weifuwu 0.22.2 → 0.22.3

package/dist/index.js

@@ -186,7 +186,14 @@ function serve(handler, options) {
       if (shuttingDown) return;
       shuttingDown = true;
       server.close();
-      process.exit(0);
+      const timer = setTimeout(() => {
+        server.closeAllConnections();
+        process.exit(0);
+      }, 1e4);
+      server.on("close", () => {
+        clearTimeout(timer);
+        process.exit(0);
+      });
     };
     shutdownHandler = shutdown;
     process.on("SIGTERM", shutdown);
@@ -232,7 +239,7 @@ function serve(handler, options) {
     console.log(`weifuwu listening on http://${displayHost}:${_cachedPort}`);
   });
   return {
-    stop: () => {
+    stop: (timeoutMs = 1e4) => {
       if (shutdownHandler) {
         process.off("SIGTERM", shutdownHandler);
         process.off("SIGINT", shutdownHandler);
@@ -243,9 +250,16 @@ function serve(handler, options) {
           resolve14();
           return;
         }
+        server.close();
         server.closeIdleConnections();
-        server.closeAllConnections();
-        server.close(() => resolve14());
+        const timer = setTimeout(() => {
+          server.closeAllConnections();
+          resolve14();
+        }, timeoutMs);
+        server.on("close", () => {
+          clearTimeout(timer);
+          resolve14();
+        });
       });
     },
     ready,
@@ -965,10 +979,30 @@ function cors(options) {
 
 // auth.ts
 function auth(options) {
-  if (!options.token && !options.verify && !options.proxy) {
-    throw new Error("auth() requires at least one of: token, verify, or proxy");
+  if (!options.token && !options.verify && !options.proxy && !options.session) {
+    throw new Error("auth() requires at least one of: token, verify, proxy, or session");
   }
   return async (req, ctx, next) => {
+    if (options.session) {
+      const sessionUserId = ctx.session?.userId;
+      if (sessionUserId !== void 0 && sessionUserId !== null) {
+        if (options.resolveUser) {
+          const userData = await options.resolveUser(sessionUserId);
+          if (userData) {
+            ctx.user = userData;
+            return next(req, ctx);
+          }
+          if (typeof ctx.session?.destroy === "function") {
+            ;
+            ctx.session.destroy();
+          }
+          console.warn(`[${currentTraceId()}] auth: session userId ${sessionUserId} resolved to null`);
+        } else {
+          ctx.user = { id: sessionUserId };
+          return next(req, ctx);
+        }
+      }
+    }
     const headerName = options.header ?? "Authorization";
     let from = "header";
     let header = req.headers.get(headerName);
@@ -1051,6 +1085,266 @@ function auth(options) {
   };
 }
 
