tina4-nodejs 3.13.149 → 3.13.151

package/packages/core/dist/index.js

@@ -13,6 +13,30 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/slashTrim.ts
+function rtrimSlashes(s) {
+  let end = s.length;
+  while (end > 0 && s.charCodeAt(end - 1) === SLASH) end--;
+  return end === s.length ? s : s.slice(0, end);
+}
+function trimChar(s, code) {
+  let start2 = 0;
+  let end = s.length;
+  while (start2 < end && s.charCodeAt(start2) === code) start2++;
+  while (end > start2 && s.charCodeAt(end - 1) === code) end--;
+  return start2 === 0 && end === s.length ? s : s.slice(start2, end);
+}
+function trimSlashes(s) {
+  return trimChar(s, SLASH);
+}
+var SLASH;
+var init_slashTrim = __esm({
+  "src/slashTrim.ts"() {
+    "use strict";
+    SLASH = 47;
+  }
+});
+
 // src/constants.ts
 var HTTP_OK, HTTP_CREATED, HTTP_ACCEPTED, HTTP_NO_CONTENT, HTTP_MOVED, HTTP_REDIRECT, HTTP_NOT_MODIFIED, HTTP_BAD_REQUEST, HTTP_UNAUTHORIZED, HTTP_FORBIDDEN, HTTP_NOT_FOUND, HTTP_METHOD_NOT_ALLOWED, HTTP_CONFLICT, HTTP_GONE, HTTP_UNPROCESSABLE, HTTP_TOO_MANY, HTTP_SERVER_ERROR, HTTP_BAD_GATEWAY, HTTP_UNAVAILABLE, APPLICATION_JSON, APPLICATION_XML, APPLICATION_FORM, APPLICATION_OCTET, TEXT_HTML, TEXT_PLAIN, TEXT_CSV, TEXT_XML;
 var init_constants = __esm({
@@ -1101,7 +1125,7 @@ function resolveAlgorithm(algorithm) {
   return chosen;
 }
 function base64urlEncode(data) {
-  return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/={1,2}$/, "");
 }
 function base64urlDecode(str) {
   let s = str.replace(/-/g, "+").replace(/_/g, "/");
@@ -1380,6 +1404,12 @@ var init_types = __esm({
 });
 
 // ../orm/src/databaseResult.ts
+function stripTypeArgs(colType) {
+  const open = colType.indexOf("(");
+  if (open < 0) return colType;
+  const close = colType.indexOf(")", open);
+  return close < 0 ? colType : colType.slice(0, open) + colType.slice(close + 1);
+}
 var DatabaseResult;
 var init_databaseResult = __esm({
   "../orm/src/databaseResult.ts"() {
@@ -1562,7 +1592,7 @@ var init_databaseResult = __esm({
           const [size, decimals] = this._parseTypeSize(colType);
           return {
             name: col.name,
-            type: colType.replace(/\(.*\)/, ""),
+            type: stripTypeArgs(colType),
             size,
             decimals,
             nullable: col.nullable ?? true,
@@ -2119,12 +2149,49 @@ var init_point = __esm({
 });
 
