weifuwu 0.22.2 → 0.23.0

package/dist/index.js

@@ -186,7 +186,14 @@ function serve(handler, options) {
       if (shuttingDown) return;
       shuttingDown = true;
       server.close();
-      process.exit(0);
+      const timer = setTimeout(() => {
+        server.closeAllConnections();
+        process.exit(0);
+      }, 1e4);
+      server.on("close", () => {
+        clearTimeout(timer);
+        process.exit(0);
+      });
     };
     shutdownHandler = shutdown;
     process.on("SIGTERM", shutdown);
@@ -232,7 +239,7 @@ function serve(handler, options) {
     console.log(`weifuwu listening on http://${displayHost}:${_cachedPort}`);
   });
   return {
-    stop: () => {
+    stop: (timeoutMs = 1e4) => {
       if (shutdownHandler) {
         process.off("SIGTERM", shutdownHandler);
         process.off("SIGINT", shutdownHandler);
@@ -243,9 +250,16 @@ function serve(handler, options) {
           resolve14();
           return;
         }
+        server.close();
         server.closeIdleConnections();
-        server.closeAllConnections();
-        server.close(() => resolve14());
+        const timer = setTimeout(() => {
+          server.closeAllConnections();
+          resolve14();
+        }, timeoutMs);
+        server.on("close", () => {
+          clearTimeout(timer);
+          resolve14();
+        });
       });
     },
     ready,
@@ -837,7 +851,7 @@ function sendHttpResponseOnSocket(socket, response) {
 
 // tsx-context.ts
 import { useSyncExternalStore, createContext } from "react";
-var DEFAULT_CTX = { params: {}, query: {}, parsed: {}, prefs: {}, loaderData: {}, env: {}, user: {} };
+var DEFAULT_CTX = { params: {}, query: {}, parsed: {}, loaderData: {}, env: {}, user: {} };
 var KEY = "__WEIFUWU_CTX_STORE";
 function getStore() {
   if (typeof globalThis !== "undefined" && globalThis[KEY]) {
@@ -845,8 +859,9 @@ function getStore() {
   }
   const s = {
     _ctx: DEFAULT_CTX,
-    _snapshot: { params: DEFAULT_CTX.params, query: DEFAULT_CTX.query, user: DEFAULT_CTX.user, parsed: DEFAULT_CTX.parsed, prefs: DEFAULT_CTX.prefs, env: DEFAULT_CTX.env },
+    _snapshot: { params: DEFAULT_CTX.params, query: DEFAULT_CTX.query, user: DEFAULT_CTX.user, parsed: DEFAULT_CTX.parsed, theme: DEFAULT_CTX.theme, i18n: DEFAULT_CTX.i18n, loaderData: DEFAULT_CTX.loaderData, env: DEFAULT_CTX.env },
     _listeners: /* @__PURE__ */ new Set(),
+    _rebuilders: [],
     _alsGetStore: null
   };
   if (typeof globalThis !== "undefined") {
@@ -859,8 +874,18 @@ function __registerAls(getStore2) {
   store._alsGetStore = getStore2;
 }
 function setCtx(value) {
+  if (typeof window !== "undefined") {
+    for (const r of store._rebuilders) {
+      const rebuilt = r(value);
+      if (rebuilt) Object.assign(value, rebuilt);
+    }
+  }
   store._ctx = { ...store._ctx, ...value };
-  store._snapshot = { params: store._ctx.params, query: store._ctx.query, user: store._ctx.user, parsed: store._ctx.parsed, prefs: store._ctx.prefs, env: store._ctx.env };
+  store._snapshot = { params: store._ctx.params, query: store._ctx.query, user: store._ctx.user, parsed: store._ctx.parsed, theme: store._ctx.theme, i18n: store._ctx.i18n, loaderData: store._ctx.loaderData, env: store._ctx.env };
+  if (typeof window !== "undefined") {
+    ;
+    window.__WEIFUWU_CTX = { ...window.__WEIFUWU_CTX, ...value };
+  }
   store._listeners.forEach((fn) => fn());
 }
 var TsxContext = createContext(DEFAULT_CTX);
@@ -965,10 +990,30 @@ function cors(options) {
 
 // auth.ts
 function auth(options) {
-  if (!options.token && !options.verify && !options.proxy) {
-    throw new Error("auth() requires at least one of: token, verify, or proxy");
+  if (!options.token && !options.verify && !options.proxy && !options.session) {
+    throw new Error("auth() requires at least one of: token, verify, proxy, or session");
   }
   return async (req, ctx, next) => {
+    if (options.session) {
+      const sessionUserId = ctx.session?.userId;
+      if (sessionUserId !== void 0 && sessionUserId !== null) {
+        if (options.resolveUser) {
+          const userData = await options.resolveUser(sessionUserId);
+          if (userData) {
+            ctx.user = userData;
+            return next(req, ctx);
+          }
+          if (typeof ctx.session?.destroy === "function") {
+            ;
+            ctx.session.destroy();
+          }
+          console.warn(`[${currentTraceId()}] auth: session userId ${sessionUserId} resolved to null`);
+        } else {
+          ctx.user = { id: sessionUserId };
+          return next(req, ctx);
+        }
+      }
+    }
     const headerName = options.header ?? "Authorization";
     let from = "header";
     let header = req.headers.get(headerName);
@@ -2093,18 +2138,21 @@ async function getStreamObject() {
   if (!_ai.streamObject) _ai.streamObject = (await import("ai")).streamObject;
   return _ai.streamObject;
 }
-async function aiStream(handler) {
+async function aiStream(handler, provider) {
   const r = new Router();
   r.post("/", async (req, ctx) => {
     const options = await handler(req, ctx);
+    if (provider && !options.model) {
+      options.model = provider.model();
+    }
     if (options.schema) {
       const streamObject2 = await getStreamObject();
       const { schema, ...params } = options;
       const result2 = streamObject2({ ...params, schema, output: "object" });
       return result2.toTextStreamResponse();
     }
-    const streamText4 = await getStreamText();
-    const result = streamText4(options);
+    const streamText3 = await getStreamText();
+    const result = streamText3(options);
     return result.toTextStreamResponse();
   });
   return r;
@@ -2316,22 +2364,21 @@ function runWorkflow(opts = {}) {
       let nodes;
       if (input.nodes && input.nodes.length > 0) {
         nodes = input.nodes;
-      } else if (opts.model) {
+      } else {
+        if (!opts.provider && !opts.model) throw new Error('Provide either "nodes", a "model", or a "provider" with a model to generate the workflow from "goal"');
         const toolsDesc = Object.entries(opts.tools ?? {}).map(([k, t]) => `- ${k}: ${t.description}`).join("\n");
-        const result = await generateText({
-          model: opts.model,
-          system: [
-            "You are a workflow generator. Given a user goal and available tools, output a workflow JSON.",
-            "",
-            "Available tools:",
-            toolsDesc,
-            "",
-            "Node types: eval (expression), set (variable), get (variable), if (condition), while (loop), call (tool), http (request).",
-            "Reference syntax: $var.name, $nodes.id.output, $nodes.id.output.field, $input.field",
-            "Output ONLY valid JSON. No explanation, no markdown."
-          ].filter(Boolean).join("\n"),
-          messages: [{ role: "user", content: input.goal }]
-        });
+        const system = [
+          "You are a workflow generator. Given a user goal and available tools, output a workflow JSON.",
+          "",
+          "Available tools:",
+          toolsDesc,
+          "",
+          "Node types: eval (expression), set (variable), get (variable), if (condition), while (loop), call (tool), http (request).",
+          "Reference syntax: $var.name, $nodes.id.output, $nodes.id.output.field, $input.field",
+          "Output ONLY valid JSON. No explanation, no markdown."
+        ].filter(Boolean).join("\n");
+        const genParams = { system, messages: [{ role: "user", content: input.goal }] };
+        const result = opts.provider ? await opts.provider.generateText(genParams) : await generateText({ ...genParams, model: opts.model });
         const text2 = result.text.trim();
         const jsonStart = text2.indexOf("{");
         const jsonEnd = text2.lastIndexOf("}");
@@ -2339,8 +2386,6 @@ function runWorkflow(opts = {}) {
         const parsed = JSON.parse(text2.slice(jsonStart, jsonEnd + 1));
         nodes = parsed.nodes ?? parsed.workflow?.nodes ?? [];
         if (!Array.isArray(nodes)) throw new Error("Generated workflow has no nodes array");
-      } else {
-        throw new Error('Provide either "nodes" or a "model" to generate the workflow from "goal"');
       }
       const ctx = {
         variables: /* @__PURE__ */ new Map(),
@@ -2360,6 +2405,54 @@ function runWorkflow(opts = {}) {
   });
 }
 
+// ai/provider.ts
+import { createOpenAI } from "@ai-sdk/openai";
+import {
+  embed as aiEmbed,
+  embedMany as aiEmbedMany,
+  generateText as aiGenerateText,
+  streamText as aiStreamText
+} from "ai";
+function aiProvider(options) {
+  const baseURL = options?.baseURL ?? process.env.OPENAI_BASE_URL ?? "http://localhost:11434/v1";
+  const apiKey = options?.apiKey ?? process.env.OPENAI_API_KEY ?? "ollama";
+  const modelName = options?.model ?? process.env.OPENAI_MODEL ?? "qwen3:0.6b";
+  const embedModelName = options?.embeddingModel ?? process.env.OPENAI_EMBEDDING_MODEL ?? "qwen3-embedding:0.6b";
+  const dimension = options?.embeddingDimension ?? parseInt(process.env.EMBEDDING_DIMENSION || "1024", 10);
+  const client = createOpenAI({ baseURL, apiKey });
+  let _model;
+  let _embedModel;
+  return {
+    get dimension() {
+      return dimension;
+    },
+    model(name) {
+      const m = name ?? modelName;
+      if (!_model) _model = client(m);
+      return _model;
+    },
+    embeddingModel(name) {
+      const m = name ?? embedModelName;
+      if (!_embedModel) _embedModel = client.embedding(m);
+      return _embedModel;
+    },
+    async embed(text2) {
+      const result = await aiEmbed({ model: this.embeddingModel(), value: text2 });
+      return result.embedding;
+    },
+    async embedMany(texts) {
+      const result = await aiEmbedMany({ model: this.embeddingModel(), value: texts });
+      return result.embeddings;
+    },
+    generateText(params) {
+      return aiGenerateText({ ...params, model: this.model() });
+    },
+    streamText(params) {
+      return aiStreamText({ ...params, model: this.model() });
+    }
+  };
+}
+
 // ai-sdk.ts
 import {
   streamText,
@@ -2373,7 +2466,7 @@ import {
 } from "ai";
 import {
   openai,
-  createOpenAI
+  createOpenAI as createOpenAI2
 } from "@ai-sdk/openai";
 
 // postgres/client.ts
@@ -3293,6 +3386,226 @@ h2{color:#dc2626}.desc{color:#555}</style>
   return { authorizeHandler, consentHandler, tokenHandler, registerClient, getClient, revokeClient };
 }
 
