weifuwu 0.19.8 → 0.19.10

package/dist/index.js

@@ -1,10 +1,17 @@
 // env.ts
-import { readFileSync, existsSync } from "node:fs";
+import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
+function isDev() {
+  return process.env.NODE_ENV === "development";
+}
 function loadEnv(path2) {
   const filePath = resolve(process.cwd(), path2 ?? ".env");
-  if (!existsSync(filePath)) return;
-  const content = readFileSync(filePath, "utf-8");
+  let content;
+  try {
+    content = readFileSync(filePath, "utf-8");
+  } catch {
+    return;
+  }
   for (const line of content.split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
@@ -17,7 +24,7 @@ function loadEnv(path2) {
     if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
       value = value.slice(1, -1);
     } else {
-      const commentIdx = value.indexOf(" #");
+      const commentIdx = value.search(/\s#/);
       if (commentIdx !== -1) {
         value = value.slice(0, commentIdx).trimEnd();
       }
@@ -28,24 +35,24 @@ function loadEnv(path2) {
 
 // serve.ts
 import http from "node:http";
+var HttpError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "HttpError";
+  }
+};
 async function readBody(req, maxSize) {
   if (maxSize) {
     const cl = parseInt(req.headers["content-length"] ?? "0", 10);
-    if (cl > maxSize) {
-      const err = new Error("Request body too large");
-      err.status = 413;
-      throw err;
-    }
+    if (cl > maxSize) throw new HttpError("Request body too large", 413);
   }
   const chunks = [];
   let total = 0;
   for await (const chunk of req) {
     total += chunk.byteLength;
-    if (maxSize && total > maxSize) {
-      const err = new Error("Request body too large");
-      err.status = 413;
-      throw err;
-    }
+    if (maxSize && total > maxSize) throw new HttpError("Request body too large", 413);
     chunks.push(chunk);
   }
   return Buffer.concat(chunks);
@@ -92,7 +99,7 @@ async function sendResponse(res, response) {
   res.end();
 }
 async function createTestServer(handler) {
-  const server = serve(handler, { port: 0 });
+  const server = serve(handler, { port: 0, shutdown: false });
   await server.ready;
   return { server, url: `http://localhost:${server.port}` };
 }
@@ -106,7 +113,7 @@ function serve(handler, options) {
       const response = await handler(request, { params: {}, query });
       await sendResponse(res, response);
     } catch (err) {
-      if (err?.status === 413) {
+      if (err instanceof HttpError && err.status === 413) {
         res.writeHead(413, { "Content-Type": "text/plain" });
         res.end("Request Body Too Large");
         return;
@@ -122,6 +129,7 @@ function serve(handler, options) {
   const ready = new Promise((r) => {
     resolveReady = r;
   });
+  let shutdownHandler = null;
   if (options?.shutdown !== false) {
     let shuttingDown = false;
     const shutdown = () => {
@@ -130,6 +138,7 @@ function serve(handler, options) {
       server.close();
       process.exit(0);
     };
+    shutdownHandler = shutdown;
     process.on("SIGTERM", shutdown);
     process.on("SIGINT", shutdown);
   }
@@ -155,13 +164,19 @@ function serve(handler, options) {
   }
   server.on("error", (err) => {
     console.error("Failed to start server:", err.message);
-    process.exit(1);
+    server.close();
+    resolveReady();
   });
   server.listen(port, hostname, () => {
     resolveReady();
   });
   return {
     stop: () => {
+      if (shutdownHandler) {
+        process.off("SIGTERM", shutdownHandler);
+        process.off("SIGINT", shutdownHandler);
+        shutdownHandler = null;
+      }
       server.close();
     },
     ready,
@@ -190,75 +205,50 @@ var createWsNode = () => ({
   children: /* @__PURE__ */ new Map(),
   middlewares: []
 });
-var getTrieNode = (node, segment) => {
-  if (segment.startsWith(":")) {
-    if (!node.children.has(":")) {
-      const child2 = createTrieNode();
-      child2.param = segment.slice(1);
-      node.children.set(":", child2);
-    }
-    const child = node.children.get(":");
-    if (child.param !== segment.slice(1)) {
-      throw new Error(
-        `Param name conflict: ":${child.param}" already registered at this path position, cannot register ":"${segment.slice(1)}"`
-      );
-    }
-    return child;
-  }
-  if (!node.children.has(segment)) {
-    node.children.set(segment, createTrieNode());
-  }
-  return node.children.get(segment);
-};
-var matchTrieNode = (node, segment, params) => {
-  if (node.children.has(segment)) return node.children.get(segment);
-  if (node.children.has(":")) {
-    const child = node.children.get(":");
-    if (child.param) params[child.param] = segment;
-    return child;
+function createParamChild(node, segment, createNode) {
+  const paramName = segment.slice(1);
+  if (!node.children.has(":")) {
+    const child2 = createNode();
+    child2.param = paramName;
+    node.children.set(":", child2);
+  }
+  const child = node.children.get(":");
+  if (child.param !== paramName) {
+    throw new Error(
+      `Param name conflict: ":${child.param}" already registered, cannot register ":"${paramName}"`
+    );
   }
-  return null;
-};
-var getWsNode = (node, segment) => {
-  if (segment === "*") {
+  return child;
+}
+function getOrCreateChild(node, segment, createNode, allowWildcard) {
+  if (allowWildcard && segment === "*") {
     node.wildcard = true;
     return node;
   }
-  if (segment.startsWith(":")) {
-    if (!node.children.has(":")) {
-      const child2 = createWsNode();
-      child2.param = segment.slice(1);
-      node.children.set(":", child2);
-    }
-    const child = node.children.get(":");
-    if (child.param !== segment.slice(1)) {
-      throw new Error(
-        `Param name conflict: ":${child.param}" already registered at this path position`
-      );
-    }
-    return child;
-  }
-  if (!node.children.has(segment)) {
-    node.children.set(segment, createWsNode());
-  }
+  if (segment.startsWith(":")) return createParamChild(node, segment, createNode);
+  if (!node.children.has(segment)) node.children.set(segment, createNode());
   return node.children.get(segment);
-};
-var matchWsNode = (node, segment, params) => {
+}
+function matchChild(node, segment, params, allowWildcard = false) {
   if (node.children.has(segment)) return node.children.get(segment);
   if (node.children.has(":")) {
     const child = node.children.get(":");
     if (child.param) params[child.param] = segment;
     return child;
   }
-  if (node.wildcard) return node;
+  if (allowWildcard && node.wildcard) return node;
   return null;
-};
+}
 var Router = class _Router {
   root = createTrieNode();
   wsRoot = createWsNode();
   globalMws = [];
   errorHandler;
-  wss = new WebSocketServer({ noServer: true });
+  _wss;
+  get wss() {
+    if (!this._wss) this._wss = new WebSocketServer({ noServer: true });
+    return this._wss;
+  }
   use(arg1, arg2) {
     if (typeof arg1 === "string") {
       if (arg2 instanceof _Router) {
@@ -266,12 +256,10 @@ var Router = class _Router {
       } else if (typeof arg2 === "function") {
         let node = this.root;
         for (const segment of this.splitPath(arg1)) {
-          node = getTrieNode(node, segment);
+          node = getOrCreateChild(node, segment, createTrieNode, false);
         }
         node.pathMws.push(arg2);
       }
-    } else if (arg1 instanceof _Router) {
-      this._mountRouter("/", arg1);
     } else if (typeof arg1 === "function") {
       this.globalMws.push(arg1);
     }
@@ -308,7 +296,7 @@ var Router = class _Router {
   route(method, path2, ...args) {
     const last = args[args.length - 1];
     if (last instanceof _Router) {
-      this._mountRouter(path2, last);
+      this._mountRouter(path2, last, args.slice(0, -1));
       return this;
     }
     const handler = args.pop();
@@ -326,7 +314,7 @@ var Router = class _Router {
         if (middlewares.length > 0) node.middlewares.set(method, middlewares);
         return this;
       }
-      node = getTrieNode(node, segment);
+      node = getOrCreateChild(node, segment, createTrieNode, false);
     }
     node.handlers.set(method, handler);
     if (middlewares.length > 0) node.middlewares.set(method, middlewares);
@@ -338,16 +326,16 @@ var Router = class _Router {
     const segments = this.splitPath(path2);
     let node = this.wsRoot;
     for (const segment of segments) {
-      node = getWsNode(node, segment);
+      node = getOrCreateChild(node, segment, createWsNode, true);
     }
     node.handler = handler;
-    if (middlewares.length > 0) node.middlewares = middlewares;
+    node.middlewares = middlewares;
     return this;
   }
   handler() {
     return (req, ctx) => {
       const url = new URL(req.url);
-      return this.handle(req, ctx, this.splitPath(url.pathname), Object.fromEntries(url.searchParams));
+      return this.handle(req, ctx, this.splitPath(url.pathname));
     };
   }
   websocketHandler() {
@@ -357,86 +345,80 @@ var Router = class _Router {
       const url = new URL(req.url ?? "/", "http://localhost");
       const segments = url.pathname.split("/").filter(Boolean);
       const match = router.matchWsTrie(wsRoot, segments);
-      if (match) {
-        const query = Object.fromEntries(url.searchParams);
-        const webReq = new Request(url.href, {
-          method: req.method ?? "GET",
-          headers: Object.fromEntries(
-            Object.entries(req.headers).map(([k, v]) => [k, Array.isArray(v) ? v.join(", ") : v ?? ""])
-          )
-        });
-        const ctx = { params: match.params, query };
-        if (match.middlewares.length === 0) {
-          upgradeSocket(router.wss, req, socket, head, match.handler, ctx);
-          return;
-        }
-        let index = 0;
-        const dispatch = async (innerReq, ctx2) => {
-          if (index < match.middlewares.length) {
-            const mw = match.middlewares[index++];
-            return mw(innerReq, ctx2, dispatch);
-          }
-          return await new Promise((resolve15) => {
-            try {
-              upgradeSocket(router.wss, req, socket, head, match.handler, ctx2);
-              resolve15(new Response(null, { status: 101 }));
-            } catch {
-              socket.destroy();
-              resolve15(new Response("WebSocket upgrade failed", { status: 500 }));
-            }
-          });
-        };
-        Promise.resolve(dispatch(webReq, ctx)).then((result) => {
-          if (result.status !== 101) {
-            sendHttpResponseOnSocket(socket, result);
-          }
-        }).catch(() => {
-          socket.destroy();
-        });
+      if (!match) {
+        socket.destroy();
         return;
       }
-      socket.destroy();
+      const query = Object.fromEntries(url.searchParams);
+      const ctx = { params: match.params, query };
+      const allMws = router.globalMws.length === 0 && match.middlewares.length === 0 ? [] : [...router.globalMws, ...match.middlewares];
+      if (allMws.length === 0) {
+        upgradeSocket(router.wss, req, socket, head, match.handler, ctx);
+        return;
+      }
+      const finalHandler = () => {
+        try {
+          upgradeSocket(router.wss, req, socket, head, match.handler, ctx);
+        } catch {
+          socket.destroy();
+          return new Response("WebSocket upgrade failed", { status: 500 });
+        }
+        return new Response(null, { status: 200 });