+// oauth-client.ts
+import crypto2 from "node:crypto";
+import jwt from "jsonwebtoken";
+var BUILTIN_PROVIDERS = {
+  google: {
+    authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    userUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+    scope: "openid email profile",
+    parseUser: (data) => ({
+      id: data.id,
+      email: data.email,
+      name: data.name,
+      avatarUrl: data.picture
+    })
+  },
+  github: {
+    authUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    userUrl: "https://api.github.com/user",
+    scope: "read:user user:email",
+    parseUser: (data) => ({
+      id: String(data.id),
+      email: data.email ?? "",
+      name: data.name ?? data.login,
+      avatarUrl: data.avatar_url
+    })
+  }
+};
+function oauthClient(options) {
+  const {
+    pg,
+    jwtSecret,
+    providers,
+    redirectUrl = "/",
+    expiresIn = "24h"
+  } = options;
+  const providerTable = options.table ?? "_auth_providers";
+  const router = new Router();
+  async function saveOAuthState(ctx, state, provider) {
+    if (ctx.session) {
+      ctx.session.oauthState = { state, provider };
+    }
+  }
+  function verifyOAuthState(ctx, state, provider) {
+    const saved = ctx.session?.oauthState;
+    if (!saved) return false;
+    if (saved.state !== state || saved.provider !== provider) return false;
+    delete ctx.session.oauthState;
+    return true;
+  }
+  async function ensureTable() {
+    await pg.sql`
+      CREATE TABLE IF NOT EXISTS ${pg.sql(providerTable)} (
+        id SERIAL PRIMARY KEY,
+        user_id INTEGER NOT NULL REFERENCES "_users"(id) ON DELETE CASCADE,
+        provider TEXT NOT NULL,
+        provider_id TEXT NOT NULL,
+        email TEXT NOT NULL DEFAULT '',
+        name TEXT NOT NULL DEFAULT '',
+        avatar_url TEXT NOT NULL DEFAULT '',
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        UNIQUE(provider, provider_id)
+      )
+    `;
+    await pg.sql`
+      CREATE INDEX IF NOT EXISTS ${pg.sql(providerTable + "_user_idx")}
+      ON ${pg.sql(providerTable)}(user_id)
+    `;
+  }
+  async function findUserByProvider(provider, providerId) {
+    const [row] = await pg.sql`
+      SELECT * FROM ${pg.sql(providerTable)}
+      WHERE provider = ${provider} AND provider_id = ${providerId}
+      LIMIT 1
+    `;
+    return row ?? null;
+  }
+  async function findUserByEmail(email) {
+    const [row] = await pg.sql`
+      SELECT * FROM "_users" WHERE email = ${email} LIMIT 1
+    `;
+    return row ?? null;
+  }
+  async function createUser(email, name) {
+    const randomPassword = crypto2.randomBytes(32).toString("hex");
+    const [row] = await pg.sql`
+      INSERT INTO "_users" (email, password, name, role)
+      VALUES (${email}, ${randomPassword}, ${name}, 'user')
+      RETURNING *
+    `;
+    return row;
+  }
+  async function linkProvider(userId, provider, providerId, email, name, avatarUrl) {
+    await pg.sql`
+      INSERT INTO ${pg.sql(providerTable)} (user_id, provider, provider_id, email, name, avatar_url)
+      VALUES (${userId}, ${provider}, ${providerId}, ${email}, ${name}, ${avatarUrl})
+      ON CONFLICT (provider, provider_id) DO NOTHING
+    `;
+  }
+  async function findOrCreateUser(provider, providerId, email, name, avatarUrl) {
+    const link = await findUserByProvider(provider, providerId);
+    if (link) {
+      const [user2] = await pg.sql`SELECT * FROM "_users" WHERE id = ${link.user_id} LIMIT 1`;
+      return user2 ?? null;
+    }
+    if (email) {
+      const existingUser = await findUserByEmail(email);
+      if (existingUser) {
+        await linkProvider(existingUser.id, provider, providerId, email, name, avatarUrl);
+        return existingUser;
+      }
+    }
+    const newUser = await createUser(email || `${provider}_${providerId}@oauth.local`, name || provider);
+    await linkProvider(newUser.id, provider, providerId, email, name, avatarUrl);
+    return newUser;
+  }
+  function signToken(user2) {
+    return jwt.sign(
+      { sub: user2.id, email: user2.email, role: user2.role },
+      jwtSecret,
+      { expiresIn }
+    );
+  }
+  let tableReady = null;
+  function ensureInit() {
+    if (!tableReady) tableReady = ensureTable();
+    return tableReady;
+  }
+  function getProviderMeta(providerName) {
+    const config = providers[providerName];
+    if (!config) return null;
+    const builtin = BUILTIN_PROVIDERS[providerName];
+    const parseUser = config.parseUser ?? builtin?.parseUser;
+    if (!parseUser) return null;
+    const meta = {
+      authUrl: config.authUrl ?? builtin?.authUrl ?? "",
+      tokenUrl: config.tokenUrl ?? builtin?.tokenUrl ?? "",
+      userUrl: config.userUrl ?? builtin?.userUrl ?? "",
