weifuwu 0.23.4 → 0.24.0

package/dist/index.js

@@ -5,8 +5,8 @@ var __export = (target, all) => {
 };
 
 // trace.ts
+import crypto2 from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
 var als = new AsyncLocalStorage();
 function currentTraceId() {
   return als.getStore()?.traceId;
@@ -15,7 +15,7 @@ function currentTrace() {
   return als.getStore();
 }
 function runWithTrace(incomingTraceId, fn) {
-  const traceId = incomingTraceId || randomUUID();
+  const traceId = incomingTraceId || crypto2.randomUUID();
   const startTime = Date.now();
   return als.run({ traceId, startTime }, fn);
 }
@@ -24,10 +24,43 @@ function traceElapsed() {
   if (!ctx) return 0;
   return Date.now() - ctx.startTime;
 }
+function trace(options) {
+  const header = options?.header ?? "X-Request-ID";
+  const gen = options?.generator ?? (() => crypto2.randomUUID());
+  return async (req, ctx, next) => {
+    const existing = req.headers.get(header);
+    const requestId2 = existing ?? gen();
+    const tc = als.getStore();
+    ctx.trace = {
+      requestId: requestId2,
+      traceId: tc?.traceId ?? requestId2,
+      startTime: tc?.startTime ?? Date.now(),
+      elapsed: () => {
+        const t = als.getStore();
+        return t ? Date.now() - t.startTime : 0;
+      }
+    };
+    const res = await next(req, ctx);
+    if (res.headers.has(header)) return res;
+    const h = new Headers(res.headers);
+    h.set(header, requestId2);
+    return new Response(res.body, { status: res.status, statusText: res.statusText, headers: h });
+  };
+}
 
 // env.ts
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
+var PUBLIC_PREFIX = "WEIFUWU_PUBLIC_";
+function getPublicEnv() {
+  const result = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (key.startsWith(PUBLIC_PREFIX) && value !== void 0) {
+      result[key.slice(PUBLIC_PREFIX.length)] = value;
+    }
+  }
+  return result;
+}
 function isBundled() {
   return true ? true : false;
 }
@@ -65,6 +98,14 @@ function loadEnv(path2) {
     process.env[key] = value;
   }
 }
+function env() {
+  const entries = getPublicEnv();
+  return async (req, ctx, next) => {
+    ;
+    ctx.env = entries;
+    return next(req, ctx);
+  };
+}
 
 // serve.ts
 import http from "node:http";
@@ -447,6 +488,10 @@ var Router = class _Router {
       }
     } else if (typeof arg1 === "function") {
       this.globalMws.push(arg1);
+    } else if (typeof arg1 === "object" && arg1 !== null && "middleware" in arg1 && typeof arg1.middleware === "function" && arg1 instanceof _Router) {
+      const mod = arg1;
+      this.globalMws.push(mod.middleware());
+      this._mountRouter("/", mod);
     }
     return this;
   }
@@ -991,114 +1036,6 @@ function cors(options) {
   };
 }
 
-// auth.ts
-function auth(options) {
-  if (!options.token && !options.verify && !options.proxy && !options.session) {
-    throw new Error("auth() requires at least one of: token, verify, proxy, or session");
-  }
-  return async (req, ctx, next) => {
-    if (options.session) {
-      const sessionUserId = ctx.session?.userId;
-      if (sessionUserId !== void 0 && sessionUserId !== null) {
-        if (options.resolveUser) {
-          const userData = await options.resolveUser(sessionUserId);
-          if (userData) {
-            ctx.user = userData;
-            return next(req, ctx);
-          }
-          if (typeof ctx.session?.destroy === "function") {
-            ;
-            ctx.session.destroy();
-          }
-          console.warn(`[${currentTraceId()}] auth: session userId ${sessionUserId} resolved to null`);
-        } else {
-          ctx.user = { id: sessionUserId };
-          return next(req, ctx);
-        }
-      }
-    }
-    const headerName = options.header ?? "Authorization";
-    let from = "header";
-    let header = req.headers.get(headerName);
-    let token = "";
-    if (header) {
-      token = header.trim();
-      if (headerName.toLowerCase() === "authorization") {
-        const parts = header.split(" ");
-        if (parts[0]?.toLowerCase() === "bearer") {
-          token = parts.slice(1).join(" ").trim();
-        }
-      }
-    } else if (!options.header) {
-      const url = new URL(req.url);
-      const qsToken = url.searchParams.get("access_token");
-      if (qsToken) {
-        token = qsToken;
-        from = "query";
-      }
-    }
-    if (!token) {
-      return new Response("Unauthorized", {
-        status: 401,
-        headers: headerName.toLowerCase() === "authorization" ? { "WWW-Authenticate": "Bearer" } : void 0
-      });
-    }
-    if (options.proxy) {
-      let proxyUrl;
-      try {
-        proxyUrl = typeof options.proxy === "string" ? new URL(options.proxy) : options.proxy;
-      } catch {
-        return new Response("Invalid proxy URL", { status: 500 });
-      }
-      const proxyHeaders = {};
-      if (from === "header" && header) {
-        proxyHeaders[headerName] = header;
-      } else {
-        proxyUrl.searchParams.set("access_token", token);
-      }
-      for (const name of ["x-forwarded-for", "x-real-ip", "user-agent", "content-type"]) {
-        const v = req.headers.get(name);
-        if (v) proxyHeaders[name] = v;
-      }
-      const proxyRes = await fetch(proxyUrl.href, { headers: proxyHeaders });
-      if (proxyRes.status >= 400) {
-        return new Response(await proxyRes.text() || "Forbidden", { status: proxyRes.status });
-      }
-      let userData = void 0;
-      if (proxyRes.status === 200) {
-        const ct = proxyRes.headers.get("content-type");
-        if (ct?.includes("application/json")) {
-          try {
-            userData = await proxyRes.json();
-          } catch {
-          }
-        }
-      }
-      ctx.user = userData;
-      return next(req, ctx);
-    }
-    if (options.token) {
-      if (token !== options.token) {
-        console.warn(`[${currentTraceId()}] auth: invalid static token`);
-        return new Response("Forbidden", { status: 403 });
-      }
-      return next(req, ctx);
-    }
-    if (options.verify) {
-      const result = await options.verify(token, req);
-      if (!result) {
-        console.warn(`[${currentTraceId()}] auth: verify failed for token`);
-        return new Response("Forbidden", { status: 403 });
-      }
-      if (typeof result === "object" && result !== null) {
-        ctx.user = result;
-      }
-      return next(req, ctx);
-    }
-    return next(req, ctx);
-  };
-}
-
 // static.ts
 import { open, realpath } from "node:fs/promises";
 import { extname, resolve as resolve2, normalize, sep } from "node:path";
@@ -1382,7 +1319,7 @@ function deleteCookie(res, name, options) {
 
