tina4-python 3.13.106__tar.gz → 3.13.108__tar.gz

{tina4_python-3.13.106 → tina4_python-3.13.108}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tina4-python
-Version: 3.13.106
+Version: 3.13.108
 Summary: Tina4 Python v3 — Zero-dependency, lightweight web framework
 Author-email: Andre van Zuydam <andrevanzuydam@gmail.com>
 License: MIT
@@ -56,13 +56,12 @@ Description-Content-Type: text/markdown
 <h1 align="center">Tina4 Python</h1>
 
 <p align="center">
-  98 built-in features. Zero dependencies. One import, everything works.
+  Zero dependencies. One import, everything works.
 </p>
 
 <p align="center">
   <a href="https://pypi.org/project/tina4-python/"><img src="https://img.shields.io/pypi/v/tina4-python?color=7b1fa2&label=PyPI" alt="PyPI"></a>
-  <img src="https://img.shields.io/badge/tests-2%2C281%20passing-brightgreen" alt="Tests">
-  <img src="https://img.shields.io/badge/features-98-blue" alt="Features">
+  <a href="https://github.com/tina4stack/tina4-python/actions/workflows/test.yml"><img src="https://img.shields.io/github/actions/workflow/status/tina4stack/tina4-python/test.yml?label=tests" alt="Tests"></a>
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero Deps">
   <a href="https://tina4.com"><img src="https://img.shields.io/badge/docs-tina4.com-7b1fa2" alt="Docs"></a>
 </p>

{tina4_python-3.13.106 → tina4_python-3.13.108}/README.md

@@ -5,13 +5,12 @@
 <h1 align="center">Tina4 Python</h1>
 
 <p align="center">
-  98 built-in features. Zero dependencies. One import, everything works.
+  Zero dependencies. One import, everything works.
 </p>
 
 <p align="center">
   <a href="https://pypi.org/project/tina4-python/"><img src="https://img.shields.io/pypi/v/tina4-python?color=7b1fa2&label=PyPI" alt="PyPI"></a>
-  <img src="https://img.shields.io/badge/tests-2%2C281%20passing-brightgreen" alt="Tests">
-  <img src="https://img.shields.io/badge/features-98-blue" alt="Features">
+  <a href="https://github.com/tina4stack/tina4-python/actions/workflows/test.yml"><img src="https://img.shields.io/github/actions/workflow/status/tina4stack/tina4-python/test.yml?label=tests" alt="Tests"></a>
   <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="Zero Deps">
   <a href="https://tina4.com"><img src="https://img.shields.io/badge/docs-tina4.com-7b1fa2" alt="Docs"></a>
 </p>

{tina4_python-3.13.106 → tina4_python-3.13.108}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tina4-python"
-version = "3.13.106"
+version = "3.13.108"
 description = "Tina4 Python v3 — Zero-dependency, lightweight web framework"
 authors = [
     {name = "Andre van Zuydam", email = "andrevanzuydam@gmail.com"}

{tina4_python-3.13.106 → tina4_python-3.13.108}/tina4_python/__init__.py

@@ -51,7 +51,7 @@ def _resolve_version() -> str:
     #
     # test_version_constant.py now asserts this literal equals the pyproject
     # version, so the release bump cannot leave it behind again.
-    return "3.13.106"
+    return "3.13.108"
 
 
 __version__ = _resolve_version()
@@ -71,7 +71,7 @@ __version__ = _resolve_version()
 # ── CORE (always eager) — every app needs these to boot + serve ──
 from tina4_python.core.router import (  # noqa: E402, F401
     get, post, put, patch, delete, any_method,
-    noauth, secured, cached, middleware, template,
+    noauth, secured, role, can, cached, middleware, template,
     Router, RouteGroup,
 )
 # websocket is not in that tuple. The tina4_python.websocket *subpackage* is

{tina4_python-3.13.106 → tina4_python-3.13.108}/tina4_python/cache/__init__.py

@@ -1190,6 +1190,17 @@ def _vary_fields(response) -> list:
     return [f.strip().lower() for f in raw.split(",") if f.strip()]
 
 
+def _cache_control_tokens(carrier) -> set:
+    """The Cache-Control directive names on a request or response, lowercased.
+
+    Parsed as comma-separated tokens with any ``=value`` stripped, rather than by
+    substring search, so ``no-cache="Set-Cookie"`` is recognised as ``no-cache``
+    and a directive name never matches as a fragment of a longer one.
+    """
+    raw = _header_value(carrier, "Cache-Control") or ""
+    return {token.split("=", 1)[0].strip().lower() for token in raw.split(",") if token.strip()}
+
+
 def _shared_cache_allowed(response) -> bool:
     """Does the response carry a directive that lets a shared cache store it?"""
     cc = (_header_value(response, "Cache-Control") or "").lower()
@@ -1373,11 +1384,35 @@ class ResponseCache:
           URL, because the key is method + URL only.
         * s4.1 — "A stored response with a Vary header field value containing a
           member '*' always fails to match", so storing one is pointless.
+
+        The same s3 reasoning applies to two cases the Authorization check alone
+        does not cover, and both were storable before 3.13.108:
+
+        * ``no-store`` forbids storage in any cache and ``private`` forbids it in
+          a shared one. Neither was honoured, so a handler had no way at all to
+          keep a response out of this cache — setting the correct standard header
+          did nothing.
+        * A caller identified by a session cookie is as specific as one carrying
+          Authorization, and Tina4's own session mechanism IS a cookie. Because
+          the key is method + URL, storing such a response replays one signed-in
+          user's page to whoever asks for that URL next. A response that installs
+          a session is per-user by construction for the same reason.
+
+        Both cookie cases stay cacheable when the response opts in explicitly with
+        a shared-cache directive, which is how a genuinely public page served to
+        cookie-bearing browsers keeps its hit rate.
         """
         if "*" in _vary_fields(response):
             return False
+        directives = _cache_control_tokens(response)
+        if directives & {"no-store", "private", "no-cache"}:
+            return False
         if _header_value(request, "Authorization") is not None:
             return _shared_cache_allowed(response)
+        if _header_value(request, "Cookie") is not None:
+            return _shared_cache_allowed(response)
+        if _header_value(response, "Set-Cookie") is not None:
+            return _shared_cache_allowed(response)
         return True
 
     @staticmethod

{tina4_python-3.13.106 → tina4_python-3.13.108}/tina4_python/core/router.py

@@ -50,6 +50,24 @@ class RouteRef:
         self._route["auth_required"] = False
         return self
 