+      };
+      const webReq = new Request(url.href, {
+        method: req.method ?? "GET",
+        headers: nodeReqHeadersToRecord(req.headers)
+      });
+      void router.runChain(allMws, finalHandler, webReq, ctx).then((result) => {
+        if (result.status >= 400) {
+          sendHttpResponseOnSocket(socket, result);
+        }
+      }).catch(() => {
+        socket.destroy();
+      });
     };
   }
-  _mountRouter(prefix, sub) {
+  _mountRouter(prefix, sub, extraMws = []) {
     const base = prefix === "/" ? "" : prefix.replace(/\/$/, "");
     const mountMw = (req, ctx, next) => {
       ctx.mountPath = (ctx.mountPath || "") + base;
       return next(req, ctx);
     };
-    this.globalMws.push(...sub.globalMws);
+    const allExtra = extraMws.length === 0 && sub.globalMws.length === 0 ? [mountMw] : [mountMw, ...extraMws, ...sub.globalMws];
     const routes = [];
     this._collect(sub.root, "", routes, []);
     for (const { method, path: path2, handler, middlewares } of routes) {
-      this.route(method, base + path2, mountMw, ...sub.globalMws, ...middlewares, handler);
+      this.route(method, base + path2, ...allExtra, ...middlewares, handler);
     }
     const wsRoutes = [];
     this._collectWs(sub.wsRoot, "", wsRoutes);
-    for (const { path: path2, handler } of wsRoutes) {
-      this.ws(base + path2, handler);
+    for (const { path: path2, handler, middlewares } of wsRoutes) {
+      this.ws(base + path2, ...allExtra, ...middlewares, handler);
     }
   }
+  mergeMws(base, extra) {
+    if (base.length === 0) return extra.length === 0 ? base : extra;
+    if (extra.length === 0) return base;
+    return [...base, ...extra];
+  }
   _collect(node, prefix, result, pathMwsAcc) {
-    const mws = [...pathMwsAcc, ...node.pathMws];
-    if (node.wildcard) {
-      for (const [method, handler] of node.handlers) {
-        result.push({ method, path: prefix + "/*", handler, middlewares: [...mws, ...node.middlewares.get(method) || []] });
-      }
-    } else {
-      for (const [method, handler] of node.handlers) {
-        result.push({ method, path: prefix || "/", handler, middlewares: [...mws, ...node.middlewares.get(method) || []] });
-      }
+    const mws = this.mergeMws(pathMwsAcc, node.pathMws);
+    for (const [method, handler] of node.handlers) {
+      const rmws = node.middlewares.get(method) || [];
+      const suffix = node.wildcard ? "/*" : "";
+      result.push({ method, path: (prefix || "/") + suffix, handler, middlewares: this.mergeMws(mws, rmws) });
     }
     for (const [seg, child] of node.children) {
-      if (seg === ":") this._collect(child, prefix + "/:" + child.param, result, mws);
-      else this._collect(child, prefix + "/" + seg, result, mws);
+      const next = seg === ":" ? `/:${child.param}` : `/${seg}`;
+      this._collect(child, prefix + next, result, mws);
     }
   }
-  _collectWs(node, prefix, result) {
-    if (node.handler) result.push({ path: prefix || "/", handler: node.handler });
+  _collectWs(node, prefix, result, pathMwsAcc = []) {
+    const mws = this.mergeMws(pathMwsAcc, node.middlewares);
+    if (node.handler) result.push({ path: prefix || "/", handler: node.handler, middlewares: mws });
     for (const [seg, child] of node.children) {
-      if (seg === ":") this._collectWs(child, prefix + "/:" + child.param, result);
-      else this._collectWs(child, prefix + "/" + seg, result);
+      const next = seg === ":" ? `/:${child.param}` : `/${seg}`;
+      this._collectWs(child, prefix + next, result, mws);
     }
   }
   splitPath(path2) {
@@ -460,8 +442,7 @@ var Router = class _Router {
         }
       }
       const segment = segments[i];
-      if (!segment) break;
-      const next = matchTrieNode(node, segment, params);
+      const next = matchChild(node, segment, params, false);
       if (!next) {
         if (wildcardHandler) {
           params["*"] = segments.slice(wildcardIdx).join("/");
@@ -486,56 +467,77 @@ var Router = class _Router {
       params["*"] = segments.slice(wildcardIdx).join("/");
       return { handler: wildcardHandler, middlewares: wildcardMws, pathMws, params };
     }
+    if (node.handlers.size > 0) {
+      return { middlewares: [], pathMws, params, allowedMethods: [...node.handlers.keys()].filter((k) => k !== "*") };
+    }
     return null;
   }
   matchWsTrie(root, segments) {
     let node = root;
     const params = {};
     for (const segment of segments) {
-      const next = matchWsNode(node, segment, params);
+      const next = matchChild(node, segment, params, true);
       if (!next) return null;
       node = next;
     }
     return node.handler ? { handler: node.handler, middlewares: node.middlewares, params } : null;
   }
-  async handle(req, ctx, segments, query) {
+  async handleError(e, req, ctx) {
+    const err = e instanceof Error ? e : new Error(String(e));
+    console.error(err);
+    return this.errorHandler ? await this.errorHandler(err, req, ctx) : new Response("Internal Server Error", { status: 500 });
+  }
+  async handle(req, ctx, segments) {
     const match = this.matchTrie(req.method, segments);
-    if (match?.handler) {
-      const { handler, middlewares: routeMws, pathMws, params } = match;
-      const allMws = this.globalMws.length + pathMws.length + routeMws.length === 0 ? [] : [...this.globalMws, ...pathMws, ...routeMws];
-      const ctxWithMatch = { ...ctx, params: { ...ctx.params, ...params } };
-      try {
-        return await this.runChain(allMws, handler, req, ctxWithMatch);
-      } catch (e) {
-        const err = e instanceof Error ? e : new Error(String(e));
-        console.error(err);
-        return this.errorHandler ? this.errorHandler(err, req, ctxWithMatch) : new Response("Internal Server Error", { status: 500 });
+    if (match) {
+      Object.assign(ctx.params, match.params);
+      if (match.handler) {
+        const { handler, middlewares: routeMws, pathMws } = match;
+        const mws = this.mergeMws(this.mergeMws(this.globalMws, pathMws), routeMws);
+        try {
+          return await this.runChain(mws, handler, req, ctx);
+        } catch (e) {
+          return this.handleError(e, req, ctx);
+        }
+      }
+      if (match.allowedMethods && match.allowedMethods.length > 0) {
+        if (this.globalMws.length > 0) {
+          try {
+            return await this.runChain(this.globalMws, () => new Response("Method Not Allowed", {
+              status: 405,
+              headers: { "Allow": match.allowedMethods.join(", ") }
+            }), req, ctx);
+          } catch (e) {
+            return this.handleError(e, req, ctx);
+          }
+        }
+        return new Response("Method Not Allowed", {
+          status: 405,
+          headers: { "Allow": match.allowedMethods.join(", ") }
+        });
       }
     }
     if (this.globalMws.length > 0) {
       try {
-        const delegate = () => new Response("Not Found", { status: 404 });
-        return await this.runChain(this.globalMws, delegate, req, ctx);
+        return await this.runChain(this.globalMws, () => new Response("Not Found", { status: 404 }), req, ctx);
       } catch (e) {
-        const err = e instanceof Error ? e : new Error(String(e));
-        console.error(err);
-        return this.errorHandler ? this.errorHandler(err, req, ctx) : new Response("Internal Server Error", { status: 500 });
+        return this.handleError(e, req, ctx);
       }
     }
     return new Response("Not Found", { status: 404 });
   }
   async runChain(middlewares, finalHandler, req, ctx) {
-    let index = 0;
-    const dispatch = async (req2, ctx2) => {
-      if (index < middlewares.length) {
-        const mw = middlewares[index++];
-        return mw ? await mw(req2, ctx2, dispatch) : new Response("Middleware error", { status: 500 });
-      }
-      return await finalHandler(req2, ctx2);
-    };
-    return dispatch(req, ctx);
+    if (middlewares.length === 0) return await finalHandler(req, ctx);
+    return await runChainLoop(middlewares, 0, finalHandler, req, ctx);
   }
 };
+function runChainLoop(middlewares, index, finalHandler, req, ctx) {
+  if (index < middlewares.length) {
+    const mw = middlewares[index];
+    return Promise.resolve(mw(req, ctx, (r, c) => runChainLoop(middlewares, index + 1, finalHandler, r, c)));
+  }
+  return Promise.resolve(finalHandler(req, ctx));
+}
 function upgradeSocket(wss, req, socket, head, handler, ctx) {
   wss.handleUpgrade(req, socket, head, (ws) => {
     if (handler.open) {
@@ -552,6 +554,13 @@ function upgradeSocket(wss, req, socket, head, handler, ctx) {
     });
   });
 }
+function nodeReqHeadersToRecord(headers) {
+  const result = {};
+  for (const [k, v] of Object.entries(headers)) {
+    if (v !== void 0) result[k] = Array.isArray(v) ? v.join(", ") : v;
+  }
+  return result;
+}
 function sendHttpResponseOnSocket(socket, response) {
   const statusLine = `HTTP/1.1 ${response.status} ${response.statusText}`;
   const headerLines = [statusLine];
@@ -562,8 +571,8 @@ function sendHttpResponseOnSocket(socket, response) {
   headerLines.push("");
   const headerStr = headerLines.join("\r\n");
   response.arrayBuffer().then((buf) => {
-    const body = Buffer.from(buf);
-    socket.write(headerStr + "\r\n" + body.toString());
+    socket.write(headerStr + "\r\n");
+    if (buf.byteLength > 0) socket.write(Buffer.from(buf));
     socket.end();
   }).catch(() => {
     socket.write(headerStr + "\r\n");
@@ -601,7 +610,7 @@ function setCtx(value) {
 }
 var TsxContext = createContext(DEFAULT_CTX);
 
-// middleware.ts
+// logger.ts
 function logger(options) {
   return async (req, ctx, next) => {
     const start = Date.now();
@@ -622,6 +631,8 @@ function logger(options) {
     }
   };
 }
+
+// cors.ts
 function cors(options) {
   const opts = {
     origin: "*",
@@ -670,6 +681,8 @@ function cors(options) {
     return Promise.resolve(next(req, ctx)).then((res) => setCORSHeaders(res, acao));
   };
 }
+
+// auth.ts
 function auth(options) {
   if (!options.token && !options.verify && !options.proxy) {
     throw new Error("auth() requires at least one of: token, verify, or proxy");
@@ -756,7 +769,6 @@ function auth(options) {
 }
 
 // static.ts
-import { createHash } from "node:crypto";
 import { open, realpath } from "node:fs/promises";
 import { extname, resolve as resolve2, normalize, sep } from "node:path";
 import { Readable } from "node:stream";
@@ -776,13 +788,13 @@ function serveStatic(root, options) {
     let fileHandle;
     try {
       fileHandle = await open(filePath, "r");
-      let stat = await fileHandle.stat();
+      let stat2 = await fileHandle.stat();
       const realPath = await realpath(filePath);
       if (!realPath.startsWith(rootDir + sep) && realPath !== rootDir) {
         await fileHandle.close();
         return new Response("Forbidden", { status: 403 });
       }
-      if (stat.isDirectory()) {
+      if (stat2.isDirectory()) {
         await fileHandle.close();
         const indexFile = opts.index ?? "index.html";
         filePath = resolve2(filePath, indexFile);
@@ -790,29 +802,29 @@ function serveStatic(root, options) {
           return new Response("Forbidden", { status: 403 });
         }
         fileHandle = await open(filePath, "r");
-        stat = await fileHandle.stat();
-        if (!stat.isFile()) {
+        stat2 = await fileHandle.stat();