 // upload.ts
 import { writeFile, mkdir } from "node:fs/promises";
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { join, extname as extname2 } from "node:path";
 var extensionMimeMap = {
   ".jpg": "image/jpeg",
@@ -1454,7 +1391,7 @@ function upload(options) {
         };
         if (saveDir) {
           const safeName = value.name.replace(/[/\\\0]/g, "_").replace(/\.\./g, "_");
-          const filePath = join(saveDir, `${randomUUID2()}-${safeName}`);
+          const filePath = join(saveDir, `${randomUUID()}-${safeName}`);
           await writeFile(filePath, buf);
           uf.path = filePath;
         }
@@ -1551,10 +1488,11 @@ function rateLimit(options) {
     const res = await next(req, ctx);
     return addRateLimitHeaders(res, max, remaining, reset);
   };
-  mw.stop = () => {
+  mw.close = () => {
     if (interval) clearInterval(interval);
     hits.clear();
   };
+  mw.stop = mw.close;
   mw.stats = () => ({
     store: storeType,
     entries: storeType === "memory" ? hits.size : void 0,
@@ -1672,10 +1610,10 @@ var DEFAULTS = {
 };
 
 // request-id.ts
-import crypto2 from "node:crypto";
+import crypto3 from "node:crypto";
 function requestId(options) {
   const header = options?.header ?? "X-Request-ID";
-  const gen = options?.generator ?? (() => crypto2.randomUUID());
+  const gen = options?.generator ?? (() => crypto3.randomUUID());
   return async (req, ctx, next) => {
     const existing = req.headers.get(header);
     const id2 = existing ?? gen();
@@ -2425,7 +2363,7 @@ function aiProvider(options) {
   const client = createOpenAI({ baseURL, apiKey });
   let _model;
   let _embedModel;
-  return {
+  const provider = {
     get dimension() {
       return dimension;
     },
@@ -2454,6 +2392,12 @@ function aiProvider(options) {
       return aiStreamText({ ...params, model: this.model() });
     }
   };
+  const mw = async (req, ctx, next) => {
+    ;
+    ctx.ai = provider;
+    return next(req, ctx);
+  };
+  return Object.assign(mw, provider);
 }
 
 // ai-sdk.ts
@@ -3126,7 +3070,7 @@ import jwt2 from "jsonwebtoken";
 import { z as z2 } from "zod";
 
 // user/oauth2.ts
-import crypto3 from "node:crypto";
+import crypto4 from "node:crypto";
 import jwt from "jsonwebtoken";
 function createOAuth2Server(deps) {
   const { pg, users, jwtSecret, expiresIn } = deps;
@@ -3145,8 +3089,8 @@ function createOAuth2Server(deps) {
     };
   }
   async function registerClient(data) {
-    const clientId = crypto3.randomUUID();
-    const clientSecret = crypto3.randomBytes(32).toString("hex");
+    const clientId = crypto4.randomUUID();
+    const clientSecret = crypto4.randomBytes(32).toString("hex");
     const [row] = await pg.sql`
       INSERT INTO "_oauth2_clients" ("name", "client_id", "client_secret", "redirect_uris")
       VALUES (${data.name}, ${clientId}, ${clientSecret}, ${pg.sql.array(data.redirectUris)})
@@ -3294,7 +3238,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
       const loc2 = `${redirectUri}?error=access_denied${state ? `&state=${state}` : ""}`;
       return Response.redirect(loc2, 302);
     }
-    const code = crypto3.randomUUID();
+    const code = crypto4.randomUUID();
     const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
     await pg.sql`
       INSERT INTO "_oauth2_codes" ("code", "client_id", "user_id", "redirect_uri", "code_challenge", "code_challenge_method", "scope", "expires_at")
@@ -3359,7 +3303,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
       if (stored.code_challenge_method === "plain") {
         expected = codeVerifier;
       } else {
-        expected = crypto3.createHash("sha256").update(codeVerifier).digest().toString("base64url");
+        expected = crypto4.createHash("sha256").update(codeVerifier).digest().toString("base64url");
       }
       if (expected !== stored.code_challenge) {
         return Response.json({ error: "invalid_grant", error_description: "code_verifier mismatch" }, { status: 400 });
@@ -3376,7 +3320,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
       jwtSecret,
       { expiresIn }
     );
-    const refreshToken = crypto3.randomUUID();
+    const refreshToken = crypto4.randomUUID();
     const refreshExpires = new Date(Date.now() + 30 * 24 * 60 * 60 * 1e3);
     await pg.sql`
       INSERT INTO "_oauth2_tokens" ("token", "client_id", "user_id", "scope", "expires_at")
@@ -3414,7 +3358,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
 }
 
