tina4-nodejs 3.13.149 → 3.13.151

package/packages/orm/src/sqlTranslator.ts

@@ -29,6 +29,53 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 
 import { DatabaseUrl } from "./databaseUrl.js";
 import { DEFAULT_SRID, SpatialNotSupportedError } from "./point.js";
+
+// ── placeholder-scan helpers ─────────────────────────────────
+// The `?`-placeholder scanner skips over literals/comments it must not count.
+// Each span-skip is a pure "return the index just past this span" helper so the
+// scan loop itself stays flat (keeps placeholderPositions' complexity down).
+const isIdentChar = (ch: string | undefined): boolean => !!ch && /[A-Za-z0-9_]/.test(ch);
+
+/** Index just past the quoted string/identifier opening at i (sql[i] is the quote). */
+function skipQuoted(sql: string, i: number, backslashEscapes: boolean): number {
+  const c = sql[i];
+  // E'...' (Postgres escape string) honours backslash escapes; so does every
+  // quoted string when the engine does (MySQL).
+  const escapeString = c === "'" && (sql[i - 1] === "E" || sql[i - 1] === "e") && !isIdentChar(sql[i - 2]);
+  const backslash = c !== "`" && (escapeString || backslashEscapes);
+  const n = sql.length;
+  i++;
+  while (i < n) {
+    if (backslash && sql[i] === "\\") { i += 2; continue; }
+    if (sql[i] === c) {
+      if (sql[i + 1] === c) { i += 2; continue; } // doubled quote = escaped quote
+      return i + 1;
+    }
+    i++;
+  }
+  return i;
+}
+
+/** Index just past the `-- ...` line comment opening at i. */
+function skipLineComment(sql: string, i: number): number {
+  while (i < sql.length && sql[i] !== "\n") i++;
+  return i;
+}
+
+/** Index just past the block comment opening at i. */
+function skipBlockComment(sql: string, i: number): number {
+  const end = sql.indexOf("*/", i + 2);
+  return end === -1 ? sql.length : end + 2;
+}
+
+/** Index just past the `$tag$ ... $tag$` dollar-quoted block opening at i, or i if none opens here. */
+function skipDollarQuote(sql: string, i: number): number {
+  const tag = sql.slice(i).match(/^\$([A-Za-z_][A-Za-z0-9_]*)?\$/);
+  if (!tag) return i;
+  const end = sql.indexOf(tag[0], i + tag[0].length);
+  return end === -1 ? sql.length : end + tag[0].length;
+}
+
 export class SQLTranslator {
   private static readonly SPATIAL_ENGINES = new Set(["postgres", "postgresql"]);
   private static readonly SPATIAL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/;
@@ -357,51 +404,17 @@ export class SQLTranslator {
   static placeholderPositions(sql: string, options: { backslashEscapes?: boolean } = {}): number[] {
     const positions: number[] = [];
     const n = sql.length;
-    const isIdent = (ch: string | undefined): boolean => !!ch && /[A-Za-z0-9_]/.test(ch);
     let i = 0;
     while (i < n) {
       const c = sql[i];
       const next = sql[i + 1];