 // ../orm/src/sqlTranslator.ts
-var SQLTranslator, QueryCache;
+function skipQuoted(sql, i, backslashEscapes) {
+  const c = sql[i];
+  const escapeString = c === "'" && (sql[i - 1] === "E" || sql[i - 1] === "e") && !isIdentChar(sql[i - 2]);
+  const backslash = c !== "`" && (escapeString || backslashEscapes);
+  const n = sql.length;
+  i++;
+  while (i < n) {
+    if (backslash && sql[i] === "\\") {
+      i += 2;
+      continue;
+    }
+    if (sql[i] === c) {
+      if (sql[i + 1] === c) {
+        i += 2;
+        continue;
+      }
+      return i + 1;
+    }
+    i++;
+  }
+  return i;
+}
+function skipLineComment(sql, i) {
+  while (i < sql.length && sql[i] !== "\n") i++;
+  return i;
+}
+function skipBlockComment(sql, i) {
+  const end = sql.indexOf("*/", i + 2);
+  return end === -1 ? sql.length : end + 2;
+}
+function skipDollarQuote(sql, i) {
+  const tag = sql.slice(i).match(/^\$([A-Za-z_][A-Za-z0-9_]*)?\$/);
+  if (!tag) return i;
+  const end = sql.indexOf(tag[0], i + tag[0].length);
+  return end === -1 ? sql.length : end + tag[0].length;
+}
+var isIdentChar, SQLTranslator, QueryCache;
 var init_sqlTranslator = __esm({
   "../orm/src/sqlTranslator.ts"() {
     "use strict";
     init_databaseUrl();
     init_point();
+    isIdentChar = (ch) => !!ch && /[A-Za-z0-9_]/.test(ch);
     SQLTranslator = class _SQLTranslator {
       static SPATIAL_ENGINES = /* @__PURE__ */ new Set(["postgres", "postgresql"]);
       static SPATIAL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)*$/;
@@ -2405,47 +2472,26 @@ var init_sqlTranslator = __esm({
       static placeholderPositions(sql, options = {}) {
         const positions = [];
         const n = sql.length;
-        const isIdent = (ch) => !!ch && /[A-Za-z0-9_]/.test(ch);
         let i = 0;
         while (i < n) {
           const c = sql[i];
           const next = sql[i + 1];
           if (c === "'" || c === '"' || c === "`") {
-            const prev = sql[i - 1];
-            const escapeString = c === "'" && (prev === "E" || prev === "e") && !isIdent(sql[i - 2]);
-            const backslash = c !== "`" && (escapeString || options.backslashEscapes === true);
-            i++;
-            while (i < n) {
-              if (backslash && sql[i] === "\\") {
-                i += 2;
-                continue;
-              }
-              if (sql[i] === c) {
-                if (sql[i + 1] === c) {
-                  i += 2;
-                  continue;
-                }
-                i++;
-                break;
-              }
-              i++;
-            }
+            i = skipQuoted(sql, i, options.backslashEscapes === true);
             continue;
           }
           if (c === "-" && next === "-") {
-            while (i < n && sql[i] !== "\n") i++;
+            i = skipLineComment(sql, i);
             continue;
           }
           if (c === "/" && next === "*") {
-            const end = sql.indexOf("*/", i + 2);
-            i = end === -1 ? n : end + 2;
+            i = skipBlockComment(sql, i);
             continue;
           }
-          if (c === "$" && !isIdent(sql[i - 1])) {
-            const tag = sql.slice(i).match(/^\$([A-Za-z_][A-Za-z0-9_]*)?\$/);
-            if (tag) {
-              const end = sql.indexOf(tag[0], i + tag[0].length);
-              i = end === -1 ? n : end + tag[0].length;
+          if (c === "$" && !isIdentChar(sql[i - 1])) {
+            const past = skipDollarQuote(sql, i);
+            if (past !== i) {
+              i = past;
               continue;
             }
           }
@@ -2478,7 +2524,7 @@ var init_sqlTranslator = __esm({
        * → { sql: "INSERT INTO t (x) VALUES (1)", columns: ["id", "name"] }
        */
       static parseReturning(sql) {
-        const m = sql.match(/\bRETURNING\s+(.+)$/i);
+        const m = sql.match(/\bRETURNING\s+(\S.*)$/i);
         if (!m) return { sql, columns: [] };
         const columns = m[1].split(",").map((c) => c.trim());
         return {
@@ -2532,7 +2578,12 @@ var init_sqlTranslator = __esm({
       // The `d` flag records group indices, so the head can be sliced at the exact
       // start of the VALUES group rather than by hunting for a parenthesis (the
       // column list has parentheses too).
-      static INSERT_VALUES = /^\s*INSERT\s+INTO\s+.+?\s+VALUES\s*\(([^()]*)\)\s*$/dis;
+      static INSERT_VALUES = (
+        // ReDoS-safe: the table ref matches `\S(?:[\s\S]*?\S)?` (bounded by non-space
+        // at both ends) so the separator `\s+` before VALUES can't overlap it the way
+        // the old `.+?\s+` did (polynomial on `INSERT INTO ` + a long space run).
+        /^\s*INSERT\s+INTO\s+\S(?:[\s\S]*?\S)?\s+VALUES\s*\(([^()]*)\)\s*$/dis
+      );
       /**
        * Engines whose lastInsertId reports the FIRST generated id of a multi-row
        * INSERT rather than the last. Verified live, not assumed: a 3-row insert
@@ -7272,7 +7323,7 @@ __export(database_exports, {
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 function stripTrailingSemicolons(sql) {
   if (!sql) return sql;
-  let stripped = sql.replace(/\s+$/, "");
+  let stripped = sql.trimEnd();
   while (stripped.endsWith(";")) {
     stripped = stripped.slice(0, -1).replace(/\s+$/, "");
   }
@@ -7439,6 +7490,13 @@ async function createAdapterFromUrl(url, username, password) {
 }
 async function buildAdapterFromUrl(url, username, password) {
   const parsed = parseDatabaseUrl(url, username, password);
+  const serverConfig = {
+    host: parsed.host ?? void 0,
+    port: parsed.port ?? void 0,
+    user: parsed.username ?? void 0,
+    password: parsed.password ?? void 0,
+    database: parsed.database || void 0
+  };
   switch (parsed.engine) {
     case "sqlite": {
       const { SQLiteAdapter: SQLiteAdapter2 } = await Promise.resolve().then(() => (init_sqlite(), sqlite_exports));
@@ -7446,49 +7504,25 @@ async function buildAdapterFromUrl(url, username, password) {
     }
     case "postgres": {
       const { PostgresAdapter: PostgresAdapter2 } = await Promise.resolve().then(() => (init_postgres(), postgres_exports));
-      const adapter = new PostgresAdapter2({
-        host: parsed.host ?? void 0,
-        port: parsed.port ?? void 0,
-        user: parsed.username ?? void 0,
-        password: parsed.password ?? void 0,
-        database: parsed.database || void 0
-      });
+      const adapter = new PostgresAdapter2(serverConfig);
       await adapter.connect();
       return adapter;
     }
     case "mysql": {
       const { MysqlAdapter: MysqlAdapter2 } = await Promise.resolve().then(() => (init_mysql(), mysql_exports));
-      const adapter = new MysqlAdapter2({
-        host: parsed.host ?? void 0,
-        port: parsed.port ?? void 0,
-        user: parsed.username ?? void 0,
-        password: parsed.password ?? void 0,
-        database: parsed.database || void 0
-      });
+      const adapter = new MysqlAdapter2(serverConfig);
       await adapter.connect();
       return adapter;
     }
     case "mssql": {
       const { MssqlAdapter: MssqlAdapter2 } = await Promise.resolve().then(() => (init_mssql(), mssql_exports));
-      const adapter = new MssqlAdapter2({
-        host: parsed.host ?? void 0,
-        port: parsed.port ?? void 0,
-        user: parsed.username ?? void 0,
-        password: parsed.password ?? void 0,
-        database: parsed.database || void 0
-      });
+      const adapter = new MssqlAdapter2(serverConfig);
       await adapter.connect();
       return adapter;
     }
     case "firebird": {
       const { FirebirdAdapter: FirebirdAdapter2 } = await Promise.resolve().then(() => (init_firebird(), firebird_exports));
-      const adapter = new FirebirdAdapter2({
-        host: parsed.host ?? void 0,
-        port: parsed.port ?? void 0,
-        user: parsed.username ?? void 0,
-        password: parsed.password ?? void 0,
-        database: parsed.database || void 0
-      });
+      const adapter = new FirebirdAdapter2(serverConfig);
       await adapter.connect();
       return adapter;
     }
@@ -10224,9 +10258,11 @@ __export(engine_exports, {
   escapeHtml: () => escapeHtml,
   expressionFormCache: () => expressionFormCache,
   filterChainCache: () => filterChainCache,
+  frondRange: () => frondRange,
   pathParseCache: () => pathParseCache,
   setCspNonceProvider: () => setCspNonceProvider,
-  setFormTokenSessionId: () => setFormTokenSessionId
+  setFormTokenSessionId: () => setFormTokenSessionId,
+  setFormTokenSessionProvider: () => setFormTokenSessionProvider
 });
 import { createHash as createHash3, createHmac as createHmac2, randomBytes as randomBytes2 } from "node:crypto";
 import { readFileSync as readFileSync4, existsSync as existsSync5, statSync as statSync4, realpathSync } from "node:fs";
@@ -10311,6 +10347,14 @@ function renderDump(value) {
   const escaped = dumped.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
   return new SafeString(`<pre>${escaped}</pre>`);
 }
+function stripTags(input) {
+  let s = input, prev;
+  do {
+    prev = s;
+    s = s.replace(STRIP_TAGS_RE, "");
+  } while (s !== prev);
+  return s;
+}
 function liveAttr(value) {
   return String(value).replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
@@ -10328,35 +10372,58 @@ function sweepExpiredCache(cache) {
     if (expiresAt2 <= now) cache.delete(key);
   }
 }
-function tokenize(source) {
+function extractRawBlocks(source) {
   const rawBlocks = [];
-  source = source.replace(RAW_BLOCK_RE, (_match, content) => {
+  let out = "";
+  let pos = 0;
+  RAW_OPEN_RE.lastIndex = 0;
+  let om;
+  while ((om = RAW_OPEN_RE.exec(source)) !== null) {
+    const openStart = om.index;
+    const openEnd = RAW_OPEN_RE.lastIndex;
+    RAW_CLOSE_RE.lastIndex = openEnd;
+    const cm = RAW_CLOSE_RE.exec(source);
+    if (cm === null) break;
     const idx = rawBlocks.length;
-    rawBlocks.push(content);
-    return `\0RAW_${idx}\0`;
-  });
+    rawBlocks.push(source.slice(openEnd, cm.index));
+    out += source.slice(pos, openStart) + `\0RAW_${idx}\0`;
+    pos = RAW_CLOSE_RE.lastIndex;
+    RAW_OPEN_RE.lastIndex = pos;
+  }
+  out += source.slice(pos);
+  return { source: out, rawBlocks };
+}
+function tokenize(rawSource) {
+  const { source, rawBlocks } = extractRawBlocks(rawSource);
   const tokens = [];
+  const n = source.length;
   let pos = 0;
-  TOKEN_RE.lastIndex = 0;
-  let m;
-  while ((m = TOKEN_RE.exec(source)) !== null) {
-    const start2 = m.index;
-    if (start2 > pos) {
-      tokens.push(["TEXT", source.slice(pos, start2)]);
+  let scan = 0;
+  const exhausted = { "%}": false, "}}": false, "#}": false };
+  while (scan < n) {
+    const brace = source.indexOf("{", scan);
+    if (brace === -1) break;
+    const kind = TAG_KINDS[source[brace + 1]];
+    if (!kind) {
+      scan = brace + 1;
+      continue;
     }
-    const raw = m[0];
-    if (raw.startsWith("{#")) {
-      tokens.push(["COMMENT", raw]);
-    } else if (raw.startsWith("{{")) {
-      tokens.push(["VAR", raw]);
-    } else if (raw.startsWith("{%")) {
-      tokens.push(["BLOCK", raw]);
+    if (exhausted[kind.close]) {
+      scan = brace + 1;
+      continue;
     }
-    pos = m.index + raw.length;
-  }
-  if (pos < source.length) {
-    tokens.push(["TEXT", source.slice(pos)]);
+    const close = source.indexOf(kind.close, brace + 2);
+    if (close === -1) {
+      exhausted[kind.close] = true;
+      scan = brace + 1;
+      continue;
+    }
+    if (brace > pos) tokens.push(["TEXT", source.slice(pos, brace)]);
+    tokens.push([kind.type, source.slice(brace, close + 2)]);
+    pos = close + 2;
+    scan = close + 2;
   }
+  if (pos < n) tokens.push(["TEXT", source.slice(pos)]);
   if (rawBlocks.length > 0) {
     for (let i = 0; i < tokens.length; i++) {
       if (tokens[i][0] === "TEXT" && tokens[i][1].includes("\0RAW_")) {
@@ -10682,26 +10749,123 @@ function evalConcatOrComparison(expr, context) {
   }
   return EXPR_NOT_MATCHED;
 }
+function topLevelPositions(expr) {
+  const positions = [];
+  let inQuote = null;
+  let depth = 0;
+  for (let pos = 0; pos < expr.length; pos++) {
+    const ch = expr[pos];
+    if (inQuote) {
+      if (ch === inQuote) inQuote = null;
+    } else if (ch === '"' || ch === "'") {
+      inQuote = ch;
+    } else if ("([{".includes(ch)) {
+      depth++;
+    } else if (")]}".includes(ch)) {
+      depth--;
+    } else if (depth === 0) {
+      positions.push(pos);
+    }
+  }
+  return positions;
+}
+function followsOperand(expr, pos) {
+  return /[\w)\]'"]$/.test(expr.slice(0, pos).trimEnd());
+}
+function topLevelArithmeticOperators(expr) {
+  const operators = [];
+  let skipUntil = -1;
+  for (const pos of topLevelPositions(expr)) {
+    if (pos < skipUntil || !"+-*/%".includes(expr[pos])) continue;
+    const pair = expr.slice(pos, pos + 2);
+    const op = pair === "**" || pair === "//" ? pair : expr[pos];
+    skipUntil = pos + op.length;
+    if (followsOperand(expr, pos)) operators.push([pos, op]);
+  }
+  return operators;
+}
+function splitArithmetic(expr) {
+  const operators = topLevelArithmeticOperators(expr);
+  for (const level of ARITHMETIC_LEVELS) {
+    const matches = operators.filter(([, op]) => level.includes(op));
+    if (matches.length > 0) return level[0] === "**" ? matches[0] : matches[matches.length - 1];
+  }
+  return null;
+}
 function evalArithmeticExpression(expr, context) {
-  for (const op of [" + ", " - ", " * ", " // ", " / ", " % ", " ** "]) {
-    const pos = findOutsideQuotes(expr, op);
-    if (pos >= 0) {
-      const left = expr.slice(0, pos).trim();
-      const right = expr.slice(pos + op.length).trim();
-      const lVal = evalExpr(left, context);
-      const rVal = evalExpr(right, context);
-      try {
-        let lNum = lVal != null ? Number(lVal) : 0;
-        let rNum = rVal != null ? Number(rVal) : 0;
-        if (isNaN(lNum)) lNum = 0;
-        if (isNaN(rNum)) rNum = 0;
-        return ARITHMETIC_OPERATIONS[op.trim()](lNum, rNum);
-      } catch {
-        return null;
-      }
+  const split = splitArithmetic(expr);
+  if (!split) return EXPR_NOT_MATCHED;
+  const [pos, op] = split;
+  const lVal = evalExpr(expr.slice(0, pos).trim(), context);
+  const rVal = evalExpr(expr.slice(pos + op.length).trim(), context);
+  let lNum = lVal != null ? Number(lVal) : 0;
+  let rNum = rVal != null ? Number(rVal) : 0;
+  if (isNaN(lNum)) lNum = 0;
+  if (isNaN(rNum)) rNum = 0;
+  return ARITHMETIC_OPERATIONS[op](lNum, rNum);
+}
+function frondRange(start2, end, step = 1) {
+  const numeric = (value) => typeof value === "number" || typeof value === "string" && NUMERIC_RE.test(value);
+  if (!numeric(start2) || !numeric(end) || !numeric(step)) return [];
+  const first = Math.trunc(Number(start2));
+  const last = Math.trunc(Number(end));
+  const stride = Math.abs(Math.trunc(Number(step)));
+  if (stride === 0) return [];
+  const values = [];
+  if (first <= last) for (let value = first; value <= last; value += stride) values.push(value);
+  else for (let value = first; value >= last; value -= stride) values.push(value);
+  return values;
+}
+function findRangeOperator(expr) {
+  let pos = findOutsideQuotes(expr, "..");
+  while (pos >= 0) {
+    const partOfEllipsis = expr.startsWith("...", pos) || pos > 0 && expr[pos - 1] === ".";
+    if (pos > 0 && !partOfEllipsis) return findOutsideQuotes(expr.slice(pos + 2), "|") >= 0 ? -1 : pos;
+    const next = findOutsideQuotes(expr.slice(pos + 2), "..");
+    pos = next >= 0 ? pos + 2 + next : -1;
+  }
+  return -1;
+}
+function evalRangeExpression(expr, context) {
+  const pos = findRangeOperator(expr);
+  if (pos < 0) return EXPR_NOT_MATCHED;
+  return frondRange(evalExpr(expr.slice(0, pos).trim(), context), evalExpr(expr.slice(pos + 2).trim(), context));
+}
+function closingBracketIndex(expr) {
+  let depth = 0;
+  let inQuote = null;
+  for (let i = 0; i < expr.length; i++) {
+    const ch = expr[i];
+    if (inQuote) {
+      if (ch === inQuote) inQuote = null;
+    } else if (ch === '"' || ch === "'") {
+      inQuote = ch;
+    } else if ("([{".includes(ch)) {
+      depth++;
+    } else if (")]}".includes(ch) && --depth === 0) {
+      return i;
     }
   }
-  return EXPR_NOT_MATCHED;
+  return -1;
+}
+function mapLiteralKey(rawKey, context) {
+  const quoted = rawKey.length >= 2 && (rawKey[0] === '"' || rawKey[0] === "'") && rawKey.endsWith(rawKey[0]);
+  if (quoted) return rawKey.slice(1, -1);
+  return BARE_KEY_RE.test(rawKey) ? rawKey : String(evalExpr(rawKey, context));
+}
+function evalMapLiteral(inner, context) {
+  const map = {};
+  for (const pair of inner === "" ? [] : splitArgs(inner)) {
+    const colon = findOutsideQuotes(pair, ":");
+    if (colon > 0) map[mapLiteralKey(pair.slice(0, colon).trim(), context)] = evalExpr(pair.slice(colon + 1).trim(), context);
+  }
+  return map;
+}
+function evalCollectionLiteral(expr, context) {
+  if (expr[0] !== "[" && expr[0] !== "{" || closingBracketIndex(expr) !== expr.length - 1) return EXPR_NOT_MATCHED;
+  const inner = expr.slice(1, -1).trim();
+  if (expr[0] === "{") return evalMapLiteral(inner, context);
+  return inner === "" ? [] : splitArgs(inner).map((item) => evalExpr(item.trim(), context));
 }
 function evalFilterExpression(expr, context) {
   if (findOutsideQuotes(expr, "|") >= 0) {
@@ -11123,12 +11287,12 @@ function splitArgs(raw) {
       current += ch;
       continue;
     }
-    if (ch === "(" || ch === "[") {
+    if (ch === "(" || ch === "[" || ch === "{") {
       depth++;
       current += ch;
       continue;
     }
-    if (ch === ")" || ch === "]") {
+    if (ch === ")" || ch === "]" || ch === "}") {
       depth--;
       current += ch;
       continue;
@@ -11293,11 +11457,14 @@ function formatMatch(match, flags, width, prec, type2, arg) {
   return padFormattedValue(formatValue(type2, precision, arg), flags, width);
 }
 function _b64url(data) {
-  return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return data.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/={1,2}$/, "");
 }
 function setFormTokenSessionId(sessionId) {
   _formTokenSessionId = sessionId || "";
 }
+function setFormTokenSessionProvider(fn) {
+  _formTokenSessionProvider = fn;
+}
 function setCspNonceProvider(fn) {
   _cspNonceProvider = fn;
 }
@@ -11322,8 +11489,9 @@ function _buildFormTokenJwt(descriptor = "") {
       payload.context = descriptor;
     }
   }
-  if (_formTokenSessionId) {
-    payload.session_id = _formTokenSessionId;
+  const sessionId = _formTokenSessionProvider() || _formTokenSessionId;
+  if (sessionId) {
+    payload.session_id = sessionId;
   }
   const h2 = _b64url(Buffer.from(JSON.stringify(header)));
   const p = _b64url(Buffer.from(JSON.stringify(payload)));
@@ -11339,7 +11507,7 @@ function _generateFormToken(descriptor = "") {
 function _generateFormTokenValue(descriptor = "") {
   return new SafeString(_buildFormTokenJwt(descriptor));
 }
-var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FAST_FILTERS, FORMAT_RE, LEADING_WS_RE, TRAILING_WS_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, TOKEN_RE, RAW_BLOCK_RE, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, EXPR_EVALUATORS, expressionFormCache, VarRef, JS_SAFE_RE, MEDIA_TYPE_RE, SANDBOX_EXPR_KEYWORDS, SANDBOX_IDENT_RE, SANDBOX_STRING_RE, UNSAFE_KEYS, BUILTIN_FILTERS, _formTokenSessionId, _cspNonceProvider, Frond;
+var SafeString, KNOWN_TAGS, TERMINATOR_TAGS, GATEABLE_TAGS, BLOCK_TAG_ENDS, JSON_UNSAFE_RE, JSON_UNSAFE_MAP, NUMERIC_RE, METHOD_CALL_RE, FN_CALL_RE, IS_NOT_RE, IS_RE, NOT_IN_RE, IN_RE, DIVISIBLE_BY_RE, FILTER_WITH_ARGS_RE, FILTER_COMPARISON_RE, TITLE_WORD_RE, STRIP_TAGS_RE, FAST_FILTERS, FORMAT_RE, THOUSANDS_RE, LIVE_RE, LIVE_WS_RE, LIVE_SRC_RE, EXTENDS_RE, EXTENDS_RE_GLOBAL, filterChainCache, pathParseCache, TEMPLATE_CACHE_MAX, MEMO_CACHE_MAX, RAW_OPEN_RE, RAW_CLOSE_RE, TAG_KINDS, EXPR_NOT_MATCHED, ARITHMETIC_OPERATIONS, ARITHMETIC_LEVELS, BARE_KEY_RE, EXPR_EVALUATORS, expressionFormCache, VarRef, JS_SAFE_RE, MEDIA_TYPE_RE, SANDBOX_EXPR_KEYWORDS, SANDBOX_IDENT_RE, SANDBOX_STRING_RE, UNSAFE_KEYS, BUILTIN_FILTERS, _formTokenSessionId, _formTokenSessionProvider, _cspNonceProvider, Frond;
 var init_engine = __esm({
   "../frond/src/engine.ts"() {
     "use strict";
@@ -11441,7 +11609,7 @@ var init_engine = __esm({
       int: (value) => value ? parseInt(String(value), 10) || 0 : 0,
       float: (value) => value ? parseFloat(String(value)) || 0 : 0,
       abs: (value) => typeof value === "number" ? Math.abs(value) : value,
-      striptags: (value) => String(value).replace(STRIP_TAGS_RE, ""),
+      striptags: (value) => stripTags(String(value)),
       first: (value) => Array.isArray(value) ? value[0] ?? null : null,
       last: (value) => Array.isArray(value) ? value[value.length - 1] ?? null : null,
       keys: (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value) : [],
@@ -11455,20 +11623,23 @@ var init_engine = __esm({
       filter: (value) => Array.isArray(value) ? value.filter(Boolean) : value
     };
     FORMAT_RE = /%%|%([-+ 0]*)(\d+)?(?:\.(\d+))?([sdifFeEgGxXob])/g;
-    LEADING_WS_RE = /^\s+/;
-    TRAILING_WS_RE = /\s+$/;
     THOUSANDS_RE = /\B(?=(\d{3})+(?!\d))/g;
     LIVE_RE = /^live\s+["']([^"']+)["']([\s\S]*)$/;
     LIVE_WS_RE = /ws\s+["']([^"']+)["']/;
     LIVE_SRC_RE = /src\s+["']([^"']+)["']/;
-    EXTENDS_RE = /\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/;
-    EXTENDS_RE_GLOBAL = /\{%[-\s]*extends\s+["'](.+?)["']\s*[-]?%\}/g;
+    EXTENDS_RE = /\{%[-\s]*extends\s+["']([^"']+)["']\s*[-]?%\}/;
+    EXTENDS_RE_GLOBAL = /\{%[-\s]*extends\s+["']([^"']+)["']\s*[-]?%\}/g;
     filterChainCache = /* @__PURE__ */ new Map();
     pathParseCache = /* @__PURE__ */ new Map();
     TEMPLATE_CACHE_MAX = 256;
     MEMO_CACHE_MAX = 1024;
-    TOKEN_RE = /(\{%-?\s*[\s\S]*?\s*-?%\})|(\{\{-?\s*[\s\S]*?\s*-?\}\})|(\{#[\s\S]*?#\})/g;
-    RAW_BLOCK_RE = /\{%-?\s*raw\s*-?%\}([\s\S]*?)\{%-?\s*endraw\s*-?%\}/g;
+    RAW_OPEN_RE = /\{%-?\s*raw\s*-?%\}/g;
+    RAW_CLOSE_RE = /\{%-?\s*endraw\s*-?%\}/g;
+    TAG_KINDS = {
+      "%": { close: "%}", type: "BLOCK" },
+      "{": { close: "}}", type: "VAR" },
+      "#": { close: "#}", type: "COMMENT" }
+    };
     EXPR_NOT_MATCHED = /* @__PURE__ */ Symbol("frond-expression-not-matched");
     ARITHMETIC_OPERATIONS = {
       "+": (left, right) => left + right,
@@ -11479,10 +11650,14 @@ var init_engine = __esm({
       "%": (left, right) => right !== 0 ? left % right : 0,
       "**": (left, right) => left ** right
     };
+    ARITHMETIC_LEVELS = [["+", "-"], ["*", "//", "/", "%"], ["**"]];
+    BARE_KEY_RE = /^[A-Za-z_]\w*$/;
     EXPR_EVALUATORS = [
+      evalCollectionLiteral,
       evalPrimary,
       evalConditional,
       evalConcatOrComparison,
+      evalRangeExpression,
       evalArithmeticExpression,
       evalFilterExpression,
       evalFunctionExpression
@@ -11538,8 +11713,8 @@ var init_engine = __esm({
       },
       title: (v) => String(v).replace(TITLE_WORD_RE, (c) => c.toUpperCase()),
       trim: (v) => String(v).trim(),
-      ltrim: (v) => String(v).replace(LEADING_WS_RE, ""),
-      rtrim: (v) => String(v).replace(TRAILING_WS_RE, ""),
+      ltrim: (v) => String(v).trimStart(),
+      rtrim: (v) => String(v).trimEnd(),
       length: (v) => {
         if (Array.isArray(v)) return v.length;
         if (typeof v === "string") return v.length;
@@ -11580,7 +11755,7 @@ var init_engine = __esm({
       safe: (v) => v,
       escape: (v, ...a) => escapeStrategy(v, a[0] ?? "html"),
       e: (v, ...a) => escapeStrategy(v, a[0] ?? "html"),
-      striptags: (v) => String(v).replace(STRIP_TAGS_RE, ""),
+      striptags: (v) => stripTags(String(v)),
       nl2br: (v) => new SafeString(htmlEscape(String(v)).replace(/\n/g, "<br />\n")),
       abs: (v) => typeof v === "number" ? Math.abs(v) : v,
       round: (v, decimals) => {
@@ -11693,6 +11868,7 @@ var init_engine = __esm({
       js_escape: (v) => new SafeString(jsEscape(v))
     };
     _formTokenSessionId = "";
+    _formTokenSessionProvider = () => "";
     _cspNonceProvider = () => "";
     Frond = class _Frond {
       // ── Class-level registries ──────────────────────────────────
@@ -11846,6 +12022,7 @@ var init_engine = __esm({
         this.globals.form_token = (descriptor) => _generateFormToken(descriptor || "");
         this.globals.formTokenValue = (descriptor) => _generateFormTokenValue(descriptor || "");
         this.globals.form_token_value = (descriptor) => _generateFormTokenValue(descriptor || "");
+        this.globals.range = frondRange;
         this.globals.dump = (value) => renderDump(value);
         this.globals.csp_nonce = () => _cspNonceProvider();
         for (const [k, v] of _Frond.classFilters) this.filters[k] = v;
@@ -12182,20 +12359,20 @@ var init_engine = __esm({
       }
       renderVarToken(tokens, index, context, output) {
         const [content, stripB, stripA] = stripTag(tokens[index][1]);
-        if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].replace(TRAILING_WS_RE, "");
+        if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].trimEnd();
         const result = this.evalVar(content, context);
         output.push(result !== null && result !== void 0 ? String(result) : "");
         if (stripA && index + 1 < tokens.length && tokens[index + 1][0] === "TEXT") {
-          tokens[index + 1] = ["TEXT", tokens[index + 1][1].replace(LEADING_WS_RE, "")];
+          tokens[index + 1] = ["TEXT", tokens[index + 1][1].trimStart()];
         }
         return index + 1;
       }
       renderBlockToken(tokens, index, context, output) {
         const [content, stripB, stripA] = stripTag(tokens[index][1]);
-        if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].replace(TRAILING_WS_RE, "");
+        if (stripB && output.length > 0) output[output.length - 1] = output[output.length - 1].trimEnd();
         const tag = content.split(/\s+/)[0] || "";
         if (stripA && index + 1 < tokens.length && tokens[index + 1][0] === "TEXT") {
-          tokens[index + 1] = ["TEXT", tokens[index + 1][1].replace(LEADING_WS_RE, "")];
+          tokens[index + 1] = ["TEXT", tokens[index + 1][1].trimStart()];
         }
         let next;
         if (tag === "if" && this.tagPermitted(tag)) {
@@ -12212,7 +12389,7 @@ var init_engine = __esm({
           next = block.next;
         }
         if (stripA && next < tokens.length && tokens[next][0] === "TEXT") {
-          tokens[next] = ["TEXT", tokens[next][1].replace(LEADING_WS_RE, "")];
+          tokens[next] = ["TEXT", tokens[next][1].trimStart()];
         }
         return next;
       }
@@ -12471,7 +12648,7 @@ var init_engine = __esm({
       pushIfBranch(branches, condition, branchTokens, stripBefore) {
         if (stripBefore && branchTokens.length > 0 && branchTokens[branchTokens.length - 1][0] === "TEXT") {
           const last = branchTokens[branchTokens.length - 1];
-          branchTokens[branchTokens.length - 1] = ["TEXT", last[1].replace(TRAILING_WS_RE, "")];
+          branchTokens[branchTokens.length - 1] = ["TEXT", last[1].trimEnd()];
         }
         branches.push([condition, branchTokens]);
       }
@@ -12499,7 +12676,7 @@ var init_engine = __esm({
           } else if (tag === "endif") {
             this.pushIfBranch(branches, currentCond, currentTokens, tagStripB);
             if (tagStripA && i + 1 < tokens.length && tokens[i + 1][0] === "TEXT") {
-              tokens[i + 1] = ["TEXT", tokens[i + 1][1].replace(LEADING_WS_RE, "")];
+              tokens[i + 1] = ["TEXT", tokens[i + 1][1].trimStart()];
             }
             return { branches, next: i + 1 };
           } else if ((tag === "elseif" || tag === "elif") && depth === 0) {
@@ -13285,7 +13462,7 @@ function tableData(opts) {
     readonly: !opts.editable,
     inline_script: opts.inlineScript,
     table_name: h(opts.tableName),
-    table_id_attr: opts.tableId ? ` id="${h(opts.tableId)}"` : ""
+    table_id: opts.tableId ? String(opts.tableId) : ""
   };
 }
 var init_crudTable = __esm({
@@ -13393,13 +13570,13 @@ function renderModalForm(mode, columns, pk, edit) {
       value: "",
       placeholder: h(`Enter ${label.toLowerCase()}`),
       type: "text",
-      required_attr: "",
+      required: false,
       input: true
     };
   });
   return renderCrudTemplate("form", {
     wrap: true,
-    form_id_attr: ` id="form-${mode}"`,
+    form_id: `form-${mode}`,
     action: "",
     form_method: "POST",
     method_override: null,
@@ -13456,7 +13633,7 @@ function fieldInputShape(field, base) {
     case "text":
       return { ...base, textarea: true };
     case "boolean":
-      return { ...base, checkbox: true, checked_attr: value ? " checked" : "" };
+      return { ...base, checkbox: true, checked: !!value };
     case "select":
       return { ...base, select: true, options_html: buildOptions(field.options, value) };
     case "date":
@@ -13479,7 +13656,7 @@ function buildCustomField(field) {
     label: h(String(label)),
     value: h(field.value ?? ""),
     placeholder: "",
-    required_attr: field.required ? " required" : ""
+    required: !!field.required
   };
   return fieldInputShape(field, base);
 }
@@ -13487,7 +13664,7 @@ function generateForm(fields, options = {}) {
   const verb = String(options.method ?? "POST").toUpperCase();
   return renderCrudTemplate("form", {
     wrap: true,
-    form_id_attr: "",
+    form_id: "",
     action: h(options.action ?? "/"),
     form_method: h(verb),
     method_override: ["PUT", "PATCH", "DELETE"].includes(verb) ? verb : null,
@@ -18138,20 +18315,210 @@ var init_attachment = __esm({
   }
 });
 
