weifuwu 0.22.2 → 0.23.0

package/dist/kb/index.d.ts

@@ -0,0 +1,3 @@
+import type { KBOptions, KBModule, KBIngestOptions, KBSearchOptions, KBSearchResult, KBListEntry } from './types.ts';
+export type { KBOptions, KBIngestOptions, KBSearchResult, KBSearchOptions, KBListEntry, KBModule };
+export declare function knowledgeBase(options: KBOptions): KBModule;

package/dist/kb/types.d.ts

@@ -0,0 +1,64 @@
+import type { Middleware } from '../types.ts';
+import type { AIProvider } from '../ai/provider.ts';
+import type { PostgresClient } from '../postgres/types.ts';
+export interface KBOptions {
+    /** Postgres client instance. */
+    pg: PostgresClient;
+    /** AI provider for embedding. */
+    provider: AIProvider;
+    /** Table name (default: '_kb_docs'). */
+    table?: string;
+    /** Default chunk size in characters (default: 512). */
+    chunkSize?: number;
+    /** Default chunk overlap in characters (default: 64). */
+    chunkOverlap?: number;
+    /** Default search limit (default: 5). */
+    searchLimit?: number;
+    /** Minimum similarity score threshold (0–1, default: 0). Set higher for stricter matches. */
+    searchThreshold?: number;
+}
+export interface KBIngestOptions {
+    title?: string;
+    metadata?: Record<string, unknown>;
+    chunkSize?: number;
+    chunkOverlap?: number;
+}
+export interface KBSearchResult {
+    id: number;
+    key: string;
+    title: string;
+    content: string;
+    score: number;
+    metadata: Record<string, unknown>;
+}
+export interface KBSearchOptions {
+    limit?: number;
+    /** Minimum cosine similarity score (0–1). Results below this are excluded. */
+    threshold?: number;
+}
+export interface KBListEntry {
+    key: string;
+    title: string;
+    chunks: number;
+}
+export interface KBModule {
+    /**
+     * Ingest a document: chunk → embed → store.
+     * If a document with the same key exists, it is replaced (delete + re-insert).
+     * Returns the number of chunks created.
+     */
+    ingest(key: string, content: string, options?: KBIngestOptions): Promise<number>;
+    /**
+     * Search the knowledge base by semantic similarity.
+     * Query is embedded, then vector similarity search returns top results.
+     */
+    search(query: string, searchOptions?: KBSearchOptions): Promise<KBSearchResult[]>;
+    /** Delete all chunks for a document key. */
+    delete(key: string): Promise<void>;
+    /** List all document keys with title and chunk count. */
+    list(): Promise<KBListEntry[]>;
+    /** Create the table and HNSW index. Safe to call multiple times. */
+    migrate(): Promise<void>;
+    /** Middleware that injects `ctx.kb` with `.search()` method. */
+    middleware(): Middleware;
+}