+// user/oauth-login.ts
+import crypto4 from "node:crypto";
+var BUILTIN_PROVIDERS = {
+  google: {
+    authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+    tokenUrl: "https://oauth2.googleapis.com/token",
+    userUrl: "https://www.googleapis.com/oauth2/v2/userinfo",
+    scope: "openid email profile",
+    parseUser: (data) => ({
+      id: data.id,
+      email: data.email,
+      name: data.name,
+      avatarUrl: data.picture
+    })
+  },
+  github: {
+    authUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    userUrl: "https://api.github.com/user",
+    scope: "read:user user:email",
+    parseUser: (data) => ({
+      id: String(data.id),
+      email: data.email ?? "",
+      name: data.name ?? data.login,
+      avatarUrl: data.avatar_url
+    })
+  }
+};
+function registerOAuthLoginRoutes(router, deps, providers) {
+  const { sql: sql2, providerTable, signToken, redirectUrl } = deps;
+  let tableReady = null;
+  async function ensureTable() {
+    if (tableReady) return tableReady;
+    tableReady = (async () => {
+      await sql2.unsafe(`
+        CREATE TABLE IF NOT EXISTS ${escapeIdent(providerTable)} (
+          id SERIAL PRIMARY KEY,
+          user_id INTEGER NOT NULL REFERENCES ${escapeIdent(deps.usersTable)}(id) ON DELETE CASCADE,
+          provider TEXT NOT NULL,
+          provider_id TEXT NOT NULL,
+          email TEXT NOT NULL DEFAULT '',
+          name TEXT NOT NULL DEFAULT '',
+          avatar_url TEXT NOT NULL DEFAULT '',
+          created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+          UNIQUE(provider, provider_id)
+        )
+      `);
+      await sql2.unsafe(`
+        CREATE INDEX IF NOT EXISTS ${escapeIdent(providerTable + "_user_idx")}
+        ON ${escapeIdent(providerTable)}(user_id)
+      `);
+    })();
+    return tableReady;
+  }
+  async function findUserByProvider(provider, providerId) {
+    const [row] = await sql2.unsafe(
+      `SELECT * FROM ${escapeIdent(providerTable)} WHERE provider = $1 AND provider_id = $2 LIMIT 1`,
+      [provider, providerId]
+    );
+    return row ?? null;
+  }
+  async function linkProvider(userId, provider, providerId, email, name, avatarUrl) {
+    await sql2.unsafe(
+      `INSERT INTO ${escapeIdent(providerTable)} (user_id, provider, provider_id, email, name, avatar_url)
+       VALUES ($1, $2, $3, $4, $5, $6)
+       ON CONFLICT (provider, provider_id) DO NOTHING`,
+      [userId, provider, providerId, email, name, avatarUrl]
+    );
+  }
+  async function findOrCreateUser(provider, providerId, email, name, avatarUrl) {
+    const link = await findUserByProvider(provider, providerId);
+    if (link) {
+      const user2 = await deps.findUserById(link.user_id);
+      if (user2) return user2;
+    }
+    if (email) {
+      const existingUser = await deps.findUserByEmail(email);
+      if (existingUser) {
+        await linkProvider(existingUser.id, provider, providerId, email, name, avatarUrl);
+        return existingUser;
+      }
+    }
+    const newUser = await deps.createPlaceholderUser(
+      email || `${provider}_${providerId}@oauth.local`,
+      name || provider
+    );
+    await linkProvider(newUser.id, provider, providerId, email, name, avatarUrl);
+    return newUser;
+  }
+  function getProviderMeta(providerName) {
+    const config = providers[providerName];
+    if (!config) return null;
+    const builtin = BUILTIN_PROVIDERS[providerName];
+    const parseUser = config.parseUser ?? builtin?.parseUser;
+    if (!parseUser) return null;
+    const meta = {
+      authUrl: config.authUrl ?? builtin?.authUrl ?? "",
+      tokenUrl: config.tokenUrl ?? builtin?.tokenUrl ?? "",
+      userUrl: config.userUrl ?? builtin?.userUrl ?? "",
+      scope: config.scope ?? builtin?.scope ?? "openid",
+      parseUser
+    };
+    if (!meta.authUrl || !meta.tokenUrl || !meta.userUrl) return null;
+    return { config, meta };
+  }
+  router.get("/auth/:provider", async (req, ctx) => {
+    await ensureTable();
+    const providerName = ctx.params.provider;
+    const resolved = getProviderMeta(providerName);
+    if (!resolved) {
+      return Response.json({ error: `Unsupported provider: ${providerName}` }, { status: 400 });
+    }
+    const { config, meta } = resolved;
+    const state = crypto4.randomUUID();
+    const redirectUri = new URL(req.url);
+    redirectUri.pathname = redirectUri.pathname.replace(/\/[^/]+$/, "/") + providerName + "/callback";
+    if (ctx.session) {
+      ctx.session.oauthState = { state, provider: providerName };
+    }
+    const scope = config.scope ?? meta.scope;
+    const params = new URLSearchParams({
+      client_id: config.clientId,
+      redirect_uri: redirectUri.origin + redirectUri.pathname,
+      response_type: "code",
+      scope,
+      state,
+      access_type: "offline",
+      prompt: "consent"
+    });
+    return Response.redirect(`${meta.authUrl}?${params.toString()}`, 302);
+  });
+  router.get("/auth/:provider/callback", async (req, ctx) => {
+    const providerName = ctx.params.provider;
+    const resolved = getProviderMeta(providerName);
+    if (!resolved) {
+      return Response.json({ error: `Unsupported provider: ${providerName}` }, { status: 400 });
+    }
+    const { config, meta } = resolved;
+    const url = new URL(req.url);
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    if (!code || !state) {
+      return Response.json({ error: "Missing code or state parameter" }, { status: 400 });
+    }
+    const savedState = ctx.session?.oauthState;
+    if (!savedState || savedState.state !== state || savedState.provider !== providerName) {
+      return Response.json({ error: "Invalid state \u2014 possible CSRF attack" }, { status: 403 });
+    }
+    if (ctx.session) delete ctx.session.oauthState;
+    const redirectUri = url.origin + url.pathname.replace(/\/callback$/, "");
+    let tokenRes;
+    try {
+      tokenRes = await fetch(meta.tokenUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "Accept": "application/json" },
+        body: JSON.stringify({
+          code,
+          client_id: config.clientId,
+          client_secret: config.clientSecret,
+          redirect_uri: redirectUri,
+          grant_type: "authorization_code"
+        })
+      });
+    } catch (err) {
+      console.error(`[oauth] token exchange network error for ${providerName}:`, err.message);
+      return Response.json({ error: "Failed to connect to OAuth provider" }, { status: 502 });
+    }
+    if (!tokenRes.ok) {
+      const errBody = await tokenRes.text();
+      console.error(`[oauth] token exchange failed for ${providerName}:`, errBody);
+      return Response.json({ error: "Failed to exchange authorization code" }, { status: 502 });
+    }
+    const tokenData = await tokenRes.json();
+    const accessToken = tokenData.access_token;
+    if (!accessToken) {
+      return Response.json({ error: "No access_token in response" }, { status: 502 });
+    }
+    let userRes;
+    try {
+      userRes = await fetch(meta.userUrl, { headers: { Authorization: "Bearer " + accessToken } });
+    } catch (err) {
+      console.error("[oauth] user info network error for " + providerName + ":", err.message);
+      return Response.json({ error: "Failed to connect to OAuth provider" }, { status: 502 });
+    }
+    if (!userRes.ok) {
+      return Response.json({ error: "Failed to fetch user profile" }, { status: 502 });
+    }
+    const userData = await userRes.json();
+    const providerUser = meta.parseUser(userData, accessToken);
+    const user2 = await findOrCreateUser(
+      providerName,
+      providerUser.id,
+      providerUser.email,
+      providerUser.name,
+      providerUser.avatarUrl ?? ""
+    );
+    if (!user2) {
+      return Response.json({ error: "Failed to create/link user" }, { status: 500 });
+    }
+    const token = signToken(user2);
+    if (ctx.session) {
+      ctx.session.userId = user2.id;
+      ctx.session.role = user2.role;
+    }
+    const accept = req.headers.get("accept") ?? "";
+    if (accept.includes("application/json")) {
+      return Response.json({
+        token,
+        user: { id: user2.id, email: user2.email, name: user2.name, role: user2.role }
+      });
+    }
+    const finalUrl = new URL(redirectUrl, url.origin);
+    finalUrl.searchParams.set("token", token);
+    return Response.redirect(finalUrl.toString(), 302);
+  });
+}
+function escapeIdent(s) {
+  return `"${s.replace(/"/g, '""')}"`;
+}
+
 // user/client.ts
 var RegisterSchema = z2.object({
   email: z2.string().email(),
@@ -3303,6 +3616,9 @@ var LoginSchema = z2.object({
   email: z2.string().email(),
   password: z2.string().min(1)
 });
+function escapeIdent2(s) {
+  return `"${s.replace(/"/g, '""')}"`;
+}
 function hashPassword(password) {
   const salt = randomBytes(16).toString("hex");
   const hash = scryptSync(password, salt, 64).toString("hex");
@@ -3336,6 +3652,25 @@ function user(options) {
   }
   async function migrate() {
     await users.create();
+    if (options.oauthLogin) {
+      await pg.sql.unsafe(`
+        CREATE TABLE IF NOT EXISTS "_auth_providers" (
+          id SERIAL PRIMARY KEY,
+          user_id INTEGER NOT NULL REFERENCES ${escapeIdent2(table)}(id) ON DELETE CASCADE,
+          provider TEXT NOT NULL,
+          provider_id TEXT NOT NULL,
+          email TEXT NOT NULL DEFAULT '',
+          name TEXT NOT NULL DEFAULT '',
+          avatar_url TEXT NOT NULL DEFAULT '',
+          created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+          UNIQUE(provider, provider_id)
+        )
+      `);
+      await pg.sql.unsafe(`
+        CREATE INDEX IF NOT EXISTS "_auth_providers_user_idx"
+        ON "_auth_providers"(user_id)
+      `);
+    }
     if (!oauth2Enabled) return;
     const clients3 = pg.table("_oauth2_clients", {
       id: serial("id").primaryKey(),
@@ -3389,6 +3724,11 @@ function user(options) {
   async function findById(id2) {
     return await users.read(id2);
   }
+  async function createPlaceholderUser(email, name) {
+    const randomPassword = randomBytes(32).toString("hex");
+    const row = await users.insert({ email, password: randomPassword, name });
+    return row;
+  }
   async function register(data) {
     const { email, password, name } = RegisterSchema.parse(data);
     const existing = await findByEmail(email);
@@ -3505,6 +3845,20 @@ function user(options) {
     return r2;
   }
   const r = router();
+  if (options.oauthLogin) {
+    registerOAuthLoginRoutes(r, {
+      sql: pg.sql,
+      jwtSecret: secret,
+      expiresIn,
+      usersTable: table,
+      providerTable: "_auth_providers",
+      redirectUrl: options.oauthLogin.redirectUrl || "/",
+      signToken,
+      createPlaceholderUser,
+      findUserById: findById,
+      findUserByEmail: findByEmail
+    }, options.oauthLogin.providers);
+  }
   const mod = r;
   mod.middleware = middleware;
   mod.migrate = migrate;
@@ -3542,30 +3896,9 @@ function redis(opts) {
 