+// ../orm/src/realtime/s3Client.ts
+import { createHash as createHash4, createHmac as createHmac3 } from "node:crypto";
+function retryAfterSeconds(raw) {
+  if (raw == null) return null;
+  const n = Number(raw);
+  return Number.isFinite(n) ? Math.max(0, n) : null;
+}
+function uriEncode(value, isPath) {
+  let out = "";
+  for (const byte of Buffer.from(value, "utf8")) {
+    const ch = String.fromCharCode(byte);
+    if (UNRESERVED.test(ch) || isPath && ch === "/") out += ch;
+    else out += "%" + byte.toString(16).toUpperCase().padStart(2, "0");
+  }
+  return out;
+}
+function sha256Hex2(data) {
+  return createHash4("sha256").update(data).digest("hex");
+}
+function hmac(key, msg) {
+  return createHmac3("sha256", key).update(msg, "utf8").digest();
+}
+var ALGORITHM, SERVICE, UNRESERVED, MAX_RETRIES, BACKOFF_BASE, BACKOFF_CAP, S3Error, S3ConfigError, sleep, S3Client;
+var init_s3Client = __esm({
+  "../orm/src/realtime/s3Client.ts"() {
+    "use strict";
+    ALGORITHM = "AWS4-HMAC-SHA256";
+    SERVICE = "s3";
+    UNRESERVED = /[A-Za-z0-9\-_.~]/;
+    MAX_RETRIES = 2;
+    BACKOFF_BASE = 0.5;
+    BACKOFF_CAP = 20;
+    S3Error = class extends Error {
+      constructor(status2, message) {
+        super(message);
+        this.status = status2;
+        this.name = "S3Error";
+      }
+      status;
+      /** Seconds from a Retry-After header in its delta-seconds form, else null. */
+      retryAfter = null;
+    };
+    S3ConfigError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "S3ConfigError";
+      }
+    };
+    sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+    S3Client = class {
+      scheme;
+      host;
+      // authority (host[:port]) — matches the Host header
+      prefix;
+      // path an endpoint carries (https://host/s3 -> "/s3"), "" if none
+      region;
+      accessKey;
+      secretKey;
+      timeout;
+      constructor(opts = {}) {
+        this.region = opts.region || "us-east-1";
+        this.accessKey = opts.accessKey || "";
+        this.secretKey = opts.secretKey || "";
+        this.timeout = opts.timeout ?? 3e4;
+        let base = opts.endpoint || `https://s3.${this.region}.amazonaws.com`;
+        while (base.endsWith("/")) base = base.slice(0, -1);
+        const m = /^([a-z][a-z0-9+.-]*):\/\/([^/]+)(\/.*)?$/i.exec(base);
+        this.scheme = m ? m[1] : "https";
+        this.host = m ? m[2] : base;
+        let p = m && m[3] ? m[3] : "";
+        while (p.endsWith("/")) p = p.slice(0, -1);
+        this.prefix = p;
+      }
+      // -- public API (the subset S3Storage uses) --------------------------------
+      async putObject(bucket, key, data, contentType = "application/octet-stream") {
+        const body = Buffer.isBuffer(data) ? data : Buffer.from(data);
+        await this.request("PUT", this.canonicalUri(bucket, key), body, { "content-type": contentType });
+      }
+      async getObject(bucket, key) {
+        return (await this.request("GET", this.canonicalUri(bucket, key), Buffer.alloc(0))).body;
+      }
+      async deleteObject(bucket, key) {
+        await this.request("DELETE", this.canonicalUri(bucket, key), Buffer.alloc(0));
+      }
+      async headObject(bucket, key) {
+        await this.request("HEAD", this.canonicalUri(bucket, key), Buffer.alloc(0));
+      }
+      /** Create the bucket (path-style `PUT /<bucket>`); an already-owned bucket (409) is success. */
+      async createBucket(bucket) {
+        try {
+          await this.request("PUT", `${this.prefix}/${uriEncode(bucket, true)}`, Buffer.alloc(0));
+        } catch (e) {
+          if (!(e instanceof S3Error) || e.status !== 409) throw e;
+        }
+      }
+      /** A URL that fetches the object directly, signed via SigV4 query params. */
+      presignedGetUrl(bucket, key, expires = 3600) {
+        this.requireCredentials();
+        const { amzDate, dateStamp } = this.now();
+        const uri = this.canonicalUri(bucket, key);
+        const scope = `${dateStamp}/${this.region}/${SERVICE}/aws4_request`;
+        const query = {
+          "X-Amz-Algorithm": ALGORITHM,
+          "X-Amz-Credential": `${this.accessKey}/${scope}`,
+          "X-Amz-Date": amzDate,
+          "X-Amz-Expires": String(expires),
+          "X-Amz-SignedHeaders": "host"
+        };
+        const canonicalQs = this.canonicalQuery(query);
+        const canonicalRequest = ["GET", uri, canonicalQs, `host:${this.host}
+`, "host", "UNSIGNED-PAYLOAD"].join("\n");
+        const signature = this.sign(canonicalRequest, amzDate, dateStamp, scope);
+        return `${this.scheme}://${this.host}${uri}?${canonicalQs}&X-Amz-Signature=${signature}`;
+      }
+      // -- signing + transport ----------------------------------------------------
+      requireCredentials() {
+        if (!this.accessKey || !this.secretKey) {
+          throw new S3ConfigError(
+            "S3 credentials are not set: set TINA4_STORAGE_KEY and TINA4_STORAGE_SECRET"
+          );
+        }
+      }
+      now() {
+        const iso2 = (/* @__PURE__ */ new Date()).toISOString().replace(/[:-]|\.\d{3}/g, "");
+        return { amzDate: iso2, dateStamp: iso2.slice(0, 8) };
+      }
+      canonicalUri(bucket, key) {
+        return `${this.prefix}/${uriEncode(bucket, true)}/${uriEncode(key, true)}`;
+      }
+      canonicalQuery(query) {
+        return Object.keys(query).sort().map((k) => `${uriEncode(k, false)}=${uriEncode(query[k], false)}`).join("&");
+      }
+      signingKey(dateStamp) {
+        const kDate = hmac(`AWS4${this.secretKey}`, dateStamp);
+        const kRegion = hmac(kDate, this.region);
+        const kService = hmac(kRegion, SERVICE);
+        return hmac(kService, "aws4_request");
+      }
+      sign(canonicalRequest, amzDate, dateStamp, scope) {
+        const stringToSign = [ALGORITHM, amzDate, scope, sha256Hex2(canonicalRequest)].join("\n");
+        return createHmac3("sha256", this.signingKey(dateStamp)).update(stringToSign, "utf8").digest("hex");
+      }
+      async request(method, uri, body, extraHeaders = {}) {
+        this.requireCredentials();
+        for (let attempt = 0; ; attempt++) {
+          const last = attempt === MAX_RETRIES;
+          let delay2 = null;
+          try {
+            return await this.send(method, uri, body, extraHeaders);
+          } catch (e) {
+            if (e instanceof S3Error) {
+              if (last || !(e.status === 429 || e.status >= 500)) throw e;
+              delay2 = e.retryAfter;
+            } else {
+              if (last) throw e;
+              delay2 = null;
+            }
+          }
+          if (delay2 == null) delay2 = Math.random() * (BACKOFF_BASE * 2 ** attempt);
+          await sleep(Math.min(delay2, BACKOFF_CAP) * 1e3);
+        }
+      }
+      async send(method, uri, body, extraHeaders = {}) {
+        const { amzDate, dateStamp } = this.now();
+        const payloadHash = sha256Hex2(body);
+        const signed = {
+          host: this.host,
+          "x-amz-content-sha256": payloadHash,
+          "x-amz-date": amzDate
+        };
+        const signedKeys = Object.keys(signed).sort();
+        const canonicalHeaders = signedKeys.map((k) => `${k}:${signed[k]}
+`).join("");
+        const signedHeaders = signedKeys.join(";");
+        const canonicalRequest = [method, uri, "", canonicalHeaders, signedHeaders, payloadHash].join("\n");
+        const scope = `${dateStamp}/${this.region}/${SERVICE}/aws4_request`;
+        const signature = this.sign(canonicalRequest, amzDate, dateStamp, scope);
+        const authorization = `${ALGORITHM} Credential=${this.accessKey}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`;
+        const headers = {
+          Authorization: authorization,
+          "x-amz-content-sha256": payloadHash,
+          "x-amz-date": amzDate,
+          ...extraHeaders
+        };
+        const url = `${this.scheme}://${this.host}${uri}`;
+        const init = { method, headers, redirect: "manual" };
+        if (method === "PUT" || method === "POST") init.body = body;
+        if (AbortSignal.timeout) init.signal = AbortSignal.timeout(this.timeout);
+        const response = await fetch(url, init);
+        if (response.status < 200 || response.status >= 300) {
+          const err = new S3Error(response.status, `${method} ${uri}: HTTP ${response.status}`);
+          err.retryAfter = retryAfterSeconds(response.headers.get("retry-after"));
+          throw err;
+        }
+        return { status: response.status, body: Buffer.from(await response.arrayBuffer()) };
+      }
+    };
+  }
+});
+
 // ../orm/src/realtime/storage.ts
 import { randomBytes as randomBytes5 } from "node:crypto";
 import { mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2, statSync as statSync5 } from "node:fs";
 import { resolve as resolve6, sep as sep3 } from "node:path";
-import { createRequire as createRequire6 } from "node:module";
-function loadAwsSdk(packageName) {
-  try {
-    return require2(packageName);
-  } catch (error2) {
-    const missing = error2?.code === "MODULE_NOT_FOUND" && String(error2?.message ?? "").includes(`'${packageName}'`);
-    if (!missing) throw error2;
-    throw optionalPackageMissing("S3Storage", S3_PACKAGES);
-  }
-}
 function storageKey(filename = "") {
   let ext = "";
   if (filename && filename.includes(".")) {
@@ -18176,14 +18543,12 @@ function selectStorage(storage) {
   }
   return new LocalStorage();
 }
-var require2, S3_PACKAGES, UNSAFE, LocalStorage, S3Storage;
+var UNSAFE, LocalStorage, S3Storage;
 var init_storage = __esm({
   "../orm/src/realtime/storage.ts"() {
     "use strict";
     init_index();
-    init_optionalPackage();
-    require2 = createRequire6(import.meta.url);
-    S3_PACKAGES = ["@aws-sdk/client-s3", "@aws-sdk/s3-request-presigner"];
+    init_s3Client();
     UNSAFE = /[^A-Za-z0-9]/g;
     LocalStorage = class {
       directory;
@@ -18233,51 +18598,36 @@ var init_storage = __esm({
       constructor(opts = {}) {
         this.bucket = opts.bucket || process.env.TINA4_STORAGE_BUCKET || "";
         if (!this.bucket) throw new Error("S3Storage requires TINA4_STORAGE_BUCKET");
-        const { S3Client } = loadAwsSdk("@aws-sdk/client-s3");
-        loadAwsSdk("@aws-sdk/s3-request-presigner");
-        const endpoint = opts.endpoint || process.env.TINA4_STORAGE_URL;
         this.client = new S3Client({
-          endpoint: endpoint || void 0,
-          forcePathStyle: true,
+          endpoint: opts.endpoint || process.env.TINA4_STORAGE_URL || void 0,
           region: opts.region || process.env.TINA4_STORAGE_REGION || "us-east-1",
-          credentials: {
-            accessKeyId: opts.key || process.env.TINA4_STORAGE_KEY || "",
-            secretAccessKey: opts.secret || process.env.TINA4_STORAGE_SECRET || ""
-          }
+          accessKey: opts.key || process.env.TINA4_STORAGE_KEY || "",
+          secretKey: opts.secret || process.env.TINA4_STORAGE_SECRET || ""
         });
       }
       async put(key, data, mime = "application/octet-stream") {
-        const { PutObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-        await this.client.send(new PutObjectCommand({ Bucket: this.bucket, Key: key, Body: data, ContentType: mime }));
+        await this.client.putObject(this.bucket, key, data, mime);
       }
       async get(key) {
         try {
-          const { GetObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-          const res = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
-          const chunks = [];
-          for await (const chunk of res.Body) chunks.push(Buffer.from(chunk));
-          return Buffer.concat(chunks);
+          return await this.client.getObject(this.bucket, key);
         } catch {
           return null;
         }
       }
       async url(key, ttl = 3600) {
-        const { GetObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-        const { getSignedUrl } = loadAwsSdk("@aws-sdk/s3-request-presigner");
-        return getSignedUrl(this.client, new GetObjectCommand({ Bucket: this.bucket, Key: key }), { expiresIn: ttl });
+        return this.client.presignedGetUrl(this.bucket, key, ttl);
       }
       async delete(key) {
         try {
-          const { DeleteObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-          await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: key }));
+          await this.client.deleteObject(this.bucket, key);
         } catch (e) {
           Log.error(`S3Storage delete failed for ${key}: ${e.message}`);
         }
       }
       async exists(key) {
         try {
-          const { HeadObjectCommand } = loadAwsSdk("@aws-sdk/client-s3");
-          await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
+          await this.client.headObject(this.bucket, key);
           return true;
         } catch {
           return false;
@@ -18288,7 +18638,7 @@ var init_storage = __esm({
 });
 