-
-      if (c === "'" || c === '"' || c === "`") {
-        // E'...' (Postgres escape string) honours backslash escapes; so does
-        // every quoted string when the engine does (MySQL).
-        const prev = sql[i - 1];
-        const escapeString = c === "'" && (prev === "E" || prev === "e") && !isIdent(sql[i - 2]);
-        const backslash = c !== "`" && (escapeString || options.backslashEscapes === true);
-        i++;
-        while (i < n) {
-          if (backslash && sql[i] === "\\") { i += 2; continue; }
-          if (sql[i] === c) {
-            if (sql[i + 1] === c) { i += 2; continue; }
-            i++;
-            break;
-          }
-          i++;
-        }
-        continue;
-      }
-
-      if (c === "-" && next === "-") {
-        while (i < n && sql[i] !== "\n") i++;
-        continue;
-      }
-
-      if (c === "/" && next === "*") {
-        const end = sql.indexOf("*/", i + 2);
-        i = end === -1 ? n : end + 2;
-        continue;
+      if (c === "'" || c === '"' || c === "`") { i = skipQuoted(sql, i, options.backslashEscapes === true); continue; }
+      if (c === "-" && next === "-") { i = skipLineComment(sql, i); continue; }
+      if (c === "/" && next === "*") { i = skipBlockComment(sql, i); continue; }
+      if (c === "$" && !isIdentChar(sql[i - 1])) {
+        const past = skipDollarQuote(sql, i);
+        if (past !== i) { i = past; continue; }
       }
-
-      if (c === "$" && !isIdent(sql[i - 1])) {
-        const tag = sql.slice(i).match(/^\$([A-Za-z_][A-Za-z0-9_]*)?\$/);
-        if (tag) {
-          const end = sql.indexOf(tag[0], i + tag[0].length);
-          i = end === -1 ? n : end + tag[0].length;
-          continue;
-        }
-      }
-
       if (c === "?") positions.push(i);
       i++;
     }
@@ -437,7 +450,7 @@ export class SQLTranslator {
    * → { sql: "INSERT INTO t (x) VALUES (1)", columns: ["id", "name"] }
    */
   static parseReturning(sql: string): { sql: string; columns: string[] } {
-    const m = sql.match(/\bRETURNING\s+(.+)$/i);
+    const m = sql.match(/\bRETURNING\s+(\S.*)$/i);
     if (!m) return { sql, columns: [] };
     const columns = m[1].split(",").map((c) => c.trim());
     return {
@@ -496,7 +509,10 @@ export class SQLTranslator {
   // start of the VALUES group rather than by hunting for a parenthesis (the
   // column list has parentheses too).
   private static readonly INSERT_VALUES =
-    /^\s*INSERT\s+INTO\s+.+?\s+VALUES\s*\(([^()]*)\)\s*$/dis;
+    // ReDoS-safe: the table ref matches `\S(?:[\s\S]*?\S)?` (bounded by non-space
+    // at both ends) so the separator `\s+` before VALUES can't overlap it the way
+    // the old `.+?\s+` did (polynomial on `INSERT INTO ` + a long space run).
+    /^\s*INSERT\s+INTO\s+\S(?:[\s\S]*?\S)?\s+VALUES\s*\(([^()]*)\)\s*$/dis;
 