 // queue/index.ts
 import { Redis as IORedis2 } from "ioredis";
-import crypto4 from "node:crypto";
-function cronNext(expr, from = /* @__PURE__ */ new Date()) {
-  const parts = expr.trim().split(/\s+/);
-  if (parts.length !== 5) throw new Error(`Invalid cron expression "${expr}": expected 5 fields`);
-  const fields = parts.map((f, i) => {
-    const ranges = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 6]];
-    const [min, max] = ranges[i];
-    return parseField(f, min, max);
-  });
-  let candidate = new Date(from.getTime() + 6e4);
-  candidate.setSeconds(0, 0);
-  for (let i = 0; i < 525600; i++) {
-    const m = candidate.getMonth() + 1;
-    const d = candidate.getDate();
-    const h = candidate.getHours();
-    const min = candidate.getMinutes();
-    const dw = candidate.getDay();
-    if (fields[4].has(dw) && fields[3].has(m) && fields[2].has(d) && fields[1].has(h) && fields[0].has(min)) {
-      return candidate.getTime();
-    }
-    candidate.setTime(candidate.getTime() + 6e4);
-  }
-  throw new Error(`No future date found for cron expression "${expr}"`);
-}
+import crypto5 from "node:crypto";
+
+// cron-utils.ts
 function parseField(field, min, max) {
   const values = /* @__PURE__ */ new Set();
   for (const part of field.split(",")) {
@@ -3574,19 +3907,23 @@ function parseField(field, min, max) {
     } else if (part.includes("/")) {
       const [range, stepStr] = part.split("/");
       const step = parseInt(stepStr, 10);
+      if (isNaN(step) || step < 1) throw new Error(`Invalid cron step: ${part}`);
       let start = min;
       let end = max;
       if (range !== "*") {
-        const parts = range.split("-");
-        start = parseInt(parts[0], 10);
-        end = parts.length > 1 ? parseInt(parts[1], 10) : max;
+        const rangeParts = range.split("-");
+        start = parseInt(rangeParts[0], 10);
+        end = rangeParts.length > 1 ? parseInt(rangeParts[1], 10) : max;
       }
       for (let i = start; i <= end; i += step) values.add(i);
     } else if (part.includes("-")) {
       const [s, e] = part.split("-").map(Number);
+      if (isNaN(s) || isNaN(e)) throw new Error(`Invalid cron range: ${part}`);
       for (let i = s; i <= e; i++) values.add(i);
     } else {
-      values.add(parseInt(part, 10));
+      const val = parseInt(part, 10);
+      if (isNaN(val)) throw new Error(`Invalid cron value: ${part}`);
+      values.add(val);
     }
   }
   const result = /* @__PURE__ */ new Set();
@@ -3595,41 +3932,333 @@ function parseField(field, min, max) {
   }
   return result;
 }
+var FIELD_RANGES = [
+  [0, 59],
+  // minute
+  [0, 23],
+  // hour
+  [1, 31],
+  // day of month
+  [1, 12],
+  // month
+  [0, 6]
+  // day of week (0=Sunday)
+];
+function parsePattern(pattern) {
+  const fields = pattern.trim().split(/\s+/);
+  if (fields.length !== 5) {
+    throw new Error(
+      `Invalid cron pattern "${pattern}": expected 5 fields, got ${fields.length}`
+    );
+  }
+  return fields.map((f, i) => parseField(f, FIELD_RANGES[i][0], FIELD_RANGES[i][1]));
+}
+function matches(fields, date) {
+  return fields[0].has(date.getMinutes()) && fields[1].has(date.getHours()) && fields[2].has(date.getDate()) && fields[3].has(date.getMonth() + 1) && fields[4].has(date.getDay());
+}
+function cronNext(expr, from = /* @__PURE__ */ new Date()) {
+  const fields = parsePattern(expr);
+  let candidate = new Date(from.getTime() + 6e4);
+  candidate.setSeconds(0, 0);
+  for (let i = 0; i < 525600; i++) {
+    if (fields[4].has(candidate.getDay()) && fields[3].has(candidate.getMonth() + 1) && fields[2].has(candidate.getDate()) && fields[1].has(candidate.getHours()) && fields[0].has(candidate.getMinutes())) {
+      return candidate.getTime();
+    }
+    candidate.setTime(candidate.getTime() + 6e4);
+  }
+  throw new Error(`No future date found for cron expression "${expr}"`);
+}
+
+// queue/index.ts
 function queue(opts) {
-  const redis2 = opts?.redis ?? new IORedis2(opts?.url ?? process.env.REDIS_URL ?? "redis://localhost:6379");
-  const prefix = opts?.prefix ?? "queue";
+  const store2 = opts?.store ?? "memory";
+  if (store2 === "redis") return createRedisQueue(opts);
+  if (store2 === "pg") return createPgQueue(opts);
+  return createMemoryQueue(opts);
+}
+function escapeIdent3(s) {
+  return '"' + s.replace(/"/g, '""') + '"';
+}
+function attachCron(q, handlers) {
+  ;
+  q.cron = function(pattern, handler) {
+    const id2 = "__cron_" + pattern.replace(/[^a-zA-Z0-9]/g, "_") + "_" + crypto5.randomUUID().slice(0, 8);
+    q.process(id2, async () => {
+      await handler();
+    });
+    q.add(id2, {}, { schedule: pattern });
+    return { stop: () => handlers.delete(id2) };
+  };
+}
+function createMemoryQueue(opts) {
   const pollInterval = opts?.pollInterval ?? 200;
   const handlers = /* @__PURE__ */ new Map();
+  const jobs = [];
+  const failed = [];
+  const MAX_FAILED = 1e3;
   let running = false;
   let pollTimer = null;
-  let epoch = 0;
   let _processed = 0;
   let _failed = 0;
-  const jobKey = `${prefix}:jobs`;
-  const failedKey = `${prefix}:failed`;
-  const MAX_FAILED = 1e3;
+  let inflight = 0;
+  const MAX_CONCURRENT = 16;
+  function insertJob(job) {
+    let i = 0;
+    while (i < jobs.length && jobs[i].runAt <= job.runAt) i++;
+    jobs.splice(i, 0, job);
+  }
+  async function execute(job, handler) {
+    inflight++;
+    try {
+      await handler(job);
+      _processed++;
+    } catch (e) {
+      _failed++;
+      failed.unshift({ ...job, error: e.message, failedAt: Date.now() });
+      if (failed.length > MAX_FAILED) failed.length = MAX_FAILED;
+    } finally {
+      inflight--;
+    }
+    if (job.schedule) {
+      try {
+        insertJob({ ...job, id: crypto5.randomUUID(), runAt: cronNext(job.schedule), createdAt: Date.now() });
+      } catch (e) {
+        console.error("[queue] cron re-queue failed:", e.message);
+      }
+    }
+  }
+  async function poll() {
+    if (!running) return;
+    const now = Date.now();
+    while (running && inflight < MAX_CONCURRENT && jobs.length > 0 && jobs[0].runAt <= now) {
+      const job = jobs.shift();
+      const handler = handlers.get(job.type);
+      if (handler) execute(job, handler);
+    }
+    if (running) pollTimer = setTimeout(poll, pollInterval);
+  }
   const mw = ((req, ctx, next) => {
     ctx.queue = q;
     return next(req, ctx);
   });
   const q = mw;
+  mw.add = function add(type, payload, opts2) {
+    const id2 = crypto5.randomUUID();
+    let runAt;
+    if (opts2?.schedule) {
+      try {
+        const f = parsePattern(opts2.schedule);
+        runAt = matches(f, /* @__PURE__ */ new Date()) ? Date.now() : cronNext(opts2.schedule);
+      } catch {
+        runAt = cronNext(opts2.schedule);
+      }
+    } else if (opts2?.delay) {
+      runAt = Date.now() + opts2.delay;
+    } else {
+      runAt = Date.now();
+    }
+    const job = { id: id2, type, payload, createdAt: Date.now(), runAt };
+    if (opts2?.schedule) job.schedule = opts2.schedule;
+    insertJob(job);
+    return Promise.resolve(id2);
+  };
+  mw.process = function process2(type, handler) {
+    handlers.set(type, handler);
+  };
+  mw.run = async function run() {
+    if (running) return;
+    running = true;
+    poll();
+  };
+  mw.stop = function stop2() {
+    running = false;
+    if (pollTimer) {
+      clearTimeout(pollTimer);
+      pollTimer = null;
+    }
+  };
+  mw.close = async function close() {
+    mw.stop();
+    while (inflight > 0) await new Promise((r) => setTimeout(r, 50));
+  };
+  mw.jobs = async function jobs2(limit) {
+    return jobs2.slice(0, limit ?? 50);
+  };
+  mw.failedJobs = async function failedJobs(limit) {
+    return failed.slice(0, limit ?? 50);
+  };
+  mw.retryFailed = async function retry(jobId) {
+    const idx = failed.findIndex((j) => j.id === jobId);
+    if (idx < 0) return false;
+    const [entry] = failed.splice(idx, 1);
+    _failed--;
+    insertJob({ ...entry, runAt: Date.now() });
+    return true;
+  };
+  mw.retryAllFailed = async function retryAll(type) {
+    let count = 0;
+    for (let i = failed.length - 1; i >= 0; i--) {
+      if (type && failed[i].type !== type) continue;
+      const [entry] = failed.splice(i, 1);
+      _failed--;
+      insertJob({ ...entry, runAt: Date.now() });
+      count++;
+    }
+    return count;
+  };
+  mw.dashboard = function dashboard() {
+    return buildDashboard(q);
+  };
+  mw.stats = () => ({ running, inflight, processed: _processed, failed: _failed, handlers: handlers.size, maxConcurrent: MAX_CONCURRENT });
+  attachCron(q, handlers);
+  return q;
+}
+function createPgQueue(opts) {
+  const sql2 = opts.pg.sql;
+  const pollInterval = opts?.pollInterval ?? 200;
+  const table = (opts?.prefix ?? "queue") + "_jobs";
+  const handlers = /* @__PURE__ */ new Map();
+  let running = false, pollTimer = null;
+  let _processed = 0, _failed = 0, inflight = 0, ready = false;
   const MAX_CONCURRENT = 16;
-  let inflight = 0;
-  async function processJob(job, jobHandler) {
+  const MAX_FAILED = 1e3;
+  async function ensureTable() {
+    if (ready) return;
+    await sql2.unsafe(`CREATE TABLE IF NOT EXISTS ${escapeIdent3(table)} (id UUID PRIMARY KEY, type TEXT NOT NULL, payload JSONB NOT NULL DEFAULT '{}', run_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), schedule TEXT, status TEXT NOT NULL DEFAULT 'pending', error TEXT, failed_at TIMESTAMPTZ, created_at TIMESTAMPTZ NOT NULL DEFAULT NOW())`);
+    await sql2.unsafe(`CREATE INDEX IF NOT EXISTS ${escapeIdent3(table + "_run_at_idx")} ON ${escapeIdent3(table)} (run_at, status)`);
+    ready = true;
+  }
+  async function processJob(job, handler) {
     inflight++;
     try {
-      await jobHandler(job);
+      await handler(job);
       _processed++;
+      await sql2.unsafe(`DELETE FROM ${escapeIdent3(table)} WHERE id = $1`, [job.id]);
     } catch (e) {
       _failed++;
-      const errMsg = e.message;
-      console.error("[queue] handler error:", errMsg);
-      const failedEntry = JSON.stringify({
-        ...job,
-        error: errMsg,
-        failedAt: Date.now()
-      });
-      await redis2.lpush(failedKey, failedEntry);
+      const msg = e.message;
+      console.error("[queue] handler error:", msg);
+      await sql2.unsafe(`UPDATE ${escapeIdent3(table)} SET status = 'failed', error = $2, failed_at = NOW() WHERE id = $1`, [job.id, msg]);
+    } finally {
+      inflight--;
+    }
+    if (job.schedule) {
+      try {
+        const nextRun = cronNext(job.schedule);
+        await sql2.unsafe(`INSERT INTO ${escapeIdent3(table)} (id, type, payload, run_at, schedule) VALUES ($1, $2, $3::jsonb, $4, $5)`, [crypto5.randomUUID(), job.type, JSON.stringify(job.payload), new Date(nextRun).toISOString(), job.schedule]);
+      } catch (e) {
+        console.error("[queue] cron re-queue failed:", e.message);
+      }
+    }
+  }
+  async function poll() {
+    if (!running) return;
+    try {
+      while (running && inflight < MAX_CONCURRENT) {
+        const rows = await sql2.unsafe(`UPDATE ${escapeIdent3(table)} SET status = 'running' WHERE id = (SELECT id FROM ${escapeIdent3(table)} WHERE run_at <= NOW() AND status = 'pending' ORDER BY run_at LIMIT 1 FOR UPDATE SKIP LOCKED) RETURNING *`);
+        if (rows.length === 0) break;
+        const row = rows[0];
+        const job = { id: row.id, type: row.type, payload: typeof row.payload === "string" ? JSON.parse(row.payload) : row.payload, createdAt: new Date(row.created_at).getTime(), runAt: new Date(row.run_at).getTime(), schedule: row.schedule || void 0 };
+        const handler = handlers.get(job.type);
+        if (handler) processJob(job, handler);
+      }
+    } catch (e) {
+      const msg = e.message;
+      if (msg.includes("CONNECTION_ENDED") || msg.includes("Connection terminated")) {
+        running = false;
+        return;
+      }
+      console.error("[queue] poll error:", msg);
+    }
+    if (running) pollTimer = setTimeout(poll, pollInterval);
+  }
+  const mw = ((req, ctx, next) => {
+    ctx.queue = q;
+    return next(req, ctx);
+  });
+  const q = mw;
+  mw.add = function add(type, payload, opts2) {
+    return (async () => {
+      const id2 = crypto5.randomUUID();
+      let runAt;
+      if (opts2?.schedule) {
+        try {
+          const f = parsePattern(opts2.schedule);
+          runAt = matches(f, /* @__PURE__ */ new Date()) ? /* @__PURE__ */ new Date() : new Date(cronNext(opts2.schedule));
+        } catch {
+          runAt = new Date(cronNext(opts2.schedule));
+        }
+      } else if (opts2?.delay) {
+        runAt = new Date(Date.now() + opts2.delay);
+      } else {
+        runAt = /* @__PURE__ */ new Date();
+      }
+      await sql2.unsafe(`INSERT INTO ${escapeIdent3(table)} (id, type, payload, run_at, schedule) VALUES ($1, $2, $3::jsonb, $4, $5)`, [id2, type, JSON.stringify(payload), runAt.toISOString(), opts2?.schedule || null]);
+      return id2;
+    })();
+  };
+  mw.process = function process2(type, handler) {
+    handlers.set(type, handler);
+  };
+  mw.migrate = ensureTable;
+  mw.run = async function run() {
+    if (running) return;
+    await ensureTable();
+    running = true;
+    poll();
+  };
+  mw.stop = function stop2() {
+    running = false;
+    if (pollTimer) {
+      clearTimeout(pollTimer);
+      pollTimer = null;
+    }
+  };
+  mw.close = async function close() {
+    mw.stop();
+    while (inflight > 0) await new Promise((r) => setTimeout(r, 50));
+  };
+  mw.jobs = async function jobs(limit) {
+    const rows = await sql2.unsafe(`SELECT * FROM ${escapeIdent3(table)} WHERE status = 'pending' ORDER BY run_at LIMIT $1`, [limit ?? 50]);
+    return rows.map((r) => ({ id: r.id, type: r.type, payload: typeof r.payload === "string" ? JSON.parse(r.payload) : r.payload, createdAt: new Date(r.created_at).getTime(), runAt: new Date(r.run_at).getTime(), schedule: r.schedule || void 0 }));
+  };
+  mw.failedJobs = async function failedJobs(limit) {
+    const rows = await sql2.unsafe(`SELECT * FROM ${escapeIdent3(table)} WHERE status = 'failed' ORDER BY failed_at DESC LIMIT $1`, [limit ?? 50]);
+    return rows.map((r) => ({ id: r.id, type: r.type, payload: typeof r.payload === "string" ? JSON.parse(r.payload) : r.payload, createdAt: new Date(r.created_at).getTime(), runAt: new Date(r.run_at).getTime(), schedule: r.schedule || void 0, error: r.error || "", failedAt: new Date(r.failed_at).getTime() }));
+  };
+  mw.retryFailed = async function retryFailed(jobId) {
+    const result = await sql2.unsafe(`UPDATE ${escapeIdent3(table)} SET status = 'pending', error = NULL, failed_at = NULL, run_at = NOW() WHERE id = $1 AND status = 'failed' RETURNING id`, [jobId]);
+    return result.length > 0;
+  };
+  mw.retryAllFailed = async function retryAllFailed(type) {
+    const result = await sql2.unsafe(type ? `UPDATE ${escapeIdent3(table)} SET status = 'pending', error = NULL, failed_at = NULL, run_at = NOW() WHERE status = 'failed' AND type = $1 RETURNING id` : `UPDATE ${escapeIdent3(table)} SET status = 'pending', error = NULL, failed_at = NULL, run_at = NOW() WHERE status = 'failed' RETURNING id`, type ? [type] : []);
+    return result.length;
+  };
+  mw.dashboard = function dashboard() {
+    return buildDashboard(q);
+  };
+  mw.stats = () => ({ running, inflight, processed: _processed, failed: _failed, handlers: handlers.size, maxConcurrent: MAX_CONCURRENT });
+  attachCron(q, handlers);
+  return q;
+}
+function createRedisQueue(opts) {
+  const redis2 = opts?.redis ?? new IORedis2(opts?.url ?? process.env.REDIS_URL ?? "redis://localhost:6379");
+  const prefix = opts?.prefix ?? "queue";
+  const pollInterval = opts?.pollInterval ?? 200;
+  const handlers = /* @__PURE__ */ new Map();
+  let running = false, pollTimer = null, epoch = 0;
+  let _processed = 0, _failed = 0, inflight = 0;
+  const jobKey = prefix + ":jobs", failedKey = prefix + ":failed", MAX_FAILED = 1e3, MAX_CONCURRENT = 16;
+  async function processJob(job, handler) {
+    inflight++;
+    try {
+      await handler(job);
+      _processed++;
+    } catch (e) {
+      _failed++;
+      const msg = e.message;
+      console.error("[queue] handler error:", msg);
+      await redis2.lpush(failedKey, JSON.stringify({ ...job, error: msg, failedAt: Date.now() }));
       await redis2.ltrim(failedKey, 0, MAX_FAILED - 1);
     } finally {
       inflight--;
@@ -3637,8 +4266,7 @@ function queue(opts) {
     if (job.schedule) {
       try {
         const nextRun = cronNext(job.schedule);
-        const nextJob = { ...job, id: crypto4.randomUUID(), runAt: nextRun, createdAt: Date.now() };
-        await redis2.zadd(jobKey, nextRun, JSON.stringify(nextJob));
+        await redis2.zadd(jobKey, nextRun, JSON.stringify({ ...job, id: crypto5.randomUUID(), runAt: nextRun, createdAt: Date.now() }));
       } catch (e) {
         console.error("[queue] cron re-queue failed:", e.message);
       }
@@ -3652,8 +4280,7 @@ function queue(opts) {
       while (running && inflight < MAX_CONCURRENT) {
         const result = await redis2.zpopmin(jobKey);
         if (result.length < 2) break;
-        const raw = result[0];
-        const score = parseInt(result[1], 10);
+        const raw = result[0], score = parseInt(result[1], 10);
         if (score > now) {
           await redis2.zadd(jobKey, score, raw);
           break;
@@ -3664,20 +4291,21 @@ function queue(opts) {
         } catch {
           continue;
         }
-        const jobHandler = handlers.get(job.type);
-        if (jobHandler) {
-          processJob(job, jobHandler);
-        }
+        const handler = handlers.get(job.type);
+        if (handler) processJob(job, handler);
       }
     } catch (e) {
       console.error("[queue] poll error:", e.message);
     }
-    if (running && currentEpoch === epoch) {
-      pollTimer = setTimeout(poll, pollInterval);
-    }
+    if (running && currentEpoch === epoch) pollTimer = setTimeout(poll, pollInterval);
   }
+  const mw = ((req, ctx, next) => {
+    ctx.queue = q;
+    return next(req, ctx);
+  });
+  const q = mw;
   mw.add = function add(type, payload, opts2) {
-    const id2 = crypto4.randomUUID();
+    const id2 = crypto5.randomUUID();
     let runAt;
     if (opts2?.schedule) {
       runAt = cronNext(opts2.schedule);
@@ -3751,8 +4379,8 @@ function queue(opts) {
     return false;
   };
   mw.retryAllFailed = async function retryAllFailed(type) {
-    const raw = await redis2.lrange(failedKey, 0, -1);
     let count = 0;
+    const raw = await redis2.lrange(failedKey, 0, -1);
     for (const entry of raw) {
       try {
         const job = JSON.parse(entry);
@@ -3770,52 +4398,43 @@ function queue(opts) {
     return count;
   };
   mw.dashboard = function dashboard() {
-    const r = new Router();
-    r.get("/", async (req, ctx) => {
-      const s = q.stats();
-      const pending = await q.jobs(100);
-      const byType = {};
-      for (const job of pending) {
-        if (!byType[job.type]) byType[job.type] = { pending: 0, failed: 0 };
-        byType[job.type].pending++;
-      }
-      const failed = await q.failedJobs(1e3);
-      for (const job of failed) {
-        if (!byType[job.type]) byType[job.type] = { pending: 0, failed: 0 };
-        byType[job.type].failed++;
-      }
-      return Response.json({
-        stats: s,
-        types: byType,
-        failedCount: failed.length
-      });
-    });
-    r.get("/:type/failed", async (req, ctx) => {
-      const failed = await q.failedJobs(100);
-      const filtered = failed.filter((j) => j.type === ctx.params.type);
-      return Response.json({ jobs: filtered, count: filtered.length });
-    });
-    r.post("/:type/retry", async (req, ctx) => {
-      const count = await q.retryAllFailed(ctx.params.type);
-      return Response.json({ retried: count });
-    });
-    r.post("/retry/:id", async (req, ctx) => {
-      const ok = await q.retryFailed(ctx.params.id);
-      if (!ok) return new Response("Job not found", { status: 404 });
-      return Response.json({ retried: true });
-    });
-    return r;
+    return buildDashboard(q);
   };
-  mw.stats = () => ({
-    running,
-    inflight,
-    processed: _processed,
-    failed: _failed,
-    handlers: handlers.size,
-    maxConcurrent: MAX_CONCURRENT
-  });
+  mw.stats = () => ({ running, inflight, processed: _processed, failed: _failed, handlers: handlers.size, maxConcurrent: MAX_CONCURRENT });
+  attachCron(q, handlers);
   return q;
 }
+function buildDashboard(q) {
+  const r = new Router();
+  r.get("/", async () => {
+    const s = q.stats();
+    const pending = await q.jobs(100);
+    const byType = {};
+    for (const j of pending) {
+      if (!byType[j.type]) byType[j.type] = { pending: 0, failed: 0 };
+      byType[j.type].pending++;
+    }
+    const failed = await q.failedJobs(1e3);
+    for (const j of failed) {
+      if (!byType[j.type]) byType[j.type] = { pending: 0, failed: 0 };
+      byType[j.type].failed++;
+    }
+    return Response.json({ stats: s, types: byType, failedCount: failed.length });
+  });
+  r.get("/:type/failed", async (req, ctx) => {
+    const failed = await q.failedJobs(100);
+    return Response.json({ jobs: failed.filter((j) => j.type === ctx.params.type) });
+  });
+  r.post("/:type/retry", async (req, ctx) => {
+    return Response.json({ retried: await q.retryAllFailed(ctx.params.type) });
+  });
+  r.post("/retry/:id", async (req, ctx) => {
+    const ok = await q.retryFailed(ctx.params.id);
+    if (!ok) return new Response("Not found", { status: 404 });
+    return Response.json({ ok: true });
+  });
+  return r;
+}
 
 // tenant/rest.ts
 import { z as z3 } from "zod";
@@ -4723,9 +5342,6 @@ function tenant(options) {
   return mod;
 }
 
-// agent/client.ts
-import { createOpenAI as createOpenAI2 } from "@ai-sdk/openai";
-
 // agent/rest.ts
 function buildRouter2(deps) {
   const { agents: agentsTable, runs: runsTable, knowledge, runner } = deps;
@@ -4879,12 +5495,10 @@ function buildRouter2(deps) {
 }
 