+    def role(self, *names):
+        """Require the caller to hold ONE of the named roles (OR). Reads the
+        verified JWT ``roles`` claim. Implies auth (a guarded GET still needs a
+        token). Stack ``.role()``/``.can()`` for AND. Feature 138 / ADR-0058."""
+        if names:
+            self._route.setdefault("required_roles", []).append(tuple(names))
+            self._route["auth_required"] = True
+        return self
+
+    def can(self, *permissions):
+        """Require the caller to hold ONE of the named permissions (OR). Reads
+        the verified JWT ``permissions`` claim; granted-side wildcards (``posts.*``,
+        ``*``) satisfy a concrete requirement. Implies auth. Feature 138."""
+        if permissions:
+            self._route.setdefault("required_perms", []).append(tuple(permissions))
+            self._route["auth_required"] = True
+        return self
+
     def cache(self):
         """Mark this route as cacheable."""
         self._route["cached"] = True
@@ -371,6 +389,12 @@ class Router:
             auth_required = False
         elif hasattr(handler, "_secured"):
             auth_required = True
+        elif hasattr(handler, "_required_roles") or hasattr(handler, "_required_perms"):
+            # A role/permission guard (Feature 138) implies auth — a guarded GET
+            # still requires a token. This branch only fires in the unusual
+            # innermost-order case (guard BELOW @get); the documented order puts
+            # the guard ABOVE, where it flips auth_required via the RouteRef.
+            auth_required = True
         else:
             # GET, HEAD, OPTIONS, and ANY are public by default. HEAD and
             # OPTIONS are safe/idempotent introspection methods (RFC 9110
@@ -392,6 +416,11 @@ class Router:
             "module": getattr(handler, "__module__", ""),
             "middleware": effective_middleware,
             "auth_required": auth_required,
+            # RBAC guards (Feature 138): lists of OR-groups; AND across groups.
+            # Populated here for the innermost-order case, and appended to by the
+            # RouteRef.role()/.can() modifiers for the documented guard-above order.
+            "required_roles": list(getattr(handler, "_required_roles", []) or []),
+            "required_perms": list(getattr(handler, "_required_perms", []) or []),
             "cached": options.get("cached", False),
             "cache_max_age": options.get("cache_max_age", 60),
             "swagger_meta": swagger_meta or options.get("swagger_meta", {}),
@@ -862,6 +891,121 @@ def secured():
     return decorator
 
 
+# ── RBAC guards (Feature 138 / ADR-0058) ──────────────────────
+# Claim-first authorization on top of the JWT auth gate. @role reads the verified
+# `roles` claim, @can reads `permissions`. Multiple args are OR; stack guards for
+# AND. A guard implies @secured. Roles and permissions are independent claims;
+# the core never expands a role into permissions.
+
+def role(*names):
+    """Require the caller to hold ONE of the named roles (OR). Stack
+    ``@role``/``@can`` for AND. Reads the verified JWT ``roles`` claim (a legacy
+    singular ``role`` string is coerced). Implies ``@secured``."""
+    group = tuple(names)
+
+    def decorator(fn):
+        fn._required_roles = getattr(fn, "_required_roles", []) + [group]
+        if hasattr(fn, "_route_ref"):
+            route = fn._route_ref._route
+            route.setdefault("required_roles", []).append(group)
+            was_public = not route.get("auth_required", True)
+            route["auth_required"] = True
+            if was_public:
+                Log.debug(
+                    f"Route auth updated: {route['method']} {route['path']} "
+                    f"(auth=required via @role)"
+                )
+        return fn
+    return decorator
+
+
+def can(*permissions):
+    """Require the caller to hold ONE of the named permissions (OR). Stack
+    ``@role``/``@can`` for AND. Reads the verified JWT ``permissions`` claim;
+    granted-side wildcards (``posts.*``, ``*``) satisfy a concrete requirement.
+    Implies ``@secured``."""
+    group = tuple(permissions)
+
+    def decorator(fn):
+        fn._required_perms = getattr(fn, "_required_perms", []) + [group]
+        if hasattr(fn, "_route_ref"):
+            route = fn._route_ref._route
+            route.setdefault("required_perms", []).append(group)
+            was_public = not route.get("auth_required", True)
+            route["auth_required"] = True
+            if was_public:
+                Log.debug(
+                    f"Route auth updated: {route['method']} {route['path']} "
+                    f"(auth=required via @can)"
+                )
+        return fn
+    return decorator
+
+
+def _rbac_claim_list(subject, key, legacy=None):
+    """Read a claim as a list of strings from the VERIFIED payload. Coerces a
+    legacy singular string (``role`` -> ``["role"]``). Returns ``[]`` for a
+    missing/None subject or claim."""
+    if not isinstance(subject, dict):
+        return []
+    val = subject.get(key)
+    out = []
+    if isinstance(val, str) and val:
+        out = [val]
+    elif isinstance(val, (list, tuple)):
+        out = [str(x) for x in val if x is not None and str(x) != ""]
+    if not out and legacy:
+        lv = subject.get(legacy)
+        if isinstance(lv, str) and lv:
+            out = [lv]
+        elif isinstance(lv, (list, tuple)):
+            out = [str(x) for x in lv if x is not None and str(x) != ""]
+    return out
+
+
+def _rbac_perm_granted(granted, required):
+    """True if any GRANTED permission satisfies the concrete REQUIRED permission.
+    Wildcards live only on the granted side: ``*`` grants everything; ``posts.*``
+    grants ``posts.<anything...>`` on the dot boundary (never ``users.delete``)."""
+    for g in granted:
+        if g == "*" or g == required:
+            return True
+        if g.endswith(".*") and required.startswith(g[:-1]):
+            return True
+    return False
+
+
+def rbac_authorized(subject, required_roles, required_perms):
+    """Return True if the verified ``subject`` satisfies every guard group.
+
+    AND across groups, OR within a group. ``required_roles`` / ``required_perms``
+    are lists of OR-groups (each ``@role``/``@can`` adds one group). Roles read
+    the ``roles`` claim (legacy singular ``role`` coerced); permissions read
+    ``permissions`` with granted-side wildcards. A missing subject satisfies no
+    group. Feature 138 / ADR-0058."""
+    # NOTE: explicit loops, NOT any(...): this module shadows the builtin `any`
+    # (a route helper), so `any(...)` here would resolve to the wrong callable.
+    roles = _rbac_claim_list(subject, "roles", legacy="role")
+    for group in (required_roles or []):
+        matched = False
+        for r in group:
+            if r in roles:
+                matched = True
+                break
+        if not matched:
+            return False
+    perms = _rbac_claim_list(subject, "permissions")
+    for group in (required_perms or []):
+        matched = False
+        for req in group:
+            if _rbac_perm_granted(perms, req):
+                matched = True
+                break
+        if not matched:
+            return False
+    return True
+
+
 # ── Middleware Decorator ───────────────────────────────────────
 
 def middleware(*middleware_classes):

{tina4_python-3.13.106 → tina4_python-3.13.108}/tina4_python/core/server.py

@@ -1804,6 +1804,22 @@ def _check_auth(request: Request, response: Response, route: dict) -> bool:
             "status": 401,
         })
         return True
+    # ── RBAC guards (Feature 138): authorization AFTER authentication ──
+    # Auth passed (401 already ruled out above). If the route carries role/
+    # permission guards, the verified payload (request.user) must satisfy them,
+    # else 403 — authenticated but forbidden. An API-key auth leaves request.user
+    # unset, so it carries no roles and is correctly forbidden from a guarded route.
+    _req_roles = route.get("required_roles") or []
+    _req_perms = route.get("required_perms") or []
+    if _req_roles or _req_perms:
+        from tina4_python.core.router import rbac_authorized
+        if not rbac_authorized(getattr(request, "user", None), _req_roles, _req_perms):
+            response.status(403).json({
+                "error": "Forbidden",
+                "message": "You do not have permission to access this resource",
+                "status": 403,
+            })
+            return True
     return False
 
 

{tina4_python-3.13.106 → tina4_python-3.13.108}/tina4_python/database/adapter.py

@@ -62,16 +62,41 @@ def resolve_connect_timeout() -> float | None:
 
 
 def driver_connect_timeout_seconds(seconds: float | None) -> int | None:
-    """A driver's own connect-timeout option value, rounded UP to whole seconds.
+    """A driver's own connect-timeout option, in whole seconds, STRICTLY longer
+    than the bound it protects.
 
