weifuwu 0.23.4 → 0.24.1

package/dist/index.js

@@ -5,8 +5,8 @@ var __export = (target, all) => {
 };
 
 // trace.ts
+import crypto2 from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
 var als = new AsyncLocalStorage();
 function currentTraceId() {
   return als.getStore()?.traceId;
@@ -15,7 +15,7 @@ function currentTrace() {
   return als.getStore();
 }
 function runWithTrace(incomingTraceId, fn) {
-  const traceId = incomingTraceId || randomUUID();
+  const traceId = incomingTraceId || crypto2.randomUUID();
   const startTime = Date.now();
   return als.run({ traceId, startTime }, fn);
 }
@@ -24,10 +24,43 @@ function traceElapsed() {
   if (!ctx) return 0;
   return Date.now() - ctx.startTime;
 }
+function trace(options) {
+  const header = options?.header ?? "X-Request-ID";
+  const gen = options?.generator ?? (() => crypto2.randomUUID());
+  return async (req, ctx, next) => {
+    const existing = req.headers.get(header);
+    const requestId2 = existing ?? gen();
+    const tc = als.getStore();
+    ctx.trace = {
+      requestId: requestId2,
+      traceId: tc?.traceId ?? requestId2,
+      startTime: tc?.startTime ?? Date.now(),
+      elapsed: () => {
+        const t = als.getStore();
+        return t ? Date.now() - t.startTime : 0;
+      }
+    };
+    const res = await next(req, ctx);
+    if (res.headers.has(header)) return res;
+    const h = new Headers(res.headers);
+    h.set(header, requestId2);
+    return new Response(res.body, { status: res.status, statusText: res.statusText, headers: h });
+  };
+}
 
 // env.ts
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
+var PUBLIC_PREFIX = "WEIFUWU_PUBLIC_";
+function getPublicEnv() {
+  const result = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (key.startsWith(PUBLIC_PREFIX) && value !== void 0) {
+      result[key.slice(PUBLIC_PREFIX.length)] = value;
+    }
+  }
+  return result;
+}
 function isBundled() {
   return true ? true : false;
 }
@@ -65,6 +98,14 @@ function loadEnv(path2) {
     process.env[key] = value;
   }
 }
+function env() {
+  const entries = getPublicEnv();
+  return async (req, ctx, next) => {
+    ;
+    ctx.env = entries;
+    return next(req, ctx);
+  };
+}
 
 // serve.ts
 import http from "node:http";
@@ -142,8 +183,8 @@ async function sendResponse(res, response, opts) {
   }
   res.end();
 }
-async function createTestServer(handler) {
-  const server = serve(handler, { port: 0, shutdown: false });
+async function createTestServer(handler, options) {
+  const server = serve(handler, { ...options, port: options?.port ?? 0, shutdown: false });
   await server.ready;
   return { server, url: `http://localhost:${server.port}` };
 }
@@ -447,6 +488,10 @@ var Router = class _Router {
       }
     } else if (typeof arg1 === "function") {
       this.globalMws.push(arg1);
+    } else if (typeof arg1 === "object" && arg1 !== null && "middleware" in arg1 && typeof arg1.middleware === "function" && arg1 instanceof _Router) {
+      const mod = arg1;
+      this.globalMws.push(mod.middleware());
+      this._mountRouter("/", mod);
     }
     return this;
   }
@@ -991,114 +1036,6 @@ function cors(options) {
   };
 }
 