 // user/oauth-login.ts
-import crypto4 from "node:crypto";
+import crypto5 from "node:crypto";
 var BUILTIN_PROVIDERS = {
   google: {
     authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
@@ -3526,7 +3470,7 @@ function registerOAuthLoginRoutes(router, deps, providers) {
       return Response.json({ error: `Unsupported provider: ${providerName}` }, { status: 400 });
     }
     const { config, meta } = resolved;
-    const state = crypto4.randomUUID();
+    const state = crypto5.randomUUID();
     const redirectUri = new URL(req.url);
     redirectUri.pathname = redirectUri.pathname.replace(/\/[^/]+$/, "/") + providerName + "/callback";
     if (ctx.session) {
@@ -3657,14 +3601,40 @@ function verifyPassword(password, stored) {
   if (hash.length !== verify.length) return false;
   return timingSafeEqual(Buffer.from(hash), Buffer.from(verify));
 }
+function extractToken(req, headerName, cookieName) {
+  const header = req.headers.get(headerName);
+  if (header) {
+    if (headerName.toLowerCase() === "authorization") {
+      const parts = header.split(" ");
+      if (parts[0]?.toLowerCase() === "bearer") {
+        return parts.slice(1).join(" ").trim();
+      }
+    }
+    return header.trim();
+  }
+  if (headerName.toLowerCase() === "authorization") {
+    const url = new URL(req.url);
+    const qsToken = url.searchParams.get("access_token");
+    if (qsToken) return qsToken;
+  }
+  if (cookieName) {
+    const cookies = req.headers.get("cookie")?.split(";").map((c) => c.trim()).filter(Boolean) || [];
+    for (const c of cookies) {
+      const eq2 = c.indexOf("=");
+      if (eq2 > 0 && c.slice(0, eq2) === cookieName) return c.slice(eq2 + 1);
+    }
+  }
+  return null;
+}
 function user(options) {
+  const hasDb = !!options.pg;
   const table = options.table ?? "_users";
   const pg = options.pg;
   const secret = options.jwtSecret;
   const expiresIn = options.expiresIn ?? "24h";
   const oauth2Enabled = options.oauth2?.server ?? false;
-  const base = new PgModule(pg);
-  const users = pg.table(table, {
+  const base = hasDb ? new PgModule(pg) : null;
+  const users = hasDb ? pg.table(table, {
     id: serial("id").primaryKey(),
     email: text("email").unique().notNull(),
     password: text("password").notNull(),
@@ -3672,15 +3642,17 @@ function user(options) {
     role: text("role").default("user"),
     created_at: timestamptz("created_at").default(sql`NOW()`),
     updated_at: timestamptz("updated_at").default(sql`NOW()`)
-  });
+  }) : null;
+  const _pg = pg;
+  const _users = users;
   let oauth2 = null;
   if (oauth2Enabled) {
-    oauth2 = createOAuth2Server({ pg, users, jwtSecret: secret, expiresIn });
+    oauth2 = createOAuth2Server({ pg: _pg, users: _users, jwtSecret: secret, expiresIn });
   }
   async function migrate() {
-    await users.create();
+    await _users.create();
     if (options.oauthLogin) {
-      await pg.sql.unsafe(`
+      await _pg.sql.unsafe(`
         CREATE TABLE IF NOT EXISTS "_auth_providers" (
           id SERIAL PRIMARY KEY,
           user_id INTEGER NOT NULL REFERENCES ${escapeIdent2(table)}(id) ON DELETE CASCADE,
@@ -3693,13 +3665,13 @@ function user(options) {
           UNIQUE(provider, provider_id)
         )
       `);
-      await pg.sql.unsafe(`
+      await _pg.sql.unsafe(`
         CREATE INDEX IF NOT EXISTS "_auth_providers_user_idx"
         ON "_auth_providers"(user_id)
       `);
     }
     if (!oauth2Enabled) return;
-    const clients3 = pg.table("_oauth2_clients", {
+    const clients3 = _pg.table("_oauth2_clients", {
       id: serial("id").primaryKey(),
       name: text("name").notNull(),
       client_id: text("client_id").unique().notNull(),
@@ -3709,7 +3681,7 @@ function user(options) {
       created_at: timestamptz("created_at").default(sql`NOW()`)
     });
     await clients3.create();
-    const codes = pg.table("_oauth2_codes", {
+    const codes = _pg.table("_oauth2_codes", {
       id: serial("id").primaryKey(),
       code: text("code").unique().notNull(),
       client_id: text("client_id").notNull(),
@@ -3722,7 +3694,7 @@ function user(options) {
       used: boolean_("used").default(false)
     });
     await codes.create();
-    const tokens = pg.table("_oauth2_tokens", {
+    const tokens = _pg.table("_oauth2_tokens", {
       id: serial("id").primaryKey(),
       token: text("token").unique().notNull(),
       client_id: text("client_id").notNull(),
@@ -3745,15 +3717,15 @@ function user(options) {
     return user2;
   }
   async function findByEmail(email) {
-    const { data: rows } = await users.readMany({ email });
+    const { data: rows } = await _users.readMany({ email });
     return rows[0];
   }
   async function findById(id2) {
-    return await users.read(id2);
+    return await _users.read(id2);
   }
   async function createPlaceholderUser(email, name) {
     const randomPassword = randomBytes(32).toString("hex");
-    const row = await users.insert({ email, password: randomPassword, name });
+    const row = await _users.insert({ email, password: randomPassword, name });
     return row;
   }
   async function register(data) {
@@ -3765,14 +3737,14 @@ function user(options) {
       throw err;
     }
     const hashed = hashPassword(password);
-    const row = await users.insert({ email, password: hashed, name });
+    const row = await _users.insert({ email, password: hashed, name });
     const userData = row;
     const token = signToken(userData);
     return { user: stripPassword(userData), token };
   }
   async function login(data) {
     const { email, password } = LoginSchema.parse(data);
-    const { data: rows } = await users.readMany({ email });
+    const { data: rows } = await _users.readMany({ email });
     const row = rows[0];
     if (!row) {
       const err = new Error("Invalid email or password");
@@ -3792,6 +3764,7 @@ function user(options) {
     try {
       const payload = jwt2.verify(token, secret);
       if (payload.token_type === "client_credentials") return null;
+      if (!hasDb || !findById) return null;
       const row = await findById(payload.sub);
       if (!row) return null;
       return stripPassword(row);
@@ -3799,26 +3772,14 @@ function user(options) {
       return null;
     }
   }
-  function extractToken(req, cookieName) {
-    const header = req.headers.get("Authorization");
-    if (header?.startsWith("Bearer ")) return header.slice(7);
-    if (cookieName) {
-      const cookies = req.headers.get("cookie")?.split(";").map((c) => c.trim()).filter(Boolean) || [];
-      for (const c of cookies) {
-        const eq2 = c.indexOf("=");
-        if (eq2 > 0 && c.slice(0, eq2) === cookieName) return c.slice(eq2 + 1);
-      }
-    }
-    return null;
-  }
-  function middleware() {
-    return async (req, ctx, next) => {
-      const sessionUserId = ctx.session?.userId;
-      if (sessionUserId) {