+      scope: config.scope ?? builtin?.scope ?? "openid",
+      parseUser
+    };
+    if (!meta.authUrl || !meta.tokenUrl || !meta.userUrl) return null;
+    return { config, meta };
+  }
+  router.get("/:provider", async (req, ctx) => {
+    await ensureInit();
+    const providerName = ctx.params.provider;
+    const resolved = getProviderMeta(providerName);
+    if (!resolved) {
+      return Response.json({ error: `Unsupported provider: ${providerName}` }, { status: 400 });
+    }
+    const { config, meta } = resolved;
+    const state = crypto2.randomUUID();
+    const redirectUri = new URL(req.url);
+    redirectUri.pathname = redirectUri.pathname.replace(/\/[^/]+$/, "/") + providerName + "/callback";
+    await saveOAuthState(ctx, state, providerName);
+    const scope = config.scope ?? meta.scope;
+    const params = new URLSearchParams({
+      client_id: config.clientId,
+      redirect_uri: redirectUri.origin + redirectUri.pathname,
+      response_type: "code",
+      scope,
+      state,
+      access_type: "offline",
+      prompt: "consent"
+    });
+    return Response.redirect(`${meta.authUrl}?${params.toString()}`, 302);
+  });
+  router.get("/:provider/callback", async (req, ctx) => {
+    await ensureInit();
+    const providerName = ctx.params.provider;
+    const resolved = getProviderMeta(providerName);
+    if (!resolved) {
+      return Response.json({ error: `Unsupported provider: ${providerName}` }, { status: 400 });
+    }
+    const { config, meta } = resolved;
+    const url = new URL(req.url);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    if (!code || !state) {
+      return Response.json({ error: "Missing code or state parameter" }, { status: 400 });
+    }
+    if (!verifyOAuthState(ctx, state, providerName)) {
+      return Response.json({ error: "Invalid state \u2014 possible CSRF attack" }, { status: 403 });
+    }
+    const redirectUri = url.origin + url.pathname.replace(/\/callback$/, "");
+    let tokenRes;
+    try {
+      tokenRes = await fetch(meta.tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "Accept": "application/json"
+        },
+        body: JSON.stringify({
+          code,
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          redirect_uri: redirectUri,
+          grant_type: "authorization_code"
+        })
+      });
+    } catch (err) {
+      console.error(`[oauth] token exchange network error for ${providerName}:`, err);
+      return Response.json({ error: "Failed to connect to OAuth provider" }, { status: 502 });
+    }
+    if (!tokenRes.ok) {
+      const errBody = await tokenRes.text();
+      console.error(`[oauth] token exchange failed for ${providerName}:`, errBody);
+      return Response.json({ error: "Failed to exchange authorization code" }, { status: 502 });
+    }
+    const tokenData = await tokenRes.json();
+    const accessToken = tokenData.access_token;
+    if (!accessToken) {
+      return Response.json({ error: "No access_token in response" }, { status: 502 });
+    }
+    let userRes;
+    try {
+      userRes = await fetch(meta.userUrl, {
+        headers: { Authorization: `Bearer ${accessToken}` }
+      });
+    } catch (err) {
+      console.error(`[oauth] user info network error for ${providerName}:`, err);
+      return Response.json({ error: "Failed to connect to OAuth provider" }, { status: 502 });
+    }
+    if (!userRes.ok) {
+      return Response.json({ error: "Failed to fetch user profile" }, { status: 502 });
+    }
+    const userData = await userRes.json();
+    const providerUser = meta.parseUser(userData, accessToken);
+    const user2 = await findOrCreateUser(
+      providerName,
+      providerUser.id,
+      providerUser.email,
+      providerUser.name,
+      providerUser.avatarUrl ?? ""
+    );
+    if (!user2) {
+      return Response.json({ error: "Failed to create/link user" }, { status: 500 });
+    }
+    const token = signToken(user2);
+    if (ctx.session) {
+      ctx.session.userId = user2.id;
+      ctx.session.role = user2.role;
+    }
+    const accept = req.headers.get("accept") ?? "";
+    if (accept.includes("application/json")) {
+      return Response.json({
+        token,
+        user: { id: user2.id, email: user2.email, name: user2.name, role: user2.role }
+      });
+    }
+    const finalUrl = new URL(redirectUrl, url.origin);
+    finalUrl.searchParams.set("token", token);
+    return Response.redirect(finalUrl.toString(), 302);
+  });
+  return router;
+}
+
 // static.ts
 import { open, realpath } from "node:fs/promises";
 import { extname, resolve as resolve2, normalize, sep } from "node:path";
@@ -1624,10 +1918,10 @@ function helmet(options) {
 }
 