 // agent/run.ts
-import { streamText as streamText2, generateText as generateText3, embed as embed2 } from "ai";
 import { z as z4 } from "zod";
-function hasKnowledgeDocs(sql2, agentId) {
-  return sql2`SELECT 1 FROM "_knowledge_documents" WHERE agent_id = ${agentId} LIMIT 1`.then((r) => r.length > 0);
-}
-function chunkContent(content, chunkSize = 512, overlap = 64) {
+
+// ai/utils.ts
+function chunkContent(content, chunkSize, overlap) {
   const paragraphs = content.split(/\n\n+/);
   const chunks = [];
   let current = "";
@@ -4898,8 +5512,13 @@ function chunkContent(content, chunkSize = 512, overlap = 64) {
   if (current) chunks.push(current);
   return chunks;
 }
-async function searchKnowledge(sql2, embedModel, agentId, query, limit = 5) {
-  const { embedding } = await embed2({ model: embedModel, value: query });
+
+// agent/run.ts
+function hasKnowledgeDocs(sql2, agentId) {
+  return sql2`SELECT 1 FROM "_knowledge_documents" WHERE agent_id = ${agentId} LIMIT 1`.then((r) => r.length > 0);
+}
+async function searchKnowledge(sql2, provider, agentId, query, limit = 5) {
+  const embedding = await provider.embed(query);
   const vec = `[${embedding.join(",")}]`;
   const docs = await sql2.unsafe(
     `SELECT id, title, content, metadata, embedding <=> $1::vector AS _score FROM "_knowledge_documents" WHERE agent_id = $2 ORDER BY embedding <=> $1::vector LIMIT $3`,
@@ -4912,7 +5531,7 @@ async function loadAgent(agents, agentId) {
   return row ?? null;
 }
 function createRunner(deps) {
-  const { sql: sql2, agents, runs, getModel, getEmbeddingModel, userTools } = deps;
+  const { sql: sql2, agents, runs, provider, modelName, userTools } = deps;
   function truncate(s, max = 200) {
     return s.length > max ? s.slice(0, max) + "..." : s;
   }
@@ -4937,8 +5556,6 @@ function createRunner(deps) {
   async function run(agentId, params) {
     const agent2 = await loadAgent(agents, agentId);
     if (!agent2 || !agent2.active) throw new Error("Agent not found or inactive");
-    const model = getModel();
-    const embedModel = getEmbeddingModel();
     const start = Date.now();
     const hasKB = await hasKnowledgeDocs(sql2, agentId);
     const messages2 = params.messages ?? [];
@@ -4954,7 +5571,7 @@ function createRunner(deps) {
           limit: z4.number().default(5).describe("\u8FD4\u56DE\u7ED3\u679C\u6570\u91CF")
         }),
         execute: async ({ query, limit }) => {
-          return searchKnowledge(sql2, embedModel, agentId, query, limit);
+          return searchKnowledge(sql2, provider, agentId, query, limit);
         }
       };
     }
@@ -4965,8 +5582,7 @@ function createRunner(deps) {
     }
     const system = agent2.system_prompt || void 0;
     if (params.stream) {
-      const result = streamText2({
-        model,
+      const result = provider.streamText({
         system,
         messages: messages2,
         tools: Object.keys(tools).length > 0 ? tools : void 0
@@ -4991,8 +5607,7 @@ function createRunner(deps) {
       });
       return { stream: sseStream };
     } else {
-      const result = await generateText3({
-        model,
+      const result = await provider.generateText({
         system,
         messages: messages2,
         tools: Object.keys(tools).length > 0 ? tools : void 0
@@ -5011,20 +5626,20 @@ function createRunner(deps) {
     }
   }
   async function addKnowledge(agentId, title, content) {
-    const embedModel = getEmbeddingModel();
     const chunks = chunkContent(content);
     const [first] = chunks;
-    const { embedding } = await embed2({ model: embedModel, value: first });
+    const embedding = await provider.embed(first);
     const vec = `[${embedding.join(",")}]`;
     const [doc] = await sql2.unsafe(
       `INSERT INTO "_knowledge_documents" ("agent_id", "title", "content", "embedding") VALUES ($1, $2, $3, $4::vector) RETURNING *`,
       [agentId, title, first, vec]
     );
     for (let i = 1; i < chunks.length; i++) {
-      const { embedding: emb } = await embed2({ model: embedModel, value: chunks[i] });
+      const emb = await provider.embed(chunks[i]);
+      const vec2 = `[${emb.join(",")}]`;
       await sql2.unsafe(
         `INSERT INTO "_knowledge_documents" ("agent_id", "title", "content", "embedding") VALUES ($1, $2, $3, $4::vector)`,
-        [agentId, `${title} (${i + 1})`, chunks[i], `[${emb.join(",")}]`]
+        [agentId, `${title} (${i + 1})`, chunks[i], vec2]
       );
     }
     return doc;
@@ -5033,31 +5648,11 @@ function createRunner(deps) {
 }
 
 // agent/client.ts
-function createModelsFromEnv() {
-  const baseURL = process.env.OPENAI_BASE_URL || "http://localhost:11434/v1";
-  const apiKey = process.env.OPENAI_API_KEY || "ollama";
-  const modelName = process.env.OPENAI_MODEL || "qwen3:0.6b";
-  const embedModelName = process.env.OPENAI_EMBEDDING_MODEL || "qwen3-embedding:0.6b";
-  const provider = createOpenAI2({ baseURL, apiKey });
-  return {
-    model: provider(modelName),
-    embeddingModel: provider.embedding(embedModelName),
-    dimension: parseInt(process.env.EMBEDDING_DIMENSION || "1024", 10)
-  };
-}
 function agent(options) {
   const pg = options.pg;
   const sql2 = pg.sql;
-  const model = options.model;
-  const embeddingModel = options.embeddingModel;
-  const dimension = options.embeddingDimension ?? 1024;
-  const defaultModels = !model || !embeddingModel ? createModelsFromEnv() : null;
-  function getModel() {
-    return model ?? defaultModels.model;
-  }
-  function getEmbeddingModel() {
-    return embeddingModel ?? defaultModels.embeddingModel;
-  }
+  const resolvedProvider = options.provider ?? aiProvider();
+  const dimension = options.embeddingDimension ?? resolvedProvider.dimension;
   const agentsTable = pg.table("_agents", {
     id: serial("id").primaryKey(),
     tenant_id: text("tenant_id"),
@@ -5094,7 +5689,7 @@ function agent(options) {
     trace_id: text("trace_id"),
     created_at: timestamptz("created_at").notNull().default(sql`NOW()`)
   });
-  const runner = createRunner({ sql: sql2, agents: agentsTable, runs: runsTable, knowledge: knowledgeTable, getModel, getEmbeddingModel, userTools: options.tools });
+  const runner = createRunner({ sql: sql2, agents: agentsTable, runs: runsTable, knowledge: knowledgeTable, provider: resolvedProvider, userTools: options.tools });
   const base = new PgModule(pg);
   const r = buildRouter2({ agents: agentsTable, runs: runsTable, knowledge: knowledgeTable, runner });
   const mod = r;
@@ -5635,7 +6230,7 @@ function createGateway(config, getPort) {
 }
 
 // deploy/manager.ts
-import crypto5 from "node:crypto";
+import crypto6 from "node:crypto";
 