+  const headerName = options.header ?? "Authorization";
+  async function resolveUser(req, ctx) {
+    const sessionUserId = ctx.session?.userId;
+    if (sessionUserId !== void 0 && sessionUserId !== null) {
+      if (hasDb) {
         const row = await findById(sessionUserId);
         if (row) {
-          ctx.user = stripPassword(row);
-          return next(req, ctx);
+          return stripPassword(row);
         }
         if (typeof ctx.session?.destroy === "function") {
           ;
@@ -3826,27 +3787,99 @@ function user(options) {
         } else {
           delete ctx.session?.userId;
         }
-      }
-      const token = extractToken(req);
-      if (token) {
-        const userData = await verify(token);
+      } else if (options.resolveUser) {
+        const userData = await options.resolveUser(sessionUserId);
         if (userData) {
-          ctx.user = userData;
-          return next(req, ctx);
+          return userData;
         }
+        if (typeof ctx.session?.destroy === "function") {
+          ;
+          ctx.session.destroy();
+        }
+        console.warn(`[${currentTraceId()}] user: session userId ${sessionUserId} resolved to null`);
+      } else {
+        return { id: sessionUserId };
+      }
+    }
+    const token = extractToken(req, headerName);
+    if (!token) return null;
+    if (options.tokens?.length) {
+      if (options.tokens.includes(token)) {
+        return { id: token };
+      }
+      console.warn(`[${currentTraceId()}] user: invalid static token`);
+      return null;
+    }
+    if (options.verify) {
+      const result = await options.verify(token, req);
+      if (!result) {
+        console.warn(`[${currentTraceId()}] user: verify failed for token`);
+        return null;
+      }
+      return result;
+    }
+    if (options.proxy) {
+      let proxyUrl;
+      try {
+        proxyUrl = typeof options.proxy === "string" ? new URL(options.proxy) : options.proxy;
+      } catch {
+        return null;
+      }
+      const proxyHeaders = {};
+      proxyHeaders[headerName] = req.headers.get(headerName) ?? `Bearer ${token}`;
+      for (const name of ["x-forwarded-for", "x-real-ip", "user-agent", "content-type"]) {
+        const v = req.headers.get(name);
+        if (v) proxyHeaders[name] = v;
+      }
+      try {
+        const proxyRes = await fetch(proxyUrl.href, { headers: proxyHeaders });
+        if (proxyRes.status >= 400) {
+          console.warn(`[${currentTraceId()}] user: proxy auth rejected (${proxyRes.status})`);
+          return null;
+        }
+        const ct = proxyRes.headers.get("content-type");
+        if (ct?.includes("application/json")) {
+          try {
+            return await proxyRes.json();
+          } catch {
+          }
+        }
+        return { id: token };
+      } catch (err) {
+        console.warn(`[${currentTraceId()}] user: proxy auth error: ${err}`);
+        return null;
       }
-      return new Response("Unauthorized", { status: 401, headers: { "WWW-Authenticate": "Bearer" } });
+    }
+    if (secret && hasDb) {
+      try {
+        const payload = jwt2.verify(token, secret);
+        if (payload.token_type === "client_credentials") return null;
+        const row = await findById(payload.sub);
+        if (row) return stripPassword(row);
+      } catch {
+      }
+      return null;
+    }
+    return null;
+  }
+  function middleware() {
+    return async (req, ctx, next) => {
+      const userData = await resolveUser(req, ctx);
+      if (userData) {
+        ctx.user = userData;
+        return next(req, ctx);
+      }
+      return new Response("Unauthorized", {
+        status: 401,
+        headers: headerName.toLowerCase() === "authorization" ? { "WWW-Authenticate": "Bearer" } : void 0
+      });
     };
   }
-  function middlewareOptional(opts) {
-    const cookieName = opts?.cookie;
+  function middlewareOptional(_opts) {
     return async (req, ctx, next) => {
-      const token = extractToken(req, cookieName);
-      if (token) {
-        const userData = await verify(token);
-        if (userData) {
-          ctx.user = userData;
-        }
+      const userData = await resolveUser(req, ctx);
+      if (userData) {
+        ctx.user = userData;
       }
       return next(req, ctx);
     };
@@ -3863,9 +3896,9 @@ function user(options) {
     }
     return obj;
   }
-  function router() {
-    const r2 = new Router();
-    r2.post("/register", async (req) => {
+  const r = new Router();
+  if (hasDb) {
+    r.post("/register", async (req) => {
       try {
         const body = await parseBody2(req);
         const result = await register(body);
@@ -3878,7 +3911,7 @@ function user(options) {
         return Response.json({ error: err.message }, { status });
       }
     });
-    r2.post("/login", async (req, ctx) => {
+    r.post("/login", async (req, ctx) => {
       try {
         const body = await parseBody2(req);
         const result = await login(body);
@@ -3900,17 +3933,15 @@ function user(options) {
         return Response.json({ error: err.message }, { status });
       }
     });
-    if (oauth2) {
-      r2.get("/oauth/authorize", (req, ctx) => oauth2.authorizeHandler(req, ctx));
-      r2.post("/oauth/consent", (req) => oauth2.consentHandler(req));
-      r2.post("/oauth/token", (req) => oauth2.tokenHandler(req));
-    }
-    return r2;
   }
-  const r = router();
-  if (options.oauthLogin) {
+  if (oauth2) {
+    r.get("/oauth/authorize", (req, ctx) => oauth2.authorizeHandler(req, ctx));
+    r.post("/oauth/consent", (req) => oauth2.consentHandler(req));
+    r.post("/oauth/token", (req) => oauth2.tokenHandler(req));
+  }
+  if (hasDb && options.oauthLogin) {
     registerOAuthLoginRoutes(r, {
-      sql: pg.sql,
+      sql: _pg.sql,
       jwtSecret: secret,
       expiresIn,
       usersTable: table,
@@ -3925,10 +3956,15 @@ function user(options) {
   const mod = r;
   mod.middleware = middleware;
   mod.middlewareOptional = middlewareOptional;
-  mod.migrate = migrate;
-  mod.register = register;
-  mod.login = login;
-  mod.verify = verify;
+  mod.migrate = hasDb ? migrate : async () => {
+  };
+  mod.register = hasDb ? register : async () => {
+    throw new Error("user(): pg required for register");
+  };
+  mod.login = hasDb ? login : async () => {
+    throw new Error("user(): pg required for login");
+  };
+  mod.verify = hasDb ? verify : async () => null;
   mod.registerClient = oauth2 ? (data) => oauth2.registerClient(data) : async () => {
     throw new Error("OAuth2 server is not enabled");
   };
@@ -3938,7 +3974,8 @@ function user(options) {
   mod.revokeClient = oauth2 ? (clientId) => oauth2.revokeClient(clientId) : async () => {
     throw new Error("OAuth2 server is not enabled");
   };
-  mod.close = () => base.close();
+  mod.close = hasDb ? () => base.close() : async () => {
+  };
   return mod;
 }
 