 // ../orm/src/realtime/realtime.ts
-import { createHmac as createHmac3 } from "node:crypto";
+import { createHmac as createHmac4 } from "node:crypto";
 function iceServers() {
   const stun = process.env.TINA4_RTC_STUN_URLS || DEFAULT_STUN;
   const servers = [{ urls: splitUrls(stun) }];
@@ -18297,14 +18647,14 @@ function iceServers() {
   if (turnUrl && secret) {
     const ttl = parseInt(process.env.TINA4_RTC_TURN_TTL || "3600", 10);
     const username = String(Math.floor(Date.now() / 1e3) + ttl);
-    const credential = createHmac3("sha1", secret).update(username).digest("base64");
+    const credential = createHmac4("sha1", secret).update(username).digest("base64");
     servers.push({ urls: splitUrls(turnUrl), username, credential });
   }
   return servers;
 }
 async function realtime(options = {}) {
   const features = options.features ?? ["calls"];
-  const raw = (options.prefix ?? "").replace(/^\/+|\/+$/g, "");
+  const raw = trimSlashes(options.prefix ?? "");
   const p = raw ? `/${raw}` : "";
   _authorize = options.authorize;
   if (features.includes("chat") || features.includes("files")) {
@@ -18576,6 +18926,7 @@ var DEFAULT_STUN, _authorize;
 var init_realtime = __esm({
   "../orm/src/realtime/realtime.ts"() {
     "use strict";
+    init_slashTrim();
     init_index();
     init_workspace();
     init_channel();
@@ -18593,6 +18944,7 @@ var init_realtime2 = __esm({
     "use strict";
     init_realtime();
     init_storage();
+    init_s3Client();
     init_workspace();
     init_channel();
     init_channelMember();
@@ -18958,6 +19310,7 @@ function mayStore(req2, vary, cacheControl, setCookie) {
   if (requestHeader(req2, "authorization") !== void 0) return sharedCacheAllowed(cacheControl);
   if (requestHeader(req2, "cookie") !== void 0) return sharedCacheAllowed(cacheControl);
   if (hasSetCookie(setCookie)) return sharedCacheAllowed(cacheControl);
+  if (req2.session?.isFresh && !req2.session.isFresh()) return sharedCacheAllowed(cacheControl);
   return true;
 }
 function varyMatches(entry, req2) {
@@ -20310,7 +20663,7 @@ function coerceParam(raw, type2) {
 }
 function joinGroupPath(prefix, path10) {
   const full = `${prefix}/${path10.replace(/^\/+/, "")}`;
-  const trimmed = `/${full.replace(/^\/+|\/+$/g, "")}`;
+  const trimmed = `/${trimSlashes(full)}`;
   return trimmed.replace(/\/+/g, "/");
 }
 async function resolveStringMiddleware(spec) {
@@ -20375,6 +20728,7 @@ var WsRouteRef, RouteRef, Router, RouteGroup, TINA4_DEFAULT_ROUTER, globalRouter
 var init_router = __esm({
   "src/router.ts"() {
     "use strict";
+    init_slashTrim();
     init_dotenv();
     init_middleware();
     WsRouteRef = class {
@@ -20584,7 +20938,7 @@ var init_router = __esm({
           const direct = this.matchRoute(routes, path10);
           if (direct) return direct;
           if (isTrailingSlashRedirectEnabled() && path10.length > 1 && path10.endsWith("/")) {
-            const stripped = path10.replace(/\/+$/, "");
+            const stripped = rtrimSlashes(path10);
             if (stripped.length > 0) {
               const retry = this.matchRoute(routes, stripped);
               if (retry) return retry;
@@ -22260,7 +22614,8 @@ var init_middleware = __esm({
           "Content-Security-Policy": resolveCspHeader(currentCspNonce()),
           "Referrer-Policy": process.env.TINA4_REFERRER_POLICY ?? "strict-origin-when-cross-origin",
           "X-XSS-Protection": "0",
-          "Permissions-Policy": process.env.TINA4_PERMISSIONS_POLICY ?? "camera=(), microphone=(), geolocation=()"
+          "Permissions-Policy": process.env.TINA4_PERMISSIONS_POLICY ?? "camera=(), microphone=(), geolocation=()",
+          "Cross-Origin-Opener-Policy": process.env.TINA4_COOP ?? "same-origin-allow-popups"
         };
       }
       static beforeSecurity(req2, res) {
@@ -22277,7 +22632,7 @@ var init_middleware = __esm({
         if (process.env.TINA4_CSP === void 0) {
           _SecurityHeadersMiddleware.warnCspDefaultOnce();
         }
-        for (const name of ["Content-Security-Policy", "Referrer-Policy", "X-XSS-Protection", "Permissions-Policy"]) {
+        for (const name of ["Content-Security-Policy", "Referrer-Policy", "X-XSS-Protection", "Permissions-Policy", "Cross-Origin-Opener-Policy"]) {
           res.header(name, canonical[name]);
         }
         return [req2, res];
@@ -22361,7 +22716,7 @@ var init_middleware = __esm({
 });
 
 // src/request.ts
-import { mkdirSync as mkdirSync7, realpathSync as realpathSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { closeSync as closeSync3, constants as constants2, fstatSync as fstatSync2, ftruncateSync, lstatSync, mkdirSync as mkdirSync7, openSync as openSync3, realpathSync as realpathSync2, unlinkSync as unlinkSync4, writeFileSync as writeFileSync4 } from "node:fs";
 import { dirname as dirname6, join as join11 } from "node:path";
 function makeCaseInsensitiveHeaders(raw) {
   return new Proxy(raw, {
@@ -22397,7 +22752,8 @@ function createRequest(req2) {
   try {
     const url = new URL(req2.url ?? "/", `${proto}://${host}`);
     for (const [key, value] of url.searchParams) {
-      query[key] = value;
+      if (isUnsafeFieldName(key)) continue;
+      Reflect.set(query, key, value);
     }
     path10 = url.pathname;
     queryString = url.search.replace(/^\?/, "");
@@ -22409,7 +22765,8 @@ function createRequest(req2) {
     queryString = questionIdx >= 0 ? rawTarget.slice(questionIdx + 1) : "";
     try {
       for (const [key, value] of new URLSearchParams(queryString)) {
-        query[key] = value;
+        if (isUnsafeFieldName(key)) continue;
+        Reflect.set(query, key, value);
       }
     } catch {
     }
@@ -22428,7 +22785,8 @@ function createRequest(req2) {
   if (cookieHeader) {
     for (const pair of cookieHeader.split(";")) {
       const [k, ...v] = pair.trim().split("=");
-      if (k) cookies[k.trim()] = v.join("=").trim();
+      const name = k ? k.trim() : "";
+      if (name && !isUnsafeFieldName(name)) Reflect.set(cookies, name, v.join("=").trim());
     }
   }
   w.cookies = cookies;
@@ -22519,13 +22877,7 @@ async function parseBody(req2) {
       req2.body = str;
     }
   } else if (contentType.includes("application/x-www-form-urlencoded")) {
-    const str = raw.toString("utf-8");
-    const params = new URLSearchParams(str);
-    const obj = {};
-    for (const [key, value] of params) {
-      obj[key] = value;
-    }
-    req2.body = obj;
+    req2.body = nestFormFields([...new URLSearchParams(raw.toString("utf-8"))]);
   } else {
     req2.body = raw.toString("utf-8");
   }
@@ -22535,7 +22887,7 @@ function extractBoundary(contentType) {
   return match ? match[1] ?? match[2] : null;
 }
 function parseMultipart(body, boundary) {
-  const fields = {};
+  const pairs = [];
   const files = {};
   const delimiter2 = Buffer.from(`--${boundary}`);
   const closeDelimiter = Buffer.from(`--${boundary}--`);
@@ -22543,7 +22895,7 @@ function parseMultipart(body, boundary) {
   const doubleCrlf = Buffer.from("\r\n\r\n");
   let offset = 0;
   const firstIdx = bufferIndexOf(body, delimiter2, offset);
-  if (firstIdx === -1) return { fields, files };
+  if (firstIdx === -1) return { fields: {}, files };
   offset = firstIdx + delimiter2.length;
   if (body[offset] === 13 && body[offset + 1] === 10) {
     offset += 2;
@@ -22567,14 +22919,15 @@ function parseMultipart(body, boundary) {
         content: Buffer.from(content),
         size: content.length
       };
-      if (files[disposition.name]) {
+      if (isUnsafeFieldName(disposition.name)) {
+      } else if (files[disposition.name]) {
         const existing = files[disposition.name];
-        files[disposition.name] = Array.isArray(existing) ? [...existing, file] : [existing, file];
+        Reflect.set(files, disposition.name, Array.isArray(existing) ? [...existing, file] : [existing, file]);
       } else {
-        files[disposition.name] = file;
+        Reflect.set(files, disposition.name, file);
       }
     } else if (disposition.name) {
-      fields[disposition.name] = content.toString("utf-8");
+      pairs.push([disposition.name, content.toString("utf-8")]);
     }
     offset = nextDelimIdx + delimiter2.length;
     if (body[offset] === 45 && body[offset + 1] === 45) {
@@ -22584,7 +22937,7 @@ function parseMultipart(body, boundary) {
       offset += 2;
     }
   }
-  return { fields, files };
+  return { fields: nestFormFields(pairs), files };
 }
 function saveUpload(file, targetDir, filename) {
   const raw = String(filename ?? file.filename ?? "");
@@ -22600,7 +22953,21 @@ function saveUpload(file, targetDir, filename) {
   if (realParent !== realDir) {
     throw new Error(`refusing to write outside ${targetDir}: ${JSON.stringify(raw)}`);
   }
-  writeFileSync4(dest, file.content);
+  if (lstatSync(dest, { throwIfNoEntry: false })?.isSymbolicLink()) unlinkSync4(dest);
+  const flags = constants2.O_WRONLY | constants2.O_CREAT | (constants2.O_NOFOLLOW ?? 0);
+  let fd = openSync3(dest, flags, 384);
+  try {
+    if (fstatSync2(fd).nlink > 1) {
+      closeSync3(fd);
+      fd = -1;
+      unlinkSync4(dest);
+      fd = openSync3(dest, flags | constants2.O_EXCL, 384);
+    }
+    ftruncateSync(fd, 0);
+    writeFileSync4(fd, file.content);
+  } finally {
+    if (fd >= 0) closeSync3(fd);
+  }
   return dest;
 }
 function bufferIndexOf(haystack, needle, offset) {
@@ -22625,10 +22992,98 @@ function parseDisposition(headers) {
   };
 }
 function parsePartContentType(headers) {
-  const match = headers.match(/Content-Type:\s*(.+?)(?:\r?\n|$)/i);
-  return match?.[1]?.trim() ?? null;
+  const match = headers.match(/Content-Type:([^\r\n]*)/i);
+  const value = match?.[1]?.trim();
+  return value ? value : null;
+}
+function nestFormFields(pairs) {
+  const kept = pairs.filter(([name]) => !/(^|[[\]])__proto__([[\]]|$)/.test(name));
+  if (kept.length > FORM_FIELD_LIMIT) return Object.fromEntries(kept);
+  const nested = /* @__PURE__ */ new WeakSet();
+  const node = () => {
+    const created = /* @__PURE__ */ Object.create(null);
+    nested.add(created);
+    return created;
+  };
+  const isNode = (value) => typeof value === "object" && value !== null && nested.has(value);
+  const own = (params, key) => Object.prototype.hasOwnProperty.call(params, key) ? params[key] : void 0;
+  const list = (params, key) => {
+    let current = own(params, key);
+    if (current === void 0) {
+      current = [];
+      Reflect.set(params, key, current);
+    }
+    if (!Array.isArray(current)) throw new RangeError(`expected an array for '${key}'`);
+    return current;
+  };
+  const object = (params, key) => {
+    let current = own(params, key);
+    if (current === void 0) {
+      current = node();
+      Reflect.set(params, key, current);
+    }
+    if (!isNode(current)) throw new RangeError(`expected an object for '${key}'`);
+    return current;
+  };
+  const hasKey = (params, key) => {
+    if (key.includes("[]")) return false;
+    let level = params;
+    for (const part of key.split(/[[\]]+/).filter(Boolean)) {
+      if (!isNode(level) || own(level, part) === void 0) return false;
+      level = level[part];
+    }
+    return true;
+  };
+  const splitName = (name, depth) => {
+    if (depth === 0) {
+      const start2 = name.indexOf("[", 1);
+      return start2 === -1 ? [name, ""] : [name.slice(0, start2), name.slice(start2)];
+    }
+    if (name.startsWith("[]")) return ["[]", name.slice(2)];
+    const close = name.indexOf("]", 1);
+    return name.startsWith("[") && close !== -1 ? [name.slice(1, close), name.slice(close + 1)] : [name, ""];
+  };
+  const putListItem = (items, after, value, depth) => {
+    let childKey = after[2] === "[" && after.endsWith("]") ? after.slice(3, -1) : "";
+    if (childKey === "" || childKey.includes("[") || childKey.includes("]")) childKey = after.slice(2);
+    const last = items[items.length - 1];
+    if (isNode(last) && !hasKey(last, childKey)) put2(last, childKey, value, depth + 1);
+    else items.push(put2(node(), childKey, value, depth + 1));
+  };
+  const put2 = (params, name, value, depth) => {
+    const [key, after] = splitName(name, depth);
+    if (key === "") return void 0;
+    if (after === "" && key === "[]" && depth !== 0) return [value];
+    if (after === "") Reflect.set(params, key, value);
+    else if (after === "[") Reflect.set(params, name, value);
+    else if (after === "[]") list(params, key).push(value);
+    else if (after.startsWith("[]")) putListItem(list(params, key), after, value, depth);
+    else put2(object(params, key), after, value, depth + 1);
+    return params;
+  };
+  const tooDeep = (name) => {
+    let count = 0;
+    for (let at = name.indexOf("["); at !== -1; at = name.indexOf("[", at + 1)) {
+      if (++count >= FORM_DEPTH_LIMIT) return true;
+    }
+    return false;
+  };
+  const fields = node();
+  for (const [name, value] of kept) {
+    if (name.length > FORM_NAME_LIMIT || tooDeep(name)) {
+      Reflect.set(fields, name, value);
+      continue;
+    }
+    try {
+      put2(fields, name, value, 0);
+    } catch (error2) {
+      if (!(error2 instanceof RangeError)) throw error2;
+      Reflect.set(fields, name, value);
+    }
+  }
+  return fields;
 }
-var DEFAULT_MAX_UPLOAD_SIZE, warnedLimits, PayloadTooLargeError;
+var DEFAULT_MAX_UPLOAD_SIZE, warnedLimits, PayloadTooLargeError, FORM_DEPTH_LIMIT, FORM_FIELD_LIMIT, FORM_NAME_LIMIT, isUnsafeFieldName;
 var init_request = __esm({
   "src/request.ts"() {
     "use strict";
@@ -22643,6 +23098,10 @@ var init_request = __esm({
         this.name = "PayloadTooLargeError";
       }
     };
+    FORM_DEPTH_LIMIT = 32;
+    FORM_FIELD_LIMIT = 4096;
+    FORM_NAME_LIMIT = 1024;
+    isUnsafeFieldName = (key) => key === "__proto__" || key === "constructor" || key === "prototype";
   }
 });
 
@@ -23149,7 +23608,7 @@ var init_routeDiscovery = __esm({
 
 // src/portTakeover.ts
 import { execFileSync } from "node:child_process";
-import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync9, unlinkSync as unlinkSync4 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync9, unlinkSync as unlinkSync5 } from "node:fs";
 import { join as join13 } from "node:path";
 function isTruthy3(value) {
   return ["true", "1", "yes", "on"].includes(String(value ?? "").trim().toLowerCase());
@@ -23203,7 +23662,7 @@ function readPidfile(port, baseDir) {
 }
 function removePidfile(port, baseDir) {
   try {
-    unlinkSync4(pidfilePath(port, baseDir));
+    unlinkSync5(pidfilePath(port, baseDir));
   } catch {
   }
 }
@@ -23304,21 +23763,6 @@ var init_portTakeover = __esm({
   }
 });
 
-// src/etag.ts
-function etagMatches(ifNoneMatch, etag) {
-  const strip = (tag) => tag.trim().replace(/^W\//, "");
-  const target = strip(etag);
-  return ifNoneMatch.split(",").some((candidate) => {
-    const trimmed = candidate.trim();
-    return trimmed === "*" || strip(trimmed) === target;
-  });
-}
-var init_etag = __esm({
-  "src/etag.ts"() {
-    "use strict";
-  }
-});
-
 // src/sessionHandlers/syncBridge.ts
 import { Worker } from "node:worker_threads";
 function getBridge(key, workerSource, workerData) {
@@ -23678,7 +24122,7 @@ var init_valkeyHandler = __esm({
 });
 
 // src/sessionHandlers/memcachedHandler.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 var MAX_KEY_BYTES, MAX_RELATIVE_EXPTIME, MemcachedSessionHandler;
 var init_memcachedHandler = __esm({
   "src/sessionHandlers/memcachedHandler.ts"() {
@@ -23700,7 +24144,7 @@ var init_memcachedHandler = __esm({
       key(sessionId) {
         const candidate = `${this.prefix}${sessionId}`;
         if (Buffer.byteLength(candidate) > MAX_KEY_BYTES || /[\x00-\x20\x7f]/.test(candidate)) {
-          return `${this.prefix}${createHash5("sha256").update(sessionId).digest("hex")}`;
+          return `${this.prefix}${createHash6("sha256").update(sessionId).digest("hex")}`;
         }
         return candidate;
       }
@@ -24166,7 +24610,7 @@ var init_mongoHandler = __esm({
 });
 
