, job.id));
             } catch {
             }
             continue;
@@ -21369,10 +21725,10 @@ var init_liteBackend = __esm({
           job.priority = job.priority ?? 0;
           this.writeReserved(queue, job);
           try {
-            unlinkSync6(filePath);
+            unlinkSync7(filePath);
           } catch {
             try {
-              unlinkSync6(this.reservedPath(queue, job.id));
+              unlinkSync7(this.reservedPath(queue, job.id));
             } catch {
             }
             continue;
@@ -21387,7 +21743,7 @@ var init_liteBackend = __esm({
        */
       clearReservation(queue, jobId) {
         try {
-          unlinkSync6(this.reservedPath(queue, jobId));
+          unlinkSync7(this.reservedPath(queue, jobId));
         } catch {
         }
       }
@@ -21430,7 +21786,7 @@ var init_liteBackend = __esm({
         try {
           const files = readdirSync9(dir).filter((f) => f.endsWith(".queue-data"));
           for (const file of files) {
-            unlinkSync6(join18(dir, file));
+            unlinkSync7(join18(dir, file));
             count++;
           }
         } catch {
@@ -21440,7 +21796,7 @@ var init_liteBackend = __esm({
           if (existsSync16(failedDir)) {
             const files = readdirSync9(failedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
-              unlinkSync6(join18(failedDir, file));
+              unlinkSync7(join18(failedDir, file));
               count++;
             }
           }
@@ -21451,7 +21807,7 @@ var init_liteBackend = __esm({
           if (existsSync16(reservedDir)) {
             const files = readdirSync9(reservedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
-              unlinkSync6(join18(reservedDir, file));
+              unlinkSync7(join18(reservedDir, file));
               count++;
             }
           }
@@ -21509,7 +21865,7 @@ var init_liteBackend = __esm({
               const prefix = this.nextPrefix();
               const queueDir = join18(this.basePath, q);
               writeFileSync9(join18(queueDir, `${prefix}_${jobId}.queue-data`), JSON.stringify(job, null, 2));
-              unlinkSync6(filePath);
+              unlinkSync7(filePath);
               return true;
             }
           }
@@ -21545,7 +21901,7 @@ var init_liteBackend = __esm({
             const files = readdirSync9(failedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
               try {
-                unlinkSync6(join18(failedDir, file));
+                unlinkSync7(join18(failedDir, file));
                 count++;
               } catch {
               }
@@ -21560,7 +21916,7 @@ var init_liteBackend = __esm({
               try {
                 const job = JSON.parse(readFileSync14(join18(dir, file), "utf-8"));
                 if (job.status === status2) {
-                  unlinkSync6(join18(dir, file));
+                  unlinkSync7(join18(dir, file));
                   count++;
                 }
               } catch {
@@ -21595,7 +21951,7 @@ var init_liteBackend = __esm({
               job.delayUntil = null;
               const prefix = this.nextPrefix();
               writeFileSync9(join18(queueDir, `${prefix}_${job.id}.queue-data`), JSON.stringify(job, null, 2));
-              unlinkSync6(filePath);
+              unlinkSync7(filePath);
               count++;
             } catch {
             }
@@ -21627,10 +21983,10 @@ var init_liteBackend = __esm({
             job.priority = job.priority ?? 0;
             this.writeReserved(queue, job);
             try {
-              unlinkSync6(filePath);
+              unlinkSync7(filePath);
             } catch {
               try {
-                unlinkSync6(this.reservedPath(queue, job.id));
+                unlinkSync7(this.reservedPath(queue, job.id));
               } catch {
               }
               continue;
@@ -21732,7 +22088,7 @@ var init_liteBackend = __esm({
       retryJob(queue, job, delaySeconds) {
         this.clearReservation(queue, job.id);
         try {
-          unlinkSync6(join18(this.ensureFailedDir(queue), `${job.id}.queue-data`));
+          unlinkSync7(join18(this.ensureFailedDir(queue), `${job.id}.queue-data`));
         } catch {
         }
         job.attempts = (job.attempts || 0) + 1;
@@ -22282,7 +22638,8 @@ function archiveDir() {
   return p;
 }
 function slugify(title) {
-  const slug = (title || "").trim().toLowerCase().replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+  const dashed = (title || "").trim().toLowerCase().replace(/[^A-Za-z0-9_-]+/g, "-");
+  const slug = trimChar(dashed, 45);
   return slug.slice(0, 80) || `plan-${Math.floor(Date.now() / 1e3)}`;
 }
 function parse(text) {
@@ -22419,6 +22776,7 @@ var PLAN_DIR, CURRENT_FILE, ARCHIVE_SUBDIR, STEP_RE, Plan;
 var init_plan = __esm({
   "../core/src/plan.ts"() {
     "use strict";
+    init_slashTrim();
     PLAN_DIR = "plan";
     CURRENT_FILE = ".current";
     ARCHIVE_SUBDIR = "done";
@@ -22690,7 +23048,7 @@ var init_plan = __esm({
         const existing = (currentPlan.steps || []).map((s) => s.text || "");
         const title = currentPlan.title || target;
         const goal = currentPlan.goal || "";
-        const aiUrl = process.env.TINA4_AI_URL || "http://localhost:11437/api/chat";
+        const aiUrl = process.env.TINA4_AI_URL || "http://localhost:11435/api/chat";
         const aiModel = process.env.TINA4_AI_MODEL || "qwen2.5-coder:14b";
         const prompts = fleshPrompt(title, goal, existing, prompt);
         const fetched = await fetchFleshReply(aiUrl, aiModel, prompts);
@@ -23658,7 +24016,7 @@ function relativePath(absPath, projectRoot3, frameworkRoots) {
 }
 function tokenise(text) {
   if (!text) return [];
-  const expanded = text.replace(CAMEL_SPLIT, (_m, a, b, c, d) => a ? `${a} ${b}` : `${c} ${d}`).toLowerCase();
+  const expanded = text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z])(?=[A-Z][a-z])/g, "$1 ").toLowerCase();
   return expanded.split(/[\s_\-./:,;()\[\]{}\\]+/).filter((p) => p.length > 0);
 }
 function summariseDoc(doc) {
@@ -23889,7 +24247,7 @@ function returnFromSignature(signature) {
   const rest = signature.slice(close + 1).trim();
   return rest.startsWith(":") ? rest.slice(1).trim() : "";
 }
-var STDLIB_ALLOWLIST, _DOCS_CACHE, __FILENAME, __DIRNAME, USER_DIRS, CAMEL_SPLIT, FENCE_RE, CALL_RE, sharedFrameworkIndex, Docs;
+var STDLIB_ALLOWLIST, _DOCS_CACHE, __FILENAME, __DIRNAME, USER_DIRS, FENCE_RE, CALL_RE, sharedFrameworkIndex, Docs;
 var init_docs = __esm({
   "../core/src/docs.ts"() {
     "use strict";
@@ -24028,7 +24386,6 @@ var init_docs = __esm({
     __FILENAME = fileURLToPath5(import.meta.url);
     __DIRNAME = path8.dirname(__FILENAME);
     USER_DIRS = ["src/orm", "src/routes", "src/app", "src/services", "src/models"];
-    CAMEL_SPLIT = /([a-z0-9])([A-Z])|([A-Z]+)([A-Z][a-z])/g;
     FENCE_RE = new RegExp(
       String.fromCharCode(96, 96, 96) + "[a-zA-Z0-9_+-]*\\n([\\s\\S]*?)\\n" + String.fromCharCode(96, 96, 96),
       "g"
@@ -24402,7 +24759,7 @@ ${end}
 
 // ../core/src/devAdmin.ts
 import { cpus as osCpus } from "node:os";