@@ -3960,7 +3997,7 @@ function redis(opts) {
 
 // queue/index.ts
 import { Redis as IORedis2 } from "ioredis";
-import crypto5 from "node:crypto";
+import crypto6 from "node:crypto";
 
 // cron-utils.ts
 function parseField(field, min, max) {
@@ -4046,7 +4083,7 @@ function escapeIdent3(s) {
 function attachCron(q, handlers) {
   ;
   q.cron = function(pattern, handler) {
-    const id2 = "__cron_" + pattern.replace(/[^a-zA-Z0-9]/g, "_") + "_" + crypto5.randomUUID().slice(0, 8);
+    const id2 = "__cron_" + pattern.replace(/[^a-zA-Z0-9]/g, "_") + "_" + crypto6.randomUUID().slice(0, 8);
     q.process(id2, async () => {
       await handler();
     });
@@ -4085,7 +4122,7 @@ function createMemoryQueue(opts) {
     }
     if (job.schedule) {
       try {
-        insertJob({ ...job, id: crypto5.randomUUID(), runAt: cronNext(job.schedule), createdAt: Date.now() });
+        insertJob({ ...job, id: crypto6.randomUUID(), runAt: cronNext(job.schedule), createdAt: Date.now() });
       } catch (e) {
         console.error("[queue] cron re-queue failed:", e.message);
       }
@@ -4107,7 +4144,7 @@ function createMemoryQueue(opts) {
   });
   const q = mw;
   mw.add = function add(type, payload, opts2) {
-    const id2 = crypto5.randomUUID();
+    const id2 = crypto6.randomUUID();
     let runAt;
     if (opts2?.schedule) {
       try {
@@ -4209,7 +4246,7 @@ function createPgQueue(opts) {
     if (job.schedule) {
       try {
         const nextRun = cronNext(job.schedule);
-        await sql2.unsafe(`INSERT INTO ${escapeIdent3(table)} (id, type, payload, run_at, schedule) VALUES ($1, $2, $3::jsonb, $4, $5)`, [crypto5.randomUUID(), job.type, JSON.stringify(job.payload), new Date(nextRun).toISOString(), job.schedule]);
+        await sql2.unsafe(`INSERT INTO ${escapeIdent3(table)} (id, type, payload, run_at, schedule) VALUES ($1, $2, $3::jsonb, $4, $5)`, [crypto6.randomUUID(), job.type, JSON.stringify(job.payload), new Date(nextRun).toISOString(), job.schedule]);
       } catch (e) {
         console.error("[queue] cron re-queue failed:", e.message);
       }
@@ -4243,7 +4280,7 @@ function createPgQueue(opts) {
   const q = mw;
   mw.add = function add(type, payload, opts2) {
     return (async () => {
-      const id2 = crypto5.randomUUID();
+      const id2 = crypto6.randomUUID();
       let runAt;
       if (opts2?.schedule) {
         try {
@@ -4330,7 +4367,7 @@ function createRedisQueue(opts) {
     if (job.schedule) {
       try {
         const nextRun = cronNext(job.schedule);
-        await redis2.zadd(jobKey, nextRun, JSON.stringify({ ...job, id: crypto5.randomUUID(), runAt: nextRun, createdAt: Date.now() }));
+        await redis2.zadd(jobKey, nextRun, JSON.stringify({ ...job, id: crypto6.randomUUID(), runAt: nextRun, createdAt: Date.now() }));
       } catch (e) {
         console.error("[queue] cron re-queue failed:", e.message);
       }
@@ -4369,7 +4406,7 @@ function createRedisQueue(opts) {
   });
   const q = mw;
   mw.add = function add(type, payload, opts2) {
-    const id2 = crypto5.randomUUID();
+    const id2 = crypto6.randomUUID();
     let runAt;
     if (opts2?.schedule) {
       runAt = cronNext(opts2.schedule);
@@ -6294,7 +6331,7 @@ function createGateway(config, getPort) {
 }
 