   /**
    * Engines whose lastInsertId reports the FIRST generated id of a multi-row

package/packages/swagger/dist/index.js

@@ -1,3 +1,21 @@
+// ../core/src/slashTrim.ts
+var SLASH = 47;
+function rtrimSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === SLASH) end--;
+  return end === s.length ? s : s.slice(0, end);
+}
+function trimChar(s, code) {
+  let start = 0;
+  let end = s.length;
+  while (start < end && s.charCodeAt(start) === code) start++;
+  while (end > start && s.charCodeAt(end - 1) === code) end--;
+  return start === 0 && end === s.length ? s : s.slice(start, end);
+}
+function trimSlashes(s) {
+  return trimChar(s, SLASH);
+}
+
 // src/generator.ts
 var WRITE_METHODS = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
 var INTERNAL_PREFIXES = ["/swagger", "/__dev", "/__feedback", "/ai", "/rag", "/vision", "/embed", "/image"];
@@ -85,7 +103,10 @@ function generate(routes, models = []) {
     openapi: resolveOpenApiVersion(),
     info: buildInfo(),
     servers: resolveServers(),
-    paths: {},
+    // Prototype-less: route paths are developer-defined, but a null prototype
+    // makes `spec.paths[path][method] = op` structurally pollution-proof
+    // regardless (js/prototype-polluting-assignment). Serialises to JSON the same.
+    paths: /* @__PURE__ */ Object.create(null),
     components: {
       schemas: {},
       // Configurable security schemes (v3.13.42): bearerFormat via env, optional
@@ -150,7 +171,7 @@ function buildOperation(route, spec, ctx) {
   const openApiPath = patternToOpenAPI(route.pattern);
   const method = route.method.toLowerCase();
   if (!spec.paths[openApiPath]) {
-    spec.paths[openApiPath] = {};
+    spec.paths[openApiPath] = /* @__PURE__ */ Object.create(null);
   }
   const tags = route.meta?.tags ?? inferTags(route.pattern);
   for (const t of tags) {
@@ -468,7 +489,7 @@ function inferModelFromPath(pattern) {
   return null;
 }
 function operationIdBase(method, openApiPath) {
-  const clean = openApiPath.replace(/^\/+|\/+$/g, "").replace(/\//g, "_").replace(/\.\.\./g, "").replace(/[{}]/g, "").replace(/\*/g, "wildcard");
+  const clean = trimSlashes(openApiPath).replace(/\//g, "_").replace(/\.\.\./g, "").replace(/[{}]/g, "").replace(/\*/g, "wildcard");
   return clean ? `${method}_${clean}` : method;
 }
 function uniqueOperationId(method, openApiPath, seen) {
@@ -485,7 +506,7 @@ function uniqueOperationId(method, openApiPath, seen) {
 
 // src/ui.ts
 function swaggerUiCdn() {
-  return (process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5").replace(/\/+$/, "");
+  return rtrimSlashes(process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5");
 }
 var SWAGGER_UI_HTML = (specUrl, nonce) => `<!DOCTYPE html>
 <html lang="en">

package/packages/swagger/src/generator.ts

@@ -7,6 +7,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */
 
 import type { RouteDefinition } from "../../core/src/index.js";
+import { trimSlashes } from "../../core/src/slashTrim.js";
 import type { ModelDefinition, FieldDefinition } from "../../orm/src/index.js";
 
 interface OpenAPISpecInfo {
@@ -191,7 +192,10 @@ export function generate(
     openapi: resolveOpenApiVersion(),
     info: buildInfo(),
     servers: resolveServers(),
-    paths: {},
+    // Prototype-less: route paths are developer-defined, but a null prototype
+    // makes `spec.paths[path][method] = op` structurally pollution-proof
+    // regardless (js/prototype-polluting-assignment). Serialises to JSON the same.
+    paths: Object.create(null),
     components: {
       schemas: {},
       // Configurable security schemes (v3.13.42): bearerFormat via env, optional
@@ -297,7 +301,7 @@ function buildOperation(route: RouteDefinition, spec: OpenAPISpec, ctx: BuildCon
   const method = route.method.toLowerCase();
 
   if (!spec.paths[openApiPath]) {
-    spec.paths[openApiPath] = {};
+    spec.paths[openApiPath] = Object.create(null);
   }
 
   const tags = route.meta?.tags ?? inferTags(route.pattern);
@@ -793,8 +797,7 @@ function inferModelFromPath(pattern: string): string | null {
  * distinct ids straight from the two distinct paths.
  */
 function operationIdBase(method: string, openApiPath: string): string {
-  const clean = openApiPath
-    .replace(/^\/+|\/+$/g, "")   // strip leading/trailing slashes (Python .strip("/"))
+  const clean = trimSlashes(openApiPath)   // strip leading/trailing slashes (ReDoS-safe)
     .replace(/\//g, "_")          // internal slash -> underscore
     .replace(/\.\.\./g, "")       // catch-all '...' inside braces -> nothing ({...slug} -> slug)
     .replace(/[{}]/g, "")         // drop braces

package/packages/swagger/src/ui.ts

@@ -7,6 +7,7 @@ file, You can obtain one at https://mozilla.org/MPL/2.0/.
 */
 
 import type { Tina4Request, Tina4Response, RouteDefinition } from "../../core/src/index.js";
+import { rtrimSlashes } from "../../core/src/slashTrim.js";
 