 // deploy/process.ts
 import { fork } from "node:child_process";
@@ -5694,7 +6289,7 @@ function createManager(config, apps, manager) {
     const token = header.replace("Bearer ", "");
     const tokenBuf = Buffer.from(token);
     const secretBuf = Buffer.from(config.deployToken);
-    if (tokenBuf.length !== secretBuf.length || !crypto5.timingSafeEqual(tokenBuf, secretBuf)) {
+    if (tokenBuf.length !== secretBuf.length || !crypto6.timingSafeEqual(tokenBuf, secretBuf)) {
       return Response.json({ error: "Unauthorized" }, { status: 401 });
     }
     return next(req, ctx);
@@ -5990,7 +6585,7 @@ import { createOpenAI as createOpenAI3 } from "@ai-sdk/openai";
 // ssr.ts
 import { createElement as createElement3 } from "react";
 import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync4, readdirSync } from "node:fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync } from "node:fs";
 import { readdir, stat } from "node:fs/promises";
 import { dirname as dirname3, join as join5, resolve as resolve6, relative as relative2 } from "node:path";
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
@@ -6107,6 +6702,7 @@ function compile(path2) {
   return isDev() ? compileTsxDev(path2) : compileTsx(path2);
 }
 var vendorBundle = null;
+var vendorHash = "";
 async function compileVendorBundle() {
   if (vendorBundle) return vendorBundle;
   if (!_userRequire) _userRequire = createRequire(join2(process.cwd(), "package.json"));
@@ -6121,8 +6717,18 @@ async function compileVendorBundle() {
     const keys = Object.keys(mod).filter((k) => !k.startsWith("_") && k !== "default");
     modules[request] = keys;
   }
-  const wfwMod = _userRequire("weifuwu/react");
-  const wfwKeys = Object.keys(wfwMod).filter((k) => !k.startsWith("_") && k !== "default");
+  const reactTsPath = resolve3(import.meta.dirname ?? __dirname, "react.ts");
+  const reactSrc = readFileSync2(reactTsPath, "utf-8");
+  const wfwKeys = [];
+  for (const line of reactSrc.split("\n")) {
+    const m = line.match(/^export\s+\{[^}]+\}\s*from/);
+    if (m) {
+      const names = line.slice(line.indexOf("{") + 1, line.indexOf("}")).split(",").map((s) => s.trim()).filter(Boolean);
+      for (const n of names) {
+        if (!n.startsWith("type ") && !wfwKeys.includes(n)) wfwKeys.push(n);
+      }
+    }
+  }
   const used = /* @__PURE__ */ new Set();
   const stmts = [""];
   for (const [request, keys] of Object.entries(modules)) {
@@ -6130,7 +6736,7 @@ async function compileVendorBundle() {
     if (unique.length > 0) stmts.push(`export { ${unique.join(", ")} } from ${JSON.stringify(request)};`);
   }
   const uidWfw = wfwKeys.filter((k) => !used.has(k) && used.add(k));
-  if (uidWfw.length > 0) stmts.push(`export { ${uidWfw.join(", ")} } from 'weifuwu/react';`);
+  if (uidWfw.length > 0) stmts.push(`export { ${uidWfw.join(", ")} } from ${JSON.stringify(reactTsPath)};`);
   const result = await esbuild.build({
     stdin: { contents: stmts.join("\n"), resolveDir: process.cwd() },
     format: "esm",
@@ -6138,13 +6744,68 @@ async function compileVendorBundle() {
     write: false
   });
   vendorBundle = new TextDecoder().decode(result.outputFiles[0].contents);
+  const hashBytes = new TextEncoder().encode(vendorBundle);
+  const hashBuffer = await crypto.subtle.digest("SHA-1", hashBytes);
+  vendorHash = Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 8);
   return vendorBundle;
 }
+async function compileBrowser(path2, outDir) {
+  const absPath = resolve3(path2);
+  const h = id(absPath);
+  outDir = outDir ?? resolve3(OUT_DIR);
+  const outPath = join2(outDir, h + ".js");
+  if (!isDev() && existsSync(outPath)) return h;
+  mkdirSync(outDir, { recursive: true });
+  const wfwDir = resolve3(import.meta.dirname ?? __dirname);
+  const plugin = {
+    name: "wfw-external",
+    setup(build2) {
+      build2.onResolve({ filter: /./ }, (args) => {
+        if (args.kind === "entry-point") return;
+        const abs = args.path.startsWith(".") ? join2(args.resolveDir, args.path) : args.path;
+        if (abs.startsWith(wfwDir) && !abs.includes("node_modules")) {
+          const rel = abs.slice(wfwDir.length + 1);
+          if (rel.includes("/")) return;
+          return { path: "weifuwu/react", external: true };
+        }
+      });
+    }
+  };
+  await esbuild.build({
+    entryPoints: { [h]: absPath },
+    outdir: outDir,
+    format: "esm",
+    platform: "browser",
+    jsx: "automatic",
+    jsxImportSource: "react",
+    bundle: true,
+    external: ["react", "react-dom", "react-dom/client", "react/jsx-runtime", "weifuwu", "weifuwu/react"],
+    plugins: [plugin],
+    write: true,
+    allowOverwrite: true
+  });
+  return h;
+}
 async function compileHotComponent(path2) {
   const absPath = resolve3(path2);
   const h = id(absPath);
   const stdin = `import C from ${JSON.stringify(absPath)};
 (window.__WFW_REFRESH||function(){})(C)`;
+  const wfwDir = resolve3(import.meta.dirname ?? __dirname);
+  const plugin = {
+    name: "wfw-external",
+    setup(build2) {
+      build2.onResolve({ filter: /./ }, (args) => {
+        if (args.kind === "entry-point") return;
+        const abs = args.path.startsWith(".") ? join2(args.resolveDir, args.path) : args.path;
+        if (abs.startsWith(wfwDir) && !abs.includes("node_modules")) {
+          const rel = abs.slice(wfwDir.length + 1);
+          if (rel.includes("/")) return;
+          return { path: "weifuwu/react", external: true };
+        }
+      });
+    }
+  };
   const result = await esbuild.build({
     stdin: { contents: stdin, loader: "tsx", resolveDir: dirname(absPath) },
     format: "esm",
@@ -6152,7 +6813,8 @@ async function compileHotComponent(path2) {
     jsx: "automatic",
     jsxImportSource: "react",
     bundle: true,
-    external: ["react", "react-dom", "react-dom/client", "react/jsx-runtime", "weifuwu/react"],
+    external: ["react", "react-dom", "react-dom/client", "react/jsx-runtime", "weifuwu", "weifuwu/react"],
+    plugins: [plugin],
     write: false
   });
   let code = new TextDecoder().decode(result.outputFiles[0].contents);
@@ -6177,11 +6839,10 @@ function getPublicEnv() {
   return _publicEnv;
 }
 function buildHeadPayload(opts) {
-  const { ctx, base, compiledTailwindCss, isDev: isDev3 } = opts;
+  const { ctx, base, tailwind } = opts;
   let result = "";
-  if (isDev3) {
-    const vUrl = `${base}/__wfw/v/bundle`;
-    result += `<script type="importmap">{
+  const vUrl = `${base}/__wfw/v/bundle?h=${vendorHash}`;
+  result += `<script type="importmap">{
   "imports": {
     "react": "${vUrl}",
     "react-dom": "${vUrl}",
@@ -6191,22 +6852,12 @@ function buildHeadPayload(opts) {
   }
 }</script>
 `;
-  }
-  if (ctx.prefs?.theme) {
+  if (ctx.theme?.value) {
     result += `<script>!function(){var t=(document.cookie.match(/(?:^|;\\s*)theme=([^;]+)/)||[])[1]||'system';if(t==='system'){t=window.matchMedia('(prefers-color-scheme:dark)').matches?'dark':'light'}document.documentElement.setAttribute('data-theme',t)}()</script>
 `;
   }
-  if (compiledTailwindCss) {
-    const cssUrl = ctx.tailwindCssUrl;
-    if (cssUrl) result += `<link rel="stylesheet" href="${cssUrl}" />
-`;
-  }
-  const localeData = ctx.parsed?.__localeData ?? globalThis.__LOCALE_DATA__;
-  if (localeData && Object.keys(localeData).length > 0) {
-    if (!_localeDataCache || _localeDataCache.data !== localeData) {
-      _localeDataCache = { data: localeData, json: JSON.stringify(localeData) };
-    }
-    result += `<script>window.__LOCALE_DATA__=${_localeDataCache.json}</script>
+  if (tailwind?.css) {
+    result += `<link rel="stylesheet" href="${tailwind.url}" />
 `;
   }
   const loaderData = opts.loaderData || {};
@@ -6214,7 +6865,9 @@ function buildHeadPayload(opts) {
     params: ctx.params,
     query: ctx.query,
     parsed: ctx.parsed,
-    prefs: ctx.prefs,
+    theme: ctx.theme,
+    i18n: ctx.i18n,
+    flash: ctx.flash,
     loaderData
   };
   if (ctx.user && typeof ctx.user === "object") {
@@ -6234,72 +6887,97 @@ function buildHeadPayload(opts) {
 `;
   return result;
 }
-function buildBodyScripts(opts) {
+function buildBodyScripts(opts, hydrationScript) {
   const parts = [];
-  if (opts.loaderData && Object.keys(opts.loaderData).length > 0) {
-    parts.push(`<script>window.__WEIFUWU_PROPS=${JSON.stringify(opts.loaderData)}</script>`);
-  }
-  if (opts.bundle) {
-    parts.push(`<script type="module" src="${opts.base}${opts.bundle.url}"></script>`);
-  }
+  if (hydrationScript) parts.push(hydrationScript);
   return parts.join("\n");
 }
-var _localeDataCache = null;
-function streamResponse(reactStream, opts) {
+function streamResponse(reactStream, opts, hydrationScript) {
   const decoder = new TextDecoder2();
   const encoder2 = new TextEncoder2();
-  const headPayload = buildHeadPayload(opts);
-  let buffer = "";
-  let headFlushed = false;
-  let extractedHead = "";
   const output = new ReadableStream({
     async start(controller) {
       try {
         const reader = reactStream.getReader();
-        async function push(chunk) {
-          buffer += decoder.decode(chunk, { stream: true });
-          if (!extractedHead) {
-            const m = buffer.match(/<template id="__wfw_head">([\s\S]*?)<\/template>/);
-            if (m) {
-              extractedHead = m[1];
-              buffer = buffer.replace(m[0], "");
-            }
-          }
-          if (!headFlushed) {
-            const idx = buffer.indexOf("</head>");
-            if (idx !== -1) {
-              const before = buffer.slice(0, idx);
-              let injection = "";
-              if (extractedHead) injection += "\n" + extractedHead;
-              injection += headPayload;
-              controller.enqueue(encoder2.encode(before + injection));
-              buffer = buffer.slice(idx);
-              headFlushed = true;
-            }
-            return;
-          }
-          controller.enqueue(encoder2.encode(buffer));
-          buffer = "";
-        }
+        let html = "";
         while (true) {
           const { done, value } = await reader.read();
           if (done) break;
-          await push(value);
+          html += decoder.decode(value, { stream: true });
+        }
+        html += decoder.decode();
+        const headTmpl = html.match(/<template id="__wfw_head">([\s\S]*?)<\/template>/);
+        if (headTmpl) {
+          const extractedHead = headTmpl[1];
+          html = html.replace(headTmpl[0], "");
+          const headIdx2 = html.indexOf("</head>");
+          if (headIdx2 !== -1) {
+            html = html.slice(0, headIdx2) + "\n" + extractedHead + html.slice(headIdx2);
+          }
+        }
+        const headPayload = buildHeadPayload(opts);
+        const headIdx = html.indexOf("</head>");
+        if (headIdx !== -1) {
+          html = html.slice(0, headIdx) + headPayload + html.slice(headIdx);
         }
-        buffer = buffer.replace(/<template id="__wfw_head">[\s\S]*?<\/template>/g, "");
-        if (buffer) controller.enqueue(encoder2.encode(buffer));
-        const body = buildBodyScripts(opts);
-        if (body) controller.enqueue(encoder2.encode("\n" + body));
+        let bodyScripts = "";
+        const built = buildBodyScripts(opts, hydrationScript);
+        if (built) bodyScripts += built;
         if (opts.isDev) {
           const wsUrl = `${opts.base}/__weifuwu/livereload`;
           const hbUrl = `${opts.base}/__wfw/h/`;
-          controller.enqueue(encoder2.encode(
-            `
-<script>(function(){var ws=new WebSocket((location.protocol==='https:'?'wss:':'ws:')+'//'+location.host+'${wsUrl}');var t=0;ws.onmessage=function(e){try{var m=JSON.parse(e.data);if(m.type==='component'){if(m.entry&&m.entry!==window.__WFW_ENTRY)return;import('${hbUrl}'+m.hash+'?'+Date.now()).catch(function(){location.reload()});if(m.css){var s=document.querySelector('style[data-lr]')||function(){var x=document.createElement('style');x.setAttribute('data-lr','');document.head.appendChild(x);return x}();s.textContent=m.css}return}if(m.type==='css'){var s=document.querySelector('style[data-lr]')||function(){var x=document.createElement('style');x.setAttribute('data-lr','');document.head.appendChild(x);return x}();s.textContent=m.css;return}}catch(_){}if(e.data==='reload'&&Date.now()-t>1e3){t=Date.now();location.reload()}};ws.onclose=function(){if(Date.now()-t>1e3){t=Date.now();setTimeout(function(){location.reload()},500)}}})()</script>`
-          ));
+          bodyScripts += `
+<script>
+(function(){
+var ws=new WebSocket((location.protocol==='https:'?'wss:':'ws:')+'//'+location.host+'${wsUrl}');
+var t=0;
+ws.onmessage=function(e){
+  try{
+    var m=JSON.parse(e.data);
+    if(m.type==='component'){
+      import('${hbUrl}'+m.hash+'?t='+Date.now()).catch(function(){location.reload()});
+      if(m.css){
+        var s=document.querySelector('style[data-lr]')||function(){
+          var x=document.createElement('style');
+          x.setAttribute('data-lr','');
+          document.head.appendChild(x);
+          return x
+        }();
+        s.textContent=m.css
+      }
+      return
+    }
+    if(m.type==='css'){
+      var s=document.querySelector('style[data-lr]')||function(){
+        var x=document.createElement('style');
+        x.setAttribute('data-lr','');
+        document.head.appendChild(x);
+        return x
+      }();
+      s.textContent=m.css
+      return
+    }
+  }catch(_){}
+  if(e.data==='reload'&&Date.now()-t>1e3){t=Date.now();location.reload()}
+};
+ws.onclose=function(){
+  if(Date.now()-t>1e3){
+    t=Date.now();
+    setTimeout(function(){location.reload()},500)
+  }
+};
+})();
+</script>`;
+        }
+        if (bodyScripts) {
+          const bodyIdx = html.lastIndexOf("</body>");
+          if (bodyIdx !== -1) {
+            html = html.slice(0, bodyIdx) + bodyScripts + html.slice(bodyIdx);
+          }
         }
+        controller.enqueue(encoder2.encode(html));
       } catch {
-        const fallback = `<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>500</title></head><body><h1>500 - Internal Server Error</h1></body></html>`;
+        const fallback = '<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>500</title></head><body><h1>500 - Internal Server Error</h1></body></html>';
         controller.enqueue(encoder2.encode(fallback));
       } finally {
         controller.close();
@@ -6329,9 +7007,9 @@ function tailwindContext(dir) {
       await compileTailwindCss(cssPath, cssDir);
     }
     const entry = cssCache.get(cssPath);
-    ctx.compiledTailwindCss = entry.css;
     const base = (ctx.mountPath || "").replace(/\/$/, "");
-    ctx.tailwindCssUrl = base ? `${base}/__wfw/style/${entry.hash}.css` : `/__wfw/style/${entry.hash}.css`;
+    const url = base ? `${base}/__wfw/style/${entry.hash}.css` : `/__wfw/style/${entry.hash}.css`;
+    ctx.tailwind = { css: entry.css, url };
     return next(req, ctx);
   };
 }
@@ -6425,6 +7103,8 @@ function liveWs() {
 }
 function liveRouter(dir) {
   const r = new Router();
+  compileVendorBundle().catch(() => {
+  });
   r.get("/__wfw/v/bundle", async () => {
     const code = await compileVendorBundle();
     return new Response(code, {
@@ -6472,7 +7152,6 @@ function liveWatcher(dir) {
         return broadcastReload();
       }
       clearCompileCache();
-      markClientBundleDirty();
       const targets = existsSync3(entryPath) ? [entryPath] : findEntries(resolve5(filePath));
       if (targets.length === 0) return broadcastReload();
       try {
@@ -6578,7 +7257,7 @@ function errorBoundary(errorPath) {
         ctx,
         base,
         isDev: isDev(),
-        compiledTailwindCss: ctx.compiledTailwindCss,
+        tailwind: ctx.tailwind,
         status: 500
       });
     }
@@ -6589,25 +7268,6 @@ function errorBoundary(errorPath) {
 var isDev2 = isDev();
 var als2 = new AsyncLocalStorage2();
 __registerAls(() => als2.getStore());
-var bundleCache = /* @__PURE__ */ new Map();
-var _bundleDirty = false;
-function markClientBundleDirty() {
-  _bundleDirty = true;
-}
-function getBundle(key) {
-  if (_bundleDirty) {
-    bundleCache.clear();
-    _bundleDirty = false;
-  }
-  return bundleCache.get(key);
-}
-function setBundle(key, buf) {
-  if (_bundleDirty) {
-    bundleCache.clear();
-    _bundleDirty = false;
-  }
-  bundleCache.set(key, buf);
-}
 function hashId(s) {
   return createHash3("md5").update(s).digest("hex").slice(0, 8);
 }
@@ -6722,50 +7382,40 @@ async function resolveRoute(ssrDir, segments, routeCache) {
   routeCache.set(cacheKey, result);
   return result;
 }
-async function buildClientBundle(entryPath, layoutPaths) {
-  try {
-    const absEntry = resolve6(entryPath);
-    const absLayouts = layoutPaths.map((p) => resolve6(p));
-    const layoutImports = absLayouts.map((p) => `import${JSON.stringify(p)};`).join("");
-    const _sc = `(function(){var k='__WEIFUWU_CTX_STORE';var s=typeof globalThis!='undefined'&&globalThis[k];if(!s)return function(){};return function(v){s._ctx={...s._ctx,...v};s._snapshot={params:s._ctx.params,query:s._ctx.query,user:s._ctx.user,parsed:s._ctx.parsed,prefs:s._ctx.prefs,env:s._ctx.env};s._listeners.forEach(function(fn){fn()})}})()`;
-    const code = [
-      layoutImports,
-      `${isDev2 ? "import{createRoot}from'react-dom/client';" : "import{hydrateRoot}from'react-dom/client';"}`,
-      `import{createElement}from'react';`,
-      `import{TsxContext}from'weifuwu/react';`,
-      `import P from${JSON.stringify(absEntry)};`,
-      `var setCtx=${_sc};`,
-      `const c=document.getElementById('__weifuwu_root');`,
-      `if(window.__WEIFUWU_PROPS)setCtx({loaderData:window.__WEIFUWU_PROPS});`,
-      isDev2 ? `const _W=function(props){return(_W._fn||P)(props)};_W._fn=P;const _P=function(props){return createElement(_W,props)};` : "",
-      isDev2 ? `window.__WFW_ENTRY=${JSON.stringify(hashId(absEntry))};window.__WFW_REFRESH=function(n){_W._fn=n;window.__WFW_ROOT.render(createElement(App))};` : "",
-      `function App(){`,
-      `const ctx=window.__WEIFUWU_CTX||{};`,
-      `return createElement(TsxContext.Provider,{value:ctx},`,
-      isDev2 ? `createElement(_P,null))` : `createElement(P,null))`,
-      `}`,
-      isDev2 ? `window.__WFW_ROOT=createRoot(c);window.__WFW_ROOT.render(createElement(App));` : `hydrateRoot(c,createElement(App));`
-    ].filter(Boolean).join("");
-    const { default: esbuild2 } = await import("esbuild");
-    const result = await esbuild2.build({
-      stdin: { contents: code, loader: "tsx", resolveDir: dirname3(absEntry) },
-      bundle: true,
-      format: "esm",
-      jsx: "automatic",
-      jsxImportSource: "react",
-      banner: { js: "self.process={env:{}};" },
-      loader: { ".node": "empty" },
-      external: isDev2 ? ["react", "react-dom", "react-dom/client", "react/jsx-runtime", "weifuwu", "weifuwu/react"] : void 0,
-      write: false,
-      minify: !isDev2
-    });
-    return result.outputFiles[0].contents;
-  } catch (err) {
-    console.error("hydration bundle failed:", err);
-    return null;
-  }
+function buildHydrationScript(entryId, ctxJson, base) {
+  const ssrPrefix = `${base}/__ssr`;
+  return `
+<script type="module">
+import { setCtx, TsxContext } from 'weifuwu/react';
+import { createElement } from 'react';
+import { hydrateRoot, createRoot } from 'react-dom/client';
+
+const _ctx = ${ctxJson};
+setCtx(_ctx);
+
+const _root = document.getElementById('__weifuwu_root');
+
+async function init() {
+  const { default: Page } = await import('${ssrPrefix}/${entryId}.js');
+  const app = createElement(TsxContext.Provider, { value: _ctx },
+    createElement(Page));
+  ${isDev2 ? `
+  const reactRoot = createRoot(_root);
+  reactRoot.render(app);
+  window.__WFW_REFRESH = async (NewComponent) => {
+    const store = globalThis.__WEIFUWU_CTX_STORE?._ctx || _ctx;
+    reactRoot.render(createElement(TsxContext.Provider, { value: store },
+      createElement(NewComponent)));
+  };
+  ` : `
+  hydrateRoot(_root, app);
+  `}
 }
-function renderPage(pageFile) {
+
+init();
+</script>`;
+}
+function renderPage(pageFile, outDir) {
   const absPath = resolve6(pageFile);
   const entryId = hashId(absPath);
   ssrEntries.set(entryId, { path: absPath });
@@ -6791,15 +7441,15 @@ function renderPage(pageFile) {
       query: ctx.query,
       user: ctx.user ?? {},
       parsed: ctx.parsed ?? {},
-      prefs: ctx.prefs ?? {},
+      theme: ctx.theme,
+      i18n: ctx.i18n,
+      flash: ctx.flash,
       loaderData,
       env: ctx.env ?? {}
     };
     return als2.run(ctxValue, async () => {
       setCtx(ctxValue);
-      if (ctxValue.parsed?.__localeData) {
-        globalThis.__LOCALE_DATA__ = ctxValue.parsed.__localeData;
-      }
+      await compileBrowser(absPath, outDir);
       let element = createElement3(
         "div",
         { id: "__weifuwu_root" },
@@ -6810,24 +7460,15 @@ function renderPage(pageFile) {
         )
       );
       element = buildHtmlShell("weifuwu", element, layoutComponents);
-      let bundle = null;
-      if (!getBundle(bundleKey)) {
-        const buf = await buildClientBundle(absPath, layoutPaths);
-        if (buf) setBundle(bundleKey, buf);
-      }
-      if (getBundle(bundleKey)) {
-        bundle = { url: bundleKey };
-      }
       const { renderToReadableStream } = await import("react-dom/server");
       const stream = await renderToReadableStream(element);
       return streamResponse(stream, {
         ctx,
         base,
         isDev: isDev2,
-        bundle,
         loaderData,
-        compiledTailwindCss: ctx.compiledTailwindCss
-      });
+        tailwind: ctx.tailwind
+      }, buildHydrationScript(entryId, JSON.stringify(ctxValue), base));
     });
   };
 }
@@ -6873,11 +7514,23 @@ function discoverRoutes(dir) {
 function ssr(opts) {
   const r = new Router();
   const dir = resolve6(opts.dir);
+  const outDir = resolve6(OUT_DIR);
   const routeCache = /* @__PURE__ */ new Map();
-  r.get("/__ssr/:path", (req, ctx) => {
-    const buf = getBundle("/__ssr/" + ctx.params.path);
-    if (!buf) return new Response("", { status: 404 });
-    return new Response(buf, {
+  compileVendorBundle().catch(() => {
+  });
+  r.get("/__ssr/:file", (req, ctx) => {
+    const filePath = join5(outDir, ctx.params.file);
+    if (!filePath.startsWith(outDir) || !existsSync4(filePath)) {
+      return new Response("Not Found", { status: 404 });
+    }
+    const content = readFileSync4(filePath, "utf-8");
+    return new Response(content, {
+      headers: { "content-type": "application/javascript; charset=utf-8" }
+    });
+  });
+  r.get("/__wfw/v/bundle", async () => {
+    const code = await compileVendorBundle();
+    return new Response(code, {
       headers: { "content-type": "application/javascript; charset=utf-8" }
     });
   });
@@ -6904,7 +7557,7 @@ function ssr(opts) {
       ...resolved.layoutFiles.map((f) => layout(f)),
       tailwindContext(dir)
     ];
-    const handler = (req2, ctx2) => renderPage(resolved.pageFile)(req2, ctx2);
+    const handler = (req2, ctx2) => renderPage(resolved.pageFile, outDir)(req2, ctx2);
     return runChain(mws, handler, req, ctx);
   });
   const mod = r;
@@ -6994,13 +7647,13 @@ async function addToolMessages(sql2, sessionId, toolCalls, toolResults) {
 }
 