-import { readFileSync as readFileSync18, writeFileSync as writeFileSync13, existsSync as existsSync20, readdirSync as readdirSync13, mkdirSync as mkdirSync14, copyFileSync as copyFileSync2, statSync as statSync15, openSync as openSync4, closeSync as closeSync4, fstatSync as fstatSync2, fchmodSync as fchmodSync2, ftruncateSync, constants as constants3, realpathSync as realpathSync6, lstatSync } from "node:fs";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync13, existsSync as existsSync20, readdirSync as readdirSync13, mkdirSync as mkdirSync14, copyFileSync as copyFileSync2, statSync as statSync15, openSync as openSync5, closeSync as closeSync5, fstatSync as fstatSync3, fchmodSync as fchmodSync2, ftruncateSync as ftruncateSync2, constants as constants4, realpathSync as realpathSync6, lstatSync as lstatSync3 } from "node:fs";
 import { join as join22, dirname as dirname11, resolve as resolve12, relative as relative9, sep as sep6, basename as basename5 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
@@ -24601,8 +24958,41 @@ function quoteTableRef(name) {
   }
   return parts.map((p) => `"${p}"`).join(".");
 }
+function parseSeedRequest(url, body) {
+  const b = body ?? {};
+  const table2 = String(url.searchParams.get("table") ?? b.table ?? "");
+  const count = parseInt(String(url.searchParams.get("count") ?? b.count ?? "10"), 10) || 10;
+  const seedRaw = url.searchParams.get("seed") ?? b.seed;
+  const seed = seedRaw !== void 0 && seedRaw !== null && String(seedRaw) !== "" ? Number.isNaN(parseInt(String(seedRaw), 10)) ? void 0 : parseInt(String(seedRaw), 10) : void 0;
+  const clear = String(url.searchParams.get("clear") ?? b.clear ?? "") === "true" || b.clear === true;
+  const strict = String(url.searchParams.get("strict") ?? b.strict ?? "") === "true" || b.strict === true;
+  return { table: table2, count, seed, clear, strict };
+}
+function buildSeedFieldMap(columns, fake) {
+  const rules = [
+    [(n) => n.includes("email"), () => fake.email()],
+    [(n) => n.includes("name"), () => fake.name()],
+    [(n) => n.includes("phone"), () => fake.phone()],
+    [(n) => n.includes("address") || n.includes("city") || n.includes("country"), () => fake.address()],
+    [(n) => n.includes("url") || n.includes("website"), () => fake.url()],
+    [(_n, t) => t.includes("int"), () => fake.integer(1, 1e3)],
+    [(_n, t) => /real|float|double|numeric|decimal/.test(t), () => fake.numeric(0, 1e3, 2)],
+    [(_n, t) => t.includes("bool"), () => fake.boolean()],
+    [(_n, t) => t.includes("date") || t.includes("time"), () => fake.date()]
+  ];
+  const sentence = () => fake.sentence(3);
+  const fieldMap = {};
+  for (const col of columns) {
+    if (col.name.toLowerCase() === "id" || col.primaryKey === true) continue;
+    const name = col.name.toLowerCase();
+    const type2 = col.type.toLowerCase();
+    const rule = rules.find(([matches]) => matches(name, type2));
+    fieldMap[col.name] = rule ? rule[1] : sentence;
+  }
+  return fieldMap;
+}
 function supervisorBaseUrl() {
-  const explicit = (process.env.TINA4_SUPERVISOR_URL ?? "").replace(/\/+$/, "");
+  const explicit = rtrimSlashes(process.env.TINA4_SUPERVISOR_URL ?? "");
   if (explicit) return explicit;
   const agentPort = (process.env.TINA4_AGENT_PORT ?? "").trim();
   if (/^\d+$/.test(agentPort)) return `http://127.0.0.1:${parseInt(agentPort, 10)}`;
@@ -24610,6 +25000,42 @@ function supervisorBaseUrl() {
   if (/^\d+$/.test(fwPort)) return `http://127.0.0.1:${parseInt(fwPort, 10) + 2e3}`;
   return "http://127.0.0.1:9145";
 }
+function buildSupervisorBody(method, body) {
+  if (method !== "POST" && method !== "PUT" && method !== "PATCH" && method !== "DELETE") return void 0;
+  if (body === void 0 || body === null) return void 0;
+  if (typeof body === "string") return body;
+  if (typeof body !== "object") return void 0;
+  let outBody = body;
+  if (!Array.isArray(body)) {
+    const pf = body.plan_file;
+    if (typeof pf === "string" && pf && !pf.includes("/")) outBody = { ...body, plan_file: `plan/${pf}` };
+  }
+  return JSON.stringify(outBody);
+}
+async function streamEventStream(res, upstream, timer) {
+  res.raw.writeHead(upstream.status || 200, {
+    "Content-Type": upstream.headers.get("content-type") ?? "text/event-stream",
+    "Cache-Control": "no-cache",
+    Connection: "keep-alive"
+  });
+  if (typeof res.raw.flushHeaders === "function") res.raw.flushHeaders();
+  if (!upstream.body) {
+    res.raw.end();
+    clearTimeout(timer);
+    return;
+  }
+  const reader = upstream.body.getReader();
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) res.raw.write(Buffer.from(value));
+    }
+  } finally {
+    clearTimeout(timer);
+    res.raw.end();
+  }
+}
 async function proxyToSupervisor(req2, res, downstreamPath) {
   const base = supervisorBaseUrl();
   let qs = "";
@@ -24620,24 +25046,7 @@ async function proxyToSupervisor(req2, res, downstreamPath) {
   }
   const target = `${base}${downstreamPath}${qs}`;
   const method = (req2.method ?? "GET").toUpperCase();
-  let bodyText;
-  if (method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE") {
-    const body = req2.body;
-    if (body !== void 0 && body !== null) {
-      if (typeof body === "string") {
-        bodyText = body;
-      } else if (typeof body === "object") {
-        let outBody = body;
-        if (!Array.isArray(body)) {
-          const pf = body.plan_file;
-          if (typeof pf === "string" && pf && !pf.includes("/")) {
-            outBody = { ...body, plan_file: `plan/${pf}` };
-          }
-        }
-        bodyText = JSON.stringify(outBody);
-      }
-    }
-  }
+  const bodyText = buildSupervisorBody(method, req2.body);
   const timeoutMs = downstreamPath === "/execute" || downstreamPath === "/chat" ? 6e5 : 3e4;
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), timeoutMs);
@@ -24663,30 +25072,7 @@ async function proxyToSupervisor(req2, res, downstreamPath) {
   }
   const ct = (upstream.headers.get("content-type") ?? "").toLowerCase();
   if (ct.includes("text/event-stream")) {
-    res.raw.writeHead(upstream.status || 200, {
-      "Content-Type": upstream.headers.get("content-type") ?? "text/event-stream",
-      "Cache-Control": "no-cache",
-      Connection: "keep-alive"
-    });
-    if (typeof res.raw.flushHeaders === "function") {
-      res.raw.flushHeaders();
-    }
-    if (!upstream.body) {
-      res.raw.end();
-      clearTimeout(timer);
-      return;
-    }
-    const reader = upstream.body.getReader();
-    try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        if (value) res.raw.write(Buffer.from(value));
-      }
-    } finally {
-      clearTimeout(timer);
-      res.raw.end();
-    }
+    await streamEventStream(res, upstream, timer);
     return;
   }
   clearTimeout(timer);
@@ -24803,13 +25189,13 @@ function handleGalleryDeploy(router) {
     res.json({ deployed: name, files: copied });
   };
 }
-function realPathOf(target) {
+function realPathOf2(target) {
   let existing = target;
   const tail = [];
   for (; ; ) {
     let present = false;
     try {
-      lstatSync(existing);
+      lstatSync3(existing);
       present = true;
     } catch {
     }
@@ -24821,9 +25207,9 @@ function realPathOf(target) {
 }
 function safeJoin(projectRoot3, rel, extraRoots = []) {
   try {
-    const root = realPathOf(resolve12(projectRoot3));
-    const resolved = realPathOf(resolve12(root, rel));
-    const roots = [root, ...extraRoots.filter(Boolean).map((r) => realPathOf(resolve12(r)))];
+    const root = realPathOf2(resolve12(projectRoot3));
+    const resolved = realPathOf2(resolve12(root, rel));
+    const roots = [root, ...extraRoots.filter(Boolean).map((r) => realPathOf2(resolve12(r)))];
     for (const r of roots) {