+        if (!stat2.isFile()) {
           await fileHandle.close();
           return new Response("Not Found", { status: 404 });
         }
       }
       const mimeType = MIME_TYPES[extname(filePath).toLowerCase()] ?? "application/octet-stream";
-      const etag = `"${createHash("md5").update(`${stat.size}-${stat.mtimeMs}`).digest("hex")}"`;
+      const etag = `"${stat2.ino}-${stat2.size}-${stat2.mtimeMs}"`;
       const ifNoneMatch = req.headers.get("if-none-match");
       if (ifNoneMatch === etag) {
         await fileHandle.close();
         return new Response(null, { status: 304 });
       }
       const ifModifiedSince = req.headers.get("if-modified-since");
-      if (ifModifiedSince && stat.mtimeMs <= new Date(ifModifiedSince).getTime()) {
+      if (ifModifiedSince && stat2.mtimeMs <= new Date(ifModifiedSince).getTime()) {
         await fileHandle.close();
         return new Response(null, { status: 304 });
       }
       const headers = {
         "Content-Type": mimeType,
-        "Content-Length": String(stat.size),
+        "Content-Length": String(stat2.size),
         "ETag": etag,
-        "Last-Modified": stat.mtime.toUTCString(),
+        "Last-Modified": stat2.mtime.toUTCString(),
         "Cache-Control": opts.immutable ? `public, max-age=${opts.maxAge ?? 31536e3}, immutable` : `public, max-age=${opts.maxAge ?? 0}`
       };
       const readStream = fileHandle.createReadStream();
@@ -921,15 +933,9 @@ function validate(schemas) {
           issues.push({ path: ["body"], message: "Request body is required" });
         } else {
           const ct = req.headers.get("content-type") ?? "";
+          const shouldParseJson = ct.includes("application/json") || ct.includes("text/") || ct.includes("*/json") || !ct.includes("multipart/form-data") && !ct.includes("application/x-www-form-urlencoded");
           let bodyValue = bodyText;
-          if (ct.includes("application/json") || ct.includes("text/") || ct.includes("*/json")) {
-            try {
-              bodyValue = JSON.parse(bodyText);
-            } catch {
-            }
-          } else if (ct.includes("application/x-www-form-urlencoded") || ct.includes("multipart/form-data")) {
-            bodyValue = bodyText;
-          } else {
+          if (shouldParseJson) {
             try {
               bodyValue = JSON.parse(bodyText);
             } catch {
@@ -982,6 +988,9 @@ function getCookies(req) {
   return cookies;
 }
 function serializeCookie(name, value, options) {
+  if (/[\x00-\x1F\x7F-\x9F;,]/.test(name) || /[\x00-\x1F\x7F-\x9F;,]/.test(value)) {
+    throw new Error(`Invalid cookie name or value: contains control characters or special chars`);
+  }
   const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
   if (options?.maxAge != null) parts.push(`Max-Age=${options.maxAge}`);
   if (options?.expires) parts.push(`Expires=${options.expires.toUTCString()}`);
@@ -1053,8 +1062,12 @@ function upload(options) {
   return async (req, ctx, next) => {
     const ct = req.headers.get("content-type") ?? "";
     if (!ct.includes("multipart/form-data")) return next(req, ctx);
-    if (saveDir) await mkdir(saveDir, { recursive: true }).catch(() => {
-    });
+    try {
+      if (saveDir) await mkdir(saveDir, { recursive: true });
+    } catch (e) {
+      console.error("upload: failed to create directory", saveDir, e);
+      return Response.json({ error: "Server configuration error" }, { status: 500 });
+    }
     let formData;
     try {
       formData = await req.formData();
@@ -1084,7 +1097,7 @@ function upload(options) {
           buffer: saveDir ? void 0 : buf
         };
         if (saveDir) {
-          const safeName = value.name.replace(/[/\\\0]/g, "_");
+          const safeName = value.name.replace(/[/\\\0]/g, "_").replace(/\.\./g, "_");
           const filePath = join(saveDir, `${randomUUID()}-${safeName}`);
           await writeFile(filePath, buf);
           uf.path = filePath;
@@ -1108,14 +1121,14 @@ function upload(options) {
 function rateLimit(options) {
   const max = options?.max ?? 100;
   const window2 = options?.window ?? 6e4;
-  const getKey = options?.key ?? ((req) => {
-    const forwarded = req.headers.get("x-forwarded-for");
+  const getKey = options?.key ?? ((_req, _ctx) => {
+    const forwarded = _req.headers.get("x-forwarded-for");
     if (forwarded) return forwarded.split(",")[0].trim();
-    const realIp = req.headers.get("x-real-ip");
+    const realIp = _req.headers.get("x-real-ip");
     if (realIp) return realIp;
-    const cfIp = req.headers.get("cf-connecting-ip");
+    const cfIp = _req.headers.get("cf-connecting-ip");
     if (cfIp) return cfIp;
-    return req.headers.get("x-forwarded-for") || req.headers.get("x-real-ip") || "global";
+    return "global";
   });
   const message = options?.message ?? "Too Many Requests";
   const MAX_ENTRIES = 1e4;
@@ -1126,24 +1139,25 @@ function rateLimit(options) {
       if (entry.reset < now) hits.delete(key);
     }
     if (hits.size > MAX_ENTRIES) {
-      const toDelete = [...hits.entries()].sort((a, b) => a[1].reset - b[1].reset).slice(0, hits.size - MAX_ENTRIES);
-      for (const [k] of toDelete) hits.delete(k);
+      const toDelete = hits.size - MAX_ENTRIES;
+      let deleted = 0;
+      for (const key of hits.keys()) {
+        if (deleted >= toDelete) break;
+        hits.delete(key);
+        deleted++;
+      }
     }
   }, Math.min(window2, 3e4));
   if (interval.unref) interval.unref();
   const mw = async (req, ctx, next) => {
-    const key = getKey(req);
+    const key = getKey(req, ctx);
     const now = Date.now();
     let entry = hits.get(key);
     if (!entry || entry.reset < now) {
       hits.set(key, { count: 1, reset: now + window2 });
       entry = { count: 1, reset: now + window2 };
       const res2 = await next(req, ctx);
-      const headers2 = new Headers(res2.headers);
-      headers2.set("X-RateLimit-Limit", String(max));
-      headers2.set("X-RateLimit-Remaining", String(max - 1));
-      headers2.set("X-RateLimit-Reset", String(Math.ceil((now + window2) / 1e3)));
-      return new Response(res2.body, { status: res2.status, statusText: res2.statusText, headers: headers2 });
+      return addRateLimitHeaders(res2, max, max - 1, now + window2);
     }
     entry.count++;
     const remaining = Math.max(0, max - entry.count);
@@ -1159,11 +1173,7 @@ function rateLimit(options) {
       });
     }
     const res = await next(req, ctx);
-    const headers = new Headers(res.headers);
-    headers.set("X-RateLimit-Limit", String(max));
-    headers.set("X-RateLimit-Remaining", String(remaining));
-    headers.set("X-RateLimit-Reset", String(Math.ceil(entry.reset / 1e3)));
-    return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+    return addRateLimitHeaders(res, max, remaining, entry.reset);
   };
   mw.stop = () => {
     clearInterval(interval);
@@ -1171,9 +1181,20 @@ function rateLimit(options) {
   };
   return mw;
 }
+function addRateLimitHeaders(res, limit, remaining, reset) {
+  const headers = new Headers(res.headers);
+  headers.set("X-RateLimit-Limit", String(limit));
+  headers.set("X-RateLimit-Remaining", String(remaining));
+  headers.set("X-RateLimit-Reset", String(Math.ceil(reset / 1e3)));
+  return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
+}
 
 // compress.ts
-import { constants, gzipSync, brotliCompressSync, deflateSync } from "node:zlib";
+import { constants, brotliCompress, gzip, deflate } from "node:zlib";
+import { promisify } from "node:util";
+var brotliCompressAsync = promisify(brotliCompress);
+var gzipAsync = promisify(gzip);
+var deflateAsync = promisify(deflate);
 function compress(options) {
   const level = options?.level ?? 6;
   const threshold = options?.threshold ?? 1024;
@@ -1190,22 +1211,23 @@ function compress(options) {
     if (!ct || ct.startsWith("audio/") || ct.startsWith("video/") || ct.startsWith("image/") || ct === "application/zip") {
       return res;
     }
+    if (!res.body) return res;
     const body = await res.bytes();
     if (body.byteLength < threshold) return res;
     let compressed;
-    let enc;
-    if (encoding === "br") {
-      compressed = brotliCompressSync(body, { params: { [constants.BROTLI_PARAM_QUALITY]: Math.min(level, 11) } });
-      enc = "br";
-    } else if (encoding === "gzip") {
-      compressed = gzipSync(body, { level: Math.min(level, 9) });
-      enc = "gzip";
-    } else {
-      compressed = deflateSync(body, { level: Math.min(level, 9) });
-      enc = "deflate";
+    try {
+      if (encoding === "br") {
+        compressed = await brotliCompressAsync(body, { params: { [constants.BROTLI_PARAM_QUALITY]: Math.min(level, 11) } });
+      } else if (encoding === "gzip") {
+        compressed = await gzipAsync(body, { level: Math.min(level, 9) });
+      } else {
+        compressed = await deflateAsync(body, { level: Math.min(level, 9) });
+      }
+    } catch {
+      return res;
     }
     const headers = new Headers(res.headers);
-    headers.set("Content-Encoding", enc);
+    headers.set("Content-Encoding", encoding);
     headers.set("Content-Length", String(compressed.byteLength));
     headers.delete("Content-Range");
     const existingVary = headers.get("Vary");
@@ -1425,9 +1447,20 @@ function graphiqlHTML(endpoint) {
 }
 function graphql(handler) {
   const r = new Router();
-  r.get("/", async (req, ctx) => {
+  let cachedHandler = null;
+  let cachedSchema = null;
+  async function getSchema(req, ctx) {
     const options = await handler(req, ctx);
+    if (cachedHandler === options && cachedSchema) {
+      return { options, schema: cachedSchema };
+    }
     const schema = buildSchemaFromOptions(options);
+    cachedHandler = options;
+    cachedSchema = schema;
+    return { options, schema };
+  }
+  r.get("/", async (req, ctx) => {
+    const { options, schema } = await getSchema(req, ctx);
     const url = new URL(req.url);
     if (options.graphiql && !url.searchParams.has("query")) {
       return new Response(graphiqlHTML(url.pathname), {
@@ -1442,8 +1475,7 @@ function graphql(handler) {
     return executeQuery(schema, params, options, req, ctx);
   });
   r.post("/", async (req, ctx) => {
-    const options = await handler(req, ctx);
-    const schema = buildSchemaFromOptions(options);
+    const { options, schema } = await getSchema(req, ctx);
     const params = await parseParamsFromPost(req);
     if (!params) {
       return Response.json({ errors: [{ message: "Missing query" }] }, { status: 400 });
@@ -2845,7 +2877,7 @@ function createHub(opts) {
       }
     });
   }
-  function join9(key, ws) {
+  function join8(key, ws) {
     if (!channels.has(key)) {
       channels.set(key, /* @__PURE__ */ new Set());
       redisSub?.subscribe(`${prefix}${key}`);
@@ -2857,36 +2889,57 @@ function createHub(opts) {
       wsKeys.set(ws, keys);
     }
     keys.add(key);
+    if (typeof ws.addEventListener === "function") {
+      ws.addEventListener("close", () => removeFromChannels(ws));
+      ws.addEventListener("error", () => removeFromChannels(ws));
+    }
   }
-  function leave(ws) {
+  function removeFromChannels(ws) {
     const keys = wsKeys.get(ws);
     if (keys) {
       for (const key of keys) {
-        channels.get(key)?.delete(ws);
+        const members = channels.get(key);
+        if (members) {
+          members.delete(ws);