 // opencode/run.ts
-import { streamText as streamText3, stepCountIs } from "ai";
+import { streamText as streamText2, stepCountIs } from "ai";
 async function* executeGenerator(opts) {
   const { sessionId, input, model, tools, systemPrompt, messages: messages2, sql: sql2, abortSignal } = opts;
   const lastStepToolCalls = [];
   let currentAssistantText = "";
   let currentUsage = { promptTokens: 0, completionTokens: 0, totalTokens: 0 };
-  const result = streamText3({
+  const result = streamText2({
     model,
     system: systemPrompt,
     messages: [
@@ -7167,7 +7820,7 @@ function createBashTool(ctx) {
 // opencode/tools/read.ts
 import { tool as tool4 } from "ai";
 import { z as z6 } from "zod";
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
 import { resolve as resolve7 } from "node:path";
 function createReadTool(ctx) {
   return tool4({
@@ -7179,10 +7832,10 @@ function createReadTool(ctx) {
     }),
     execute: async ({ path: path2, offset, limit }) => {
       const resolved = resolve7(ctx.workspace, path2);
-      if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions)) {
+      if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions.permissions)) {
         return { error: "Path not allowed", content: null, totalLines: 0 };
       }
-      const content = readFileSync4(resolved, "utf-8");
+      const content = readFileSync5(resolved, "utf-8");
       const lines = content.split("\n");
       const totalLines = lines.length;
       if (offset !== void 0) {
@@ -7220,7 +7873,7 @@ function createWriteTool(ctx) {
     }),
     execute: async ({ path: path2, content }) => {
       const resolved = resolve8(ctx.workspace, path2);
-      if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions)) {
+      if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions.permissions)) {
         return { error: "Path not allowed" };
       }
       mkdirSync3(dirname4(resolved), { recursive: true });
@@ -7233,7 +7886,7 @@ function createWriteTool(ctx) {
 // opencode/tools/edit.ts
 import { tool as tool6 } from "ai";
 import { z as z8 } from "zod";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
 import { resolve as resolve9 } from "node:path";
 function createEditTool(ctx) {
   return tool6({
@@ -7246,10 +7899,10 @@ function createEditTool(ctx) {
     }),
     execute: async ({ path: path2, oldString, newString, replaceAll }) => {
       const resolved = resolve9(ctx.workspace, path2);
-      if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions)) {
+      if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions.permissions)) {
         return { error: "Path not allowed" };
       }
-      const content = readFileSync5(resolved, "utf-8");
+      const content = readFileSync6(resolved, "utf-8");
       if (replaceAll) {
         if (!content.includes(oldString)) {
           return { error: "oldString not found in file", replaced: 0 };
@@ -7434,7 +8087,7 @@ ${availableList}
       name: z13.string().describe("The name of the skill to load")
     }),
     execute: async ({ name }) => {
-      if (!isSkillAllowed(name, ctx.permissions)) {
+      if (!isSkillAllowed(name, ctx.permissions.permissions)) {
         return { error: `Skill "${name}" is not permitted` };
       }
       const skill = ctx.skillsRegistry.get(name);
@@ -7455,28 +8108,28 @@ ${availableList}
 // opencode/tools/index.ts
 function createTools(ctx) {
   const tools = {};
-  if (isToolEnabled("bash", ctx.permissions)) {
+  if (isToolEnabled("bash", ctx.permissions.permissions)) {
     tools.bash = createBashTool(ctx);
   }
-  if (isToolEnabled("read", ctx.permissions)) {
+  if (isToolEnabled("read", ctx.permissions.permissions)) {
     tools.read = createReadTool(ctx);
   }
-  if (isToolEnabled("write", ctx.permissions)) {
+  if (isToolEnabled("write", ctx.permissions.permissions)) {
     tools.write = createWriteTool(ctx);
   }
-  if (isToolEnabled("edit", ctx.permissions)) {
+  if (isToolEnabled("edit", ctx.permissions.permissions)) {
     tools.edit = createEditTool(ctx);
   }
-  if (isToolEnabled("grep", ctx.permissions)) {
+  if (isToolEnabled("grep", ctx.permissions.permissions)) {
     tools.grep = createGrepTool(ctx);
   }
-  if (isToolEnabled("glob", ctx.permissions)) {
+  if (isToolEnabled("glob", ctx.permissions.permissions)) {
     tools.glob = createGlobTool(ctx);
   }
-  if (isToolEnabled("web", ctx.permissions)) {
+  if (isToolEnabled("web", ctx.permissions.permissions)) {
     tools.web = createWebTool(ctx);
   }
-  if (ctx.skillsRegistry.all.length > 0 && isToolEnabled("skill", ctx.permissions)) {
+  if (ctx.skillsRegistry.all.length > 0 && isToolEnabled("skill", ctx.permissions.permissions)) {
     tools.skill = createSkillTool(ctx);
   }
   tools.question = createQuestionTool(ctx);
@@ -7485,7 +8138,7 @@ function createTools(ctx) {
 
 // opencode/rest.ts
 async function buildRouter4(deps) {
-  const { sql: sql2, model, workspace, systemPrompt, skills, skillsRegistry, permissions, pendingQuestions } = deps;
+  const { sql: sql2, model, workspace, systemPrompt, skills, skillsRegistry, permissions: permissions2, pendingQuestions } = deps;
   const router = new Router();
   router.post("/sessions", async (req, ctx) => {
     const body = await req.json().catch(() => ({}));
@@ -7520,7 +8173,7 @@ async function buildRouter4(deps) {
     if (!content) return new Response("Missing content", { status: 400 });
     const toolCtx = {
       workspace: session2.workspace || workspace,
-      permissions,
+      permissions: permissions2,
       pendingQuestions,
       skillsRegistry: deps.skillsRegistry
     };
@@ -7578,7 +8231,7 @@ async function buildRouter4(deps) {
 // opencode/ws.ts
 var clients2 = /* @__PURE__ */ new WeakMap();
 function createWSHandler2(deps) {
-  const { sql: sql2, model, workspace, systemPrompt, skills, skillsRegistry, permissions, pendingQuestions } = deps;
+  const { sql: sql2, model, workspace, systemPrompt, skills, skillsRegistry, permissions: permissions2, pendingQuestions } = deps;
   return {
     open(ws, ctx) {
       const userId = ctx.user?.id ?? 0;
@@ -7628,7 +8281,7 @@ function createWSHandler2(deps) {
             }
             const toolCtx = {
               workspace: session2.workspace || workspace,
-              permissions,
+              permissions: permissions2,
               pendingQuestions,
               skillsRegistry
             };
@@ -7790,7 +8443,7 @@ async function opencode(options) {
   const workspace = options.workspace || process.cwd();
   const systemPrompt = options.systemPrompt;
   const manualSkills = options.skills || [];
-  const permissions = options.permissions;
+  const permissions2 = options.permissions;
   const modelName = options.model || "deepseek-v4-flash";
   const [discoveredSkills] = await Promise.all([discoverSkills(workspace)]);
   const skillsRegistry = buildSkillRegistry(discoveredSkills, manualSkills);
@@ -7798,7 +8451,7 @@ async function opencode(options) {
   const model = provider.chat(modelName);
   const pendingQuestions = /* @__PURE__ */ new Map();
   const base = new PgModule(pg);
-  const r = await buildRouter4({ sql: sql2, model, workspace, systemPrompt, skills: manualSkills, skillsRegistry, permissions, pendingQuestions });
+  const r = await buildRouter4({ sql: sql2, model, workspace, systemPrompt, skills: manualSkills, skillsRegistry, permissions: permissions2, pendingQuestions });
   const mod = r;
   mod.migrate = async () => {
     const sessions2 = pg.table("_opencode_sessions", {
@@ -7831,7 +8484,7 @@ async function opencode(options) {
     await messages2.create();
     await messages2.createIndex(["session_id", "created_at"]);
   };
-  mod.wsHandler = () => createWSHandler2({ sql: sql2, model, workspace, systemPrompt, skills: manualSkills, skillsRegistry, permissions, pendingQuestions });
+  mod.wsHandler = () => createWSHandler2({ sql: sql2, model, workspace, systemPrompt, skills: manualSkills, skillsRegistry, permissions: permissions2, pendingQuestions });
   mod.close = () => base.close();
   return mod;
 }
@@ -8101,12 +8754,49 @@ function analytics(options) {
   return mod;
 }
 
-// preferences.ts
+// theme.ts
+function makeSetTheme(cookie, location) {
+  return (value, loc) => {
+    const finalLoc = loc ?? location;
+    const c = `${cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
+    return new Response(null, { status: 302, headers: { Location: finalLoc, "Set-Cookie": c } });
+  };
+}
+function theme(options) {
+  const opts = { default: "system", cookie: "theme", ...options };
+  return async (req, ctx, next) => {
+    const url = new URL(req.url);
+    const match = url.pathname.match(/^\/__theme\/([\w-]+)$/);
+    if (match && req.method === "GET") {
+      const value = match[1];
+      const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
+      const accept = req.headers.get("accept") ?? "";
+      if (accept.includes("application/json")) {
+        return Response.json({ ok: true, theme: value }, { headers: { "Set-Cookie": cookie } });
+      }
+      const referer = req.headers.get("referer") || "/";
+      return new Response(null, { status: 302, headers: { Location: referer, "Set-Cookie": cookie } });
+    }
+    let themeValue = opts.default;
+    if (opts.cookie) {
+      const fromCookie = getCookies(req)[opts.cookie];
+      if (fromCookie) themeValue = fromCookie;
+    }
+    ctx.theme = {
+      value: themeValue,
+      set: makeSetTheme(opts.cookie, req.headers.get("referer") || "/")
+    };
+    return next(req, ctx);
+  };
+}
+
+// i18n.ts
 import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
 import { join as join7, resolve as resolve13 } from "node:path";
-var defaults = {
-  locale: { default: "en", cookie: "locale", fromAcceptLanguage: true },
-  theme: { default: "system", cookie: "theme" }
+var DEFAULTS2 = {
+  default: "en",
+  cookie: "locale",
+  fromAcceptLanguage: true
 };
 function translate(msgs, key, params, fallback) {
   const msg = key.split(".").reduce((o, k) => o?.[k], msgs);
@@ -8118,130 +8808,125 @@ function translate(msgs, key, params, fallback) {
   }
   return result;
 }
-function prefCookie(name, value) {
-  return `${name}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
-}
-async function handlePrefSwitch(req, value, cookieName, load) {
-  const isJson = req.headers.get("accept")?.includes("application/json");
-  if (isJson) {
-    const result = { ok: true };
-    if (cookieName === "locale" || cookieName === "lang") {
-      result.locale = value;
-      const messages2 = await load(value);
-      if (Object.keys(messages2).length > 0) result.messages = messages2;
-    } else {
-      result.theme = value;
-    }
-    return Response.json(result, {
-      headers: { "Set-Cookie": prefCookie(cookieName, value) }
-    });
-  }
-  const referer = req.headers.get("referer") || "/";
-  return new Response(null, {
-    status: 302,
-    headers: { Location: referer, "Set-Cookie": prefCookie(cookieName, value) }
-  });
-}
-function preferences(options) {
-  const dir = options.dir ? resolve13(options.dir) : void 0;
-  const localeOpts = { ...defaults.locale, ...options.locale };
-  const themeOpts = { ...defaults.theme, ...options.theme };
+function i18n(options) {
+  const opts = { ...DEFAULTS2, ...options };
+  const dir = opts.dir ? resolve13(opts.dir) : void 0;
   const cache3 = /* @__PURE__ */ new Map();
   function validLocale(locale) {
     return /^[\w-]+$/.test(locale) && !locale.includes("..");
   }
-  async function load(locale) {
-    if (!dir) return {};
-    if (!validLocale(locale)) return {};
+  async function loadMessages(locale) {
+    if (opts.messages?.[locale] && Object.keys(opts.messages[locale]).length > 0) {
+      cache3.set(locale, opts.messages[locale]);
+      return opts.messages[locale];
+    }
+    if (!dir || !validLocale(locale)) return {};
     const cached = cache3.get(locale);
     if (cached) return cached;
     const filePath = join7(dir, `${locale}.json`);
-    let data = null;
     try {
       await stat2(filePath);
       const content = await readFile2(filePath, "utf-8");
-      data = JSON.parse(content);
+      const data = JSON.parse(content);
       cache3.set(locale, data);
       return data;
     } catch {
     }
-    if (!data) {
-      const short = locale.split("-")[0];
-      if (short !== locale) {
-        const fallback = cache3.get(short) || await load(short);
-        if (fallback && Object.keys(fallback).length > 0) {
-          cache3.set(locale, fallback);
-          return fallback;
-        }
+    const short = locale.split("-")[0];
+    if (short !== locale) {
+      const fallback = cache3.get(short) || await loadMessages(short);
+      if (fallback && Object.keys(fallback).length > 0) {
+        cache3.set(locale, fallback);
+        return fallback;
       }
     }
     return {};
   }
+  function detectLocale(req) {
+    if (opts.cookie) {
+      const fromCookie = getCookies(req)[opts.cookie];
+      if (fromCookie && validLocale(fromCookie)) return fromCookie;
+    }
+    if (opts.fromAcceptLanguage) {
+      const fromHeader = req.headers.get("Accept-Language")?.split(",")[0]?.trim();
+      if (fromHeader && validLocale(fromHeader)) return fromHeader;
+    }
+    return opts.default;
+  }
   return async (req, ctx, next) => {
     const url = new URL(req.url);
-    const langMatch = url.pathname.match(/^\/__lang\/([\w-]+)$/);
-    if (langMatch && req.method === "GET") {
-      return handlePrefSwitch(req, langMatch[1], localeOpts.cookie, load);
-    }
-    const themeMatch = url.pathname.match(/^\/__theme\/([\w-]+)$/);
-    if (themeMatch && req.method === "GET") {
-      return handlePrefSwitch(req, themeMatch[1], themeOpts.cookie, load);
-    }
-    const locale = detectLocale(req, localeOpts);
-    const theme = detectTheme(req, themeOpts);
-    ctx.prefs = { locale, theme };
-    if (dir) {
-      const msgs = await load(locale);
-      ctx.t = (key, params, fallback) => translate(msgs, key, params, fallback);
-      globalThis.__LOCALE_DATA__ = msgs;
-      ctx.parsed = { ...ctx.parsed, __localeData: msgs };
-    }
-    ctx.setPref = (name, value) => {
-      const cookieOpts = [`${name}=${encodeURIComponent(value)}`, "Path=/", "SameSite=Lax"];
+    const match = url.pathname.match(/^\/__lang\/([\w-]+)$/);
+    if (match && req.method === "GET") {
+      const value = match[1];
+      const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
+      const messages2 = await loadMessages(value);
+      const accept = req.headers.get("accept") ?? "";
+      if (accept.includes("application/json")) {
+        return Response.json(
+          { ok: true, locale: value, messages: Object.keys(messages2).length > 0 ? messages2 : void 0 },
+          { headers: { "Set-Cookie": cookie } }
+        );
+      }
       const referer = req.headers.get("referer") || "/";
-      return new Response(null, {
-        status: 302,
-        headers: {
-          Location: referer,
-          "Set-Cookie": cookieOpts.join("; ")
-        }
-      });
+      return new Response(null, { status: 302, headers: { Location: referer, "Set-Cookie": cookie } });
+    }
+    const locale = detectLocale(req);
+    const msgs = await loadMessages(locale);
+    ctx.i18n = {
+      locale,
+      messages: msgs,
+      t: (key, params, fallback) => translate(msgs, key, params, fallback),
+      set: (value, loc) => {
+        const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
+        const location = loc ?? (req.headers.get("referer") || "/");
+        return new Response(null, { status: 302, headers: { Location: location, "Set-Cookie": cookie } });
+      }
     };
-    const flashVal = getCookies(req)["flash"] ?? null;
-    if (flashVal) {
+    return next(req, ctx);
+  };
+}
+
+// flash.ts
+function makeSetFlash(name, location) {
+  return (data, loc) => {
+    const finalLoc = loc ?? location;
+    const value = encodeURIComponent(JSON.stringify(data));
+    return new Response(null, {
+      status: 302,
+      headers: {
+        Location: finalLoc,
+        "Set-Cookie": `${name}=${value}; Path=/; SameSite=Lax`
+      }
+    });
+  };
+}
+function flash(options) {
+  const name = options?.name ?? "flash";
+  return async (req, ctx, next) => {
+    const raw = getCookies(req)[name] ?? null;
+    const referer = req.headers.get("referer") || "/";
+    let value = void 0;
+    if (raw) {
       try {
-        ctx.prefs.flash = JSON.parse(flashVal);
+        value = JSON.parse(decodeURIComponent(raw));
       } catch {
-        ctx.prefs.flash = flashVal;
+        value = raw;
       }
     }
+    ;
+    ctx.flash = {
+      value,
+      set: makeSetFlash(name, referer)
+    };
     const res = await next(req, ctx);
-    if (flashVal) {
+    if (raw) {
       const headers = new Headers(res.headers);
-      headers.append("Set-Cookie", "flash=; Path=/; Max-Age=0");
+      headers.append("Set-Cookie", `${name}=; Path=/; Max-Age=0`);
       return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
     }
     return res;
   };
 }
-function detectLocale(req, opts) {
-  if (opts.cookie) {
-    const fromCookie = getCookies(req)[opts.cookie];
-    if (fromCookie) return fromCookie;
-  }
-  if (opts.fromAcceptLanguage) {
-    const fromHeader = req.headers.get("Accept-Language")?.split(",")[0]?.trim();
-    if (fromHeader) return fromHeader;
-  }
-  return opts.default;
-}
-function detectTheme(req, opts) {
-  if (opts.cookie) {
-    const fromCookie = getCookies(req)[opts.cookie];
-    if (fromCookie) return fromCookie;
-  }
-  return opts.default;
-}
 