     Every driver option here (libpq ``connect_timeout``, mysql-connector
     ``connection_timeout``, pymssql ``login_timeout``, pyodbc ``timeout``) is
-    whole seconds. Rounding UP matters: a driver that fired EARLY — at 2s for a
-    configured 2.5s — would raise its own raw error before our bound was
-    reached, and the caller would see a bare driver message instead of one
-    naming the variable that caused it.
+    whole seconds, so the bound has to become an integer — and which integer
+    decides whether the driver's deadline lands after ours or on top of it.
+    ``ceil`` put it on top: for a whole-second bound ``ceil(N) == N``, and the
+    shipped default of 10 is whole. ``floor(s) + 1`` is strictly greater for
+    every input, fractional or whole, which is what leaves the driver's own
+    timer the room to fire first — the thing this wrapper is built on. The
+    cost is at most one extra second, on a path that has already failed.
     """
-    return None if seconds is None else max(1, math.ceil(seconds))
+    return None if seconds is None else max(1, math.floor(seconds) + 1)
+
+
+def bound_was_reached(elapsed_monotonic: float, elapsed_realtime: float,
+                      seconds: float | None) -> bool:
+    """Did a connect that failed take at least the configured bound?
+
+    Two readings, because the framework and the driver do not share a clock.
+    :func:`connect_deadline` times on ``time.monotonic()``; libpq times its own
+    ``connect_timeout`` on ``gettimeofday()``. NTP moves the wall clock and
+    never touches the monotonic one, so a forward step or slew can make the
+    driver abort before a monotonic reading has reached the bound.
+
+    Taking the LARGER of the two readings covers both directions: the realtime
+    reading catches a forward jump, and keeping the monotonic reading means a
+    BACKWARD jump cannot hide a timeout that really did happen.
+
+    Pure, so the decision is testable without faking a clock.
+    """
+    if seconds is None:
+        return False
+    return max(elapsed_monotonic, elapsed_realtime) >= seconds
 
 
 @contextlib.contextmanager
@@ -105,19 +130,39 @@ def connect_deadline(host, port):
     throws away the driver's own diagnosis, and for the watchdog adapters it
     would abandon a thread the driver could have unwound itself.
 
-    The invariant that makes this work: the driver's option is always >= our
-    bound (:func:`driver_connect_timeout_seconds` rounds UP), and our clock
-    starts BEFORE the call, so the driver's own timeout cannot expire before
-    ``elapsed`` has reached our bound. Break either half and a bare driver
-    message reaches the caller instead of ours.
+    THE INVARIANT, AND WHY IT TAKES TWO CLOCKS
+    ------------------------------------------
+    What decides the race is not the driver's OPTION against our bound — it
+    is the driver's ABORT INSTANT against our reading of a clock. Two things
+    have to hold, and each of them was broken:
+
+    * The driver's option must be STRICTLY greater than our bound, so its
+      deadline lands after ours instead of on top of it.
+      :func:`driver_connect_timeout_seconds` returns ``floor(s) + 1`` for that
+      reason; ``ceil`` left a whole-second bound with no separation at all, and
+      the default bound is a whole number.
+
+    * The comparison has to be made on the clock the DRIVER used. libpq times
+      ``connect_timeout`` with ``gettimeofday()`` — CLOCK_REALTIME — while a
+      duration in Python belongs on ``time.monotonic()``. NTP slews and steps
+      realtime and never touches monotonic, so a monotonic reading can still
+      sit below the bound at the instant the driver has already given up, and
+      then the driver's own message — which names no tunable — reaches
+      the caller. :func:`bound_was_reached` compares both readings.
+
+    Break either half and a bare driver message reaches the caller instead of
+    ours.
     """
     seconds = resolve_connect_timeout()
     started = time.monotonic()
+    started_realtime = time.time()
     try:
         yield seconds
     except Exception as failure:
-        elapsed = time.monotonic() - started
-        if seconds is not None and elapsed >= seconds:
+        elapsed_monotonic = time.monotonic() - started
+        elapsed_realtime = time.time() - started_realtime
+        elapsed = max(elapsed_monotonic, elapsed_realtime)
+        if bound_was_reached(elapsed_monotonic, elapsed_realtime, seconds):
             raise DatabaseConnectTimeout(
                 f"Database connect to {host}:{port} timed out after {elapsed:.1f}s "
                 f"({CONNECT_TIMEOUT_VARIABLE}={seconds:g} seconds). "