 // deploy/manager.ts
-import crypto6 from "node:crypto";
+import crypto7 from "node:crypto";
 
 // deploy/process.ts
 import { fork } from "node:child_process";
@@ -6347,27 +6384,27 @@ async function healthCheck(port, path2 = "/") {
 // deploy/manager.ts
 function createManager(config, apps, manager) {
   const router = new Router();
-  const auth2 = (req, ctx, next) => {
+  const auth = (req, ctx, next) => {
     if (!config.deployToken) return next(req, ctx);
     const header = req.headers.get("authorization") ?? "";
     const token = header.replace("Bearer ", "");
     const tokenBuf = Buffer.from(token);
     const secretBuf = Buffer.from(config.deployToken);
-    if (tokenBuf.length !== secretBuf.length || !crypto6.timingSafeEqual(tokenBuf, secretBuf)) {
+    if (tokenBuf.length !== secretBuf.length || !crypto7.timingSafeEqual(tokenBuf, secretBuf)) {
       return Response.json({ error: "Unauthorized" }, { status: 401 });
     }
     return next(req, ctx);
   };
-  router.get("/apps", auth2, () => {
+  router.get("/apps", auth, () => {
     const list = Array.from(apps.values()).map((a) => a.status);
     return Response.json(list);
   });
-  router.get("/apps/:name", auth2, (req, ctx) => {
+  router.get("/apps/:name", auth, (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     return Response.json(app.status);
   });
-  router.post("/apps/:name/deploy", auth2, async (req, ctx) => {
+  router.post("/apps/:name/deploy", auth, async (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     try {
@@ -6378,7 +6415,7 @@ function createManager(config, apps, manager) {
       return Response.json({ error: msg }, { status: 500 });
     }
   });
-  router.post("/apps/:name/restart", auth2, async (req, ctx) => {
+  router.post("/apps/:name/restart", auth, async (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     try {
@@ -6389,7 +6426,7 @@ function createManager(config, apps, manager) {
       return Response.json({ error: msg }, { status: 500 });
     }
   });
-  router.post("/apps/:name/stop", auth2, async (req, ctx) => {
+  router.post("/apps/:name/stop", auth, async (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     if (app.process) {
@@ -6399,7 +6436,7 @@ function createManager(config, apps, manager) {
     app.status = { ...app.status, status: "stopped", pid: void 0 };
     return Response.json({ success: true });
   });
-  router.post("/apps/:name/start", auth2, async (req, ctx) => {
+  router.post("/apps/:name/start", auth, async (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     try {
@@ -6410,7 +6447,7 @@ function createManager(config, apps, manager) {
       return Response.json({ error: msg }, { status: 500 });
     }
   });
-  router.get("/apps/:name/logs", auth2, (req, ctx) => {
+  router.get("/apps/:name/logs", auth, (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     let index = app.logs.length;
@@ -6462,9 +6499,9 @@ function defineConfig(config) {
 async function deploy(config) {
   const apps = /* @__PURE__ */ new Map();
   let httpServer;
-  async function forkAndCheck(name, cwd, entry, port, env, onLog, healthEndpoint) {
+  async function forkAndCheck(name, cwd, entry, port, env2, onLog, healthEndpoint) {
     try {
-      const mp = forkApp({ cwd, entry, port, env, onLog });
+      const mp = forkApp({ cwd, entry, port, env: env2, onLog });
       onLog(`[deploy] forked ${name} (pid ${mp.child.pid}) on port ${mp.port}`);
       const healthy = await healthCheck(port, healthEndpoint ?? "/");
       if (healthy) onLog(`[deploy] health check passed`);
@@ -6903,7 +6940,7 @@ async function compileHotComponent(path2) {
 // stream.ts
 import { TextDecoder as TextDecoder2, TextEncoder as TextEncoder2 } from "node:util";
 var _publicEnv = null;
-function getPublicEnv() {
+function getPublicEnv2() {
   if (_publicEnv) return _publicEnv;
   _publicEnv = {};
   for (const key of Object.keys(process.env)) {
@@ -6954,7 +6991,7 @@ function buildHeadPayload(opts) {
     }
     ctxData.user = safeUser;
   }
-  const publicEnv = getPublicEnv();
+  const publicEnv = getPublicEnv2();
   if (Object.keys(publicEnv).length > 0) {
     ctxData.env = publicEnv;
   }
@@ -7662,7 +7699,7 @@ function ssr(opts) {
 }
 
 // opencode/session.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { join as join6 } from "node:path";
 import { mkdir as mkdir2 } from "node:fs/promises";
 var sessions = pgTable("_opencode_sessions", {
@@ -7688,7 +7725,7 @@ var messages = pgTable("_opencode_messages", {
   created_at: timestamptz("created_at")
 });
 async function createSession(sql2, opts, cwd, mountPath) {
-  const id2 = randomUUID3();
+  const id2 = randomUUID2();
   const ws = computeSessionWorkspace(cwd, mountPath, id2);
   await mkdir2(ws, { recursive: true });
   const [row] = await sql2`
@@ -8860,30 +8897,37 @@ function makeSetTheme(cookie, location) {
 }
 function theme(options) {
   const opts = { default: "system", cookie: "theme", ...options };
-  return async (req, ctx, next) => {
-    const url = new URL(req.url);
-    const match = url.pathname.match(/^\/__theme\/([\w-]+)$/);
-    if (match && req.method === "GET") {
-      const value = match[1];
-      const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
-      const accept = req.headers.get("accept") ?? "";
-      if (accept.includes("application/json")) {
-        return Response.json({ ok: true, theme: value }, { headers: { "Set-Cookie": cookie } });
-      }
-      const referer = req.headers.get("referer") || "/";
-      return new Response(null, { status: 302, headers: { Location: referer, "Set-Cookie": cookie } });
-    }
+  const mw = async (req, ctx, next) => {
     let themeValue = opts.default;
     if (opts.cookie) {
       const fromCookie = getCookies(req)[opts.cookie];
       if (fromCookie) themeValue = fromCookie;
     }
+    ;
     ctx.theme = {
       value: themeValue,
       set: makeSetTheme(opts.cookie, req.headers.get("referer") || "/")
     };
     return next(req, ctx);
   };
+  class ThemeRouter extends Router {
+    middleware() {
+      return mw;
+    }
+  }
+  const router = new ThemeRouter();
+  router.get("/__theme/:value", (req) => {
+    const url = new URL(req.url);
+    const value = url.pathname.split("/__theme/")[1] ?? "";
+    const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
+    const accept = req.headers.get("accept") ?? "";
+    if (accept.includes("application/json")) {
+      return Response.json({ ok: true, theme: value }, { headers: { "Set-Cookie": cookie } });
+    }
+    const referer = req.headers.get("referer") || "/";
+    return new Response(null, { status: 302, headers: { Location: referer, "Set-Cookie": cookie } });
+  });
+  return router;
 }
 