-// auth.ts
-function auth(options) {
-  if (!options.token && !options.verify && !options.proxy && !options.session) {
-    throw new Error("auth() requires at least one of: token, verify, proxy, or session");
-  }
-  return async (req, ctx, next) => {
-    if (options.session) {
-      const sessionUserId = ctx.session?.userId;
-      if (sessionUserId !== void 0 && sessionUserId !== null) {
-        if (options.resolveUser) {
-          const userData = await options.resolveUser(sessionUserId);
-          if (userData) {
-            ctx.user = userData;
-            return next(req, ctx);
-          }
-          if (typeof ctx.session?.destroy === "function") {
-            ;
-            ctx.session.destroy();
-          }
-          console.warn(`[${currentTraceId()}] auth: session userId ${sessionUserId} resolved to null`);
-        } else {
-          ctx.user = { id: sessionUserId };
-          return next(req, ctx);
-        }
-      }
-    }
-    const headerName = options.header ?? "Authorization";
-    let from = "header";
-    let header = req.headers.get(headerName);
-    let token = "";
-    if (header) {
-      token = header.trim();
-      if (headerName.toLowerCase() === "authorization") {
-        const parts = header.split(" ");
-        if (parts[0]?.toLowerCase() === "bearer") {
-          token = parts.slice(1).join(" ").trim();
-        }
-      }
-    } else if (!options.header) {
-      const url = new URL(req.url);
-      const qsToken = url.searchParams.get("access_token");
-      if (qsToken) {
-        token = qsToken;
-        from = "query";
-      }
-    }
-    if (!token) {
-      return new Response("Unauthorized", {
-        status: 401,
-        headers: headerName.toLowerCase() === "authorization" ? { "WWW-Authenticate": "Bearer" } : void 0
-      });
-    }
-    if (options.proxy) {
-      let proxyUrl;
-      try {
-        proxyUrl = typeof options.proxy === "string" ? new URL(options.proxy) : options.proxy;
-      } catch {
-        return new Response("Invalid proxy URL", { status: 500 });
-      }
-      const proxyHeaders = {};
-      if (from === "header" && header) {
-        proxyHeaders[headerName] = header;
-      } else {
-        proxyUrl.searchParams.set("access_token", token);
-      }
-      for (const name of ["x-forwarded-for", "x-real-ip", "user-agent", "content-type"]) {
-        const v = req.headers.get(name);
-        if (v) proxyHeaders[name] = v;
-      }
-      const proxyRes = await fetch(proxyUrl.href, { headers: proxyHeaders });
-      if (proxyRes.status >= 400) {
-        return new Response(await proxyRes.text() || "Forbidden", { status: proxyRes.status });
-      }
-      let userData = void 0;
-      if (proxyRes.status === 200) {
-        const ct = proxyRes.headers.get("content-type");
-        if (ct?.includes("application/json")) {
-          try {
-            userData = await proxyRes.json();
-          } catch {
-          }
-        }
-      }
-      ctx.user = userData;
-      return next(req, ctx);
-    }
-    if (options.token) {
-      if (token !== options.token) {
-        console.warn(`[${currentTraceId()}] auth: invalid static token`);
-        return new Response("Forbidden", { status: 403 });
-      }
-      return next(req, ctx);
-    }
-    if (options.verify) {
-      const result = await options.verify(token, req);
-      if (!result) {
-        console.warn(`[${currentTraceId()}] auth: verify failed for token`);
-        return new Response("Forbidden", { status: 403 });
-      }
-      if (typeof result === "object" && result !== null) {
-        ctx.user = result;
-      }
-      return next(req, ctx);
-    }
-    return next(req, ctx);
-  };
-}
-
 // static.ts
 import { open, realpath } from "node:fs/promises";
 import { extname, resolve as resolve2, normalize, sep } from "node:path";
@@ -1382,7 +1319,7 @@ function deleteCookie(res, name, options) {
 
 // upload.ts
 import { writeFile, mkdir } from "node:fs/promises";
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import { join, extname as extname2 } from "node:path";
 var extensionMimeMap = {
   ".jpg": "image/jpeg",
@@ -1454,7 +1391,7 @@ function upload(options) {
         };
         if (saveDir) {
           const safeName = value.name.replace(/[/\\\0]/g, "_").replace(/\.\./g, "_");
-          const filePath = join(saveDir, `${randomUUID2()}-${safeName}`);
+          const filePath = join(saveDir, `${randomUUID()}-${safeName}`);
           await writeFile(filePath, buf);
           uf.path = filePath;
         }
@@ -1551,10 +1488,11 @@ function rateLimit(options) {
     const res = await next(req, ctx);
     return addRateLimitHeaders(res, max, remaining, reset);
   };
-  mw.stop = () => {
+  mw.close = () => {
     if (interval) clearInterval(interval);
     hits.clear();
   };
+  mw.stop = mw.close;
   mw.stats = () => ({
     store: storeType,
     entries: storeType === "memory" ? hits.size : void 0,
@@ -1672,10 +1610,10 @@ var DEFAULTS = {
 };
 
 // request-id.ts
-import crypto2 from "node:crypto";
+import crypto3 from "node:crypto";
 function requestId(options) {
   const header = options?.header ?? "X-Request-ID";
-  const gen = options?.generator ?? (() => crypto2.randomUUID());
+  const gen = options?.generator ?? (() => crypto3.randomUUID());
   return async (req, ctx, next) => {
     const existing = req.headers.get(header);
     const id2 = existing ?? gen();
@@ -2425,7 +2363,7 @@ function aiProvider(options) {
   const client = createOpenAI({ baseURL, apiKey });
   let _model;
   let _embedModel;
-  return {
+  const provider = {
     get dimension() {
       return dimension;
     },
@@ -2454,6 +2392,12 @@ function aiProvider(options) {
       return aiStreamText({ ...params, model: this.model() });
     }
   };
+  const mw = async (req, ctx, next) => {
+    ;
+    ctx.ai = provider;
+    return next(req, ctx);
+  };
+  return Object.assign(mw, provider);
 }
 