package/dist/kb.d.ts

@@ -0,0 +1,70 @@
+import type { Sql } from './vendor.ts';
+import type { Middleware } from './types.ts';
+export interface KBOptions {
+    /** Postgres SQL client (with pgvector extension enabled). */
+    sql: Sql<{}>;
+    /**
+     * Embedding function.
+     * Takes a text string, returns a vector of numbers.
+     * Example: (text) => embed({ model: openai.embedding('text-embedding-3-small'), value: text }).then(r => r.embedding)
+     */
+    embedding: (text: string) => Promise<number[]>;
+    /** Vector dimensions (default: 1536 for text-embedding-3-small). */
+    dimensions?: number;
+    /** Table name (default: '_kb_docs'). */
+    table?: string;
+    /** Default chunk size in characters (default: 512). */
+    chunkSize?: number;
+    /** Default chunk overlap in characters (default: 64). */
+    chunkOverlap?: number;
+    /** Default search limit (default: 5). */
+    searchLimit?: number;
+    /** Minimum similarity score threshold (0–1, default: 0). Set higher for stricter matches. */
+    searchThreshold?: number;
+}
+export interface KBIngestOptions {
+    title?: string;
+    metadata?: Record<string, unknown>;
+    chunkSize?: number;
+    chunkOverlap?: number;
+}
+export interface KBSearchResult {
+    id: number;
+    key: string;
+    title: string;
+    content: string;
+    score: number;
+    metadata: Record<string, unknown>;
+}
+export interface KBSearchOptions {
+    limit?: number;
+    /** Minimum cosine similarity score (0–1). Results below this are excluded. */
+    threshold?: number;
+}
+export interface KBListEntry {
+    key: string;
+    title: string;
+    chunks: number;
+}
+export interface KBModule {
+    /**
+     * Ingest a document: chunk → embed → store.
+     * If a document with the same key exists, it is replaced (delete + re-insert).
+     * Returns the number of chunks created.
+     */
+    ingest(key: string, content: string, options?: KBIngestOptions): Promise<number>;
+    /**
+     * Search the knowledge base by semantic similarity.
+     * Query is embedded, then vector similarity search returns top results.
+     */
+    search(query: string, searchOptions?: KBSearchOptions): Promise<KBSearchResult[]>;
+    /** Delete all chunks for a document key. */
+    delete(key: string): Promise<void>;
+    /** List all document keys with title and chunk count. */
+    list(): Promise<KBListEntry[]>;
+    /** Create the table and HNSW index. Safe to call multiple times. */
+    migrate(): Promise<void>;
+    /** Middleware that injects `ctx.kb` with `.search()` method. */
+    middleware(): Middleware;
+}
+export declare function knowledgeBase(options: KBOptions): KBModule;

package/dist/oauth-client.d.ts

@@ -0,0 +1,41 @@
+import type { PostgresClient } from './postgres/types.ts';
+import { Router } from './router.ts';
+export interface OAuthProviderConfig {
+    clientId: string;
+    clientSecret: string;
+    scope?: string;
+    /** Custom auth URL (overrides built-in provider default). */
+    authUrl?: string;
+    /** Custom token URL (overrides built-in provider default). */
+    tokenUrl?: string;
+    /** Custom user info URL (overrides built-in provider default). */
+    userUrl?: string;
+    /**
+     * Custom user parser.
+     * Required when any of authUrl/tokenUrl/userUrl is custom.
+     * Receives the raw response from userUrl + the access token.
+     */
+    parseUser?: (data: any, accessToken: string) => ProviderUser;
+}
+export interface OAuthClientOptions {
+    /** Postgres client (required). */
+    pg: PostgresClient;
+    /** JWT secret — must match user() module's jwtSecret. */
+    jwtSecret: string;
+    /** JWT expiry (default: '24h'). */
+    expiresIn?: string | number;
+    /** Where to redirect after successful login (default: '/'). */
+    redirectUrl?: string;
+    /** Provider configurations. */
+    providers: Record<string, OAuthProviderConfig>;
+    /** Table name for provider-user links (default: '_auth_providers'). */
+    table?: string;
+}
+interface ProviderUser {
+    id: string;
+    email: string;
+    name: string;
+    avatarUrl?: string;
+}
+export declare function oauthClient(options: OAuthClientOptions): Router;
+export {};