+          if (members.size === 0) channels.delete(key);
+        }
       }
       wsKeys.delete(ws);
     }
   }
+  function leave(ws) {
+    removeFromChannels(ws);
+  }
   function broadcast(key, data) {
     const msg = JSON.stringify(data);
     const members = channels.get(key);
     if (members) {
+      const dead = [];
       for (const ws of members) {
         try {
           ws.send(msg);
         } catch {
+          dead.push(ws);
         }
       }
+      for (const ws of dead) removeFromChannels(ws);
     }
     redisPub?.publish(`${prefix}${key}`, msg);
   }
   async function close() {
+    for (const ws of wsKeys.keys()) {
+      removeFromChannels(ws);
+    }
     channels.clear();
+    wsKeys.clear();
     if (redisSub) {
+      redisSub.removeAllListeners("message");
       await redisSub.quit();
     }
+    redisPub = void 0;
+    redisSub = null;
   }
-  return { join: join9, leave, broadcast, close };
+  return { join: join8, leave, broadcast, close };
 }
 
 // queue/index.ts
@@ -3033,7 +3086,7 @@ function queue(opts) {
     running = true;
     poll();
   };
-  mw.stop = function stop() {
+  mw.stop = function stop2() {
     running = false;
     epoch++;
     if (pollTimer) {
@@ -4697,14 +4750,14 @@ function forkApp(opts) {
   return { child, port: opts.port };
 }
 function stopProcess(mp, timeout = 1e4) {
-  return new Promise((resolve15) => {
+  return new Promise((resolve14) => {
     const timer = setTimeout(() => {
       mp.child.kill("SIGKILL");
-      resolve15();
+      resolve14();
     }, timeout);
     mp.child.on("exit", () => {
       clearTimeout(timer);
-      resolve15();
+      resolve14();
     });
     mp.child.kill("SIGTERM");
   });
@@ -5022,21 +5075,19 @@ async function deploy(config) {
 // opencode/client.ts
 import { createOpenAI as createOpenAI3 } from "@ai-sdk/openai";
 
-// opencode/rest.ts
-import { join as join7 } from "node:path";
-
 // ssr.ts
-import { createElement } from "react";
+import { createElement as createElement3 } from "react";
 import { createHash as createHash3 } from "node:crypto";
-import { dirname as dirname2, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync4, readdirSync, statSync } from "node:fs";
+import { dirname as dirname3, join as join5, resolve as resolve6 } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
 
 // compile.ts
 import * as esbuild from "esbuild";
-import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
 import { join as join2, resolve as resolve3, dirname } from "node:path";
 import { pathToFileURL } from "node:url";
-import { createHash as createHash2 } from "node:crypto";
+import { createHash } from "node:crypto";
 import vm from "node:vm";
 import { createRequire } from "node:module";
 var _cjsRequire = createRequire(import.meta.url);
@@ -5059,7 +5110,7 @@ function resolveAliases() {
   const configFiles = ["tsconfig.json", "jsconfig.json"];
   for (const file of configFiles) {
     const p = resolve3(file);
-    if (existsSync2(p)) {
+    if (existsSync(p)) {
       try {
         const config = JSON.parse(readFileSync2(p, "utf-8"));
         const paths = config.compilerOptions?.paths;
@@ -5081,7 +5132,7 @@ function resolveAliases() {
   return {};
 }
 function id(s) {
-  return createHash2("md5").update(s).digest("hex").slice(0, 8);
+  return createHash("md5").update(s).digest("hex").slice(0, 8);
 }
 function clearCompileCache() {
   cache.clear();
@@ -5090,12 +5141,13 @@ function clearCompileCache() {
 async function compileTsx(path2) {
   const absPath = resolve3(path2);
   if (cache.has(absPath)) return cache.get(absPath);
-  mkdirSync(OUT_DIR, { recursive: true });
+  const outDir = resolve3(OUT_DIR);
+  mkdirSync(outDir, { recursive: true });
   const hash = id(absPath);
-  const outPath = join2(OUT_DIR, hash + ".js");
+  const outPath = join2(outDir, hash + ".js");
   await esbuild.build({
     entryPoints: { [hash]: absPath },
-    outdir: OUT_DIR,
+    outdir: outDir,
     format: "esm",
     platform: "node",
     jsx: "automatic",
@@ -5139,7 +5191,7 @@ async function compileTsxDev(path2) {
   return mod;
 }
 function compile(path2) {
-  return process.env.NODE_ENV !== "production" ? compileTsxDev(path2) : compileTsx(path2);
+  return isDev() ? compileTsxDev(path2) : compileTsx(path2);
 }
 var vendorBundle = null;
 async function compileVendorBundle() {
@@ -5212,11 +5264,10 @@ function getPublicEnv() {
   return _publicEnv;
 }
 function buildHeadPayload(opts) {
-  const { ctx, compiledTailwindCss, isDev: isDev2 } = opts;
-  const rb = opts.rootBase || "";
+  const { ctx, base, compiledTailwindCss, isDev: isDev3 } = opts;
   let result = "";
-  if (isDev2) {
-    const vUrl = `${rb}/__wfw/v/bundle`;
+  if (isDev3) {
+    const vUrl = `${base}/__wfw/v/bundle`;
     result += `<script type="importmap">{
   "imports": {
     "react": "${vUrl}",
@@ -5239,18 +5290,29 @@ function buildHeadPayload(opts) {
   }
   const localeData = ctx.parsed?.__localeData ?? globalThis.__LOCALE_DATA__;
   if (localeData && Object.keys(localeData).length > 0) {
-    result += `<script>window.__LOCALE_DATA__=${JSON.stringify(localeData)}</script>
+    if (!_localeDataCache || _localeDataCache.data !== localeData) {
+      _localeDataCache = { data: localeData, json: JSON.stringify(localeData) };
+    }
+    result += `<script>window.__LOCALE_DATA__=${_localeDataCache.json}</script>
 `;
   }
   const loaderData = opts.loaderData || {};
   const ctxData = {
     params: ctx.params,
     query: ctx.query,
-    user: ctx.user,
     parsed: ctx.parsed,
     prefs: ctx.prefs,
     loaderData
   };
+  if (ctx.user && typeof ctx.user === "object") {
+    const safeUser = {};
+    for (const k of ["id", "name", "email", "role", "avatar"]) {
+      if (k in ctx.user) {
+        safeUser[k] = ctx.user[k];
+      }
+    }
+    ctxData.user = safeUser;
+  }
   const publicEnv = getPublicEnv();
   if (Object.keys(publicEnv).length > 0) {
     ctxData.env = publicEnv;
@@ -5269,6 +5331,7 @@ function buildBodyScripts(opts) {
   }
   return parts.join("\n");
 }
+var _localeDataCache = null;
 function streamResponse(reactStream, opts) {
   const decoder = new TextDecoder2();
   const encoder2 = new TextEncoder2();
@@ -5315,9 +5378,8 @@ function streamResponse(reactStream, opts) {
         const body = buildBodyScripts(opts);
         if (body) controller.enqueue(encoder2.encode("\n" + body));
         if (opts.isDev) {
-          const rb = opts.rootBase || "";
-          const wsUrl = `${rb}/__weifuwu/livereload`;
-          const hbUrl = `${rb}/__wfw/h/`;
+          const wsUrl = `${opts.base}/__weifuwu/livereload`;
+          const hbUrl = `${opts.base}/__wfw/h/`;
           controller.enqueue(encoder2.encode(
             `
 <script>(function(){var ws=new WebSocket((location.protocol==='https:'?'wss:':'ws:')+'//'+location.host+'${wsUrl}');var t=0;ws.onmessage=function(e){try{var m=JSON.parse(e.data);if(m.type==='component'){if(m.entry&&m.entry!==window.__WFW_ENTRY)return;import('${hbUrl}'+m.hash+'?'+Date.now()).catch(function(){location.reload()});if(m.css){var s=document.querySelector('style[data-lr]')||function(){var x=document.createElement('style');x.setAttribute('data-lr','');document.head.appendChild(x);return x}();s.textContent=m.css}return}if(m.type==='css'){var s=document.querySelector('style[data-lr]')||function(){var x=document.createElement('style');x.setAttribute('data-lr','');document.head.appendChild(x);return x}();s.textContent=m.css;return}}catch(_){}if(e.data==='reload'&&Date.now()-t>1e3){t=Date.now();location.reload()}};ws.onclose=function(){if(Date.now()-t>1e3){t=Date.now();setTimeout(function(){location.reload()},500)}}})()</script>`
@@ -5340,272 +5402,117 @@ function streamResponse(reactStream, opts) {
 // ssr-entries.ts
 var ssrEntries = /* @__PURE__ */ new Map();
 
-// ssr.ts
-var als = new AsyncLocalStorage();
-__registerAls(() => als.getStore());
-var isDev = process.env.NODE_ENV !== "production";
-var bundleCache = /* @__PURE__ */ new Map();
-var _bundleDirty = false;
-function markClientBundleDirty() {
-  _bundleDirty = true;
+// tailwind.ts
+import { createHash as createHash2 } from "node:crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { join as join3, relative, resolve as resolve4 } from "node:path";
+var extraSources = /* @__PURE__ */ new Set();
+var cssCache = /* @__PURE__ */ new Map();
+function tailwindContext(dir) {
+  const cssDir = resolve4(dir);
+  const cssPath = join3(cssDir, "app", "globals.css");
+  return async (req, ctx, next) => {
+    if (!cssCache.has(cssPath)) {
+      await compileTailwindCss(cssPath, cssDir);
+    }
+    const entry = cssCache.get(cssPath);
+    ctx.compiledTailwindCss = entry.css;
+    const base = (ctx.mountPath || "").replace(/\/$/, "");
+    ctx.tailwindCssUrl = base ? `${base}/__wfw/style/${entry.hash}.css` : `/__wfw/style/${entry.hash}.css`;
+    return next(req, ctx);
+  };
 }
-function getBundle(key) {
-  if (_bundleDirty) {
-    bundleCache.clear();
-    _bundleDirty = false;
+function tailwindRouter(dir) {
+  const cssDir = resolve4(dir);
+  const cssPath = join3(cssDir, "app", "globals.css");
+  const r = new Router();
+  r.get("/__wfw/style/:hash.css", async (req, ctx) => {
+    if (!cssCache.has(cssPath)) {
+      await compileTailwindCss(cssPath, cssDir);
+    }
+    const entry = cssCache.get(cssPath);
+    if (!entry) return new Response("", { status: 404 });
+    return new Response(entry.css, {
+      headers: { "content-type": "text/css; charset=utf-8" }
+    });
+  });
+  return r;
+}
+async function compileTailwindCss(cssPath, cssDir) {
+  try {
+    if (!existsSync2(cssPath)) {
+      mkdirSync2(cssDir, { recursive: true });
+      writeFileSync(cssPath, '@import "tailwindcss"\n', "utf-8");
+    }
+    const { default: tailwindPlugin } = await import("@tailwindcss/postcss");
+    const { default: postcss } = await import("postcss");
+    let src = readFileSync3(cssPath, "utf-8");
+    src = `@source "./";
+${src}`;
+    for (const srcDir of extraSources) {
+      const rel = relative(cssDir, srcDir) || ".";
+      src = `@source "${rel.startsWith(".") ? rel : "./" + rel}";
+${src}`;
+    }
+    const result = await postcss([tailwindPlugin()]).process(src, { from: cssPath });
+    const hash = createHash2("md5").update(result.css).digest("hex").slice(0, 8);
+    cssCache.set(cssPath, { css: result.css, hash });
+    return result.css;
+  } catch (err) {
+    console.warn("Tailwind CSS processing failed:", err.message);
+    return "";
   }
-  return bundleCache.get(key);
 }
-function setBundle(key, buf) {
-  if (_bundleDirty) {
-    bundleCache.clear();
-    _bundleDirty = false;
+
+// live.ts
+import chokidar from "chokidar";
+import { existsSync as existsSync3 } from "node:fs";
+import { dirname as dirname2, join as join4, resolve as resolve5 } from "node:path";
+var clients = /* @__PURE__ */ new Set();
+var hotBundleCache = /* @__PURE__ */ new Map();
+var hotKeys = [];
+var MAX_HOT = 10;
+function setHot(hash, code) {
+  if (!hotBundleCache.has(hash)) {
+    hotKeys.push(hash);
+    if (hotKeys.length > MAX_HOT) {
+      const old = hotKeys.shift();
+      hotBundleCache.delete(old);
+    }
   }
-  bundleCache.set(key, buf);
+  hotBundleCache.set(hash, code);
 }
-function id2(s) {
-  return createHash3("md5").update(s).digest("hex").slice(0, 8);
+function broadcastReload() {