tina4_python-3.13.108/tina4_python/public/js/tina4js.min.js

@@ -0,0 +1,48 @@
+"use strict";var Tina4=(()=>{var ee=Object.defineProperty;var Xe=Object.getOwnPropertyDescriptor;var Ye=Object.getOwnPropertyNames;var et=Object.prototype.hasOwnProperty;var tt=(e,n)=>{for(var t in n)ee(e,t,{get:n[t],enumerable:!0})},nt=(e,n,t,r)=>{if(n&&typeof n=="object"||typeof n=="function")for(let o of Ye(n))!et.call(e,o)&&o!==t&&ee(e,o,{get:()=>n[o],enumerable:!(r=Xe(n,o))||r.enumerable});return e};var rt=e=>nt(ee({},"__esModule",{value:!0}),e);var $t={};tt($t,{Tina4Element:()=>N,api:()=>Ae,batch:()=>G,clearPersistedKeys:()=>Ve,computed:()=>ye,createI18n:()=>de,effect:()=>E,html:()=>be,i18n:()=>Je,isSignal:()=>I,navigate:()=>Q,persist:()=>ze,pwa:()=>Ne,route:()=>_e,router:()=>xe,rtc:()=>De,rtcConfig:()=>X,signal:()=>w,sse:()=>Pe,ws:()=>K});var L=null,H=null,U=null,B=null;function O(e){B=e}function J(){return B}var me=null,he=null,ve=[],ot=512;var V=0,te=new Set;function w(e,n){let t=e,r=new Set,o={_t4:!0,get value(){if(L&&(r.add(L),H)){let s=L;H.push(()=>r.delete(s))}return t},set value(s){if(Object.is(s,t))return;let i=t;if(t=s,o._debugInfo&&o._debugInfo.updateCount++,he&&he(o,i,s),V>0)for(let c of r)te.add(c);else{let c;for(let a of[...r])try{a()}catch(l){c===void 0&&(c=l)}if(c!==void 0)throw c}},_subscribe(s){return r.add(s),()=>{r.delete(s)}},peek(){return t}};return me?(o._debugInfo={label:n,createdAt:Date.now(),updateCount:0,subs:r},me(o,n)):ve.length<ot&&ve.push({ref:new WeakRef(o),label:n,createdAt:Date.now(),subs:r}),o}function ye(e){let n=w(void 0);return E(()=>{n.value=e()}),{_t4:!0,get value(){return n.value},set value(t){throw new Error("[tina4] computed signals are read-only")},_subscribe(t){return n._subscribe(t)},peek(){return n.peek()}}}function E(e){let n=!1,t=[],r=[],o=()=>{for(let c of r)c();r=[]},s=()=>{if(n)return;for(let g of t)g();t=[],o();let c=L,a=H,l=U;L=s,H=t,U=r;try{e()}finally{L=c,H=a,U=l}};s();let i=()=>{n=!0;for(let c of t)c();t=[],o()};return U&&U.push(i),B&&B.push(i),i}function G(e){V++;try{e()}finally{if(V--,V===0){let n=[...te];te.clear();let t;for(let r of n)try{r()}catch(o){t===void 0&&(t=o)}if(t!==void 0)throw t}}}function I(e){return e!==null&&typeof e=="object"&&e._t4===!0}var Se=new WeakMap,ne="t4:";function be(e,...n){let t=Se.get(e);if(!t){let i=document.createElement("template"),c=new Map,a="";for(let l=0;l<e.length;l++)if(a+=e[l],l<n.length)if(dt(a)){let m=ut(e[l]);m&&c.set(l,m),a+=`__t4_${l}__`}else a+=`<!--${ne}${l}-->`;i.innerHTML=a,t={template:i,propertyNames:c},Se.set(e,t)}let r=t.template.content.cloneNode(!0),o=st(r);for(let{marker:i,index:c}of o)at(i,n[c]);let s=it(r);for(let i of s)ct(i,n,t.propertyNames);return r}function st(e){let n=[];return se(e,t=>{if(t.nodeType===8){let r=t.data;if(r&&r.startsWith(ne)){let o=parseInt(r.slice(ne.length),10);n.push({marker:t,index:o})}}}),n}function it(e){let n=[];return se(e,t=>{t.nodeType===1&&n.push(t)}),n}function se(e,n){let t=e.childNodes;for(let r=0;r<t.length;r++){let o=t[r];n(o),se(o,n)}}function at(e,n){let t=e.parentNode;if(t)if(I(n)){let r=document.createTextNode("");t.replaceChild(r,e),E(()=>{r.data=String(n.value??"")})}else if(typeof n=="function"){let r=document.createComment("");t.replaceChild(r,e);let o=[],s=[];E(()=>{for(let u of s)u();s=[];let i=[],c=J();O(i);let a=n();O(c),s=i;for(let u of o)u.parentNode?.removeChild(u);o=[];let l=oe(a),g=r.parentNode;if(!g)return;let m=Z(g);for(let u of l){let d=m?D(u,m):u;g.insertBefore(d,r),o.push(d)}})}else if(Te(n)){let r=Z(t);if(r){let o=document.createDocumentFragment();for(let s of Array.from(n.childNodes))o.appendChild(D(s,r));t.replaceChild(o,e)}else t.replaceChild(n,e)}else if(n instanceof Node){let r=Z(t);t.replaceChild(r?D(n,r):n,e)}else if(Array.isArray(n)){let r=Z(t),o=document.createDocumentFragment();for(let s of n){let i=oe(s);for(let c of i)o.appendChild(r?D(c,r):c)}t.replaceChild(o,e)}else{let r=document.createTextNode(String(n??""));t.replaceChild(r,e)}}function ct(e,n,t){let r=[];for(let o of Array.from(e.attributes)){let s=o.name,i=o.value;if(s.startsWith("@")){let a=s.slice(1),l=i.match(/__t4_(\d+)__/);if(l){let g=n[parseInt(l[1],10)];typeof g=="function"&&e.addEventListener(a,m=>G(()=>g(m)))}r.push(s);continue}if(s.startsWith("?")){let a=s.slice(1),l=i.match(/__t4_(\d+)__/);if(l){let g=n[parseInt(l[1],10)];if(I(g)){let m=g;E(()=>{m.value?e.setAttribute(a,""):e.removeAttribute(a)})}else typeof g=="function"?E(()=>{g()?e.setAttribute(a,""):e.removeAttribute(a)}):g&&e.setAttribute(a,"")}r.push(s);continue}if(s.startsWith(".")){let a=i.match(/__t4_(\d+)__/);if(a){let l=parseInt(a[1],10),g=t.get(l)??s.slice(1),m=n[l];I(m)?E(()=>{e[g]=m.value}):typeof m=="function"?E(()=>{e[g]=m()??""}):e[g]=m}r.push(s);continue}let c=i.match(/__t4_(\d+)__/);if(c){let a=n[parseInt(c[1],10)];if(I(a)){let l=a;E(()=>{e.setAttribute(s,String(l.value??""))})}else typeof a=="function"?E(()=>{e.setAttribute(s,String(a()??""))}):e.setAttribute(s,String(a??""))}}for(let o of r)e.removeAttribute(o)}var re="http://www.w3.org/2000/svg",lt="http://www.w3.org/1998/Math/MathML",we="http://www.w3.org/1999/xhtml";function Z(e){let n=e;for(;n&&n.nodeType===1;){let t=n,r=t.namespaceURI;if(r===re&&t.localName==="foreignObject")return null;if(r===re||r===lt)return r;if(r===we)return null;n=n.parentNode}return null}function D(e,n){if(e.nodeType!==1)return e;let t=e;if(t.namespaceURI===n){for(let s of Array.from(t.childNodes)){let i=D(s,n);i!==s&&t.replaceChild(i,s)}return t}let r=document.createElementNS(n,t.localName);for(let s of Array.from(t.attributes))r.setAttribute(s.name,s.value);let o=n===re&&t.localName==="foreignObject"?we:n;for(let s of Array.from(t.childNodes))r.appendChild(D(s,o));return r}function ut(e){return e.match(/\.([^\s"'<>/=]+)\s*=\s*["']?$/)?.[1]}function oe(e){if(e==null||e===!1)return[];if(Te(e))return Array.from(e.childNodes);if(e instanceof Node)return[e];if(Array.isArray(e)){let n=[];for(let t of e)n.push(...oe(t));return n}return[document.createTextNode(String(e))]}function Te(e){return e!