 // src/sessionHandlers/sqlClient.ts
-import { createRequire as createRequire7 } from "node:module";
+import { createRequire as createRequire6 } from "node:module";
 function driverPath(engine) {
   const packageName = DRIVER_PACKAGE4[engine];
   try {
@@ -24205,7 +24649,7 @@ var init_sqlClient = __esm({
       mssql: "tedious",
       firebird: "node-firebird"
     };
-    requireFromHere = createRequire7(import.meta.url);
+    requireFromHere = createRequire6(import.meta.url);
     SQL_WORKER = `
 const target = workerData.target;
 const engine = target.engine;
@@ -24687,14 +25131,18 @@ __export(session_exports, {
   Session: () => Session,
   VALID_SESSION_BACKENDS: () => VALID_SESSION_BACKENDS,
   buildSessionCookie: () => buildSessionCookie,
+  currentFormTokenSessionId: () => currentFormTokenSessionId,
   isSecureScheme: () => isSecureScheme,
   isValidSessionId: () => isValidSessionId,
+  runWithFormTokenSession: () => runWithFormTokenSession,
   sessionCookieName: () => sessionCookieName,
   sessionCookieToSend: () => sessionCookieToSend,
-  sessionStrictMode: () => sessionStrictMode
+  sessionStrictMode: () => sessionStrictMode,
+  setFormTokenSession: () => setFormTokenSession
 });
-import { createHash as createHash6, randomBytes as randomBytes6 } from "node:crypto";
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync7, unlinkSync as unlinkSync5, readdirSync as readdirSync6 } from "node:fs";
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "node:async_hooks";
+import { createHash as createHash7, randomBytes as randomBytes6 } from "node:crypto";
+import { existsSync as existsSync11, mkdirSync as mkdirSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync7, unlinkSync as unlinkSync6, readdirSync as readdirSync6 } from "node:fs";
 import { join as join14 } from "node:path";
 function isValidSessionId(sessionId) {
   return typeof sessionId === "string" && SESSION_ID_PATTERN.test(sessionId);
@@ -24760,7 +25208,21 @@ function sessionCookieToSend(sess, existingSid, rawReq, rawRes) {
   const socketEncrypted = rawReq.socket?.encrypted === true;
   return buildSessionCookie(newSid, ttl, void 0, forwardedProto, socketEncrypted);
 }
-var SESSION_ID_PATTERN, VALID_SESSION_BACKENDS, CANONICAL_SESSION_BACKENDS, RETIRED_SESSION_BACKENDS, FileSessionHandler, RedisSessionHandler, FLASH_PREFIX, Session;
+function runWithFormTokenSession(fn) {
+  return sessionStore.run({ session: null }, fn);
+}
+function setFormTokenSession(session) {
+  const store = sessionStore.getStore();
+  if (store) store.session = session;
+}
+function currentFormTokenSessionId() {
+  const session = sessionStore.getStore()?.session;
+  const sid = session?.getSessionId();
+  if (!session || !sid) return "";
+  if (session.isFresh()) session.set("_tina4_csrf", true);
+  return sid;
+}
+var SESSION_ID_PATTERN, VALID_SESSION_BACKENDS, CANONICAL_SESSION_BACKENDS, RETIRED_SESSION_BACKENDS, FileSessionHandler, RedisSessionHandler, FLASH_PREFIX, Session, sessionStore;
 var init_session = __esm({
   "src/session.ts"() {
     "use strict";
@@ -24834,7 +25296,7 @@ var init_session = __esm({
             `Invalid session id ${JSON.stringify(id)} \u2014 a session id is opaque and must match ${SESSION_ID_PATTERN.source}. It is never a path, so it is refused rather than resolved to a file.`
           );
         }
-        return join14(this.storagePath, `${createHash6("sha256").update(id).digest("hex")}.json`);
+        return join14(this.storagePath, `${createHash7("sha256").update(id).digest("hex")}.json`);
       }
       read(sessionId) {
         const filePath = this.filePath(sessionId);
@@ -24844,7 +25306,7 @@ var init_session = __esm({
           const wrapper = JSON.parse(raw);
           if (wrapper._expires && wrapper._expires > 0 && Date.now() / 1e3 > wrapper._expires) {
             try {
-              unlinkSync5(filePath);
+              unlinkSync6(filePath);
             } catch {
             }
             return null;
@@ -24863,7 +25325,7 @@ var init_session = __esm({
       destroy(sessionId) {
         const filePath = this.filePath(sessionId);
         try {
-          if (existsSync11(filePath)) unlinkSync5(filePath);
+          if (existsSync11(filePath)) unlinkSync6(filePath);
         } catch {
         }
       }
@@ -24879,11 +25341,11 @@ var init_session = __esm({
               const raw = readFileSync8(fullPath, "utf-8");
               const wrapper = JSON.parse(raw);
               if (wrapper._expires && wrapper._expires > 0 && now > wrapper._expires) {
-                unlinkSync5(fullPath);
+                unlinkSync6(fullPath);
               }
             } catch {
               try {
-                unlinkSync5(fullPath);
+                unlinkSync6(fullPath);
               } catch {
               }
             }
@@ -25403,12 +25865,28 @@ var init_session = __esm({
         this.loaded = /* @__PURE__ */ new Map();
       }
     };
+    sessionStore = new AsyncLocalStorage4();
+  }
+});
+
+// src/etag.ts
+function etagMatches(ifNoneMatch, etag) {
+  const strip = (tag) => tag.trim().replace(/^W\//, "");
+  const target = strip(etag);
+  return ifNoneMatch.split(",").some((candidate) => {
+    const trimmed = candidate.trim();
+    return trimmed === "*" || strip(trimmed) === target;
+  });
+}
+var init_etag = __esm({
+  "src/etag.ts"() {
+    "use strict";
   }
 });
 
 // src/dispatchPipeline.ts
 import { gzipSync } from "node:zlib";
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 async function resetRequestCaches2() {
   if (_resetRequestCaches === void 0) {
     _resetRequestCaches = Promise.resolve().then(() => (init_src(), src_exports)).then((orm) => orm.resetRequestCaches).catch(() => null);
@@ -25481,7 +25959,7 @@ function applyResponseValidator(rawReq, rawRes, body) {
   if ((rawRes.statusCode || 200) !== 200 || body.length === 0) return false;
   let etag = rawRes.getHeader("etag");
   if (!etag) {
-    etag = `"${createHash7("md5").update(body).digest("hex").slice(0, 16)}"`;
+    etag = `"${createHash8("md5").update(body).digest("hex").slice(0, 16)}"`;
     rawRes.setHeader("ETag", etag);
   }
   if (!responseIsNotModified(rawReq, rawRes, String(etag))) return false;
@@ -25556,6 +26034,7 @@ async function sessionAutoStart(rawReq, rawRes, req2) {
     return;
   }
   req2.session = sess;
+  setFormTokenSession(sess);
   const origEnd = rawRes.end.bind(rawRes);
   let finalised = false;
   rawRes.end = function(...args) {
@@ -25584,6 +26063,7 @@ var _resetRequestCaches, COMPRESSIBLE_PREFIXES;
 var init_dispatchPipeline = __esm({
   "src/dispatchPipeline.ts"() {
     "use strict";
+    init_session();
     init_logger();
     init_etag();
     COMPRESSIBLE_PREFIXES = [
@@ -25733,14 +26213,21 @@ function parseStack(stack) {
   const frames = [];
   const lines = stack.split("\n");
   for (const line of lines) {
-    let match = line.match(/^\s*at\s+(.+?)\s+\((.+?):(\d+):(\d+)\)/);
-    if (match) {
-      frames.push({ func: match[1], file: match[2], line: parseInt(match[3], 10), column: parseInt(match[4], 10) });
-      continue;
+    const t = line.trim();
+    if (!t.startsWith("at ")) continue;
+    const rest = t.slice(3);
+    let func = "{anonymous}";
+    let loc = rest;
+    if (rest.endsWith(")")) {
+      const open = rest.lastIndexOf(" (");
+      if (open >= 0) {
+        func = rest.slice(0, open);
+        loc = rest.slice(open + 2, -1);
+      }
     }
-    match = line.match(/^\s*at\s+(.+?):(\d+):(\d+)/);
-    if (match) {
-      frames.push({ func: "{anonymous}", file: match[1], line: parseInt(match[2], 10), column: parseInt(match[3], 10) });
+    const lc = loc.match(/:(\d+):(\d+)$/);
+    if (lc && lc.index !== void 0) {
+      frames.push({ func, file: loc.slice(0, lc.index), line: parseInt(lc[1], 10), column: parseInt(lc[2], 10) });
     }
   }
   return frames;
@@ -26065,7 +26552,7 @@ var init_rateLimiter = __esm({
 });
 
 // src/devMailbox.ts
-import { mkdirSync as mkdirSync11, readdirSync as readdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync8, unlinkSync as unlinkSync6, existsSync as existsSync12 } from "node:fs";
+import { mkdirSync as mkdirSync11, readdirSync as readdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync8, unlinkSync as unlinkSync7, existsSync as existsSync12 } from "node:fs";
 import { join as join16 } from "node:path";
 import { randomUUID as randomUUID2 } from "node:crypto";
 var DevMailbox;
@@ -26197,7 +26684,7 @@ var init_devMailbox = __esm({
           const filePath = join16(this.mailboxDir, folder, `${msgId}.json`);
           if (existsSync12(filePath)) {
             try {
-              unlinkSync6(filePath);
+              unlinkSync7(filePath);
               deleted = true;
             } catch {
             }
@@ -26216,7 +26703,7 @@ var init_devMailbox = __esm({
             if (existsSync12(dir)) {
               const files = readdirSync7(dir).filter((file) => file.endsWith(".json"));
               for (const file of files) {
-                unlinkSync6(join16(dir, file));
+                unlinkSync7(join16(dir, file));
               }
             }
           } catch {
@@ -26360,7 +26847,7 @@ function enginePath() {
 function runEngine(target) {
   const binary = enginePath();
   if (!binary) throw new MetricsEngineError(`tina4 not found on PATH - ${INSTALL_HINT}`);
-  const processResult = spawnSync(binary, ["metrics", "--path", target, "--json"], {
+  const processResult = spawnSync(binary, ["metrics", "--path", target, "--json", "--no-history"], {
     encoding: "utf8",
     timeout: 6e4,
     maxBuffer: 64 * 1024 * 1024
@@ -28862,7 +29349,7 @@ import * as fs4 from "node:fs";
 import * as path3 from "node:path";
 import * as os from "node:os";
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { createRequire as createRequire8 } from "node:module";
+import { createRequire as createRequire7 } from "node:module";
 import { randomBytes as randomBytes7 } from "node:crypto";
 function reqSibling(pkg) {
   return req(`../../${pkg}/src/index.ts`);
@@ -29021,21 +29508,45 @@ function safePath(projectRoot3, relPath) {
   if (resolved !== projectRoot3 && !resolved.startsWith(rootPrefix)) {
     throw new Error(`Path escapes project directory: ${relPath}`);
   }
-  let real = null;
+  let realRoot;
   try {
-    real = fs4.realpathSync(resolved);
+    realRoot = fs4.realpathSync(projectRoot3);
   } catch {
-    real = null;
+    return resolved;
   }
-  if (real !== null) {
-    const realRoot = fs4.realpathSync(projectRoot3);
-    const realPrefix = realRoot.endsWith(path3.sep) ? realRoot : realRoot + path3.sep;
-    if (real !== realRoot && !real.startsWith(realPrefix)) {
-      throw new Error(`Path escapes project directory: ${relPath}`);
-    }
+  const real = realPathOf(resolved);
+  const realPrefix = realRoot.endsWith(path3.sep) ? realRoot : realRoot + path3.sep;
+  if (real === null || real !== realRoot && !real.startsWith(realPrefix)) {
+    throw new Error(`Path escapes project directory: ${relPath}`);
   }
   return resolved;
 }
+function realPathOf(p, hops = 0) {
+  let probe = p;
+  while (!fs4.existsSync(probe) && !isSymlink(probe) && path3.dirname(probe) !== probe) {
+    probe = path3.dirname(probe);
+  }
+  try {
+    return fs4.realpathSync.native(probe);
+  } catch {
+    if (hops >= 40) return null;
+    let target;
+    try {
+      target = fs4.readlinkSync(probe);
+    } catch {
+      return null;
+    }
+    const base = path3.isAbsolute(target) ? target : path3.dirname(probe) + path3.sep + target;
+    return realPathOf(base + p.slice(probe.length), hops + 1);
+  }
+}
+function isSymlink(p) {
+  try {
+    return fs4.lstatSync(p).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
 function redactEnv(key, value) {
   const sensitive = ["secret", "password", "token", "key", "credential", "api_key"];
   if (sensitive.some((s) => key.toLowerCase().includes(s))) {
@@ -29880,8 +30391,10 @@ function registerDevTools(server) {
           return { error: `Invalid path ${JSON.stringify(rel)}: ${proseErr}` };
         }
         rel = normalizeCoderPath(projectRoot4, rel);
-        const resolved = path3.resolve(projectRoot4, rel);
-        if (!resolved.startsWith(projectRoot4)) {
+        let resolved;
+        try {
+          resolved = safePath(projectRoot4, rel);
+        } catch {
           return { error: `Path escapes project directory: ${rel}` };
         }
         if (!fs4.existsSync(resolved) || !fs4.statSync(resolved).isFile()) {
@@ -30178,8 +30691,9 @@ var req, PARSE_ERROR, INVALID_REQUEST, METHOD_NOT_FOUND, INVALID_PARAMS, INTERNA
 var init_mcp = __esm({
   "src/mcp.ts"() {
     "use strict";
+    init_slashTrim();
     init_version();
-    req = createRequire8(import.meta.url);
+    req = createRequire7(import.meta.url);
     PARSE_ERROR = -32700;
     INVALID_REQUEST = -32600;
     METHOD_NOT_FOUND = -32601;
@@ -30204,7 +30718,7 @@ var init_mcp = __esm({
       // threaded, so this in-process map is the whole coordination mechanism.
       _sseChannels = /* @__PURE__ */ new Map();
       constructor(mcpPath, name = "Tina4 MCP", version = "1.0.0") {
-        this.path = mcpPath.replace(/\/+$/, "");
+        this.path = rtrimSlashes(mcpPath);
         this.name = name;
         this.version = version;
         _McpServer._instances.push(this);
@@ -32287,7 +32801,7 @@ __export(websocket_exports, {
   wsToken: () => wsToken
 });
 import { createServer as createServer2 } from "node:http";
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { randomUUID as randomUUID4 } from "node:crypto";
 function buildCloseFrame(code, reason = "") {
   const reasonBytes = Buffer.from(reason, "utf-8");
@@ -32297,7 +32811,7 @@ function buildCloseFrame(code, reason = "") {
   return buildFrame(OP_CLOSE, payload);
 }
 function computeAcceptKey(key) {
-  return createHash8("sha1").update(key + MAGIC_STRING).digest("base64");
+  return createHash9("sha1").update(key + MAGIC_STRING).digest("base64");
 }
 function originAllowed(headers) {
   const raw = (process.env.TINA4_WS_ALLOWED_ORIGINS ?? "").trim();
@@ -33988,7 +34502,7 @@ var init_job = __esm({
 });
 