       if (resolved === r || resolved.startsWith(r.endsWith(sep6) ? r : r + sep6)) return resolved;
     }
@@ -24832,7 +25218,7 @@ function safeJoin(projectRoot3, rel, extraRoots = []) {
   return null;
 }
 function resolvedRelative(projectRoot3, resolvedPath) {
-  return relative9(realPathOf(resolve12(projectRoot3)), resolvedPath);
+  return relative9(realPathOf2(resolve12(projectRoot3)), resolvedPath);
 }
 function devFilesHidden(name) {
   if (DEV_FILES_IGNORED.has(name)) return true;
@@ -24860,7 +25246,7 @@ async function devGitInfo(root) {
     if (!inside || inside.trim() !== "true") return empty;
     const branch = (git(["rev-parse", "--abbrev-ref", "HEAD"]) ?? "").trim();
     const topRaw = git(["rev-parse", "--show-toplevel"]);
-    const gitRoot = topRaw && topRaw.trim() !== "" ? topRaw.trim().replace(/\\/g, "/").replace(/\/+$/, "") : null;
+    const gitRoot = topRaw && topRaw.trim() !== "" ? rtrimSlashes(topRaw.trim().replace(/\\/g, "/")) : null;
     const status2 = /* @__PURE__ */ new Map();
     const porcelain = git(["status", "--porcelain", "-uall"]);
     if (porcelain) {
@@ -24879,6 +25265,44 @@ async function devGitInfo(root) {
     return empty;
   }
 }
+function devGitLabel(gitPath, isDir, gitStatus) {
+  const code = gitStatus.get(gitPath);
+  if (code !== void 0) return devGitStatusLabel(code);
+  if (isDir) {
+    const prefix = gitPath + "/";
+    for (const [gf, gc] of gitStatus) {
+      if (gf.startsWith(prefix)) return gc === "??" ? "untracked" : "modified";
+    }
+  }
+  return "clean";
+}
+function devDirHasVisibleChild(full) {
+  try {
+    for (const c of readdirSync13(full)) {
+      if (!devFilesHidden(c)) return true;
+    }
+  } catch {
+  }
+  return false;
+}
+function buildFileEntry(name, full, entryRel, cwdInGit, gitStatus) {
+  let isDir = false;
+  let size = null;
+  try {
+    const st = statSync15(full);
+    isDir = st.isDirectory();
+    if (!isDir) size = st.size;
+  } catch {
+  }
+  return {
+    name,
+    path: entryRel,
+    is_dir: isDir,
+    has_children: isDir ? devDirHasVisibleChild(full) : null,
+    git_status: devGitLabel(cwdInGit + entryRel, isDir, gitStatus),
+    size
+  };
+}
 function devAdminLanguage(rel) {
   const base = (rel.split(/[\\/]/).pop() ?? "").toLowerCase();
   if (base === "dockerfile" || base === "dockerfile.dev" || base === "dockerfile.prod") {
@@ -24893,14 +25317,14 @@ function devAdminLanguage(rel) {
 function readDevFile(target) {
   let fd;
   try {
-    fd = openSync4(target, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
-    if (!fstatSync2(fd).isFile()) return null;
+    fd = openSync5(target, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+    if (!fstatSync3(fd).isFile()) return null;
     return readFileSync18(fd);
   } catch (error2) {
     if (["ENOENT", "ENOTDIR", "ELOOP"].includes(error2.code ?? "")) return null;
     throw error2;
   } finally {
-    if (fd !== void 0) closeSync4(fd);
+    if (fd !== void 0) closeSync5(fd);
   }
 }
 function mcpSecureEqual(expected, provided) {
@@ -25127,10 +25551,11 @@ function toolbarJs() {
     connect();
 })();`;
 }
-var cpuCount, DEV_MCP_PREFIXES, DEV_PUBLIC_ASSETS, DEV_SECRET_BASENAMES, DEV_SECRET_SUFFIXES, MessageLog, RequestInspector, ErrorTracker, DevMailboxStore, DevQueue, WsTracker, DevAdmin, handleDashboard, _reloadMtime, _reloadFile, handleMtime, handleReload, handleMessages, handleMessagesClear, handleRequests, handleRequestsClear, handleSystem, handleMessagesSearch, handleQueue, handleQueueTopics, handleQueueDeadLetters, handleQueueRetry, handleQueuePurge, handleQueueReplay, handleMailbox, handleMailboxRead, handleMailboxSeed, handleMailboxClear, handleTable, handleTables, handleSeed, handleQuery, handleBroken, handleBrokenResolve, handleBrokenClear, handleWebsockets, handleWebsocketsDisconnect, handleTool, DEFAULT_MCP_URL, handleGroundingStatus, handleGroundingToken, handleMigrate, handleSeedRun, handleTest, handleThreads, handleThreadsSub, handleConnections, handleConnectionsTest, handleConnectionsSave, __devAdminFilename, __devAdminDirname, handleGalleryList, handleVersionCheck, handleThoughts, handleSuperviseStub, DEV_FILES_IGNORED, handleFiles, DEV_ADMIN_LANG_MAP, handleFileRead, handleFileSave, handleFileRaw, handleFileRename, handleFileDelete, handleDepsSearch, handleDepsInstall, handleGitStatus, handleMcpTools, handleMcpCall, handleMcpStreamable, handleMcpDelete, handleMcpGet405, handleMcpLegacyMessage, handleMcpSse, handleScaffoldList, handleScaffoldRun, handlePlanCurrent, handlePlanList, handlePlanCreate, handlePlanSwitch, handlePlanCompleteStep, handlePlanAddStep, handlePlanNote, handlePlanArchive, handlePlanRead, handlePlanFlesh, handleIndexRebuild, handleIndexSearch, handleIndexFile, handleIndexOverview, handleDocsSearch, handleDocsClass, handleDocsMethod, handleDocsIndex, handleDocsWellKnown, handleDevAdminJs, handleToolbarCss, handleToolbarJs;
+var cpuCount, DEV_MCP_PREFIXES, DEV_PUBLIC_ASSETS, DEV_SECRET_BASENAMES, DEV_SECRET_SUFFIXES, MessageLog, RequestInspector, ErrorTracker, DevMailboxStore, DevQueue, WsTracker, DevAdmin, handleDashboard, _reloadMtime, _reloadFile, handleMtime, handleReload, handleMessages, handleMessagesClear, handleRequests, handleRequestsClear, handleSystem, handleMessagesSearch, handleQueue, handleQueueTopics, handleQueueDeadLetters, handleQueueRetry, handleQueuePurge, handleQueueReplay, handleMailbox, handleMailboxRead, handleMailboxSeed, handleMailboxClear, handleTable, handleTables, handleSeed, handleQuery, handleBroken, handleBrokenResolve, handleBrokenClear, handleWebsockets, handleWebsocketsDisconnect, handleTool, DEFAULT_MCP_URL, handleGroundingStatus, handleGroundingToken, handleMigrate, handleSeedRun, handleTest, handleThreads, handleThreadsSub, handleConnections, handleConnectionsTest, handleConnectionsSave, __devAdminFilename, __devAdminDirname, handleGalleryList, handleVersionCheck, handleThoughts, handleSuperviseStub, DEV_FILES_IGNORED, handleFiles, DEV_ADMIN_LANG_MAP, handleFileRead, handleFileSave, handleFileRaw, handleFileRename, handleFileDelete, handleDepsSearch, handleDepsInstall, handleGitStatus, handleMcpTools, handleMcpCall, handleMcpStreamable, handleMcpDelete, handleMcpGet405, handleMcpLegacyMessage, handleMcpSse, handleScaffoldList, handleScaffoldRun, handlePlanCurrent, handlePlanList, handlePlanCreate, handlePlanSwitch, handlePlanCompleteStep, handlePlanAddStep, handlePlanNote, handlePlanArchive, handlePlanRead, handlePlanFlesh, handleIndexRebuild, handleIndexSearch, handleIndexFile, handleIndexOverview, handleDocsSearch, handleDocsClass, handleDocsMethod, handleDocsIndex, handleDocsWellKnown, handleDevAdminJs, handleDevAdminSplit, handleToolbarCss, handleToolbarJs;
 var init_devAdmin = __esm({
   "../core/src/devAdmin.ts"() {
     "use strict";
+    init_slashTrim();
     init_devMailbox();
     init_upstreamResponse();
     init_dotenv();
@@ -25597,6 +26022,7 @@ var init_devAdmin = __esm({
           { method: "GET", pattern: "/__dev/api/docs/.well-known.json", handler: handleDocsWellKnown },
           // JS asset
           { method: "GET", pattern: "/__dev/js/tina4-dev-admin.min.js", handler: handleDevAdminJs },
+          { method: "GET", pattern: "/__dev/split", handler: handleDevAdminSplit },
           // Dev-toolbar assets — served as external CSS/JS so the injected toolbar is
           // CSP-clean (no inline style=, onclick=, or <script>) under a strict
           // `default-src 'self'`. Parity with PHP's /__dev/toolbar.css + toolbar.js.
