@hasna/shortlinks 0.1.23 → 0.1.24

package/dist/index.js

@@ -1,8 +1,203 @@
 // @bun
-// src/database.ts
-import { Database } from "bun:sqlite";
-import { mkdirSync as mkdirSync2 } from "fs";
-import { dirname as dirname2 } from "path";
+var __create = Object.create;
+var __getProtoOf = Object.getPrototypeOf;
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toESMCache_node;
+var __toESMCache_esm;
+var __toESM = (mod, isNodeMode, target) => {
+  var canCache = mod != null && typeof mod === "object";
+  if (canCache) {
+    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
+    var cached = cache.get(mod);
+    if (cached)
+      return cached;
+  }
+  target = mod != null ? __create(__getProtoOf(mod)) : {};
+  const to = isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
+  for (let key of __getOwnPropNames(mod))
+    if (!__hasOwnProp.call(to, key))
+      __defProp(to, key, {
+        get: __accessProp.bind(mod, key),
+        enumerable: true
+      });
+  if (canCache)
+    cache.set(mod, to);
+  return to;
+};
+var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __require = import.meta.require;
+
+// src/runtime.ts
+var SHORTLINKS_RUNTIME_ENV = {
+  store: "HASNA_SHORTLINKS_STORE",
+  databaseUrl: "HASNA_SHORTLINKS_DATABASE_URL",
+  databaseSsl: "HASNA_SHORTLINKS_DATABASE_SSL"
+};
+var SHORTLINKS_RUNTIME_FALLBACK_ENV = {
+  store: "SHORTLINKS_STORE",
+  databaseUrl: "SHORTLINKS_DATABASE_URL",
+  databaseSsl: "SHORTLINKS_DATABASE_SSL"
+};
+var CANONICAL_SHORTLINKS_POSTGRES_CLUSTER = "hasna-xyz-infra-apps-prod-postgres";
+var CANONICAL_SHORTLINKS_POSTGRES_DATABASE = "shortlinks";
+var CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH = "hasna/xyz/opensource/shortlinks/prod/postgres";
+function getCanonicalShortlinksPostgresConfig() {
+  return {
+    cluster: CANONICAL_SHORTLINKS_POSTGRES_CLUSTER,
+    database: CANONICAL_SHORTLINKS_POSTGRES_DATABASE,
+    runtimeSecretPath: CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH,
+    primaryEnv: SHORTLINKS_RUNTIME_ENV.databaseUrl,
+    fallbackEnv: SHORTLINKS_RUNTIME_FALLBACK_ENV.databaseUrl
+  };
+}
+function parseShortlinksStoreMode(value) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return "local";
+  if (normalized === "local" || normalized === "postgres")
+    return normalized;
+  if (normalized === "pg")
+    return "postgres";
+  throw new Error(`${SHORTLINKS_RUNTIME_ENV.store} must be local or postgres`);
+}
+function getShortlinksStoreMode(env = process.env) {
+  return parseShortlinksStoreMode(readRuntimeEnv(env, "store").value);
+}
+function getShortlinksDatabaseUrl(env = process.env) {
+  return readRuntimeEnv(env, "databaseUrl").value;
+}
+function getShortlinksDatabaseSsl(env = process.env) {
+  return parseBoolean(readRuntimeEnv(env, "databaseSsl").value, true);
+}
+function getShortlinksRuntimeEnvName(env, key) {
+  const primary = SHORTLINKS_RUNTIME_ENV[key];
+  if (clean(env[primary]))
+    return primary;
+  return SHORTLINKS_RUNTIME_FALLBACK_ENV[key];
+}
+function loadShortlinksRuntimeConfig(env = process.env) {
+  const mode = getShortlinksStoreMode(env);
+  const databaseUrl = getShortlinksDatabaseUrl(env);
+  return {
+    service: "shortlinks",
+    mode,
+    ...databaseUrl ? {
+      database: {
+        provider: "postgres",
+        url: databaseUrl,
+        ssl: getShortlinksDatabaseSsl(env)
+      }
+    } : {}
+  };
+}
+function assertShortlinksPostgresConfig(config) {
+  if (config.mode !== "postgres")
+    return;
+  if (!config.database?.url) {
+    throw new Error(`${SHORTLINKS_RUNTIME_ENV.databaseUrl} is required when ${SHORTLINKS_RUNTIME_ENV.store}=postgres`);
+  }
+}
+function getShortlinksRuntimeStatus(env = process.env) {
+  const issues = [];
+  const warnings = [];
+  let config;
+  try {
+    config = loadShortlinksRuntimeConfig(env);
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+    config = { service: "shortlinks", mode: "local" };
+  }
+  try {
+    assertShortlinksPostgresConfig(config);
+  } catch (error) {
+    issues.push(error instanceof Error ? error.message : String(error));
+  }
+  if (config.mode === "local" && config.database?.url) {
+    warnings.push(`${SHORTLINKS_RUNTIME_ENV.store}=local ignores configured Postgres database settings`);
+  }
+  return {
+    ok: issues.length === 0,
+    service: "shortlinks",
+    mode: config.mode,
+    local_default: config.mode === "local",
+    postgres_enabled: config.mode === "postgres",
+    database: {
+      configured: Boolean(config.database?.url),
+      provider: config.database?.provider ?? null,
+      redacted_url: redactDatabaseUrl(config.database?.url),
+      ssl: config.database?.ssl ?? null
+    },
+    env: runtimeEnvStatus(env),
+    canonical: getCanonicalShortlinksPostgresConfig(),
+    issues,
+    warnings,
+    no_network: true
+  };
+}
+function redactDatabaseUrl(value) {
+  if (!value)
+    return null;
+  try {
+    const url = new URL(value);
+    if (url.username)
+      url.username = "***";
+    if (url.password)
+      url.password = "***";
+    for (const key of Array.from(url.searchParams.keys())) {
+      if (isSensitiveQueryKey(key))
+        url.searchParams.set(key, "***");
+    }
+    return url.toString();
+  } catch {
+    return "(redacted)";
+  }
+}
+function runtimeEnvStatus(env) {
+  return Object.fromEntries(Object.entries(SHORTLINKS_RUNTIME_ENV).map(([key, name]) => {
+    const activeName = getShortlinksRuntimeEnvName(env, key);
+    return [
+      key,
+      {
+        name,
+        active_name: activeName,
+        configured: Boolean(clean(env[activeName]))
+      }
+    ];
+  }));
+}
+function readRuntimeEnv(env, key) {
+  const primary = SHORTLINKS_RUNTIME_ENV[key];
+  const primaryValue = clean(env[primary]);
+  if (primaryValue)
+    return { name: primary, value: primaryValue };
+  const fallback = SHORTLINKS_RUNTIME_FALLBACK_ENV[key];
+  return { name: fallback, value: clean(env[fallback]) };
+}
+function parseBoolean(value, fallback) {
+  const normalized = clean(value)?.toLowerCase();
+  if (!normalized)
+    return fallback;
+  if (["1", "true", "yes", "on"].includes(normalized))
+    return true;
+  if (["0", "false", "no", "off"].includes(normalized))
+    return false;
+  throw new Error(`${SHORTLINKS_RUNTIME_ENV.databaseSsl} must be true or false`);
+}
+function isSensitiveQueryKey(key) {
+  return /(?:^|[_-])(pass(?:word)?|pwd|secret|token|credential|auth|api[_-]?key|access[_-]?key)(?:$|[_-])/i.test(key);
+}
+function clean(value) {
+  const trimmed = value?.trim();
+  return trimmed ? trimmed : undefined;
+}
+
+// src/pg-store.ts
+import { createHash } from "crypto";
 
 // src/config.ts
 import { existsSync, linkSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
@@ -134,6 +329,9 @@ function formatShortUrl(hostname, slug, publicBaseUrl) {
 }
 
 // src/database.ts
+import { Database } from "bun:sqlite";
+import { mkdirSync as mkdirSync2 } from "fs";
+import { dirname as dirname2 } from "path";
 function now() {
   return new Date().toISOString();
 }
@@ -241,8 +439,6 @@ class ShortlinksDatabase {
     }
   }
 }
-// src/store.ts
-import { createHash } from "crypto";
 
 // src/machine.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
@@ -288,38 +484,90 @@ function getMachineId() {
   return id;
 }
 
-// src/store.ts
+// src/pg-store.ts
 function parseJsonObject(value) {
   if (!value)
     return {};
+  if (typeof value === "object" && !Array.isArray(value))
+    return value;
   try {
-    const parsed = JSON.parse(value);
+    const parsed = JSON.parse(String(value));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
   }
 }
+async function loadPgPool() {
+  const importer = new Function("specifier", "return import(specifier)");
+  const module = await importer("pg");
+  return module.Pool;
+}
+function toPostgresSql(sql) {
+  let index = 0;
+  return sql.replace(/\?/g, () => `$${++index}`);
+}
+function createPgPoolConfig(connectionString, options = {}) {
+  const ssl = options.ssl ?? true;
+  return {
+    connectionString,
+    ...ssl ? { ssl: { rejectUnauthorized: true } } : { ssl: false }
+  };
+}
+
+class PgPoolAdapter {
+  pool;
+  constructor(pool) {
+    this.pool = pool;
+  }
+  static async create(connectionString, options = {}) {
+    const Pool = await loadPgPool();
+    return new PgPoolAdapter(new Pool(createPgPoolConfig(connectionString, options)));
+  }
+  async get(sql, ...params) {
+    const result = await this.pool.query(toPostgresSql(sql), params);
+    return result.rows[0] ?? null;
+  }
+  async all(sql, ...params) {
+    const result = await this.pool.query(toPostgresSql(sql), params);
+    return result.rows;
+  }
+  async run(sql, ...params) {
+    return this.pool.query(toPostgresSql(sql), params);
+  }
+  async close() {
+    await this.pool.end();
+  }
+}
+function toIsoString(value) {
+  if (value instanceof Date)
+    return value.toISOString();
+  return String(value);
+}
+function nullableIso(value) {
+  if (value === null || value === undefined)
+    return null;
+  return toIsoString(value);
+}
 function domainFromRow(row) {
   return {
     ...row,
     default_domain: Boolean(row.default_domain),
+    synced_at: nullableIso(row.synced_at),
+    created_at: toIsoString(row.created_at),
+    updated_at: toIsoString(row.updated_at),
     metadata: parseJsonObject(row.metadata)
   };
 }
 function linkFromRow(row) {
-  const config = loadConfig();
-  const publicBaseUrl = config.defaultDomain === row.hostname ? config.publicBaseUrl : undefined;
   return {
     ...row,
     active: Boolean(row.active),
+    expires_at: nullableIso(row.expires_at),
+    synced_at: nullableIso(row.synced_at),
+    created_at: toIsoString(row.created_at),
+    updated_at: toIsoString(row.updated_at),
     metadata: parseJsonObject(row.metadata),
-    short_url: formatShortUrl(row.hostname, row.slug, publicBaseUrl)
-  };
-}
-function clickFromRow(row) {
-  return {
-    ...row,
-    metadata: parseJsonObject(row.metadata)
+    short_url: formatShortUrl(row.hostname, row.slug)
   };
 }
 function validateDestinationUrl(url) {
@@ -342,26 +590,61 @@ function isoOrNull(input) {
     throw new Error(`Invalid date: ${input}`);
   return date.toISOString();
 }
-
-class ShortlinksStore {
-  database;
-  constructor(dbPath) {
-    this.database = new ShortlinksDatabase(dbPath);
+function clickFromRow(row) {
+  return {
+    ...row,
+    clicked_at: toIsoString(row.clicked_at),
+    synced_at: nullableIso(row.synced_at),
+    created_at: toIsoString(row.created_at),
+    updated_at: toIsoString(row.updated_at),
+    metadata: parseJsonObject(row.metadata)
+  };
+}
+function createKitPgAdapter(client) {
+  return {
+    async get(sql, ...params) {
+      return client.get(toPostgresSql(sql), params);
+    },
+    async all(sql, ...params) {
+      return client.many(toPostgresSql(sql), params);
+    },
+    async run(sql, ...params) {
+      return client.query(toPostgresSql(sql), params);
+    }
+  };
+}
+
+class PgShortlinksStore {
+  pg;
+  constructor(pg) {
+    this.pg = pg;
   }
-  close() {
-    this.database.close();
+  static async fromConnectionString(connectionString, options = {}) {
+    return new PgShortlinksStore(await PgPoolAdapter.create(connectionString, options));
   }
-  addDomain(input) {
+  static fromQueryClient(client) {
+    return new PgShortlinksStore(createKitPgAdapter(client));
+  }
+  static async fromEnv(env = process.env) {
+    const connectionString = getShortlinksDatabaseUrl(env);
+    if (!connectionString) {
+      throw new Error("HASNA_SHORTLINKS_DATABASE_URL is required when shortlinks uses the postgres store");
+    }
+    return PgShortlinksStore.fromConnectionString(connectionString, { ssl: getShortlinksDatabaseSsl(env) });
+  }
+  async close() {
+    await this.pg.close?.();
+  }
+  async addDomain(input) {
     const hostname2 = normalizeHostname(input.hostname);
     const timestamp = now();
     const machineId = getMachineId();
-    const existing = this.getDomain(hostname2);
+    const existing = await this.getDomain(hostname2);
     const id = existing?.id || makeId("dom");
     if (input.defaultDomain) {
-      this.database.db.query("UPDATE domains SET default_domain = 0, updated_at = ?, synced_at = NULL").run(timestamp);
-      updateConfig({ defaultDomain: hostname2, publicBaseUrl: `https://${hostname2}` });
+      await this.pg.run("UPDATE domains SET default_domain = 0, updated_at = ? WHERE default_domain = 1", timestamp);
     }
-    this.database.db.query(`
+    await this.pg.run(`
       INSERT INTO domains (
         id, hostname, provider, default_domain, cloudflare_zone_id, cloudflare_account_id,
         cloudflare_worker_name, origin_url, notes, metadata, machine_id, synced_at, created_at, updated_at
@@ -379,37 +662,31 @@ class ShortlinksStore {
         machine_id = excluded.machine_id,
         synced_at = NULL,
         updated_at = excluded.updated_at
-    `).run(id, hostname2, input.provider || existing?.provider || "manual", input.defaultDomain ?? existing?.default_domain ? 1 : 0, input.cloudflareZoneId || existing?.cloudflare_zone_id || null, input.cloudflareAccountId || existing?.cloudflare_account_id || null, input.cloudflareWorkerName || existing?.cloudflare_worker_name || null, input.originUrl || existing?.origin_url || null, input.notes || existing?.notes || null, JSON.stringify(input.metadata || existing?.metadata || {}), machineId, existing?.created_at || timestamp, timestamp);
-    return this.getDomain(hostname2);
+    `, id, hostname2, input.provider || existing?.provider || "manual", input.defaultDomain ?? existing?.default_domain ? 1 : 0, input.cloudflareZoneId || existing?.cloudflare_zone_id || null, input.cloudflareAccountId || existing?.cloudflare_account_id || null, input.cloudflareWorkerName || existing?.cloudflare_worker_name || null, input.originUrl || existing?.origin_url || null, input.notes || existing?.notes || null, JSON.stringify(input.metadata || existing?.metadata || {}), machineId, existing?.created_at || timestamp, timestamp);
+    return await this.getDomain(hostname2);
   }
-  listDomains() {
-    const rows = this.database.db.query(`
+  async listDomains() {
+    const rows = await this.pg.all(`
       SELECT * FROM domains
       ORDER BY default_domain DESC, hostname ASC
-    `).all();
+    `);
     return rows.map(domainFromRow);
   }
-  getDomain(hostnameOrId) {
+  async getDomain(hostnameOrId) {
     const normalized = hostnameOrId.includes(".") || hostnameOrId.includes("://") ? normalizeHostname(hostnameOrId) : hostnameOrId;
-    const row = this.database.db.query(`
+    const row = await this.pg.get(`
       SELECT * FROM domains WHERE hostname = ? OR id = ? LIMIT 1
-    `).get(normalized, hostnameOrId);
+    `, normalized, hostnameOrId);
     return row ? domainFromRow(row) : null;
   }
-  getDefaultDomain() {
-    const config = loadConfig();
-    if (config.defaultDomain) {
-      const configured = this.getDomain(config.defaultDomain);
-      if (configured)
-        return configured;
-    }
-    const row = this.database.db.query(`
+  async getDefaultDomain() {
+    const row = await this.pg.get(`
       SELECT * FROM domains ORDER BY default_domain DESC, created_at ASC LIMIT 1
-    `).get();
+    `);
     return row ? domainFromRow(row) : null;
   }
-  createLink(input) {
-    const domain = input.domain ? this.getDomain(input.domain) : this.getDefaultDomain();
+  async createLink(input) {
+    const domain = input.domain ? await this.getDomain(input.domain) : await this.getDefaultDomain();
     if (!domain) {
       throw new Error("No domain configured. Run `shortlinks domain add <domain> --default` first.");
     }
@@ -417,46 +694,45 @@ class ShortlinksStore {
     const timestamp = now();
     const machineId = getMachineId();
     const expiresAt = isoOrNull(input.expiresAt);
-    const slug = input.slug ? normalizeSlug(input.slug) : this.generateAvailableSlug(domain.id, input.slugLength || DEFAULT_SLUG_LENGTH);
+    const slug = input.slug ? normalizeSlug(input.slug) : await this.generateAvailableSlug(domain.id, input.slugLength || DEFAULT_SLUG_LENGTH);
     try {
-      this.database.db.query(`
+      await this.pg.run(`
         INSERT INTO links (
           id, domain_id, slug, destination_url, title, active, expires_at, metadata,
           machine_id, synced_at, created_at, updated_at
         )
         VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?, NULL, ?, ?)
-      `).run(makeId("lnk"), domain.id, slug, destinationUrl, input.title || null, expiresAt, JSON.stringify(input.metadata || {}), machineId, timestamp, timestamp);
+      `, makeId("lnk"), domain.id, slug, destinationUrl, input.title || null, expiresAt, JSON.stringify(input.metadata || {}), machineId, timestamp, timestamp);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      if (message.includes("UNIQUE")) {
+      if (message.includes("unique") || message.includes("duplicate")) {
         throw new Error(`Slug already exists for ${domain.hostname}: ${slug}`);
       }
       throw error;
     }
-    return this.getLink(domain.hostname, slug);
+    return await this.getLink(domain.hostname, slug);
   }
-  listLinks(options = {}) {
+  async listLinks(options = {}) {
     const params = [];
     let where = "WHERE 1 = 1";
     if (options.domain) {
       where += " AND d.hostname = ?";
       params.push(normalizeHostname(options.domain));
     }
-    if (options.activeOnly) {
+    if (options.activeOnly)
       where += " AND l.active = 1";
-    }
     params.push(options.limit || 100);
-    const rows = this.database.db.query(`
+    const rows = await this.pg.all(`
       SELECT l.*, d.hostname
       FROM links l
       JOIN domains d ON d.id = l.domain_id
       ${where}
       ORDER BY l.created_at DESC
       LIMIT ?