package/dist/permissions.d.ts

@@ -0,0 +1,49 @@
+import type { Sql } from './vendor.ts';
+import type { Middleware, Context } from './types.ts';
+declare module './types.ts' {
+    interface Context {
+        roles: Set<string>;
+        permissions: Set<string>;
+    }
+}
+export interface PermissionsOptions {
+    /** PostgreSQL client. */
+    pg: {
+        sql: Sql<{}>;
+    };
+    /** Table prefix (default: '' → _roles, _user_roles, _role_permissions). */
+    prefix?: string;
+}
+export interface PermissionsModule extends Middleware {
+    /**
+     * Middleware that injects `ctx.permissions = { roles, permissions }`.
+     * Reads `ctx.user.id` to look up role assignments.
+     * Must be placed after a middleware that sets `ctx.user`.
+     */
+    (req: Request, ctx: Context, next: Handler): Response | Promise<Response>;
+    /** Assign a role to a user. Creates the role if it doesn't exist. */
+    assignRole(userId: number, role: string): Promise<void>;
+    /** Remove a role from a user. */
+    removeRole(userId: number, role: string): Promise<void>;
+    /** Grant a permission to a role. Creates the role if it doesn't exist. */
+    grantPermission(role: string, permission: string): Promise<void>;
+    /** Revoke a permission from a role. */
+    revokePermission(role: string, permission: string): Promise<void>;
+    /** Get all roles assigned to a user. */
+    getUserRoles(userId: number): Promise<string[]>;
+    /** Get all permissions for a user (union of all role permissions). */
+    getUserPermissions(userId: number): Promise<string[]>;
+    /**
+     * Middleware that rejects the request if the user does not have any of the specified roles.
+     * Must be placed after `permissions()` middleware (which injects ctx.permissions.roles).
+     */
+    requireRole(...roles: string[]): Middleware;
+    /**
+     * Middleware that rejects the request if the user does not have all specified permissions.
+     * Must be placed after `permissions()` middleware (which injects ctx.permissions.permissions).
+     */
+    requirePermission(...permissions: string[]): Middleware;
+    /** Create the underlying tables. Safe to call multiple times. */
+    migrate(): Promise<void>;
+}
+export declare function permissions(options: PermissionsOptions): PermissionsModule;

package/dist/queue/types.d.ts

@@ -14,10 +14,16 @@ export interface QueueJob<T = unknown> {
     schedule?: string;
 }
 export interface QueueOptions {
+    /** Backend store. Default: 'memory'. */
+    store?: 'memory' | 'pg' | 'redis';
     redis?: Redis;
     url?: string;
     prefix?: string;
     pollInterval?: number;
+    /** PostgreSQL client (required when store: 'pg'). */
+    pg?: {
+        sql: import('../vendor.ts').Sql<{}>;
+    };
 }
 export interface QueueInjected {
     queue: Queue;
@@ -27,6 +33,10 @@ export interface QueueJobWithError<T = unknown> extends QueueJob<T> {
     failedAt: number;
 }
 export interface Queue extends Middleware<Context, Context & QueueInjected> {
+    /** Register a cron job. Uses queue's backend (memory/pg/redis) for execution. */
+    cron(pattern: string, handler: () => void | Promise<void>): {
+        stop: () => void;
+    };
     add<T>(type: string, payload: T, opts?: {
         delay?: number;
         schedule?: string;
@@ -34,7 +44,6 @@ export interface Queue extends Middleware<Context, Context & QueueInjected> {
     process<T>(type: string, handler: (job: QueueJob<T>) => Promise<void>): void;
     run(): Promise<void>;
     stop(): void;
-    /** Stats: { running, inflight, processed, failed, handlers, maxConcurrent } */
     stats(): {
         running: boolean;
         inflight: number;
@@ -43,15 +52,12 @@ export interface Queue extends Middleware<Context, Context & QueueInjected> {
         handlers: number;
         maxConcurrent: number;
     };
-    /** List pending jobs (up to `limit`). */
     jobs(limit?: number): Promise<QueueJob[]>;
-    /** List failed jobs (up to `limit`). */
     failedJobs(limit?: number): Promise<QueueJobWithError[]>;
-    /** Retry a specific failed job by re-adding it to the queue. */
     retryFailed(jobId: string): Promise<boolean>;
-    /** Retry all failed jobs matching a type (or all types if omitted). */
     retryAllFailed(type?: string): Promise<number>;
-    /** Returns a Router with management dashboard endpoints (GET/POST). */
     dashboard(): import('../router.ts').Router;
+    /** Create the jobs table (PG mode only; safe to call multiple times). */
+    migrate?(): Promise<void>;
     close(): Promise<void>;
 }