 // ai-sdk.ts
@@ -2751,9 +2695,10 @@ var Table = class {
   _buildSET(data) {
     const sets = [];
     const values = [];
+    const d = data;
     for (const { prop, db } of this.colEntries) {
-      if (prop in data && data[prop] !== void 0) {
-        const val = data[prop];
+      if (prop in d && d[prop] !== void 0) {
+        const val = d[prop];
         if (val instanceof SQL) {
           sets.push(`"${db}" = ${val.toSQL()}`);
         } else {
@@ -2762,7 +2707,7 @@ var Table = class {
         }
       }
     }
-    if (this.hasColumn("updated_at") && !data.updated_at) {
+    if (this.hasColumn("updated_at") && !d.updated_at) {
       sets.push('"updated_at" = NOW()');
     }
     return { sets, values };
@@ -3126,7 +3071,7 @@ import jwt2 from "jsonwebtoken";
 import { z as z2 } from "zod";
 
 // user/oauth2.ts
-import crypto3 from "node:crypto";
+import crypto4 from "node:crypto";
 import jwt from "jsonwebtoken";
 function createOAuth2Server(deps) {
   const { pg, users, jwtSecret, expiresIn } = deps;
@@ -3145,8 +3090,8 @@ function createOAuth2Server(deps) {
     };
   }
   async function registerClient(data) {
-    const clientId = crypto3.randomUUID();
-    const clientSecret = crypto3.randomBytes(32).toString("hex");
+    const clientId = crypto4.randomUUID();
+    const clientSecret = crypto4.randomBytes(32).toString("hex");
     const [row] = await pg.sql`
       INSERT INTO "_oauth2_clients" ("name", "client_id", "client_secret", "redirect_uris")
       VALUES (${data.name}, ${clientId}, ${clientSecret}, ${pg.sql.array(data.redirectUris)})
@@ -3287,18 +3232,18 @@ h2{color:#dc2626}.desc{color:#555}</style>
     const redirectUri = form.get("redirect_uri") || "";
     const scope = form.get("scope") || "";
     const state = form.get("state") || "";
-    const userId = parseInt(form.get("user_id") || "0", 10);
+    const userId2 = parseInt(form.get("user_id") || "0", 10);
     const codeChallenge = form.get("code_challenge") || "";
     const codeChallengeMethod = form.get("code_challenge_method") || "";
     if (!approve) {
       const loc2 = `${redirectUri}?error=access_denied${state ? `&state=${state}` : ""}`;
       return Response.redirect(loc2, 302);
     }
-    const code = crypto3.randomUUID();
+    const code = crypto4.randomUUID();
     const expiresAt = new Date(Date.now() + 10 * 60 * 1e3);
     await pg.sql`
       INSERT INTO "_oauth2_codes" ("code", "client_id", "user_id", "redirect_uri", "code_challenge", "code_challenge_method", "scope", "expires_at")
-      VALUES (${code}, ${clientId}, ${userId}, ${redirectUri}, ${codeChallenge || null}, ${codeChallengeMethod || null}, ${scope || null}, ${expiresAt})
+      VALUES (${code}, ${clientId}, ${userId2}, ${redirectUri}, ${codeChallenge || null}, ${codeChallengeMethod || null}, ${scope || null}, ${expiresAt})
     `;
     const loc = `${redirectUri}?code=${code}${state ? `&state=${state}` : ""}`;
     return Response.redirect(loc, 302);
@@ -3359,7 +3304,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
       if (stored.code_challenge_method === "plain") {
         expected = codeVerifier;
       } else {
-        expected = crypto3.createHash("sha256").update(codeVerifier).digest().toString("base64url");
+        expected = crypto4.createHash("sha256").update(codeVerifier).digest().toString("base64url");
       }
       if (expected !== stored.code_challenge) {
         return Response.json({ error: "invalid_grant", error_description: "code_verifier mismatch" }, { status: 400 });
@@ -3376,7 +3321,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
       jwtSecret,
       { expiresIn }
     );
-    const refreshToken = crypto3.randomUUID();
+    const refreshToken = crypto4.randomUUID();
     const refreshExpires = new Date(Date.now() + 30 * 24 * 60 * 60 * 1e3);
     await pg.sql`
       INSERT INTO "_oauth2_tokens" ("token", "client_id", "user_id", "scope", "expires_at")
@@ -3414,7 +3359,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
 }
 