-    `).all(...params);
+    `, ...params);
     return rows.map(linkFromRow);
   }
-  getLink(domainOrSlug, maybeSlug) {
+  async getLink(domainOrSlug, maybeSlug) {
     const slug = normalizeSlug(maybeSlug || domainOrSlug);
     const params = [slug];
     let domainClause = "";
@@ -464,372 +740,206 @@ class ShortlinksStore {
       domainClause = "AND d.hostname = ?";
       params.push(normalizeHostname(domainOrSlug));
     }
-    const row = this.database.db.query(`
+    const row = await this.pg.get(`
       SELECT l.*, d.hostname
       FROM links l
       JOIN domains d ON d.id = l.domain_id
       WHERE l.slug = ? ${domainClause}
       ORDER BY d.default_domain DESC, l.created_at ASC
       LIMIT 1
-    `).get(...params);
+    `, ...params);
     return row ? linkFromRow(row) : null;
   }
-  resolve(hostname2, slug) {
-    const normalizedSlug = normalizeSlug(slug);
+  async totalStats() {
+    const row = await this.pg.get(`
+      SELECT
+        (SELECT COUNT(*)::int FROM domains) AS domains,
+        (SELECT COUNT(*)::int FROM links) AS links,
+        (SELECT COUNT(*)::int FROM clicks) AS clicks
+    `);
+    return row;
+  }
+  async resolve(hostname2, slug) {
     const normalizedHost = normalizeHostname(hostname2);
-    const row = this.database.db.query(`
+    const normalizedSlug = normalizeSlug(slug);
+    const row = await this.pg.get(`
       SELECT l.*, d.hostname
       FROM links l
       JOIN domains d ON d.id = l.domain_id
       WHERE d.hostname = ? AND l.slug = ?
       LIMIT 1
-    `).get(normalizedHost, normalizedSlug);
+    `, normalizedHost, normalizedSlug);
     if (row)
       return linkFromRow(row);
-    const fallback = this.getDefaultDomain();
-    if (!fallback || fallback.hostname === normalizedHost)
-      return null;
-    return this.getLink(fallback.hostname, normalizedSlug);
+    const fallback = await this.pg.get(`
+      SELECT l.*, d.hostname
+      FROM links l
+      JOIN domains d ON d.id = l.domain_id
+      WHERE d.default_domain = 1 AND l.slug = ?
+      ORDER BY d.created_at ASC
+      LIMIT 1
+    `, normalizedSlug);
+    return fallback ? linkFromRow(fallback) : null;
   }
-  setLinkActive(domainOrSlug, maybeSlugOrActive, maybeActive) {
+  async setLinkActive(domainOrSlug, maybeSlugOrActive, maybeActive) {
     const active = typeof maybeSlugOrActive === "boolean" ? maybeSlugOrActive : Boolean(maybeActive);
-    const link = typeof maybeSlugOrActive === "boolean" ? this.getLink(domainOrSlug) : this.getLink(domainOrSlug, maybeSlugOrActive);
+    const link = typeof maybeSlugOrActive === "boolean" ? await this.getLink(domainOrSlug) : await this.getLink(domainOrSlug, maybeSlugOrActive);
     if (!link)
       throw new Error("Link not found.");
     const timestamp = now();
-    this.database.db.query(`
+    await this.pg.run(`
       UPDATE links SET active = ?, updated_at = ?, synced_at = NULL WHERE id = ?
-    `).run(active ? 1 : 0, timestamp, link.id);
-    return this.getLink(link.hostname, link.slug);
+    `, active ? 1 : 0, timestamp, link.id);
+    return await this.getLink(link.hostname, link.slug);
   }
-  deleteLink(domainOrSlug, maybeSlug) {
-    const link = maybeSlug ? this.getLink(domainOrSlug, maybeSlug) : this.getLink(domainOrSlug);
+  async deleteLink(domainOrSlug, maybeSlug) {
+    const link = maybeSlug ? await this.getLink(domainOrSlug, maybeSlug) : await this.getLink(domainOrSlug);
     if (!link)
       throw new Error("Link not found.");
-    this.database.db.query("DELETE FROM links WHERE id = ?").run(link.id);
+    await this.pg.run("DELETE FROM links WHERE id = ?", link.id);
     return link;
   }
-  recordClick(link, input = {}) {
+  async recordClick(link, input = {}) {
     const timestamp = now();
     const machineId = getMachineId();
     const ipHash = input.ip ? this.hashIp(input.ip) : null;
     const id = makeId("clk");
-    this.database.db.query(`
+    await this.pg.run(`
       INSERT INTO clicks (
         id, link_id, domain_id, slug, clicked_at, ip_hash, user_agent, referer,
         country, city, metadata, machine_id, synced_at, created_at, updated_at
       )
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?)
-    `).run(id, link.id, link.domain_id, link.slug, timestamp, ipHash, input.userAgent || null, input.referer || null, input.country || null, input.city || null, JSON.stringify(input.metadata || {}), machineId, timestamp, timestamp);
-    const row = this.database.db.query("SELECT * FROM clicks WHERE id = ?").get(id);
+    `, id, link.id, link.domain_id, link.slug, timestamp, ipHash, input.userAgent || null, input.referer || null, input.country || null, input.city || null, JSON.stringify(input.metadata || {}), machineId, timestamp, timestamp);
+    const row = await this.pg.get("SELECT * FROM clicks WHERE id = ?", id);
     return clickFromRow(row);
   }
-  getStats(domainOrSlug, maybeSlug) {
-    const link = maybeSlug ? this.getLink(domainOrSlug, maybeSlug) : this.getLink(domainOrSlug);
+  async getStats(domainOrSlug, maybeSlug) {
+    const link = maybeSlug ? await this.getLink(domainOrSlug, maybeSlug) : await this.getLink(domainOrSlug);
     if (!link)
       throw new Error("Link not found.");
-    const summary = this.database.db.query(`
-      SELECT COUNT(*) AS clicks, MAX(clicked_at) AS last_clicked_at FROM clicks WHERE link_id = ?
-    `).get(link.id);
-    const topReferrers = this.database.db.query(`
-      SELECT referer, COUNT(*) AS clicks
+    const summary = await this.pg.get(`
+      SELECT COUNT(*)::int AS clicks, MAX(clicked_at) AS last_clicked_at FROM clicks WHERE link_id = ?
+    `, link.id);
+    const topReferrers = await this.pg.all(`
+      SELECT referer, COUNT(*)::int AS clicks
       FROM clicks
       WHERE link_id = ?
       GROUP BY referer
       ORDER BY clicks DESC
       LIMIT 10
-    `).all(link.id);
-    const topUserAgents = this.database.db.query(`
-      SELECT user_agent, COUNT(*) AS clicks
+    `, link.id);
+    const topUserAgents = await this.pg.all(`
+      SELECT user_agent, COUNT(*)::int AS clicks
       FROM clicks
       WHERE link_id = ?
       GROUP BY user_agent
       ORDER BY clicks DESC
       LIMIT 10
-    `).all(link.id);
+    `, link.id);
     return {
       link,
       clicks: summary.clicks,
-      last_clicked_at: summary.last_clicked_at,
+      last_clicked_at: nullableIso(summary.last_clicked_at),
       top_referrers: topReferrers,
       top_user_agents: topUserAgents
     };
   }
-  totalStats() {
-    const row = this.database.db.query(`
-      SELECT
-        (SELECT COUNT(*) FROM domains) AS domains,
-        (SELECT COUNT(*) FROM links) AS links,
-        (SELECT COUNT(*) FROM clicks) AS clicks
-    `).get();
-    return row;
+  hashIp(ip) {
+    return createHash("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
   }
-  generateAvailableSlug(domainId, length) {
+  async generateAvailableSlug(domainId, length) {
     for (let attempt = 0;attempt < 32; attempt += 1) {
       const slug = randomToken(length);
-      const exists = this.database.db.query(`
+      const exists = await this.pg.get(`
         SELECT 1 FROM links WHERE domain_id = ? AND slug = ? LIMIT 1
-      `).get(domainId, slug);
+      `, domainId, slug);
       if (!exists)
         return slug;
     }
     throw new Error("Could not generate an unused slug after 32 attempts.");
   }
-  hashIp(ip) {
-    return createHash("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
+}
+async function applyPostgresMigrations(connectionString, migrations, options = {}) {
+  const Pool = await loadPgPool();
+  const pool = new Pool(createPgPoolConfig(connectionString, options));
+  const client = await pool.connect();
+  const run = (sql, ...params) => client.query(toPostgresSql(sql), params);
+  const get = async (sql, ...params) => {
+    const result = await run(sql, ...params);
+    return result.rows[0] ?? null;
+  };
+  const applied = [];
+  const skipped = [];
+  try {
+    await run("BEGIN");
+    await run(`
+      SELECT pg_advisory_xact_lock(hashtext(?))
+    `, "shortlinks:migrations");
+    await run(`
+      CREATE TABLE IF NOT EXISTS _shortlinks_migrations (
+        id INTEGER PRIMARY KEY,
+        service TEXT NOT NULL DEFAULT 'shortlinks',
+        applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )
+    `);
+    for (let i = 0;i < migrations.length; i += 1) {
+      const id = i + 1;
+      const existing = await get("SELECT id FROM _shortlinks_migrations WHERE id = ? LIMIT 1", id);
+      if (existing) {
+        skipped.push(id);
+        continue;
+      }
+      await run(migrations[i]);
+      await run("INSERT INTO _shortlinks_migrations (id, service, applied_at) VALUES (?, ?, now())", id, "shortlinks");
+      applied.push(id);
+    }
+    await run("COMMIT");
+    return { service: "shortlinks", applied, skipped };
+  } catch (error) {
+    try {
+      await run("ROLLBACK");
+    } catch {}
+    throw error;
+  } finally {
+    client.release();
+    await pool.end();
   }
 }
-// src/pg-store.ts
-import { createHash as createHash2 } from "crypto";
 
-// src/runtime.ts
-var SHORTLINKS_RUNTIME_ENV = {
-  store: "HASNA_SHORTLINKS_STORE",
-  databaseUrl: "HASNA_SHORTLINKS_DATABASE_URL",
-  databaseSsl: "HASNA_SHORTLINKS_DATABASE_SSL"
-};
-var SHORTLINKS_RUNTIME_FALLBACK_ENV = {
-  store: "SHORTLINKS_STORE",
-  databaseUrl: "SHORTLINKS_DATABASE_URL",
-  databaseSsl: "SHORTLINKS_DATABASE_SSL"
-};
-var CANONICAL_SHORTLINKS_POSTGRES_CLUSTER = "hasna-xyz-infra-apps-prod-postgres";
-var CANONICAL_SHORTLINKS_POSTGRES_DATABASE = "shortlinks";
-var CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH = "hasna/xyz/opensource/shortlinks/prod/postgres";
-function getCanonicalShortlinksPostgresConfig() {
-  return {
-    cluster: CANONICAL_SHORTLINKS_POSTGRES_CLUSTER,
-    database: CANONICAL_SHORTLINKS_POSTGRES_DATABASE,
-    runtimeSecretPath: CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH,
-    primaryEnv: SHORTLINKS_RUNTIME_ENV.databaseUrl,
-    fallbackEnv: SHORTLINKS_RUNTIME_FALLBACK_ENV.databaseUrl
-  };
-}
-function parseShortlinksStoreMode(value) {
-  const normalized = clean(value)?.toLowerCase();
-  if (!normalized)
-    return "local";
-  if (normalized === "local" || normalized === "postgres")
-    return normalized;
-  if (normalized === "pg")
-    return "postgres";
-  throw new Error(`${SHORTLINKS_RUNTIME_ENV.store} must be local or postgres`);
-}
-function getShortlinksStoreMode(env = process.env) {
-  return parseShortlinksStoreMode(readRuntimeEnv(env, "store").value);
-}
-function getShortlinksDatabaseUrl(env = process.env) {
-  return readRuntimeEnv(env, "databaseUrl").value;
-}
-function getShortlinksDatabaseSsl(env = process.env) {
-  return parseBoolean(readRuntimeEnv(env, "databaseSsl").value, true);
-}
-function getShortlinksRuntimeEnvName(env, key) {
-  const primary = SHORTLINKS_RUNTIME_ENV[key];
-  if (clean(env[primary]))
-    return primary;
-  return SHORTLINKS_RUNTIME_FALLBACK_ENV[key];
-}
-function loadShortlinksRuntimeConfig(env = process.env) {
-  const mode = getShortlinksStoreMode(env);
-  const databaseUrl = getShortlinksDatabaseUrl(env);
-  return {
-    service: "shortlinks",
-    mode,
-    ...databaseUrl ? {
-      database: {
-        provider: "postgres",
-        url: databaseUrl,
-        ssl: getShortlinksDatabaseSsl(env)
-      }
-    } : {}
-  };
-}
-function assertShortlinksPostgresConfig(config) {
-  if (config.mode !== "postgres")
-    return;
-  if (!config.database?.url) {
-    throw new Error(`${SHORTLINKS_RUNTIME_ENV.databaseUrl} is required when ${SHORTLINKS_RUNTIME_ENV.store}=postgres`);
-  }
-}
-function getShortlinksRuntimeStatus(env = process.env) {
-  const issues = [];
-  const warnings = [];
-  let config;
-  try {
-    config = loadShortlinksRuntimeConfig(env);
-  } catch (error) {
-    issues.push(error instanceof Error ? error.message : String(error));
-    config = { service: "shortlinks", mode: "local" };
-  }
-  try {
-    assertShortlinksPostgresConfig(config);
-  } catch (error) {
-    issues.push(error instanceof Error ? error.message : String(error));
-  }
-  if (config.mode === "local" && config.database?.url) {
-    warnings.push(`${SHORTLINKS_RUNTIME_ENV.store}=local ignores configured Postgres database settings`);
-  }
-  return {
-    ok: issues.length === 0,
-    service: "shortlinks",
-    mode: config.mode,
-    local_default: config.mode === "local",
-    postgres_enabled: config.mode === "postgres",
-    database: {
-      configured: Boolean(config.database?.url),
-      provider: config.database?.provider ?? null,
-      redacted_url: redactDatabaseUrl(config.database?.url),
-      ssl: config.database?.ssl ?? null
-    },
-    env: runtimeEnvStatus(env),
-    canonical: getCanonicalShortlinksPostgresConfig(),
-    issues,
-    warnings,
-    no_network: true
-  };
-}
-function redactDatabaseUrl(value) {
-  if (!value)
-    return null;
-  try {
-    const url = new URL(value);
-    if (url.username)
-      url.username = "***";
-    if (url.password)
-      url.password = "***";
-    for (const key of Array.from(url.searchParams.keys())) {
-      if (isSensitiveQueryKey(key))
-        url.searchParams.set(key, "***");
-    }
-    return url.toString();
-  } catch {
-    return "(redacted)";
-  }
-}
-function runtimeEnvStatus(env) {
-  return Object.fromEntries(Object.entries(SHORTLINKS_RUNTIME_ENV).map(([key, name]) => {
-    const activeName = getShortlinksRuntimeEnvName(env, key);
-    return [
-      key,
-      {
-        name,
-        active_name: activeName,
-        configured: Boolean(clean(env[activeName]))
-      }
-    ];
-  }));
-}
-function readRuntimeEnv(env, key) {
-  const primary = SHORTLINKS_RUNTIME_ENV[key];
-  const primaryValue = clean(env[primary]);
-  if (primaryValue)
-    return { name: primary, value: primaryValue };
-  const fallback = SHORTLINKS_RUNTIME_FALLBACK_ENV[key];
-  return { name: fallback, value: clean(env[fallback]) };
-}
-function parseBoolean(value, fallback) {
-  const normalized = clean(value)?.toLowerCase();
-  if (!normalized)
-    return fallback;
-  if (["1", "true", "yes", "on"].includes(normalized))
-    return true;
-  if (["0", "false", "no", "off"].includes(normalized))
-    return false;
-  throw new Error(`${SHORTLINKS_RUNTIME_ENV.databaseSsl} must be true or false`);
-}
-function isSensitiveQueryKey(key) {
-  return /(?:^|[_-])(pass(?:word)?|pwd|secret|token|credential|auth|api[_-]?key|access[_-]?key)(?:$|[_-])/i.test(key);
-}
-function clean(value) {
-  const trimmed = value?.trim();
-  return trimmed ? trimmed : undefined;
-}
-
-// src/pg-store.ts
+// src/store.ts
+import { createHash as createHash2 } from "crypto";
 function parseJsonObject2(value) {
   if (!value)
     return {};
-  if (typeof value === "object" && !Array.isArray(value))
-    return value;
   try {
-    const parsed = JSON.parse(String(value));
+    const parsed = JSON.parse(value);
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
   }
 }
-async function loadPgPool() {
-  const importer = new Function("specifier", "return import(specifier)");
-  const module = await importer("pg");
-  return module.Pool;
-}
-function toPostgresSql(sql) {
-  let index = 0;
-  return sql.replace(/\?/g, () => `$${++index}`);
-}
-function createPgPoolConfig(connectionString, options = {}) {
-  const ssl = options.ssl ?? true;
-  return {
-    connectionString,
-    ...ssl ? { ssl: { rejectUnauthorized: true } } : { ssl: false }
-  };
-}
-
-class PgPoolAdapter {
-  pool;
-  constructor(pool) {
-    this.pool = pool;
-  }
-  static async create(connectionString, options = {}) {
-    const Pool = await loadPgPool();
-    return new PgPoolAdapter(new Pool(createPgPoolConfig(connectionString, options)));
-  }
-  async get(sql, ...params) {
-    const result = await this.pool.query(toPostgresSql(sql), params);
-    return result.rows[0] ?? null;
-  }
-  async all(sql, ...params) {
-    const result = await this.pool.query(toPostgresSql(sql), params);
-    return result.rows;
-  }
-  async run(sql, ...params) {
-    return this.pool.query(toPostgresSql(sql), params);
-  }
-  async close() {
-    await this.pool.end();
-  }
-}
-function toIsoString(value) {
-  if (value instanceof Date)
-    return value.toISOString();
-  return String(value);
-}
-function nullableIso(value) {
-  if (value === null || value === undefined)