=null&&typeof e=="object"&&e.nodeType===11}function dt(e){let n=!1,t=!1,r=!1;for(let o=0;o<e.length;o++){if(!r&&e.startsWith("<!--",o)){let i=e.indexOf("-->",o+4);if(i===-1)return!1;o=i+2;continue}let s=e[o];s==="<"&&!n&&!t&&(r=!0),s===">"&&!n&&!t&&(r=!1),r&&(s==='"'&&!n&&(t=!t),s==="'"&&!t&&(n=!n))}return r}var ke=null,Ce=null;var N=class extends HTMLElement{constructor(){super();this._props={};this._rendered=!1;this._disposeRender=null;this._innerDisposers=[];let t=this.constructor;this._root=t.shadow?this.attachShadow({mode:"open"}):this;for(let[r,o]of Object.entries(t.props))this._props[r]=w(this._coerce(this.getAttribute(r),o))}static get observedAttributes(){return Object.keys(this.props)}connectedCallback(){if(this._rendered)return;this._rendered=!0;let t=this.constructor,r=null;if(t.styles&&t.shadow&&this._root instanceof ShadowRoot){let o=document.createElement("style");o.textContent=t.styles,this._root.appendChild(o),r=o}this._disposeRender=E(()=>{this._innerDisposers.splice(0).forEach(a=>a());let o=[],s=J();O(o);let i=this.render();O(s),this._innerDisposers=o;let c=Array.from(this._root.childNodes);for(let a of c)a!==r&&this._root.removeChild(a);i&&this._root.appendChild(i)}),this.onMount(),ke&&ke(this)}disconnectedCallback(){this._disposeRender&&(this._disposeRender(),this._disposeRender=null),this._innerDisposers.splice(0).forEach(t=>t()),this.onUnmount(),Ce&&Ce(this)}attributeChangedCallback(t,r,o){let i=this.constructor.props[t];i&&this._props[t]&&(this._props[t].value=this._coerce(o,i))}prop(t){if(!this._props[t])throw new Error(`[tina4] Prop '${t}' not declared in static props of <${this.tagName.toLowerCase()}>`);return this._props[t]}emit(t,r){this.dispatchEvent(new CustomEvent(t,{bubbles:!0,composed:!0,...r}))}onMount(){}onUnmount(){}_coerce(t,r){return r===Boolean?t!==null:r===Number?t!==null?Number(t):0:t??""}};N.props={},N.styles="",N.shadow=!0;var ae=[],F=null,j="history",ft=!1,W=[],ie=[],Ee=0;function _e(e,n){let t=[],r;e==="*"?r=".*":r=e.replace(/\{(\w+)\}/g,(s,i)=>(t.push(i),"([^/]+)"));let o=new RegExp(`^${r}$`);typeof n=="function"?ae.push({pattern:e,regex:o,paramNames:t,handler:n}):ae.push({pattern:e,regex:o,paramNames:t,handler:n.handler,guard:n.guard})}function Q(e,n){if(j==="hash")if(n?.replace){let t=new URL(location.href);t.hash="#"+e,history.replaceState(null,"",t.toString()),$()}else{let t=new URL(location.href);t.hash="#"+e,history.pushState(null,"",t.toString()),$()}else n?.replace?history.replaceState(null,"",e):history.pushState(null,"",e),$()}function $(){if(!F)return;let e=performance.now(),n=++Ee,t=j==="hash"?location.hash.slice(1)||"/":location.pathname;for(let r of ae){let o=t.match(r.regex);if(!o)continue;let s={};if(r.paramNames.forEach((a,l)=>{s[a]=decodeURIComponent(o[l+1])}),r.guard){let a=r.guard();if(a===!1)return;if(typeof a=="string"){Q(a,{replace:!0});return}}ie.splice(0).forEach(a=>a()),F.innerHTML="";let i=[];O(i);let c=r.handler(s);if(c instanceof Promise)c.then(a=>{if(O(null),n!==Ee){for(let g of i)g();return}Re(F,a),ie=i;let l=performance.now()-e;for(let g of W)g({path:t,params:s,pattern:r.pattern,durationMs:l})});else{O(null),Re(F,c),ie=i;let a=performance.now()-e;for(let l of W)l({path:t,params:s,pattern:r.pattern,durationMs:a})}return}}function Re(e,n){n instanceof DocumentFragment||n instanceof Node?e.replaceChildren(n):typeof n=="string"?e.innerHTML=n:n!=null&&e.replaceChildren(document.createTextNode(String(n)))}var xe={start(e){if(F=document.querySelector(e.target),!F)throw new Error(`[tina4] Router target '${e.target}' not found in DOM`);j=e.mode??"history",ft=!0,window.addEventListener("popstate",$),j==="hash"&&window.addEventListener("hashchange",$),document.addEventListener("click",n=>{if(n.metaKey||n.ctrlKey||n.shiftKey||n.altKey)return;let t=n.target.closest("a[href]");if(!t||t.origin!==location.origin||t.hasAttribute("target")||t.hasAttribute("download")||t.getAttribute("rel")?.includes("external"))return;n.preventDefault();let r=j==="hash"?t.getAttribute("href"):t.pathname;Q(r)}),$()},on(e,n){return W.push(n),()=>{let t=W.indexOf(n);t>=0&&W.splice(t,1)}}};var _={baseUrl:"",auth:!1,tokenKey:"tina4_token",headers:{}},ce=[],le=[],gt=0;function ue(){try{return localStorage.getItem(_.tokenKey)}catch{return null}}function pt(e){try{localStorage.setItem(_.tokenKey,e)}catch{}}function Me(e,n){let t=Object.entries(n).map(([r,o])=>`${encodeURIComponent(r)}=${encodeURIComponent(String(o))}`).join("&");return e+(e.includes("?")?"&":"?")+t}async function Oe(e,n){e._url=n,e._requestId=++gt;for(let c of ce){let a=c(e);a&&(e=a)}let t=await fetch(n,e),r=t.headers.get("FreshToken");r&&pt(r);let o=t.headers.get("Content-Type")??"",s;o.includes("json")?s=await t.json():s=await t.text();let i={status:t.status,data:s,ok:t.ok,headers:t.headers,_requestId:e._requestId};for(let c of le){let a=c(i);a&&(i=a)}if(!t.ok)throw i;return i.data}async function q(e,n,t,r){let o={method:e,credentials:"same-origin",headers:{"Content-Type":"application/json",..._.headers}};if(_.auth){let s=ue();s&&(o.headers.Authorization=`Bearer ${s}`)}if(t!==void 0&&e!=="GET"){let s=typeof t=="object"&&t!==null?{...t}:t;if(_.auth&&typeof s=="object"&&s!==null){let i=ue();i&&(s.formToken=i)}o.body=JSON.stringify(s)}return r?.headers&&Object.assign(o.headers,r.headers),r?.params&&(n=Me(n,r.params)),Oe(o,_.baseUrl+n)}var Ae={configure(e){Object.assign(_,e)},get(e,n){return q("GET",e,void 0,n)},post(e,n,t){return q("POST",e,n,t)},put(e,n,t){return q("PUT",e,n,t)},patch(e,n,t){return q("PATCH",e,n,t)},delete(e,n){return q("DELETE",e,void 0,n)},async graphql(e,n,t,r){return q("POST",e,{query:n,variables:t||{}},r)},async upload(e,n,t){let r={method:"POST",headers:{..._.headers},body:n};if(delete r.headers["Content-Type"],delete r.headers["content-type"],_.auth){let o=ue();o&&(r.headers.Authorization=`Bearer ${o}`)}return t?.headers&&Object.assign(r.headers,t.headers),t?.params&&(e=Me(e,t.params)),Oe(r,_.baseUrl+e)},intercept(e,n){e==="request"?ce.push(n):le.push(n)},_reset(){_.baseUrl="",_.auth=!1,_.tokenKey="tina4_token",_.headers={},ce.length=0,le.length=0}};function mt(e){let n=e.cacheStrategy??"network-first",t=JSON.stringify(e.precache??[]),r=e.offlineRoute?`'${e.offlineRoute}'`:"null";return`