 // The UI assets load from a CDN by default (a documented architecture decision —
 // we don't vendor ~1.4MB of swagger-ui-dist, to stay small). jsdelivr
@@ -15,7 +16,7 @@ import type { Tina4Request, Tina4Response, RouteDefinition } from "../../core/sr
 // splitting jsdelivr/unpkg. Air-gapped deployments point TINA4_SWAGGER_UI_CDN
 // at a self-hosted mirror (a base URL serving swagger-ui.css + swagger-ui-bundle.js).
 function swaggerUiCdn(): string {
-  return (process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5").replace(/\/+$/, "");
+  return rtrimSlashes(process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5");
 }
 
 // The inline <style> and the inline SwaggerUIBundle(...) <script> carry this

package/types/core/src/devAdmin.d.ts

@@ -221,6 +221,46 @@ export declare class DevAdmin {
         reload?: boolean;
     }): string;
 }
+/** A column as the DB adapter's getColumns() reports it, for seeding. */
+interface SeedColumn {
+    name: string;
+    type: string;
+    primaryKey?: boolean;
+}
+/** The fake-data surface buildSeedFieldMap draws from (orm's FakeData). */
+interface SeedFake {
+    email(): string;
+    name(): string;
+    phone(): string;
+    address(): string;
+    url(): string;
+    integer(min: number, max: number): number;
+    numeric(min: number, max: number, dp: number): number;
+    boolean(): boolean;
+    date(): unknown;
+    sentence(words: number): string;
+}
+/**
+ * Resolve the seed request's options from the query string and JSON body (the
+ * query string wins). Exported so the parsing is tested directly. P4b accepts
+ * seed/clear/strict; an unparseable `seed` becomes undefined (not reproducible).
+ */
+export declare function parseSeedRequest(url: URL, body: Record<string, unknown> | null | undefined): {
+    table: string;
+    count: number;
+    seed: number | undefined;
+    clear: boolean;
+    strict: boolean;
+};
+/**
+ * Build a column -> fake-value generator map from the table's columns, keyed on
+ * the column NAME first (email/name/phone/address/url) then its SQL TYPE
+ * (int/float/bool/date), falling back to a short sentence. id / primary-key
+ * columns are skipped (the engine assigns them). Exported so the heuristic is
+ * tested directly. `fake` is seeded by the caller so a run is reproducible; its
+ * generators are closed over by every entry.
+ */
+export declare function buildSeedFieldMap(columns: SeedColumn[], fake: SeedFake): Record<string, () => unknown>;
 /**
  * Return the base URL for the co-located Rust agent server.
  *