package/dist/react.d.ts

@@ -3,7 +3,7 @@ export type { UseWebsocketOptions, UseWebsocketReturn } from './use-websocket.ts
 export { useAction } from './use-action.ts';
 export type { UseActionOptions, UseActionReturn } from './use-action.ts';
 export { Link, useNavigate, navigate, useNavigating, addInterceptor } from './client-router.ts';
-export { TsxContext, useLoaderData } from './tsx-context.ts';
+export { TsxContext, useCtx, setCtx, addCtxRebuilder, useLoaderData } from './tsx-context.ts';
 export { Head } from './head.tsx';
 export { createStore, useFetch, useQueryState } from './client-state.ts';
 export type { StoreApi } from './client-state.ts';

package/dist/react.js

@@ -153,6 +153,65 @@ async function runInterceptors(url) {
   return false;
 }
 
+// tsx-context.ts
+import { useSyncExternalStore, createContext } from "react";
+var DEFAULT_CTX = { params: {}, query: {}, parsed: {}, loaderData: {}, env: {}, user: {} };
+var KEY = "__WEIFUWU_CTX_STORE";
+function getStore() {
+  if (typeof globalThis !== "undefined" && globalThis[KEY]) {
+    return globalThis[KEY];
+  }
+  const s = {
+    _ctx: DEFAULT_CTX,
+    _snapshot: { params: DEFAULT_CTX.params, query: DEFAULT_CTX.query, user: DEFAULT_CTX.user, parsed: DEFAULT_CTX.parsed, theme: DEFAULT_CTX.theme, i18n: DEFAULT_CTX.i18n, loaderData: DEFAULT_CTX.loaderData, env: DEFAULT_CTX.env },
+    _listeners: /* @__PURE__ */ new Set(),
+    _rebuilders: [],
+    _alsGetStore: null
+  };
+  if (typeof globalThis !== "undefined") {
+    globalThis[KEY] = s;
+  }
+  return s;
+}
+var store = getStore();
+function addCtxRebuilder(fn) {
+  store._rebuilders.push(fn);
+}
+var subscribe = (cb) => {
+  store._listeners.add(cb);
+  return () => {
+    store._listeners.delete(cb);
+  };
+};
+var getSnapshot = () => store._snapshot;
+function setCtx(value) {
+  if (typeof window !== "undefined") {
+    for (const r of store._rebuilders) {
+      const rebuilt = r(value);
+      if (rebuilt) Object.assign(value, rebuilt);
+    }
+  }
+  store._ctx = { ...store._ctx, ...value };
+  store._snapshot = { params: store._ctx.params, query: store._ctx.query, user: store._ctx.user, parsed: store._ctx.parsed, theme: store._ctx.theme, i18n: store._ctx.i18n, loaderData: store._ctx.loaderData, env: store._ctx.env };
+  if (typeof window !== "undefined") {
+    ;
+    window.__WEIFUWU_CTX = { ...window.__WEIFUWU_CTX, ...value };
+  }
+  store._listeners.forEach((fn) => fn());
+}
+function useCtx() {
+  if (typeof window !== "undefined") {
+    return useSyncExternalStore(subscribe, getSnapshot);
+  }
+  const alsStore = store._alsGetStore?.();
+  return alsStore ?? store._ctx;
+}
+function useLoaderData() {
+  const ctx = useCtx();
+  return ctx.loaderData;
+}
+var TsxContext = createContext(DEFAULT_CTX);
+
 // client-router.ts
 var _navigating = false;
 var _listeners = [];
@@ -187,37 +246,25 @@ async function navigate(href) {
       return;
     }
     const newHtml = rootEl.innerHTML;
-    const propsMatch = html.match(/window\.__WEIFUWU_PROPS=(.+?)<\/script>/);
-    if (!propsMatch) {
-      location.href = href;
-      return;
-    }
     const bundleMatch = html.match(/src="(\/__ssr\/[^"]+\.js)"/);
     const bundleUrl = bundleMatch ? bundleMatch[1] : null;
+    const ctxMatch = html.match(/window\.__WEIFUWU_CTX=(.+?)<\/script>/);
+    if (ctxMatch) {
+      try {
+        const ctx = JSON.parse(ctxMatch[1]);
+        window.__WEIFUWU_CTX = ctx;
+        setCtx(ctx);
+      } catch {
+      }
+    }
     applyHead(html);
     const currentRoot = document.getElementById("__weifuwu_root");
     if (!currentRoot) {
       location.href = href;
       return;
     }
-    ;
-    window.__WEIFUWU_PROPS = JSON.parse(propsMatch[1]);
     history.pushState(null, "", url.pathname + url.search);
     currentRoot.innerHTML = newHtml;
-    const ctxMatch = html.match(/window\.__WEIFUWU_CTX=(.+?)<\/script>/);
-    if (ctxMatch) {
-      try {
-        window.__WEIFUWU_CTX = JSON.parse(ctxMatch[1]);
-      } catch {
-      }
-    }
-    const localeMatch = html.match(/window\.__LOCALE_DATA__=(.+?)<\/script>/);
-    if (localeMatch) {
-      try {
-        window.__LOCALE_DATA__ = JSON.parse(localeMatch[1]);
-      } catch {
-      }
-    }
     if (bundleUrl) {
       try {
         await import(
@@ -330,52 +377,6 @@ async function prefetchPage(href) {
   }
 }
 