+const CACHE = 'tina4-v1';
+const PRECACHE = ${t};
+const OFFLINE = ${r};
+
+self.addEventListener('install', (e) => {
+  e.waitUntil(
+    caches.open(CACHE).then((c) => c.addAll(PRECACHE)).then(() => self.skipWaiting())
+  );
+});
+
+self.addEventListener('activate', (e) => {
+  e.waitUntil(self.clients.claim());
+});
+
+self.addEventListener('fetch', (e) => {
+  const req = e.request;
+  if (req.method !== 'GET') return;
+
+  ${n==="cache-first"?`
+  e.respondWith(
+    caches.match(req).then((cached) => cached || fetch(req).then((res) => {
+      const clone = res.clone();
+      caches.open(CACHE).then((c) => c.put(req, clone));
+      return res;
+    })).catch(() => OFFLINE ? caches.match(OFFLINE) : new Response('Offline', { status: 503 }))
+  );`:n==="stale-while-revalidate"?`
+  e.respondWith(
+    caches.match(req).then((cached) => {
+      const fetched = fetch(req).then((res) => {
+        caches.open(CACHE).then((c) => c.put(req, res.clone()));
+        return res;
+      });
+      return cached || fetched;
+    }).catch(() => OFFLINE ? caches.match(OFFLINE) : new Response('Offline', { status: 503 }))
+  );`:`
+  e.respondWith(
+    fetch(req).then((res) => {
+      const clone = res.clone();
+      caches.open(CACHE).then((c) => c.put(req, clone));
+      return res;
+    }).catch(() => caches.match(req).then((cached) =>
+      cached || (OFFLINE ? caches.match(OFFLINE) : new Response('Offline', { status: 503 }))
+    ))
+  );`}
+});
+`.trim()}function Ie(e){let n={name:e.name,short_name:e.shortName??e.name,start_url:"/",display:e.display??"standalone",background_color:e.backgroundColor??"#ffffff",theme_color:e.themeColor??"#000000"};return e.icon&&(n.icons=[{src:e.icon,sizes:"192x192",type:"image/png"},{src:e.icon,sizes:"512x512",type:"image/png"}]),n}var Ne={register(e){let n=Ie(e),t=new Blob([JSON.stringify(n)],{type:"application/json"}),r=document.createElement("link");r.rel="manifest",r.href=URL.createObjectURL(t),document.head.appendChild(r);let o=document.querySelector('meta[name="theme-color"]');o||(o=document.createElement("meta"),o.name="theme-color",document.head.appendChild(o)),o.content=e.themeColor??"#000000","serviceWorker"in navigator&&(e.swUrl?navigator.serviceWorker.register(e.swUrl).catch(s=>{console.warn("[tina4] Service worker registration failed:",s)}):navigator.serviceWorker.register("/sw.js").catch(()=>{console.info("[tina4] No service worker at /sw.js. Use pwa.generateServiceWorker() to create one, or pass swUrl in config.")}))},generateServiceWorker(e){return mt(e)},generateManifest(e){return Ie(e)}};var ht={reconnect:!0,reconnectDelay:1e3,reconnectMaxDelay:3e4,reconnectAttempts:1/0,protocols:[],token:""};function vt(e){let n=Array.isArray(e.protocols)?e.protocols:e.protocols?[e.protocols]:[];return e.token?["bearer",e.token,...n]:e.protocols}function yt(e,n={}){let t={...ht,...n},r=w("connecting"),o=w(!1),s=w(null),i=w(null),c=w(0),a={message:[],open:[],close:[],error:[]},l=null,g=!1,m=t.reconnectDelay,u=null,d=0;function f(v){if(typeof v!="string")return v;try{return JSON.parse(v)}catch{return v}}function h(){r.value=d>0?"reconnecting":"connecting";try{l=new WebSocket(e,vt(t))}catch{r.value="closed",o.value=!1;return}l.onopen=()=>{r.value="open",o.value=!0,i.value=null,d=0,m=t.reconnectDelay,c.value=0;for(let v of a.open)v()},l.onmessage=v=>{let T=f(v.data);s.value=T;for(let R of a.message)R(T)},l.onclose=v=>{r.value="closed",o.value=!1;for(let T of a.close)T(v.code,v.reason);!g&&t.reconnect&&d<t.reconnectAttempts&&x()},l.onerror=v=>{i.value=v;for(let T of a.error)T(v)}}function x(){d++,c.value=d,r.value="reconnecting",u=setTimeout(()=>{u=null,h()},m),m=Math.min(m*2,t.reconnectMaxDelay)}let C={status:r,connected:o,lastMessage:s,error:i,reconnectCount:c,send(v){if(!l||l.readyState!==WebSocket.OPEN)throw new Error("[tina4] WebSocket is not connected");let T=typeof v=="string"?v:JSON.stringify(v);l.send(T)},on(v,T){return a[v].push(T),()=>{let R=a[v],A=R.indexOf(T);A>=0&&R.splice(A,1)}},pipe(v,T){let R=A=>{v.value=T(A,v.value)};return C.on("message",R)},close(v,T){g=!0,u&&(clearTimeout(u),u=null),l&&l.close(v??1e3,T??""),r.value="closed",o.value=!1}};return h(),C}var K={connect:yt};var St={mode:"eventsource",method:"GET",headers:{},body:void 0,reconnect:!0,reconnectDelay:1e3,reconnectMaxDelay:3e4,reconnectAttempts:1/0,events:[],json:!0};function bt(e,n={}){let t={...St,...n},r=w("connecting"),o=w(!1),s=w(null),i=w(null),c=w(null),a=w(0),l={message:[],open:[],close:[],error:[]},g=null,m=null,u=!1,d=t.reconnectDelay,f=null,h=0;function x(p){if(!t.json||typeof p!="string")return p;try{return JSON.parse(p)}catch{return p}}function C(p,S){s.value=p,i.value=S;for(let k of l.message)k(p,S??void 0)}function v(){r.value="open",o.value=!0,c.value=null,h=0,d=t.reconnectDelay,a.value=0;for(let p of l.open)p()}function T(){r.value="closed",o.value=!1;for(let p of l.close)p();!u&&t.reconnect&&h<t.reconnectAttempts&&Y()}function R(p){c.value=p;for(let S of l.error)S(p)}function A(){r.value=h>0?"reconnecting":"connecting";try{g=new EventSource(e)}catch{r.value="closed",o.value=!1;return}g.onopen=()=>v(),g.onmessage=p=>{C(x(p.data),null)};for(let p of t.events)g.addEventListener(p,S=>{C(x(S.data),p)});g.onerror=p=>{R(p),g&&g.readyState===2&&(g=null,T())}}function z(){r.value=h>0?"reconnecting":"connecting",m=new AbortController;let p={method:t.method,headers:t.headers,signal:m.signal};t.body!==void 0&&(p.body=typeof t.body=="string"?t.body:JSON.stringify(t.body)),fetch(e,p).then(async S=>{if(!S.ok){R(new Error(`[tina4] SSE fetch ${S.status}`)),T();return}v();let k=S.body.getReader(),M=new TextDecoder,P="";for(;;){let{done:Ge,value:Ze}=await k.read();if(Ge)break;P+=M.decode(Ze,{stream:!0});let ge=P.split(`