-    return null;
-  return toIsoString(value);
-}
 function domainFromRow2(row) {
   return {
     ...row,
     default_domain: Boolean(row.default_domain),
-    synced_at: nullableIso(row.synced_at),
-    created_at: toIsoString(row.created_at),
-    updated_at: toIsoString(row.updated_at),
     metadata: parseJsonObject2(row.metadata)
   };
 }
 function linkFromRow2(row) {
+  const config = loadConfig();
+  const publicBaseUrl = config.defaultDomain === row.hostname ? config.publicBaseUrl : undefined;
   return {
     ...row,
     active: Boolean(row.active),
-    expires_at: nullableIso(row.expires_at),
-    synced_at: nullableIso(row.synced_at),
-    created_at: toIsoString(row.created_at),
-    updated_at: toIsoString(row.updated_at),
     metadata: parseJsonObject2(row.metadata),
-    short_url: formatShortUrl(row.hostname, row.slug)
+    short_url: formatShortUrl(row.hostname, row.slug, publicBaseUrl)
+  };
+}
+function clickFromRow2(row) {
+  return {
+    ...row,
+    metadata: parseJsonObject2(row.metadata)
   };
 }
 function validateDestinationUrl2(url) {
@@ -852,45 +962,26 @@ function isoOrNull2(input) {
     throw new Error(`Invalid date: ${input}`);
   return date.toISOString();
 }
-function clickFromRow2(row) {
-  return {
-    ...row,
-    clicked_at: toIsoString(row.clicked_at),
-    synced_at: nullableIso(row.synced_at),
-    created_at: toIsoString(row.created_at),
-    updated_at: toIsoString(row.updated_at),
-    metadata: parseJsonObject2(row.metadata)
-  };
-}
 
-class PgShortlinksStore {
-  pg;
-  constructor(pg) {
-    this.pg = pg;
+class ShortlinksStore {
+  database;
+  constructor(dbPath) {
+    this.database = new ShortlinksDatabase(dbPath);
   }
-  static async fromConnectionString(connectionString, options = {}) {
-    return new PgShortlinksStore(await PgPoolAdapter.create(connectionString, options));
+  close() {
+    this.database.close();
   }
-  static async fromEnv(env = process.env) {
-    const connectionString = getShortlinksDatabaseUrl(env);
-    if (!connectionString) {
-      throw new Error("HASNA_SHORTLINKS_DATABASE_URL is required when shortlinks uses the postgres store");
-    }
-    return PgShortlinksStore.fromConnectionString(connectionString, { ssl: getShortlinksDatabaseSsl(env) });
-  }
-  async close() {
-    await this.pg.close?.();
-  }
-  async addDomain(input) {
+  addDomain(input) {
     const hostname2 = normalizeHostname(input.hostname);
     const timestamp = now();
     const machineId = getMachineId();
-    const existing = await this.getDomain(hostname2);
+    const existing = this.getDomain(hostname2);
     const id = existing?.id || makeId("dom");
     if (input.defaultDomain) {
-      await this.pg.run("UPDATE domains SET default_domain = 0, updated_at = ? WHERE default_domain = 1", timestamp);
+      this.database.db.query("UPDATE domains SET default_domain = 0, updated_at = ?, synced_at = NULL").run(timestamp);
+      updateConfig({ defaultDomain: hostname2, publicBaseUrl: `https://${hostname2}` });
     }
-    await this.pg.run(`
+    this.database.db.query(`
       INSERT INTO domains (
         id, hostname, provider, default_domain, cloudflare_zone_id, cloudflare_account_id,
         cloudflare_worker_name, origin_url, notes, metadata, machine_id, synced_at, created_at, updated_at
@@ -908,31 +999,37 @@ class PgShortlinksStore {
         machine_id = excluded.machine_id,
         synced_at = NULL,
         updated_at = excluded.updated_at
-    `, id, hostname2, input.provider || existing?.provider || "manual", input.defaultDomain ?? existing?.default_domain ? 1 : 0, input.cloudflareZoneId || existing?.cloudflare_zone_id || null, input.cloudflareAccountId || existing?.cloudflare_account_id || null, input.cloudflareWorkerName || existing?.cloudflare_worker_name || null, input.originUrl || existing?.origin_url || null, input.notes || existing?.notes || null, JSON.stringify(input.metadata || existing?.metadata || {}), machineId, existing?.created_at || timestamp, timestamp);
-    return await this.getDomain(hostname2);
+    `).run(id, hostname2, input.provider || existing?.provider || "manual", input.defaultDomain ?? existing?.default_domain ? 1 : 0, input.cloudflareZoneId || existing?.cloudflare_zone_id || null, input.cloudflareAccountId || existing?.cloudflare_account_id || null, input.cloudflareWorkerName || existing?.cloudflare_worker_name || null, input.originUrl || existing?.origin_url || null, input.notes || existing?.notes || null, JSON.stringify(input.metadata || existing?.metadata || {}), machineId, existing?.created_at || timestamp, timestamp);
+    return this.getDomain(hostname2);
   }
-  async listDomains() {
-    const rows = await this.pg.all(`
+  listDomains() {
+    const rows = this.database.db.query(`
       SELECT * FROM domains
       ORDER BY default_domain DESC, hostname ASC
-    `);
+    `).all();
     return rows.map(domainFromRow2);
   }
-  async getDomain(hostnameOrId) {
+  getDomain(hostnameOrId) {
     const normalized = hostnameOrId.includes(".") || hostnameOrId.includes("://") ? normalizeHostname(hostnameOrId) : hostnameOrId;
-    const row = await this.pg.get(`
+    const row = this.database.db.query(`
       SELECT * FROM domains WHERE hostname = ? OR id = ? LIMIT 1
-    `, normalized, hostnameOrId);
+    `).get(normalized, hostnameOrId);
     return row ? domainFromRow2(row) : null;
   }
-  async getDefaultDomain() {
-    const row = await this.pg.get(`
+  getDefaultDomain() {
+    const config = loadConfig();
+    if (config.defaultDomain) {
+      const configured = this.getDomain(config.defaultDomain);
+      if (configured)
+        return configured;
+    }
+    const row = this.database.db.query(`
       SELECT * FROM domains ORDER BY default_domain DESC, created_at ASC LIMIT 1
-    `);
+    `).get();
     return row ? domainFromRow2(row) : null;
   }
-  async createLink(input) {
-    const domain = input.domain ? await this.getDomain(input.domain) : await this.getDefaultDomain();
+  createLink(input) {
+    const domain = input.domain ? this.getDomain(input.domain) : this.getDefaultDomain();
     if (!domain) {
       throw new Error("No domain configured. Run `shortlinks domain add <domain> --default` first.");
     }
@@ -940,45 +1037,46 @@ class PgShortlinksStore {
     const timestamp = now();
     const machineId = getMachineId();
     const expiresAt = isoOrNull2(input.expiresAt);
-    const slug = input.slug ? normalizeSlug(input.slug) : await this.generateAvailableSlug(domain.id, input.slugLength || DEFAULT_SLUG_LENGTH);
+    const slug = input.slug ? normalizeSlug(input.slug) : this.generateAvailableSlug(domain.id, input.slugLength || DEFAULT_SLUG_LENGTH);
     try {
-      await this.pg.run(`
+      this.database.db.query(`
         INSERT INTO links (
           id, domain_id, slug, destination_url, title, active, expires_at, metadata,
           machine_id, synced_at, created_at, updated_at
         )
         VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?, NULL, ?, ?)
-      `, makeId("lnk"), domain.id, slug, destinationUrl, input.title || null, expiresAt, JSON.stringify(input.metadata || {}), machineId, timestamp, timestamp);
+      `).run(makeId("lnk"), domain.id, slug, destinationUrl, input.title || null, expiresAt, JSON.stringify(input.metadata || {}), machineId, timestamp, timestamp);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      if (message.includes("unique") || message.includes("duplicate")) {
+      if (message.includes("UNIQUE")) {
         throw new Error(`Slug already exists for ${domain.hostname}: ${slug}`);
       }
       throw error;
     }
-    return await this.getLink(domain.hostname, slug);
+    return this.getLink(domain.hostname, slug);
   }
-  async listLinks(options = {}) {
+  listLinks(options = {}) {
     const params = [];
     let where = "WHERE 1 = 1";
     if (options.domain) {
       where += " AND d.hostname = ?";
       params.push(normalizeHostname(options.domain));
     }
-    if (options.activeOnly)
+    if (options.activeOnly) {
       where += " AND l.active = 1";
+    }
     params.push(options.limit || 100);
-    const rows = await this.pg.all(`
+    const rows = this.database.db.query(`
       SELECT l.*, d.hostname
       FROM links l
       JOIN domains d ON d.id = l.domain_id
       ${where}
       ORDER BY l.created_at DESC
       LIMIT ?
-    `, ...params);
+    `).all(...params);
     return rows.map(linkFromRow2);
   }
-  async getLink(domainOrSlug, maybeSlug) {
+  getLink(domainOrSlug, maybeSlug) {
     const slug = normalizeSlug(maybeSlug || domainOrSlug);
     const params = [slug];
     let domainClause = "";
@@ -986,172 +1084,122 @@ class PgShortlinksStore {
       domainClause = "AND d.hostname = ?";
       params.push(normalizeHostname(domainOrSlug));
     }
-    const row = await this.pg.get(`
+    const row = this.database.db.query(`
       SELECT l.*, d.hostname
       FROM links l
       JOIN domains d ON d.id = l.domain_id
       WHERE l.slug = ? ${domainClause}
       ORDER BY d.default_domain DESC, l.created_at ASC
       LIMIT 1
-    `, ...params);
+    `).get(...params);
     return row ? linkFromRow2(row) : null;
   }
-  async totalStats() {
-    const row = await this.pg.get(`
-      SELECT
-        (SELECT COUNT(*)::int FROM domains) AS domains,
-        (SELECT COUNT(*)::int FROM links) AS links,
-        (SELECT COUNT(*)::int FROM clicks) AS clicks
-    `);
-    return row;
-  }
-  async resolve(hostname2, slug) {
-    const normalizedHost = normalizeHostname(hostname2);
+  resolve(hostname2, slug) {
     const normalizedSlug = normalizeSlug(slug);
-    const row = await this.pg.get(`
+    const normalizedHost = normalizeHostname(hostname2);
+    const row = this.database.db.query(`
       SELECT l.*, d.hostname
       FROM links l
       JOIN domains d ON d.id = l.domain_id
       WHERE d.hostname = ? AND l.slug = ?
       LIMIT 1
-    `, normalizedHost, normalizedSlug);
+    `).get(normalizedHost, normalizedSlug);
     if (row)
       return linkFromRow2(row);
-    const fallback = await this.pg.get(`
-      SELECT l.*, d.hostname
-      FROM links l
-      JOIN domains d ON d.id = l.domain_id
-      WHERE d.default_domain = 1 AND l.slug = ?
-      ORDER BY d.created_at ASC
-      LIMIT 1
-    `, normalizedSlug);
-    return fallback ? linkFromRow2(fallback) : null;
+    const fallback = this.getDefaultDomain();
+    if (!fallback || fallback.hostname === normalizedHost)
+      return null;
+    return this.getLink(fallback.hostname, normalizedSlug);
   }
-  async setLinkActive(domainOrSlug, maybeSlugOrActive, maybeActive) {
+  setLinkActive(domainOrSlug, maybeSlugOrActive, maybeActive) {
     const active = typeof maybeSlugOrActive === "boolean" ? maybeSlugOrActive : Boolean(maybeActive);
-    const link = typeof maybeSlugOrActive === "boolean" ? await this.getLink(domainOrSlug) : await this.getLink(domainOrSlug, maybeSlugOrActive);
+    const link = typeof maybeSlugOrActive === "boolean" ? this.getLink(domainOrSlug) : this.getLink(domainOrSlug, maybeSlugOrActive);
     if (!link)
       throw new Error("Link not found.");
     const timestamp = now();
-    await this.pg.run(`
+    this.database.db.query(`
       UPDATE links SET active = ?, updated_at = ?, synced_at = NULL WHERE id = ?
-    `, active ? 1 : 0, timestamp, link.id);
-    return await this.getLink(link.hostname, link.slug);
+    `).run(active ? 1 : 0, timestamp, link.id);
+    return this.getLink(link.hostname, link.slug);
   }
-  async deleteLink(domainOrSlug, maybeSlug) {
-    const link = maybeSlug ? await this.getLink(domainOrSlug, maybeSlug) : await this.getLink(domainOrSlug);
+  deleteLink(domainOrSlug, maybeSlug) {
+    const link = maybeSlug ? this.getLink(domainOrSlug, maybeSlug) : this.getLink(domainOrSlug);
     if (!link)
       throw new Error("Link not found.");
-    await this.pg.run("DELETE FROM links WHERE id = ?", link.id);
+    this.database.db.query("DELETE FROM links WHERE id = ?").run(link.id);
     return link;
   }
-  async recordClick(link, input = {}) {
+  recordClick(link, input = {}) {
     const timestamp = now();
     const machineId = getMachineId();
     const ipHash = input.ip ? this.hashIp(input.ip) : null;
     const id = makeId("clk");
-    await this.pg.run(`
+    this.database.db.query(`
       INSERT INTO clicks (
         id, link_id, domain_id, slug, clicked_at, ip_hash, user_agent, referer,
         country, city, metadata, machine_id, synced_at, created_at, updated_at
       )
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?)
-    `, id, link.id, link.domain_id, link.slug, timestamp, ipHash, input.userAgent || null, input.referer || null, input.country || null, input.city || null, JSON.stringify(input.metadata || {}), machineId, timestamp, timestamp);
-    const row = await this.pg.get("SELECT * FROM clicks WHERE id = ?", id);
+    `).run(id, link.id, link.domain_id, link.slug, timestamp, ipHash, input.userAgent || null, input.referer || null, input.country || null, input.city || null, JSON.stringify(input.metadata || {}), machineId, timestamp, timestamp);
+    const row = this.database.db.query("SELECT * FROM clicks WHERE id = ?").get(id);
     return clickFromRow2(row);
   }
-  async getStats(domainOrSlug, maybeSlug) {
-    const link = maybeSlug ? await this.getLink(domainOrSlug, maybeSlug) : await this.getLink(domainOrSlug);
+  getStats(domainOrSlug, maybeSlug) {
+    const link = maybeSlug ? this.getLink(domainOrSlug, maybeSlug) : this.getLink(domainOrSlug);
     if (!link)
       throw new Error("Link not found.");
-    const summary = await this.pg.get(`
-      SELECT COUNT(*)::int AS clicks, MAX(clicked_at) AS last_clicked_at FROM clicks WHERE link_id = ?
-    `, link.id);
-    const topReferrers = await this.pg.all(`
-      SELECT referer, COUNT(*)::int AS clicks
+    const summary = this.database.db.query(`
+      SELECT COUNT(*) AS clicks, MAX(clicked_at) AS last_clicked_at FROM clicks WHERE link_id = ?
+    `).get(link.id);
+    const topReferrers = this.database.db.query(`
+      SELECT referer, COUNT(*) AS clicks
       FROM clicks
       WHERE link_id = ?
       GROUP BY referer
       ORDER BY clicks DESC
       LIMIT 10
-    `, link.id);
-    const topUserAgents = await this.pg.all(`
-      SELECT user_agent, COUNT(*)::int AS clicks
+    `).all(link.id);
+    const topUserAgents = this.database.db.query(`
+      SELECT user_agent, COUNT(*) AS clicks
       FROM clicks
       WHERE link_id = ?
       GROUP BY user_agent
       ORDER BY clicks DESC
       LIMIT 10
-    `, link.id);
+    `).all(link.id);
     return {
       link,
       clicks: summary.clicks,
-      last_clicked_at: nullableIso(summary.last_clicked_at),
+      last_clicked_at: summary.last_clicked_at,
       top_referrers: topReferrers,
       top_user_agents: topUserAgents
     };
   }
-  hashIp(ip) {
-    return createHash2("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
+  totalStats() {
+    const row = this.database.db.query(`
+      SELECT
+        (SELECT COUNT(*) FROM domains) AS domains,
+        (SELECT COUNT(*) FROM links) AS links,
+        (SELECT COUNT(*) FROM clicks) AS clicks
+    `).get();
+    return row;
   }
-  async generateAvailableSlug(domainId, length) {
+  generateAvailableSlug(domainId, length) {
     for (let attempt = 0;attempt < 32; attempt += 1) {
       const slug = randomToken(length);
-      const exists = await this.pg.get(`
+      const exists = this.database.db.query(`
         SELECT 1 FROM links WHERE domain_id = ? AND slug = ? LIMIT 1
-      `, domainId, slug);
+      `).get(domainId, slug);
       if (!exists)
         return slug;
     }
     throw new Error("Could not generate an unused slug after 32 attempts.");
   }
-}
-async function applyPostgresMigrations(connectionString, migrations, options = {}) {
-  const Pool = await loadPgPool();
-  const pool = new Pool(createPgPoolConfig(connectionString, options));
-  const client = await pool.connect();
-  const run = (sql, ...params) => client.query(toPostgresSql(sql), params);
-  const get = async (sql, ...params) => {
-    const result = await run(sql, ...params);
-    return result.rows[0] ?? null;
-  };
-  const applied = [];
-  const skipped = [];
-  try {
-    await run("BEGIN");
-    await run(`
-      SELECT pg_advisory_xact_lock(hashtext(?))