 // src/queueBackends/liteBackend.ts
-import { mkdirSync as mkdirSync15, readdirSync as readdirSync12, readFileSync as readFileSync16, writeFileSync as writeFileSync11, unlinkSync as unlinkSync7, existsSync as existsSync19 } from "node:fs";
+import { mkdirSync as mkdirSync15, readdirSync as readdirSync12, readFileSync as readFileSync16, writeFileSync as writeFileSync11, unlinkSync as unlinkSync8, existsSync as existsSync19 } from "node:fs";
 import { join as join23 } from "node:path";
 import { randomUUID as randomUUID6 } from "node:crypto";
 var LiteBackend;
@@ -34158,7 +34672,7 @@ var init_liteBackend = __esm({
           }
           if (record.availableAt && record.availableAt > now) continue;
           try {
-            unlinkSync7(filePath);
+            unlinkSync8(filePath);
           } catch {
             continue;
           }
@@ -34192,10 +34706,10 @@ var init_liteBackend = __esm({
           job.priority = job.priority ?? 0;
           this.writeReserved(queue, job);
           try {
-            unlinkSync7(filePath);
+            unlinkSync8(filePath);
           } catch {
             try {
-              unlinkSync7(this.reservedPath(queue, job.id));
+              unlinkSync8(this.reservedPath(queue, job.id));
             } catch {
             }
             continue;
@@ -34217,10 +34731,10 @@ var init_liteBackend = __esm({
           job.priority = job.priority ?? 0;
           this.writeReserved(queue, job);
           try {
-            unlinkSync7(filePath);
+            unlinkSync8(filePath);
           } catch {
             try {
-              unlinkSync7(this.reservedPath(queue, job.id));
+              unlinkSync8(this.reservedPath(queue, job.id));
             } catch {
             }
             continue;
@@ -34235,7 +34749,7 @@ var init_liteBackend = __esm({
        */
       clearReservation(queue, jobId) {
         try {
-          unlinkSync7(this.reservedPath(queue, jobId));
+          unlinkSync8(this.reservedPath(queue, jobId));
         } catch {
         }
       }
@@ -34278,7 +34792,7 @@ var init_liteBackend = __esm({
         try {
           const files = readdirSync12(dir).filter((f) => f.endsWith(".queue-data"));
           for (const file of files) {
-            unlinkSync7(join23(dir, file));
+            unlinkSync8(join23(dir, file));
             count++;
           }
         } catch {
@@ -34288,7 +34802,7 @@ var init_liteBackend = __esm({
           if (existsSync19(failedDir)) {
             const files = readdirSync12(failedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
-              unlinkSync7(join23(failedDir, file));
+              unlinkSync8(join23(failedDir, file));
               count++;
             }
           }
@@ -34299,7 +34813,7 @@ var init_liteBackend = __esm({
           if (existsSync19(reservedDir)) {
             const files = readdirSync12(reservedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
-              unlinkSync7(join23(reservedDir, file));
+              unlinkSync8(join23(reservedDir, file));
               count++;
             }
           }
@@ -34357,7 +34871,7 @@ var init_liteBackend = __esm({
               const prefix = this.nextPrefix();
               const queueDir = join23(this.basePath, q);
               writeFileSync11(join23(queueDir, `${prefix}_${jobId}.queue-data`), JSON.stringify(job, null, 2));
-              unlinkSync7(filePath);
+              unlinkSync8(filePath);
               return true;
             }
           }
@@ -34393,7 +34907,7 @@ var init_liteBackend = __esm({
             const files = readdirSync12(failedDir).filter((f) => f.endsWith(".queue-data"));
             for (const file of files) {
               try {
-                unlinkSync7(join23(failedDir, file));
+                unlinkSync8(join23(failedDir, file));
                 count++;
               } catch {
               }
@@ -34408,7 +34922,7 @@ var init_liteBackend = __esm({
               try {
                 const job = JSON.parse(readFileSync16(join23(dir, file), "utf-8"));
                 if (job.status === status2) {
-                  unlinkSync7(join23(dir, file));
+                  unlinkSync8(join23(dir, file));
                   count++;
                 }
               } catch {
@@ -34443,7 +34957,7 @@ var init_liteBackend = __esm({
               job.delayUntil = null;
               const prefix = this.nextPrefix();
               writeFileSync11(join23(queueDir, `${prefix}_${job.id}.queue-data`), JSON.stringify(job, null, 2));
-              unlinkSync7(filePath);
+              unlinkSync8(filePath);
               count++;
             } catch {
             }
@@ -34475,10 +34989,10 @@ var init_liteBackend = __esm({
             job.priority = job.priority ?? 0;
             this.writeReserved(queue, job);
             try {
-              unlinkSync7(filePath);
+              unlinkSync8(filePath);
             } catch {
               try {
-                unlinkSync7(this.reservedPath(queue, job.id));
+                unlinkSync8(this.reservedPath(queue, job.id));
               } catch {
               }
               continue;
@@ -34580,7 +35094,7 @@ var init_liteBackend = __esm({
       retryJob(queue, job, delaySeconds) {
         this.clearReservation(queue, job.id);
         try {
-          unlinkSync7(join23(this.ensureFailedDir(queue), `${job.id}.queue-data`));
+          unlinkSync8(join23(this.ensureFailedDir(queue), `${job.id}.queue-data`));
         } catch {
         }
         job.attempts = (job.attempts || 0) + 1;
@@ -35130,7 +35644,8 @@ function archiveDir() {
   return p;
 }
 function slugify(title) {
-  const slug = (title || "").trim().toLowerCase().replace(/[^A-Za-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+  const dashed = (title || "").trim().toLowerCase().replace(/[^A-Za-z0-9_-]+/g, "-");
+  const slug = trimChar(dashed, 45);
   return slug.slice(0, 80) || `plan-${Math.floor(Date.now() / 1e3)}`;
 }
 function parse(text) {
@@ -35267,6 +35782,7 @@ var PLAN_DIR, CURRENT_FILE, ARCHIVE_SUBDIR, STEP_RE, Plan;
 var init_plan = __esm({
   "src/plan.ts"() {
     "use strict";
+    init_slashTrim();
     PLAN_DIR = "plan";
     CURRENT_FILE = ".current";
     ARCHIVE_SUBDIR = "done";
@@ -35538,7 +36054,7 @@ var init_plan = __esm({
         const existing = (currentPlan.steps || []).map((s) => s.text || "");
         const title = currentPlan.title || target;
         const goal = currentPlan.goal || "";
-        const aiUrl = process.env.TINA4_AI_URL || "http://localhost:11437/api/chat";
+        const aiUrl = process.env.TINA4_AI_URL || "http://localhost:11435/api/chat";
         const aiModel = process.env.TINA4_AI_MODEL || "qwen2.5-coder:14b";
         const prompts = fleshPrompt(title, goal, existing, prompt);
         const fetched = await fetchFleshReply(aiUrl, aiModel, prompts);
@@ -36506,7 +37022,7 @@ function relativePath(absPath, projectRoot3, frameworkRoots) {
 }
 function tokenise(text) {
   if (!text) return [];
-  const expanded = text.replace(CAMEL_SPLIT, (_m, a, b, c, d) => a ? `${a} ${b}` : `${c} ${d}`).toLowerCase();
+  const expanded = text.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z])(?=[A-Z][a-z])/g, "$1 ").toLowerCase();
   return expanded.split(/[\s_\-./:,;()\[\]{}\\]+/).filter((p) => p.length > 0);
 }
 function summariseDoc(doc) {
@@ -36737,7 +37253,7 @@ function returnFromSignature(signature) {
   const rest = signature.slice(close + 1).trim();
   return rest.startsWith(":") ? rest.slice(1).trim() : "";
 }
-var STDLIB_ALLOWLIST, _DOCS_CACHE, __FILENAME, __DIRNAME, USER_DIRS, CAMEL_SPLIT, FENCE_RE, CALL_RE, sharedFrameworkIndex, Docs;
+var STDLIB_ALLOWLIST, _DOCS_CACHE, __FILENAME, __DIRNAME, USER_DIRS, FENCE_RE, CALL_RE, sharedFrameworkIndex, Docs;
 var init_docs = __esm({
   "src/docs.ts"() {
     "use strict";
@@ -36876,7 +37392,6 @@ var init_docs = __esm({
     __FILENAME = fileURLToPath6(import.meta.url);
     __DIRNAME = path8.dirname(__FILENAME);
     USER_DIRS = ["src/orm", "src/routes", "src/app", "src/services", "src/models"];
-    CAMEL_SPLIT = /([a-z0-9])([A-Z])|([A-Z]+)([A-Z][a-z])/g;
     FENCE_RE = new RegExp(
       String.fromCharCode(96, 96, 96) + "[a-zA-Z0-9_+-]*\\n([\\s\\S]*?)\\n" + String.fromCharCode(96, 96, 96),
       "g"
@@ -37250,7 +37765,7 @@ ${end}
 