+  for (const ws of clients) {
+    try {
+      ws.send("reload");
+    } catch {
+      clients.delete(ws);
+    }
+  }
 }
-function serializeLoaderData(ctx) {
-  const ld = ctx.loaderData;
-  return ld && typeof ld === "object" ? ld : {};
+function broadcastCss(css) {
+  const msg = JSON.stringify({ type: "css", css });
+  for (const ws of clients) {
+    try {
+      ws.send(msg);
+    } catch {
+      clients.delete(ws);
+    }
+  }
 }
-async function buildClientBundle(entryPath, layoutPaths) {
-  try {
-    const absEntry = resolve4(entryPath);
-    const absLayouts = layoutPaths.map((p) => resolve4(p));
-    const layoutImports = absLayouts.map((p) => `import${JSON.stringify(p)};`).join("");
-    const _sc = `(function(){var k='__WEIFUWU_CTX_STORE';var s=typeof globalThis!='undefined'&&globalThis[k];if(!s)return function(){};return function(v){s._ctx={...s._ctx,...v};s._snapshot={params:s._ctx.params,query:s._ctx.query,user:s._ctx.user,parsed:s._ctx.parsed,prefs:s._ctx.prefs,env:s._ctx.env};s._listeners.forEach(function(fn){fn()})}})()`;
-    const code = [
-      layoutImports,
-      `${isDev ? "import{createRoot}from'react-dom/client';" : "import{hydrateRoot}from'react-dom/client';"}`,
-      `import{createElement}from'react';`,
-      `import{TsxContext}from'weifuwu/react';`,
-      `import P from${JSON.stringify(absEntry)};`,
-      `var setCtx=${_sc};`,
-      `const c=document.getElementById('__weifuwu_root');`,
-      `if(window.__WEIFUWU_PROPS)setCtx({loaderData:window.__WEIFUWU_PROPS});`,
-      // Dev: stable proxy chain — _P → _W (stable) → actual component
-      isDev ? `const _W=function(props){return(_W._fn||P)(props)};_W._fn=P;const _P=function(props){return createElement(_W,props)};` : "",
-      // Dev: HMR handler — updates proxy + re-renders root
-      isDev ? `window.__WFW_ENTRY=${JSON.stringify(id2(absEntry))};window.__WFW_REFRESH=function(n){_W._fn=n;window.__WFW_ROOT.render(createElement(App))};` : "",
-      `function App(){`,
-      `const ctx=window.__WEIFUWU_CTX||{};`,
-      `return createElement(TsxContext.Provider,{value:ctx},`,
-      isDev ? `createElement(_P,null))` : `createElement(P,null))`,
-      `}`,
-      isDev ? `window.__WFW_ROOT=createRoot(c);window.__WFW_ROOT.render(createElement(App));` : `hydrateRoot(c,createElement(App));`
-    ].filter(Boolean).join("");
-    const { default: esbuild2 } = await import("esbuild");
-    const result = await esbuild2.build({
-      stdin: { contents: code, loader: "tsx", resolveDir: dirname2(absEntry) },
-      bundle: true,
-      format: "esm",
-      jsx: "automatic",
-      jsxImportSource: "react",
-      banner: { js: "self.process={env:{}};" },
-      loader: { ".node": "empty" },
-      external: isDev ? ["react", "react-dom", "react-dom/client", "react/jsx-runtime", "weifuwu", "weifuwu/react"] : void 0,
-      write: false,
-      minify: !isDev
-    });
-    return result.outputFiles[0].contents;
-  } catch (err) {
-    console.error("hydration bundle failed:", err);
-    return null;
-  }
-}
-function ssr(path2) {
-  const absPath = resolve4(path2);
-  const entryId = id2(absPath);
-  ssrEntries.set(entryId, { path: absPath });
-  const bundleKey = `/__ssr/${entryId}.js`;
-  const r = new Router();
-  r.get("/__ssr/:path", (req, ctx) => {
-    const buf = getBundle("/__ssr/" + ctx.params.path);
-    return buf ? new Response(buf, {
-      headers: { "content-type": "application/javascript; charset=utf-8" }
-    }) : new Response("", { status: 404 });
-  });
-  r.get("/", async (req, ctx) => {
-    const pageMod = await compile(path2);
-    const Component = pageMod.default;
-    if (!Component) return new Response("", { status: 500 });
-    const layouts = ctx.layoutStack || [];
-    const layoutComponents = layouts.map((l) => l.component);
-    const layoutPaths = layouts.map((l) => l.path);
-    const base = (ctx.mountPath || "").replace(/\/$/, "");
-    const loaderData = serializeLoaderData(ctx);
-    const ctxValue = {
-      params: ctx.params,
-      query: ctx.query,
-      user: ctx.user ?? {},
-      parsed: ctx.parsed ?? {},
-      prefs: ctx.prefs ?? {},
-      loaderData,
-      env: ctx.env ?? {}
-    };
-    return als.run(ctxValue, async () => {
-      setCtx(ctxValue);
-      if (ctxValue.parsed?.__localeData) {
-        ;
-        globalThis.__LOCALE_DATA__ = ctxValue.parsed.__localeData;
-      }
-      let element = createElement(
-        "div",
-        { id: "__weifuwu_root" },
-        createElement(
-          TsxContext.Provider,
-          { value: ctxValue },
-          createElement(Component, null)
-        )
-      );
-      if (layoutComponents.length === 0) {
-        element = createElement(
-          "html",
-          { lang: "en" },
-          createElement(
-            "head",
-            null,
-            createElement("meta", { charSet: "utf-8" }),
-            createElement("meta", { name: "viewport", content: "width=device-width, initial-scale=1" }),
-            createElement("title", null, "weifuwu")
-          ),
-          createElement("body", null, element)
-        );
-      } else {
-        for (const L of layoutComponents.toReversed()) {
-          element = createElement(L, { children: element });
-        }
-      }
-      let bundle = null;
-      if (!getBundle(bundleKey)) {
-        const buf = await buildClientBundle(path2, layoutPaths);
-        if (buf) setBundle(bundleKey, buf);
-      }
-      if (getBundle(bundleKey)) {
-        bundle = { url: bundleKey };
-      }
-      const { renderToReadableStream } = await import("react-dom/server");
-      const stream = await renderToReadableStream(element);
-      return streamResponse(stream, {
-        ctx,
-        base,
-        rootBase: ctx.rootLayoutBase || "",
-        isDev,
-        bundle,
-        loaderData,
-        compiledTailwindCss: ctx.compiledTailwindCss
-      });
-    });
-  });
-  return r;
-}
-
-// root-layout.ts
-import { existsSync as existsSync5 } from "node:fs";
-import { join as join5, resolve as resolve7 } from "node:path";
-
-// tailwind.ts
-import { createHash as createHash4 } from "node:crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "node:fs";
-import { join as join3, relative, resolve as resolve5 } from "node:path";
-var extraSources = /* @__PURE__ */ new Set();
-var cssCache = /* @__PURE__ */ new Map();
-function tailwind(dir) {
-  const cssDir = resolve5(dir);
-  const cssPath = join3(cssDir, "app.css");
-  const r = new Router();
-  r.use(async (req, ctx, next) => {
-    if (!cssCache.has(cssPath)) {
-      await compileTailwindCss(cssPath, cssDir);
-    }
-    const entry = cssCache.get(cssPath);
-    ctx.compiledTailwindCss = entry.css;
-    const base = (ctx.mountPath || "").replace(/\/$/, "");
-    ctx.tailwindCssUrl = base ? `${base}/__wfw/style/${entry.hash}.css` : `/__wfw/style/${entry.hash}.css`;
-    return next(req, ctx);
-  });
-  r.get("/__wfw/style/:hash.css", async (req, ctx) => {
-    if (!cssCache.has(cssPath)) {
-      await compileTailwindCss(cssPath, cssDir);
-    }
-    const entry = cssCache.get(cssPath);
-    if (!entry) return new Response("", { status: 404 });
-    return new Response(entry.css, {
-      headers: { "content-type": "text/css; charset=utf-8" }
-    });
-  });
-  return r;
-}
-async function compileTailwindCss(cssPath, cssDir) {
-  try {
-    if (!existsSync3(cssPath)) {
-      mkdirSync2(cssDir, { recursive: true });
-      writeFileSync(cssPath, '@import "tailwindcss"\n', "utf-8");
-    }
-    const { default: tailwindPlugin } = await import("@tailwindcss/postcss");
-    const { default: postcss } = await import("postcss");
-    let src = readFileSync3(cssPath, "utf-8");
-    src = `@source "./";
-${src}`;
-    for (const srcDir of extraSources) {
-      const rel = relative(cssDir, srcDir) || ".";
-      src = `@source "${rel.startsWith(".") ? rel : "./" + rel}";
-${src}`;
-    }
-    const result = await postcss([tailwindPlugin()]).process(src, { from: cssPath });
-    const hash = createHash4("md5").update(result.css).digest("hex").slice(0, 8);
-    cssCache.set(cssPath, { css: result.css, hash });
-    return result.css;
-  } catch (err) {
-    console.warn("Tailwind CSS processing failed:", err.message);
-    return "";
-  }
-}
-
-// live.ts
-import chokidar from "chokidar";
-import { existsSync as existsSync4 } from "node:fs";
-import { dirname as dirname3, join as join4, resolve as resolve6 } from "node:path";
-var clients = /* @__PURE__ */ new Set();
-var hotBundleCache = /* @__PURE__ */ new Map();
-var hotKeys = [];
-var MAX_HOT = 10;
-function setHot(hash, code) {
-  if (!hotBundleCache.has(hash)) {
-    hotKeys.push(hash);
-    if (hotKeys.length > MAX_HOT) {
-      const old = hotKeys.shift();
-      hotBundleCache.delete(old);
-    }
-  }
-  hotBundleCache.set(hash, code);
-}
-function broadcastReload() {
-  for (const ws of clients) {
-    try {
-      ws.send("reload");
-    } catch {
-      clients.delete(ws);
-    }
-  }
-}
-function broadcastCss(css) {
-  const msg = JSON.stringify({ type: "css", css });
-  for (const ws of clients) {
-    try {
-      ws.send(msg);
-    } catch {
-      clients.delete(ws);
+function liveWs() {
+  return {
+    open(ws) {
+      clients.add(ws);
+      ws.on("close", () => clients.delete(ws));
+      ws.on("error", () => clients.delete(ws));
     }
-  }
+  };
 }
-function liveReload(dir) {
+function liveRouter(dir) {
   const r = new Router();
-  const resolved = resolve6(dir);
-  const entryPath = join4(resolved, "page.tsx");
-  r.get("/__wfw/v/bundle", async (req, ctx) => {
+  r.get("/__wfw/v/bundle", async () => {
     const code = await compileVendorBundle();
     return new Response(code, {
       headers: { "content-type": "application/javascript; charset=utf-8" }
@@ -5619,13 +5526,11 @@ function liveReload(dir) {
       headers: { "content-type": "application/javascript; charset=utf-8" }
     });
   });
-  r.ws("/__weifuwu/livereload", {
-    open(ws) {
-      clients.add(ws);
-      ws.on("close", () => clients.delete(ws));
-      ws.on("error", () => clients.delete(ws));
-    }
-  });
+  return r;
+}
+function liveWatcher(dir) {
+  const resolved = resolve5(dir);
+  const entryPath = join4(resolved, "page.tsx");
   const watcher = chokidar.watch(dir, {
     ignored: /(^|[/\\])\.|node_modules|[/\\]\.weifuwu[/\\]/,
     ignoreInitial: true
@@ -5637,7 +5542,7 @@ function liveReload(dir) {
       if (entry.path === changedPath) {
         matched.push(entry.path);
       } else {
-        const ed = dirname3(entry.path);
+        const ed = dirname2(entry.path);
         if (changedPath.startsWith(ed)) matched.push(entry.path);
       }
     }
@@ -5655,12 +5560,12 @@ function liveReload(dir) {
       }
       clearCompileCache();
       markClientBundleDirty();
-      const targets = existsSync4(entryPath) ? [entryPath] : findEntries(resolve6(filePath));
+      const targets = existsSync3(entryPath) ? [entryPath] : findEntries(resolve5(filePath));
       if (targets.length === 0) return broadcastReload();
       try {
         let css;
-        const cssPath = join4(resolved, "app.css");
-        if (existsSync4(cssPath)) {
+        const cssPath = join4(resolved, "app", "globals.css");
+        if (existsSync3(cssPath)) {
           css = await compileTailwindCss(cssPath, resolved);
         }
         for (const target of targets) {