package/types/core/src/index.d.ts

@@ -8,6 +8,7 @@ export { discoverRoutes } from "./routeDiscovery.js";
 export { MiddlewareChain, MiddlewareRunner, cors, requestLogger, CorsMiddleware, RateLimiterMiddleware, RequestLogger, SecurityHeadersMiddleware, CsrfMiddleware, attachCsrfFromEnv } from "./middleware.js";
 export type { CorsConfig } from "./middleware.js";
 export { createRequest, makeCaseInsensitiveHeaders, parseMultipart, saveUpload } from "./request.js";
+export type { FormValue } from "./request.js";
 export { createResponse, errorResponse, setDefaultTemplatesDir, getFrond, setFrond, getFrameworkFrond, acceptPrefersJson, wantsJson, negotiatedErrorBody, } from "./response.js";
 export { tryServeStatic } from "./static.js";
 export { loadEnv, getEnv, requireEnv, hasEnv, allEnv, resetEnv, isTruthy } from "./dotenv.js";
@@ -45,7 +46,7 @@ export type { ApiResult, ApiOptions, ApiTransport, DownloadResult, UploadOptions
 export { Context, defaultContext, existingContext, fts5Supported, _sharedContexts } from "./context/index.js";
 export type { SearchHit } from "./context/index.js";
 export { Events } from "./events.js";
-export { DevAdmin, MessageLog, RequestInspector, ErrorTracker, DevMailboxStore, DevQueue, WsTracker, supervisorBaseUrl, devAdminLanguage } from "./devAdmin.js";
+export { DevAdmin, MessageLog, RequestInspector, ErrorTracker, DevMailboxStore, DevQueue, WsTracker, supervisorBaseUrl, devAdminLanguage, parseSeedRequest, buildSeedFieldMap } from "./devAdmin.js";
 export { feedbackEnabled, feedbackWhitelist, feedbackIdentifyUser, feedbackIsWhitelisted, feedbackRateLimitOk, injectFeedbackWidget, handleFeedbackTurn, handleFeedbackWidgetJs, registerFeedbackRoutes, } from "./feedback.js";
 export { Messenger, MessengerConnectionError, createMessenger } from "./messenger.js";
 export type { SendResult, EmailMessage } from "./messenger.js";

package/types/core/src/middleware.d.ts

@@ -325,6 +325,7 @@ export declare class RequestLogger {
  *   TINA4_CSP                 — Content-Security-Policy (default: "default-src 'self'")
  *   TINA4_REFERRER_POLICY     — Referrer-Policy (default: "strict-origin-when-cross-origin")
  *   TINA4_PERMISSIONS_POLICY  — Permissions-Policy (default: "camera=(), microphone=(), geolocation=()")
+ *   TINA4_COOP                — Cross-Origin-Opener-Policy (default: "same-origin-allow-popups")
  *
  * Usage:
  *   Router.use(SecurityHeadersMiddleware);

package/types/core/src/optionalPackage.d.ts

@@ -3,8 +3,8 @@
  * APPLICATION installs, never the framework (ADR-0067).
  *
  * tina4-nodejs installs as exactly one package. `pg`, `mongodb`, `redis` and
- * the `@aws-sdk` S3 client are optional peerDependencies, which npm does not
- * install, so for most apps "missing" is the normal state. Every feature that
+ * the SQL drivers are optional peerDependencies, which npm does not install, so
+ * for most apps "missing" is the normal state. Every feature that
  * reaches for one must therefore fail at the point of use with the exact
  * command that fixes it - never a bare MODULE_NOT_FOUND, never a silent no-op.
  */

package/types/core/src/request.d.ts

@@ -32,7 +32,7 @@ export declare class PayloadTooLargeError extends Error {
  * Zero-dependency implementation.
  */
 export declare function parseMultipart(body: Buffer, boundary: string): {
-    fields: Record<string, string>;
+    fields: Record<string, FormValue>;
     files: Record<string, UploadedFile | UploadedFile[]>;
 };
 /**
@@ -50,3 +50,7 @@ export declare function parseMultipart(body: Buffer, boundary: string): {
  * @throws when the derived name is unsafe or would escape `targetDir`.
  */
 export declare function saveUpload(file: UploadedFile, targetDir: string, filename?: string): string;
+/** A form field's value once its name is nested: `tags[]` a list, `user[name]` an object. */
+export type FormValue = string | FormValue[] | {
+    [key: string]: FormValue;
+};