 // request-id.ts
-import crypto2 from "node:crypto";
+import crypto3 from "node:crypto";
 function requestId(options) {
   const header = options?.header ?? "X-Request-ID";
-  const gen = options?.generator ?? (() => crypto2.randomUUID());
+  const gen = options?.generator ?? (() => crypto3.randomUUID());
   return async (req, ctx, next) => {
     const existing = req.headers.get(header);
     const id2 = existing ?? gen();
@@ -3002,12 +3296,12 @@ var PgModule = class {
 
 // user/client.ts
 import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
-import jwt2 from "jsonwebtoken";
+import jwt3 from "jsonwebtoken";
 import { z as z2 } from "zod";
 
 // user/oauth2.ts
-import crypto3 from "node:crypto";
-import jwt from "jsonwebtoken";
+import crypto4 from "node:crypto";
+import jwt2 from "jsonwebtoken";
 function createOAuth2Server(deps) {
   const { pg, users, jwtSecret, expiresIn } = deps;
   async function getClient(clientId) {
@@ -3025,8 +3319,8 @@ function createOAuth2Server(deps) {
     };
   }
   async function registerClient(data) {
-    const clientId = crypto3.randomUUID();
-    const clientSecret = crypto3.randomBytes(32).toString("hex");
+    const clientId = crypto4.randomUUID();
+    const clientSecret = crypto4.randomBytes(32).toString("hex");
     const [row] = await pg.sql`
       INSERT INTO "_oauth2_clients" ("name", "client_id", "client_secret", "redirect_uris")
       VALUES (${data.name}, ${clientId}, ${clientSecret}, ${pg.sql.array(data.redirectUris)})
@@ -3050,7 +3344,7 @@ function createOAuth2Server(deps) {
     const header = req.headers.get("Authorization");
     if (header?.startsWith("Bearer ")) {
       try {
-        const payload = jwt.verify(header.slice(7), jwtSecret);
+        const payload = jwt2.verify(header.slice(7), jwtSecret);
         return { id: payload.sub, email: payload.email, role: payload.role };
       } catch {
         return null;
@@ -3060,7 +3354,7 @@ function createOAuth2Server(deps) {
     const qsToken = url.searchParams.get("access_token");
     if (qsToken) {
       try {
-        const payload = jwt.verify(qsToken, jwtSecret);
+        const payload = jwt2.verify(qsToken, jwtSecret);
         return { id: payload.sub, email: payload.email, role: payload.role };
       } catch {
         return null;
@@ -3071,7 +3365,7 @@ function createOAuth2Server(deps) {
       const match = cookie.split(";").map((c) => c.trim()).find((c) => c.startsWith("session="));
       if (match) {
         try {
-          const payload = jwt.verify(match.slice(8), jwtSecret);
+          const payload = jwt2.verify(match.slice(8), jwtSecret);
           return { id: payload.sub, email: payload.email, role: payload.role };
         } catch {
           return null;
@@ -3174,7 +3468,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
       const loc2 = `${redirectUri}?error=access_denied${state ? `&state=${state}` : ""}`;
       return Response.redirect(loc2, 302);
     }
-    const code = crypto3.randomUUID();
+    const code = crypto4.randomUUID();
     const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
     await pg.sql`
       INSERT INTO "_oauth2_codes" ("code", "client_id", "user_id", "redirect_uri", "code_challenge", "code_challenge_method", "scope", "expires_at")
@@ -3239,7 +3533,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
       if (stored.code_challenge_method === "plain") {
         expected = codeVerifier;
       } else {
-        expected = crypto3.createHash("sha256").update(codeVerifier).digest().toString("base64url");
+        expected = crypto4.createHash("sha256").update(codeVerifier).digest().toString("base64url");
       }
       if (expected !== stored.code_challenge) {
         return Response.json({ error: "invalid_grant", error_description: "code_verifier mismatch" }, { status: 400 });
@@ -3251,12 +3545,12 @@ h2{color:#dc2626}.desc{color:#555}</style>
       return Response.json({ error: "invalid_grant" }, { status: 400 });
     }
     const scope = stored.scope || "";
-    const accessToken = jwt.sign(
+    const accessToken = jwt2.sign(
       { sub: user2.id, email: user2.email, role: user2.role, client_id: clientId, scope },
       jwtSecret,
       { expiresIn }
     );
-    const refreshToken = crypto3.randomUUID();
+    const refreshToken = crypto4.randomUUID();
     const refreshExpires = new Date(Date.now() + 30 * 24 * 60 * 60 * 1e3);
     await pg.sql`
       INSERT INTO "_oauth2_tokens" ("token", "client_id", "user_id", "scope", "expires_at")
@@ -3278,7 +3572,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
     if (!client || client.clientSecret !== clientSecret) {
       return Response.json({ error: "invalid_client" }, { status: 401 });
     }
-    const accessToken = jwt.sign(
+    const accessToken = jwt2.sign(
       { sub: clientId, client_id: clientId, scope, token_type: "client_credentials" },
       jwtSecret,
       { expiresIn }
@@ -3372,7 +3666,7 @@ function user(options) {
     await tokens.create();
   }
   function signToken(user2) {
-    return jwt2.sign(
+    return jwt3.sign(
       { sub: user2.id, email: user2.email, role: user2.role },
       secret,
       { expiresIn }
@@ -3423,7 +3717,7 @@ function user(options) {
   }
   async function verify(token) {
     try {
-      const payload = jwt2.verify(token, secret);
+      const payload = jwt3.verify(token, secret);
       if (payload.token_type === "client_credentials") return null;
       const row = await findById(payload.sub);
       if (!row) return null;
@@ -3542,7 +3836,7 @@ function redis(opts) {
 
 // queue/index.ts
 import { Redis as IORedis2 } from "ioredis";
-import crypto4 from "node:crypto";
+import crypto5 from "node:crypto";
 function cronNext(expr, from = /* @__PURE__ */ new Date()) {
   const parts = expr.trim().split(/\s+/);
   if (parts.length !== 5) throw new Error(`Invalid cron expression "${expr}": expected 5 fields`);
@@ -3637,7 +3931,7 @@ function queue(opts) {
     if (job.schedule) {
       try {
         const nextRun = cronNext(job.schedule);
-        const nextJob = { ...job, id: crypto4.randomUUID(), runAt: nextRun, createdAt: Date.now() };
+        const nextJob = { ...job, id: crypto5.randomUUID(), runAt: nextRun, createdAt: Date.now() };
         await redis2.zadd(jobKey, nextRun, JSON.stringify(nextJob));
       } catch (e) {
         console.error("[queue] cron re-queue failed:", e.message);
@@ -3677,7 +3971,7 @@ function queue(opts) {
     }
   }
   mw.add = function add(type, payload, opts2) {
-    const id2 = crypto4.randomUUID();
+    const id2 = crypto5.randomUUID();
     let runAt;
     if (opts2?.schedule) {
       runAt = cronNext(opts2.schedule);
@@ -5635,7 +5929,7 @@ function createGateway(config, getPort) {
 }
 
 // deploy/manager.ts
-import crypto5 from "node:crypto";
+import crypto6 from "node:crypto";
 