@@ -5684,40 +5589,334 @@ function liveReload(dir) {
         broadcastReload();
       }
     } else if (/\.css$/i.test(filePath)) {
-      const cssPath = join4(resolved, "app.css");
-      if (existsSync4(cssPath)) {
+      const cssPath = join4(resolved, "app", "globals.css");
+      if (existsSync3(cssPath)) {
         const css = await compileTailwindCss(cssPath, resolved);
         if (css) broadcastCss(css);
       }
     }
   });
-  r.close = () => {
-    watcher.close();
-    clients.clear();
+  return {
+    close: () => {
+      watcher.close();
+      clients.clear();
+    }
   };
-  return r;
 }
 
-// root-layout.ts
-function rootLayout(dir) {
-  const r = new Router();
-  const resolved = resolve7(dir);
-  const isDev2 = process.env.NODE_ENV !== "production";
-  const layoutPath = join5(resolved, "layout.tsx");
-  r.use(async (req, ctx, next) => {
-    const mod = await compile(layoutPath);
-    if (mod?.default) ctx.layoutStack = [{ path: layoutPath, component: mod.default }];
-    ctx.rootLayoutBase = (ctx.mountPath || "").replace(/\/$/, "");
+// layout.ts
+function layout(path2) {
+  return async (req, ctx, next) => {
+    const mod = await compile(path2);
+    const Component = mod.default;
+    if (!Component) throw new Error(`Layout ${path2} has no default export`);
+    ctx.layoutStack = [...ctx.layoutStack || [], { path: path2, component: Component }];
     return next(req, ctx);
+  };
+}
+
+// error-boundary.ts
+import { createElement as createElement2 } from "react";
+
+// html-shell.ts
+import { createElement } from "react";
+function buildHtmlShell(title, bodyElement, layoutComponents) {
+  if (layoutComponents.length === 0) {
+    return createElement(
+      "html",
+      { lang: "en" },
+      createElement(
+        "head",
+        null,
+        createElement("meta", { charSet: "utf-8" }),
+        createElement("meta", { name: "viewport", content: "width=device-width, initial-scale=1" }),
+        createElement("title", null, title)
+      ),
+      createElement("body", null, bodyElement)
+    );
+  }
+  let element = bodyElement;
+  for (const L of layoutComponents.toReversed()) {
+    element = createElement(L, { children: element });
+  }
+  return element;
+}
+
+// error-boundary.ts
+function errorBoundary(errorPath) {
+  return async (req, ctx, next) => {
+    try {
+      return await next(req, ctx);
+    } catch (err) {
+      const mod = await compile(errorPath);
+      const ErrorComponent = mod.default;
+      if (!ErrorComponent) throw err;
+      const layouts = (ctx.layoutStack || []).map((l) => l.component);
+      const base = (ctx.mountPath || "").replace(/\/$/, "");
+      let element = createElement2(ErrorComponent, {
+        error: err instanceof Error ? err : new Error(String(err)),
+        reset: () => {
+        }
+      });
+      element = buildHtmlShell("500", element, layouts);
+      const { renderToReadableStream } = await import("react-dom/server");
+      const stream = await renderToReadableStream(element);
+      return streamResponse(stream, {
+        ctx,
+        base,
+        isDev: isDev(),
+        compiledTailwindCss: ctx.compiledTailwindCss,
+        status: 500
+      });
+    }
+  };
+}
+
+// ssr.ts
+var isDev2 = isDev();
+var als = new AsyncLocalStorage();
+__registerAls(() => als.getStore());
+var bundleCache = /* @__PURE__ */ new Map();
+var _bundleDirty = false;
+function markClientBundleDirty() {
+  _bundleDirty = true;
+}
+function getBundle(key) {
+  if (_bundleDirty) {
+    bundleCache.clear();
+    _bundleDirty = false;
+  }
+  return bundleCache.get(key);
+}
+function setBundle(key, buf) {
+  if (_bundleDirty) {
+    bundleCache.clear();
+    _bundleDirty = false;
+  }
+  bundleCache.set(key, buf);
+}
+function id2(s) {
+  return createHash3("md5").update(s).digest("hex").slice(0, 8);
+}
+function serializeLoaderData(ctx) {
+  const ld = ctx.loaderData;
+  return ld && typeof ld === "object" ? ld : {};
+}
+async function buildClientBundle(entryPath, layoutPaths) {
+  try {
+    const absEntry = resolve6(entryPath);
+    const absLayouts = layoutPaths.map((p) => resolve6(p));
+    const layoutImports = absLayouts.map((p) => `import${JSON.stringify(p)};`).join("");
+    const _sc = `(function(){var k='__WEIFUWU_CTX_STORE';var s=typeof globalThis!='undefined'&&globalThis[k];if(!s)return function(){};return function(v){s._ctx={...s._ctx,...v};s._snapshot={params:s._ctx.params,query:s._ctx.query,user:s._ctx.user,parsed:s._ctx.parsed,prefs:s._ctx.prefs,env:s._ctx.env};s._listeners.forEach(function(fn){fn()})}})()`;
+    const code = [
+      layoutImports,
+      `${isDev2 ? "import{createRoot}from'react-dom/client';" : "import{hydrateRoot}from'react-dom/client';"}`,
+      `import{createElement}from'react';`,
+      `import{TsxContext}from'weifuwu/react';`,
+      `import P from${JSON.stringify(absEntry)};`,
+      `var setCtx=${_sc};`,
+      `const c=document.getElementById('__weifuwu_root');`,
+      `if(window.__WEIFUWU_PROPS)setCtx({loaderData:window.__WEIFUWU_PROPS});`,
+      isDev2 ? `const _W=function(props){return(_W._fn||P)(props)};_W._fn=P;const _P=function(props){return createElement(_W,props)};` : "",
+      isDev2 ? `window.__WFW_ENTRY=${JSON.stringify(id2(absEntry))};window.__WFW_REFRESH=function(n){_W._fn=n;window.__WFW_ROOT.render(createElement(App))};` : "",
+      `function App(){`,
+      `const ctx=window.__WEIFUWU_CTX||{};`,
+      `return createElement(TsxContext.Provider,{value:ctx},`,
+      isDev2 ? `createElement(_P,null))` : `createElement(P,null))`,
+      `}`,
+      isDev2 ? `window.__WFW_ROOT=createRoot(c);window.__WFW_ROOT.render(createElement(App));` : `hydrateRoot(c,createElement(App));`
+    ].filter(Boolean).join("");
+    const { default: esbuild2 } = await import("esbuild");
+    const result = await esbuild2.build({
+      stdin: { contents: code, loader: "tsx", resolveDir: dirname3(absEntry) },
+      bundle: true,
+      format: "esm",
+      jsx: "automatic",
+      jsxImportSource: "react",
+      banner: { js: "self.process={env:{}};" },
+      loader: { ".node": "empty" },
+      external: isDev2 ? ["react", "react-dom", "react-dom/client", "react/jsx-runtime", "weifuwu", "weifuwu/react"] : void 0,
+      write: false,
+      minify: !isDev2
+    });
+    return result.outputFiles[0].contents;
+  } catch (err) {
+    console.error("hydration bundle failed:", err);
+    return null;
+  }
+}
+function resolveFileSync(ssrDir, segments) {
+  const appDir = join5(ssrDir, "app");
+  let dir = appDir;
+  const paramNames = [];
+  const paramValues = [];
+  let catchAll = null;
+  let segIdx = 0;
+  for (; segIdx < segments.length; segIdx++) {
+    const seg = segments[segIdx];
+    const literal = join5(dir, seg);
+    if (existsSync4(literal) && statSync(literal).isDirectory()) {
+      dir = literal;
+      continue;
+    }
+    const entries = readdirSync(dir, { withFileTypes: true });
+    const paramDir = entries.find(
+      (e) => e.isDirectory() && e.name.startsWith("[") && e.name.endsWith("]") && !e.name.startsWith("[...")
+    );
+    if (paramDir) {
+      paramNames.push(paramDir.name.slice(1, -1));
+      paramValues.push(seg);
+      dir = join5(dir, paramDir.name);
+      continue;
+    }
+    const catchAllDir = entries.find(
+      (e) => e.isDirectory() && e.name.startsWith("[...") && e.name.endsWith("]")
+    );
+    if (catchAllDir) {
+      catchAll = segments.slice(segIdx).join("/");
+      dir = join5(dir, catchAllDir.name);
+      break;
+    }
+    return null;
+  }
+  const pageFile = join5(dir, "page.tsx");
+  if (!existsSync4(pageFile)) return null;
+  let pi = 0;
+  const consumed = catchAll !== null ? segIdx : segments.length;
+  const routeParams = [];
+  for (let i = 0; i < consumed; i++) {
+    routeParams.push(segments[i]);
+  }
+  const layoutFiles = [];
+  let d = dir;
+  while (d.startsWith(appDir)) {
+    const lf = join5(d, "layout.tsx");
+    if (existsSync4(lf)) layoutFiles.unshift(lf);
+    if (d === appDir) break;
+    d = dirname3(d);
+  }
+  const errorFiles = [];
+  d = dir;
+  while (d.startsWith(appDir)) {
+    const ef = join5(d, "error.tsx");
+    if (existsSync4(ef)) errorFiles.unshift(ef);
+    if (d === appDir) break;
+    d = dirname3(d);
+  }
+  let notFoundFile = null;
+  d = dir;
+  while (d.startsWith(appDir)) {
+    const nf = join5(d, "not-found.tsx");
+    if (existsSync4(nf)) {
+      notFoundFile = nf;
+      break;
+    }
+    if (d === appDir) break;
+    d = dirname3(d);
+  }
+  return { routePath: "/" + routeParams.join("/"), pageFile, layoutFiles, errorFiles, notFoundFile };
+}
+function renderPage(pageFile) {
+  const absPath = resolve6(pageFile);
+  const entryId = id2(absPath);
+  ssrEntries.set(entryId, { path: absPath });
+  const bundleKey = `/__ssr/${entryId}.js`;
+  return async (req, ctx) => {
+    const pageMod = await compile(absPath);
+    const Component = pageMod.default;
+    if (!Component) return new Response("", { status: 500 });
+    const layouts = ctx.layoutStack || [];
+    const layoutComponents = layouts.map((l) => l.component);
+    const layoutPaths = layouts.map((l) => l.path);
+    const base = (ctx.mountPath || "").replace(/\/$/, "");
+    const loaderData = serializeLoaderData(ctx);
+    const ctxValue = {
+      params: ctx.params,
+      query: ctx.query,
+      user: ctx.user ?? {},
+      parsed: ctx.parsed ?? {},
+      prefs: ctx.prefs ?? {},
+      loaderData,
+      env: ctx.env ?? {}
+    };
+    return als.run(ctxValue, async () => {
+      setCtx(ctxValue);
+      if (ctxValue.parsed?.__localeData) {
+        globalThis.__LOCALE_DATA__ = ctxValue.parsed.__localeData;
+      }
+      let element = createElement3(
+        "div",
+        { id: "__weifuwu_root" },
+        createElement3(
+          TsxContext.Provider,
+          { value: ctxValue },
+          createElement3(Component, null)
+        )
+      );
+      element = buildHtmlShell("weifuwu", element, layoutComponents);
+      let bundle = null;
+      if (!getBundle(bundleKey)) {
+        const buf = await buildClientBundle(absPath, layoutPaths);
+        if (buf) setBundle(bundleKey, buf);
+      }
+      if (getBundle(bundleKey)) {
+        bundle = { url: bundleKey };
+      }
+      const { renderToReadableStream } = await import("react-dom/server");
+      const stream = await renderToReadableStream(element);
+      return streamResponse(stream, {
+        ctx,
+        base,
+        isDev: isDev2,
+        bundle,
+        loaderData,
+        compiledTailwindCss: ctx.compiledTailwindCss
+      });
+    });
+  };
+}
+function runChain(mws, handler, req, ctx) {
+  let idx = 0;
+  const dispatch = (r, c) => {
+    if (idx < mws.length) return mws[idx++](r, c, dispatch);
+    return handler(r, c);
+  };
+  return Promise.resolve(dispatch(req, ctx));
+}
+function ssr(opts) {
+  const r = new Router();
+  const dir = resolve6(opts.dir);
+  r.get("/__ssr/:path", (req, ctx) => {
+    const buf = getBundle("/__ssr/" + ctx.params.path);
+    if (!buf) return new Response("", { status: 404 });
+    return new Response(buf, {
+      headers: { "content-type": "application/javascript; charset=utf-8" }
+    });
   });
-  if (existsSync5(join5(resolved, "app.css"))) {
-    r.use(tailwind(resolved));
+  if (existsSync4(join5(dir, "app", "globals.css"))) {
+    r.use("/", tailwindRouter(dir));
   }
   if (isDev2) {