-    `, "shortlinks:migrations");
-    await run(`
-      CREATE TABLE IF NOT EXISTS _shortlinks_migrations (
-        id INTEGER PRIMARY KEY,
-        service TEXT NOT NULL DEFAULT 'shortlinks',
-        applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
-      )
-    `);
-    for (let i = 0;i < migrations.length; i += 1) {
-      const id = i + 1;
-      const existing = await get("SELECT id FROM _shortlinks_migrations WHERE id = ? LIMIT 1", id);
-      if (existing) {
-        skipped.push(id);
-        continue;
-      }
-      await run(migrations[i]);
-      await run("INSERT INTO _shortlinks_migrations (id, service, applied_at) VALUES (?, ?, now())", id, "shortlinks");
-      applied.push(id);
-    }
-    await run("COMMIT");
-    return { service: "shortlinks", applied, skipped };
-  } catch (error) {
-    try {
-      await run("ROLLBACK");
-    } catch {}
-    throw error;
-  } finally {
-    client.release();
-    await pool.end();
+  hashIp(ip) {
+    return createHash2("sha256").update(`${getClickSalt()}:${ip}`).digest("hex");
   }
 }
+
 // src/server.ts
 var REDIRECT_ALLOW_HEADER = "GET, HEAD";
 function json(data, status = 200, headers) {
@@ -1249,6 +1297,7 @@ function serveShortlinks(options = {}) {
   const fetch2 = createShortlinksHandler(options);
   return Bun.serve({ hostname: host, port, fetch: fetch2 });
 }
+
 // src/cloudflare.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
 import { join as join3 } from "path";
@@ -1384,6 +1433,2591 @@ async function upsertCloudflareDnsRecord(options) {
   });
   return { id: created.id, action: "created" };
 }
+// node_modules/.pnpm/@hasna+contracts@0.4.1/node_modules/@hasna/contracts/dist/auth/index.js
+import { createHash as createHash3, createHmac, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
+var API_KEY_TOKEN_VERSION = 1;
+var API_KEY_NAMESPACE = "hasna";
+var TOKEN_PATTERN = /^hasna_([a-z][a-z0-9-]*)_([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/;
+var DEFAULT_API_KEY_TTL_SECONDS = 90 * 24 * 60 * 60;
+function toBuffer(secret) {
+  return typeof secret === "string" ? Buffer.from(secret, "utf8") : secret;
+}
+function hmac(signingSecret, message) {
+  return createHmac("sha256", toBuffer(signingSecret)).update(message, "utf8").digest();
+}
+function apiKeyPrefix(app) {
+  return `${API_KEY_NAMESPACE}_${app}_`;
+}
+function parseApiKey(token) {
+  if (typeof token !== "string")
+    return null;
+  const match = TOKEN_PATTERN.exec(token);
+  if (!match)
+    return null;
+  const [, app, body, sig] = match;
+  if (!app || !body || !sig)
+    return null;
+  let claims;
+  try {
+    claims = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+  } catch {
+    return null;
+  }
+  if (typeof claims !== "object" || claims === null || typeof claims.kid !== "string" || typeof claims.app !== "string" || !Array.isArray(claims.scopes)) {
+    return null;
+  }
+  return { app, body, sig, claims };
+}
+function verifyApiKeyToken(token, options) {
+  const parsed = parseApiKey(token);
+  if (!parsed) {
+    return { ok: false, reason: "malformed", message: "Token is malformed." };
+  }
+  const { app, body, sig, claims } = parsed;
+  if (claims.v !== API_KEY_TOKEN_VERSION) {
+    return { ok: false, reason: "unsupported_version", message: `Unsupported token version ${claims.v}.` };
+  }
+  if (claims.app !== app) {
+    return { ok: false, reason: "app_mismatch", message: "Token prefix app does not match claims." };
+  }
+  if (options.expectedApp !== undefined && app !== options.expectedApp) {
+    return { ok: false, reason: "app_mismatch", message: `Token is for app '${app}', expected '${options.expectedApp}'.` };
+  }
+  const expected = hmac(options.signingSecret, `${apiKeyPrefix(app)}${body}`);
+  let provided;
+  try {
+    provided = Buffer.from(sig, "base64url");
+  } catch {
+    return { ok: false, reason: "bad_signature", message: "Signature is not valid base64url." };
+  }
+  if (provided.length !== expected.length || !timingSafeEqual(provided, expected)) {
+    return { ok: false, reason: "bad_signature", message: "Signature verification failed." };
+  }
+  const now2 = Math.floor((options.nowMs ?? Date.now()) / 1000);
+  const leeway = options.leewaySeconds ?? 0;
+  if (typeof claims.iat === "number" && now2 + leeway < claims.iat) {
+    return { ok: false, reason: "not_yet_valid", message: "Token is not yet valid." };
+  }
+  if (claims.exp !== null && typeof claims.exp === "number" && now2 - leeway >= claims.exp) {
+    return { ok: false, reason: "expired", message: "Token has expired." };
+  }
+  if (options.requiredScopes && options.requiredScopes.length > 0) {
+    const granted = claims.scopes;
+    const satisfies = (required) => granted.some((g) => {
+      if (g === "*")
+        return true;
+      const gi = g.indexOf(":");
+      const ri = required.indexOf(":");
+      if (gi < 0 || ri < 0)
+        return false;
+      const gApp = g.slice(0, gi);
+      const gAction = g.slice(gi + 1);
+      const rApp = required.slice(0, ri);
+      const rAction = required.slice(ri + 1);
+      return (gApp === "*" || gApp === rApp) && (gAction === "*" || gAction === rAction);
+    });
+    for (const required of options.requiredScopes) {
+      if (!satisfies(required)) {
+        return { ok: false, reason: "insufficient_scope", message: `Missing required scope '${required}'.` };
+      }
+    }
+  }
+  return { ok: true, claims, kid: claims.kid, app };
+}
+var DEFAULT_API_KEYS_TABLE = "api_keys";
+function createTableSql(table) {
+  return `CREATE TABLE IF NOT EXISTS ${table} (
+    kid TEXT PRIMARY KEY,
+    app TEXT NOT NULL,
+    agent TEXT,
+    scopes JSONB NOT NULL,
+    token_hash TEXT NOT NULL UNIQUE,
+    issued_at TIMESTAMPTZ NOT NULL,
+    expires_at TIMESTAMPTZ,
+    revoked_at TIMESTAMPTZ,
+    revoked_reason TEXT,
+    last_used_at TIMESTAMPTZ,
+    created_by TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+  )`;
+}
+function apiKeyMigrations(table = DEFAULT_API_KEYS_TABLE) {
+  return [
+    { id: `hasna_auth_0001_${table}`, sql: createTableSql(table) },
+    {
+      id: `hasna_auth_0002_${table}_indexes`,
+      sql: `CREATE INDEX IF NOT EXISTS ${table}_app_idx ON ${table} (app);
+            CREATE INDEX IF NOT EXISTS ${table}_token_hash_idx ON ${table} (token_hash);`
+    }
+  ];
+}
+function toIso(value) {
+  if (value === null || value === undefined)
+    return null;
+  if (value instanceof Date)
+    return value.toISOString();
+  return new Date(String(value)).toISOString();
+}
+function parseScopes(value) {
+  if (Array.isArray(value))
+    return value.map((v) => String(v));
+  if (typeof value === "string") {
+    try {
+      const parsed = JSON.parse(value);
+      return Array.isArray(parsed) ? parsed.map((v) => String(v)) : [];
+    } catch {
+      return [];
+    }
+  }
+  return [];
+}
+function rowToRecord(row) {
+  return {
+    kid: String(row.kid),
+    app: String(row.app),
+    agent: row.agent === null || row.agent === undefined ? null : String(row.agent),
+    scopes: parseScopes(row.scopes),
+    tokenHash: String(row.token_hash),
+    issuedAt: toIso(row.issued_at) ?? new Date(0).toISOString(),
+    expiresAt: toIso(row.expires_at),
+    revokedAt: toIso(row.revoked_at),
+    revokedReason: row.revoked_reason === null || row.revoked_reason === undefined ? null : String(row.revoked_reason),
+    lastUsedAt: toIso(row.last_used_at),
+    createdBy: row.created_by === null || row.created_by === undefined ? null : String(row.created_by)
+  };
+}
+
+class ApiKeyStore {
+  client;
+  table;
+  constructor(client, options = {}) {
+    this.client = client;
+    this.table = options.table ?? DEFAULT_API_KEYS_TABLE;
+    if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(this.table)) {
+      throw new Error(`Invalid api-keys table name '${this.table}'.`);
+    }
+  }
+  migrations() {
+    return apiKeyMigrations(this.table);
+  }
+  async ensureSchema() {
+    for (const migration of this.migrations()) {
+      await this.client.execute(migration.sql);
+    }
+  }
+  async insert(input) {
+    await this.client.execute(`INSERT INTO ${this.table}
+         (kid, app, agent, scopes, token_hash, issued_at, expires_at, created_by)
+       VALUES ($1, $2, $3, $4::jsonb, $5, $6, $7, $8)`, [
+      input.kid,
+      input.app,
+      input.agent ?? null,
+      JSON.stringify(input.scopes),
+      input.tokenHash,
+      input.issuedAt.toISOString(),
+      input.expiresAt ? input.expiresAt.toISOString() : null,
+      input.createdBy ?? null
+    ]);
+  }
+  async insertMinted(minted, createdBy) {
+    const claims = minted.claims;
+    await this.insert({
+      kid: minted.kid,
+      app: claims.app,
+      agent: claims.agent ?? null,
+      scopes: claims.scopes,
+      tokenHash: minted.tokenHash,
+      issuedAt: new Date(claims.iat * 1000),
+      expiresAt: claims.exp === null ? null : new Date(claims.exp * 1000),
+      createdBy: createdBy ?? null
+    });
+  }
+  async findByKid(kid) {
+    const row = await this.client.get(`SELECT * FROM ${this.table} WHERE kid = $1`, [kid]);
+    return row ? rowToRecord(row) : null;
+  }
+  async findByTokenHash(tokenHash) {
+    const row = await this.client.get(`SELECT * FROM ${this.table} WHERE token_hash = $1`, [tokenHash]);
+    return row ? rowToRecord(row) : null;
+  }
+  isRevoked = async (kid) => {
+    const row = await this.client.get(`SELECT revoked_at FROM ${this.table} WHERE kid = $1`, [kid]);
+    if (!row)
+      return false;
+    return row.revoked_at !== null && row.revoked_at !== undefined;
+  };
+  async status(kid, nowMs = Date.now()) {
+    const record = await this.findByKid(kid);
+    if (!record)
+      return "unknown";
+    if (record.revokedAt)
+      return "revoked";
+    if (record.expiresAt && new Date(record.expiresAt).getTime() <= nowMs)
+      return "expired";
+    return "active";
+  }
+  statusChecker() {
+    return async (kid) => {
+      const status = await this.status(kid);
+      return status !== "active";
+    };
+  }
+  async revoke(kid, reason, atMs = Date.now()) {
+    const row = await this.client.get(`UPDATE ${this.table}
+          SET revoked_at = COALESCE(revoked_at, $2), revoked_reason = COALESCE(revoked_reason, $3)
+        WHERE kid = $1
+      RETURNING kid`, [kid, new Date(atMs).toISOString(), reason ?? null]);
+    return row !== null;
+  }
+  async touchLastUsed(kid, atMs = Date.now()) {
+    await this.client.execute(`UPDATE ${this.table} SET last_used_at = $2 WHERE kid = $1`, [
+      kid,
+      new Date(atMs).toISOString()
+    ]);
+  }
+  async list(options = {}) {
+    const clauses = [];
+    const params = [];
+    if (options.app) {
+      params.push(options.app);
+      clauses.push(`app = $${params.length}`);
+    }
+    if (!options.includeRevoked) {
+      clauses.push("revoked_at IS NULL");
+    }
+    const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
+    const rows = await this.client.many(`SELECT * FROM ${this.table} ${where} ORDER BY issued_at DESC`);
+    return rows.map(rowToRecord);
+  }
+  async revokedKids() {
+    const rows = await this.client.many(`SELECT kid FROM ${this.table} WHERE revoked_at IS NOT NULL`);
+    return rows.map((row) => String(row.kid));
+  }
+}
+function readHeader(source, name) {
+  const lower = name.toLowerCase();
+  if (typeof source === "function") {
+    return source(name) ?? source(lower) ?? null;
+  }
+  if (typeof Headers !== "undefined" && source instanceof Headers) {
+    return source.get(name);
+  }
+  const record = source;
+  const value = record[name] ?? record[lower] ?? record[name.toUpperCase()];
+  if (Array.isArray(value))
+    return value[0] ?? null;
+  return value ?? null;
+}
+function extractToken(source, headerName = "x-api-key", scheme = "Bearer") {
+  const direct = readHeader(source, headerName);
+  if (direct && direct.trim().length > 0)
+    return direct.trim();
+  const authz = readHeader(source, "authorization");
+  if (authz) {
+    const prefix = `${scheme} `;
+    if (authz.toLowerCase().startsWith(prefix.toLowerCase())) {
+      const token = authz.slice(prefix.length).trim();
+      if (token.length > 0)
+        return token;
+    }
+  }
+  return null;
+}
+function verifyApiKey(options) {
+  if (!options.app)
+    throw new Error("verifyApiKey requires an 'app' slug.");
+  if (!options.signingSecret) {
+    throw new Error("verifyApiKey requires a 'signingSecret'. Set it from HASNA_<APP>_API_SIGNING_KEY.");
+  }
+  const headerName = options.headerName ?? "x-api-key";
+  const scheme = options.scheme ?? "Bearer";
+  const clock = options.nowMs ?? (() => Date.now());
+  async function emit(event) {
+    if (!options.audit)
+      return;
+    try {
+      await options.audit(event);
+    } catch {}
+  }
+  async function authenticate(headers, context = {}) {
+    const method = context.method ?? null;
+    const path = context.path ?? null;
+    const requiredScopes = [...options.requiredScopes ?? [], ...context.requiredScopes ?? []];
+    const at = new Date(clock()).toISOString();
+    const token = extractToken(headers, headerName, scheme);
+    if (!token) {
+      const decision = {
+        ok: false,
+        status: 401,
+        reason: "missing_token",
+        message: `Missing API key. Send it as '${headerName}: <key>' or 'Authorization: ${scheme} <key>'.`
+      };
+      await emit({ outcome: "deny", app: options.app, kid: null, reason: "missing_token", scopesRequired: requiredScopes, method, path, status: 401, at });
+      return decision;
+    }
+    const verified = verifyApiKeyToken(token, {
+      signingSecret: options.signingSecret,
+      expectedApp: options.app,
+      nowMs: clock(),
+      ...options.leewaySeconds !== undefined ? { leewaySeconds: options.leewaySeconds } : {},
+      requiredScopes
+    });
+    if (!verified.ok) {
+      const status = verified.reason === "insufficient_scope" ? 403 : 401;
+      await emit({ outcome: "deny", app: options.app, kid: null, reason: verified.reason, scopesRequired: requiredScopes, method, path, status, at });
+      return { ok: false, status, reason: verified.reason, message: verified.message };
+    }
+    if (options.isRevoked) {
+      const revoked = await options.isRevoked(verified.kid);
+      if (revoked) {
+        await emit({ outcome: "deny", app: options.app, kid: verified.kid, reason: "revoked", scopesRequired: requiredScopes, method, path, status: 401, at });
+        return { ok: false, status: 401, reason: "revoked", message: "API key has been revoked." };
+      }
+    }
+    const principal = {
+      kid: verified.kid,
+      app: verified.app,
+      scopes: verified.claims.scopes,
+      agent: verified.claims.agent ?? null,
+      claims: verified.claims
+    };
+    await emit({ outcome: "allow", app: options.app, kid: verified.kid, reason: null, scopesRequired: requiredScopes, method, path, status: 200, at });
+    return { ok: true, status: 200, principal };
+  }
+  return { authenticate, app: options.app };
+}
+
+// src/generated/storage-kit/migrations.ts
+import { createHash as createHash4 } from "crypto";
+var DEFAULT_MIGRATION_LEDGER_TABLE = "schema_migrations";
+function checksumSql(sql) {
+  const normalized = sql.trim().replace(/\r\n/g, `
+`);
+  return `sha256:${createHash4("sha256").update(normalized).digest("hex")}`;
+}
+function defineMigration(id, sql) {
+  return Object.freeze({ id, sql: sql.trim(), checksum: checksumSql(sql) });
+}
+
+class MigrationLedger {
+  client;
+  migrations;
+  ledgerTable;
+  constructor(client, migrations, options = {}) {
+    this.client = client;
+    this.migrations = migrations;
+    this.ledgerTable = options.ledgerTable ?? DEFAULT_MIGRATION_LEDGER_TABLE;
+    const seen = new Set;
+    for (const migration of migrations) {
+      if (seen.has(migration.id))
+        throw new Error(`Duplicate migration id: ${migration.id}`);
+      seen.add(migration.id);
+    }
+  }
+  async ensureLedger() {
+    await this.client.execute(`CREATE TABLE IF NOT EXISTS ${this.ledgerTable} (
+         id TEXT PRIMARY KEY,
+         checksum TEXT NOT NULL,
+         applied_at TIMESTAMPTZ NOT NULL DEFAULT now()
+       )`);
+  }
+  async listApplied() {
+    await this.ensureLedger();
+    return this.readApplied();
+  }
+  async readApplied() {
+    const rows = await this.client.many(`SELECT id, checksum, applied_at FROM ${this.ledgerTable} ORDER BY id ASC`);
+    return rows.map((row) => ({
+      id: row.id,
+      checksum: row.checksum,
+      appliedAt: row.applied_at instanceof Date ? row.applied_at.toISOString() : String(row.applied_at)
+    }));
+  }
+  buildPlan(applied) {
+    const known = new Set(this.migrations.map((m) => m.id));
+    for (const row of applied) {
+      if (!known.has(row.id)) {
+        throw new Error(`Applied migration '${row.id}' is not recognized by this build (downgrade?).`);
+      }
+    }
+    const appliedById = new Map(applied.map((row) => [row.id, row]));
+    for (const migration of this.migrations) {
+      const existing = appliedById.get(migration.id);
+      if (existing && existing.checksum !== migration.checksum) {
+        throw new Error(`Migration checksum mismatch for '${migration.id}': the SQL changed after it was applied.`);
+      }
+    }
+    return this.migrations.map((migration) => ({
+      migration,
+      state: appliedById.has(migration.id) ? "already_applied" : "pending"
+    }));
+  }
+  async migrate(opts = {}) {
+    const dryRun = opts.dryRun === true;
+    await this.ensureLedger();
+    const applied = await this.readApplied();
+    const plan = this.buildPlan(applied);
+    if (dryRun)
+      return { dryRun, applied, plan };
+    for (const item of plan) {
+      if (item.state === "already_applied")
+        continue;
+      await this.client.execute(item.migration.sql);
+      await this.client.execute(`INSERT INTO ${this.ledgerTable} (id, checksum, applied_at) VALUES ($1, $2, now())`, [item.migration.id, item.migration.checksum]);
+    }
+    return { dryRun, applied: await this.readApplied(), plan };
+  }
+}
+
+// src/db/migrations.ts
+var CORE_MIGRATIONS = [
+  defineMigration("shortlinks_0001_domains", `CREATE TABLE IF NOT EXISTS domains (
+       id TEXT PRIMARY KEY,
+       hostname TEXT NOT NULL UNIQUE,
+       provider TEXT NOT NULL DEFAULT 'manual',
+       default_domain INTEGER NOT NULL DEFAULT 0,
+       cloudflare_zone_id TEXT,
+       cloudflare_account_id TEXT,
+       cloudflare_worker_name TEXT,
+       origin_url TEXT,