@@ -25963,13 +26389,7 @@ var init_devAdmin = __esm({
     };
     handleSeed = async (req2, res) => {
       const url = new URL(req2.url ?? "/", "http://localhost");
-      const body = req2.body ?? {};
-      const table2 = url.searchParams.get("table") ?? body?.table ?? "";
-      const count = parseInt(String(url.searchParams.get("count") ?? body?.count ?? "10"), 10) || 10;
-      const seedRaw = url.searchParams.get("seed") ?? body?.seed;
-      const seed = seedRaw !== void 0 && seedRaw !== null && String(seedRaw) !== "" ? Number.isNaN(parseInt(String(seedRaw), 10)) ? void 0 : parseInt(String(seedRaw), 10) : void 0;
-      const clear = String(url.searchParams.get("clear") ?? body?.clear ?? "") === "true" || body?.clear === true;
-      const strict = String(url.searchParams.get("strict") ?? body?.strict ?? "") === "true" || body?.strict === true;
+      const { table: table2, count, seed, clear, strict } = parseSeedRequest(url, req2.body);
       if (!table2) {
         res.json({ error: "Missing table parameter" });
         return;
@@ -25984,33 +26404,7 @@ var init_devAdmin = __esm({
           res.json({ error: `Table '${table2}' not found or has no columns` });
           return;
         }
-        const fieldMap = {};
-        for (const col of columns) {
-          const name = col.name.toLowerCase();
-          const type2 = col.type.toLowerCase();
-          if (name === "id" || col.primaryKey === true) continue;
-          if (name.includes("email")) {
-            fieldMap[col.name] = () => fake.email();
-          } else if (name.includes("name")) {
-            fieldMap[col.name] = () => fake.name();
-          } else if (name.includes("phone")) {
-            fieldMap[col.name] = () => fake.phone();
-          } else if (name.includes("address") || name.includes("city") || name.includes("country")) {
-            fieldMap[col.name] = () => fake.address();
-          } else if (name.includes("url") || name.includes("website")) {
-            fieldMap[col.name] = () => fake.url();
-          } else if (type2.includes("int")) {
-            fieldMap[col.name] = () => fake.integer(1, 1e3);
-          } else if (type2.includes("real") || type2.includes("float") || type2.includes("double") || type2.includes("numeric") || type2.includes("decimal")) {
-            fieldMap[col.name] = () => fake.numeric(0, 1e3, 2);
-          } else if (type2.includes("bool")) {
-            fieldMap[col.name] = () => fake.boolean();
-          } else if (type2.includes("date") || type2.includes("time")) {
-            fieldMap[col.name] = () => fake.date();
-          } else {
-            fieldMap[col.name] = () => fake.sentence(3);
-          }
-        }
+        const fieldMap = buildSeedFieldMap(columns, fake);
         const summary = await seedTable2(db, table2, count, fieldMap, void 0, { clear, strict });
         res.json({ seeded: summary.seeded, failed: summary.failed, errors: summary.errors, table: table2 });
       } catch (e) {
@@ -26183,9 +26577,9 @@ var init_devAdmin = __esm({
     };
     handleTest = async (_req, res) => {
       try {
-        const { execFile } = await import("node:child_process");
+        const { execFile: execFile2 } = await import("node:child_process");
         const { promisify } = await import("node:util");
-        const run = promisify(execFile);
+        const run = promisify(execFile2);
         try {
           const { stdout, stderr } = await run("npm", ["test"], {
             cwd: resolve12(process.cwd()),
@@ -26303,9 +26697,9 @@ var init_devAdmin = __esm({
       }
       try {
         const envPath = join22(process.cwd(), ".env");
-        const fd = openSync4(envPath, constants3.O_RDWR | constants3.O_APPEND | constants3.O_CREAT | (constants3.O_NOFOLLOW ?? 0) | (constants3.O_NONBLOCK ?? 0), 384);
+        const fd = openSync5(envPath, constants4.O_RDWR | constants4.O_APPEND | constants4.O_CREAT | (constants4.O_NOFOLLOW ?? 0) | (constants4.O_NONBLOCK ?? 0), 384);
         try {
-          const info = fstatSync2(fd);
+          const info = fstatSync3(fd);
           if (!info.isFile() || info.nlink !== 1) throw new Error("Refusing a non-regular or multiply-linked configuration file");
           fchmodSync2(fd, 384);
           const lines = readFileSync18(fd, "utf-8").split("\n");
@@ -26335,10 +26729,10 @@ var init_devAdmin = __esm({
           for (const [key, found] of Object.entries(keysFound)) {
             if (!found) newLines.push(`${key}=${values[key]}`);
           }
-          ftruncateSync(fd, 0);
+          ftruncateSync2(fd, 0);
           writeFileSync13(fd, newLines.join("\n") + "\n");
         } finally {
-          closeSync4(fd);
+          closeSync5(fd);
         }
         res.json({ success: true });
       } catch (e) {
@@ -26461,48 +26855,7 @@ var init_devAdmin = __esm({
         const full = join22(target, name);
         const entryRel = relative9(root, full).replace(/\\/g, "/");
         if (isSecretPath(entryRel)) continue;
-        let isDir = false;
-        let size = null;
-        try {
-          const st = statSync15(full);
-          isDir = st.isDirectory();
-          if (!isDir) size = st.size;
-        } catch {
-        }
-        const gitPath = cwdInGit + entryRel;
-        let gitLabel = "clean";
-        const code = gitStatus.get(gitPath);
-        if (code !== void 0) {
-          gitLabel = devGitStatusLabel(code);
-        } else if (isDir) {
-          const prefix = gitPath + "/";
-          for (const [gf, gc] of gitStatus) {
-            if (gf.startsWith(prefix)) {
-              gitLabel = gc === "??" ? "untracked" : "modified";
-              break;
-            }
-          }
-        }
-        let hasChildren = null;
-        if (isDir) {
-          hasChildren = false;
-          try {
-            for (const c of readdirSync13(full)) {
-              if (devFilesHidden(c)) continue;
-              hasChildren = true;
-              break;
-            }
-          } catch {
-          }
-        }
-        entries.push({
-          name,
-          path: entryRel,
-          is_dir: isDir,
-          has_children: hasChildren,
-          git_status: gitLabel,
-          size
-        });
+        entries.push(buildFileEntry(name, full, entryRel, cwdInGit, gitStatus));
       }
       res.json({ path: relative9(root, target).replace(/\\/g, "/") || ".", branch, entries });
     };
@@ -27035,6 +27388,31 @@ var init_devAdmin = __esm({
       res.raw.writeHead(404, { "Content-Type": "text/plain" });
       res.raw.end("tina4-dev-admin.min.js not found");
     };
+    handleDevAdminSplit = async (_req, res) => {
+      const { readFileSync: readFileSync27, existsSync: existsSync29 } = await import("node:fs");
+      const { dirname: dirname17, join: join33, resolve: resolve21 } = await import("node:path");
+      const { fileURLToPath: fileURLToPath10 } = await import("node:url");
+      const dir = dirname17(fileURLToPath10(import.meta.url));
+      const candidates = [
+        join33(dir, "..", "public", "js", "tina4-dev-admin-split.html"),
+        join33(dir, "..", "..", "public", "js", "tina4-dev-admin-split.html"),
+        resolve21(process.cwd(), "node_modules", "tina4-nodejs", "packages", "core", "public", "js", "tina4-dev-admin-split.html"),
+        resolve21(process.cwd(), "public", "js", "tina4-dev-admin-split.html")
+      ];
+      for (const path10 of candidates) {
+        if (existsSync29(path10)) {
+          try {
+            const content = readFileSync27(path10, "utf-8");
+            res.raw.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" });
+            res.raw.end(content);
+            return;
+          } catch {
+          }
+        }
+      }
+      res.raw.writeHead(404, { "Content-Type": "text/plain" });
+      res.raw.end("tina4-dev-admin-split.html not found");
+    };
     handleToolbarCss = (_req, res) => {
       res.raw.writeHead(200, { "Content-Type": "text/css; charset=utf-8", "Cache-Control": "no-cache" });
       res.raw.end(toolbarCss());
@@ -27506,7 +27884,10 @@ function generate2(routes, models = []) {
     openapi: resolveOpenApiVersion(),
     info: buildInfo(),
     servers: resolveServers(),
-    paths: {},
+    // Prototype-less: route paths are developer-defined, but a null prototype
+    // makes `spec.paths[path][method] = op` structurally pollution-proof
+    // regardless (js/prototype-polluting-assignment). Serialises to JSON the same.
+    paths: /* @__PURE__ */ Object.create(null),
     components: {
       schemas: {},
       // Configurable security schemes (v3.13.42): bearerFormat via env, optional
@@ -27571,7 +27952,7 @@ function buildOperation(route, spec, ctx) {
   const openApiPath = patternToOpenAPI(route.pattern);
   const method = route.method.toLowerCase();
   if (!spec.paths[openApiPath]) {
-    spec.paths[openApiPath] = {};
+    spec.paths[openApiPath] = /* @__PURE__ */ Object.create(null);
   }
   const tags = route.meta?.tags ?? inferTags(route.pattern);
   for (const t of tags) {
@@ -27877,7 +28258,7 @@ function inferModelFromPath(pattern) {
   return null;
 }
 function operationIdBase(method, openApiPath) {
-  const clean = openApiPath.replace(/^\/+|\/+$/g, "").replace(/\//g, "_").replace(/\.\.\./g, "").replace(/[{}]/g, "").replace(/\*/g, "wildcard");
+  const clean = trimSlashes(openApiPath).replace(/\//g, "_").replace(/\.\.\./g, "").replace(/[{}]/g, "").replace(/\*/g, "wildcard");
   return clean ? `${method}_${clean}` : method;
 }
 function uniqueOperationId(method, openApiPath, seen) {
@@ -27895,6 +28276,7 @@ var WRITE_METHODS, INTERNAL_PREFIXES, registeredSchemes, registeredSchemas, PARA