-    const lr = liveReload(resolved);
-    r.use(lr);
-    r.close = lr.close;
-  }
+    r.use("/", liveRouter(dir));
+    r.ws("/__weifuwu/livereload", liveWs());
+    const watcher = liveWatcher(dir);
+    r.close = watcher.close;
+  }
+  r.all("/*", async (req, ctx) => {
+    const prefix = ctx.mountPath || "";
+    const pathname = new URL(req.url).pathname;
+    const relativePath = pathname.replace(prefix, "") || "/";
+    const segments = relativePath.split("/").filter(Boolean);
+    const resolved = resolveFileSync(dir, segments);
+    if (!resolved) return new Response("Not Found", { status: 404 });
+    const mws = [
+      ...resolved.errorFiles.map((f) => errorBoundary(f)),
+      ...resolved.layoutFiles.map((f) => layout(f)),
+      tailwindContext(dir)
+    ];
+    const handler = (req2, ctx2) => renderPage(resolved.pageFile)(req2, ctx2);
+    return runChain(mws, handler, req, ctx);
+  });
   return r;
 }
 
@@ -5957,10 +6156,10 @@ function createBashTool(ctx) {
         return { stdout: "", stderr: "Command denied: potentially dangerous command", exitCode: 1 };
       }
       const cwd = workdir ? `${ctx.workspace}/${workdir}` : ctx.workspace;
-      return new Promise((resolve15) => {
+      return new Promise((resolve14) => {
         const child = exec(command, { cwd, timeout: timeout * 1e3, maxBuffer: 1024 * 1024 }, (error, stdout, stderr) => {
           const truncated = stdout.length > 1e6 || stderr.length > 1e6;
-          resolve15({
+          resolve14({
             stdout: stdout.slice(0, 1e6),
             stderr: stderr.slice(0, 1e6),
             exitCode: error?.code ?? 0,
@@ -5977,7 +6176,7 @@ function createBashTool(ctx) {
 import { tool as tool4 } from "ai";
 import { z as z6 } from "zod";
 import { readFileSync as readFileSync4 } from "node:fs";
-import { resolve as resolve8 } from "node:path";
+import { resolve as resolve7 } from "node:path";
 function createReadTool(ctx) {
   return tool4({
     description: "Read file contents. Supports offset and limit for reading specific line ranges.",
@@ -5987,7 +6186,7 @@ function createReadTool(ctx) {
       limit: z6.number().optional().describe("Number of lines to read")
     }),
     execute: async ({ path: path2, offset, limit }) => {
-      const resolved = resolve8(ctx.workspace, path2);
+      const resolved = resolve7(ctx.workspace, path2);
       if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions)) {
         return { error: "Path not allowed", content: null, totalLines: 0 };
       }
@@ -6019,7 +6218,7 @@ function createReadTool(ctx) {
 import { tool as tool5 } from "ai";
 import { z as z7 } from "zod";
 import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "node:fs";
-import { resolve as resolve9, dirname as dirname4 } from "node:path";
+import { resolve as resolve8, dirname as dirname4 } from "node:path";
 function createWriteTool(ctx) {
   return tool5({
     description: "Create or overwrite a file. Parent directories are created automatically.",
@@ -6028,7 +6227,7 @@ function createWriteTool(ctx) {
       content: z7.string().describe("File content")
     }),
     execute: async ({ path: path2, content }) => {
-      const resolved = resolve9(ctx.workspace, path2);
+      const resolved = resolve8(ctx.workspace, path2);
       if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions)) {
         return { error: "Path not allowed" };
       }
@@ -6043,7 +6242,7 @@ function createWriteTool(ctx) {
 import { tool as tool6 } from "ai";
 import { z as z8 } from "zod";
 import { readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { resolve as resolve10 } from "node:path";
+import { resolve as resolve9 } from "node:path";
 function createEditTool(ctx) {
   return tool6({
     description: "Perform exact string replacements in a file. If oldString appears multiple times, provide more surrounding context.",
@@ -6054,7 +6253,7 @@ function createEditTool(ctx) {
       replaceAll: z8.boolean().default(false).describe("Replace all occurrences")
     }),
     execute: async ({ path: path2, oldString, newString, replaceAll }) => {
-      const resolved = resolve10(ctx.workspace, path2);
+      const resolved = resolve9(ctx.workspace, path2);
       if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions)) {
         return { error: "Path not allowed" };
       }
@@ -6087,8 +6286,8 @@ function createEditTool(ctx) {
 import { tool as tool7 } from "ai";
 import { z as z9 } from "zod";
 import { execFileSync } from "node:child_process";
-import { resolve as resolve11 } from "node:path";
-import { existsSync as existsSync6 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
 function createGrepTool(ctx) {
   return tool7({
     description: "Search file contents using regex. Supports file type filtering and context lines.",
@@ -6099,10 +6298,10 @@ function createGrepTool(ctx) {
       context: z9.number().default(0).describe("Number of context lines before and after each match")
     }),
     execute: async ({ pattern, include, path: path2, context }) => {
-      const searchDir = path2 ? resolve11(ctx.workspace, path2) : ctx.workspace;
+      const searchDir = path2 ? resolve10(ctx.workspace, path2) : ctx.workspace;
       try {
         let stdout;
-        if (existsSync6("/usr/bin/rg") || existsSync6("/usr/local/bin/rg")) {
+        if (existsSync5("/usr/bin/rg") || existsSync5("/usr/local/bin/rg")) {
           const args = ["-n"];
           if (context > 0) args.push("-C", String(context));
           if (include) args.push("-g", include);
@@ -6131,7 +6330,7 @@ function createGrepTool(ctx) {
 import { tool as tool8 } from "ai";
 import { z as z10 } from "zod";
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve11 } from "node:path";
 function createGlobTool(ctx) {
   return tool8({
     description: "Find files matching a glob pattern.",
@@ -6140,7 +6339,7 @@ function createGlobTool(ctx) {
       path: z10.string().optional().describe("Subdirectory relative to workspace")
     }),
     execute: async ({ pattern, path: path2 }) => {
-      const searchDir = path2 ? resolve12(ctx.workspace, path2) : ctx.workspace;
+      const searchDir = path2 ? resolve11(ctx.workspace, path2) : ctx.workspace;
       try {
         const stdout = execFileSync2("find", [
           searchDir,
@@ -6201,7 +6400,7 @@ function createQuestionTool(ctx) {
       options: z12.array(z12.string()).optional().describe("Optional multiple choice options")
     }),
     execute: async ({ question, options }, { toolCallId }) => {
-      return new Promise((resolve15, reject) => {
+      return new Promise((resolve14, reject) => {
         const timeout = setTimeout(() => {
           ctx.pendingQuestions.delete(toolCallId);
           reject(new Error("Question timed out"));
@@ -6209,7 +6408,7 @@ function createQuestionTool(ctx) {
         ctx.pendingQuestions.set(toolCallId, {
           resolve: (answer) => {
             clearTimeout(timeout);
-            resolve15(answer);
+            resolve14(answer);
           },
           reject: (err) => {
             clearTimeout(timeout);
@@ -6356,8 +6555,7 @@ async function buildRouter4(deps) {
   });
   try {
     const uiDir = new URL("../opencode/ui/", import.meta.url).pathname;
-    router.use(rootLayout(uiDir));
-    router.get("/", ssr(join7(uiDir, "page.tsx")));
+    router.use("/", ssr({ dir: uiDir }));
   } catch (e) {
     console.warn("[opencode] UI not available:", e);
   }
@@ -6492,7 +6690,7 @@ function createWSHandler2(deps) {
 import { readFile } from "node:fs/promises";
 import { glob } from "node:fs/promises";
 import { homedir } from "node:os";
-import { resolve as resolve13 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 import { parse as parseYaml } from "yaml";
 var SEARCH_DIRS = [
   (ws) => `${ws}/.opencode/skills`,
@@ -6530,7 +6728,7 @@ async function scanDir(dir) {
   try {
     const files = [];
     for await (const entry of glob("*/SKILL.md", { cwd: dir })) {
-      const skill = await parseSkillFile(resolve13(dir, entry));
+      const skill = await parseSkillFile(resolve12(dir, entry));
       if (skill) files.push(skill);
     }
     return files;
@@ -6627,7 +6825,7 @@ async function opencode(options) {
 
 // health.ts
 function health(options) {
-  const path2 = options?.path ?? "/";
+  const path2 = options?.path ?? "/__health";
   const r = new Router();
   const handler = async () => {
     try {
@@ -6649,15 +6847,31 @@ var MemStore = class {
   days = /* @__PURE__ */ new Map();
   pages = /* @__PURE__ */ new Map();
   refs = /* @__PURE__ */ new Map();
-  evict() {
+  timer = null;
+  evict(forceAll = false) {
     if (this.days.size <= MAX_MEM_ENTRIES) return;
-    const sorted = [...this.days.keys()].sort();
-    const toDelete = sorted.slice(0, this.days.size - MAX_MEM_ENTRIES);
+    const target = forceAll ? 0 : MAX_MEM_ENTRIES;
+    const toDelete = [];
+    for (const d of this.days.keys()) {
+      toDelete.push(d);
+      if (!forceAll && this.days.size - toDelete.length <= target) break;
+    }
     for (const d of toDelete) {
       this.days.delete(d);
       this.refs.delete(d);
     }
   }
+  startCleanup(interval) {
+    if (this.timer) return;
+    this.timer = setInterval(() => this.evict(true), interval);
+    if (this.timer.unref) this.timer.unref();
+  }
+  stopCleanup() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
   record(path2, date, refDomain, mobile) {
     let day = this.days.get(date);
     if (!day) {
@@ -6769,17 +6983,20 @@ async function queryPg(sql2, days) {
     devices: { mobile: Math.round(t.total_mobile / denom * 1e3) / 10, desktop: Math.round(t.total_desktop / denom * 1e3) / 10 }
   };
 }
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
 function renderDashboard(days, data) {
   const { total_pv, total_uv, top_pages, referrers } = data;
   const maxPv = Math.max(...data.daily.map((d) => d.pv), 1);
   const bars = data.daily.map(
-    (d) => `<div class="bar-wrap"><div class="bar" style="height:${d.pv / maxPv * 100}%"></div><span class="bar-label">${d.date.slice(5)}</span></div>`
+    (d) => `<div class="bar-wrap"><div class="bar" style="height:${d.pv / maxPv * 100}%"></div><span class="bar-label">${escapeHtml(d.date.slice(5))}</span></div>`
   ).join("");
   const rows = top_pages.map(
-    (p, i) => `<tr><td class="num">${i + 1}</td><td class="path">${p.path}</td><td class="num">${p.pv}</td></tr>`
+    (p, i) => `<tr><td class="num">${i + 1}</td><td class="path">${escapeHtml(p.path)}</td><td class="num">${p.pv}</td></tr>`
   ).join("");
   const refRows = referrers.map(
-    (r) => `<tr><td>${r.domain}</td><td class="num">${r.count}</td></tr>`
+    (r) => `<tr><td>${escapeHtml(r.domain)}</td><td class="num">${r.count}</td></tr>`
   ).join("");
   return `<!DOCTYPE html><html lang="en">
 <head><meta charset="utf-8"/><meta name="viewport" content="width=device-width,initial-scale=1"/><title>Analytics - weifuwu</title>
@@ -6821,6 +7038,7 @@ function analytics(options) {
   const excluded = options?.excluded ?? DEFAULT_EXCLUDED;
   const pg = options?.pg;
   const store2 = pg ? null : new MemStore();
+  if (store2) store2.startCleanup(6e4);
   const middleware = () => {
     const m = async (req, ctx, next) => {
       const path2 = new URL(req.url).pathname;
@@ -6832,7 +7050,13 @@ function analytics(options) {
         await recordPg(pg.sql, path2, date, mobile);