package/types/core/src/session.d.ts

@@ -413,4 +413,29 @@ export declare function sessionCookieToSend(sess: {
 }, rawRes: {
     headersSent: boolean;
 }): string | null;
+/**
+ * The session of the request being dispatched, for CSRF form-token binding.
+ *
+ * Frond's form_token() reads it through the provider core registers
+ * (setFormTokenSessionProvider), so a token is bound to the session that
+ * rendered it. It lives in an AsyncLocalStorage, like the CSP nonce, so two
+ * requests interleaving on the one event loop never bind to each other's session.
+ */
+interface BindableSession {
+    getSessionId(): string | null;
+    isFresh(): boolean;
+    set(key: string, value: unknown): void;
+}
+/** Run `fn` with a request scope the dispatcher publishes its session into. */
+export declare function runWithFormTokenSession<T>(fn: () => T): T;
+/** Publish the current request's session (no-op outside a request scope). */
+export declare function setFormTokenSession(session: BindableSession | null): void;
+/**
+ * The current request's session id, or "" outside a request.
+ *
+ * A session that holds nothing is sent no cookie, so the form's own POST would
+ * arrive under a newly minted id and fail its own token. Rendering a bound
+ * token therefore stores a marker, which makes the session persist.
+ */
+export declare function currentFormTokenSessionId(): string;
 export {};

package/types/core/src/slashTrim.d.ts

@@ -0,0 +1,6 @@
+/** Strip the given char code from the end only (the `/\/+$/` replacement). */
+export declare function rtrimSlashes(s: string): string;
+/** Strip the given char code from both ends (linear, no backtracking). */
+export declare function trimChar(s: string, code: number): string;
+/** Strip leading AND trailing '/' (the ReDoS-safe `/^\/+|\/+$/g` replacement). */
+export declare function trimSlashes(s: string): string;

package/types/frond/src/engine.d.ts

@@ -47,6 +47,12 @@ export declare const TEMPLATE_CACHE_MAX = 256;
  * string, the same order of magnitude as a compiled template.
  */
 export declare const MEMO_CACHE_MAX = 1024;
+/**
+ * Integers from start to end inclusive, counting down when start is greater
+ * than end. Backs both range() and `a..b`; [] for a bound that is not a
+ * number or a zero step.
+ */
+export declare function frondRange(start: unknown, end: unknown, step?: unknown): number[];
 /** Cached expression dispatcher branch; exported only for cache-bound verification. */
 export declare const expressionFormCache: Map<string, number>;
 /**
@@ -59,6 +65,11 @@ export declare function escapeHtml(value: unknown): string;
  * Set the session ID used by formToken() / form_token() for CSRF session binding.
  */
 export declare function setFormTokenSessionId(sessionId: string): void;
+/**
+ * Register the function that gives form_token() the current request's session
+ * id, so each token is bound to the session that rendered it (CSRF).
+ */
+export declare function setFormTokenSessionProvider(fn: () => string): void;
 /**
  * Register the function that backs the `{{ csp_nonce() }}` template global.
  * @tina4/core calls this once with its request-scoped nonce source so every

package/types/frond/src/index.d.ts

@@ -1,2 +1,2 @@
-export { Frond, escapeHtml, setCspNonceProvider } from "./engine.js";
+export { Frond, escapeHtml, setCspNonceProvider, setFormTokenSessionProvider } from "./engine.js";
 export type { FilterFn, TestFn, LiveProvider, LiveRequest, LiveResponse, LiveBroadcaster } from "./engine.js";

package/types/orm/src/realtime/index.d.ts

@@ -1,5 +1,6 @@
 export { realtime, iceServers, type RealtimeOptions } from "./realtime.js";
 export { LocalStorage, S3Storage, selectStorage, storageKey, type StorageBackend, } from "./storage.js";
+export { S3Client, S3Error, S3ConfigError, uriEncode } from "./s3Client.js";
 export { default as Workspace } from "./models/workspace.js";
 export { default as Channel } from "./models/channel.js";
 export { default as ChannelMember } from "./models/channelMember.js";