 var init_generator = __esm({
   "../swagger/src/generator.ts"() {
     "use strict";
+    init_slashTrim();
     WRITE_METHODS = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
     INTERNAL_PREFIXES = ["/swagger", "/__dev", "/__feedback", "/ai", "/rag", "/vision", "/embed", "/image"];
     registeredSchemes = {};
@@ -27916,7 +28298,7 @@ var init_generator = __esm({
 
 // ../swagger/src/ui.ts
 function swaggerUiCdn() {
-  return (process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5").replace(/\/+$/, "");
+  return rtrimSlashes(process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5");
 }
 function swaggerEnabled() {
   const raw = (process.env.TINA4_SWAGGER_ENABLED ?? "").trim().toLowerCase();
@@ -27972,6 +28354,7 @@ var SWAGGER_UI_HTML;
 var init_ui = __esm({
   "../swagger/src/ui.ts"() {
     "use strict";
+    init_slashTrim();
     SWAGGER_UI_HTML = (specUrl, nonce) => `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -28389,7 +28772,7 @@ import { resolve as resolve15, dirname as dirname12, join as join25, relative as
 import { existsSync as existsSync23, readdirSync as readdirSync15, readFileSync as readFileSync21, statSync as statSync16 } from "node:fs";
 import { isatty } from "node:tty";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
-import { execFileSync as execFileSync3, exec } from "node:child_process";
+import { execFileSync as execFileSync3, execFile } from "node:child_process";
 import cluster from "node:cluster";
 import os2 from "node:os";
 function isSwaggerAssetPath(pathname) {
@@ -28525,10 +28908,11 @@ function shouldOpenBrowser(isDevelopment, noBrowser = false) {
   });
 }
 function openBrowser(url) {
+  if (!/^https?:\/\/([A-Za-z0-9.-]+|\[[0-9A-Fa-f:]+\])(:\d{1,5})?\/?$/.test(url)) return;
   setTimeout(() => {
-    if (process.platform === "darwin") exec(`open ${url}`);
-    else if (process.platform === "win32") exec(`start "" "${url}"`);
-    else exec(`xdg-open ${url}`);
+    if (process.platform === "darwin") execFile("open", [url]);
+    else if (process.platform === "win32") execFile("rundll32", ["url.dll,FileProtocolHandler", url]);
+    else execFile("xdg-open", [url]);
   }, 2e3);
 }
 function resolvePortAndHost(config) {
@@ -28643,7 +29027,7 @@ function resetTemplateCache() {
 }
 function resolveTemplate(pathname, templatesDir) {
   if (!templateAutoRoutingEnabled()) return null;
-  const cleanPath = pathname.replace(/^\/+/, "").replace(/\/+$/, "") || "index";
+  const cleanPath = trimSlashes(pathname) || "index";
   const isDev2 = (process.env.TINA4_DEBUG ?? "false").toLowerCase() === "true";
   if (isDev2) {
     if (cleanPath.split("/").some((seg) => seg.startsWith("_"))) return null;
@@ -28911,7 +29295,7 @@ async function runGlobalMiddlewarePass(middleware, req2, res) {
 }
 function resolveHandlerArgs(handler, req2, res, routeParams) {
   const fnStr = handler.toString();
-  const argMatch = fnStr.match(/^(?:async\s*)?(?:function\s*\w*)?\s*\(([^)]*)\)/);
+  const argMatch = fnStr.match(/^(?:async\s*)?(?:function(?:\s+\w+)?\s*)?\(([^)]*)\)/);
   const argNames = argMatch?.[1]?.split(",").map((a) => a.trim().replace(/[:=].*/, "")) ?? [];
   const filteredArgs = argNames.filter((n) => n.length > 0);
   if (filteredArgs.length === 0) return [];
@@ -29147,8 +29531,9 @@ async function buildDispatchContext(router, base) {
   const templatesDir = resolve15(root, "src/templates");
   let frondEngine = null;
   try {
-    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2, setFormTokenSessionProvider: setFormTokenSessionProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
     setCspNonceProvider2(currentCspNonce);
+    setFormTokenSessionProvider2(currentFormTokenSessionId);
     frondEngine = new Frond2(templatesDir);
   } catch {
   }
@@ -29263,7 +29648,10 @@ async function runDispatch(ctx, rawReq, rawRes) {
   const requestNonce = generateNonce();
   return Log.runWithRequestId(
     requestId,
-    () => runWithCspNonce(requestNonce, () => dispatchInner(ctx, rawReq, rawRes, requestId))
+    () => runWithCspNonce(
+      requestNonce,
+      () => runWithFormTokenSession(() => dispatchInner(ctx, rawReq, rawRes, requestId))
+    )
   );
 }
 function loopbackBindHosts(host) {
@@ -29391,8 +29779,9 @@ async function startServer(config) {
   let frondEngine = null;
   setDefaultTemplatesDir(templatesDir);
   try {
-    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2, setFormTokenSessionProvider: setFormTokenSessionProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
     setCspNonceProvider2(currentCspNonce);
+    setFormTokenSessionProvider2(currentFormTokenSessionId);
     frondEngine = new Frond2(templatesDir);
     router.addRoute({
       method: "GET",
@@ -29741,6 +30130,7 @@ var __filename, __dirname, BUILTIN_ERROR_TEMPLATES_DIR, BUILTIN_PUBLIC_DIR, swag
 var init_server = __esm({
   "../core/src/server.ts"() {
     "use strict";
+    init_slashTrim();
     init_transport();
     init_router();
     init_authGate();
@@ -29748,6 +30138,7 @@ var init_server = __esm({
     init_portTakeover();
     init_request();
     init_dispatchPipeline();
+    init_session();
     init_response();
     init_middleware();
     init_static();
@@ -31894,6 +32285,7 @@ var ApiStreamError, RETRY_STATUSES, DOWNLOAD_CHUNK_SIZE, MAX_REDIRECTS, STRIP_ON
 var init_api = __esm({
   "../core/src/api.ts"() {
     "use strict";
+    init_slashTrim();
     init_version();
     init_ssrf();
     ApiStreamError = class extends Error {
@@ -31991,7 +32383,7 @@ var init_api = __esm({
        * turns on a per-client, in-memory cookie jar.
        */
       constructor(baseUrl = "", authHeaderOrOptions = "", timeout = 30) {
-        this.baseUrl = baseUrl.replace(/\/+$/, "");
+        this.baseUrl = rtrimSlashes(baseUrl);
         this.headers = {};
         this.maxRetries = 0;
         this.retryBackoff = 0.5;
@@ -32757,6 +33149,23 @@ function sendCommand(socket, command) {
     });
   });
 }
+function pushAlternativeBody(lines, altBoundary, text, body) {
+  lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
+  lines.push("");
+  lines.push(`--${altBoundary}`);
+  lines.push("Content-Type: text/plain; charset=UTF-8");
+  lines.push("Content-Transfer-Encoding: 7bit");
+  lines.push("");
+  lines.push(text);
+  lines.push("");
+  lines.push(`--${altBoundary}`);
+  lines.push("Content-Type: text/html; charset=UTF-8");
+  lines.push("Content-Transfer-Encoding: 7bit");
+  lines.push("");
+  lines.push(body);
+  lines.push("");
+  lines.push(`--${altBoundary}--`);
+}
 function buildMimeMessage(options) {
   const boundary = `----=_Tina4_${Date.now()}_${Math.random().toString(36).substring(2)}`;
   const altBoundary = `----=_Tina4Alt_${Date.now()}_${Math.random().toString(36).substring(2)}`;
@@ -32786,21 +33195,7 @@ function buildMimeMessage(options) {
     lines.push("");
     lines.push(`--${boundary}`);
     if (hasTextAlt) {
-      lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
-      lines.push("");
-      lines.push(`--${altBoundary}`);
-      lines.push("Content-Type: text/plain; charset=UTF-8");
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.text);
-      lines.push("");
-      lines.push(`--${altBoundary}`);
-      lines.push("Content-Type: text/html; charset=UTF-8");
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.body);
-      lines.push("");
-      lines.push(`--${altBoundary}--`);
+      pushAlternativeBody(lines, altBoundary, options.text, options.body);
     } else {
       const contentType = options.html ? "text/html" : "text/plain";
       lines.push(`Content-Type: ${contentType}; charset=UTF-8`);
@@ -32825,21 +33220,7 @@ function buildMimeMessage(options) {
     lines.push("");
     lines.push(`--${boundary}--`);
   } else if (hasTextAlt) {
-    lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
-    lines.push("");
-    lines.push(`--${altBoundary}`);
-    lines.push("Content-Type: text/plain; charset=UTF-8");
-    lines.push("Content-Transfer-Encoding: 7bit");
-    lines.push("");
-    lines.push(options.text);
-    lines.push("");
-    lines.push(`--${altBoundary}`);
-    lines.push("Content-Type: text/html; charset=UTF-8");
-    lines.push("Content-Transfer-Encoding: 7bit");
-    lines.push("");
-    lines.push(options.body);
-    lines.push("");
-    lines.push(`--${altBoundary}--`);
+    pushAlternativeBody(lines, altBoundary, options.text, options.body);
   } else {
     const contentType = options.html ? "text/html" : "text/plain";
     lines.push(`Content-Type: ${contentType}; charset=UTF-8`);
@@ -33604,61 +33985,72 @@ function decodeEntities(raw) {
 function parseXmlDocument(xml) {
   const stack = [];
   let root = null;
-  let position = 0;
   const addText = (text) => {
     const current = stack[stack.length - 1];
     if (current.children.length === 0) current.text += text;
   };
-  while (position < xml.length) {
-    const nextTag = xml.indexOf("<", position);
+  const skipComment = (at) => {
+    const close = xml.indexOf("-->", at + 4);
+    if (close === -1) malformed();
+    return close + 3;
+  };
+  const readCData = (at) => {
+    const close = xml.indexOf("]]>", at + 9);
+    if (close === -1 || stack.length === 0) malformed();
+    addText(xml.slice(at + 9, close));
+    return close + 3;
+  };
+  const skipProcessingInstruction = (at) => {
+    const close = xml.indexOf("?>", at + 2);
+    if (close === -1) malformed();
+    const target = xml.slice(at + 2, close).split(/\s/, 1)[0];
+    if (target.toLowerCase() === "xml" && at !== 0) malformed();
+    return close + 2;
+  };