 // seo.ts
 function escapeXml(s) {
@@ -8620,7 +9305,7 @@ function logdb(options) {
 }
 
 // iii/client.ts
-import crypto6 from "node:crypto";
+import crypto7 from "node:crypto";
 
 // iii/stream.ts
 function notify(channels, stream, group, item, event, data) {
@@ -9149,7 +9834,7 @@ function iii(opts = {}) {
   registerBuiltin("stream::send", (p) => stream.send(p.stream_name, p.group_id, p.type, p.data, p.id));
   registerBuiltin("stream::update", (p) => stream.update(p.stream_name, p.group_id, p.item_id, p.ops));
   function addLocalWorker(worker) {
-    const workerId = crypto6.randomUUID();
+    const workerId = crypto7.randomUUID();
     const reg = {
       id: workerId,
       name: worker.name,
@@ -9164,7 +9849,7 @@ function iii(opts = {}) {
       const triggerIds = [];
       for (const t of worker.getTriggers()) {
         if (t.input.function_id === fn.id) {
-          const tid = crypto6.randomUUID();
+          const tid = crypto7.randomUUID();
           triggers.set(tid, {
             id: tid,
             type: t.input.type,
@@ -9193,7 +9878,7 @@ function iii(opts = {}) {
     if (!worker) return;
     const handler = async (payload) => {
       if (!worker.ws) throw new Error(`Worker "${worker.name}" disconnected`);
-      const invocationId = crypto6.randomUUID();
+      const invocationId = crypto7.randomUUID();
       return new Promise((resolve14, reject) => {
         const timer = setTimeout(() => {
           pending.delete(invocationId);
@@ -9228,7 +9913,7 @@ function iii(opts = {}) {
   let engineRef = null;
   const wsHandler = createWsHandler({
     registerRemoteWorker(ws, name) {
-      const id2 = crypto6.randomUUID();
+      const id2 = crypto7.randomUUID();
       workers.set(id2, { id: id2, name, ws, functions: [], triggers: [] });
       return id2;
     },
@@ -9239,7 +9924,7 @@ function iii(opts = {}) {
       addRemoteFunction(workerId, id2);
     },
     registerRemoteTrigger(workerId, input) {
-      const tid = crypto6.randomUUID();
+      const tid = crypto7.randomUUID();
       const reg = { id: tid, ...input, workerId };
       triggers.set(tid, reg);
       const worker = workers.get(workerId);
@@ -9589,7 +10274,7 @@ function registerWorker(url) {
 }
 
 // session.ts
-import crypto7 from "node:crypto";
+import crypto8 from "node:crypto";
 var kSaved = /* @__PURE__ */ Symbol("session.saved");
 var kDestroyed = /* @__PURE__ */ Symbol("session.destroyed");
 var kId = /* @__PURE__ */ Symbol("session.id");
@@ -9665,13 +10350,33 @@ var RedisStore = class {
     await this.redis.del(this.key(sid));
   }
 };
-function createSessionObject(data, sid, store2, ttl) {
+var COOKIE_SEPARATOR = ".";
+function signSessionId(sid, secret) {
+  const hmac = crypto8.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
+  return sid + COOKIE_SEPARATOR + hmac;
+}
+function unsignSessionId(value, secret) {
+  const dot = value.lastIndexOf(COOKIE_SEPARATOR);
+  if (dot === -1) return null;
+  const sid = value.slice(0, dot);
+  const sig = value.slice(dot + 1);
+  const expected = crypto8.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
+  if (sig.length !== expected.length) return null;
+  try {
+    return crypto8.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) ? sid : null;
+  } catch {
+    return null;
+  }
+}
+var kCreatedAt = "__createdAt";
+function createSessionObject(data, sid, store2, ttl, createdAt) {
   const obj = data ?? {};
   obj[kSaved] = false;
   obj[kDestroyed] = false;
   obj[kId] = sid;
   obj[kStore] = store2;
   obj[kTtl] = ttl;
+  if (createdAt) obj[kCreatedAt] = createdAt;
   obj.save = () => {
     obj[kSaved] = true;
   };
@@ -9701,6 +10406,8 @@ function isSessionActive(session2) {
 function session(options) {
   const ttl = options?.ttl ?? 24 * 60 * 60 * 1e3;
   const cookieName = options?.cookieName ?? "__session";
+  const secret = options?.secret;
+  const rotateInterval = options?.rotateInterval ?? 9e5;
   const cookieOpts = {
     path: options?.cookie?.path ?? "/",
     domain: options?.cookie?.domain,
@@ -9720,25 +10427,38 @@ function session(options) {
     store2 = mem;
     closeStore = () => mem.close();
   }
+  function writeCookie(res, sid) {
+    const value = secret ? signSessionId(sid, secret) : sid;
+    return setCookie(res, cookieName, value, cookieOpts);
+  }
   const mw = (async (req, ctx, next) => {
     const cookies = getCookies(req);
-    const sid = cookies[cookieName];
+    const rawSid = cookies[cookieName];
+    let sid;
+    if (rawSid) {
+      sid = secret ? unsignSessionId(rawSid, secret) : rawSid;
+    }
     let session2;
     let loadedSid = sid ?? null;
+    let needsRotation = false;
     if (sid) {
       const data = await store2.get(sid);
       if (data) {
-        session2 = createSessionObject(data, sid, store2, ttl);
+        const createdAt = data[kCreatedAt] ?? Date.now();
+        session2 = createSessionObject(data, sid, store2, ttl, createdAt);
+        if (rotateInterval > 0 && Date.now() - createdAt > rotateInterval) {
+          needsRotation = true;
+        }
       } else {
         loadedSid = null;
-        session2 = createSessionObject({}, crypto7.randomUUID(), store2, ttl);
+        session2 = createSessionObject({}, crypto8.randomUUID(), store2, ttl, Date.now());
       }
     } else {
-      session2 = createSessionObject({}, crypto7.randomUUID(), store2, ttl);
+      loadedSid = null;
+      session2 = createSessionObject({}, crypto8.randomUUID(), store2, ttl, Date.now());
     }
     const snapshot = isSessionActive(session2) ? JSON.stringify(session2) : null;
     ctx.session = session2;
-    ctx.sessionId = session2.id;
     const res = await next(req, ctx);
     const currentSession = ctx.session;
     if (!currentSession || currentSession[kDestroyed]) {
@@ -9747,14 +10467,22 @@ function session(options) {
       }
       return deleteCookie(res, cookieName, cookieOpts);
     }
+    if (needsRotation && loadedSid) {
+      const newId = crypto8.randomUUID();
+      const data = JSON.parse(JSON.stringify(currentSession));
+      data[kCreatedAt] = Date.now();
+      await store2.set(newId, data, ttl);
+      await store2.destroy(loadedSid);
+      loadedSid = newId;
+      currentSession[kId] = newId;
+      currentSession[kCreatedAt] = data[kCreatedAt];
+    }
     const currentData = isSessionActive(currentSession) ? JSON.stringify(currentSession) : null;
     const wasSaved = currentSession[kSaved];
-    const changed = wasSaved || currentData !== snapshot;
+    const changed = wasSaved || needsRotation || currentData !== snapshot;
     if (!changed) {
-      if (loadedSid) {
-        if (store2 instanceof RedisStore) {
-          await store2.set(loadedSid, JSON.parse(currentData ?? "{}"), ttl);
-        }
+      if (loadedSid && store2 instanceof RedisStore) {
+        await store2.set(loadedSid, JSON.parse(currentData ?? "{}"), ttl);
       }
       return res;
     }
@@ -9763,8 +10491,10 @@ function session(options) {
       const data = JSON.parse(currentData);
       await store2.set(targetSid, data, ttl);
       if (!loadedSid) {
-        const cookieRes = setCookie(res, cookieName, targetSid, cookieOpts);
-        return cookieRes;
+        return writeCookie(res, targetSid);
+      }
+      if (needsRotation) {
+        return writeCookie(res, targetSid);
       }
     } else if (loadedSid) {
       await store2.destroy(loadedSid);
@@ -9780,7 +10510,7 @@ function session(options) {
 }
 
 // cache.ts
-import crypto8 from "node:crypto";
+import crypto9 from "node:crypto";
 var BINARY_PREFIXES = [
   "image/",
   "audio/",
@@ -9800,7 +10530,7 @@ function isCacheableStatus(status, allowed) {
   return allowed.includes(status);
 }
 function defaultCacheKey(req) {
-  const hash = crypto8.createHash("sha256");
+  const hash = crypto9.createHash("sha256");
   hash.update(req.method);
   hash.update(req.url);
   return hash.digest("hex");
@@ -10015,10 +10745,10 @@ function cache2(options) {
 }
 
 // webhook.ts
-import crypto9 from "node:crypto";
+import crypto10 from "node:crypto";
 function timingSafeEqual2(a, b) {
   try {
-    return crypto9.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    return crypto10.timingSafeEqual(Buffer.from(a), Buffer.from(b));
   } catch {
     return false;
   }
@@ -10036,7 +10766,7 @@ function createStripeVerifier(config) {
     const signature = parts["v1"];
     if (!timestamp || !signature) return { valid: false, provider: "stripe", event: "", id: void 0 };
     const signed = `${timestamp}.${body}`;
-    const expected = crypto9.createHmac("sha256", config.secret).update(signed).digest("hex");
+    const expected = crypto10.createHmac("sha256", config.secret).update(signed).digest("hex");
     const valid = timingSafeEqual2(signature, expected);
     let event = "";
     let id2;
@@ -10053,7 +10783,7 @@ function createGitHubVerifier(config) {
   return (body, headers) => {
     const sig = headers["x-hub-signature-256"];
     if (!sig) return { valid: false, provider: "github", event: "", id: void 0 };
-    const expected = `sha256=${crypto9.createHmac("sha256", config.secret).update(body).digest("hex")}`;
+    const expected = `sha256=${crypto10.createHmac("sha256", config.secret).update(body).digest("hex")}`;
     const valid = timingSafeEqual2(sig, expected);
     let event = headers["x-github-event"] ?? "";
     let id2;
@@ -10076,7 +10806,7 @@ function createSlackVerifier(config) {
       return { valid: false, provider: "slack", event: "", id: void 0 };
     }
     const sigBase = `v0:${timestamp}:${body}`;
-    const expected = `v0=${crypto9.createHmac("sha256", config.secret).update(sigBase).digest("hex")}`;
+    const expected = `v0=${crypto10.createHmac("sha256", config.secret).update(sigBase).digest("hex")}`;
     const valid = timingSafeEqual2(signature, expected);
     let event = "";
     let id2;
@@ -10237,7 +10967,7 @@ function resolveTableName(table) {
   }
   return name;
 }
-function escapeIdent(s) {
+function escapeIdent4(s) {
   return `"${s.replace(/"/g, '""')}"`;
 }
 function sqlLit(s) {
@@ -10247,11 +10977,11 @@ async function createIndex(sql2, table, fields, options) {
   const language = options?.language ?? "english";
   const tableName = resolveTableName(table);
   const indexName = options?.indexName ?? `${tableName}_fts_idx`;
-  const vectorExpr = fields.map((f) => `coalesce(${escapeIdent(f)}, '')`).join(` || ' ' || `);
+  const vectorExpr = fields.map((f) => `coalesce(${escapeIdent4(f)}, '')`).join(` || ' ' || `);
   const indexType = options?.indexType ?? "gin";
   await sql2.unsafe(`
-    CREATE INDEX IF NOT EXISTS ${escapeIdent(indexName)}
-    ON ${escapeIdent(tableName)}
+    CREATE INDEX IF NOT EXISTS ${escapeIdent4(indexName)}
+    ON ${escapeIdent4(tableName)}
     USING ${indexType}
     (to_tsvector(${sqlLit(language)}, ${vectorExpr}))
   `);
@@ -10259,7 +10989,7 @@ async function createIndex(sql2, table, fields, options) {
 async function dropIndex(sql2, table, options) {
   const tableName = resolveTableName(table);
   const indexName = options?.indexName ?? `${tableName}_fts_idx`;
-  await sql2.unsafe(`DROP INDEX IF EXISTS ${escapeIdent(indexName)}`);
+  await sql2.unsafe(`DROP INDEX IF EXISTS ${escapeIdent4(indexName)}`);
 }
 async function search(sql2, table, query, options) {
   const tableName = resolveTableName(table);
@@ -10273,13 +11003,13 @@ async function search(sql2, table, query, options) {
   }
   const sanitized = query.trim();
   if (!sanitized) return [];
-  const vectorExpr = searchFields.map((f) => `coalesce(${escapeIdent(f)}, '')`).join(` || ' ' || `);
+  const vectorExpr = searchFields.map((f) => `coalesce(${escapeIdent4(f)}, '')`).join(` || ' ' || `);
   const langLit = sqlLit(language);
   const queryLit = sqlLit(sanitized);
-  const rankColId = escapeIdent(rankCol);
-  const tableId = escapeIdent(tableName);
+  const rankColId = escapeIdent4(rankCol);
+  const tableId = escapeIdent4(tableName);
   const headlineExpr = options?.headline ? searchFields.map(
-    (f) => `ts_headline(${langLit}, ${escapeIdent(f)}, websearch_to_tsquery(${langLit}, ${queryLit}), 'MaxWords=30,MinWords=15') as ${escapeIdent(f + "_headline")}`
+    (f) => `ts_headline(${langLit}, ${escapeIdent4(f)}, websearch_to_tsquery(${langLit}, ${queryLit}), 'MaxWords=30,MinWords=15') as ${escapeIdent4(f + "_headline")}`
   ).join(",\n      ") : "";
   const sql_query = `
     SELECT
@@ -10319,14 +11049,380 @@ async function suggest(sql2, table, prefix, options) {
   const rows = await sql2.unsafe(`
     SELECT DISTINCT ts_lexize(${sqlLit(language)}, word) as tokens
     FROM (
-      SELECT regexp_split_to_table(lower(${escapeIdent(field)}), E'\\W+') as word
-      FROM ${escapeIdent(tableName)}
+      SELECT regexp_split_to_table(lower(${escapeIdent4(field)}), E'\\W+') as word
+      FROM ${escapeIdent4(tableName)}
     ) words
     WHERE word LIKE ${sqlLit(sanitized + "%")}
     LIMIT ${limit}
   `);
   return rows.map((r) => r.tokens?.[0] ?? "").filter(Boolean);
 }
+
+// s3.ts
+import {
+  S3Client,
+  PutObjectCommand,
+  GetObjectCommand,
+  DeleteObjectCommand,
+  HeadObjectCommand,
+  ListObjectsV2Command
+} from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+function s3(options) {
+  const { bucket, publicUrl } = options;
+  const client = new S3Client({
+    region: options.region ?? "us-east-1",
+    endpoint: options.endpoint,
+    forcePathStyle: options.forcePathStyle,
+    credentials: options.credentials
+  });
+  async function put(key, body, putOpts) {
+    const command = new PutObjectCommand({
+      Bucket: bucket,
+      Key: key,
+      Body: body,
+      ContentType: putOpts?.contentType,
+      CacheControl: putOpts?.cacheControl ?? "public, max-age=31536000",
+      Metadata: putOpts?.metadata
+    });
+    await client.send(command);
+    return key;
+  }
+  async function get(key) {
+    try {
+      const command = new GetObjectCommand({ Bucket: bucket, Key: key });
+      const response = await client.send(command);
+      const body = response.Body;
+      if (!body) return null;
+      return Buffer.from(await body.transformToByteArray());
+    } catch (err) {
+      if (err.name === "NoSuchKey") return null;
+      throw err;
+    }
+  }
+  async function del(key) {
+    const command = new DeleteObjectCommand({ Bucket: bucket, Key: key });
+    await client.send(command);
+  }
+  async function exists(key) {
+    try {
+      const command = new HeadObjectCommand({ Bucket: bucket, Key: key });
+      await client.send(command);
+      return true;
+    } catch (err) {
+      if (err.name === "NotFound" || err.name === "NoSuchKey") return false;
+      throw err;
+    }
+  }
+  async function url(key, urlOpts) {
+    const expiresIn = urlOpts?.expiresIn ?? 3600;
+    if (expiresIn === 0) {
+      if (!publicUrl) {
+        throw new Error(
+          "s3.url() with expiresIn=0 requires publicUrl in S3Options. Set publicUrl to enable unsigned public URLs."
+        );
+      }
+      const base = publicUrl.replace(/\/+$/, "");
+      const objectKey = key.startsWith("/") ? key.slice(1) : key;
+      return `${base}/${objectKey}`;
+    }
+    const command = new GetObjectCommand({ Bucket: bucket, Key: key });
+    return getSignedUrl(client, command, { expiresIn });
+  }
+  async function list(prefix) {
+    const keys = [];
+    let continuationToken;
+    do {
+      const command = new ListObjectsV2Command({
+        Bucket: bucket,
+        Prefix: prefix,
+        ContinuationToken: continuationToken
+      });
+      const response = await client.send(command);
+      if (response.Contents) {
+        for (const obj of response.Contents) {
+          if (obj.Key) keys.push(obj.Key);
+        }
+      }
+      continuationToken = response.NextContinuationToken;
+    } while (continuationToken);
+    return keys;
+  }
+  const mod = {
+    put,
+    get,
+    delete: del,
+    exists,
+    url,
+    list,
+    client
+  };
+  const mw = ((req, ctx, next) => {
+    ;
+    ctx.s3 = mod;
+    return next(req, ctx);
+  });
+  mw.put = put;
+  mw.get = get;
+  mw.delete = del;
+  mw.exists = exists;
+  mw.url = url;
+  mw.list = list;
+  mw.client = client;
+  return mw;
+}
+
+// kb/index.ts
+function escapeIdent5(s) {
+  return `"${s.replace(/"/g, '""')}"`;
+}
+function knowledgeBase(options) {
+  const { pg, provider, table = "_kb_docs", chunkSize = 512, chunkOverlap = 64, searchLimit = 5, searchThreshold = 0 } = options;
+  const sql2 = pg.sql;
+  const dimension = provider.dimension;
+  const docsTable = pg.table(table, {
+    id: serial("id").primaryKey(),
+    doc_key: text("doc_key").notNull(),
+    title: text("title").notNull().default(""),
+    content: text("content").notNull(),
+    chunk_index: integer("chunk_index").notNull().default(0),
+    metadata: jsonb("metadata").notNull().default(sql`'{}'::jsonb`),
+    embedding: vector("embedding", dimension),
+    created_at: timestamptz("created_at").notNull().default(sql`NOW()`)
+  });
+  async function migrate() {
+    await sql2.unsafe(`CREATE EXTENSION IF NOT EXISTS "vector"`);
+    await docsTable.create();
+    await docsTable.createIndex("doc_key");
+    await docsTable.createIndex("embedding", { type: "hnsw", operator: "vector_cosine_ops" });
+  }
+  async function ingest(key, content, ingestOpts) {
+    const title = ingestOpts?.title ?? key;
+    const meta = ingestOpts?.metadata ?? {};
+    const cs = ingestOpts?.chunkSize ?? chunkSize;
+    const co = ingestOpts?.chunkOverlap ?? chunkOverlap;
+    const chunks = chunkContent(content, cs, co);
+    const metaJson = JSON.stringify(meta);
+    await sql2.unsafe(`DELETE FROM ${escapeIdent5(table)} WHERE doc_key = $1`, [key]);
+    const embeddings = await Promise.all(chunks.map((c) => provider.embed(c)));
+    for (let i = 0; i < chunks.length; i++) {
+      const vec = `[${embeddings[i].join(",")}]`;
+      await sql2.unsafe(
+        `INSERT INTO ${escapeIdent5(table)} (doc_key, title, content, chunk_index, metadata, embedding)
+         VALUES ($1, $2, $3, $4, $5::jsonb, $6::vector)`,
+        [key, title, chunks[i], i, metaJson, vec]
+      );
+    }
+    return chunks.length;
+  }
+  async function search2(query, searchOpts) {
+    const limit = searchOpts?.limit ?? searchLimit;
+    const threshold = searchOpts?.threshold ?? searchThreshold;
+    const embedding = await provider.embed(query);
+    const vec = `[${embedding.join(",")}]`;
+    const whereClause = threshold > 0 ? `WHERE (1 - (embedding <=> $1::vector) / 2) >= ${threshold}` : "";
+    const rows = await sql2.unsafe(
+      `SELECT id, doc_key, title, content, chunk_index, metadata,
+              1 - (embedding <=> $1::vector) / 2 AS _score
+       FROM ${escapeIdent5(table)}
+       ${whereClause}
+       ORDER BY embedding <=> $1::vector
+       LIMIT ${limit}`,
+      [vec]
+    );
+    return rows.map((r) => ({
+      id: r.id,
+      key: r.doc_key,
+      title: r.title,
+      content: r.content,
+      score: r._score,
+      metadata: typeof r.metadata === "string" ? JSON.parse(r.metadata) : r.metadata ?? {}
+    }));
+  }
+  async function del(key) {
+    await sql2.unsafe(`DELETE FROM ${escapeIdent5(table)} WHERE doc_key = $1`, [key]);
+  }
+  async function list() {
+    const rows = await sql2.unsafe(`
+      SELECT doc_key, title, COUNT(*) AS chunks
+      FROM ${escapeIdent5(table)}
+      GROUP BY doc_key, title
+      ORDER BY doc_key
+    `);
+    return rows.map((r) => ({
+      key: r.doc_key,
+      title: r.title,
+      chunks: Number(r.chunks)
+    }));
+  }
+  function mw() {
+    return (req, ctx, next) => {
+      ;
+      ctx.kb = { search: search2 };
+      return next(req, ctx);
+    };
+  }
+  return {
+    ingest,
+    search: search2,
+    delete: del,
+    list,
+    migrate,
+    middleware: mw
+  };
+}
+
+// permissions.ts
+function escapeIdent6(s) {
+  return `"${s.replace(/"/g, '""')}"`;
+}
+function permissions(options) {
+  const { pg } = options;
+  const sql2 = pg.sql;
+  const prefix = options.prefix ?? "";
+  const rolesTable = `${prefix}_roles`;
+  const rolePermsTable = `${prefix}_role_permissions`;
+  const userRolesTable = `${prefix}_user_roles`;
+  async function migrate() {
+    await sql2.unsafe(`
+      CREATE TABLE IF NOT EXISTS ${escapeIdent6(rolesTable)} (
+        id SERIAL PRIMARY KEY,
+        name TEXT UNIQUE NOT NULL,
+        description TEXT NOT NULL DEFAULT '',
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+    await sql2.unsafe(`
+      CREATE TABLE IF NOT EXISTS ${escapeIdent6(rolePermsTable)} (
+        id SERIAL PRIMARY KEY,
+        role_id INTEGER NOT NULL REFERENCES ${escapeIdent6(rolesTable)}(id) ON DELETE CASCADE,
+        permission TEXT NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        UNIQUE(role_id, permission)
+      )
+    `);
+    await sql2.unsafe(`
+      CREATE TABLE IF NOT EXISTS ${escapeIdent6(userRolesTable)} (
+        id SERIAL PRIMARY KEY,
+        user_id INTEGER NOT NULL,
+        role_id INTEGER NOT NULL REFERENCES ${escapeIdent6(rolesTable)}(id) ON DELETE CASCADE,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        UNIQUE(user_id, role_id)
+      )
+    `);
+  }
+  async function ensureRole(role) {
+    const [existing] = await sql2.unsafe(
+      `SELECT id FROM ${escapeIdent6(rolesTable)} WHERE name = $1 LIMIT 1`,
+      [role]
+    );
+    if (existing) return existing.id;
+    const [created] = await sql2.unsafe(
+      `INSERT INTO ${escapeIdent6(rolesTable)} (name) VALUES ($1) RETURNING id`,
+      [role]
+    );
+    return created.id;
+  }
+  async function assignRole(userId, role) {
+    const roleId = await ensureRole(role);
+    await sql2.unsafe(
+      `INSERT INTO ${escapeIdent6(userRolesTable)} (user_id, role_id) VALUES ($1, $2) ON CONFLICT DO NOTHING`,
+      [userId, roleId]
+    );
+  }
+  async function removeRole(userId, role) {
+    await sql2.unsafe(
+      `DELETE FROM ${escapeIdent6(userRolesTable)} WHERE user_id = $1 AND role_id = (SELECT id FROM ${escapeIdent6(rolesTable)} WHERE name = $2)`,
+      [userId, role]
+    );
+  }
+  async function grantPermission(role, permission) {
+    const roleId = await ensureRole(role);
+    await sql2.unsafe(
+      `INSERT INTO ${escapeIdent6(rolePermsTable)} (role_id, permission) VALUES ($1, $2) ON CONFLICT DO NOTHING`,
+      [roleId, permission]
+    );
+  }
+  async function revokePermission(role, permission) {
+    await sql2.unsafe(
+      `DELETE FROM ${escapeIdent6(rolePermsTable)} WHERE role_id = (SELECT id FROM ${escapeIdent6(rolesTable)} WHERE name = $1) AND permission = $2`,
+      [role, permission]
+    );
+  }
+  async function getUserRoles(userId) {
+    const rows = await sql2.unsafe(
+      `SELECT r.name FROM ${escapeIdent6(userRolesTable)} ur
+       JOIN ${escapeIdent6(rolesTable)} r ON r.id = ur.role_id
+       WHERE ur.user_id = $1 ORDER BY r.name`,
+      [userId]
+    );
+    return rows.map((r) => r.name);
+  }
+  async function getUserPermissions(userId) {
+    const rows = await sql2.unsafe(
+      `SELECT DISTINCT rp.permission FROM ${escapeIdent6(userRolesTable)} ur
+       JOIN ${escapeIdent6(rolePermsTable)} rp ON rp.role_id = ur.role_id
+       WHERE ur.user_id = $1 ORDER BY rp.permission`,
+      [userId]
+    );
+    return rows.map((r) => r.permission);
+  }
+  const mw = (async (req, ctx, next) => {
+    const userId = ctx.user?.id;
+    let roles = /* @__PURE__ */ new Set();
+    let perms = /* @__PURE__ */ new Set();
+    if (userId) {
+      const userRoles = await getUserRoles(userId);
+      const userPerms = userId ? await getUserPermissions(userId) : [];
+      roles = new Set(userRoles);
+      perms = new Set(userPerms);
+      const hasWildcard = userPerms.includes("*");
+      if (hasWildcard) {
+        perms = /* @__PURE__ */ new Set(["*"]);
+      }
+    }
+    ctx.permissions = { roles, permissions: perms };
+    return next(req, ctx);
+  });
+  function requireRole(...roles) {
+    return (req, ctx, next) => {
+      if (!ctx.permissions?.roles || !roles.some((r) => ctx.permissions.roles.has(r))) {
+        return Response.json(
+          { error: `Forbidden: requires one of roles [${roles.join(", ")}]` },
+          { status: 403 }
+        );
+      }
+      return next(req, ctx);
+    };
+  }
+  function requirePermission(...perms) {
+    return (req, ctx, next) => {
+      const userPerms = ctx.permissions?.permissions;
+      if (!userPerms) {
+        return Response.json({ error: "Forbidden: no permissions loaded" }, { status: 403 });
+      }
+      if (userPerms.has("*")) return next(req, ctx);
+      const missing = perms.filter((p) => !userPerms.has(p));
+      if (missing.length > 0) {
+        return Response.json(
+          { error: `Forbidden: missing permissions [${missing.join(", ")}]` },
+          { status: 403 }
+        );
+      }
+      return next(req, ctx);
+    };
+  }
+  mw.assignRole = assignRole;
+  mw.removeRole = removeRole;
+  mw.grantPermission = grantPermission;
+  mw.revokePermission = revokePermission;
+  mw.getUserRoles = getUserRoles;
+  mw.getUserPermissions = getUserPermissions;
+  mw.requireRole = requireRole;
+  mw.requirePermission = requirePermission;
+  mw.migrate = migrate;
+  return mw;
+}
 export {
   DEFAULT_MAX_BODY,
   MIGRATIONS_TABLE,
@@ -10339,6 +11435,7 @@ export {
   TestRequest,
   TsxContext,
   agent,
+  aiProvider,
   aiStream,
   analytics,
   auth,
@@ -10346,7 +11443,7 @@ export {
   compress,
   cors,
   createHub,
-  createOpenAI,
+  createOpenAI2 as createOpenAI,
   createSSEStream,
   createTestDb,
   createTestServer,
@@ -10359,6 +11456,7 @@ export {
   deploy,
   embed,
   embedMany,
+  flash,
   formatSSE,
   formatSSEData,
   fts_exports as fts,
@@ -10368,9 +11466,11 @@ export {
   graphql,
   health,
   helmet,
+  i18n,
   iii,
   isDev,
   isProd,
+  knowledgeBase,
   loadEnv,
   logdb,
   logger,
@@ -10378,8 +11478,8 @@ export {
   messager,
   openai,
   opencode,
+  permissions,
   postgres,
-  preferences,
   queue,
   rateLimit,
   redis,
@@ -10387,6 +11487,7 @@ export {
   requestId,
   runWithTrace,
   runWorkflow,
+  s3,
   seo,
   seoMiddleware,
   seoTags,
@@ -10400,6 +11501,7 @@ export {
   streamText,
   tenant,
   testApp,
+  theme,
   tool2 as tool,
   traceElapsed,
   upload,