 // src/devAdmin.ts
 import { cpus as osCpus } from "node:os";
-import { readFileSync as readFileSync20, writeFileSync as writeFileSync15, existsSync as existsSync23, readdirSync as readdirSync16, mkdirSync as mkdirSync18, copyFileSync as copyFileSync2, statSync as statSync17, openSync as openSync4, closeSync as closeSync4, fstatSync as fstatSync2, fchmodSync as fchmodSync2, ftruncateSync, constants as constants3, realpathSync as realpathSync6, lstatSync } from "node:fs";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync15, existsSync as existsSync23, readdirSync as readdirSync16, mkdirSync as mkdirSync18, copyFileSync as copyFileSync2, statSync as statSync17, openSync as openSync5, closeSync as closeSync5, fstatSync as fstatSync3, fchmodSync as fchmodSync2, ftruncateSync as ftruncateSync2, constants as constants4, realpathSync as realpathSync6, lstatSync as lstatSync3 } from "node:fs";
 import { join as join27, dirname as dirname14, resolve as resolve16, relative as relative9, sep as sep8, basename as basename5 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { timingSafeEqual as timingSafeEqual2 } from "node:crypto";
@@ -37449,8 +37964,41 @@ function quoteTableRef(name) {
   }
   return parts.map((p) => `"${p}"`).join(".");
 }
+function parseSeedRequest(url, body) {
+  const b = body ?? {};
+  const table2 = String(url.searchParams.get("table") ?? b.table ?? "");
+  const count = parseInt(String(url.searchParams.get("count") ?? b.count ?? "10"), 10) || 10;
+  const seedRaw = url.searchParams.get("seed") ?? b.seed;
+  const seed = seedRaw !== void 0 && seedRaw !== null && String(seedRaw) !== "" ? Number.isNaN(parseInt(String(seedRaw), 10)) ? void 0 : parseInt(String(seedRaw), 10) : void 0;
+  const clear = String(url.searchParams.get("clear") ?? b.clear ?? "") === "true" || b.clear === true;
+  const strict = String(url.searchParams.get("strict") ?? b.strict ?? "") === "true" || b.strict === true;
+  return { table: table2, count, seed, clear, strict };
+}
+function buildSeedFieldMap(columns, fake) {
+  const rules = [
+    [(n) => n.includes("email"), () => fake.email()],
+    [(n) => n.includes("name"), () => fake.name()],
+    [(n) => n.includes("phone"), () => fake.phone()],
+    [(n) => n.includes("address") || n.includes("city") || n.includes("country"), () => fake.address()],
+    [(n) => n.includes("url") || n.includes("website"), () => fake.url()],
+    [(_n, t) => t.includes("int"), () => fake.integer(1, 1e3)],
+    [(_n, t) => /real|float|double|numeric|decimal/.test(t), () => fake.numeric(0, 1e3, 2)],
+    [(_n, t) => t.includes("bool"), () => fake.boolean()],
+    [(_n, t) => t.includes("date") || t.includes("time"), () => fake.date()]
+  ];
+  const sentence = () => fake.sentence(3);
+  const fieldMap = {};
+  for (const col of columns) {
+    if (col.name.toLowerCase() === "id" || col.primaryKey === true) continue;
+    const name = col.name.toLowerCase();
+    const type2 = col.type.toLowerCase();
+    const rule = rules.find(([matches]) => matches(name, type2));
+    fieldMap[col.name] = rule ? rule[1] : sentence;
+  }
+  return fieldMap;
+}
 function supervisorBaseUrl() {
-  const explicit = (process.env.TINA4_SUPERVISOR_URL ?? "").replace(/\/+$/, "");
+  const explicit = rtrimSlashes(process.env.TINA4_SUPERVISOR_URL ?? "");
   if (explicit) return explicit;
   const agentPort = (process.env.TINA4_AGENT_PORT ?? "").trim();
   if (/^\d+$/.test(agentPort)) return `http://127.0.0.1:${parseInt(agentPort, 10)}`;
@@ -37458,6 +38006,42 @@ function supervisorBaseUrl() {
   if (/^\d+$/.test(fwPort)) return `http://127.0.0.1:${parseInt(fwPort, 10) + 2e3}`;
   return "http://127.0.0.1:9145";
 }
+function buildSupervisorBody(method, body) {
+  if (method !== "POST" && method !== "PUT" && method !== "PATCH" && method !== "DELETE") return void 0;
+  if (body === void 0 || body === null) return void 0;
+  if (typeof body === "string") return body;
+  if (typeof body !== "object") return void 0;
+  let outBody = body;
+  if (!Array.isArray(body)) {
+    const pf = body.plan_file;
+    if (typeof pf === "string" && pf && !pf.includes("/")) outBody = { ...body, plan_file: `plan/${pf}` };
+  }
+  return JSON.stringify(outBody);
+}
+async function streamEventStream(res, upstream, timer) {
+  res.raw.writeHead(upstream.status || 200, {
+    "Content-Type": upstream.headers.get("content-type") ?? "text/event-stream",
+    "Cache-Control": "no-cache",
+    Connection: "keep-alive"
+  });
+  if (typeof res.raw.flushHeaders === "function") res.raw.flushHeaders();
+  if (!upstream.body) {
+    res.raw.end();
+    clearTimeout(timer);
+    return;
+  }
+  const reader = upstream.body.getReader();
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) res.raw.write(Buffer.from(value));
+    }
+  } finally {
+    clearTimeout(timer);
+    res.raw.end();
+  }
+}
 async function proxyToSupervisor(req2, res, downstreamPath) {
   const base = supervisorBaseUrl();
   let qs = "";
@@ -37468,24 +38052,7 @@ async function proxyToSupervisor(req2, res, downstreamPath) {
   }
   const target = `${base}${downstreamPath}${qs}`;
   const method = (req2.method ?? "GET").toUpperCase();
-  let bodyText;
-  if (method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE") {
-    const body = req2.body;
-    if (body !== void 0 && body !== null) {
-      if (typeof body === "string") {
-        bodyText = body;
-      } else if (typeof body === "object") {
-        let outBody = body;
-        if (!Array.isArray(body)) {
-          const pf = body.plan_file;
-          if (typeof pf === "string" && pf && !pf.includes("/")) {
-            outBody = { ...body, plan_file: `plan/${pf}` };
-          }
-        }
-        bodyText = JSON.stringify(outBody);
-      }
-    }
-  }
+  const bodyText = buildSupervisorBody(method, req2.body);
   const timeoutMs = downstreamPath === "/execute" || downstreamPath === "/chat" ? 6e5 : 3e4;
   const ctrl = new AbortController();
   const timer = setTimeout(() => ctrl.abort(), timeoutMs);
@@ -37511,30 +38078,7 @@ async function proxyToSupervisor(req2, res, downstreamPath) {
   }
   const ct = (upstream.headers.get("content-type") ?? "").toLowerCase();
   if (ct.includes("text/event-stream")) {
-    res.raw.writeHead(upstream.status || 200, {
-      "Content-Type": upstream.headers.get("content-type") ?? "text/event-stream",
-      "Cache-Control": "no-cache",
-      Connection: "keep-alive"
-    });
-    if (typeof res.raw.flushHeaders === "function") {
-      res.raw.flushHeaders();
-    }
-    if (!upstream.body) {
-      res.raw.end();
-      clearTimeout(timer);
-      return;
-    }
-    const reader = upstream.body.getReader();
-    try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        if (value) res.raw.write(Buffer.from(value));
-      }
-    } finally {
-      clearTimeout(timer);
-      res.raw.end();
-    }
+    await streamEventStream(res, upstream, timer);
     return;
   }
   clearTimeout(timer);
@@ -37651,13 +38195,13 @@ function handleGalleryDeploy(router) {
     res.json({ deployed: name, files: copied });
   };
 }
-function realPathOf(target) {
+function realPathOf2(target) {
   let existing = target;
   const tail = [];
   for (; ; ) {
     let present = false;
     try {
-      lstatSync(existing);
+      lstatSync3(existing);
       present = true;
     } catch {
     }
@@ -37669,9 +38213,9 @@ function realPathOf(target) {
 }
 function safeJoin(projectRoot3, rel, extraRoots = []) {
   try {
-    const root = realPathOf(resolve16(projectRoot3));
-    const resolved = realPathOf(resolve16(root, rel));
-    const roots = [root, ...extraRoots.filter(Boolean).map((r) => realPathOf(resolve16(r)))];
+    const root = realPathOf2(resolve16(projectRoot3));
+    const resolved = realPathOf2(resolve16(root, rel));
+    const roots = [root, ...extraRoots.filter(Boolean).map((r) => realPathOf2(resolve16(r)))];
     for (const r of roots) {
       if (resolved === r || resolved.startsWith(r.endsWith(sep8) ? r : r + sep8)) return resolved;
     }
@@ -37680,7 +38224,7 @@ function safeJoin(projectRoot3, rel, extraRoots = []) {
   return null;
 }
 function resolvedRelative(projectRoot3, resolvedPath) {
-  return relative9(realPathOf(resolve16(projectRoot3)), resolvedPath);
+  return relative9(realPathOf2(resolve16(projectRoot3)), resolvedPath);
 }
 function devFilesHidden(name) {
   if (DEV_FILES_IGNORED.has(name)) return true;
@@ -37708,7 +38252,7 @@ async function devGitInfo(root) {
     if (!inside || inside.trim() !== "true") return empty;
     const branch = (git(["rev-parse", "--abbrev-ref", "HEAD"]) ?? "").trim();
     const topRaw = git(["rev-parse", "--show-toplevel"]);
-    const gitRoot = topRaw && topRaw.trim() !== "" ? topRaw.trim().replace(/\\/g, "/").replace(/\/+$/, "") : null;
+    const gitRoot = topRaw && topRaw.trim() !== "" ? rtrimSlashes(topRaw.trim().replace(/\\/g, "/")) : null;
     const status2 = /* @__PURE__ */ new Map();
     const porcelain = git(["status", "--porcelain", "-uall"]);
     if (porcelain) {
@@ -37727,6 +38271,44 @@ async function devGitInfo(root) {
     return empty;
   }
 }
+function devGitLabel(gitPath, isDir, gitStatus) {
+  const code = gitStatus.get(gitPath);
+  if (code !== void 0) return devGitStatusLabel(code);
+  if (isDir) {
+    const prefix = gitPath + "/";
+    for (const [gf, gc] of gitStatus) {
+      if (gf.startsWith(prefix)) return gc === "??" ? "untracked" : "modified";
+    }
+  }
+  return "clean";
+}
+function devDirHasVisibleChild(full) {
+  try {
+    for (const c of readdirSync16(full)) {
+      if (!devFilesHidden(c)) return true;
+    }
+  } catch {
+  }
+  return false;
+}
+function buildFileEntry(name, full, entryRel, cwdInGit, gitStatus) {
+  let isDir = false;
+  let size = null;
+  try {
+    const st = statSync17(full);
+    isDir = st.isDirectory();
+    if (!isDir) size = st.size;
+  } catch {
+  }
+  return {
+    name,
+    path: entryRel,
+    is_dir: isDir,
+    has_children: isDir ? devDirHasVisibleChild(full) : null,
+    git_status: devGitLabel(cwdInGit + entryRel, isDir, gitStatus),
+    size
+  };
+}
 function devAdminLanguage(rel) {
   const base = (rel.split(/[\\/]/).pop() ?? "").toLowerCase();
   if (base === "dockerfile" || base === "dockerfile.dev" || base === "dockerfile.prod") {
@@ -37741,14 +38323,14 @@ function devAdminLanguage(rel) {
 function readDevFile(target) {
   let fd;
   try {
-    fd = openSync4(target, constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK);
-    if (!fstatSync2(fd).isFile()) return null;
+    fd = openSync5(target, constants4.O_RDONLY | constants4.O_NOFOLLOW | constants4.O_NONBLOCK);
+    if (!fstatSync3(fd).isFile()) return null;
     return readFileSync20(fd);
   } catch (error2) {
     if (["ENOENT", "ENOTDIR", "ELOOP"].includes(error2.code ?? "")) return null;
     throw error2;
   } finally {
-    if (fd !== void 0) closeSync4(fd);
+    if (fd !== void 0) closeSync5(fd);
   }
 }
 function mcpSecureEqual(expected, provided) {
@@ -37975,10 +38557,11 @@ function toolbarJs() {
     connect();
 })();`;
 }
-var cpuCount, DEV_MCP_PREFIXES, DEV_PUBLIC_ASSETS, DEV_SECRET_BASENAMES, DEV_SECRET_SUFFIXES, MessageLog, RequestInspector, ErrorTracker, DevMailboxStore, DevQueue, WsTracker, DevAdmin, handleDashboard, _reloadMtime, _reloadFile, handleMtime, handleReload, handleMessages, handleMessagesClear, handleRequests, handleRequestsClear, handleSystem, handleMessagesSearch, handleQueue, handleQueueTopics, handleQueueDeadLetters, handleQueueRetry, handleQueuePurge, handleQueueReplay, handleMailbox, handleMailboxRead, handleMailboxSeed, handleMailboxClear, handleTable, handleTables, handleSeed, handleQuery, handleBroken, handleBrokenResolve, handleBrokenClear, handleWebsockets, handleWebsocketsDisconnect, handleTool, DEFAULT_MCP_URL, handleGroundingStatus, handleGroundingToken, handleMigrate, handleSeedRun, handleTest, handleThreads, handleThreadsSub, handleConnections, handleConnectionsTest, handleConnectionsSave, __devAdminFilename, __devAdminDirname, handleGalleryList, handleVersionCheck, handleThoughts, handleSuperviseStub, DEV_FILES_IGNORED, handleFiles, DEV_ADMIN_LANG_MAP, handleFileRead, handleFileSave, handleFileRaw, handleFileRename, handleFileDelete, handleDepsSearch, handleDepsInstall, handleGitStatus, handleMcpTools, handleMcpCall, handleMcpStreamable, handleMcpDelete, handleMcpGet405, handleMcpLegacyMessage, handleMcpSse, handleScaffoldList, handleScaffoldRun, handlePlanCurrent, handlePlanList, handlePlanCreate, handlePlanSwitch, handlePlanCompleteStep, handlePlanAddStep, handlePlanNote, handlePlanArchive, handlePlanRead, handlePlanFlesh, handleIndexRebuild, handleIndexSearch, handleIndexFile, handleIndexOverview, handleDocsSearch, handleDocsClass, handleDocsMethod, handleDocsIndex, handleDocsWellKnown, handleDevAdminJs, handleToolbarCss, handleToolbarJs;
+var cpuCount, DEV_MCP_PREFIXES, DEV_PUBLIC_ASSETS, DEV_SECRET_BASENAMES, DEV_SECRET_SUFFIXES, MessageLog, RequestInspector, ErrorTracker, DevMailboxStore, DevQueue, WsTracker, DevAdmin, handleDashboard, _reloadMtime, _reloadFile, handleMtime, handleReload, handleMessages, handleMessagesClear, handleRequests, handleRequestsClear, handleSystem, handleMessagesSearch, handleQueue, handleQueueTopics, handleQueueDeadLetters, handleQueueRetry, handleQueuePurge, handleQueueReplay, handleMailbox, handleMailboxRead, handleMailboxSeed, handleMailboxClear, handleTable, handleTables, handleSeed, handleQuery, handleBroken, handleBrokenResolve, handleBrokenClear, handleWebsockets, handleWebsocketsDisconnect, handleTool, DEFAULT_MCP_URL, handleGroundingStatus, handleGroundingToken, handleMigrate, handleSeedRun, handleTest, handleThreads, handleThreadsSub, handleConnections, handleConnectionsTest, handleConnectionsSave, __devAdminFilename, __devAdminDirname, handleGalleryList, handleVersionCheck, handleThoughts, handleSuperviseStub, DEV_FILES_IGNORED, handleFiles, DEV_ADMIN_LANG_MAP, handleFileRead, handleFileSave, handleFileRaw, handleFileRename, handleFileDelete, handleDepsSearch, handleDepsInstall, handleGitStatus, handleMcpTools, handleMcpCall, handleMcpStreamable, handleMcpDelete, handleMcpGet405, handleMcpLegacyMessage, handleMcpSse, handleScaffoldList, handleScaffoldRun, handlePlanCurrent, handlePlanList, handlePlanCreate, handlePlanSwitch, handlePlanCompleteStep, handlePlanAddStep, handlePlanNote, handlePlanArchive, handlePlanRead, handlePlanFlesh, handleIndexRebuild, handleIndexSearch, handleIndexFile, handleIndexOverview, handleDocsSearch, handleDocsClass, handleDocsMethod, handleDocsIndex, handleDocsWellKnown, handleDevAdminJs, handleDevAdminSplit, handleToolbarCss, handleToolbarJs;
 var init_devAdmin = __esm({
   "src/devAdmin.ts"() {
     "use strict";
+    init_slashTrim();
     init_devMailbox();
     init_upstreamResponse();
     init_dotenv();
@@ -38445,6 +39028,7 @@ var init_devAdmin = __esm({
           { method: "GET", pattern: "/__dev/api/docs/.well-known.json", handler: handleDocsWellKnown },
           // JS asset
           { method: "GET", pattern: "/__dev/js/tina4-dev-admin.min.js", handler: handleDevAdminJs },
+          { method: "GET", pattern: "/__dev/split", handler: handleDevAdminSplit },
           // Dev-toolbar assets — served as external CSS/JS so the injected toolbar is
           // CSP-clean (no inline style=, onclick=, or <script>) under a strict
           // `default-src 'self'`. Parity with PHP's /__dev/toolbar.css + toolbar.js.
@@ -38811,13 +39395,7 @@ var init_devAdmin = __esm({
     };
     handleSeed = async (req2, res) => {
       const url = new URL(req2.url ?? "/", "http://localhost");
-      const body = req2.body ?? {};
-      const table2 = url.searchParams.get("table") ?? body?.table ?? "";
-      const count = parseInt(String(url.searchParams.get("count") ?? body?.count ?? "10"), 10) || 10;
-      const seedRaw = url.searchParams.get("seed") ?? body?.seed;
-      const seed = seedRaw !== void 0 && seedRaw !== null && String(seedRaw) !== "" ? Number.isNaN(parseInt(String(seedRaw), 10)) ? void 0 : parseInt(String(seedRaw), 10) : void 0;
-      const clear = String(url.searchParams.get("clear") ?? body?.clear ?? "") === "true" || body?.clear === true;
-      const strict = String(url.searchParams.get("strict") ?? body?.strict ?? "") === "true" || body?.strict === true;
+      const { table: table2, count, seed, clear, strict } = parseSeedRequest(url, req2.body);
       if (!table2) {
         res.json({ error: "Missing table parameter" });
         return;
@@ -38832,33 +39410,7 @@ var init_devAdmin = __esm({
           res.json({ error: `Table '${table2}' not found or has no columns` });
           return;
         }
-        const fieldMap = {};
-        for (const col of columns) {
-          const name = col.name.toLowerCase();
-          const type2 = col.type.toLowerCase();
-          if (name === "id" || col.primaryKey === true) continue;
-          if (name.includes("email")) {
-            fieldMap[col.name] = () => fake.email();
-          } else if (name.includes("name")) {
-            fieldMap[col.name] = () => fake.name();
-          } else if (name.includes("phone")) {
-            fieldMap[col.name] = () => fake.phone();
-          } else if (name.includes("address") || name.includes("city") || name.includes("country")) {
-            fieldMap[col.name] = () => fake.address();
-          } else if (name.includes("url") || name.includes("website")) {
-            fieldMap[col.name] = () => fake.url();
-          } else if (type2.includes("int")) {
-            fieldMap[col.name] = () => fake.integer(1, 1e3);
-          } else if (type2.includes("real") || type2.includes("float") || type2.includes("double") || type2.includes("numeric") || type2.includes("decimal")) {
-            fieldMap[col.name] = () => fake.numeric(0, 1e3, 2);
-          } else if (type2.includes("bool")) {
-            fieldMap[col.name] = () => fake.boolean();
-          } else if (type2.includes("date") || type2.includes("time")) {
-            fieldMap[col.name] = () => fake.date();
-          } else {
-            fieldMap[col.name] = () => fake.sentence(3);
-          }
-        }
+        const fieldMap = buildSeedFieldMap(columns, fake);
         const summary = await seedTable2(db, table2, count, fieldMap, void 0, { clear, strict });
         res.json({ seeded: summary.seeded, failed: summary.failed, errors: summary.errors, table: table2 });
       } catch (e) {
@@ -39031,9 +39583,9 @@ var init_devAdmin = __esm({
     };
     handleTest = async (_req, res) => {
       try {
-        const { execFile } = await import("node:child_process");
+        const { execFile: execFile2 } = await import("node:child_process");
         const { promisify } = await import("node:util");
-        const run = promisify(execFile);
+        const run = promisify(execFile2);
         try {
           const { stdout, stderr } = await run("npm", ["test"], {
             cwd: resolve16(process.cwd()),
@@ -39151,9 +39703,9 @@ var init_devAdmin = __esm({
       }
       try {
         const envPath = join27(process.cwd(), ".env");
-        const fd = openSync4(envPath, constants3.O_RDWR | constants3.O_APPEND | constants3.O_CREAT | (constants3.O_NOFOLLOW ?? 0) | (constants3.O_NONBLOCK ?? 0), 384);
+        const fd = openSync5(envPath, constants4.O_RDWR | constants4.O_APPEND | constants4.O_CREAT | (constants4.O_NOFOLLOW ?? 0) | (constants4.O_NONBLOCK ?? 0), 384);
         try {
-          const info = fstatSync2(fd);
+          const info = fstatSync3(fd);
           if (!info.isFile() || info.nlink !== 1) throw new Error("Refusing a non-regular or multiply-linked configuration file");
           fchmodSync2(fd, 384);
           const lines = readFileSync20(fd, "utf-8").split("\n");
@@ -39183,10 +39735,10 @@ var init_devAdmin = __esm({
           for (const [key, found] of Object.entries(keysFound)) {
             if (!found) newLines.push(`${key}=${values[key]}`);
           }
-          ftruncateSync(fd, 0);
+          ftruncateSync2(fd, 0);
           writeFileSync15(fd, newLines.join("\n") + "\n");
         } finally {
-          closeSync4(fd);
+          closeSync5(fd);
         }
         res.json({ success: true });
       } catch (e) {
@@ -39309,48 +39861,7 @@ var init_devAdmin = __esm({
         const full = join27(target, name);
         const entryRel = relative9(root, full).replace(/\\/g, "/");
         if (isSecretPath(entryRel)) continue;
-        let isDir = false;
-        let size = null;
-        try {
-          const st = statSync17(full);
-          isDir = st.isDirectory();
-          if (!isDir) size = st.size;
-        } catch {
-        }
-        const gitPath = cwdInGit + entryRel;
-        let gitLabel = "clean";
-        const code = gitStatus.get(gitPath);
-        if (code !== void 0) {
-          gitLabel = devGitStatusLabel(code);
-        } else if (isDir) {
-          const prefix = gitPath + "/";
-          for (const [gf, gc] of gitStatus) {
-            if (gf.startsWith(prefix)) {
-              gitLabel = gc === "??" ? "untracked" : "modified";
-              break;
-            }
-          }
-        }
-        let hasChildren = null;
-        if (isDir) {
-          hasChildren = false;
-          try {
-            for (const c of readdirSync16(full)) {
-              if (devFilesHidden(c)) continue;
-              hasChildren = true;
-              break;
-            }
-          } catch {
-          }
-        }
-        entries.push({
-          name,
-          path: entryRel,
-          is_dir: isDir,
-          has_children: hasChildren,
-          git_status: gitLabel,
-          size
-        });
+        entries.push(buildFileEntry(name, full, entryRel, cwdInGit, gitStatus));
       }
       res.json({ path: relative9(root, target).replace(/\\/g, "/") || ".", branch, entries });
     };
@@ -39883,6 +40394,31 @@ var init_devAdmin = __esm({
       res.raw.writeHead(404, { "Content-Type": "text/plain" });
       res.raw.end("tina4-dev-admin.min.js not found");
     };
+    handleDevAdminSplit = async (_req, res) => {
+      const { readFileSync: readFileSync27, existsSync: existsSync29 } = await import("node:fs");
+      const { dirname: dirname17, join: join33, resolve: resolve21 } = await import("node:path");
+      const { fileURLToPath: fileURLToPath10 } = await import("node:url");
+      const dir = dirname17(fileURLToPath10(import.meta.url));
+      const candidates = [
+        join33(dir, "..", "public", "js", "tina4-dev-admin-split.html"),
+        join33(dir, "..", "..", "public", "js", "tina4-dev-admin-split.html"),
+        resolve21(process.cwd(), "node_modules", "tina4-nodejs", "packages", "core", "public", "js", "tina4-dev-admin-split.html"),
+        resolve21(process.cwd(), "public", "js", "tina4-dev-admin-split.html")
+      ];
+      for (const path10 of candidates) {
+        if (existsSync29(path10)) {
+          try {
+            const content = readFileSync27(path10, "utf-8");
+            res.raw.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-cache" });
+            res.raw.end(content);
+            return;
+          } catch {
+          }
+        }
+      }
+      res.raw.writeHead(404, { "Content-Type": "text/plain" });
+      res.raw.end("tina4-dev-admin-split.html not found");
+    };
     handleToolbarCss = (_req, res) => {
       res.raw.writeHead(200, { "Content-Type": "text/css; charset=utf-8", "Cache-Control": "no-cache" });
       res.raw.end(toolbarCss());
@@ -40354,7 +40890,10 @@ function generate2(routes, models = []) {
     openapi: resolveOpenApiVersion(),
     info: buildInfo(),
     servers: resolveServers(),
-    paths: {},
+    // Prototype-less: route paths are developer-defined, but a null prototype
+    // makes `spec.paths[path][method] = op` structurally pollution-proof
+    // regardless (js/prototype-polluting-assignment). Serialises to JSON the same.
+    paths: /* @__PURE__ */ Object.create(null),
     components: {
       schemas: {},
       // Configurable security schemes (v3.13.42): bearerFormat via env, optional
@@ -40419,7 +40958,7 @@ function buildOperation(route, spec, ctx) {
   const openApiPath = patternToOpenAPI(route.pattern);
   const method = route.method.toLowerCase();
   if (!spec.paths[openApiPath]) {
-    spec.paths[openApiPath] = {};
+    spec.paths[openApiPath] = /* @__PURE__ */ Object.create(null);
   }
   const tags = route.meta?.tags ?? inferTags(route.pattern);
   for (const t of tags) {
@@ -40725,7 +41264,7 @@ function inferModelFromPath(pattern) {
   return null;
 }
 function operationIdBase(method, openApiPath) {
-  const clean = openApiPath.replace(/^\/+|\/+$/g, "").replace(/\//g, "_").replace(/\.\.\./g, "").replace(/[{}]/g, "").replace(/\*/g, "wildcard");
+  const clean = trimSlashes(openApiPath).replace(/\//g, "_").replace(/\.\.\./g, "").replace(/[{}]/g, "").replace(/\*/g, "wildcard");
   return clean ? `${method}_${clean}` : method;
 }
 function uniqueOperationId(method, openApiPath, seen) {
@@ -40743,6 +41282,7 @@ var WRITE_METHODS, INTERNAL_PREFIXES, registeredSchemes, registeredSchemas, PARA
 var init_generator = __esm({
   "../swagger/src/generator.ts"() {
     "use strict";
+    init_slashTrim();
     WRITE_METHODS = /* @__PURE__ */ new Set(["post", "put", "patch", "delete"]);
     INTERNAL_PREFIXES = ["/swagger", "/__dev", "/__feedback", "/ai", "/rag", "/vision", "/embed", "/image"];
     registeredSchemes = {};
@@ -40764,7 +41304,7 @@ var init_generator = __esm({
 