 // i18n.ts
@@ -8949,23 +8993,7 @@ function i18n(options) {
     }
     return opts.default;
   }
-  return async (req, ctx, next) => {
-    const url = new URL(req.url);
-    const match = url.pathname.match(/^\/__lang\/([\w-]+)$/);
-    if (match && req.method === "GET") {
-      const value = match[1];
-      const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
-      const messages2 = await loadMessages(value);
-      const accept = req.headers.get("accept") ?? "";
-      if (accept.includes("application/json")) {
-        return Response.json(
-          { ok: true, locale: value, messages: Object.keys(messages2).length > 0 ? messages2 : void 0 },
-          { headers: { "Set-Cookie": cookie } }
-        );
-      }
-      const referer = req.headers.get("referer") || "/";
-      return new Response(null, { status: 302, headers: { Location: referer, "Set-Cookie": cookie } });
-    }
+  const mw = async (req, ctx, next) => {
     const locale = detectLocale(req);
     const msgs = await loadMessages(locale);
     ctx.i18n = {
@@ -8980,6 +9008,28 @@ function i18n(options) {
     };
     return next(req, ctx);
   };
+  class I18nRouter extends Router {
+    middleware() {
+      return mw;
+    }
+  }
+  const router = new I18nRouter();
+  router.get("/__lang/:locale", async (req) => {
+    const url = new URL(req.url);
+    const value = url.pathname.split("/__lang/")[1] ?? "";
+    const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
+    const messages2 = await loadMessages(value);
+    const accept = req.headers.get("accept") ?? "";
+    if (accept.includes("application/json")) {
+      return Response.json(
+        { ok: true, locale: value, messages: Object.keys(messages2).length > 0 ? messages2 : void 0 },
+        { headers: { "Set-Cookie": cookie } }
+      );
+    }
+    const referer = req.headers.get("referer") || "/";
+    return new Response(null, { status: 302, headers: { Location: referer, "Set-Cookie": cookie } });
+  });
+  return router;
 }
 
 // flash.ts
@@ -9209,13 +9259,13 @@ function csrf(options) {
       let token = getCookies(req)[cookieName];
       if (!token) {
         token = crypto.randomUUID();
-        ctx.csrfToken = token;
+        ctx.csrf = { token };
       } else {
         ;
-        ctx.csrfToken = token;
+        ctx.csrf = { token };
       }
       const res = await next(req, ctx);
-      const tokenToSet = ctx.csrfToken;
+      const tokenToSet = ctx.csrf?.token;
       if (tokenToSet && !getCookies(req)[cookieName]) {
         return setCookie(res, cookieName, tokenToSet, {
           httpOnly: true,
@@ -9400,7 +9450,7 @@ function logdb(options) {
 }
 
 // iii/client.ts
-import crypto7 from "node:crypto";
+import crypto8 from "node:crypto";
 
 // iii/stream.ts
 function notify(channels, stream, group, item, event, data) {
@@ -9929,7 +9979,7 @@ function iii(opts = {}) {
   registerBuiltin("stream::send", (p) => stream.send(p.stream_name, p.group_id, p.type, p.data, p.id));
   registerBuiltin("stream::update", (p) => stream.update(p.stream_name, p.group_id, p.item_id, p.ops));
   function addLocalWorker(worker) {
-    const workerId = crypto7.randomUUID();
+    const workerId = crypto8.randomUUID();
     const reg = {
       id: workerId,
       name: worker.name,
@@ -9944,7 +9994,7 @@ function iii(opts = {}) {
       const triggerIds = [];
       for (const t of worker.getTriggers()) {
         if (t.input.function_id === fn.id) {
-          const tid = crypto7.randomUUID();
+          const tid = crypto8.randomUUID();
           triggers.set(tid, {
             id: tid,
             type: t.input.type,
@@ -9973,7 +10023,7 @@ function iii(opts = {}) {
     if (!worker) return;
     const handler = async (payload) => {
       if (!worker.ws) throw new Error(`Worker "${worker.name}" disconnected`);
-      const invocationId = crypto7.randomUUID();
+      const invocationId = crypto8.randomUUID();
       return new Promise((resolve14, reject) => {
         const timer = setTimeout(() => {
           pending.delete(invocationId);
@@ -10008,7 +10058,7 @@ function iii(opts = {}) {
   let engineRef = null;
   const wsHandler = createWsHandler({
     registerRemoteWorker(ws, name) {
-      const id2 = crypto7.randomUUID();
+      const id2 = crypto8.randomUUID();
       workers.set(id2, { id: id2, name, ws, functions: [], triggers: [] });
       return id2;
     },
@@ -10019,7 +10069,7 @@ function iii(opts = {}) {
       addRemoteFunction(workerId, id2);
     },
     registerRemoteTrigger(workerId, input) {
-      const tid = crypto7.randomUUID();
+      const tid = crypto8.randomUUID();
       const reg = { id: tid, ...input, workerId };
       triggers.set(tid, reg);
       const worker = workers.get(workerId);
@@ -10155,6 +10205,7 @@ function iii(opts = {}) {
     triggers.clear();
     await stream.close();
   };
+  mod.close = mod.shutdown;
   return mod;
 }
 