       } else {
         const ref = req.headers.get("referer") || "";
-        const refDomain = ref ? new URL(ref).hostname.replace(/^www\./, "") : "";
+        let refDomain = "";
+        if (ref) {
+          try {
+            refDomain = new URL(ref).hostname.replace(/^www\./, "");
+          } catch {
+          }
+        }
         store2.record(path2, date, refDomain, mobile);
       }
       return next(req, ctx);
@@ -6855,6 +7079,7 @@ function analytics(options) {
     if (pg) await migratePg(pg.sql, pg.table);
   };
   const close = async () => {
+    if (store2) store2.stopCleanup();
   };
   const mod = r;
   mod.middleware = middleware;
@@ -6864,9 +7089,8 @@ function analytics(options) {
 }
 
 // preferences.ts
-import { readFile as readFile2 } from "node:fs/promises";
-import { existsSync as existsSync7 } from "node:fs";
-import { join as join8, resolve as resolve14 } from "node:path";
+import { readFile as readFile2, stat } from "node:fs/promises";
+import { join as join7, resolve as resolve13 } from "node:path";
 var defaults = {
   locale: { default: "en", cookie: "locale", fromAcceptLanguage: true },
   theme: { default: "system", cookie: "theme" }
@@ -6881,15 +7105,6 @@ function translate(msgs, key, params, fallback) {
   }
   return result;
 }
-function extractCookie(req, name) {
-  const cookie = req.headers.get("cookie");
-  if (!cookie) return null;
-  for (const part of cookie.split(";")) {
-    const [k, v] = part.trim().split("=");
-    if (k === name && v) return decodeURIComponent(v);
-  }
-  return null;
-}
 function prefCookie(name, value) {
   return `${name}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
 }
@@ -6915,7 +7130,7 @@ async function handlePrefSwitch(req, value, cookieName, load) {
   });
 }
 function preferences(options) {
-  const dir = options.dir ? resolve14(options.dir) : void 0;
+  const dir = options.dir ? resolve13(options.dir) : void 0;
   const localeOpts = { ...defaults.locale, ...options.locale };
   const themeOpts = { ...defaults.theme, ...options.theme };
   const cache2 = /* @__PURE__ */ new Map();
@@ -6927,23 +7142,24 @@ function preferences(options) {
     if (!validLocale(locale)) return {};
     const cached = cache2.get(locale);
     if (cached) return cached;
-    const filePath = join8(dir, `${locale}.json`);
-    if (existsSync7(filePath)) {
-      try {
-        const content = await readFile2(filePath, "utf-8");
-        const data = JSON.parse(content);
-        cache2.set(locale, data);
-        return data;
-      } catch {
-        return {};
-      }
+    const filePath = join7(dir, `${locale}.json`);
+    let data = null;
+    try {
+      await stat(filePath);
+      const content = await readFile2(filePath, "utf-8");
+      data = JSON.parse(content);
+      cache2.set(locale, data);
+      return data;
+    } catch {
     }
-    const short = locale.split("-")[0];
-    if (short !== locale) {
-      const fallback = cache2.get(short) || await load(short);
-      if (fallback && Object.keys(fallback).length > 0) {
-        cache2.set(locale, fallback);
-        return fallback;
+    if (!data) {
+      const short = locale.split("-")[0];
+      if (short !== locale) {
+        const fallback = cache2.get(short) || await load(short);
+        if (fallback && Object.keys(fallback).length > 0) {
+          cache2.set(locale, fallback);
+          return fallback;
+        }
       }
     }
     return {};
@@ -6978,7 +7194,7 @@ function preferences(options) {
         }
       });
     };
-    const flashVal = extractCookie(req, "flash");
+    const flashVal = getCookies(req)["flash"] ?? null;
     if (flashVal) {
       try {
         ctx.prefs.flash = JSON.parse(flashVal);
@@ -6997,7 +7213,7 @@ function preferences(options) {
 }
 function detectLocale(req, opts) {
   if (opts.cookie) {
-    const fromCookie = extractCookie(req, opts.cookie);
+    const fromCookie = getCookies(req)[opts.cookie];
     if (fromCookie) return fromCookie;
   }
   if (opts.fromAcceptLanguage) {
@@ -7008,7 +7224,7 @@ function detectLocale(req, opts) {
 }
 function detectTheme(req, opts) {
   if (opts.cookie) {
-    const fromCookie = extractCookie(req, opts.cookie);
+    const fromCookie = getCookies(req)[opts.cookie];
     if (fromCookie) return fromCookie;
   }
   return opts.default;
@@ -7217,12 +7433,13 @@ function csrf(options) {
       return res;
     }
     const cookieToken = getCookies(req)[cookieName];
-    let headerToken = req.headers.get(headerName) ?? req.headers.get("x-xsrf-token") ?? "";
+    let headerToken = req.headers.get(headerName) ?? "";
     if (!headerToken && (req.method === "POST" || req.method === "PUT" || req.method === "PATCH" || req.method === "DELETE")) {
       try {
         const body = await req.clone().json();
         headerToken = body[bodyKey] ?? "";
-      } catch {
+      } catch (e) {
+        return new Response("Invalid request body", { status: 400 });
       }
     }
     if (!cookieToken || !headerToken || cookieToken !== headerToken) {
@@ -7964,12 +8181,12 @@ function iii(opts = {}) {
     const handler = async (payload) => {
       if (!worker.ws) throw new Error(`Worker "${worker.name}" disconnected`);
       const invocationId = crypto6.randomUUID();
-      return new Promise((resolve15, reject) => {
+      return new Promise((resolve14, reject) => {
         const timer = setTimeout(() => {
           pending.delete(invocationId);
           reject(new Error(`Invocation timed out for "${id3}"`));
         }, 3e4);
-        pending.set(invocationId, { resolve: resolve15, reject, timer });
+        pending.set(invocationId, { resolve: resolve14, reject, timer });
         worker.ws.send(JSON.stringify({
           type: "invoke",
           invocation_id: invocationId,
@@ -8210,8 +8427,8 @@ function registerWorker(url) {
   function connect() {
     if (intentionalClose) return;
     ws = new WebSocket(url);
-    ready = new Promise((resolve15) => {
-      resolveReady = resolve15;
+    ready = new Promise((resolve14) => {
+      resolveReady = resolve14;
     });
     ws.onopen = () => {
       reconnectAttempt = 0;
@@ -8331,13 +8548,13 @@ function registerWorker(url) {
         }
         return Promise.resolve(fn(request.payload, ctx));
       }
-      return new Promise((resolve15, reject) => {
+      return new Promise((resolve14, reject) => {
         const invocationId = genId();
         const timer = setTimeout(() => {
           pendingInvocations.delete(invocationId);
           reject(new Error(`Invocation timed out for "${request.function_id}"`));
         }, request.timeout_ms || 3e4);
-        pendingInvocations.set(invocationId, { resolve: resolve15, reject, timer });
+        pendingInvocations.set(invocationId, { resolve: resolve14, reject, timer });
         send({
           type: "invoke",
           invocation_id: invocationId,
@@ -8357,116 +8574,6 @@ function registerWorker(url) {
     }
   };
 }
-
-// layout.ts
-function layout(path2) {
-  return async (req, ctx, next) => {
-    const mod = await compile(path2);
-    const Component = mod.default;
-    if (!Component) throw new Error(`Layout ${path2} has no default export`);
-    ctx.layoutStack = [...ctx.layoutStack || [], { path: path2, component: Component }];
-    return next(req, ctx);
-  };
-}
-
-// not-found.ts
-import { createElement as createElement2 } from "react";
-function notFound(path2) {
-  return async (req, ctx) => {
-    if (!path2) return new Response("Not Found", { status: 404 });
-    let Component;
-    try {
-      const mod = await compile(path2);
-      Component = mod?.default;
-    } catch {
-      return new Response("Not Found", { status: 404 });
-    }
-    if (!Component) return new Response("Not Found", { status: 404 });
-    const layouts = ctx.layoutStack || [];
-    const layoutComponents = layouts.map((l) => l.component);
-    const base = (ctx.mountPath || "").replace(/\/$/, "");
-    let element = createElement2(
-      "div",
-      { id: "__weifuwu_root" },
-      createElement2(Component, null)
-    );
-    if (layoutComponents.length === 0) {
-      element = createElement2(
-        "html",
-        { lang: "en" },
-        createElement2(
-          "head",
-          null,
-          createElement2("meta", { charSet: "utf-8" }),
-          createElement2("meta", { name: "viewport", content: "width=device-width, initial-scale=1" }),
-          createElement2("title", null, "404")
-        ),
-        createElement2("body", null, element)
-      );
-    } else {
-      for (const L of layoutComponents.toReversed()) {
-        element = createElement2(L, { children: element });
-      }
-    }
-    const { renderToReadableStream } = await import("react-dom/server");
-    const stream = await renderToReadableStream(element);
-    return streamResponse(stream, {
-      ctx,
-      base,
-      isDev: process.env.NODE_ENV !== "production",
-      compiledTailwindCss: ctx.compiledTailwindCss,
-      status: 404
-    });
-  };
-}
-
-// error-boundary.ts
-import { createElement as createElement3 } from "react";
-function errorBoundary(errorPath) {
-  return async (req, ctx, next) => {
-    try {
-      return await next(req, ctx);
-    } catch (err) {
-      const mod = await compile(errorPath);
-      const ErrorComponent = mod.default;
-      if (!ErrorComponent) throw err;
-      const layouts = (ctx.layoutStack || []).map((l) => l.component);
-      const base = (ctx.mountPath || "").replace(/\/$/, "");
-      let element = createElement3(ErrorComponent, {
-        error: err instanceof Error ? err : new Error(String(err)),
-        reset: () => {
-        }
-      });
-      if (layouts.length === 0) {
-        element = createElement3(
-          "html",
-          { lang: "en" },
-          createElement3(
-            "head",
-            null,
-            createElement3("meta", { charSet: "utf-8" }),
-            createElement3("meta", { name: "viewport", content: "width=device-width, initial-scale=1" }),
-            createElement3("title", null, "500")
-          ),
-          createElement3("body", null, element)
-        );
-      } else {
-        for (const L of layouts.toReversed()) {
-          element = createElement3(L, { children: element });
-        }
-      }
-      const { renderToReadableStream } = await import("react-dom/server");
-      const stream = await renderToReadableStream(element);
-      return streamResponse(stream, {
-        ctx,
-        base,
-        isDev: process.env.NODE_ENV !== "production",
-        compiledTailwindCss: ctx.compiledTailwindCss,
-        status: 500
-      });
-    }
-  };
-}
 export {
   Router,
   TsxContext,
@@ -8474,7 +8581,6 @@ export {
   aiStream,
   analytics,
   auth,
-  clearCompileCache,
   compress,
   cors,
   createHub,
@@ -8488,7 +8594,6 @@ export {
   deploy,
   embed,
   embedMany,
-  errorBoundary,
   formatSSE,
   formatSSEData,
   generateObject,
@@ -8498,13 +8603,12 @@ export {
   health,
   helmet,
   iii,
-  layout,
+  isDev,
   loadEnv,
   logdb,
   logger,
   mailer,
   messager,
-  notFound,
   openai,
   opencode,
   postgres,
@@ -8514,7 +8618,6 @@ export {
   redis,
   registerWorker,
   requestId,
-  rootLayout,
   runWorkflow,
   seo,
   seoMiddleware,
@@ -8524,7 +8627,6 @@ export {
   setCookie,
   smoothStream,
   ssr,
-  ssrEntries,
   streamObject,
   streamText,
   tenant,