-// tsx-context.ts
-import { useSyncExternalStore, createContext } from "react";
-var DEFAULT_CTX = { params: {}, query: {}, parsed: {}, prefs: {}, loaderData: {}, env: {}, user: {} };
-var KEY = "__WEIFUWU_CTX_STORE";
-function getStore() {
-  if (typeof globalThis !== "undefined" && globalThis[KEY]) {
-    return globalThis[KEY];
-  }
-  const s = {
-    _ctx: DEFAULT_CTX,
-    _snapshot: { params: DEFAULT_CTX.params, query: DEFAULT_CTX.query, user: DEFAULT_CTX.user, parsed: DEFAULT_CTX.parsed, prefs: DEFAULT_CTX.prefs, env: DEFAULT_CTX.env },
-    _listeners: /* @__PURE__ */ new Set(),
-    _alsGetStore: null
-  };
-  if (typeof globalThis !== "undefined") {
-    globalThis[KEY] = s;
-  }
-  return s;
-}
-var store = getStore();
-var subscribe = (cb) => {
-  store._listeners.add(cb);
-  return () => {
-    store._listeners.delete(cb);
-  };
-};
-var getSnapshot = () => store._snapshot;
-function setCtx(value) {
-  store._ctx = { ...store._ctx, ...value };
-  store._snapshot = { params: store._ctx.params, query: store._ctx.query, user: store._ctx.user, parsed: store._ctx.parsed, prefs: store._ctx.prefs, env: store._ctx.env };
-  store._listeners.forEach((fn) => fn());
-}
-function useCtx() {
-  if (typeof window !== "undefined") {
-    const snapshot = useSyncExternalStore(subscribe, getSnapshot);
-    return { ...snapshot, ...window.__WEIFUWU_CTX };
-  }
-  const alsStore = store._alsGetStore?.();
-  return alsStore ?? store._ctx;
-}
-function useLoaderData() {
-  const ctx = useCtx();
-  return ctx.loaderData;
-}
-var TsxContext = createContext(DEFAULT_CTX);
-
 // head.tsx
 import { createElement as createElement2 } from "react";
 function Head({ children }) {
@@ -516,9 +517,10 @@ function useQueryState(key, defaultValue = "") {
 }
 