@@ -10369,7 +10420,7 @@ function registerWorker(url) {
 }
 
 // session.ts
-import crypto8 from "node:crypto";
+import crypto9 from "node:crypto";
 var kSaved = /* @__PURE__ */ Symbol("session.saved");
 var kDestroyed = /* @__PURE__ */ Symbol("session.destroyed");
 var kId = /* @__PURE__ */ Symbol("session.id");
@@ -10447,7 +10498,7 @@ var RedisStore = class {
 };
 var COOKIE_SEPARATOR = ".";
 function signSessionId(sid, secret) {
-  const hmac = crypto8.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
+  const hmac = crypto9.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
   return sid + COOKIE_SEPARATOR + hmac;
 }
 function unsignSessionId(value, secret) {
@@ -10455,10 +10506,10 @@ function unsignSessionId(value, secret) {
   if (dot === -1) return null;
   const sid = value.slice(0, dot);
   const sig = value.slice(dot + 1);
-  const expected = crypto8.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
+  const expected = crypto9.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
   if (sig.length !== expected.length) return null;
   try {
-    return crypto8.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) ? sid : null;
+    return crypto9.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) ? sid : null;
   } catch {
     return null;
   }
@@ -10546,11 +10597,11 @@ function session(options) {
         }
       } else {
         loadedSid = null;
-        session2 = createSessionObject({}, crypto8.randomUUID(), store2, ttl, Date.now());
+        session2 = createSessionObject({}, crypto9.randomUUID(), store2, ttl, Date.now());
       }
     } else {
       loadedSid = null;
-      session2 = createSessionObject({}, crypto8.randomUUID(), store2, ttl, Date.now());
+      session2 = createSessionObject({}, crypto9.randomUUID(), store2, ttl, Date.now());
     }
     const snapshot = isSessionActive(session2) ? JSON.stringify(session2) : null;
     ctx.session = session2;
@@ -10563,7 +10614,7 @@ function session(options) {
       return deleteCookie(res, cookieName, cookieOpts);
     }
     if (needsRotation && loadedSid) {
-      const newId = crypto8.randomUUID();
+      const newId = crypto9.randomUUID();
       const data = JSON.parse(JSON.stringify(currentSession));
       data[kCreatedAt] = Date.now();
       await store2.set(newId, data, ttl);
@@ -10604,7 +10655,7 @@ function session(options) {
 }
 
 // cache.ts
-import crypto9 from "node:crypto";
+import crypto10 from "node:crypto";
 var BINARY_PREFIXES = [
   "image/",
   "audio/",
@@ -10624,7 +10675,7 @@ function isCacheableStatus(status, allowed) {
   return allowed.includes(status);
 }
 function defaultCacheKey(req) {
-  const hash = crypto9.createHash("sha256");
+  const hash = crypto10.createHash("sha256");
   hash.update(req.method);
   hash.update(req.url);
   return hash.digest("hex");
@@ -10839,10 +10890,10 @@ function cache2(options) {
 }
 
 // webhook.ts
-import crypto10 from "node:crypto";
+import crypto11 from "node:crypto";
 function timingSafeEqual2(a, b) {
   try {
-    return crypto10.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    return crypto11.timingSafeEqual(Buffer.from(a), Buffer.from(b));
   } catch {
     return false;
   }
@@ -10860,7 +10911,7 @@ function createStripeVerifier(config) {
     const signature = parts["v1"];
     if (!timestamp || !signature) return { valid: false, provider: "stripe", event: "", id: void 0 };
     const signed = `${timestamp}.${body}`;
-    const expected = crypto10.createHmac("sha256", config.secret).update(signed).digest("hex");
+    const expected = crypto11.createHmac("sha256", config.secret).update(signed).digest("hex");
     const valid = timingSafeEqual2(signature, expected);
     let event = "";
     let id2;
@@ -10877,7 +10928,7 @@ function createGitHubVerifier(config) {
   return (body, headers) => {
     const sig = headers["x-hub-signature-256"];
     if (!sig) return { valid: false, provider: "github", event: "", id: void 0 };
-    const expected = `sha256=${crypto10.createHmac("sha256", config.secret).update(body).digest("hex")}`;
+    const expected = `sha256=${crypto11.createHmac("sha256", config.secret).update(body).digest("hex")}`;
     const valid = timingSafeEqual2(sig, expected);
     let event = headers["x-github-event"] ?? "";
     let id2;
@@ -10900,7 +10951,7 @@ function createSlackVerifier(config) {
       return { valid: false, provider: "slack", event: "", id: void 0 };
     }
     const sigBase = `v0:${timestamp}:${body}`;
-    const expected = `v0=${crypto10.createHmac("sha256", config.secret).update(sigBase).digest("hex")}`;
+    const expected = `v0=${crypto11.createHmac("sha256", config.secret).update(sigBase).digest("hex")}`;
     const valid = timingSafeEqual2(signature, expected);
     let event = "";
     let id2;
@@ -11534,7 +11585,6 @@ export {
   aiProvider,
   aiStream,
   analytics,
-  auth,
   cache2 as cache,
   compress,
   cors,
@@ -11552,6 +11602,7 @@ export {
   deploy,
   embed,
   embedMany,
+  env,
   flash,
   formatSSE,
   formatSSEData,
@@ -11559,6 +11610,7 @@ export {
   generateObject,
   generateText2 as generateText,
   getCookies,
+  getPublicEnv,
   graphql,
   health,
   helmet,
@@ -11600,6 +11652,7 @@ export {
   testApp,
   theme,
   tool2 as tool,
+  trace,
   traceElapsed,
   upload,
   user,