+       notes TEXT,
+       metadata TEXT NOT NULL DEFAULT '{}',
+       machine_id TEXT,
+       synced_at TIMESTAMPTZ,
+       created_at TIMESTAMPTZ NOT NULL,
+       updated_at TIMESTAMPTZ NOT NULL
+     )`),
+  defineMigration("shortlinks_0002_links", `CREATE TABLE IF NOT EXISTS links (
+       id TEXT PRIMARY KEY,
+       domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+       slug TEXT NOT NULL,
+       destination_url TEXT NOT NULL,
+       title TEXT,
+       active INTEGER NOT NULL DEFAULT 1,
+       expires_at TIMESTAMPTZ,
+       metadata TEXT NOT NULL DEFAULT '{}',
+       machine_id TEXT,
+       synced_at TIMESTAMPTZ,
+       created_at TIMESTAMPTZ NOT NULL,
+       updated_at TIMESTAMPTZ NOT NULL,
+       UNIQUE(domain_id, slug)
+     )`),
+  defineMigration("shortlinks_0003_clicks", `CREATE TABLE IF NOT EXISTS clicks (
+       id TEXT PRIMARY KEY,
+       link_id TEXT NOT NULL REFERENCES links(id) ON DELETE CASCADE,
+       domain_id TEXT NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
+       slug TEXT NOT NULL,
+       clicked_at TIMESTAMPTZ NOT NULL,
+       ip_hash TEXT,
+       user_agent TEXT,
+       referer TEXT,
+       country TEXT,
+       city TEXT,
+       metadata TEXT NOT NULL DEFAULT '{}',
+       machine_id TEXT,
+       synced_at TIMESTAMPTZ,
+       created_at TIMESTAMPTZ NOT NULL,
+       updated_at TIMESTAMPTZ NOT NULL
+     )`),
+  defineMigration("shortlinks_0004_indexes", `CREATE INDEX IF NOT EXISTS idx_domains_hostname ON domains(hostname);
+     CREATE INDEX IF NOT EXISTS idx_domains_default ON domains(default_domain);
+     CREATE INDEX IF NOT EXISTS idx_links_domain_slug ON links(domain_id, slug);
+     CREATE INDEX IF NOT EXISTS idx_links_active ON links(active);
+     CREATE INDEX IF NOT EXISTS idx_links_updated ON links(updated_at);
+     CREATE INDEX IF NOT EXISTS idx_clicks_link ON clicks(link_id);
+     CREATE INDEX IF NOT EXISTS idx_clicks_domain ON clicks(domain_id);
+     CREATE INDEX IF NOT EXISTS idx_clicks_clicked_at ON clicks(clicked_at);
+     CREATE INDEX IF NOT EXISTS idx_clicks_updated ON clicks(updated_at)`)
+];
+var SHORTLINKS_MIGRATIONS = [
+  ...CORE_MIGRATIONS,
+  ...apiKeyMigrations().map((m) => defineMigration(m.id, m.sql))
+];
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/compose.js
+var compose = (middleware, onError, onNotFound) => {
+  return (context, next) => {
+    let index = -1;
+    return dispatch(0);
+    async function dispatch(i) {
+      if (i <= index) {
+        throw new Error("next() called multiple times");
+      }
+      index = i;
+      let res;
+      let isError = false;
+      let handler;
+      if (middleware[i]) {
+        handler = middleware[i][0][0];
+        context.req.routeIndex = i;
+      } else {
+        handler = i === middleware.length && next || undefined;
+      }
+      if (handler) {
+        try {
+          res = await handler(context, () => dispatch(i + 1));
+        } catch (err) {
+          if (err instanceof Error && onError) {
+            context.error = err;
+            res = await onError(err, context);
+            isError = true;
+          } else {
+            throw err;
+          }
+        }
+      } else {
+        if (context.finalized === false && onNotFound) {
+          res = await onNotFound(context);
+        }
+      }
+      if (res && (context.finalized === false || isError)) {
+        context.res = res;
+      }
+      return context;
+    }
+  };
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/request/constants.js
+var GET_MATCH_RESULT = /* @__PURE__ */ Symbol();
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/utils/body.js
+var parseBody = async (request, options = /* @__PURE__ */ Object.create(null)) => {
+  const { all = false, dot = false } = options;
+  const headers = request instanceof HonoRequest ? request.raw.headers : request.headers;
+  const contentType = headers.get("Content-Type");
+  if (contentType?.startsWith("multipart/form-data") || contentType?.startsWith("application/x-www-form-urlencoded")) {
+    return parseFormData(request, { all, dot });
+  }
+  return {};
+};
+async function parseFormData(request, options) {
+  const formData = await request.formData();
+  if (formData) {
+    return convertFormDataToBodyData(formData, options);
+  }
+  return {};
+}
+function convertFormDataToBodyData(formData, options) {
+  const form = /* @__PURE__ */ Object.create(null);
+  formData.forEach((value, key) => {
+    const shouldParseAllValues = options.all || key.endsWith("[]");
+    if (!shouldParseAllValues) {
+      form[key] = value;
+    } else {
+      handleParsingAllValues(form, key, value);
+    }
+  });
+  if (options.dot) {
+    Object.entries(form).forEach(([key, value]) => {
+      const shouldParseDotValues = key.includes(".");
+      if (shouldParseDotValues) {
+        handleParsingNestedValues(form, key, value);
+        delete form[key];
+      }
+    });
+  }
+  return form;
+}
+var handleParsingAllValues = (form, key, value) => {
+  if (form[key] !== undefined) {
+    if (Array.isArray(form[key])) {
+      form[key].push(value);
+    } else {
+      form[key] = [form[key], value];
+    }
+  } else {
+    if (!key.endsWith("[]")) {
+      form[key] = value;
+    } else {
+      form[key] = [value];
+    }
+  }
+};
+var handleParsingNestedValues = (form, key, value) => {
+  if (/(?:^|\.)__proto__\./.test(key)) {
+    return;
+  }
+  let nestedForm = form;
+  const keys = key.split(".");
+  keys.forEach((key2, index) => {
+    if (index === keys.length - 1) {
+      nestedForm[key2] = value;
+    } else {
+      if (!nestedForm[key2] || typeof nestedForm[key2] !== "object" || Array.isArray(nestedForm[key2]) || nestedForm[key2] instanceof File) {
+        nestedForm[key2] = /* @__PURE__ */ Object.create(null);
+      }
+      nestedForm = nestedForm[key2];
+    }
+  });
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/utils/url.js
+var splitPath = (path) => {
+  const paths = path.split("/");
+  if (paths[0] === "") {
+    paths.shift();
+  }
+  return paths;
+};
+var splitRoutingPath = (routePath) => {
+  const { groups, path } = extractGroupsFromPath(routePath);
+  const paths = splitPath(path);
+  return replaceGroupMarks(paths, groups);
+};
+var extractGroupsFromPath = (path) => {
+  const groups = [];
+  path = path.replace(/\{[^}]+\}/g, (match, index) => {
+    const mark = `@${index}`;
+    groups.push([mark, match]);
+    return mark;
+  });
+  return { groups, path };
+};
+var replaceGroupMarks = (paths, groups) => {
+  for (let i = groups.length - 1;i >= 0; i--) {
+    const [mark] = groups[i];
+    for (let j = paths.length - 1;j >= 0; j--) {
+      if (paths[j].includes(mark)) {
+        paths[j] = paths[j].replace(mark, groups[i][1]);
+        break;
+      }
+    }
+  }
+  return paths;
+};
+var patternCache = {};
+var getPattern = (label, next) => {
+  if (label === "*") {
+    return "*";
+  }
+  const match = label.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);
+  if (match) {
+    const cacheKey = `${label}#${next}`;
+    if (!patternCache[cacheKey]) {
+      if (match[2]) {
+        patternCache[cacheKey] = next && next[0] !== ":" && next[0] !== "*" ? [cacheKey, match[1], new RegExp(`^${match[2]}(?=/${next})`)] : [label, match[1], new RegExp(`^${match[2]}$`)];
+      } else {
+        patternCache[cacheKey] = [label, match[1], true];
+      }
+    }
+    return patternCache[cacheKey];
+  }
+  return null;
+};
+var tryDecode = (str, decoder) => {
+  try {
+    return decoder(str);
+  } catch {
+    return str.replace(/(?:%[0-9A-Fa-f]{2})+/g, (match) => {
+      try {
+        return decoder(match);
+      } catch {
+        return match;
+      }
+    });
+  }
+};
+var tryDecodeURI = (str) => tryDecode(str, decodeURI);
+var getPath = (request) => {
+  const url = request.url;
+  const start = url.indexOf("/", url.indexOf(":") + 4);
+  let i = start;
+  for (;i < url.length; i++) {
+    const charCode = url.charCodeAt(i);
+    if (charCode === 37) {
+      const queryIndex = url.indexOf("?", i);
+      const hashIndex = url.indexOf("#", i);
+      const end = queryIndex === -1 ? hashIndex === -1 ? undefined : hashIndex : hashIndex === -1 ? queryIndex : Math.min(queryIndex, hashIndex);
+      const path = url.slice(start, end);
+      return tryDecodeURI(path.includes("%25") ? path.replace(/%25/g, "%2525") : path);
+    } else if (charCode === 63 || charCode === 35) {
+      break;
+    }
+  }
+  return url.slice(start, i);
+};
+var getPathNoStrict = (request) => {
+  const result = getPath(request);
+  return result.length > 1 && result.at(-1) === "/" ? result.slice(0, -1) : result;
+};
+var mergePath = (base, sub, ...rest) => {
+  if (rest.length) {
+    sub = mergePath(sub, ...rest);
+  }
+  return `${base?.[0] === "/" ? "" : "/"}${base}${sub === "/" ? "" : `${base?.at(-1) === "/" ? "" : "/"}${sub?.[0] === "/" ? sub.slice(1) : sub}`}`;
+};
+var checkOptionalParameter = (path) => {
+  if (path.charCodeAt(path.length - 1) !== 63 || !path.includes(":")) {
+    return null;
+  }
+  const segments = path.split("/");
+  const results = [];
+  let basePath = "";
+  segments.forEach((segment) => {
+    if (segment !== "" && !/\:/.test(segment)) {
+      basePath += "/" + segment;
+    } else if (/\:/.test(segment)) {
+      if (/\?/.test(segment)) {
+        if (results.length === 0 && basePath === "") {
+          results.push("/");
+        } else {
+          results.push(basePath);
+        }
+        const optionalSegment = segment.replace("?", "");
+        basePath += "/" + optionalSegment;
+        results.push(basePath);
+      } else {
+        basePath += "/" + segment;
+      }
+    }
+  });
+  return results.filter((v, i, a) => a.indexOf(v) === i);
+};
+var _decodeURI = (value) => {
+  if (!/[%+]/.test(value)) {
+    return value;
+  }
+  if (value.indexOf("+") !== -1) {
+    value = value.replace(/\+/g, " ");
+  }
+  return value.indexOf("%") !== -1 ? tryDecode(value, decodeURIComponent_) : value;
+};
+var _getQueryParam = (url, key, multiple) => {
+  let encoded;
+  if (!multiple && key && !/[%+]/.test(key)) {
+    let keyIndex2 = url.indexOf("?", 8);
+    if (keyIndex2 === -1) {
+      return;
+    }
+    if (!url.startsWith(key, keyIndex2 + 1)) {
+      keyIndex2 = url.indexOf(`&${key}`, keyIndex2 + 1);
+    }
+    while (keyIndex2 !== -1) {
+      const trailingKeyCode = url.charCodeAt(keyIndex2 + key.length + 1);
+      if (trailingKeyCode === 61) {
+        const valueIndex = keyIndex2 + key.length + 2;
+        const endIndex = url.indexOf("&", valueIndex);
+        return _decodeURI(url.slice(valueIndex, endIndex === -1 ? undefined : endIndex));
+      } else if (trailingKeyCode == 38 || isNaN(trailingKeyCode)) {
+        return "";
+      }
+      keyIndex2 = url.indexOf(`&${key}`, keyIndex2 + 1);
+    }
+    encoded = /[%+]/.test(url);
+    if (!encoded) {
+      return;
+    }
+  }
+  const results = {};
+  encoded ??= /[%+]/.test(url);
+  let keyIndex = url.indexOf("?", 8);
+  while (keyIndex !== -1) {
+    const nextKeyIndex = url.indexOf("&", keyIndex + 1);
+    let valueIndex = url.indexOf("=", keyIndex);
+    if (valueIndex > nextKeyIndex && nextKeyIndex !== -1) {
+      valueIndex = -1;
+    }
+    let name = url.slice(keyIndex + 1, valueIndex === -1 ? nextKeyIndex === -1 ? undefined : nextKeyIndex : valueIndex);
+    if (encoded) {
+      name = _decodeURI(name);
+    }
+    keyIndex = nextKeyIndex;
+    if (name === "") {
+      continue;
+    }
+    let value;
+    if (valueIndex === -1) {
+      value = "";
+    } else {
+      value = url.slice(valueIndex + 1, nextKeyIndex === -1 ? undefined : nextKeyIndex);
+      if (encoded) {
+        value = _decodeURI(value);
+      }
+    }
+    if (multiple) {
+      if (!(results[name] && Array.isArray(results[name]))) {
+        results[name] = [];
+      }
+      results[name].push(value);
+    } else {
+      results[name] ??= value;
+    }
+  }
+  return key ? results[key] : results;
+};
+var getQueryParam = _getQueryParam;
+var getQueryParams = (url, key) => {
+  return _getQueryParam(url, key, true);
+};
+var decodeURIComponent_ = decodeURIComponent;
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/request.js
+var tryDecodeURIComponent = (str) => tryDecode(str, decodeURIComponent_);
+var HonoRequest = class {
+  raw;
+  #validatedData;
+  #matchResult;
+  routeIndex = 0;
+  path;
+  bodyCache = {};
+  constructor(request, path = "/", matchResult = [[]]) {
+    this.raw = request;
+    this.path = path;
+    this.#matchResult = matchResult;
+    this.#validatedData = {};
+  }
+  param(key) {
+    return key ? this.#getDecodedParam(key) : this.#getAllDecodedParams();
+  }
+  #getDecodedParam(key) {
+    const paramKey = this.#matchResult[0][this.routeIndex][1][key];
+    const param = this.#getParamValue(paramKey);
+    return param && /\%/.test(param) ? tryDecodeURIComponent(param) : param;
+  }
+  #getAllDecodedParams() {
+    const decoded = {};
+    const keys = Object.keys(this.#matchResult[0][this.routeIndex][1]);
+    for (const key of keys) {
+      const value = this.#getParamValue(this.#matchResult[0][this.routeIndex][1][key]);
+      if (value !== undefined) {
+        decoded[key] = /\%/.test(value) ? tryDecodeURIComponent(value) : value;
+      }
+    }
+    return decoded;
+  }
+  #getParamValue(paramKey) {
+    return this.#matchResult[1] ? this.#matchResult[1][paramKey] : paramKey;
+  }
+  query(key) {
+    return getQueryParam(this.url, key);
+  }
+  queries(key) {
+    return getQueryParams(this.url, key);
+  }
+  header(name) {
+    if (name) {
+      return this.raw.headers.get(name) ?? undefined;
+    }
+    const headerData = {};
+    this.raw.headers.forEach((value, key) => {
+      headerData[key] = value;
+    });
+    return headerData;
+  }
+  async parseBody(options) {
+    return parseBody(this, options);
+  }
+  #cachedBody = (key) => {
+    const { bodyCache, raw } = this;
+    const cachedBody = bodyCache[key];
+    if (cachedBody) {
+      return cachedBody;
+    }
+    const anyCachedKey = Object.keys(bodyCache)[0];
+    if (anyCachedKey) {
+      return bodyCache[anyCachedKey].then((body) => {
+        if (anyCachedKey === "json") {
+          body = JSON.stringify(body);
+        }
+        return new Response(body)[key]();
+      });
+    }
+    return bodyCache[key] = raw[key]();
+  };
+  json() {
+    return this.#cachedBody("text").then((text) => JSON.parse(text));
+  }
+  text() {
+    return this.#cachedBody("text");
+  }
+  arrayBuffer() {
+    return this.#cachedBody("arrayBuffer");
+  }
+  bytes() {
+    return this.#cachedBody("arrayBuffer").then((buffer) => new Uint8Array(buffer));
+  }
+  blob() {
+    return this.#cachedBody("blob");
+  }
+  formData() {
+    return this.#cachedBody("formData");
+  }
+  addValidatedData(target, data) {
+    this.#validatedData[target] = data;
+  }
+  valid(target) {
+    return this.#validatedData[target];
+  }
+  get url() {
+    return this.raw.url;
+  }
+  get method() {
+    return this.raw.method;
+  }
+  get [GET_MATCH_RESULT]() {
+    return this.#matchResult;
+  }
+  get matchedRoutes() {
+    return this.#matchResult[0].map(([[, route]]) => route);
+  }
+  get routePath() {
+    return this.#matchResult[0].map(([[, route]]) => route)[this.routeIndex].path;
+  }
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/utils/html.js
+var HtmlEscapedCallbackPhase = {
+  Stringify: 1,
+  BeforeStream: 2,
+  Stream: 3
+};
+var raw = (value, callbacks) => {
+  const escapedString = new String(value);
+  escapedString.isEscaped = true;
+  escapedString.callbacks = callbacks;
+  return escapedString;
+};
+var resolveCallback = async (str, phase, preserveCallbacks, context, buffer) => {
+  if (typeof str === "object" && !(str instanceof String)) {
+    if (!(str instanceof Promise)) {
+      str = str.toString();
+    }
+    if (str instanceof Promise) {
+      str = await str;
+    }
+  }
+  const callbacks = str.callbacks;
+  if (!callbacks?.length) {
+    return Promise.resolve(str);
+  }
+  if (buffer) {
+    buffer[0] += str;
+  } else {
+    buffer = [str];
+  }
+  const resStr = Promise.all(callbacks.map((c) => c({ phase, buffer, context }))).then((res) => Promise.all(res.filter(Boolean).map((str2) => resolveCallback(str2, phase, false, context, buffer))).then(() => buffer[0]));
+  if (preserveCallbacks) {
+    return raw(await resStr, callbacks);
+  } else {
+    return resStr;
+  }
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/context.js
+var TEXT_PLAIN = "text/plain; charset=UTF-8";
+var setDefaultContentType = (contentType, headers) => {
+  return {
+    "Content-Type": contentType,
+    ...headers
+  };
+};
+var createResponseInstance = (body, init) => new Response(body, init);
+var Context = class {
+  #rawRequest;
+  #req;
+  env = {};
+  #var;
+  finalized = false;
+  error;
+  #status;
+  #executionCtx;
+  #res;
+  #layout;
+  #renderer;
+  #notFoundHandler;
+  #preparedHeaders;
+  #matchResult;
+  #path;
+  constructor(req, options) {
+    this.#rawRequest = req;
+    if (options) {
+      this.#executionCtx = options.executionCtx;
+      this.env = options.env;
+      this.#notFoundHandler = options.notFoundHandler;
+      this.#path = options.path;
+      this.#matchResult = options.matchResult;
+    }
+  }
+  get req() {
+    this.#req ??= new HonoRequest(this.#rawRequest, this.#path, this.#matchResult);
+    return this.#req;
+  }
+  get event() {
+    if (this.#executionCtx && "respondWith" in this.#executionCtx) {
+      return this.#executionCtx;
+    } else {
+      throw Error("This context has no FetchEvent");
+    }
+  }
+  get executionCtx() {
+    if (this.#executionCtx) {
+      return this.#executionCtx;
+    } else {
+      throw Error("This context has no ExecutionContext");
+    }
+  }
+  get res() {
+    return this.#res ||= createResponseInstance(null, {
+      headers: this.#preparedHeaders ??= new Headers
+    });
+  }
+  set res(_res) {
+    if (this.#res && _res) {
+      _res = createResponseInstance(_res.body, _res);
+      for (const [k, v] of this.#res.headers.entries()) {
+        if (k === "content-type") {
+          continue;
+        }
+        if (k === "set-cookie") {
+          const cookies = this.#res.headers.getSetCookie();
+          _res.headers.delete("set-cookie");
+          for (const cookie of cookies) {
+            _res.headers.append("set-cookie", cookie);
+          }
+        } else {
+          _res.headers.set(k, v);