+  const closeElement = (at) => {
+    END_TAG.lastIndex = at;
+    const match = END_TAG.exec(xml);
+    const open = stack.pop();
+    if (!match || !open || open.qualifiedName !== match[1]) malformed();
+    return END_TAG.lastIndex;
+  };
+  const openElement = (at) => {
+    START_TAG.lastIndex = at;
+    const match = START_TAG.exec(xml);
+    if (!match || stack.length === 0 && root !== null) malformed();
+    for (const attribute of match[2].matchAll(ATTRIBUTE_VALUE)) decodeEntities(attribute[1] ?? attribute[2]);
+    const qualifiedName = match[1];
+    const element = {
+      name: qualifiedName.slice(qualifiedName.indexOf(":") + 1),
+      qualifiedName,
+      children: [],
+      text: ""
+    };
+    if (stack.length > 0) stack[stack.length - 1].children.push(element);
+    else root = element;
+    if (match[3] !== "/") stack.push(element);
+    return START_TAG.lastIndex;
+  };
+  const readText = (at) => {
+    const nextTag = xml.indexOf("<", at);
     const textEnd = nextTag === -1 ? xml.length : nextTag;
-    if (textEnd > position) {
-      const raw = xml.slice(position, textEnd);
+    if (textEnd > at) {
+      const raw = xml.slice(at, textEnd);
       if (stack.length > 0) addText(decodeEntities(raw));
       else if (raw.trim() !== "") malformed();
-      position = textEnd;
-      if (nextTag === -1) break;
-    }
-    if (xml.startsWith("<!--", position)) {
-      const close = xml.indexOf("-->", position + 4);
-      if (close === -1) malformed();
-      position = close + 3;
-    } else if (xml.startsWith("<![CDATA[", position)) {
-      const close = xml.indexOf("]]>", position + 9);
-      if (close === -1 || stack.length === 0) malformed();
-      addText(xml.slice(position + 9, close));
-      position = close + 3;
-    } else if (xml.startsWith("<?", position)) {
-      const close = xml.indexOf("?>", position + 2);
-      if (close === -1) malformed();
-      const target = xml.slice(position + 2, close).split(/\s/, 1)[0];
-      if (target.toLowerCase() === "xml" && position !== 0) malformed();
-      position = close + 2;
-    } else if (xml.startsWith("<!", position)) {
-      malformed();
-    } else if (xml.startsWith("</", position)) {
-      END_TAG.lastIndex = position;
-      const match = END_TAG.exec(xml);
-      const open = stack.pop();
-      if (!match || !open || open.qualifiedName !== match[1]) malformed();
-      position = END_TAG.lastIndex;
-    } else {
-      START_TAG.lastIndex = position;
-      const match = START_TAG.exec(xml);
-      if (!match || stack.length === 0 && root !== null) malformed();
-      for (const attribute of match[2].matchAll(ATTRIBUTE_VALUE)) decodeEntities(attribute[1] ?? attribute[2]);
-      const qualifiedName = match[1];
-      const element = {
-        name: qualifiedName.slice(qualifiedName.indexOf(":") + 1),
-        qualifiedName,
-        children: [],
-        text: ""
-      };
-      if (stack.length > 0) stack[stack.length - 1].children.push(element);
-      else root = element;
-      if (match[3] !== "/") stack.push(element);
-      position = START_TAG.lastIndex;
     }
+    return textEnd;
+  };
+  let position = 0;
+  while (position < xml.length) {
+    position = readText(position);
+    if (position >= xml.length) break;
+    if (xml.startsWith("<!--", position)) position = skipComment(position);
+    else if (xml.startsWith("<![CDATA[", position)) position = readCData(position);
+    else if (xml.startsWith("<?", position)) position = skipProcessingInstruction(position);
+    else if (xml.startsWith("<!", position)) malformed();
+    else if (xml.startsWith("</", position)) position = closeElement(position);
+    else position = openElement(position);
   }
   if (root === null || stack.length > 0) malformed();
   return root;
@@ -35148,7 +35540,7 @@ import {
   randomBytes as randomBytes10
 } from "node:crypto";
 function encodeBase64Url(value) {
-  return Buffer.from(value).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+  return Buffer.from(value).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/={1,2}$/, "");
 }
 function decodeBase64Url(value, name) {
   if (typeof value !== "string" || value.length === 0) {
@@ -35399,6 +35791,7 @@ var AiError, AiConfigError, AiTimeoutError, AiParseError, AiHTTPError, Ai, Aggre
 var init_aiClient = __esm({
   "../core/src/aiClient.ts"() {
     "use strict";
+    init_slashTrim();
     init_api();
     AiError = class extends Error {
     };
@@ -35603,7 +35996,7 @@ var init_aiClient = __esm({
           throw new AiConfigError("AI URL must be an http or https URL");
         }
         if (url.protocol !== "http:" && url.protocol !== "https:") throw new AiConfigError("AI URL must be an http or https URL");
-        const path10 = url.pathname.replace(/\/+$/, "");
+        const path10 = rtrimSlashes(url.pathname);
         if (path10 === "" || path10 === "/v1" || path10 === "/api" || path10 === "/v1beta/openai") {
           const suffix = provider === "anthropic" ? "/messages" : capability === "embed" ? "/embeddings" : "/chat/completions";
           url.pathname = (path10 || "/v1") + suffix;
@@ -37973,6 +38366,7 @@ __export(src_exports2, {
   backgroundTaskCount: () => backgroundTaskCount,
   buildEnvelope: () => buildEnvelope,
   buildFrame: () => buildFrame,
+  buildSeedFieldMap: () => buildSeedFieldMap,
   buildSessionCookie: () => buildSessionCookie,
   cacheBackendStats: () => cacheBackendStats,
   cacheClear: () => cacheClear,
@@ -38078,6 +38472,7 @@ __export(src_exports2, {
   parseFrame: () => parseFrame,
   parseLineStream: () => parseLineStream,
   parseMultipart: () => parseMultipart,
+  parseSeedRequest: () => parseSeedRequest,
   parseSseStream: () => parseSseStream,
   parseUpgradeHeaders: () => parseUpgradeHeaders,
   patch: () => patch,
@@ -42471,10 +42866,10 @@ __export(database_exports, {
   stripTrailingSemicolons: () => stripTrailingSemicolons,
   wrapWithCache: () => wrapWithCache
 });
-import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "node:async_hooks";
 function stripTrailingSemicolons(sql) {
   if (!sql) return sql;
-  let stripped = sql.replace(/\s+$/, "");
+  let stripped = sql.trimEnd();
   while (stripped.endsWith(";")) {
     stripped = stripped.slice(0, -1).replace(/\s+$/, "");
   }
@@ -42641,6 +43036,13 @@ async function createAdapterFromUrl(url, username, password) {
 }
 async function buildAdapterFromUrl(url, username, password) {
   const parsed = parseDatabaseUrl(url, username, password);
+  const serverConfig = {
+    host: parsed.host ?? void 0,
+    port: parsed.port ?? void 0,
+    user: parsed.username ?? void 0,
+    password: parsed.password ?? void 0,
+    database: parsed.database || void 0
+  };
   switch (parsed.engine) {
     case "sqlite": {
       const { SQLiteAdapter: SQLiteAdapter2 } = await Promise.resolve().then(() => (init_sqlite(), sqlite_exports));
@@ -42648,49 +43050,25 @@ async function buildAdapterFromUrl(url, username, password) {
     }
     case "postgres": {
       const { PostgresAdapter: PostgresAdapter2 } = await Promise.resolve().then(() => (init_postgres(), postgres_exports));
-      const adapter = new PostgresAdapter2({
-        host: parsed.host ?? void 0,
-        port: parsed.port ?? void 0,
-        user: parsed.username ?? void 0,
-        password: parsed.password ?? void 0,
-        database: parsed.database || void 0
-      });
+      const adapter = new PostgresAdapter2(serverConfig);
       await adapter.connect();
       return adapter;
     }
     case "mysql": {
       const { MysqlAdapter: MysqlAdapter2 } = await Promise.resolve().then(() => (init_mysql(), mysql_exports));
-      const adapter = new MysqlAdapter2({
-        host: parsed.host ?? void 0,
-        port: parsed.port ?? void 0,
-        user: parsed.username ?? void 0,
-        password: parsed.password ?? void 0,
-        database: parsed.database || void 0
-      });
+      const adapter = new MysqlAdapter2(serverConfig);
       await adapter.connect();
       return adapter;
     }
     case "mssql": {
       const { MssqlAdapter: MssqlAdapter2 } = await Promise.resolve().then(() => (init_mssql(), mssql_exports));
-      const adapter = new MssqlAdapter2({
-        host: parsed.host ?? void 0,
-        port: parsed.port ?? void 0,
-        user: parsed.username ?? void 0,
-        password: parsed.password ?? void 0,
-        database: parsed.database || void 0
-      });
+      const adapter = new MssqlAdapter2(serverConfig);
       await adapter.connect();
       return adapter;
     }
     case "firebird": {
       const { FirebirdAdapter: FirebirdAdapter2 } = await Promise.resolve().then(() => (init_firebird(), firebird_exports));
-      const adapter = new FirebirdAdapter2({
-        host: parsed.host ?? void 0,
-        port: parsed.port ?? void 0,
-        user: parsed.username ?? void 0,
-        password: parsed.password ?? void 0,
-        database: parsed.database || void 0
-      });
+      const adapter = new FirebirdAdapter2(serverConfig);
       await adapter.connect();
       return adapter;
     }
@@ -42885,9 +43263,9 @@ var init_database = __esm({
       leases = /* @__PURE__ */ new Map();
       discardedSlots = /* @__PURE__ */ new Set();
       repairs = /* @__PURE__ */ new Map();
-      leaseOwner = new AsyncLocalStorage3();
-      operationStore = new AsyncLocalStorage3();
-      txStore = new AsyncLocalStorage3();
+      leaseOwner = new AsyncLocalStorage4();
+      operationStore = new AsyncLocalStorage4();
+      txStore = new AsyncLocalStorage4();
       /**
        * Create a Database wrapping an existing adapter.