+`);P=ge.pop();for(let Qe of ge){let pe=Qe.trim();pe&&C(x(pe),null)}}let fe=P.trim();fe&&C(x(fe),null),m=null,T()}).catch(S=>{S.name!=="AbortError"&&(m=null,R(S),T())})}function Y(){h++,a.value=h,r.value="reconnecting",f=setTimeout(()=>{f=null,b()},d),d=Math.min(d*2,t.reconnectMaxDelay)}function b(){t.mode==="fetch"?z():A()}let y={status:r,connected:o,lastMessage:s,lastEvent:i,error:c,reconnectCount:a,on(p,S){return l[p].push(S),()=>{let k=l[p],M=k.indexOf(S);M>=0&&k.splice(M,1)}},pipe(p,S){let k=M=>{p.value=S(M,p.value)};return y.on("message",k)},close(){u=!0,f&&(clearTimeout(f),f=null),g&&(g.close(),g=null),m&&(m.abort(),m=null),r.value="closed",o.value=!1}};return b(),y}var Pe={connect:bt};async function X(e="/api/rtc/config"){let n=await fetch(e);if(!n.ok)throw new Error(`[tina4] rtc config fetch failed: ${n.status}`);return n.json()}function wt(){let e=window.location;return`${e.protocol==="https:"?"wss:":"ws:"}//${e.host}`}function Le(e){return/^wss?:\/\//.test(e)?e:wt()+(e.startsWith("/")?e:"/"+e)}function Tt(){let e=globalThis.crypto;if(e&&"randomUUID"in e)return e.randomUUID().slice(0,8);let n="";for(let t=0;t<8;t++)n+=Math.floor(16*(.5+t)).toString(16);return n+Date.now().toString(16).slice(-4)}async function kt(e,n={}){let t=w("connecting"),r=w(null),o=w([]),s=w(!1),i=w(null),c=Tt(),a=n.config??await X(n.configUrl),l=n.iceServers??a.iceServers??[],g=n.signallingUrl??a.signalling??"/ws/rtc",m=Le(g.includes("{room}")?g.replace("{room}",e):`${g}/${e}`),u=null;n.media instanceof MediaStream?u=n.media:n.media!==!1&&(u=await navigator.mediaDevices.getUserMedia(n.media??{audio:!0,video:!0})),r.value=u;let d=u?.getVideoTracks()[0]??null,f=new Map,h=K.connect(m);function x(){o.value=[...f.entries()].map(([b,y])=>({id:b,stream:y.stream}))}function C(b){try{h.send({...b,from:c})}catch{}}function v(b){let y=f.get(b);if(y)return y;let p=new RTCPeerConnection({iceServers:l}),S={pc:p,polite:c<b,makingOffer:!1,ignoreOffer:!1,stream:null};if(f.set(b,S),u)for(let k of u.getTracks())p.addTrack(k,u);return p.onnegotiationneeded=async()=>{try{S.makingOffer=!0,await p.setLocalDescription(),C({type:"desc",to:b,description:p.localDescription})}catch(k){i.value=k}finally{S.makingOffer=!1}},p.onicecandidate=({candidate:k})=>{k&&C({type:"ice",to:b,candidate:k})},p.ontrack=({streams:k})=>{S.stream=k[0]??null,x()},p.onconnectionstatechange=()=>{["failed","closed"].includes(p.connectionState)?T(b):p.connectionState==="connected"&&(t.value="connected")},x(),S}function T(b){let y=f.get(b);if(y){try{y.pc.close()}catch{}f.delete(b),x()}}async function R(b){let y=b,p=y.from;if(!p||p===c||y.to&&y.to!==c)return;if(y.type==="hello"){v(p),C({type:"welcome",to:p});return}if(y.type==="welcome"){v(p);return}if(y.type==="bye"){T(p);return}let S=v(p),k=S.pc;if(y.type==="desc"){let M=y.description,P=M.type==="offer"&&(S.makingOffer||k.signalingState!=="stable");if(S.ignoreOffer=!S.polite&&P,S.ignoreOffer)return;await k.setRemoteDescription(M),M.type==="offer"&&(await k.setLocalDescription(),C({type:"desc",to:p,description:k.localDescription}))}else if(y.type==="ice")try{await k.addIceCandidate(y.candidate)}catch(M){S.ignoreOffer||(i.value=M)}}h.on("message",b=>{R(b)}),h.on("open",()=>{C({type:"hello"})});async function A(b){if(b)for(let{pc:y}of f.values()){let p=y.getSenders().find(S=>S.track?.kind==="video");p&&await p.replaceTrack(b)}}async function z(){await A(d),s.value=!1}async function Y(){let y=(await navigator.mediaDevices.getDisplayMedia({video:!0})).getVideoTracks()[0];await A(y),y.onended=()=>{z()},s.value=!0}return{status:t,localStream:r,peers:o,screenSharing:s,error:i,id:c,shareScreen:Y,stopScreen:z,toggleAudio(b){let y=u?.getAudioTracks()[0];return y?(y.enabled=b??!y.enabled,y.enabled):!1},toggleVideo(b){let y=u?.getVideoTracks()[0];return y?(y.enabled=b??!y.enabled,y.enabled):!1},leave(){C({type:"bye"});for(let b of[...f.keys()])T(b);if(u)for(let b of u.getTracks())b.stop();h.close(),t.value="closed"}}}function Ct(e,n={}){let t=w([]),r=w([]),o=w([]),s=new Map,i=n.typingTimeout??3e3,c=n.url??"/ws/chat",a=Le(c.includes("{channel}")?c.replace("{channel}",String(e)):`${c}/${e}`),l=K.connect(a,{token:n.token});function g(d){o.value.includes(d)||(o.value=[...o.value,d]);let f=s.get(d);f&&clearTimeout(f),s.set(d,setTimeout(()=>{o.value=o.value.filter(h=>h!==d),s.delete(d)},i))}l.on("message",d=>{let f=d;switch(f.type){case"message":t.value=[...t.value,f.message];break;case"presence":f.event==="roster"?r.value=f.users??[]:f.event==="join"&&f.user_id?r.value=[...new Set([...r.value,f.user_id])]:f.event==="leave"&&(r.value=r.value.filter(h=>h!==f.user_id));break;case"typing":f.user_id&&g(f.user_id);break}});let m=n.apiBase??"",u=n.messagesPath??"/api/channels/{id}/messages";return{status:l.status,connected:l.connected,messages:t,presence:r,typing:o,send(d,f){l.send({type:"message",body:d,thread_id:f??null})},sendTyping(){l.send({type:"typing"})},markRead(){l.send({type:"read"})},async history(d,f=50){let h=u.replace("{id}",String(e)),x=new URLSearchParams({limit:String(f)});d&&x.set("before",String(d));let C={};n.token&&(C.Authorization=`Bearer ${n.token}`);let v=await fetch(`${m}${h}?${x}`,{headers:C});if(!v.ok)throw new Error(`[tina4] chat history failed: ${v.status}`);let T=await v.json(),R=[...T].reverse();return t.value=[...R,...t.value],T},close(){for(let d of s.values())clearTimeout(d);s.clear(),l.close()}}}async function Et(e,n,t={}){let r=t.filesPath??"/api/files",o=new FormData;o.append("channel_id",String(e)),o.append("file",n,n.name??"file");let s={};t.token&&(s.Authorization=`Bearer ${t.token}`);let i=await fetch(`${t.apiBase??""}${r}`,{method:"POST",body:o,headers:s});if(!i.ok)throw new Error(`[tina4] file upload failed: ${i.status}`);return i.json()}async function Rt(e,n={}){let t=/^https?:\/\//.test(e)?e:`${n.apiBase??""}${n.filesPath??"