+        }
+      }
+    }
+    this.#res = _res;
+    this.finalized = true;
+  }
+  render = (...args) => {
+    this.#renderer ??= (content) => this.html(content);
+    return this.#renderer(...args);
+  };
+  setLayout = (layout) => this.#layout = layout;
+  getLayout = () => this.#layout;
+  setRenderer = (renderer) => {
+    this.#renderer = renderer;
+  };
+  header = (name, value, options) => {
+    if (this.finalized) {
+      this.#res = createResponseInstance(this.#res.body, this.#res);
+    }
+    const headers = this.#res ? this.#res.headers : this.#preparedHeaders ??= new Headers;
+    if (value === undefined) {
+      headers.delete(name);
+    } else if (options?.append) {
+      headers.append(name, value);
+    } else {
+      headers.set(name, value);
+    }
+  };
+  status = (status) => {
+    this.#status = status;
+  };
+  set = (key, value) => {
+    this.#var ??= /* @__PURE__ */ new Map;
+    this.#var.set(key, value);
+  };
+  get = (key) => {
+    return this.#var ? this.#var.get(key) : undefined;
+  };
+  get var() {
+    if (!this.#var) {
+      return {};
+    }
+    return Object.fromEntries(this.#var);
+  }
+  #newResponse(data, arg, headers) {
+    const responseHeaders = this.#res ? new Headers(this.#res.headers) : this.#preparedHeaders ?? new Headers;
+    if (typeof arg === "object" && "headers" in arg) {
+      const argHeaders = arg.headers instanceof Headers ? arg.headers : new Headers(arg.headers);
+      for (const [key, value] of argHeaders) {
+        if (key.toLowerCase() === "set-cookie") {
+          responseHeaders.append(key, value);
+        } else {
+          responseHeaders.set(key, value);
+        }
+      }
+    }
+    if (headers) {
+      for (const [k, v] of Object.entries(headers)) {
+        if (typeof v === "string") {
+          responseHeaders.set(k, v);
+        } else {
+          responseHeaders.delete(k);
+          for (const v2 of v) {
+            responseHeaders.append(k, v2);
+          }
+        }
+      }
+    }
+    const status = typeof arg === "number" ? arg : arg?.status ?? this.#status;
+    return createResponseInstance(data, { status, headers: responseHeaders });
+  }
+  newResponse = (...args) => this.#newResponse(...args);
+  body = (data, arg, headers) => this.#newResponse(data, arg, headers);
+  text = (text, arg, headers) => {
+    return !this.#preparedHeaders && !this.#status && !arg && !headers && !this.finalized ? new Response(text) : this.#newResponse(text, arg, setDefaultContentType(TEXT_PLAIN, headers));
+  };
+  json = (object, arg, headers) => {
+    return this.#newResponse(JSON.stringify(object), arg, setDefaultContentType("application/json", headers));
+  };
+  html = (html, arg, headers) => {
+    const res = (html2) => this.#newResponse(html2, arg, setDefaultContentType("text/html; charset=UTF-8", headers));
+    return typeof html === "object" ? resolveCallback(html, HtmlEscapedCallbackPhase.Stringify, false, {}).then(res) : res(html);
+  };
+  redirect = (location, status) => {
+    const locationString = String(location);
+    this.header("Location", !/[^\x00-\xFF]/.test(locationString) ? locationString : encodeURI(locationString));
+    return this.newResponse(null, status ?? 302);
+  };
+  notFound = () => {
+    this.#notFoundHandler ??= () => createResponseInstance();
+    return this.#notFoundHandler(this);
+  };
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/router.js
+var METHOD_NAME_ALL = "ALL";
+var METHOD_NAME_ALL_LOWERCASE = "all";
+var METHODS = ["get", "post", "put", "delete", "options", "patch"];
+var MESSAGE_MATCHER_IS_ALREADY_BUILT = "Can not add a route since the matcher is already built.";
+var UnsupportedPathError = class extends Error {
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/utils/constants.js
+var COMPOSED_HANDLER = "__COMPOSED_HANDLER";
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/hono-base.js
+var notFoundHandler = (c) => {
+  return c.text("404 Not Found", 404);
+};
+var errorHandler = (err, c) => {
+  if ("getResponse" in err) {
+    const res = err.getResponse();
+    return c.newResponse(res.body, res);
+  }
+  console.error(err);
+  return c.text("Internal Server Error", 500);
+};
+var Hono = class _Hono {
+  get;
+  post;
+  put;
+  delete;
+  options;
+  patch;
+  all;
+  on;
+  use;
+  router;
+  getPath;
+  _basePath = "/";
+  #path = "/";
+  routes = [];
+  constructor(options = {}) {
+    const allMethods = [...METHODS, METHOD_NAME_ALL_LOWERCASE];
+    allMethods.forEach((method) => {
+      this[method] = (args1, ...args) => {
+        if (typeof args1 === "string") {
+          this.#path = args1;
+        } else {
+          this.#addRoute(method, this.#path, args1);
+        }
+        args.forEach((handler) => {
+          this.#addRoute(method, this.#path, handler);
+        });
+        return this;
+      };
+    });
+    this.on = (method, path, ...handlers) => {
+      for (const p of [path].flat()) {
+        this.#path = p;
+        for (const m of [method].flat()) {
+          handlers.map((handler) => {
+            this.#addRoute(m.toUpperCase(), this.#path, handler);
+          });
+        }
+      }
+      return this;
+    };
+    this.use = (arg1, ...handlers) => {
+      if (typeof arg1 === "string") {
+        this.#path = arg1;
+      } else {
+        this.#path = "*";
+        handlers.unshift(arg1);
+      }
+      handlers.forEach((handler) => {
+        this.#addRoute(METHOD_NAME_ALL, this.#path, handler);
+      });
+      return this;
+    };
+    const { strict, ...optionsWithoutStrict } = options;
+    Object.assign(this, optionsWithoutStrict);
+    this.getPath = strict ?? true ? options.getPath ?? getPath : getPathNoStrict;
+  }
+  #clone() {
+    const clone = new _Hono({
+      router: this.router,
+      getPath: this.getPath
+    });
+    clone.errorHandler = this.errorHandler;
+    clone.#notFoundHandler = this.#notFoundHandler;
+    clone.routes = this.routes;
+    return clone;
+  }
+  #notFoundHandler = notFoundHandler;
+  errorHandler = errorHandler;
+  route(path, app) {
+    const subApp = this.basePath(path);
+    app.routes.map((r) => {
+      let handler;
+      if (app.errorHandler === errorHandler) {
+        handler = r.handler;
+      } else {
+        handler = async (c, next) => (await compose([], app.errorHandler)(c, () => r.handler(c, next))).res;
+        handler[COMPOSED_HANDLER] = r.handler;
+      }
+      subApp.#addRoute(r.method, r.path, handler, r.basePath);
+    });
+    return this;
+  }
+  basePath(path) {
+    const subApp = this.#clone();
+    subApp._basePath = mergePath(this._basePath, path);
+    return subApp;
+  }
+  onError = (handler) => {
+    this.errorHandler = handler;
+    return this;
+  };
+  notFound = (handler) => {
+    this.#notFoundHandler = handler;
+    return this;
+  };
+  mount(path, applicationHandler, options) {
+    let replaceRequest;
+    let optionHandler;
+    if (options) {
+      if (typeof options === "function") {
+        optionHandler = options;
+      } else {
+        optionHandler = options.optionHandler;
+        if (options.replaceRequest === false) {
+          replaceRequest = (request) => request;
+        } else {
+          replaceRequest = options.replaceRequest;
+        }
+      }
+    }
+    const getOptions = optionHandler ? (c) => {
+      const options2 = optionHandler(c);
+      return Array.isArray(options2) ? options2 : [options2];
+    } : (c) => {
+      let executionContext = undefined;
+      try {
+        executionContext = c.executionCtx;
+      } catch {}
+      return [c.env, executionContext];
+    };
+    replaceRequest ||= (() => {
+      const mergedPath = mergePath(this._basePath, path);
+      const pathPrefixLength = mergedPath === "/" ? 0 : mergedPath.length;
+      return (request) => {
+        const url = new URL(request.url);
+        url.pathname = this.getPath(request).slice(pathPrefixLength) || "/";
+        return new Request(url, request);
+      };
+    })();
+    const handler = async (c, next) => {
+      const res = await applicationHandler(replaceRequest(c.req.raw), ...getOptions(c));
+      if (res) {
+        return res;
+      }
+      await next();
+    };
+    this.#addRoute(METHOD_NAME_ALL, mergePath(path, "*"), handler);
+    return this;
+  }
+  #addRoute(method, path, handler, baseRoutePath) {
+    method = method.toUpperCase();
+    path = mergePath(this._basePath, path);
+    const r = {
+      basePath: baseRoutePath !== undefined ? mergePath(this._basePath, baseRoutePath) : this._basePath,
+      path,
+      method,
+      handler
+    };
+    this.router.add(method, path, [handler, r]);
+    this.routes.push(r);
+  }
+  #handleError(err, c) {
+    if (err instanceof Error) {
+      return this.errorHandler(err, c);
+    }
+    throw err;
+  }
+  #dispatch(request, executionCtx, env, method) {
+    if (method === "HEAD") {
+      return (async () => new Response(null, await this.#dispatch(request, executionCtx, env, "GET")))();
+    }
+    const path = this.getPath(request, { env });
+    const matchResult = this.router.match(method, path);
+    const c = new Context(request, {
+      path,
+      matchResult,
+      env,
+      executionCtx,
+      notFoundHandler: this.#notFoundHandler
+    });
+    if (matchResult[0].length === 1) {
+      let res;
+      try {
+        res = matchResult[0][0][0][0](c, async () => {
+          c.res = await this.#notFoundHandler(c);
+        });
+      } catch (err) {
+        return this.#handleError(err, c);
+      }
+      return res instanceof Promise ? res.then((resolved) => resolved || (c.finalized ? c.res : this.#notFoundHandler(c))).catch((err) => this.#handleError(err, c)) : res ?? this.#notFoundHandler(c);
+    }
+    const composed = compose(matchResult[0], this.errorHandler, this.#notFoundHandler);
+    return (async () => {
+      try {
+        const context = await composed(c);
+        if (!context.finalized) {
+          throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");
+        }
+        return context.res;
+      } catch (err) {
+        return this.#handleError(err, c);
+      }
+    })();
+  }
+  fetch = (request, ...rest) => {
+    return this.#dispatch(request, rest[1], rest[0], request.method);
+  };
+  request = (input, requestInit, Env, executionCtx) => {
+    if (input instanceof Request) {
+      return this.fetch(requestInit ? new Request(input, requestInit) : input, Env, executionCtx);
+    }
+    input = input.toString();
+    return this.fetch(new Request(/^https?:\/\//.test(input) ? input : `http://localhost${mergePath("/", input)}`, requestInit), Env, executionCtx);
+  };
+  fire = () => {
+    addEventListener("fetch", (event) => {
+      event.respondWith(this.#dispatch(event.request, event, undefined, event.request.method));
+    });
+  };
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/router/reg-exp-router/matcher.js
+var emptyParam = [];
+function match(method, path) {
+  const matchers = this.buildAllMatchers();
+  const match2 = (method2, path2) => {
+    const matcher = matchers[method2] || matchers[METHOD_NAME_ALL];
+    const staticMatch = matcher[2][path2];
+    if (staticMatch) {
+      return staticMatch;
+    }
+    const match3 = path2.match(matcher[0]);
+    if (!match3) {
+      return [[], emptyParam];
+    }
+    const index = match3.indexOf("", 1);
+    return [matcher[1][index], match3];
+  };
+  this.match = match2;
+  return match2(method, path);
+}
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/router/reg-exp-router/node.js
+var LABEL_REG_EXP_STR = "[^/]+";
+var ONLY_WILDCARD_REG_EXP_STR = ".*";
+var TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
+var PATH_ERROR = /* @__PURE__ */ Symbol();
+var regExpMetaChars = new Set(".\\+*[^]$()");
+function compareKey(a, b) {
+  if (a.length === 1) {
+    return b.length === 1 ? a < b ? -1 : 1 : -1;
+  }
+  if (b.length === 1) {
+    return 1;
+  }
+  if (a === ONLY_WILDCARD_REG_EXP_STR || a === TAIL_WILDCARD_REG_EXP_STR) {
+    return 1;
+  } else if (b === ONLY_WILDCARD_REG_EXP_STR || b === TAIL_WILDCARD_REG_EXP_STR) {
+    return -1;
+  }
+  if (a === LABEL_REG_EXP_STR) {
+    return 1;
+  } else if (b === LABEL_REG_EXP_STR) {
+    return -1;
+  }
+  return a.length === b.length ? a < b ? -1 : 1 : b.length - a.length;
+}
+var Node = class _Node {
+  #index;
+  #varIndex;
+  #children = /* @__PURE__ */ Object.create(null);
+  insert(tokens, index, paramMap, context, pathErrorCheckOnly) {
+    if (tokens.length === 0) {
+      if (this.#index !== undefined) {
+        throw PATH_ERROR;
+      }
+      if (pathErrorCheckOnly) {
+        return;
+      }
+      this.#index = index;
+      return;
+    }
+    const [token, ...restTokens] = tokens;
+    const pattern = token === "*" ? restTokens.length === 0 ? ["", "", ONLY_WILDCARD_REG_EXP_STR] : ["", "", LABEL_REG_EXP_STR] : token === "/*" ? ["", "", TAIL_WILDCARD_REG_EXP_STR] : token.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);
+    let node;
+    if (pattern) {
+      const name = pattern[1];
+      let regexpStr = pattern[2] || LABEL_REG_EXP_STR;
+      if (name && pattern[2]) {
+        if (regexpStr === ".*") {
+          throw PATH_ERROR;
+        }
+        regexpStr = regexpStr.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:");
+        if (/\((?!\?:)/.test(regexpStr)) {
+          throw PATH_ERROR;
+        }
+      }
+      node = this.#children[regexpStr];
+      if (!node) {
+        if (Object.keys(this.#children).some((k) => k !== ONLY_WILDCARD_REG_EXP_STR && k !== TAIL_WILDCARD_REG_EXP_STR)) {
+          throw PATH_ERROR;
+        }
+        if (pathErrorCheckOnly) {
+          return;
+        }
+        node = this.#children[regexpStr] = new _Node;
+        if (name !== "") {
+          node.#varIndex = context.varIndex++;
+        }
+      }
+      if (!pathErrorCheckOnly && name !== "") {
+        paramMap.push([name, node.#varIndex]);
+      }
+    } else {
+      node = this.#children[token];
+      if (!node) {
+        if (Object.keys(this.#children).some((k) => k.length > 1 && k !== ONLY_WILDCARD_REG_EXP_STR && k !== TAIL_WILDCARD_REG_EXP_STR)) {
+          throw PATH_ERROR;
+        }
+        if (pathErrorCheckOnly) {
+          return;
+        }
+        node = this.#children[token] = new _Node;
+      }
+    }
+    node.insert(restTokens, index, paramMap, context, pathErrorCheckOnly);
+  }
+  buildRegExpStr() {
+    const childKeys = Object.keys(this.#children).sort(compareKey);
+    const strList = childKeys.map((k) => {
+      const c = this.#children[k];
+      return (typeof c.#varIndex === "number" ? `(${k})@${c.#varIndex}` : regExpMetaChars.has(k) ? `\\${k}` : k) + c.buildRegExpStr();
+    });
+    if (typeof this.#index === "number") {
+      strList.unshift(`#${this.#index}`);
+    }
+    if (strList.length === 0) {
+      return "";
+    }
+    if (strList.length === 1) {
+      return strList[0];
+    }
+    return "(?:" + strList.join("|") + ")";
+  }
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/router/reg-exp-router/trie.js
+var Trie = class {
+  #context = { varIndex: 0 };
+  #root = new Node;
+  insert(path, index, pathErrorCheckOnly) {
+    const paramAssoc = [];
+    const groups = [];
+    for (let i = 0;; ) {
+      let replaced = false;
+      path = path.replace(/\{[^}]+\}/g, (m) => {
+        const mark = `@\\${i}`;
+        groups[i] = [mark, m];
+        i++;
+        replaced = true;
+        return mark;
+      });
+      if (!replaced) {
+        break;
+      }
+    }
+    const tokens = path.match(/(?::[^\/]+)|(?:\/\*$)|./g) || [];
+    for (let i = groups.length - 1;i >= 0; i--) {
+      const [mark] = groups[i];
+      for (let j = tokens.length - 1;j >= 0; j--) {
+        if (tokens[j].indexOf(mark) !== -1) {
+          tokens[j] = tokens[j].replace(mark, groups[i][1]);
+          break;
+        }
+      }
+    }
+    this.#root.insert(tokens, index, paramAssoc, this.#context, pathErrorCheckOnly);
+    return paramAssoc;
+  }
+  buildRegExp() {
+    let regexp = this.#root.buildRegExpStr();
+    if (regexp === "") {
+      return [/^$/, [], []];
+    }
+    let captureIndex = 0;
+    const indexReplacementMap = [];
+    const paramReplacementMap = [];
+    regexp = regexp.replace(/#(\d+)|@(\d+)|\.\*\$/g, (_, handlerIndex, paramIndex) => {
+      if (handlerIndex !== undefined) {
+        indexReplacementMap[++captureIndex] = Number(handlerIndex);
+        return "$()";
+      }
+      if (paramIndex !== undefined) {
+        paramReplacementMap[Number(paramIndex)] = ++captureIndex;
+        return "";
+      }
+      return "";
+    });
+    return [new RegExp(`^${regexp}`), indexReplacementMap, paramReplacementMap];
+  }
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/router/reg-exp-router/router.js
+var nullMatcher = [/^$/, [], /* @__PURE__ */ Object.create(null)];
+var wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
+function buildWildcardRegExp(path) {
+  return wildcardRegExpCache[path] ??= new RegExp(path === "*" ? "" : `^${path.replace(/\/\*$|([.\\+*[^\]$()])/g, (_, metaChar) => metaChar ? `\\${metaChar}` : "(?:|/.*)")}$`);
+}
+function clearWildcardRegExpCache() {
+  wildcardRegExpCache = /* @__PURE__ */ Object.create(null);
+}
+function buildMatcherFromPreprocessedRoutes(routes) {
+  const trie = new Trie;
+  const handlerData = [];
+  if (routes.length === 0) {
+    return nullMatcher;
+  }
+  const routesWithStaticPathFlag = routes.map((route) => [!/\*|\/:/.test(route[0]), ...route]).sort(([isStaticA, pathA], [isStaticB, pathB]) => isStaticA ? 1 : isStaticB ? -1 : pathA.length - pathB.length);
+  const staticMap = /* @__PURE__ */ Object.create(null);
+  for (let i = 0, j = -1, len = routesWithStaticPathFlag.length;i < len; i++) {
+    const [pathErrorCheckOnly, path, handlers] = routesWithStaticPathFlag[i];
+    if (pathErrorCheckOnly) {
+      staticMap[path] = [handlers.map(([h]) => [h, /* @__PURE__ */ Object.create(null)]), emptyParam];
+    } else {
+      j++;
+    }
+    let paramAssoc;
+    try {
+      paramAssoc = trie.insert(path, j, pathErrorCheckOnly);
+    } catch (e) {
+      throw e === PATH_ERROR ? new UnsupportedPathError(path) : e;
+    }
+    if (pathErrorCheckOnly) {
+      continue;
+    }
+    handlerData[j] = handlers.map(([h, paramCount]) => {
+      const paramIndexMap = /* @__PURE__ */ Object.create(null);
+      paramCount -= 1;
+      for (;paramCount >= 0; paramCount--) {