        * For creating a Database from a URL, use the async static factories:
@@ -45627,7 +46005,7 @@ function tableData(opts) {
     readonly: !opts.editable,
     inline_script: opts.inlineScript,
     table_name: h(opts.tableName),
-    table_id_attr: opts.tableId ? ` id="${h(opts.tableId)}"` : ""
+    table_id: opts.tableId ? String(opts.tableId) : ""
   };
 }
 var init_crudTable = __esm({
@@ -45668,13 +46046,13 @@ function renderModalForm(mode, columns, pk, edit) {
       value: "",
       placeholder: h(`Enter ${label.toLowerCase()}`),
       type: "text",
-      required_attr: "",
+      required: false,
       input: true
     };
   });
   return renderCrudTemplate("form", {
     wrap: true,
-    form_id_attr: ` id="form-${mode}"`,
+    form_id: `form-${mode}`,
     action: "",
     form_method: "POST",
     method_override: null,
@@ -45731,7 +46109,7 @@ function fieldInputShape(field, base) {
     case "text":
       return { ...base, textarea: true };
     case "boolean":
-      return { ...base, checkbox: true, checked_attr: value ? " checked" : "" };
+      return { ...base, checkbox: true, checked: !!value };
     case "select":
       return { ...base, select: true, options_html: buildOptions(field.options, value) };
     case "date":
@@ -45754,7 +46132,7 @@ function buildCustomField(field) {
     label: h(String(label)),
     value: h(field.value ?? ""),
     placeholder: "",
-    required_attr: field.required ? " required" : ""
+    required: !!field.required
   };
   return fieldInputShape(field, base);
 }
@@ -45762,7 +46140,7 @@ function generateForm2(fields, options = {}) {
   const verb = String(options.method ?? "POST").toUpperCase();
   return renderCrudTemplate("form", {
     wrap: true,
-    form_id_attr: "",
+    form_id: "",
     action: h(options.action ?? "/"),
     form_method: h(verb),
     method_override: ["PUT", "PATCH", "DELETE"].includes(verb) ? verb : null,
@@ -49882,20 +50260,210 @@ var init_attachment = __esm({
   }
 });
 
+// src/realtime/s3Client.ts
+import { createHash as createHash11, createHmac as createHmac4 } from "node:crypto";
+function retryAfterSeconds(raw) {
+  if (raw == null) return null;
+  const n = Number(raw);
+  return Number.isFinite(n) ? Math.max(0, n) : null;
+}
+function uriEncode(value, isPath) {
+  let out = "";
+  for (const byte of Buffer.from(value, "utf8")) {
+    const ch = String.fromCharCode(byte);
+    if (UNRESERVED.test(ch) || isPath && ch === "/") out += ch;
+    else out += "%" + byte.toString(16).toUpperCase().padStart(2, "0");
+  }
+  return out;
+}
+function sha256Hex2(data) {
+  return createHash11("sha256").update(data).digest("hex");
+}
+function hmac2(key, msg) {
+  return createHmac4("sha256", key).update(msg, "utf8").digest();
+}
+var ALGORITHM, SERVICE, UNRESERVED, MAX_RETRIES, BACKOFF_BASE, BACKOFF_CAP, S3Error, S3ConfigError, sleep, S3Client;
+var init_s3Client = __esm({
+  "src/realtime/s3Client.ts"() {
+    "use strict";
+    ALGORITHM = "AWS4-HMAC-SHA256";
+    SERVICE = "s3";
+    UNRESERVED = /[A-Za-z0-9\-_.~]/;
+    MAX_RETRIES = 2;
+    BACKOFF_BASE = 0.5;
+    BACKOFF_CAP = 20;
+    S3Error = class extends Error {
+      constructor(status2, message) {
+        super(message);
+        this.status = status2;
+        this.name = "S3Error";
+      }
+      status;
+      /** Seconds from a Retry-After header in its delta-seconds form, else null. */
+      retryAfter = null;
+    };
+    S3ConfigError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "S3ConfigError";
+      }
+    };
+    sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+    S3Client = class {
+      scheme;
+      host;
+      // authority (host[:port]) — matches the Host header
+      prefix;
+      // path an endpoint carries (https://host/s3 -> "/s3"), "" if none
+      region;
+      accessKey;
+      secretKey;
+      timeout;
+      constructor(opts = {}) {
+        this.region = opts.region || "us-east-1";
+        this.accessKey = opts.accessKey || "";
+        this.secretKey = opts.secretKey || "";
+        this.timeout = opts.timeout ?? 3e4;
+        let base = opts.endpoint || `https://s3.${this.region}.amazonaws.com`;
+        while (base.endsWith("/")) base = base.slice(0, -1);
+        const m = /^([a-z][a-z0-9+.-]*):\/\/([^/]+)(\/.*)?$/i.exec(base);
+        this.scheme = m ? m[1] : "https";
+        this.host = m ? m[2] : base;
+        let p = m && m[3] ? m[3] : "";
+        while (p.endsWith("/")) p = p.slice(0, -1);
+        this.prefix = p;
+      }
+      // -- public API (the subset S3Storage uses) --------------------------------
+      async putObject(bucket, key, data, contentType = "application/octet-stream") {
+        const body = Buffer.isBuffer(data) ? data : Buffer.from(data);
+        await this.request("PUT", this.canonicalUri(bucket, key), body, { "content-type": contentType });
+      }
+      async getObject(bucket, key) {
+        return (await this.request("GET", this.canonicalUri(bucket, key), Buffer.alloc(0))).body;
+      }
+      async deleteObject(bucket, key) {
+        await this.request("DELETE", this.canonicalUri(bucket, key), Buffer.alloc(0));
+      }
+      async headObject(bucket, key) {
+        await this.request("HEAD", this.canonicalUri(bucket, key), Buffer.alloc(0));
+      }
+      /** Create the bucket (path-style `PUT /<bucket>`); an already-owned bucket (409) is success. */
+      async createBucket(bucket) {
+        try {
+          await this.request("PUT", `${this.prefix}/${uriEncode(bucket, true)}`, Buffer.alloc(0));
+        } catch (e) {
+          if (!(e instanceof S3Error) || e.status !== 409) throw e;
+        }
+      }
+      /** A URL that fetches the object directly, signed via SigV4 query params. */
+      presignedGetUrl(bucket, key, expires = 3600) {
+        this.requireCredentials();
+        const { amzDate, dateStamp } = this.now();
+        const uri = this.canonicalUri(bucket, key);
+        const scope = `${dateStamp}/${this.region}/${SERVICE}/aws4_request`;
+        const query = {
+          "X-Amz-Algorithm": ALGORITHM,
+          "X-Amz-Credential": `${this.accessKey}/${scope}`,
+          "X-Amz-Date": amzDate,
+          "X-Amz-Expires": String(expires),
+          "X-Amz-SignedHeaders": "host"
+        };
+        const canonicalQs = this.canonicalQuery(query);
+        const canonicalRequest = ["GET", uri, canonicalQs, `host:${this.host}
+`, "host", "UNSIGNED-PAYLOAD"].join("\n");
+        const signature = this.sign(canonicalRequest, amzDate, dateStamp, scope);
+        return `${this.scheme}://${this.host}${uri}?${canonicalQs}&X-Amz-Signature=${signature}`;
+      }
+      // -- signing + transport ----------------------------------------------------
+      requireCredentials() {
+        if (!this.accessKey || !this.secretKey) {
+          throw new S3ConfigError(
+            "S3 credentials are not set: set TINA4_STORAGE_KEY and TINA4_STORAGE_SECRET"
+          );
+        }
+      }
+      now() {
+        const iso2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
+        return { amzDate: iso2, dateStamp: iso2.slice(0, 8) };
+      }
+      canonicalUri(bucket, key) {
+        return `${this.prefix}/${uriEncode(bucket, true)}/${uriEncode(key, true)}`;
+      }
+      canonicalQuery(query) {
+        return Object.keys(query).sort().map((k) => `${uriEncode(k, false)}=${uriEncode(query[k], false)}`).join("&");
+      }
+      signingKey(dateStamp) {
+        const kDate = hmac2(`AWS4${this.secretKey}`, dateStamp);
+        const kRegion = hmac2(kDate, this.region);
+        const kService = hmac2(kRegion, SERVICE);
+        return hmac2(kService, "aws4_request");
+      }
+      sign(canonicalRequest, amzDate, dateStamp, scope) {
+        const stringToSign = [ALGORITHM, amzDate, scope, sha256Hex2(canonicalRequest)].join("\n");
+        return createHmac4("sha256", this.signingKey(dateStamp)).update(stringToSign, "utf8").digest("hex");
+      }
+      async request(method, uri, body, extraHeaders = {}) {
+        this.requireCredentials();
+        for (let attempt = 0; ; attempt++) {
+          const last = attempt === MAX_RETRIES;
+          let delay2 = null;
+          try {
+            return await this.send(method, uri, body, extraHeaders);
+          } catch (e) {
+            if (e instanceof S3Error) {
+              if (last || !(e.status === 429 || e.status >= 500)) throw e;
+              delay2 = e.retryAfter;