/api/files"}/${e}`,r={};n.token&&(r.Authorization=`Bearer ${n.token}`);let o=await fetch(t,{headers:r});if(!o.ok)throw new Error(`[tina4] file fetch failed: ${o.status}`);return URL.createObjectURL(await o.blob())}var De={config:X,call:kt,chat:Ct,upload:Et,fetchBlob:Rt};var Fe={read:e=>JSON.parse(e),write:e=>JSON.stringify(e)},$e=/(token|password|passwd|secret|api[_-]?key|apikey|auth(?!or)|credential|jwt|bearer|otp|seed|private[_-]?key|session[_-]?id)/i,_t=/^[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}$/,xt=/^[A-Za-z0-9+/_=-]{40,}$/,qe=new Set;function Mt(e,n){if($e.test(e))return`key name "${e}" looks like a credential`;if(typeof n=="string"){if(_t.test(n))return"value looks like a JWT";if(n.length>=40&&xt.test(n))return"value looks like a long base64 / token"}if(n&&typeof n=="object"&&!Array.isArray(n)){for(let t of Object.keys(n))if($e.test(t))return`object contains a credential-shape field "${t}"`}return null}function Ot(e,n){qe.has(n)||(qe.add(n),console.warn(`[tina4 persist] ${e} (key: ${JSON.stringify(n)}). localStorage is XSS-readable and never appropriate for credentials, tokens, passwords, personal data, or secrets. See STORAGE.md.`))}function He(e){if(typeof globalThis>"u")return null;try{let n=e==="local"?globalThis.localStorage:globalThis.sessionStorage;return!n||typeof n.getItem!="function"?null:n}catch{return null}}function je(e,n,t){try{let r=JSON.parse(e);return r&&typeof r=="object"&&"value"in r?{version:r.v,payload:r.value}:{version:void 0,payload:r}}catch{return{version:void 0,payload:t?e:n.read(e)}}}function We(e,n,t){return t?e:n.read(typeof e=="string"?e:JSON.stringify(e))}function At(e,n,t,r,o,s,i){try{let c=n.getItem(t);if(c===null)return;let a=je(c,o,s);if(a.version===r||a.version===void 0){e.value=We(a.payload,o,s);return}if(i){try{e.value=i(a.payload,a.version)}catch(l){console.warn(`[tina4 persist] migrate() threw for key "${t}":`,l)}return}console.warn(`[tina4 persist] stored version ${a.version} does not match current ${r} for key "${t}", and no migrate() was provided. Discarding the stored value.`)}catch(c){console.warn(`[tina4 persist] failed to read key "${t}":`,c)}}function Ke(e,n,t){if(t)return;let r=Mt(e,n);r&&Ot(r,e)}function It(e,n,t,r,o,s,i){return E(()=>{let c=e.value;Ke(t,c,i);try{let a=JSON.stringify(s?{v:r,value:c}:{v:r,value:o.write(c)});n.setItem(t,a)}catch(a){console.warn(`[tina4 persist] failed to write key "${t}":`,a)}})}function Nt(e,n,t,r,o,s,i,c){if(!c||typeof globalThis>"u"||!("addEventListener"in globalThis))return null;let a=l=>{let g=l;if(!(g.storageArea!==n||g.key!==t||g.newValue===null))try{let m=je(g.newValue,o,s);m.version!==void 0&&m.version!==r&&i?e.value=i(m.payload,m.version):(m.version===r||m.version===void 0)&&(e.value=We(m.payload,o,s))}catch(m){console.warn(`[tina4 persist] failed to parse storage event for key "${t}":`,m)}};return globalThis.addEventListener?.("storage",a),()=>{globalThis.removeEventListener?.("storage",a)}}function Pt(e,n){try{e.removeItem(n)}catch(t){console.warn(`[tina4 persist] failed to clear key "${n}":`,t)}}function ze(e,n){let{key:t,storage:r="local",serializer:o=Fe,version:s=1,migrate:i,syncTabs:c=!1,silenceCredentialWarning:a=!1}=n;if(!t||typeof t!="string")throw new Error("[tina4 persist] options.key is required and must be a string");let l=o===Fe,g=He(r);if(!g)return Ue(e,()=>{},()=>{});At(e,g,t,s,o,l,i),Ke(t,e.peek(),a);let m=It(e,g,t,s,o,l,a),u=Nt(e,g,t,s,o,l,i,c);return Ue(e,()=>Pt(g,t),()=>{m(),u&&u()})}function Ue(e,n,t){return Object.assign(e,{clear:n,dispose:t})}function Ve(e,n="local"){let t=He(n);if(t)for(let r of e)try{t.removeItem(r)}catch(o){console.warn(`[tina4 persist] failed to clear key "${r}":`,o)}}var Lt=["ar","he","fa","ur","ps","dv","syr","ckb","yi"];function Dt(){return globalThis.navigator?.language||"en"}function Be(e,n="",t={}){for(let[r,o]of Object.entries(e)){let s=n?`${n}.${r}`:r;if(o!==null&&typeof o=="object"&&!Array.isArray(o))Be(o,s,t);else{let i=String(o);t[s]=i,r in t||(t[r]=i)}}return t}function Ft(e,n){return e.replace(/\{(\w+)\}/g,(t,r)=>Object.prototype.hasOwnProperty.call(n,r)?String(n[r]):t)}function de(e={}){let n=e.locale||Dt(),t=e.fallbackLocale||n,r=new Set([...Lt,...e.rtlLocales||[]]),o=w(n,"i18n.locale"),s=new Map,i=new Map;function c(u,d){let f=Be(d),h=s.get(u);s.set(u,h?{...h,...f}:f)}if(e.messages)for(let[u,d]of Object.entries(e.messages))c(u,d);function a(u,d){return s.get(u)?.[d]}function l(u,d){let f=`n|${u}|${JSON.stringify(d||{})}`,h=i.get(f);return h||(h=new Intl.NumberFormat(u,d),i.set(f,h)),h}function g(u,d){let f=`d|${u}|${JSON.stringify(d||{})}`,h=i.get(f);return h||(h=new Intl.DateTimeFormat(u,d),i.set(f,h)),h}function m(u,d){let f=`r|${u}|${JSON.stringify(d||{})}`,h=i.get(f);return h||(h=new Intl.RelativeTimeFormat(u,d),i.set(f,h)),h}return{locale:o,t(u,d){let f=o.value,h=a(f,u);return h===void 0&&t!==f&&(h=a(t,u)),h===void 0&&(h=u),d?Ft(h,d):h},setLocale(u){o.value=u},getLocale(){return o.value},addMessages:c,hasLocale(u){return s.has(u)},availableLocales(){return[...s.keys()].sort()},async loadMessages(u,d){let f=await fetch(d);if(!f.ok)throw new Error(`[tina4 i18n] failed to load "${u}" from ${d}: ${f.status}`);c(u,await f.json())},number(u,d){return l(o.value,d).format(u)},currency(u,d,f){return l(o.value,{style:"currency",currency:d,...f}).format(u)},date(u,d){let f=u instanceof Date?u:new Date(u);return g(o.value,d).format(f)},relativeTime(u,d,f){return m(o.value,f||{numeric:"auto"}).format(u,d)},isRTL(){return r.has(o.value.split("-")[0].toLowerCase())},dir(){return this.isRTL()?"rtl":"ltr"}}}var Je=de();return rt($t);})();

{tina4_python-3.13.106 → tina4_python-3.13.108}/tina4_python/service/__init__.py

@@ -356,6 +356,16 @@ class ServiceRunner:
 
         for svc in self.services:
             svc["running"] = False
+            instance = svc.get("instance")
+            if instance is not None and hasattr(instance, "stop") and callable(instance.stop):
+                try:
+                    instance.stop()
+                except Exception as exc:
+                    _get_log().error(
+                        "Error stopping service instance",
+                        name=svc.get("name"),
+                        error=str(exc),
+                    )
 
         # Give threads a moment to finish
         for t in self._threads: