weifuwu 0.21.0 → 0.22.0

package/dist/index.js

@@ -1,3 +1,9 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
 // trace.ts
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
@@ -1159,11 +1165,33 @@ var MIME_TYPES = {
 };
 
 // validate.ts
+function parseFormBody(text2) {
+  const params = new URLSearchParams(text2);
+  const result = {};
+  for (const [key, value] of params) {
+    result[key] = value;
+  }
+  return result;
+}
+function parseBody(text2, ct) {
+  if (ct.includes("application/x-www-form-urlencoded")) {
+    return parseFormBody(text2);
+  }
+  const isExplicitJson = ct.includes("application/json") || ct.includes("+json") || ct.includes("text/") || ct.includes("*/json");
+  const isNotSpecialMultipart = !ct.includes("multipart/form-data") && !ct.includes("application/x-www-form-urlencoded");
+  if (isExplicitJson || isNotSpecialMultipart) {
+    try {
+      return JSON.parse(text2);
+    } catch {
+    }
+  }
+  return text2;
+}
 function validate(schemas) {
   return async (req, ctx, next) => {
     const parsed = {};
     const issues = [];
-    if (schemas.params) {
+    if (schemas?.params) {
       const result = schemas.params.safeParse(ctx.params);
       if (result.success) {
         parsed.params = result.data;
@@ -1174,7 +1202,7 @@ function validate(schemas) {
         })));
       }
     }
-    if (schemas.query) {
+    if (schemas?.query) {
       const result = schemas.query.safeParse(ctx.query);
       if (result.success) {
         parsed.query = result.data;
@@ -1185,7 +1213,7 @@ function validate(schemas) {
         })));
       }
     }
-    if (schemas.headers) {
+    if (schemas?.headers) {
       const rawHeaders = {};
       req.headers.forEach((v, k) => {
         rawHeaders[k] = v;
@@ -1200,32 +1228,35 @@ function validate(schemas) {
         })));
       }
     }
-    if (schemas.body) {
-      if (req.method === "GET" || req.method === "HEAD") {
-      } else if (req.body === null) {
-        issues.push({ path: ["body"], message: "Request body is required" });
-      } else {
-        const bodyText = await req.text();
-        if (!bodyText) {
-          issues.push({ path: ["body"], message: "Request body is required" });
+    if (req.method !== "GET" && req.method !== "HEAD") {
+      const ct = req.headers.get("content-type") ?? "";
+      const isForm = ct.includes("application/x-www-form-urlencoded");
+      if (schemas?.body || isForm) {
+        if (req.body === null) {
+          if (schemas?.body) {
+            issues.push({ path: ["body"], message: "Request body is required" });
+          }
         } else {
-          const ct = req.headers.get("content-type") ?? "";
-          const shouldParseJson = ct.includes("application/json") || ct.includes("text/") || ct.includes("*/json") || !ct.includes("multipart/form-data") && !ct.includes("application/x-www-form-urlencoded");
-          let bodyValue = bodyText;
-          if (shouldParseJson) {
-            try {
-              bodyValue = JSON.parse(bodyText);
-            } catch {
+          const bodyText = await req.text();
+          if (!bodyText) {
+            if (schemas?.body) {
+              issues.push({ path: ["body"], message: "Request body is required" });
             }
-          }
-          const result = schemas.body.safeParse(bodyValue);
-          if (result.success) {
-            parsed.body = result.data;
           } else {
-            issues.push(...result.error.issues.map((i) => ({
-              path: ["body", ...i.path.map(String)],
-              message: i.message
-            })));
+            const bodyValue = parseBody(bodyText, ct);
+            if (schemas?.body) {
+              const result = schemas.body.safeParse(bodyValue);
+              if (result.success) {
+                parsed.body = result.data;
+              } else {
+                issues.push(...result.error.issues.map((i) => ({
+                  path: ["body", ...i.path.map(String)],
+                  message: i.message
+                })));
+              }
+            } else {
+              parsed.body = bodyValue;
+            }
           }
         }
       }
@@ -1395,28 +1426,35 @@ function upload(options) {
 }
 
 // rate-limit.ts
+function defaultKey(_req, _ctx) {
+  const forwarded = _req.headers.get("x-forwarded-for");
+  if (forwarded) return forwarded.split(",")[0].trim();
+  const realIp = _req.headers.get("x-real-ip");
+  if (realIp) return realIp;
+  const cfIp = _req.headers.get("cf-connecting-ip");
+  if (cfIp) return cfIp;
+  return "global";
+}
 function rateLimit(options) {
   const max = options?.max ?? 100;
   const window2 = options?.window ?? 6e4;
-  const getKey = options?.key ?? ((_req, _ctx) => {
-    const forwarded = _req.headers.get("x-forwarded-for");
-    if (forwarded) return forwarded.split(",")[0].trim();
-    const realIp = _req.headers.get("x-real-ip");
-    if (realIp) return realIp;
-    const cfIp = _req.headers.get("cf-connecting-ip");
-    if (cfIp) return cfIp;
-    return "global";
-  });
+  const getKey = options?.key ?? defaultKey;
   const message = options?.message ?? "Too Many Requests";
-  const MAX_ENTRIES = 1e4;
+  const storeType = options?.store ?? "memory";
+  if (storeType === "redis" && !options?.redis) {
+    throw new Error('rateLimit: redis client required when store: "redis"');
+  }
+  const redis2 = options?.redis ?? null;
+  const keyPrefix = options?.prefix ?? "ratelimit:";
+  const MAX_ENTRIES2 = 1e4;
   const hits = /* @__PURE__ */ new Map();
-  const interval = setInterval(() => {
+  const interval = storeType === "memory" ? setInterval(() => {
     const now = Date.now();
     for (const [key, entry] of hits) {
       if (entry.reset < now) hits.delete(key);
     }
-    if (hits.size > MAX_ENTRIES) {
-      const toDelete = hits.size - MAX_ENTRIES;
+    if (hits.size > MAX_ENTRIES2) {
+      const toDelete = hits.size - MAX_ENTRIES2;
       let deleted = 0;
       for (const key of hits.keys()) {
         if (deleted >= toDelete) break;
@@ -1424,39 +1462,56 @@ function rateLimit(options) {
         deleted++;
       }
     }
-  }, Math.min(window2, 3e4));
-  if (interval.unref) interval.unref();
-  const mw = async (req, ctx, next) => {
-    const key = getKey(req, ctx);
+  }, Math.min(window2, 3e4)) : null;
+  if (interval?.unref) interval.unref();
+  async function checkAndIncrement(key) {
     const now = Date.now();
+    if (storeType === "redis" && redis2) {
+      const redisKey = `${keyPrefix}${key}`;
+      const count = await redis2.incr(redisKey);
+      if (count === 1) {
+        await redis2.pexpire(redisKey, window2);
+      }
+      const pttl = await redis2.pttl(redisKey);
+      const reset = pttl > 0 ? now + pttl : now + window2;
+      return { count, reset };
+    }
     let entry = hits.get(key);
     if (!entry || entry.reset < now) {
       hits.set(key, { count: 1, reset: now + window2 });
-      entry = { count: 1, reset: now + window2 };
-      const res2 = await next(req, ctx);
-      return addRateLimitHeaders(res2, max, max - 1, now + window2);
+      return { count: 1, reset: now + window2 };
     }
     entry.count++;
-    const remaining = Math.max(0, max - entry.count);
-    if (entry.count > max) {
+    return { count: entry.count, reset: entry.reset };
+  }
+  const mw = async (req, ctx, next) => {
+    const key = getKey(req, ctx);
+    const now = Date.now();
+    const { count, reset } = await checkAndIncrement(key);
+    if (count > max) {
       return new Response(message, {
         status: 429,
         headers: {
-          "Retry-After": String(Math.ceil((entry.reset - now) / 1e3)),
+          "Retry-After": String(Math.ceil((reset - now) / 1e3)),
           "X-RateLimit-Limit": String(max),
           "X-RateLimit-Remaining": "0",
-          "X-RateLimit-Reset": String(Math.ceil(entry.reset / 1e3))
+          "X-RateLimit-Reset": String(Math.ceil(reset / 1e3))
         }
       });
     }
+    const remaining = max - count;
     const res = await next(req, ctx);
-    return addRateLimitHeaders(res, max, remaining, entry.reset);
+    return addRateLimitHeaders(res, max, remaining, reset);
   };
   mw.stop = () => {
-    clearInterval(interval);
+    if (interval) clearInterval(interval);
     hits.clear();
   };
-  mw.stats = () => ({ entries: hits.size, maxEntries: MAX_ENTRIES });
+  mw.stats = () => ({
+    store: storeType,
+    entries: storeType === "memory" ? hits.size : void 0,
+    maxEntries: MAX_ENTRIES2
+  });
   return mw;
 }
 function addRateLimitHeaders(res, limit, remaining, reset) {
@@ -1781,6 +1836,55 @@ var TestApp = class {
 function testApp() {
   return new TestApp();
 }
+async function createTestDb(options) {
+  const dbUrl = options?.url || process.env.TEST_DATABASE_URL || process.env.DATABASE_URL;
+  if (!dbUrl) throw new Error("createTestDb: DATABASE_URL or TEST_DATABASE_URL required");
+  const schema = options?.schema || `test_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+  const { default: postgres2 } = await import("postgres");
+  const adminSql = postgres2(dbUrl);
+  await adminSql.unsafe('CREATE SCHEMA IF NOT EXISTS "' + schema.replace(/"/g, '""') + '"');
+  const schemaUrl = new URL(dbUrl);
+  schemaUrl.searchParams.set("search_path", schema);
+  const sql2 = postgres2(schemaUrl.toString());
+  await adminSql.end();
+  return {
+    sql: sql2,
+    url: schemaUrl.toString(),
+    schema,
+    destroy: async () => {
+      const destroySql = postgres2(dbUrl);
+      await destroySql.unsafe('DROP SCHEMA IF EXISTS "' + schema.replace(/"/g, '""') + '" CASCADE');
+      await destroySql.end();
+      await sql2.end();
+    }
+  };
+}
+async function withTestDb(optionsOrFn, fn) {
+  let dbUrl;
+  let callback;
+  if (typeof optionsOrFn === "function") {
+    callback = optionsOrFn;
+  } else if (typeof optionsOrFn === "string") {
+    dbUrl = optionsOrFn;
+    callback = fn;
+  } else {
+    dbUrl = optionsOrFn?.url;
+    callback = fn;
+  }
+  const resolvedUrl = dbUrl || process.env.TEST_DATABASE_URL || process.env.DATABASE_URL;
+  if (!resolvedUrl) throw new Error("withTestDb: DATABASE_URL or TEST_DATABASE_URL required");
+  const { default: postgres2 } = await import("postgres");
+  const sql2 = postgres2(resolvedUrl);
+  try {
+    await sql2.begin(async (txSql) => {
+      await callback(txSql);
+      throw void 0;
+    });
+  } catch {
+  } finally {
+    await sql2.end();
+  }
+}
 
 // graphql.ts
 import { buildSchema, graphql as executeGraphQL, validate as validateQuery, parse } from "graphql";
@@ -3476,6 +3580,8 @@ function queue(opts) {
   let _processed = 0;
   let _failed = 0;
   const jobKey = `${prefix}:jobs`;
+  const failedKey = `${prefix}:failed`;
+  const MAX_FAILED = 1e3;
   const mw = ((req, ctx, next) => {
     ctx.queue = q;
     return next(req, ctx);
@@ -3490,7 +3596,15 @@ function queue(opts) {
       _processed++;
     } catch (e) {
       _failed++;
-      console.error("[queue] handler error:", e.message);
+      const errMsg = e.message;
+      console.error("[queue] handler error:", errMsg);
+      const failedEntry = JSON.stringify({
+        ...job,
+        error: errMsg,
+        failedAt: Date.now()
+      });
+      await redis2.lpush(failedKey, failedEntry);
+      await redis2.ltrim(failedKey, 0, MAX_FAILED - 1);
     } finally {
       inflight--;
     }
@@ -3571,6 +3685,101 @@ function queue(opts) {
     while (inflight > 0) await new Promise((r) => setTimeout(r, 50));
     redis2.disconnect();
   };
+  mw.jobs = async function jobs(limit) {
+    const raw = await redis2.zrevrange(jobKey, 0, (limit ?? 50) - 1);
+    return raw.map((r) => {
+      try {
+        return JSON.parse(r);
+      } catch {
+        return null;
+      }
+    }).filter(Boolean);
+  };
+  mw.failedJobs = async function failedJobs(limit) {
+    const raw = await redis2.lrange(failedKey, 0, (limit ?? 50) - 1);
+    return raw.map((r) => {
+      try {
+        return JSON.parse(r);
+      } catch {
+        return null;
+      }
+    }).filter(Boolean);
+  };
+  mw.retryFailed = async function retryFailed(jobId) {
+    const raw = await redis2.lrange(failedKey, 0, -1);
+    for (const entry of raw) {
+      try {
+        const job = JSON.parse(entry);
+        if (job.id === jobId) {
+          await redis2.lrem(failedKey, 1, entry);
+          const reJob = { ...job, runAt: Date.now() };
+          delete reJob.error;
+          delete reJob.failedAt;
+          await redis2.zadd(jobKey, reJob.runAt, JSON.stringify(reJob));
+          _failed--;
+          return true;
+        }
+      } catch {
+      }
+    }
+    return false;
+  };
+  mw.retryAllFailed = async function retryAllFailed(type) {
+    const raw = await redis2.lrange(failedKey, 0, -1);
+    let count = 0;
+    for (const entry of raw) {
+      try {
+        const job = JSON.parse(entry);
+        if (type && job.type !== type) continue;
+        await redis2.lrem(failedKey, 1, entry);
+        const reJob = { ...job, runAt: Date.now() };
+        delete reJob.error;
+        delete reJob.failedAt;
+        await redis2.zadd(jobKey, reJob.runAt, JSON.stringify(reJob));
+        _failed--;
+        count++;
+      } catch {
+      }
+    }
+    return count;
+  };
+  mw.dashboard = function dashboard() {
+    const r = new Router();
+    r.get("/", async (req, ctx) => {
+      const s = q.stats();
+      const pending = await q.jobs(100);
+      const byType = {};
+      for (const job of pending) {
+        if (!byType[job.type]) byType[job.type] = { pending: 0, failed: 0 };
+        byType[job.type].pending++;
+      }
+      const failed = await q.failedJobs(1e3);
+      for (const job of failed) {
+        if (!byType[job.type]) byType[job.type] = { pending: 0, failed: 0 };
+        byType[job.type].failed++;
+      }
+      return Response.json({
+        stats: s,
+        types: byType,
+        failedCount: failed.length
+      });
+    });
+    r.get("/:type/failed", async (req, ctx) => {
+      const failed = await q.failedJobs(100);
+      const filtered = failed.filter((j) => j.type === ctx.params.type);
+      return Response.json({ jobs: filtered, count: filtered.length });
+    });
+    r.post("/:type/retry", async (req, ctx) => {
+      const count = await q.retryAllFailed(ctx.params.type);
+      return Response.json({ retried: count });
+    });
+    r.post("/retry/:id", async (req, ctx) => {
+      const ok = await q.retryFailed(ctx.params.id);
+      if (!ok) return new Response("Job not found", { status: 404 });
+      return Response.json({ retried: true });
+    });
+    return r;
+  };
   mw.stats = () => ({
     running,
     inflight,
@@ -7254,12 +7463,12 @@ async function buildRouter4(deps) {
   const router = new Router();
   router.post("/sessions", async (req, ctx) => {
     const body = await req.json().catch(() => ({}));
-    const session = await createSession(sql2, {
+    const session2 = await createSession(sql2, {
       title: body.title,
       model: body.model,
       systemPrompt: body.systemPrompt || systemPrompt
     }, workspace, ctx.mountPath || "");
-    return Response.json(session, { status: 201 });
+    return Response.json(session2, { status: 201 });
   });
   router.get("/sessions", async () => {
     const sessions2 = await listSessions(sql2);
@@ -7267,10 +7476,10 @@ async function buildRouter4(deps) {
   });
   router.get("/sessions/:id", async (_req, ctx) => {
     const id2 = ctx.params.id;
-    const session = await getSession(sql2, id2);
-    if (!session) return new Response("Not Found", { status: 404 });
+    const session2 = await getSession(sql2, id2);
+    if (!session2) return new Response("Not Found", { status: 404 });
     const messages2 = await getHistory(sql2, id2);
-    return Response.json({ session, messages: messages2 });
+    return Response.json({ session: session2, messages: messages2 });
   });
   router.delete("/sessions/:id", async (_req, ctx) => {
     const id2 = ctx.params.id;
@@ -7279,12 +7488,12 @@ async function buildRouter4(deps) {
   });
   router.post("/sessions/:id/message", async (req, ctx) => {
     const sessionId = ctx.params.id;
-    const session = await getSession(sql2, sessionId);
-    if (!session) return new Response("Session Not Found", { status: 404 });
+    const session2 = await getSession(sql2, sessionId);
+    if (!session2) return new Response("Session Not Found", { status: 404 });
     const { content } = await req.json();
     if (!content) return new Response("Missing content", { status: 400 });
     const toolCtx = {
-      workspace: session.workspace || workspace,
+      workspace: session2.workspace || workspace,
       permissions,
       pendingQuestions,
       skillsRegistry: deps.skillsRegistry
@@ -7292,10 +7501,10 @@ async function buildRouter4(deps) {
     const tools = createTools(toolCtx);
     const allSkills = [...skills];
     const sysPrompt = buildSystemPrompt({
-      workspace: session.workspace || workspace,
-      model: session.model,
+      workspace: session2.workspace || workspace,
+      model: session2.model,
       skills: allSkills,
-      systemPrompt: session.system_prompt || systemPrompt
+      systemPrompt: session2.system_prompt || systemPrompt
     });
     const history = await getHistory(sql2, sessionId);
     await addTextMessage(sql2, sessionId, "user", content);
@@ -7312,8 +7521,8 @@ async function buildRouter4(deps) {
   });
   router.get("/sessions/:id/usage", async (_req, ctx) => {
     const sessionId = ctx.params.id;
-    const session = await getSession(sql2, sessionId);
-    if (!session) return new Response("Not Found", { status: 404 });
+    const session2 = await getSession(sql2, sessionId);
+    if (!session2) return new Response("Not Found", { status: 404 });
     const rows = await sql2`
       SELECT
         COUNT(*)::int AS message_count,
@@ -7363,13 +7572,13 @@ function createWSHandler2(deps) {
       switch (msg.type) {
         case "create": {
           try {
-            const session = await createSession(sql2, {
+            const session2 = await createSession(sql2, {
               userId: client.userId,
               title: msg.title,
               model: msg.model,
               systemPrompt: msg.systemPrompt || systemPrompt
             }, workspace, client.mountPath);
-            ws.send(JSON.stringify({ type: "session_created", session }));
+            ws.send(JSON.stringify({ type: "session_created", session: session2 }));
           } catch (e) {
             ws.send(JSON.stringify({ type: "error", error: e.message }));
           }
@@ -7386,13 +7595,13 @@ function createWSHandler2(deps) {
           client.abortController = controller;
           client.currentSessionId = session_id;
           try {
-            const session = await getSession(sql2, session_id);
-            if (!session) {
+            const session2 = await getSession(sql2, session_id);
+            if (!session2) {
               ws.send(JSON.stringify({ type: "error", error: "Session not found" }));
               return;
             }
             const toolCtx = {
-              workspace: session.workspace || workspace,
+              workspace: session2.workspace || workspace,
               permissions,
               pendingQuestions,
               skillsRegistry
@@ -7400,10 +7609,10 @@ function createWSHandler2(deps) {
             const tools = createTools(toolCtx);
             const allSkills = [...skills];
             const sysPrompt = buildSystemPrompt({
-              workspace: session.workspace || workspace,
-              model: session.model,
+              workspace: session2.workspace || workspace,
+              model: session2.model,
               skills: allSkills,
-              systemPrompt: session.system_prompt || systemPrompt
+              systemPrompt: session2.system_prompt || systemPrompt
             });
             const history = await getHistory(sql2, session_id);
             await addTextMessage(sql2, session_id, "user", content);
@@ -7911,14 +8120,14 @@ function preferences(options) {
   const dir = options.dir ? resolve13(options.dir) : void 0;
   const localeOpts = { ...defaults.locale, ...options.locale };
   const themeOpts = { ...defaults.theme, ...options.theme };
-  const cache2 = /* @__PURE__ */ new Map();
+  const cache3 = /* @__PURE__ */ new Map();
   function validLocale(locale) {
     return /^[\w-]+$/.test(locale) && !locale.includes("..");
   }
   async function load(locale) {
     if (!dir) return {};
     if (!validLocale(locale)) return {};
-    const cached = cache2.get(locale);
+    const cached = cache3.get(locale);
     if (cached) return cached;
     const filePath = join7(dir, `${locale}.json`);
     let data = null;
@@ -7926,16 +8135,16 @@ function preferences(options) {
       await stat2(filePath);
       const content = await readFile2(filePath, "utf-8");
       data = JSON.parse(content);
-      cache2.set(locale, data);
+      cache3.set(locale, data);
       return data;
     } catch {
     }
     if (!data) {
       const short = locale.split("-")[0];
       if (short !== locale) {
-        const fallback = cache2.get(short) || await load(short);
+        const fallback = cache3.get(short) || await load(short);
         if (fallback && Object.keys(fallback).length > 0) {
-          cache2.set(locale, fallback);
+          cache3.set(locale, fallback);
           return fallback;
         }
       }
@@ -9352,9 +9561,753 @@ function registerWorker(url) {
     }
   };
 }
+
+// session.ts
+import crypto7 from "node:crypto";
+var kSaved = /* @__PURE__ */ Symbol("session.saved");
+var kDestroyed = /* @__PURE__ */ Symbol("session.destroyed");
+var kId = /* @__PURE__ */ Symbol("session.id");
+var kStore = /* @__PURE__ */ Symbol("session.store");
+var kTtl = /* @__PURE__ */ Symbol("session.ttl");
+var MAX_SESSIONS = 1e5;
+var MemoryStore = class {
+  store = /* @__PURE__ */ new Map();
+  interval;
+  constructor(cleanupMs = 6e4) {
+    this.interval = setInterval(() => this.cleanup(), cleanupMs);
+    if (this.interval.unref) this.interval.unref();
+  }
+  async get(sid) {
+    const entry = this.store.get(sid);
+    if (!entry) return null;
+    if (Date.now() > entry.expires) {
+      this.store.delete(sid);
+      return null;
+    }
+    return entry.data;
+  }
+  async set(sid, data, ttl) {
+    if (this.store.size >= MAX_SESSIONS) {
+      const oldest = this.store.keys().next();
+      if (!oldest.done) this.store.delete(oldest.value);
+    }
+    this.store.set(sid, { data, expires: Date.now() + ttl });
+  }
+  async destroy(sid) {
+    this.store.delete(sid);
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [key, entry] of this.store) {
+      if (entry.expires < now) this.store.delete(key);
+    }
+  }
+  close() {
+    clearInterval(this.interval);
+    this.store.clear();
+  }
+  /** Testing only: return approximate count. */
+  get size() {
+    return this.store.size;
+  }
+};
+var RedisStore = class {
+  redis;
+  prefix;
+  constructor(redis2, prefix = "session:") {
+    this.redis = redis2;
+    this.prefix = prefix;
+  }
+  key(sid) {
+    return `${this.prefix}${sid}`;
+  }
+  async get(sid) {
+    const raw = await this.redis.get(this.key(sid));
+    if (!raw) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      await this.redis.del(this.key(sid));
+      return null;
+    }
+  }
+  async set(sid, data, ttl) {
+    const ttlSec = Math.ceil(ttl / 1e3);
+    await this.redis.setex(this.key(sid), ttlSec, JSON.stringify(data));
+  }
+  async destroy(sid) {
+    await this.redis.del(this.key(sid));
+  }
+};
+function createSessionObject(data, sid, store2, ttl) {
+  const obj = data ?? {};
+  obj[kSaved] = false;
+  obj[kDestroyed] = false;
+  obj[kId] = sid;
+  obj[kStore] = store2;
+  obj[kTtl] = ttl;
+  obj.save = () => {
+    obj[kSaved] = true;
+  };
+  obj.destroy = () => {
+    obj[kDestroyed] = true;
+    obj[kSaved] = false;
+    for (const key of Object.keys(obj)) {
+      if (typeof key === "symbol") continue;
+      delete obj[key];
+    }
+  };
+  Object.defineProperty(obj, "id", {
+    get: () => obj[kId],
+    enumerable: false,
+    configurable: false
+  });
+  Object.defineProperty(obj, "save", { enumerable: false, configurable: true, writable: true, value: obj.save });
+  Object.defineProperty(obj, "destroy", { enumerable: false, configurable: true, writable: true, value: obj.destroy });
+  return obj;
+}
+function isSessionActive(session2) {
+  for (const key of Object.keys(session2)) {
+    if (key !== "save" && key !== "destroy") return true;
+  }
+  return false;
+}
+function session(options) {
+  const ttl = options?.ttl ?? 24 * 60 * 60 * 1e3;
+  const cookieName = options?.cookieName ?? "__session";
+  const cookieOpts = {
+    path: options?.cookie?.path ?? "/",
+    domain: options?.cookie?.domain,
+    httpOnly: options?.cookie?.httpOnly ?? true,
+    secure: options?.cookie?.secure ?? process.env.NODE_ENV === "production",
+    sameSite: options?.cookie?.sameSite ?? "lax"
+  };
+  let store2;
+  let closeStore = null;
+  if (options?.store && typeof options.store.get === "function") {
+    store2 = options.store;
+  } else if (options?.store === "redis") {
+    if (!options.redis) throw new Error('session: redis client required when store: "redis"');
+    store2 = new RedisStore(options.redis);
+  } else {
+    const mem = new MemoryStore();
+    store2 = mem;
+    closeStore = () => mem.close();
+  }
+  const mw = (async (req, ctx, next) => {
+    const cookies = getCookies(req);
+    const sid = cookies[cookieName];
+    let session2;
+    let loadedSid = sid ?? null;
+    if (sid) {
+      const data = await store2.get(sid);
+      if (data) {
+        session2 = createSessionObject(data, sid, store2, ttl);
+      } else {
+        loadedSid = null;
+        session2 = createSessionObject({}, crypto7.randomUUID(), store2, ttl);
+      }
+    } else {
+      session2 = createSessionObject({}, crypto7.randomUUID(), store2, ttl);
+    }
+    const snapshot = isSessionActive(session2) ? JSON.stringify(session2) : null;
+    ctx.session = session2;
+    ctx.sessionId = session2.id;
+    const res = await next(req, ctx);
+    const currentSession = ctx.session;
+    if (!currentSession || currentSession[kDestroyed]) {
+      if (loadedSid) {
+        await store2.destroy(loadedSid);
+      }
+      return deleteCookie(res, cookieName, cookieOpts);
+    }
+    const currentData = isSessionActive(currentSession) ? JSON.stringify(currentSession) : null;
+    const wasSaved = currentSession[kSaved];
+    const changed = wasSaved || currentData !== snapshot;
+    if (!changed) {
+      if (loadedSid) {
+        if (store2 instanceof RedisStore) {
+          await store2.set(loadedSid, JSON.parse(currentData ?? "{}"), ttl);
+        }
+      }
+      return res;
+    }
+    if (currentData && currentData !== "{}") {
+      const targetSid = loadedSid ?? currentSession.id;
+      const data = JSON.parse(currentData);
+      await store2.set(targetSid, data, ttl);
+      if (!loadedSid) {
+        const cookieRes = setCookie(res, cookieName, targetSid, cookieOpts);
+        return cookieRes;
+      }
+    } else if (loadedSid) {
+      await store2.destroy(loadedSid);
+      return deleteCookie(res, cookieName, cookieOpts);
+    }
+    return res;
+  });
+  mw.close = () => {
+    closeStore?.();
+  };
+  mw.store = store2;
+  return mw;
+}
+
+// cache.ts
+import crypto8 from "node:crypto";
+var BINARY_PREFIXES = [
+  "image/",
+  "audio/",
+  "video/",
+  "application/octet-stream",
+  "application/pdf",
+  "application/zip",
+  "application/gzip",
+  "application/x-tar",
+  "application/vnd.ms-",
+  "application/vnd.openxmlformats-"
+];
+function isCacheableContentType(ct) {
+  return !BINARY_PREFIXES.some((p) => ct.startsWith(p));
+}
+function isCacheableStatus(status, allowed) {
+  return allowed.includes(status);
+}
+function defaultCacheKey(req) {
+  const hash = crypto8.createHash("sha256");
+  hash.update(req.method);
+  hash.update(req.url);
+  return hash.digest("hex");
+}
+var MAX_ENTRIES = 1e5;
+var MemoryCache = class {
+  store = /* @__PURE__ */ new Map();
+  tagIndex = /* @__PURE__ */ new Map();
+  interval;
+  constructor(cleanupMs = 6e4) {
+    this.interval = setInterval(() => this.cleanup(), cleanupMs);
+    if (this.interval.unref) this.interval.unref();
+  }
+  async get(key) {
+    const entry = this.store.get(key);
+    if (!entry) return null;
+    if (Date.now() > entry.expires) {
+      this.store.delete(key);
+      return null;
+    }
+    return entry.data;
+  }
+  async set(key, data, ttl) {
+    if (this.store.size >= MAX_ENTRIES) {
+      const oldest = this.store.keys().next();
+      if (!oldest.done) this.store.delete(oldest.value);
+    }
+    this.store.set(key, { data, expires: Date.now() + ttl });
+    for (const tag of data.tags) {
+      let set = this.tagIndex.get(tag);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        this.tagIndex.set(tag, set);
+      }
+      set.add(key);
+    }
+  }
+  async delete(key) {
+    this.store.delete(key);
+    for (const [, set] of this.tagIndex) {
+      set.delete(key);
+    }
+  }
+  async invalidate(tag) {
+    const keys = this.tagIndex.get(tag);
+    if (!keys) return;
+    for (const key of keys) {
+      this.store.delete(key);
+    }
+    this.tagIndex.delete(tag);
+  }
+  async flush() {
+    this.store.clear();
+    this.tagIndex.clear();
+  }
+  cleanup() {
+    const now = Date.now();
+    for (const [key, entry] of this.store) {
+      if (entry.expires < now) {
+        this.store.delete(key);
+        for (const [, set] of this.tagIndex) {
+          set.delete(key);
+        }
+      }
+    }
+  }
+  close() {
+    clearInterval(this.interval);
+    this.store.clear();
+    this.tagIndex.clear();
+  }
+  /** Testing only. */
+  get size() {
+    return this.store.size;
+  }
+};
+var RedisCache = class {
+  redis;
+  prefix;
+  tagPrefix;
+  constructor(redis2, prefix = "cache:") {
+    this.redis = redis2;
+    this.prefix = prefix;
+    this.tagPrefix = `${prefix}tag:`;
+  }
+  key(sid) {
+    return `${this.prefix}${sid}`;
+  }
+  tagKey(tag) {
+    return `${this.tagPrefix}${tag}`;
+  }
+  async get(key) {
+    const raw = await this.redis.get(this.key(key));
+    if (!raw) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      await this.redis.del(this.key(key));
+      return null;
+    }
+  }
+  async set(key, entry, ttl) {
+    const multi = this.redis.multi();
+    multi.psetex(this.key(key), ttl, JSON.stringify(entry));
+    const ttlSec = Math.ceil(ttl / 1e3);
+    for (const tag of entry.tags) {
+      multi.sadd(this.tagKey(tag), key);
+      multi.expire(this.tagKey(tag), ttlSec);
+    }
+    await multi.exec();
+  }
+  async delete(key) {
+    await this.redis.del(this.key(key));
+  }
+  async invalidate(tag) {
+    const key = this.tagKey(tag);
+    const members = await this.redis.smembers(key);
+    if (members.length > 0) {
+      await this.redis.del(key, ...members.map((m) => this.key(m)));
+    }
+  }
+  async flush() {
+    const keys = await this.redis.keys(`${this.prefix}*`);
+    if (keys.length > 0) await this.redis.del(...keys);
+  }
+};
+var DEFAULT_TTL = 3e5;
+var DEFAULT_MAX_BODY2 = 1024 * 1024;
+function shouldSkipCache(req) {
+  if (req.method !== "GET" && req.method !== "HEAD") return true;
+  if (req.headers.get("authorization")) return true;
+  if (req.headers.get("cookie")) return true;
+  return false;
+}
+function cache2(options) {
+  const ttl = options?.ttl ?? DEFAULT_TTL;
+  const cacheStatus = options?.cacheStatus ?? [200];
+  const maxBodySize = options?.maxBodySize ?? DEFAULT_MAX_BODY2;
+  const getKey = options?.key ?? defaultCacheKey;
+  const getTag = options?.tag;
+  const cacheCookies = options?.cacheCookies ?? false;
+  let store2;
+  let closeStore = null;
+  if (options?.store && typeof options.store.get === "function") {
+    store2 = options.store;
+  } else if (options?.store === "redis") {
+    if (!options.redis) throw new Error('cache: redis client required when store: "redis"');
+    store2 = new RedisCache(options.redis);
+  } else {
+    const mem = new MemoryCache();
+    store2 = mem;
+    closeStore = () => mem.close();
+  }
+  const mw = (async (req, ctx, next) => {
+    if (shouldSkipCache(req)) {
+      return next(req, ctx);
+    }
+    const cacheKey = getKey(req);
+    const cached = await store2.get(cacheKey);
+    if (cached) {
+      const age = Math.floor((Date.now() - cached.createdAt) / 1e3);
+      const headers2 = new Headers(cached.headers);
+      headers2.set("Age", String(age));
+      headers2.set("X-Cache", "HIT");
+      return new Response(cached.body, {
+        status: cached.status,
+        statusText: cached.statusText,
+        headers: headers2
+      });
+    }
+    const res = await next(req, ctx);
+    if (!isCacheableStatus(res.status, cacheStatus)) return res;
+    if (res.headers.get("set-cookie") && !cacheCookies) return res;
+    if (res.headers.get("cache-control")?.includes("no-store")) return res;
+    if (res.body && res.headers.get("content-type")?.includes("text/event-stream")) return res;
+    const ct = res.headers.get("content-type") ?? "";
+    if (!isCacheableContentType(ct)) return res;
+    const clone = res.clone();
+    const bodyText = await clone.text();
+    if (bodyText.length > maxBodySize) return res;
+    const tags = [];
+    if (getTag) {
+      const result = getTag(req, ctx);
+      if (result) {
+        if (Array.isArray(result)) tags.push(...result);
+        else tags.push(result);
+      }
+    }
+    const headers = {};
+    res.headers.forEach((value, key) => {
+      if (key.toLowerCase() === "set-cookie" && !cacheCookies) return;
+      headers[key] = value;
+    });
+    const entry = {
+      status: res.status,
+      statusText: res.statusText,
+      headers,
+      body: bodyText,
+      createdAt: Date.now(),
+      tags
+    };
+    await store2.set(cacheKey, entry, ttl);
+    return res;
+  });
+  mw.store = store2;
+  mw.invalidate = async (tag) => store2.invalidate(tag);
+  mw.flush = async () => store2.flush();
+  mw.close = () => {
+    closeStore?.();
+  };
+  return mw;
+}
+
+// webhook.ts
+import crypto9 from "node:crypto";
+function timingSafeEqual2(a, b) {
+  try {
+    return crypto9.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+  } catch {
+    return false;
+  }
+}
+function createStripeVerifier(config) {
+  return (body, headers) => {
+    const sigHeader = headers["stripe-signature"];
+    if (!sigHeader) return { valid: false, provider: "stripe", event: "", id: void 0 };
+    const parts = sigHeader.split(",").reduce((acc, p) => {
+      const [k, ...v] = p.split("=");
+      if (k) acc[k.trim()] = v.join("=").trim();
+      return acc;
+    }, {});
+    const timestamp = parts["t"];
+    const signature = parts["v1"];
+    if (!timestamp || !signature) return { valid: false, provider: "stripe", event: "", id: void 0 };
+    const signed = `${timestamp}.${body}`;
+    const expected = crypto9.createHmac("sha256", config.secret).update(signed).digest("hex");
+    const valid = timingSafeEqual2(signature, expected);
+    let event = "";
+    let id2;
+    try {
+      const parsed = JSON.parse(body);
+      event = parsed.type ?? "";
+      id2 = parsed.id;
+    } catch {
+    }
+    return { valid, provider: "stripe", event, id: id2 };
+  };
+}
+function createGitHubVerifier(config) {
+  return (body, headers) => {
+    const sig = headers["x-hub-signature-256"];
+    if (!sig) return { valid: false, provider: "github", event: "", id: void 0 };
+    const expected = `sha256=${crypto9.createHmac("sha256", config.secret).update(body).digest("hex")}`;
+    const valid = timingSafeEqual2(sig, expected);
+    let event = headers["x-github-event"] ?? "";
+    let id2;
+    try {
+      const parsed = JSON.parse(body);
+      id2 = headers["x-github-delivery"] || parsed.id;
+    } catch {
+    }
+    return { valid, provider: "github", event, id: id2 };
+  };
+}
+function createSlackVerifier(config) {
+  return (body, headers) => {
+    const signature = headers["x-slack-signature"];
+    const timestamp = headers["x-slack-request-timestamp"];
+    if (!signature || !timestamp) return { valid: false, provider: "slack", event: "", id: void 0 };
+    const now = Math.floor(Date.now() / 1e3);
+    const ts = parseInt(timestamp, 10);
+    if (isNaN(ts) || Math.abs(now - ts) > 300) {
+      return { valid: false, provider: "slack", event: "", id: void 0 };
+    }
+    const sigBase = `v0:${timestamp}:${body}`;
+    const expected = `v0=${crypto9.createHmac("sha256", config.secret).update(sigBase).digest("hex")}`;
+    const valid = timingSafeEqual2(signature, expected);
+    let event = "";
+    let id2;
+    try {
+      const parsed = JSON.parse(body);
+      event = parsed.event?.type ?? parsed.type ?? (parsed.challenge ? "url_verification" : "");
+      id2 = parsed.event_id || parsed.ssl?.event_id;
+    } catch {
+    }
+    return { valid, provider: "slack", event, id: id2 };
+  };
+}
+var IdempotencyStore = class {
+  store = /* @__PURE__ */ new Map();
+  ttl;
+  constructor(ttl) {
+    this.ttl = ttl;
+  }
+  /** Returns true if this event ID has already been processed. */
+  isDuplicate(id2) {
+    if (this.store.has(id2)) return true;
+    this.store.set(id2, Date.now());
+    return false;
+  }
+  /** Periodic cleanup */
+  cleanup() {
+    const now = Date.now();
+    for (const [key, ts] of this.store) {
+      if (now - ts > this.ttl) this.store.delete(key);
+    }
+  }
+};
+var EventBus = class {
+  handlers = /* @__PURE__ */ new Map();
+  on(event, handler) {
+    let set = this.handlers.get(event);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      this.handlers.set(event, set);
+    }
+    set.add(handler);
+  }
+  off(event, handler) {
+    const set = this.handlers.get(event);
+    if (!set) return;
+    set.delete(handler);
+    if (set.size === 0) this.handlers.delete(event);
+  }
+  async emit(event, payload, provider, id2, ctx) {
+    const we = { event, payload, provider, id: id2 };
+    const specific = this.handlers.get(event);
+    if (specific) {
+      for (const handler of specific) {
+        await handler(we, ctx);
+      }
+    }
+    const wildcard = this.handlers.get("*");
+    if (wildcard) {
+      for (const handler of wildcard) {
+        await handler(we, ctx);
+      }
+    }
+  }
+};
+function webhook(options) {
+  const replayProtection = options?.replayProtection ?? true;
+  const idempotencyTTL = options?.idempotencyTTL ?? 36e5;
+  const mountPath = options?.path ?? "/";
+  const verifiers = [];
+  if (options?.stripe) verifiers.push(createStripeVerifier(options.stripe));
+  if (options?.github) verifiers.push(createGitHubVerifier(options.github));
+  if (options?.slack) verifiers.push(createSlackVerifier(options.slack));
+  if (options?.custom) {
+    for (const c of options.custom) {
+      verifiers.push(async (body, headers) => {
+        const valid = await c.verify(body, headers);
+        let event = "";
+        try {
+          event = c.event(JSON.parse(body), headers);
+        } catch {
+        }
+        return { valid, provider: c.name, event, id: void 0 };
+      });
+    }
+  }
+  const bus = new EventBus();
+  const idempotency = new IdempotencyStore(idempotencyTTL);
+  const cleanupInterval = setInterval(() => idempotency.cleanup(), 6e4);
+  if (cleanupInterval.unref) cleanupInterval.unref();
+  const router = new Router();
+  const handler = async (req, ctx) => {
+    const body = await req.text();
+    if (!body) {
+      return new Response("Empty body", { status: 400 });
+    }
+    const headers = {};
+    req.headers.forEach((v, k) => {
+      headers[k] = v;
+    });
+    for (const verify of verifiers) {
+      const result = await verify(body, headers);
+      if (!result.valid) continue;
+      if (replayProtection && result.id) {
+        if (idempotency.isDuplicate(result.id)) {
+          return new Response("OK", { status: 200 });
+        }
+      }
+      let payload;
+      try {
+        payload = JSON.parse(body);
+      } catch {
+        return new Response("Invalid JSON body", { status: 400 });
+      }
+      if (result.provider === "slack" && payload?.challenge) {
+        return new Response(JSON.stringify({ challenge: payload.challenge }), {
+          headers: { "content-type": "application/json" }
+        });
+      }
+      try {
+        await bus.emit(result.event, payload, result.provider, result.id, ctx);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`[webhook] handler error for ${result.provider}.${result.event}: ${msg}`);
+        return new Response("Handler error", { status: 500 });
+      }
+      return new Response("OK", { status: 200 });
+    }
+    return new Response("Unauthorized", { status: 401 });
+  };
+  router.post(mountPath, handler);
+  const mod = router;
+  mod.on = (event, handler2) => {
+    bus.on(event, handler2);
+    return mod;
+  };
+  mod.off = (event, handler2) => {
+    bus.off(event, handler2);
+    return mod;
+  };
+  mod._cleanup = () => {
+    clearInterval(cleanupInterval);
+  };
+  return mod;
+}
+
+// fts.ts
+var fts_exports = {};
+__export(fts_exports, {
+  createIndex: () => createIndex,
+  dropIndex: () => dropIndex,
+  search: () => search,
+  suggest: () => suggest
+});
+function resolveTableName(table) {
+  const name = table.inner?.tableName ?? table.tableName;
+  if (!name || typeof name !== "string") {
+    throw new Error("fts: could not determine table name. Ensure you pass a pg.table() result.");
+  }
+  return name;
+}
+function escapeIdent(s) {
+  return `"${s.replace(/"/g, '""')}"`;
+}
+function sqlLit(s) {
+  return `'${s.replace(/'/g, "''")}'`;
+}
+async function createIndex(sql2, table, fields, options) {
+  const language = options?.language ?? "english";
+  const tableName = resolveTableName(table);
+  const indexName = options?.indexName ?? `${tableName}_fts_idx`;
+  const vectorExpr = fields.map((f) => `coalesce(${escapeIdent(f)}, '')`).join(` || ' ' || `);
+  const indexType = options?.indexType ?? "gin";
+  await sql2.unsafe(`
+    CREATE INDEX IF NOT EXISTS ${escapeIdent(indexName)}
+    ON ${escapeIdent(tableName)}
+    USING ${indexType}
+    (to_tsvector(${sqlLit(language)}, ${vectorExpr}))
+  `);
+}
+async function dropIndex(sql2, table, options) {
+  const tableName = resolveTableName(table);
+  const indexName = options?.indexName ?? `${tableName}_fts_idx`;
+  await sql2.unsafe(`DROP INDEX IF EXISTS ${escapeIdent(indexName)}`);
+}
+async function search(sql2, table, query, options) {
+  const tableName = resolveTableName(table);
+  const language = options?.language ?? "english";
+  const searchFields = options?.fields;
+  const limit = options?.limit ?? 20;
+  const offset = options?.offset ?? 0;
+  const rankCol = options?.rankColumn ?? "_rank";
+  if (!searchFields?.length) {
+    throw new Error("fts.search: `fields` option is required. Specify which columns to search.");
+  }
+  const sanitized = query.trim();
+  if (!sanitized) return [];
+  const vectorExpr = searchFields.map((f) => `coalesce(${escapeIdent(f)}, '')`).join(` || ' ' || `);
+  const langLit = sqlLit(language);
+  const queryLit = sqlLit(sanitized);
+  const rankColId = escapeIdent(rankCol);
+  const tableId = escapeIdent(tableName);
+  const headlineExpr = options?.headline ? searchFields.map(
+    (f) => `ts_headline(${langLit}, ${escapeIdent(f)}, websearch_to_tsquery(${langLit}, ${queryLit}), 'MaxWords=30,MinWords=15') as ${escapeIdent(f + "_headline")}`
+  ).join(",\n      ") : "";
+  const sql_query = `
+    SELECT
+      *,
+      ts_rank(
+        to_tsvector(${langLit}, ${vectorExpr}),
+        websearch_to_tsquery(${langLit}, ${queryLit})
+      ) as ${rankColId}
+      ${headlineExpr ? "," + headlineExpr : ""}
+    FROM ${tableId}
+    WHERE to_tsvector(${langLit}, ${vectorExpr}) @@ websearch_to_tsquery(${langLit}, ${queryLit})
+    ORDER BY ${rankColId} DESC
+    LIMIT ${limit} OFFSET ${offset}
+  `;
+  const rows = await sql2.unsafe(sql_query);
+  return rows.map((row) => {
+    const result = {
+      id: row.id,
+      rank: Number(row[rankCol]) || 0,
+      row
+    };
+    if (options?.headline && searchFields) {
+      const snippets = searchFields.map((f) => row[`${f}_headline`]).filter(Boolean);
+      result.headline = snippets.join(" ... ");
+    }
+    return result;
+  });
+}
+async function suggest(sql2, table, prefix, options) {
+  const tableName = resolveTableName(table);
+  const field = options?.field;
+  const language = options?.language ?? "english";
+  const limit = options?.limit ?? 10;
+  if (!field) throw new Error("fts.suggest: `field` option is required");
+  const sanitized = prefix.replace(/[^\w\s-]/g, " ").trim();
+  if (!sanitized) return [];
+  const rows = await sql2.unsafe(`
+    SELECT DISTINCT ts_lexize(${sqlLit(language)}, word) as tokens
+    FROM (
+      SELECT regexp_split_to_table(lower(${escapeIdent(field)}), E'\\W+') as word
+      FROM ${escapeIdent(tableName)}
+    ) words
+    WHERE word LIKE ${sqlLit(sanitized + "%")}
+    LIMIT ${limit}
+  `);
+  return rows.map((r) => r.tokens?.[0] ?? "").filter(Boolean);
+}
 export {
   DEFAULT_MAX_BODY,
   MIGRATIONS_TABLE,
+  MemoryCache,
+  MemoryStore,
+  RedisCache,
+  RedisStore,
   Router,
   TestApp,
   TestRequest,
@@ -9363,11 +10316,13 @@ export {
   aiStream,
   analytics,
   auth,
+  cache2 as cache,
   compress,
   cors,
   createHub,
   createOpenAI,
   createSSEStream,
+  createTestDb,
   createTestServer,
   createWorker,
   csrf,
@@ -9380,6 +10335,7 @@ export {
   embedMany,
   formatSSE,
   formatSSEData,
+  fts_exports as fts,
   generateObject,
   generateText2 as generateText,
   getCookies,
@@ -9410,6 +10366,7 @@ export {
   seoTags,
   serve,
   serveStatic,
+  session,
   setCookie,
   smoothStream,
   ssr,
@@ -9421,5 +10378,7 @@ export {
   traceElapsed,
   upload,
   user,
-  validate
+  validate,
+  webhook,
+  withTestDb
 };