 // client-locale.ts
-function buildT() {
-  const messages = globalThis.__LOCALE_DATA__ || (typeof window !== "undefined" ? window.__LOCALE_DATA__ : null);
-  if (!messages) return (key, _p, fb) => fb ?? key;
+function buildT(messages) {
+  if (!messages || Object.keys(messages).length === 0) {
+    return (key, _p, fb) => fb ?? key;
+  }
   return (key, params, fallback) => {
     const msg = key.split(".").reduce((o, k) => o?.[k], messages);
     if (msg === void 0 || msg === null) return fallback ?? key;
@@ -528,6 +530,12 @@ function buildT() {
     return result;
   };
 }
+addCtxRebuilder((value) => {
+  if (value.i18n?.messages) {
+    return { i18n: { ...value.i18n, t: buildT(value.i18n.messages) } };
+  }
+  return null;
+});
 addInterceptor(async (url) => {
   const m = url.pathname.match(/^\/__lang\/([\w-]+)$/);
   if (!m) return false;
@@ -536,11 +544,7 @@ addInterceptor(async (url) => {
       headers: { accept: "application/json" }
     });
     const data = await res.json();
-    const ctx = { ...window.__WEIFUWU_CTX || {}, params: {}, query: {} };
-    ctx.prefs = { ...ctx.prefs, locale: data.locale };
-    if (data.messages) window.__LOCALE_DATA__ = data.messages;
-    window.__WEIFUWU_CTX = ctx;
-    setCtx(ctx);
+    setCtx({ i18n: { locale: data.locale, messages: data.messages || {} } });
   } catch {
     location.href = url.href;
   }
@@ -549,9 +553,9 @@ addInterceptor(async (url) => {
 function useLocale() {
   const ctx = useCtx();
   return {
-    locale: ctx.prefs.locale,
+    locale: ctx.i18n?.locale,
     setLocale: (locale) => navigate("/__lang/" + locale),
-    t: buildT()
+    t: ctx.i18n?.t ?? ((key, _p, fb) => fb ?? key)
   };
 }
 
@@ -573,7 +577,7 @@ function applyTheme(theme) {
     if (!_mqListener) {
       const mq = window.matchMedia("(prefers-color-scheme: dark)");
       mq.addEventListener("change", (e) => {
-        if (window.__WEIFUWU_CTX?.prefs?.theme === "system") {
+        if (window.__WEIFUWU_CTX?.theme?.value === "system") {
           document.documentElement.dataset.theme = e.matches ? "dark" : "light";
         }
       });
@@ -589,11 +593,9 @@ addInterceptor(async (url) => {
       headers: { accept: "application/json" }
     });
     const data = await res.json();
-    const ctx = { ...window.__WEIFUWU_CTX || {}, params: {}, query: {} };
-    ctx.prefs = { ...ctx.prefs, theme: data.theme };
-    window.__WEIFUWU_CTX = ctx;
+    window.__WEIFUWU_CTX = { ...window.__WEIFUWU_CTX, theme: { value: data.theme } };
+    setCtx({ theme: { value: data.theme } });
     applyTheme(data.theme);
-    setCtx(ctx);
   } catch {
     location.href = url.href;
   }
@@ -601,7 +603,7 @@ addInterceptor(async (url) => {
 });
 function useTheme() {
   const ctx = useCtx();
-  const theme = ctx.prefs.theme ?? "system";
+  const theme = ctx.theme?.value ?? "system";
   useEffect4(() => {
     applyTheme(theme);
   }, [theme]);
@@ -617,9 +619,9 @@ import { useState as useState5 } from "react";
 function useFlashMessage() {
   const [flash] = useState5(() => {
     if (typeof window === "undefined") return null;
-    const raw = window.__WEIFUWU_CTX?.prefs?.flash;
-    if (!raw) return null;
-    return typeof raw === "string" ? JSON.parse(raw) : raw;
+    const raw = window.__WEIFUWU_CTX?.flash?.value;
+    if (raw === void 0 || raw === null) return null;
+    return raw;
   });
   return flash;
 }
@@ -683,12 +685,15 @@ export {
   Head,
   Link,
   TsxContext,
+  addCtxRebuilder,
   addInterceptor,
   applyTheme,
   createStore,
   navigate,
+  setCtx,
   useAction,
   useAgentStream,
+  useCtx,
   useFetch,
   useFlashMessage,
   useLoaderData,