+            } else {
+              if (last) throw e;
+              delay2 = null;
+            }
+          }
+          if (delay2 == null) delay2 = Math.random() * (BACKOFF_BASE * 2 ** attempt);
+          await sleep(Math.min(delay2, BACKOFF_CAP) * 1e3);
+        }
+      }
+      async send(method, uri, body, extraHeaders = {}) {
+        const { amzDate, dateStamp } = this.now();
+        const payloadHash = sha256Hex2(body);
+        const signed = {
+          host: this.host,
+          "x-amz-content-sha256": payloadHash,
+          "x-amz-date": amzDate
+        };
+        const signedKeys = Object.keys(signed).sort();
+        const canonicalHeaders = signedKeys.map((k) => `${k}:${signed[k]}
+`).join("");
+        const signedHeaders = signedKeys.join(";");
+        const canonicalRequest = [method, uri, "", canonicalHeaders, signedHeaders, payloadHash].join("\n");
+        const scope = `${dateStamp}/${this.region}/${SERVICE}/aws4_request`;
+        const signature = this.sign(canonicalRequest, amzDate, dateStamp, scope);
+        const authorization = `${ALGORITHM} Credential=${this.accessKey}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+        const headers = {
+          Authorization: authorization,
+          "x-amz-content-sha256": payloadHash,
+          "x-amz-date": amzDate,
+          ...extraHeaders
+        };
+        const url = `${this.scheme}://${this.host}${uri}`;
+        const init = { method, headers, redirect: "manual" };
+        if (method === "PUT" || method === "POST") init.body = body;
+        if (AbortSignal.timeout) init.signal = AbortSignal.timeout(this.timeout);
+        const response = await fetch(url, init);
+        if (response.status < 200 || response.status >= 300) {
+          const err = new S3Error(response.status, `${method} ${uri}: HTTP ${response.status}`);
+          err.retryAfter = retryAfterSeconds(response.headers.get("retry-after"));
+          throw err;
+        }
+        return { status: response.status, body: Buffer.from(await response.arrayBuffer()) };
+      }
+    };
+  }
+});
+
 // src/realtime/storage.ts
 import { randomBytes as randomBytes12 } from "node:crypto";
-import { mkdirSync as mkdirSync21, readFileSync as readFileSync26, writeFileSync as writeFileSync18, unlinkSync as unlinkSync8, statSync as statSync19 } from "node:fs";
+import { mkdirSync as mkdirSync21, readFileSync as readFileSync26, writeFileSync as writeFileSync18, unlinkSync as unlinkSync9, statSync as statSync19 } from "node:fs";
 import { resolve as resolve20, sep as sep8 } from "node:path";
-import { createRequire as createRequire8 } from "node:module";
-function loadAwsSdk(packageName) {
-  try {
-    return require2(packageName);
-  } catch (error2) {
-    const missing = error2?.code === "MODULE_NOT_FOUND" && String(error2?.message ?? "").includes(`'${packageName}'`);
-    if (!missing) throw error2;
-    throw optionalPackageMissing("S3Storage", S3_PACKAGES);
-  }
-}
 function storageKey(filename = "") {
   let ext = "";
   if (filename && filename.includes(".")) {
@@ -49920,14 +50488,12 @@ function selectStorage(storage) {
   }
   return new LocalStorage();
 }
-var require2, S3_PACKAGES, UNSAFE, LocalStorage, S3Storage;
+var UNSAFE, LocalStorage, S3Storage;
 var init_storage = __esm({
   "src/realtime/storage.ts"() {
     "use strict";
     init_src2();
-    init_optionalPackage();
-    require2 = createRequire8(import.meta.url);
-    S3_PACKAGES = ["@aws-sdk/client-s3", "@aws-sdk/s3-request-presigner"];
+    init_s3Client();
     UNSAFE = /[^A-Za-z0-9]/g;
     LocalStorage = class {
       directory;
@@ -49959,7 +50525,7 @@ var init_storage = __esm({
       }
       delete(key) {
         try {
-          unlinkSync8(this.pathFor(key));
+          unlinkSync9(this.pathFor(key));
         } catch {
         }
       }
@@ -49977,51 +50543,36 @@ var init_storage = __esm({
       constructor(opts = {}) {
         this.bucket = opts.bucket || process.env.TINA4_STORAGE_BUCKET || "";
         if (!this.bucket) throw new Error("S3Storage requires TINA4_STORAGE_BUCKET");
-        const { S3Client } = loadAwsSdk("@aws-sdk/client-s3");
-        loadAwsSdk("@aws-sdk/s3-request-presigner");
-        const endpoint = opts.endpoint || process.env.TINA4_STORAGE_URL;
         this.client = new S3Client({
-          endpoint: endpoint || void 0,
-          forcePathStyle: true,
+          endpoint: opts.endpoint || process.env.TINA4_STORAGE_URL || void 0,
           region: opts.region || process.env.TINA4_STORAGE_REGION || "us-east-1",
-          credentials: {
-            accessKeyId: opts.key || process.env.TINA4_STORAGE_KEY || "",
-            secretAccessKey: opts.secret || process.env.TINA4_STORAGE_SECRET || ""
-          }
+          accessKey: opts.key || process.env.TINA4_STORAGE_KEY || "",
+          secretKey: opts.secret || process.env.TINA4_STORAGE_SECRET || ""
         });
       }
       async put(key, data, mime = "application/octet-stream") {
-        const { PutObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-        await this.client.send(new PutObjectCommand({ Bucket: this.bucket, Key: key, Body: data, ContentType: mime }));
+        await this.client.putObject(this.bucket, key, data, mime);
       }
       async get(key) {
         try {
-          const { GetObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-          const res = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
-          const chunks = [];
-          for await (const chunk of res.Body) chunks.push(Buffer.from(chunk));
-          return Buffer.concat(chunks);
+          return await this.client.getObject(this.bucket, key);
         } catch {
           return null;
         }
       }
       async url(key, ttl = 3600) {
-        const { GetObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-        const { getSignedUrl } = loadAwsSdk("@aws-sdk/s3-request-presigner");
-        return getSignedUrl(this.client, new GetObjectCommand({ Bucket: this.bucket, Key: key }), { expiresIn: ttl });
+        return this.client.presignedGetUrl(this.bucket, key, ttl);
       }
       async delete(key) {
         try {
-          const { DeleteObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-          await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: key }));
+          await this.client.deleteObject(this.bucket, key);
         } catch (e) {
           Log.error(`S3Storage delete failed for ${key}: ${e.message}`);
         }
       }
       async exists(key) {
         try {
-          const { HeadObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-          await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
+          await this.client.headObject(this.bucket, key);
           return true;
         } catch {
           return false;
@@ -50032,7 +50583,7 @@ var init_storage = __esm({
 });
 
 // src/realtime/realtime.ts
-import { createHmac as createHmac4 } from "node:crypto";
+import { createHmac as createHmac5 } from "node:crypto";
 function iceServers() {
   const stun = process.env.TINA4_RTC_STUN_URLS || DEFAULT_STUN;
   const servers = [{ urls: splitUrls(stun) }];
@@ -50041,14 +50592,14 @@ function iceServers() {
   if (turnUrl && secret) {
     const ttl = parseInt(process.env.TINA4_RTC_TURN_TTL || "3600", 10);
     const username = String(Math.floor(Date.now() / 1e3) + ttl);
-    const credential = createHmac4("sha1", secret).update(username).digest("base64");
+    const credential = createHmac5("sha1", secret).update(username).digest("base64");
     servers.push({ urls: splitUrls(turnUrl), username, credential });
   }
   return servers;
 }
 async function realtime(options = {}) {
   const features = options.features ?? ["calls"];
-  const raw = (options.prefix ?? "").replace(/^\/+|\/+$/g, "");
+  const raw = trimSlashes(options.prefix ?? "");
   const p = raw ? `/${raw}` : "";
   _authorize = options.authorize;
   if (features.includes("chat") || features.includes("files")) {
@@ -50320,6 +50871,7 @@ var DEFAULT_STUN, _authorize;
 var init_realtime = __esm({
   "src/realtime/realtime.ts"() {
     "use strict";
+    init_slashTrim();
     init_src2();
     init_workspace();
     init_channel();
@@ -50337,6 +50889,7 @@ var init_realtime2 = __esm({
     "use strict";
     init_realtime();
     init_storage();
+    init_s3Client();
     init_workspace();
     init_channel();
     init_channelMember();