package/types/orm/src/realtime/s3Client.d.ts

@@ -0,0 +1,48 @@
+/** An S3 request returned a non-2xx status; `status` holds the HTTP code. */
+export declare class S3Error extends Error {
+    readonly status: number;
+    /** Seconds from a Retry-After header in its delta-seconds form, else null. */
+    retryAfter: number | null;
+    constructor(status: number, message: string);
+}
+/** The client cannot sign a request: no access key or secret was given. */
+export declare class S3ConfigError extends Error {
+    constructor(message: string);
+}
+/**
+ * SigV4 canonical encoding: keep the RFC 3986 unreserved set literal; keep "/"
+ * in a path and encode it in a query; every other byte becomes %XX (upper-case).
+ */
+export declare function uriEncode(value: string, isPath: boolean): string;
+export declare class S3Client {
+    private readonly scheme;
+    private readonly host;
+    private readonly prefix;
+    private readonly region;
+    private readonly accessKey;
+    private readonly secretKey;
+    private readonly timeout;
+    constructor(opts?: {
+        endpoint?: string;
+        accessKey?: string;
+        secretKey?: string;
+        region?: string;
+        timeout?: number;
+    });
+    putObject(bucket: string, key: string, data: Buffer | string, contentType?: string): Promise<void>;
+    getObject(bucket: string, key: string): Promise<Buffer>;
+    deleteObject(bucket: string, key: string): Promise<void>;
+    headObject(bucket: string, key: string): Promise<void>;
+    /** Create the bucket (path-style `PUT /<bucket>`); an already-owned bucket (409) is success. */
+    createBucket(bucket: string): Promise<void>;
+    /** A URL that fetches the object directly, signed via SigV4 query params. */
+    presignedGetUrl(bucket: string, key: string, expires?: number): string;
+    private requireCredentials;
+    private now;
+    private canonicalUri;
+    private canonicalQuery;
+    private signingKey;
+    private sign;
+    private request;
+    private send;
+}

package/types/orm/src/realtime/storage.d.ts

@@ -1,8 +1,9 @@
 /**
  * Pluggable file storage for the realtime "files" feature. StorageBackend is
  * the interface; LocalStorage (default, zero-dependency, filesystem) and
- * S3Storage (opt-in, S3-compatible via @aws-sdk/client-s3) are the shipped
- * implementations. Selection mirrors the cache/session/queue backend pattern:
+ * S3Storage (opt-in, S3-compatible, also zero-dependency — it uses Tina4's own
+ * stdlib SigV4 client, not @aws-sdk) are the shipped implementations.
+ * Selection mirrors the cache/session/queue backend pattern:
  * TINA4_STORAGE_BACKEND (local default | s3) plus per-backend env vars, with a
  * graceful fallback to local if an s3 backend cannot be constructed - a real
  * persistent store, never a silent no-op. Parity with Python's storage.py.
@@ -33,10 +34,11 @@ export declare class LocalStorage implements StorageBackend {
     exists(key: string): boolean;
 }
 /**
- * S3-compatible store (AWS S3, MinIO, ...). Opt-in; the app installs the SDK:
- * `npm install @aws-sdk/client-s3 @aws-sdk/s3-request-presigner`.
- * Presigned GET URLs let clients fetch large blobs straight from object
- * storage instead of streaming through the app.
+ * S3-compatible store (AWS S3, MinIO, Garage, ...). Opt-in, zero dependencies.
+ *
+ * Talks to S3 through Tina4's own stdlib SigV4 client (S3Client, node:crypto +
+ * global fetch) — no @aws-sdk packages. Presigned GET URLs let clients fetch
+ * large blobs straight from object storage instead of streaming through the app.
  */
 export declare class S3Storage implements StorageBackend {
     private client;
@@ -57,6 +59,6 @@ export declare class S3Storage implements StorageBackend {
 /**
  * Resolve the storage backend from an explicit instance or the environment.
  * Falls back to LocalStorage (logging why) when an s3 backend cannot be built
- * (driver missing or config incomplete) - a real store, never a silent no-op.
+ * (config incomplete, e.g. no bucket) - a real store, never a silent no-op.
  */
 export declare function selectStorage(storage?: StorageBackend): StorageBackend;