 // ../swagger/src/ui.ts
 function swaggerUiCdn() {
-  return (process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5").replace(/\/+$/, "");
+  return rtrimSlashes(process.env.TINA4_SWAGGER_UI_CDN ?? "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5");
 }
 function swaggerEnabled() {
   const raw = (process.env.TINA4_SWAGGER_ENABLED ?? "").trim().toLowerCase();
@@ -40820,6 +41360,7 @@ var SWAGGER_UI_HTML;
 var init_ui = __esm({
   "../swagger/src/ui.ts"() {
     "use strict";
+    init_slashTrim();
     SWAGGER_UI_HTML = (specUrl, nonce) => `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -40874,7 +41415,7 @@ __export(sso_exports, {
   SsoError: () => SsoError,
   liveSessionIdentity: () => liveSessionIdentity
 });
-import { createHash as createHash10, randomBytes as randomBytes8, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
+import { createHash as createHash11, randomBytes as randomBytes8, timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 function expiresAt(tokens) {
   const lifetime = Number(tokens.expires_in ?? 0);
   return lifetime > 0 ? Math.floor(Date.now() / 1e3) + lifetime : 0;
@@ -41005,7 +41546,7 @@ var init_sso = __esm({
         const state = randomBytes8(32).toString("base64url");
         const nonce = randomBytes8(32).toString("base64url");
         const verifier = randomBytes8(64).toString("base64url");
-        const challenge = createHash10("sha256").update(verifier).digest("base64url");
+        const challenge = createHash11("sha256").update(verifier).digest("base64url");
         session.set(_Sso.PENDING_KEY, { state, nonce, verifier, return_to: _Sso.safeReturn(returnTo), created_at: Math.floor(Date.now() / 1e3) });
         const metadata = await this.discover();
         const query = new URLSearchParams({
@@ -41237,7 +41778,7 @@ import { resolve as resolve19, dirname as dirname15, join as join30, relative as
 import { existsSync as existsSync26, readdirSync as readdirSync18, readFileSync as readFileSync23, statSync as statSync18 } from "node:fs";
 import { isatty } from "node:tty";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
-import { execFileSync as execFileSync3, exec } from "node:child_process";
+import { execFileSync as execFileSync3, execFile } from "node:child_process";
 import cluster from "node:cluster";
 import os2 from "node:os";
 function isSwaggerAssetPath(pathname) {
@@ -41373,10 +41914,11 @@ function shouldOpenBrowser(isDevelopment, noBrowser = false) {
   });
 }
 function openBrowser(url) {
+  if (!/^https?:\/\/([A-Za-z0-9.-]+|\[[0-9A-Fa-f:]+\])(:\d{1,5})?\/?$/.test(url)) return;
   setTimeout(() => {
-    if (process.platform === "darwin") exec(`open ${url}`);
-    else if (process.platform === "win32") exec(`start "" "${url}"`);
-    else exec(`xdg-open ${url}`);
+    if (process.platform === "darwin") execFile("open", [url]);
+    else if (process.platform === "win32") execFile("rundll32", ["url.dll,FileProtocolHandler", url]);
+    else execFile("xdg-open", [url]);
   }, 2e3);
 }
 function resolvePortAndHost(config) {
@@ -41491,7 +42033,7 @@ function resetTemplateCache() {
 }
 function resolveTemplate(pathname, templatesDir) {
   if (!templateAutoRoutingEnabled()) return null;
-  const cleanPath = pathname.replace(/^\/+/, "").replace(/\/+$/, "") || "index";
+  const cleanPath = trimSlashes(pathname) || "index";
   const isDev2 = (process.env.TINA4_DEBUG ?? "false").toLowerCase() === "true";
   if (isDev2) {
     if (cleanPath.split("/").some((seg) => seg.startsWith("_"))) return null;
@@ -41759,7 +42301,7 @@ async function runGlobalMiddlewarePass(middleware, req2, res) {
 }
 function resolveHandlerArgs(handler, req2, res, routeParams) {
   const fnStr = handler.toString();
-  const argMatch = fnStr.match(/^(?:async\s*)?(?:function\s*\w*)?\s*\(([^)]*)\)/);
+  const argMatch = fnStr.match(/^(?:async\s*)?(?:function(?:\s+\w+)?\s*)?\(([^)]*)\)/);
   const argNames = argMatch?.[1]?.split(",").map((a) => a.trim().replace(/[:=].*/, "")) ?? [];
   const filteredArgs = argNames.filter((n) => n.length > 0);
   if (filteredArgs.length === 0) return [];
@@ -41995,8 +42537,9 @@ async function buildDispatchContext(router, base) {
   const templatesDir = resolve19(root, "src/templates");
   let frondEngine = null;
   try {
-    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2, setFormTokenSessionProvider: setFormTokenSessionProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
     setCspNonceProvider2(currentCspNonce);
+    setFormTokenSessionProvider2(currentFormTokenSessionId);
     frondEngine = new Frond2(templatesDir);
   } catch {
   }
@@ -42111,7 +42654,10 @@ async function runDispatch(ctx, rawReq, rawRes) {
   const requestNonce = generateNonce();
   return Log.runWithRequestId(
     requestId,
-    () => runWithCspNonce(requestNonce, () => dispatchInner(ctx, rawReq, rawRes, requestId))
+    () => runWithCspNonce(
+      requestNonce,
+      () => runWithFormTokenSession(() => dispatchInner(ctx, rawReq, rawRes, requestId))
+    )
   );
 }
 function loopbackBindHosts(host) {
@@ -42239,8 +42785,9 @@ async function startServer(config) {
   let frondEngine = null;
   setDefaultTemplatesDir(templatesDir);
   try {
-    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
+    const { Frond: Frond2, setCspNonceProvider: setCspNonceProvider2, setFormTokenSessionProvider: setFormTokenSessionProvider2 } = await Promise.resolve().then(() => (init_engine(), engine_exports));
     setCspNonceProvider2(currentCspNonce);
+    setFormTokenSessionProvider2(currentFormTokenSessionId);
     frondEngine = new Frond2(templatesDir);
     router.addRoute({
       method: "GET",
@@ -42589,6 +43136,7 @@ var __filename, __dirname, BUILTIN_ERROR_TEMPLATES_DIR, BUILTIN_PUBLIC_DIR, swag
 var init_server = __esm({
   "src/server.ts"() {
     "use strict";
+    init_slashTrim();
     init_transport();
     init_router();
     init_authGate();
@@ -42596,6 +43144,7 @@ var init_server = __esm({
     init_portTakeover();
     init_request();
     init_dispatchPipeline();
+    init_session();
     init_response();
     init_middleware();
     init_static();
@@ -44211,6 +44760,7 @@ var ApiStreamError, RETRY_STATUSES, DOWNLOAD_CHUNK_SIZE, MAX_REDIRECTS, STRIP_ON
 var init_api = __esm({
   "src/api.ts"() {
     "use strict";
+    init_slashTrim();
     init_version();
     init_ssrf();
     ApiStreamError = class extends Error {
@@ -44308,7 +44858,7 @@ var init_api = __esm({
        * turns on a per-client, in-memory cookie jar.
        */
       constructor(baseUrl = "", authHeaderOrOptions = "", timeout = 30) {
-        this.baseUrl = baseUrl.replace(/\/+$/, "");
+        this.baseUrl = rtrimSlashes(baseUrl);
         this.headers = {};
         this.maxRetries = 0;
         this.retryBackoff = 0.5;
@@ -45074,6 +45624,23 @@ function sendCommand(socket, command) {
     });
   });
 }
+function pushAlternativeBody(lines, altBoundary, text, body) {
+  lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
+  lines.push("");
+  lines.push(`--${altBoundary}`);
+  lines.push("Content-Type: text/plain; charset=UTF-8");
+  lines.push("Content-Transfer-Encoding: 7bit");
+  lines.push("");
+  lines.push(text);
+  lines.push("");
+  lines.push(`--${altBoundary}`);
+  lines.push("Content-Type: text/html; charset=UTF-8");
+  lines.push("Content-Transfer-Encoding: 7bit");
+  lines.push("");
+  lines.push(body);
+  lines.push("");
+  lines.push(`--${altBoundary}--`);
+}
 function buildMimeMessage(options) {
   const boundary = `----=_Tina4_${Date.now()}_${Math.random().toString(36).substring(2)}`;
   const altBoundary = `----=_Tina4Alt_${Date.now()}_${Math.random().toString(36).substring(2)}`;
@@ -45103,21 +45670,7 @@ function buildMimeMessage(options) {
     lines.push("");
     lines.push(`--${boundary}`);
     if (hasTextAlt) {
-      lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
-      lines.push("");
-      lines.push(`--${altBoundary}`);
-      lines.push("Content-Type: text/plain; charset=UTF-8");
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.text);
-      lines.push("");
-      lines.push(`--${altBoundary}`);
-      lines.push("Content-Type: text/html; charset=UTF-8");
-      lines.push("Content-Transfer-Encoding: 7bit");
-      lines.push("");
-      lines.push(options.body);
-      lines.push("");
-      lines.push(`--${altBoundary}--`);
+      pushAlternativeBody(lines, altBoundary, options.text, options.body);
     } else {
       const contentType = options.html ? "text/html" : "text/plain";
       lines.push(`Content-Type: ${contentType}; charset=UTF-8`);
@@ -45142,21 +45695,7 @@ function buildMimeMessage(options) {
     lines.push("");
     lines.push(`--${boundary}--`);
   } else if (hasTextAlt) {
-    lines.push(`Content-Type: multipart/alternative; boundary="${altBoundary}"`);
-    lines.push("");
-    lines.push(`--${altBoundary}`);
-    lines.push("Content-Type: text/plain; charset=UTF-8");
-    lines.push("Content-Transfer-Encoding: 7bit");
-    lines.push("");
-    lines.push(options.text);
-    lines.push("");
-    lines.push(`--${altBoundary}`);
-    lines.push("Content-Type: text/html; charset=UTF-8");
-    lines.push("Content-Transfer-Encoding: 7bit");
-    lines.push("");
-    lines.push(options.body);
-    lines.push("");
-    lines.push(`--${altBoundary}--`);
+    pushAlternativeBody(lines, altBoundary, options.text, options.body);
   } else {
     const contentType = options.html ? "text/html" : "text/plain";
     lines.push(`Content-Type: ${contentType}; charset=UTF-8`);
@@ -45921,61 +46460,72 @@ function decodeEntities(raw) {
 function parseXmlDocument(xml) {
   const stack = [];
   let root = null;
-  let position = 0;
   const addText = (text) => {
     const current = stack[stack.length - 1];
     if (current.children.length === 0) current.text += text;
   };
-  while (position < xml.length) {
-    const nextTag = xml.indexOf("<", position);
+  const skipComment = (at) => {
+    const close = xml.indexOf("-->", at + 4);
+    if (close === -1) malformed();
+    return close + 3;
+  };
+  const readCData = (at) => {
+    const close = xml.indexOf("]]>", at + 9);
+    if (close === -1 || stack.length === 0) malformed();
+    addText(xml.slice(at + 9, close));
+    return close + 3;
+  };
+  const skipProcessingInstruction = (at) => {
+    const close = xml.indexOf("?>", at + 2);
+    if (close === -1) malformed();
+    const target = xml.slice(at + 2, close).split(/\s/, 1)[0];
+    if (target.toLowerCase() === "xml" && at !== 0) malformed();
+    return close + 2;
+  };
+  const closeElement = (at) => {
+    END_TAG.lastIndex = at;
+    const match = END_TAG.exec(xml);
+    const open = stack.pop();
+    if (!match || !open || open.qualifiedName !== match[1]) malformed();
+    return END_TAG.lastIndex;
+  };
+  const openElement = (at) => {
+    START_TAG.lastIndex = at;
+    const match = START_TAG.exec(xml);
+    if (!match || stack.length === 0 && root !== null) malformed();
+    for (const attribute of match[2].matchAll(ATTRIBUTE_VALUE)) decodeEntities(attribute[1] ?? attribute[2]);
+    const qualifiedName = match[1];
+    const element = {
+      name: qualifiedName.slice(qualifiedName.indexOf(":") + 1),
+      qualifiedName,
+      children: [],
+      text: ""
+    };
+    if (stack.length > 0) stack[stack.length - 1].children.push(element);
+    else root = element;
+    if (match[3] !== "/") stack.push(element);
+    return START_TAG.lastIndex;
+  };
+  const readText = (at) => {
+    const nextTag = xml.indexOf("<", at);
     const textEnd = nextTag === -1 ? xml.length : nextTag;
-    if (textEnd > position) {
-      const raw = xml.slice(position, textEnd);
+    if (textEnd > at) {
+      const raw = xml.slice(at, textEnd);
       if (stack.length > 0) addText(decodeEntities(raw));
       else if (raw.trim() !== "") malformed();
-      position = textEnd;
-      if (nextTag === -1) break;
-    }
-    if (xml.startsWith("<!--", position)) {
-      const close = xml.indexOf("-->", position + 4);
-      if (close === -1) malformed();
-      position = close + 3;
-    } else if (xml.startsWith("<![CDATA[", position)) {
-      const close = xml.indexOf("]]>", position + 9);
-      if (close === -1 || stack.length === 0) malformed();
-      addText(xml.slice(position + 9, close));
-      position = close + 3;
-    } else if (xml.startsWith("<?", position)) {
-      const close = xml.indexOf("?>", position + 2);
-      if (close === -1) malformed();
-      const target = xml.slice(position + 2, close).split(/\s/, 1)[0];
-      if (target.toLowerCase() === "xml" && position !== 0) malformed();
-      position = close + 2;
-    } else if (xml.startsWith("<!", position)) {
-      malformed();
-    } else if (xml.startsWith("</", position)) {
-      END_TAG.lastIndex = position;
-      const match = END_TAG.exec(xml);
-      const open = stack.pop();
-      if (!match || !open || open.qualifiedName !== match[1]) malformed();
-      position = END_TAG.lastIndex;
-    } else {
-      START_TAG.lastIndex = position;
-      const match = START_TAG.exec(xml);
-      if (!match || stack.length === 0 && root !== null) malformed();
-      for (const attribute of match[2].matchAll(ATTRIBUTE_VALUE)) decodeEntities(attribute[1] ?? attribute[2]);
-      const qualifiedName = match[1];
-      const element = {
-        name: qualifiedName.slice(qualifiedName.indexOf(":") + 1),
-        qualifiedName,
-        children: [],
-        text: ""
-      };
-      if (stack.length > 0) stack[stack.length - 1].children.push(element);
-      else root = element;
-      if (match[3] !== "/") stack.push(element);
-      position = START_TAG.lastIndex;
     }
+    return textEnd;
+  };
+  let position = 0;
+  while (position < xml.length) {
+    position = readText(position);
+    if (position >= xml.length) break;
+    if (xml.startsWith("<!--", position)) position = skipComment(position);
+    else if (xml.startsWith("<![CDATA[", position)) position = readCData(position);
+    else if (xml.startsWith("<?", position)) position = skipProcessingInstruction(position);
+    else if (xml.startsWith("<!", position)) malformed();
+    else if (xml.startsWith("</", position)) position = closeElement(position);
+    else position = openElement(position);
   }
   if (root === null || stack.length > 0) malformed();
   return root;
@@ -47459,13 +48009,13 @@ export default class User {
 import {
   createCipheriv,
   createECDH,
-  createHmac as createHmac4,
+  createHmac as createHmac5,
   createPrivateKey,
   createSign as createSign2,
   randomBytes as randomBytes12
 } from "node:crypto";
 function encodeBase64Url(value) {
-  return Buffer.from(value).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+  return Buffer.from(value).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/={1,2}$/, "");
 }
 function decodeBase64Url(value, name) {
   if (typeof value !== "string" || value.length === 0) {
@@ -47495,15 +48045,15 @@ function vapidPrivateKey(rawPrivate, rawPublic) {
     format: "jwk"
   });
 }
-function hmac(salt, value) {
-  return createHmac4("sha256", salt).update(value).digest();
+function hmac2(salt, value) {
+  return createHmac5("sha256", salt).update(value).digest();
 }
 function hkdfExpand(prk, info, length) {
   const chunks = [];
   let previous = Buffer.alloc(0);
   for (let counter = 1; Buffer.concat(chunks).length < length; counter++) {
     if (counter > 255) throw new PushError("HKDF output is too large");
-    previous = hmac(prk, Buffer.concat([previous, info, Buffer.from([counter])]));
+    previous = hmac2(prk, Buffer.concat([previous, info, Buffer.from([counter])]));
     chunks.push(previous);
   }
   return Buffer.concat(chunks).subarray(0, length);
@@ -47540,10 +48090,10 @@ function encryptPayload(payload, subscription) {
     clientPublic,
     serverPublic
   ]);
-  const prkKey = hmac(authSecret, sharedSecret);
+  const prkKey = hmac2(authSecret, sharedSecret);
   const ikm = hkdfExpand(prkKey, keyInfo, 32);
   const salt = randomBytes12(16);
-  const contentPrk = hmac(salt, ikm);
+  const contentPrk = hmac2(salt, ikm);
   const cek = hkdfExpand(contentPrk, Buffer.from("Content-Encoding: aes128gcm\0", "ascii"), 16);
   const nonce = hkdfExpand(contentPrk, Buffer.from("Content-Encoding: nonce\0", "ascii"), 12);
   const cipher = createCipheriv("aes-128-gcm", cek, nonce);
@@ -47716,6 +48266,7 @@ var AiError, AiConfigError, AiTimeoutError, AiParseError, AiHTTPError, Ai, Aggre
 var init_aiClient = __esm({
   "src/aiClient.ts"() {
     "use strict";
+    init_slashTrim();
     init_api();
     AiError = class extends Error {
     };
@@ -47920,7 +48471,7 @@ var init_aiClient = __esm({
           throw new AiConfigError("AI URL must be an http or https URL");
         }
         if (url.protocol !== "http:" && url.protocol !== "https:") throw new AiConfigError("AI URL must be an http or https URL");
-        const path10 = url.pathname.replace(/\/+$/, "");
+        const path10 = rtrimSlashes(url.pathname);
         if (path10 === "" || path10 === "/v1" || path10 === "/api" || path10 === "/v1beta/openai") {
           const suffix = provider === "anthropic" ? "/messages" : capability === "embed" ? "/embeddings" : "/chat/completions";
           url.pathname = (path10 || "/v1") + suffix;
@@ -50290,6 +50841,7 @@ __export(index_exports, {
   backgroundTaskCount: () => backgroundTaskCount,
   buildEnvelope: () => buildEnvelope,
   buildFrame: () => buildFrame,
+  buildSeedFieldMap: () => buildSeedFieldMap,
   buildSessionCookie: () => buildSessionCookie,
   cacheBackendStats: () => cacheBackendStats,
   cacheClear: () => cacheClear,
@@ -50395,6 +50947,7 @@ __export(index_exports, {
   parseFrame: () => parseFrame,
   parseLineStream: () => parseLineStream,
   parseMultipart: () => parseMultipart,
+  parseSeedRequest: () => parseSeedRequest,
   parseSseStream: () => parseSseStream,
   parseUpgradeHeaders: () => parseUpgradeHeaders,
   patch: () => patch,
@@ -50679,6 +51232,7 @@ export {
   backgroundTaskCount,
   buildEnvelope,
   buildFrame,
+  buildSeedFieldMap,
   buildSessionCookie,
   cacheBackendStats,
   cacheClear,
@@ -50784,6 +51338,7 @@ export {
   parseFrame,
   parseLineStream,
   parseMultipart,
+  parseSeedRequest,
   parseSseStream,
   parseUpgradeHeaders,
   patch,