package/dist/s3.d.ts

@@ -0,0 +1,68 @@
+import { S3Client } from '@aws-sdk/client-s3';
+import type { Middleware } from './types.ts';
+import type { Readable } from 'node:stream';
+declare module './types.ts' {
+    interface Context {
+        s3: S3Module;
+    }
+}
+export interface S3Options {
+    /** S3 bucket name. Required. */
+    bucket: string;
+    /** AWS region. Default: 'us-east-1'. */
+    region?: string;
+    /** Custom endpoint (MinIO, Cloudflare R2, Backblaze B2, etc.). */
+    endpoint?: string;
+    /** Force path-style addressing (required for MinIO, some private clouds). */
+    forcePathStyle?: boolean;
+    /** AWS credentials. Falls back to AWS env vars / IAM role if omitted. */
+    credentials?: {
+        accessKeyId: string;
+        secretAccessKey: string;
+    };
+    /**
+     * Base public URL for unsigned URLs.
+     * When set, `s3.url(key, { expiresIn: 0 })` returns a public URL.
+     * Example: 'https://cdn.example.com' or 'https://pub-xxx.r2.dev'
+     */
+    publicUrl?: string;
+}
+export interface S3PutOptions {
+    /** Content-Type of the object. */
+    contentType?: string;
+    /** Cache-Control header value. */
+    cacheControl?: string;
+    /** User-defined metadata (prefix x-amz-meta-). */
+    metadata?: Record<string, string>;
+}
+export interface S3UrlOptions {
+    /**
+     * Signed URL expiry in seconds.
+     * Default: 3600 (1 hour).
+     * Set to 0 to return an unsigned public URL (requires `publicUrl` option).
+     */
+    expiresIn?: number;
+}
+export interface S3Module {
+    /** Upload a file. Returns the key. */
+    put(key: string, body: S3Body, options?: S3PutOptions): Promise<string>;
+    /** Download a file. Returns the body as Buffer, or null if not found. */
+    get(key: string): Promise<Buffer | null>;
+    /** Delete a file. */
+    delete(key: string): Promise<void>;
+    /** Check if a file exists. */
+    exists(key: string): Promise<boolean>;
+    /**
+     * Generate a URL for an object.
+     * - If `expiresIn` > 0 (default): returns a signed URL with that expiry.
+     * - If `expiresIn` === 0 and `publicUrl` is configured: returns an unsigned
+     *   public URL. Throws if `publicUrl` is not set.
+     */
+    url(key: string, options?: S3UrlOptions): Promise<string>;
+    /** List object keys under a prefix. */
+    list(prefix?: string): Promise<string[]>;
+    /** The underlying S3Client (for advanced usage). */
+    client: S3Client;
+}
+export type S3Body = Buffer | Uint8Array | string | ReadableStream | Readable;
+export declare function s3(options: S3Options): S3Module & Middleware;

package/dist/serve.d.ts

@@ -17,7 +17,7 @@ export interface ServeOptions {
     shutdown?: boolean;
 }
 export interface Server {
-    stop: () => Promise<void>;
+    stop: (timeoutMs?: number) => Promise<void>;
     readonly port: number;
     readonly hostname: string;
     ready: Promise<void>;

package/dist/session.d.ts

@@ -3,7 +3,6 @@ import type { Redis } from './vendor.ts';
 declare module './types.ts' {
     interface Context {
         session: Session;
-        sessionId: string;
     }
 }
 declare const kSaved: unique symbol;
@@ -50,6 +49,18 @@ export interface SessionOptions {
         secure?: boolean;
         sameSite?: 'strict' | 'lax' | 'none';
     };
+    /**
+     * Secret for signing the session cookie with HMAC-SHA256.
+     * When set, the cookie value becomes `sid.signature` — tampering is detected
+     * and rejected. Strongly recommended in production.
+     */
+    secret?: string;
+    /**
+     * Interval (ms) for automatic session ID rotation.
+     * Rotating the ID mitigates session fixation attacks.
+     * Default: 900_000 (15 min). Set to 0 to disable.
+     */
+    rotateInterval?: number;
 }
 export interface SessionInjected {
     session: Session;

package/dist/ssr.d.ts

@@ -1,5 +1,4 @@
 import { Router } from './router.ts';
-export declare function markClientBundleDirty(): void;
 interface ResolvedRoute {
     routePath: string;
     pageFile: string;