+        const [key, value] = paramAssoc[paramCount];
+        paramIndexMap[key] = value;
+      }
+      return [h, paramIndexMap];
+    });
+  }
+  const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
+  for (let i = 0, len = handlerData.length;i < len; i++) {
+    for (let j = 0, len2 = handlerData[i].length;j < len2; j++) {
+      const map = handlerData[i][j]?.[1];
+      if (!map) {
+        continue;
+      }
+      const keys = Object.keys(map);
+      for (let k = 0, len3 = keys.length;k < len3; k++) {
+        map[keys[k]] = paramReplacementMap[map[keys[k]]];
+      }
+    }
+  }
+  const handlerMap = [];
+  for (const i in indexReplacementMap) {
+    handlerMap[i] = handlerData[indexReplacementMap[i]];
+  }
+  return [regexp, handlerMap, staticMap];
+}
+function findMiddleware(middleware, path) {
+  if (!middleware) {
+    return;
+  }
+  for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) {
+    if (buildWildcardRegExp(k).test(path)) {
+      return [...middleware[k]];
+    }
+  }
+  return;
+}
+var RegExpRouter = class {
+  name = "RegExpRouter";
+  #middleware;
+  #routes;
+  constructor() {
+    this.#middleware = { [METHOD_NAME_ALL]: /* @__PURE__ */ Object.create(null) };
+    this.#routes = { [METHOD_NAME_ALL]: /* @__PURE__ */ Object.create(null) };
+  }
+  add(method, path, handler) {
+    const middleware = this.#middleware;
+    const routes = this.#routes;
+    if (!middleware || !routes) {
+      throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
+    }
+    if (!middleware[method]) {
+      [middleware, routes].forEach((handlerMap) => {
+        handlerMap[method] = /* @__PURE__ */ Object.create(null);
+        Object.keys(handlerMap[METHOD_NAME_ALL]).forEach((p) => {
+          handlerMap[method][p] = [...handlerMap[METHOD_NAME_ALL][p]];
+        });
+      });
+    }
+    if (path === "/*") {
+      path = "*";
+    }
+    const paramCount = (path.match(/\/:/g) || []).length;
+    if (/\*$/.test(path)) {
+      const re = buildWildcardRegExp(path);
+      if (method === METHOD_NAME_ALL) {
+        Object.keys(middleware).forEach((m) => {
+          middleware[m][path] ||= findMiddleware(middleware[m], path) || findMiddleware(middleware[METHOD_NAME_ALL], path) || [];
+        });
+      } else {
+        middleware[method][path] ||= findMiddleware(middleware[method], path) || findMiddleware(middleware[METHOD_NAME_ALL], path) || [];
+      }
+      Object.keys(middleware).forEach((m) => {
+        if (method === METHOD_NAME_ALL || method === m) {
+          Object.keys(middleware[m]).forEach((p) => {
+            re.test(p) && middleware[m][p].push([handler, paramCount]);
+          });
+        }
+      });
+      Object.keys(routes).forEach((m) => {
+        if (method === METHOD_NAME_ALL || method === m) {
+          Object.keys(routes[m]).forEach((p) => re.test(p) && routes[m][p].push([handler, paramCount]));
+        }
+      });
+      return;
+    }
+    const paths = checkOptionalParameter(path) || [path];
+    for (let i = 0, len = paths.length;i < len; i++) {
+      const path2 = paths[i];
+      Object.keys(routes).forEach((m) => {
+        if (method === METHOD_NAME_ALL || method === m) {
+          routes[m][path2] ||= [
+            ...findMiddleware(middleware[m], path2) || findMiddleware(middleware[METHOD_NAME_ALL], path2) || []
+          ];
+          routes[m][path2].push([handler, paramCount - len + i + 1]);
+        }
+      });
+    }
+  }
+  match = match;
+  buildAllMatchers() {
+    const matchers = /* @__PURE__ */ Object.create(null);
+    Object.keys(this.#routes).concat(Object.keys(this.#middleware)).forEach((method) => {
+      matchers[method] ||= this.#buildMatcher(method);
+    });
+    this.#middleware = this.#routes = undefined;
+    clearWildcardRegExpCache();
+    return matchers;
+  }
+  #buildMatcher(method) {
+    const routes = [];
+    let hasOwnRoute = method === METHOD_NAME_ALL;
+    [this.#middleware, this.#routes].forEach((r) => {
+      const ownRoute = r[method] ? Object.keys(r[method]).map((path) => [path, r[method][path]]) : [];
+      if (ownRoute.length !== 0) {
+        hasOwnRoute ||= true;
+        routes.push(...ownRoute);
+      } else if (method !== METHOD_NAME_ALL) {
+        routes.push(...Object.keys(r[METHOD_NAME_ALL]).map((path) => [path, r[METHOD_NAME_ALL][path]]));
+      }
+    });
+    if (!hasOwnRoute) {
+      return null;
+    } else {
+      return buildMatcherFromPreprocessedRoutes(routes);
+    }
+  }
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/router/reg-exp-router/prepared-router.js
+var PreparedRegExpRouter = class {
+  name = "PreparedRegExpRouter";
+  #matchers;
+  #relocateMap;
+  constructor(matchers, relocateMap) {
+    this.#matchers = matchers;
+    this.#relocateMap = relocateMap;
+  }
+  #addWildcard(method, handlerData) {
+    const matcher = this.#matchers[method];
+    matcher[1].forEach((list) => list && list.push(handlerData));
+    Object.values(matcher[2]).forEach((list) => list[0].push(handlerData));
+  }
+  #addPath(method, path, handler, indexes, map) {
+    const matcher = this.#matchers[method];
+    if (!map) {
+      matcher[2][path][0].push([handler, {}]);
+    } else {
+      indexes.forEach((index) => {
+        if (typeof index === "number") {
+          matcher[1][index].push([handler, map]);
+        } else {
+          matcher[2][index || path][0].push([handler, map]);
+        }
+      });
+    }
+  }
+  add(method, path, handler) {
+    if (!this.#matchers[method]) {
+      const all = this.#matchers[METHOD_NAME_ALL];
+      const staticMap = {};
+      for (const key in all[2]) {
+        staticMap[key] = [all[2][key][0].slice(), emptyParam];
+      }
+      this.#matchers[method] = [
+        all[0],
+        all[1].map((list) => Array.isArray(list) ? list.slice() : 0),
+        staticMap
+      ];
+    }
+    if (path === "/*" || path === "*") {
+      const handlerData = [handler, {}];
+      if (method === METHOD_NAME_ALL) {
+        for (const m in this.#matchers) {
+          this.#addWildcard(m, handlerData);
+        }
+      } else {
+        this.#addWildcard(method, handlerData);
+      }
+      return;
+    }
+    const data = this.#relocateMap[path];
+    if (!data) {
+      throw new Error(`Path ${path} is not registered`);
+    }
+    for (const [indexes, map] of data) {
+      if (method === METHOD_NAME_ALL) {
+        for (const m in this.#matchers) {
+          this.#addPath(m, path, handler, indexes, map);
+        }
+      } else {
+        this.#addPath(method, path, handler, indexes, map);
+      }
+    }
+  }
+  buildAllMatchers() {
+    return this.#matchers;
+  }
+  match = match;
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/router/smart-router/router.js
+var SmartRouter = class {
+  name = "SmartRouter";
+  #routers = [];
+  #routes = [];
+  constructor(init) {
+    this.#routers = init.routers;
+  }
+  add(method, path, handler) {
+    if (!this.#routes) {
+      throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
+    }
+    this.#routes.push([method, path, handler]);
+  }
+  match(method, path) {
+    if (!this.#routes) {
+      throw new Error("Fatal error");
+    }
+    const routers = this.#routers;
+    const routes = this.#routes;
+    const len = routers.length;
+    let i = 0;
+    let res;
+    for (;i < len; i++) {
+      const router = routers[i];
+      try {
+        for (let i2 = 0, len2 = routes.length;i2 < len2; i2++) {
+          router.add(...routes[i2]);
+        }
+        res = router.match(method, path);
+      } catch (e) {
+        if (e instanceof UnsupportedPathError) {
+          continue;
+        }
+        throw e;
+      }
+      this.match = router.match.bind(router);
+      this.#routers = [router];
+      this.#routes = undefined;
+      break;
+    }
+    if (i === len) {
+      throw new Error("Fatal error");
+    }
+    this.name = `SmartRouter + ${this.activeRouter.name}`;
+    return res;
+  }
+  get activeRouter() {
+    if (this.#routes || this.#routers.length !== 1) {
+      throw new Error("No active router has been determined yet.");
+    }
+    return this.#routers[0];
+  }
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/router/trie-router/node.js
+var emptyParams = /* @__PURE__ */ Object.create(null);
+var hasChildren = (children) => {
+  for (const _ in children) {
+    return true;
+  }
+  return false;
+};
+var Node2 = class _Node2 {
+  #methods;
+  #children;
+  #patterns;
+  #order = 0;
+  #params = emptyParams;
+  constructor(method, handler, children) {
+    this.#children = children || /* @__PURE__ */ Object.create(null);
+    this.#methods = [];
+    if (method && handler) {
+      const m = /* @__PURE__ */ Object.create(null);
+      m[method] = { handler, possibleKeys: [], score: 0 };
+      this.#methods = [m];
+    }
+    this.#patterns = [];
+  }
+  insert(method, path, handler) {
+    this.#order = ++this.#order;
+    let curNode = this;
+    const parts = splitRoutingPath(path);
+    const possibleKeys = [];
+    for (let i = 0, len = parts.length;i < len; i++) {
+      const p = parts[i];
+      const nextP = parts[i + 1];
+      const pattern = getPattern(p, nextP);
+      const key = Array.isArray(pattern) ? pattern[0] : p;
+      if (key in curNode.#children) {
+        curNode = curNode.#children[key];
+        if (pattern) {
+          possibleKeys.push(pattern[1]);
+        }
+        continue;
+      }
+      curNode.#children[key] = new _Node2;
+      if (pattern) {
+        curNode.#patterns.push(pattern);
+        possibleKeys.push(pattern[1]);
+      }
+      curNode = curNode.#children[key];
+    }
+    curNode.#methods.push({
+      [method]: {
+        handler,
+        possibleKeys: possibleKeys.filter((v, i, a) => a.indexOf(v) === i),
+        score: this.#order
+      }
+    });
+    return curNode;
+  }
+  #pushHandlerSets(handlerSets, node, method, nodeParams, params) {
+    for (let i = 0, len = node.#methods.length;i < len; i++) {
+      const m = node.#methods[i];
+      const handlerSet = m[method] || m[METHOD_NAME_ALL];
+      const processedSet = {};
+      if (handlerSet !== undefined) {
+        handlerSet.params = /* @__PURE__ */ Object.create(null);
+        handlerSets.push(handlerSet);
+        if (nodeParams !== emptyParams || params && params !== emptyParams) {
+          for (let i2 = 0, len2 = handlerSet.possibleKeys.length;i2 < len2; i2++) {
+            const key = handlerSet.possibleKeys[i2];
+            const processed = processedSet[handlerSet.score];
+            handlerSet.params[key] = params?.[key] && !processed ? params[key] : nodeParams[key] ?? params?.[key];
+            processedSet[handlerSet.score] = true;
+          }
+        }
+      }
+    }
+  }
+  search(method, path) {
+    const handlerSets = [];
+    this.#params = emptyParams;
+    const curNode = this;
+    let curNodes = [curNode];
+    const parts = splitPath(path);
+    const curNodesQueue = [];
+    const len = parts.length;
+    let partOffsets = null;
+    for (let i = 0;i < len; i++) {
+      const part = parts[i];
+      const isLast = i === len - 1;
+      const tempNodes = [];
+      for (let j = 0, len2 = curNodes.length;j < len2; j++) {
+        const node = curNodes[j];
+        const nextNode = node.#children[part];
+        if (nextNode) {
+          nextNode.#params = node.#params;
+          if (isLast) {
+            if (nextNode.#children["*"]) {
+              this.#pushHandlerSets(handlerSets, nextNode.#children["*"], method, node.#params);
+            }
+            this.#pushHandlerSets(handlerSets, nextNode, method, node.#params);
+          } else {
+            tempNodes.push(nextNode);
+          }
+        }
+        for (let k = 0, len3 = node.#patterns.length;k < len3; k++) {
+          const pattern = node.#patterns[k];
+          const params = node.#params === emptyParams ? {} : { ...node.#params };
+          if (pattern === "*") {
+            const astNode = node.#children["*"];
+            if (astNode) {
+              this.#pushHandlerSets(handlerSets, astNode, method, node.#params);
+              astNode.#params = params;
+              tempNodes.push(astNode);
+            }
+            continue;
+          }
+          const [key, name, matcher] = pattern;
+          if (!part && !(matcher instanceof RegExp)) {
+            continue;
+          }
+          const child = node.#children[key];
+          if (matcher instanceof RegExp) {
+            if (partOffsets === null) {
+              partOffsets = new Array(len);
+              let offset = path[0] === "/" ? 1 : 0;
+              for (let p = 0;p < len; p++) {
+                partOffsets[p] = offset;
+                offset += parts[p].length + 1;
+              }
+            }
+            const restPathString = path.substring(partOffsets[i]);
+            const m = matcher.exec(restPathString);
+            if (m) {
+              params[name] = m[0];
+              this.#pushHandlerSets(handlerSets, child, method, node.#params, params);
+              if (hasChildren(child.#children)) {
+                child.#params = params;
+                const componentCount = m[0].match(/\//)?.length ?? 0;
+                const targetCurNodes = curNodesQueue[componentCount] ||= [];
+                targetCurNodes.push(child);
+              }
+              continue;
+            }
+          }
+          if (matcher === true || matcher.test(part)) {
+            params[name] = part;
+            if (isLast) {
+              this.#pushHandlerSets(handlerSets, child, method, params, node.#params);
+              if (child.#children["*"]) {
+                this.#pushHandlerSets(handlerSets, child.#children["*"], method, params, node.#params);
+              }
+            } else {
+              child.#params = params;
+              tempNodes.push(child);
+            }
+          }
+        }
+      }
+      const shifted = curNodesQueue.shift();
+      curNodes = shifted ? tempNodes.concat(shifted) : tempNodes;
+    }
+    if (handlerSets.length > 1) {
+      handlerSets.sort((a, b) => {
+        return a.score - b.score;
+      });
+    }
+    return [handlerSets.map(({ handler, params }) => [handler, params])];
+  }
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/router/trie-router/router.js
+var TrieRouter = class {
+  name = "TrieRouter";
+  #node;
+  constructor() {
+    this.#node = new Node2;
+  }
+  add(method, path, handler) {
+    const results = checkOptionalParameter(path);
+    if (results) {
+      for (let i = 0, len = results.length;i < len; i++) {
+        this.#node.insert(method, results[i], handler);
+      }
+      return;
+    }
+    this.#node.insert(method, path, handler);
+  }
+  match(method, path) {
+    return this.#node.search(method, path);
+  }
+};
+
+// node_modules/.pnpm/hono@4.12.27/node_modules/hono/dist/hono.js
+var Hono2 = class extends Hono {
+  constructor(options = {}) {
+    super(options);
+    this.router = options.router ?? new SmartRouter({
+      routers: [new RegExpRouter, new TrieRouter]
+    });
+  }
+};
+
+// src/generated/storage-kit/health.ts
+async function checkHealth(client) {
+  const start = Date.now();
+  try {
+    await client.get("SELECT 1 AS ok");
+    return { ok: true, latencyMs: Date.now() - start };
+  } catch (error) {
+    return {
+      ok: false,
+      latencyMs: Date.now() - start,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function checkReady(client, migrations, options = {}) {
+  const start = Date.now();
+  try {
+    const ledger = new MigrationLedger(client, migrations, options);
+    const result = await ledger.migrate({ dryRun: true });
+    const pending = result.plan.filter((item) => item.state === "pending").map((item) => item.migration.id);
+    return { ok: pending.length === 0, latencyMs: Date.now() - start, pendingMigrations: pending };
+  } catch (error) {
+    return {
+      ok: false,
+      latencyMs: Date.now() - start,
+      pendingMigrations: [],
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+
+// src/serve/openapi.ts
+function buildOpenApiDocument(version) {
+  const linkSchema = {
+    type: "object",
+    properties: {
+      id: { type: "string" },
+      domain_id: { type: "string" },
+      hostname: { type: "string" },
+      slug: { type: "string" },
+      destination_url: { type: "string" },
+      title: { type: "string", nullable: true },
+      active: { type: "boolean" },
+      expires_at: { type: "string", nullable: true },
+      short_url: { type: "string" },
+      metadata: { type: "object", additionalProperties: true },
+      created_at: { type: "string" },
+      updated_at: { type: "string" }
+    },
+    required: ["id", "domain_id", "hostname", "slug", "destination_url", "active", "created_at"]
+  };
+  const domainSchema = {
+    type: "object",
+    properties: {
+      id: { type: "string" },
+      hostname: { type: "string" },
+      provider: { type: "string" },
+      default_domain: { type: "boolean" },
+      origin_url: { type: "string", nullable: true },
+      notes: { type: "string", nullable: true },
+      metadata: { type: "object", additionalProperties: true },
+      created_at: { type: "string" },
+      updated_at: { type: "string" }
+    },
+    required: ["id", "hostname", "provider", "default_domain", "created_at"]
+  };
+  const linkStatsSchema = {
+    type: "object",
+    properties: {
+      link: { $ref: "#/components/schemas/Link" },
+      clicks: { type: "integer" },
+      last_clicked_at: { type: "string", nullable: true },
+      top_referrers: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: { referer: { type: "string", nullable: true }, clicks: { type: "integer" } }
+        }
+      },
+      top_user_agents: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: { user_agent: { type: "string", nullable: true }, clicks: { type: "integer" } }
+        }
+      }
+    },
+    required: ["link", "clicks"]
+  };
+  const probe = (extra = {}) => ({
+    type: "object",
+    properties: {
+      status: { type: "string" },
+      version: { type: "string" },
+      mode: { type: "string" },
+      ...extra
+    },
+    required: ["status", "version", "mode"]
+  });
+  return {
+    openapi: "3.0.3",
+    info: {
+      title: "ShortlinksApi",
+      version,
+      description: "Shortlink manager \u2014 custom domains, click tracking, and shortlink CRUD with API-key auth. PURE REMOTE (Amendment A1): reads/writes RDS Postgres directly."