 // deploy/process.ts
 import { fork } from "node:child_process";
@@ -5694,7 +5988,7 @@ function createManager(config, apps, manager) {
     const token = header.replace("Bearer ", "");
     const tokenBuf = Buffer.from(token);
     const secretBuf = Buffer.from(config.deployToken);
-    if (tokenBuf.length !== secretBuf.length || !crypto5.timingSafeEqual(tokenBuf, secretBuf)) {
+    if (tokenBuf.length !== secretBuf.length || !crypto6.timingSafeEqual(tokenBuf, secretBuf)) {
       return Response.json({ error: "Unauthorized" }, { status: 401 });
     }
     return next(req, ctx);
@@ -8620,7 +8914,7 @@ function logdb(options) {
 }
 
 // iii/client.ts
-import crypto6 from "node:crypto";
+import crypto7 from "node:crypto";
 
 // iii/stream.ts
 function notify(channels, stream, group, item, event, data) {
@@ -9149,7 +9443,7 @@ function iii(opts = {}) {
   registerBuiltin("stream::send", (p) => stream.send(p.stream_name, p.group_id, p.type, p.data, p.id));
   registerBuiltin("stream::update", (p) => stream.update(p.stream_name, p.group_id, p.item_id, p.ops));
   function addLocalWorker(worker) {
-    const workerId = crypto6.randomUUID();
+    const workerId = crypto7.randomUUID();
     const reg = {
       id: workerId,
       name: worker.name,
@@ -9164,7 +9458,7 @@ function iii(opts = {}) {
       const triggerIds = [];
       for (const t of worker.getTriggers()) {
         if (t.input.function_id === fn.id) {
-          const tid = crypto6.randomUUID();
+          const tid = crypto7.randomUUID();
           triggers.set(tid, {
             id: tid,
             type: t.input.type,
@@ -9193,7 +9487,7 @@ function iii(opts = {}) {
     if (!worker) return;
     const handler = async (payload) => {
       if (!worker.ws) throw new Error(`Worker "${worker.name}" disconnected`);
-      const invocationId = crypto6.randomUUID();
+      const invocationId = crypto7.randomUUID();
       return new Promise((resolve14, reject) => {
         const timer = setTimeout(() => {
           pending.delete(invocationId);
@@ -9228,7 +9522,7 @@ function iii(opts = {}) {
   let engineRef = null;
   const wsHandler = createWsHandler({
     registerRemoteWorker(ws, name) {
-      const id2 = crypto6.randomUUID();
+      const id2 = crypto7.randomUUID();
       workers.set(id2, { id: id2, name, ws, functions: [], triggers: [] });
       return id2;
     },
@@ -9239,7 +9533,7 @@ function iii(opts = {}) {
       addRemoteFunction(workerId, id2);
     },
     registerRemoteTrigger(workerId, input) {
-      const tid = crypto6.randomUUID();
+      const tid = crypto7.randomUUID();
       const reg = { id: tid, ...input, workerId };
       triggers.set(tid, reg);
       const worker = workers.get(workerId);
@@ -9589,7 +9883,7 @@ function registerWorker(url) {
 }
 
 // session.ts
-import crypto7 from "node:crypto";
+import crypto8 from "node:crypto";
 var kSaved = /* @__PURE__ */ Symbol("session.saved");
 var kDestroyed = /* @__PURE__ */ Symbol("session.destroyed");
 var kId = /* @__PURE__ */ Symbol("session.id");
@@ -9665,13 +9959,33 @@ var RedisStore = class {
     await this.redis.del(this.key(sid));
   }
 };
-function createSessionObject(data, sid, store2, ttl) {
+var COOKIE_SEPARATOR = ".";
+function signSessionId(sid, secret) {
+  const hmac = crypto8.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
+  return sid + COOKIE_SEPARATOR + hmac;
+}
+function unsignSessionId(value, secret) {
+  const dot = value.lastIndexOf(COOKIE_SEPARATOR);
+  if (dot === -1) return null;
+  const sid = value.slice(0, dot);
+  const sig = value.slice(dot + 1);
+  const expected = crypto8.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
+  if (sig.length !== expected.length) return null;
+  try {
+    return crypto8.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) ? sid : null;
+  } catch {
+    return null;
+  }
+}
+var kCreatedAt = "__createdAt";
+function createSessionObject(data, sid, store2, ttl, createdAt) {
   const obj = data ?? {};
   obj[kSaved] = false;
   obj[kDestroyed] = false;
   obj[kId] = sid;
   obj[kStore] = store2;
   obj[kTtl] = ttl;
+  if (createdAt) obj[kCreatedAt] = createdAt;
   obj.save = () => {
     obj[kSaved] = true;
   };
@@ -9701,6 +10015,8 @@ function isSessionActive(session2) {
 function session(options) {
   const ttl = options?.ttl ?? 24 * 60 * 60 * 1e3;
   const cookieName = options?.cookieName ?? "__session";
+  const secret = options?.secret;
+  const rotateInterval = options?.rotateInterval ?? 9e5;
   const cookieOpts = {
     path: options?.cookie?.path ?? "/",
     domain: options?.cookie?.domain,
@@ -9720,21 +10036,35 @@ function session(options) {
     store2 = mem;
     closeStore = () => mem.close();
   }
+  function writeCookie(res, sid) {
+    const value = secret ? signSessionId(sid, secret) : sid;
+    return setCookie(res, cookieName, value, cookieOpts);
+  }
   const mw = (async (req, ctx, next) => {
     const cookies = getCookies(req);
-    const sid = cookies[cookieName];
+    const rawSid = cookies[cookieName];
+    let sid;
+    if (rawSid) {
+      sid = secret ? unsignSessionId(rawSid, secret) : rawSid;
+    }
     let session2;
     let loadedSid = sid ?? null;
+    let needsRotation = false;
     if (sid) {
       const data = await store2.get(sid);
       if (data) {
-        session2 = createSessionObject(data, sid, store2, ttl);
+        const createdAt = data[kCreatedAt] ?? Date.now();
+        session2 = createSessionObject(data, sid, store2, ttl, createdAt);
+        if (rotateInterval > 0 && Date.now() - createdAt > rotateInterval) {
+          needsRotation = true;
+        }
       } else {
         loadedSid = null;
-        session2 = createSessionObject({}, crypto7.randomUUID(), store2, ttl);
+        session2 = createSessionObject({}, crypto8.randomUUID(), store2, ttl, Date.now());
       }
     } else {
-      session2 = createSessionObject({}, crypto7.randomUUID(), store2, ttl);
+      loadedSid = null;
+      session2 = createSessionObject({}, crypto8.randomUUID(), store2, ttl, Date.now());
     }
     const snapshot = isSessionActive(session2) ? JSON.stringify(session2) : null;
     ctx.session = session2;
@@ -9747,14 +10077,22 @@ function session(options) {
       }
       return deleteCookie(res, cookieName, cookieOpts);
     }
+    if (needsRotation && loadedSid) {
+      const newId = crypto8.randomUUID();
+      const data = JSON.parse(JSON.stringify(currentSession));
+      data[kCreatedAt] = Date.now();
+      await store2.set(newId, data, ttl);
+      await store2.destroy(loadedSid);
+      loadedSid = newId;
+      currentSession[kId] = newId;
+      currentSession[kCreatedAt] = data[kCreatedAt];
+    }
     const currentData = isSessionActive(currentSession) ? JSON.stringify(currentSession) : null;
     const wasSaved = currentSession[kSaved];
-    const changed = wasSaved || currentData !== snapshot;
+    const changed = wasSaved || needsRotation || currentData !== snapshot;
     if (!changed) {
-      if (loadedSid) {
-        if (store2 instanceof RedisStore) {
-          await store2.set(loadedSid, JSON.parse(currentData ?? "{}"), ttl);
-        }
+      if (loadedSid && store2 instanceof RedisStore) {
+        await store2.set(loadedSid, JSON.parse(currentData ?? "{}"), ttl);
       }
       return res;
     }
@@ -9763,8 +10101,10 @@ function session(options) {
       const data = JSON.parse(currentData);
       await store2.set(targetSid, data, ttl);
       if (!loadedSid) {
-        const cookieRes = setCookie(res, cookieName, targetSid, cookieOpts);
-        return cookieRes;
+        return writeCookie(res, targetSid);
+      }
+      if (needsRotation) {
+        return writeCookie(res, targetSid);
       }
     } else if (loadedSid) {
       await store2.destroy(loadedSid);
@@ -9780,7 +10120,7 @@ function session(options) {
 }
 
 // cache.ts
-import crypto8 from "node:crypto";
+import crypto9 from "node:crypto";
 var BINARY_PREFIXES = [
   "image/",
   "audio/",
@@ -9800,7 +10140,7 @@ function isCacheableStatus(status, allowed) {
   return allowed.includes(status);
 }
 function defaultCacheKey(req) {
-  const hash = crypto8.createHash("sha256");
+  const hash = crypto9.createHash("sha256");
   hash.update(req.method);
   hash.update(req.url);
   return hash.digest("hex");
@@ -10015,10 +10355,10 @@ function cache2(options) {
 }
 