+    },
+    servers: [{ url: "/" }],
+    components: {
+      securitySchemes: {
+        apiKey: { type: "apiKey", in: "header", name: "x-api-key" }
+      },
+      schemas: {
+        Link: linkSchema,
+        Domain: domainSchema,
+        LinkStats: linkStatsSchema,
+        LinkList: { type: "array", items: linkSchema },
+        DomainList: { type: "array", items: domainSchema },
+        TotalStats: {
+          type: "object",
+          properties: {
+            domains: { type: "integer" },
+            links: { type: "integer" },
+            clicks: { type: "integer" }
+          },
+          required: ["domains", "links", "clicks"]
+        },
+        CreateLinkRequest: {
+          type: "object",
+          properties: {
+            url: { type: "string", description: "Destination URL (http/https)." },
+            domain: { type: "string", description: "Hostname; defaults to the default domain." },
+            slug: { type: "string", description: "Custom slug; generated when omitted." },
+            title: { type: "string" },
+            expires_at: { type: "string", description: "ISO date/time." },
+            length: { type: "integer", description: "Generated slug length." },
+            metadata: { type: "object", additionalProperties: true }
+          },
+          required: ["url"]
+        },
+        AddDomainRequest: {
+          type: "object",
+          properties: {
+            hostname: { type: "string" },
+            provider: { type: "string" },
+            default: { type: "boolean" },
+            origin_url: { type: "string" },
+            notes: { type: "string" },
+            metadata: { type: "object", additionalProperties: true }
+          },
+          required: ["hostname"]
+        },
+        DeleteResponse: {
+          type: "object",
+          properties: { deleted: { type: "boolean" }, slug: { type: "string" } },
+          required: ["deleted"]
+        },
+        HealthStatus: probe({ db_latency_ms: { type: "integer" } }),
+        ReadyStatus: probe({ pending_migrations: { type: "array", items: { type: "string" } } }),
+        VersionInfo: probe({ name: { type: "string" } }),
+        ErrorResponse: {
+          type: "object",
+          properties: { error: { type: "string" }, reason: { type: "string" } },
+          required: ["error"]
+        }
+      }
+    },
+    paths: {
+      "/health": {
+        get: {
+          operationId: "getHealth",
+          summary: "Liveness probe.",
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/HealthStatus" } } } }
+          }
+        }
+      },
+      "/ready": {
+        get: {
+          operationId: "getReady",
+          summary: "Readiness probe (DB reachable and schema migrated).",
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/ReadyStatus" } } } }
+          }
+        }
+      },
+      "/version": {
+        get: {
+          operationId: "getVersion",
+          summary: "Service version and mode.",
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/VersionInfo" } } } }
+          }
+        }
+      },
+      "/v1/stats": {
+        get: {
+          operationId: "getStats",
+          summary: "Total domains/links/clicks counts.",
+          security: [{ apiKey: [] }],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/TotalStats" } } } }
+          }
+        }
+      },
+      "/v1/domains": {
+        get: {
+          operationId: "listDomains",
+          summary: "List configured domains.",
+          security: [{ apiKey: [] }],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/DomainList" } } } }
+          }
+        },
+        post: {
+          operationId: "addDomain",
+          summary: "Add or update a domain.",
+          security: [{ apiKey: [] }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/AddDomainRequest" } } }
+          },
+          responses: {
+            "201": { content: { "application/json": { schema: { $ref: "#/components/schemas/Domain" } } } }
+          }
+        }
+      },
+      "/v1/links": {
+        get: {
+          operationId: "listLinks",
+          summary: "List shortlinks.",
+          security: [{ apiKey: [] }],
+          parameters: [
+            { name: "domain", in: "query", schema: { type: "string" } },
+            { name: "active", in: "query", schema: { type: "boolean" } },
+            { name: "limit", in: "query", schema: { type: "integer" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/LinkList" } } } }
+          }
+        },
+        post: {
+          operationId: "createLink",
+          summary: "Create a shortlink.",
+          security: [{ apiKey: [] }],
+          requestBody: {
+            required: true,
+            content: { "application/json": { schema: { $ref: "#/components/schemas/CreateLinkRequest" } } }
+          },
+          responses: {
+            "201": { content: { "application/json": { schema: { $ref: "#/components/schemas/Link" } } } }
+          }
+        }
+      },
+      "/v1/links/{slug}": {
+        get: {
+          operationId: "getLink",
+          summary: "Get a shortlink by slug.",
+          security: [{ apiKey: [] }],
+          parameters: [
+            { name: "slug", in: "path", required: true, schema: { type: "string" } },
+            { name: "domain", in: "query", schema: { type: "string" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/Link" } } } }
+          }
+        },
+        delete: {
+          operationId: "deleteLink",
+          summary: "Delete a shortlink.",
+          security: [{ apiKey: [] }],
+          parameters: [
+            { name: "slug", in: "path", required: true, schema: { type: "string" } },
+            { name: "domain", in: "query", schema: { type: "string" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/DeleteResponse" } } } }
+          }
+        }
+      },
+      "/v1/links/{slug}/enable": {
+        post: {
+          operationId: "enableLink",
+          summary: "Enable a shortlink.",
+          security: [{ apiKey: [] }],
+          parameters: [
+            { name: "slug", in: "path", required: true, schema: { type: "string" } },
+            { name: "domain", in: "query", schema: { type: "string" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/Link" } } } }
+          }
+        }
+      },
+      "/v1/links/{slug}/disable": {
+        post: {
+          operationId: "disableLink",
+          summary: "Disable a shortlink.",
+          security: [{ apiKey: [] }],
+          parameters: [
+            { name: "slug", in: "path", required: true, schema: { type: "string" } },
+            { name: "domain", in: "query", schema: { type: "string" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/Link" } } } }
+          }
+        }
+      },
+      "/v1/links/{slug}/stats": {
+        get: {
+          operationId: "getLinkStats",
+          summary: "Click stats for a shortlink.",
+          security: [{ apiKey: [] }],
+          parameters: [
+            { name: "slug", in: "path", required: true, schema: { type: "string" } },
+            { name: "domain", in: "query", schema: { type: "string" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/LinkStats" } } } }
+          }
+        }
+      },
+      "/v1/resolve/{slug}": {
+        get: {
+          operationId: "resolveLink",
+          summary: "Resolve a slug to its destination without recording a click.",
+          security: [{ apiKey: [] }],
+          parameters: [
+            { name: "slug", in: "path", required: true, schema: { type: "string" } },
+            { name: "domain", in: "query", schema: { type: "string" } }
+          ],
+          responses: {
+            "200": { content: { "application/json": { schema: { $ref: "#/components/schemas/Link" } } } }
+          }
+        }
+      }
+    }
+  };
+}
+
+// src/serve/app.ts
+var APP_SLUG = "shortlinks";
+var SECURITY_HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "Referrer-Policy": "no-referrer",
+  "Permissions-Policy": "camera=(), microphone=(), geolocation=(), payment=()"
+};
+function createServeApp(deps) {
+  const app = new Hono2;
+  const { store, client, version, mode } = deps;
+  const verifier = verifyApiKey({
+    app: APP_SLUG,
+    signingSecret: deps.signingSecret,
+    ...deps.isRevoked ? { isRevoked: deps.isRevoked } : {},
+    ...deps.audit ? { audit: deps.audit } : {}
+  });
+  app.use("*", async (c, next) => {
+    await next();
+    for (const [k, v] of Object.entries(SECURITY_HEADERS))
+      c.header(k, v);
+  });
+  async function requireScopes(c, scopes) {
+    const decision = await verifier.authenticate(c.req.raw.headers, {
+      method: c.req.method,
+      path: c.req.path,
+      requiredScopes: scopes
+    });
+    if (!decision.ok) {
+      return c.json({ error: decision.message, reason: decision.reason }, decision.status);
+    }
+    c.set("apiKey", decision.principal);
+    return null;
+  }
+  function handleError(c, error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const notFound = /not found/i.test(message);
+    return c.json({ error: message }, notFound ? 404 : 400);
+  }
+  app.get("/health", async (c) => {
+    const health = await checkHealth(client);
+    return c.json({ status: health.ok ? "ok" : "degraded", version, mode, db_latency_ms: health.latencyMs }, health.ok ? 200 : 503);
+  });
+  app.get("/ready", async (c) => {
+    const ready = await checkReady(client, SHORTLINKS_MIGRATIONS);
+    return c.json({
+      status: ready.ok ? "ready" : "not_ready",
+      version,
+      mode,
+      pending_migrations: ready.pendingMigrations,
+      ...ready.error ? { error: ready.error } : {}
+    }, ready.ok ? 200 : 503);
+  });
+  app.get("/version", (c) => c.json({ status: "ok", version, mode, name: `@hasna/${APP_SLUG}` }));
+  app.get("/openapi.json", (c) => c.json(buildOpenApiDocument(version)));
+  app.get("/v1/stats", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:read`]);
+    if (denied)
+      return denied;
+    return c.json(await store.totalStats());
+  });
+  app.get("/v1/domains", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:read`]);
+    if (denied)
+      return denied;
+    return c.json(await store.listDomains());
+  });
+  app.post("/v1/domains", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:write`]);
+    if (denied)
+      return denied;
+    const body = await c.req.json().catch(() => null);
+    if (!body?.hostname)
+      return c.json({ error: "hostname is required" }, 400);
+    try {
+      const domain = await store.addDomain({
+        hostname: body.hostname,
+        ...body.provider !== undefined ? { provider: body.provider } : {},
+        ...body.default !== undefined ? { defaultDomain: body.default } : {},
+        ...body.origin_url !== undefined ? { originUrl: body.origin_url } : {},
+        ...body.notes !== undefined ? { notes: body.notes } : {},
+        ...body.metadata !== undefined ? { metadata: body.metadata } : {}
+      });
+      return c.json(domain, 201);
+    } catch (error) {
+      return handleError(c, error);
+    }
+  });
+  app.get("/v1/links", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:read`]);
+    if (denied)
+      return denied;
+    const domain = c.req.query("domain");
+    const limit = c.req.query("limit") ? parseInt(c.req.query("limit"), 10) : 100;
+    const activeOnly = c.req.query("active") === "true";
+    const links = await store.listLinks({
+      ...domain ? { domain } : {},
+      activeOnly,
+      limit
+    });
+    return c.json(links);
+  });
+  app.post("/v1/links", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:write`]);
+    if (denied)
+      return denied;
+    const body = await c.req.json().catch(() => null);
+    if (!body?.url)
+      return c.json({ error: "url is required" }, 400);
+    try {
+      const link = await store.createLink({
+        destinationUrl: body.url,
+        ...body.domain !== undefined ? { domain: body.domain } : {},
+        ...body.slug !== undefined ? { slug: body.slug } : {},
+        ...body.title !== undefined ? { title: body.title } : {},
+        ...body.expires_at !== undefined ? { expiresAt: body.expires_at } : {},
+        ...body.length !== undefined ? { slugLength: body.length } : {},
+        ...body.metadata !== undefined ? { metadata: body.metadata } : {}
+      });
+      return c.json(link, 201);
+    } catch (error) {
+      return handleError(c, error);
+    }
+  });
+  app.get("/v1/links/:slug", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:read`]);
+    if (denied)
+      return denied;
+    const slug = c.req.param("slug");
+    const domain = c.req.query("domain");
+    const link = domain ? await store.getLink(domain, slug) : await store.getLink(slug);
+    if (!link)
+      return c.json({ error: "Link not found." }, 404);
+    return c.json(link);
+  });
+  app.delete("/v1/links/:slug", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:write`]);
+    if (denied)
+      return denied;
+    const slug = c.req.param("slug");
+    const domain = c.req.query("domain");
+    try {
+      const link = domain ? await store.deleteLink(domain, slug) : await store.deleteLink(slug);
+      return c.json({ deleted: true, slug: link.slug });
+    } catch (error) {
+      return handleError(c, error);
+    }
+  });
+  app.post("/v1/links/:slug/enable", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:write`]);
+    if (denied)
+      return denied;
+    const slug = c.req.param("slug");
+    const domain = c.req.query("domain");
+    try {
+      const link = domain ? await store.setLinkActive(domain, slug, true) : await store.setLinkActive(slug, true);
+      return c.json(link);
+    } catch (error) {
+      return handleError(c, error);
+    }
+  });
+  app.post("/v1/links/:slug/disable", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:write`]);
+    if (denied)
+      return denied;
+    const slug = c.req.param("slug");
+    const domain = c.req.query("domain");
+    try {
+      const link = domain ? await store.setLinkActive(domain, slug, false) : await store.setLinkActive(slug, false);
+      return c.json(link);
+    } catch (error) {
+      return handleError(c, error);
+    }
+  });
+  app.get("/v1/links/:slug/stats", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:read`]);
+    if (denied)
+      return denied;
+    const slug = c.req.param("slug");
+    const domain = c.req.query("domain");
+    try {
+      const stats = domain ? await store.getStats(domain, slug) : await store.getStats(slug);
+      return c.json(stats);
+    } catch (error) {
+      return handleError(c, error);
+    }
+  });
+  app.get("/v1/resolve/:slug", async (c) => {
+    const denied = await requireScopes(c, [`${APP_SLUG}:read`]);
+    if (denied)
+      return denied;
+    const slug = c.req.param("slug");
+    const domain = c.req.query("domain");
+    const link = domain ? await store.getLink(domain, slug) : await store.getLink(slug);
+    if (!link)
+      return c.json({ error: "Link not found." }, 404);
+    return c.json(link);
+  });
+  return app;
+}
 // src/local.ts
 import { spawnSync } from "child_process";
 import { homedir as homedir2 } from "os";
@@ -1523,8 +4157,11 @@ export {
   generateWorkerScript,
   formatShortUrl,
   createShortlinksHandler,
+  createServeApp,
   createLocalSetupPlan,
+  createKitPgAdapter,
   createCloudflarePlan,
+  buildOpenApiDocument,
   assertShortlinksPostgresConfig,
   applyPostgresMigrations,
   ShortlinksStore,
@@ -1532,6 +4169,7 @@ export {
   SQLITE_MIGRATIONS,
   SHORTLINKS_RUNTIME_FALLBACK_ENV,
   SHORTLINKS_RUNTIME_ENV,
+  SHORTLINKS_MIGRATIONS,
   PgShortlinksStore,
   PG_MIGRATIONS,
   CANONICAL_SHORTLINKS_RUNTIME_SECRET_PATH,