 // webhook.ts
-import crypto9 from "node:crypto";
+import crypto10 from "node:crypto";
 function timingSafeEqual2(a, b) {
   try {
-    return crypto9.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    return crypto10.timingSafeEqual(Buffer.from(a), Buffer.from(b));
   } catch {
     return false;
   }
@@ -10036,7 +10376,7 @@ function createStripeVerifier(config) {
     const signature = parts["v1"];
     if (!timestamp || !signature) return { valid: false, provider: "stripe", event: "", id: void 0 };
     const signed = `${timestamp}.${body}`;
-    const expected = crypto9.createHmac("sha256", config.secret).update(signed).digest("hex");
+    const expected = crypto10.createHmac("sha256", config.secret).update(signed).digest("hex");
     const valid = timingSafeEqual2(signature, expected);
     let event = "";
     let id2;
@@ -10053,7 +10393,7 @@ function createGitHubVerifier(config) {
   return (body, headers) => {
     const sig = headers["x-hub-signature-256"];
     if (!sig) return { valid: false, provider: "github", event: "", id: void 0 };
-    const expected = `sha256=${crypto9.createHmac("sha256", config.secret).update(body).digest("hex")}`;
+    const expected = `sha256=${crypto10.createHmac("sha256", config.secret).update(body).digest("hex")}`;
     const valid = timingSafeEqual2(sig, expected);
     let event = headers["x-github-event"] ?? "";
     let id2;
@@ -10076,7 +10416,7 @@ function createSlackVerifier(config) {
       return { valid: false, provider: "slack", event: "", id: void 0 };
     }
     const sigBase = `v0:${timestamp}:${body}`;
-    const expected = `v0=${crypto9.createHmac("sha256", config.secret).update(sigBase).digest("hex")}`;
+    const expected = `v0=${crypto10.createHmac("sha256", config.secret).update(sigBase).digest("hex")}`;
     const valid = timingSafeEqual2(signature, expected);
     let event = "";
     let id2;
@@ -10327,6 +10667,250 @@ async function suggest(sql2, table, prefix, options) {
   `);
   return rows.map((r) => r.tokens?.[0] ?? "").filter(Boolean);
 }
+
+// s3.ts
+import {
+  S3Client,
+  PutObjectCommand,
+  GetObjectCommand,
+  DeleteObjectCommand,
+  HeadObjectCommand,
+  ListObjectsV2Command
+} from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+function s3(options) {
+  const { bucket, publicUrl } = options;
+  const client = new S3Client({
+    region: options.region ?? "us-east-1",
+    endpoint: options.endpoint,
+    forcePathStyle: options.forcePathStyle,
+    credentials: options.credentials
+  });
+  async function put(key, body, putOpts) {
+    const command = new PutObjectCommand({
+      Bucket: bucket,
+      Key: key,
+      Body: body,
+      ContentType: putOpts?.contentType,
+      CacheControl: putOpts?.cacheControl ?? "public, max-age=31536000",
+      Metadata: putOpts?.metadata
+    });
+    await client.send(command);
+    return key;
+  }
+  async function get(key) {
+    try {
+      const command = new GetObjectCommand({ Bucket: bucket, Key: key });
+      const response = await client.send(command);
+      const body = response.Body;
+      if (!body) return null;
+      return Buffer.from(await body.transformToByteArray());
+    } catch (err) {
+      if (err.name === "NoSuchKey") return null;
+      throw err;
+    }
+  }
+  async function del(key) {
+    const command = new DeleteObjectCommand({ Bucket: bucket, Key: key });
+    await client.send(command);
+  }
+  async function exists(key) {
+    try {
+      const command = new HeadObjectCommand({ Bucket: bucket, Key: key });
+      await client.send(command);
+      return true;
+    } catch (err) {
+      if (err.name === "NotFound" || err.name === "NoSuchKey") return false;
+      throw err;
+    }
+  }
+  async function url(key, urlOpts) {
+    const expiresIn = urlOpts?.expiresIn ?? 3600;
+    if (expiresIn === 0) {
+      if (!publicUrl) {
+        throw new Error(
+          "s3.url() with expiresIn=0 requires publicUrl in S3Options. Set publicUrl to enable unsigned public URLs."
+        );
+      }
+      const base = publicUrl.replace(/\/+$/, "");
+      const objectKey = key.startsWith("/") ? key.slice(1) : key;
+      return `${base}/${objectKey}`;
+    }
+    const command = new GetObjectCommand({ Bucket: bucket, Key: key });
+    return getSignedUrl(client, command, { expiresIn });
+  }
+  async function list(prefix) {
+    const keys = [];
+    let continuationToken;
+    do {
+      const command = new ListObjectsV2Command({
+        Bucket: bucket,
+        Prefix: prefix,
+        ContinuationToken: continuationToken
+      });
+      const response = await client.send(command);
+      if (response.Contents) {
+        for (const obj of response.Contents) {
+          if (obj.Key) keys.push(obj.Key);
+        }
+      }
+      continuationToken = response.NextContinuationToken;
+    } while (continuationToken);
+    return keys;
+  }
+  const mod = {
+    put,
+    get,
+    delete: del,
+    exists,
+    url,
+    list,
+    client
+  };
+  const mw = ((req, ctx, next) => {
+    ;
+    ctx.s3 = mod;
+    return next(req, ctx);
+  });
+  mw.put = put;
+  mw.get = get;
+  mw.delete = del;
+  mw.exists = exists;
+  mw.url = url;
+  mw.list = list;
+  mw.client = client;
+  return mw;
+}
+
+// kb.ts
+function chunkContent2(content, chunkSize, overlap) {
+  const paragraphs = content.split(/\n\n+/);
+  const chunks = [];
+  let current = "";
+  for (const p of paragraphs) {
+    if (current.length + p.length > chunkSize && current.length > 0) {
+      chunks.push(current);
+      current = current.slice(-overlap);
+    }
+    current += (current ? "\n\n" : "") + p;
+  }
+  if (current) chunks.push(current);
+  return chunks;
+}
+function escapeIdent2(s) {
+  return `"${s.replace(/"/g, '""')}"`;
+}
+function knowledgeBase(options) {
+  const {
+    sql: sql2,
+    embedding: embedFn,
+    dimensions = 1536,
+    table = "_kb_docs",
+    chunkSize = 512,
+    chunkOverlap = 64,
+    searchLimit = 5,
+    searchThreshold = 0
+  } = options;
+  async function migrate() {
+    await sql2.unsafe(`CREATE EXTENSION IF NOT EXISTS "vector"`);
+    await sql2.unsafe(`
+      CREATE TABLE IF NOT EXISTS ${escapeIdent2(table)} (
+        id SERIAL PRIMARY KEY,
+        doc_key TEXT NOT NULL,
+        title TEXT NOT NULL DEFAULT '',
+        content TEXT NOT NULL,
+        chunk_index INTEGER NOT NULL DEFAULT 0,
+        metadata JSONB NOT NULL DEFAULT '{}',
+        embedding vector(${dimensions}),
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+    await sql2.unsafe(`
+      CREATE INDEX IF NOT EXISTS ${escapeIdent2(table + "_key_idx")}
+      ON ${escapeIdent2(table)}(doc_key)
+    `);
+    await sql2.unsafe(`
+      CREATE INDEX IF NOT EXISTS ${escapeIdent2(table + "_embedding_idx")}
+      ON ${escapeIdent2(table)}
+      USING hnsw (embedding vector_cosine_ops)
+    `);
+  }
+  async function ingest(key, content, ingestOpts) {
+    await sql2.unsafe(`DELETE FROM ${escapeIdent2(table)} WHERE doc_key = $1`, [key]);
+    const title = ingestOpts?.title ?? key;
+    const meta = ingestOpts?.metadata ?? {};
+    const cs = ingestOpts?.chunkSize ?? chunkSize;
+    const co = ingestOpts?.chunkOverlap ?? chunkOverlap;
+    const chunks = chunkContent2(content, cs, co);
+    const metaJson = JSON.stringify(meta);
+    for (let i = 0; i < chunks.length; i++) {
+      const chunk = chunks[i];
+      const embedding = await embedFn(chunk);
+      const vec = `[${embedding.join(",")}]`;
+      await sql2.unsafe(
+        `INSERT INTO ${escapeIdent2(table)} (doc_key, title, content, chunk_index, metadata, embedding)
+         VALUES ($1, $2, $3, $4, $5::jsonb, $6::vector)`,
+        [key, title, chunk, i, metaJson, vec]
+      );
+    }
+    return chunks.length;
+  }
+  async function search2(query, searchOpts) {
+    const limit = searchOpts?.limit ?? searchLimit;
+    const threshold = searchOpts?.threshold ?? searchThreshold;
+    const embedding = await embedFn(query);
+    const vec = `[${embedding.join(",")}]`;
+    const whereClause = threshold > 0 ? `WHERE (1 - (embedding <=> $1::vector) / 2) >= ${threshold}` : "";
+    const rows = await sql2.unsafe(
+      `SELECT id, doc_key, title, content, chunk_index, metadata,
+              1 - (embedding <=> $1::vector) / 2 AS _score
+       FROM ${escapeIdent2(table)}
+       ${whereClause}
+       ORDER BY embedding <=> $1::vector
+       LIMIT ${limit}`,
+      [vec]
+    );
+    return rows.map((r) => ({
+      id: r.id,
+      key: r.doc_key,
+      title: r.title,
+      content: r.content,
+      score: r._score,
+      metadata: typeof r.metadata === "string" ? JSON.parse(r.metadata) : r.metadata ?? {}
+    }));
+  }
+  async function del(key) {
+    await sql2.unsafe(`DELETE FROM ${escapeIdent2(table)} WHERE doc_key = $1`, [key]);
+  }
+  async function list() {
+    const rows = await sql2.unsafe(`
+      SELECT doc_key, title, COUNT(*) AS chunks
+      FROM ${escapeIdent2(table)}
+      GROUP BY doc_key, title
+      ORDER BY doc_key
+    `);
+    return rows.map((r) => ({
+      key: r.doc_key,
+      title: r.title,
+      chunks: Number(r.chunks)
+    }));
+  }
+  function mw() {
+    return (req, ctx, next) => {
+      ;
+      ctx.kb = { search: search2 };
+      return next(req, ctx);
+    };
+  }
+  return {
+    ingest,
+    search: search2,
+    delete: del,
+    list,
+    migrate,
+    middleware: mw
+  };
+}
 export {
   DEFAULT_MAX_BODY,
   MIGRATIONS_TABLE,
@@ -10371,11 +10955,13 @@ export {
   iii,
   isDev,
   isProd,
+  knowledgeBase,
   loadEnv,
   logdb,
   logger,
   mailer,
   messager,
+  oauthClient,
   openai,
   opencode,
   postgres,
@@ -10387,6 +10973,7 @@ export {
   requestId,
   runWithTrace,
   runWorkflow,
+  s3,
   seo,
   seoMiddleware,
   seoTags,