 // user/oauth-login.ts
-import crypto4 from "node:crypto";
+import crypto5 from "node:crypto";
 var BUILTIN_PROVIDERS = {
   google: {
     authUrl: "https://accounts.google.com/o/oauth2/v2/auth",
@@ -3474,12 +3419,12 @@ function registerOAuthLoginRoutes(router, deps, providers) {
     );
     return row ?? null;
   }
-  async function linkProvider(userId, provider, providerId, email, name, avatarUrl) {
+  async function linkProvider(userId2, provider, providerId, email, name, avatarUrl) {
     await sql2.unsafe(
       `INSERT INTO ${escapeIdent(providerTable)} (user_id, provider, provider_id, email, name, avatar_url)
        VALUES ($1, $2, $3, $4, $5, $6)
        ON CONFLICT (provider, provider_id) DO NOTHING`,
-      [userId, provider, providerId, email, name, avatarUrl]
+      [userId2, provider, providerId, email, name, avatarUrl]
     );
   }
   async function findOrCreateUser(provider, providerId, email, name, avatarUrl) {
@@ -3526,7 +3471,7 @@ function registerOAuthLoginRoutes(router, deps, providers) {
       return Response.json({ error: `Unsupported provider: ${providerName}` }, { status: 400 });
     }
     const { config, meta } = resolved;
-    const state = crypto4.randomUUID();
+    const state = crypto5.randomUUID();
     const redirectUri = new URL(req.url);
     redirectUri.pathname = redirectUri.pathname.replace(/\/[^/]+$/, "/") + providerName + "/callback";
     if (ctx.session) {
@@ -3657,14 +3602,40 @@ function verifyPassword(password, stored) {
   if (hash.length !== verify.length) return false;
   return timingSafeEqual(Buffer.from(hash), Buffer.from(verify));
 }
+function extractToken(req, headerName, cookieName) {
+  const header = req.headers.get(headerName);
+  if (header) {
+    if (headerName.toLowerCase() === "authorization") {
+      const parts = header.split(" ");
+      if (parts[0]?.toLowerCase() === "bearer") {
+        return parts.slice(1).join(" ").trim();
+      }
+    }
+    return header.trim();
+  }
+  if (headerName.toLowerCase() === "authorization") {
+    const url = new URL(req.url);
+    const qsToken = url.searchParams.get("access_token");
+    if (qsToken) return qsToken;
+  }
+  if (cookieName) {
+    const cookies = req.headers.get("cookie")?.split(";").map((c) => c.trim()).filter(Boolean) || [];
+    for (const c of cookies) {
+      const eq2 = c.indexOf("=");
+      if (eq2 > 0 && c.slice(0, eq2) === cookieName) return c.slice(eq2 + 1);
+    }
+  }
+  return null;
+}
 function user(options) {
+  const hasDb = !!options.pg;
   const table = options.table ?? "_users";
   const pg = options.pg;
   const secret = options.jwtSecret;
   const expiresIn = options.expiresIn ?? "24h";
   const oauth2Enabled = options.oauth2?.server ?? false;
-  const base = new PgModule(pg);
-  const users = pg.table(table, {
+  const base = hasDb ? new PgModule(pg) : null;
+  const users = hasDb ? pg.table(table, {
     id: serial("id").primaryKey(),
     email: text("email").unique().notNull(),
     password: text("password").notNull(),
@@ -3672,15 +3643,17 @@ function user(options) {
     role: text("role").default("user"),
     created_at: timestamptz("created_at").default(sql`NOW()`),
     updated_at: timestamptz("updated_at").default(sql`NOW()`)
-  });
+  }) : null;
+  const _pg = pg;
+  const _users = users;
   let oauth2 = null;
   if (oauth2Enabled) {
-    oauth2 = createOAuth2Server({ pg, users, jwtSecret: secret, expiresIn });
+    oauth2 = createOAuth2Server({ pg: _pg, users: _users, jwtSecret: secret, expiresIn });
   }
   async function migrate() {
-    await users.create();
+    await _users.create();
     if (options.oauthLogin) {
-      await pg.sql.unsafe(`
+      await _pg.sql.unsafe(`
         CREATE TABLE IF NOT EXISTS "_auth_providers" (
           id SERIAL PRIMARY KEY,
           user_id INTEGER NOT NULL REFERENCES ${escapeIdent2(table)}(id) ON DELETE CASCADE,
@@ -3693,13 +3666,13 @@ function user(options) {
           UNIQUE(provider, provider_id)
         )
       `);
-      await pg.sql.unsafe(`
+      await _pg.sql.unsafe(`
         CREATE INDEX IF NOT EXISTS "_auth_providers_user_idx"
         ON "_auth_providers"(user_id)
       `);
     }
     if (!oauth2Enabled) return;
-    const clients3 = pg.table("_oauth2_clients", {
+    const clients3 = _pg.table("_oauth2_clients", {
       id: serial("id").primaryKey(),
       name: text("name").notNull(),
       client_id: text("client_id").unique().notNull(),
@@ -3709,7 +3682,7 @@ function user(options) {
       created_at: timestamptz("created_at").default(sql`NOW()`)
     });
     await clients3.create();
-    const codes = pg.table("_oauth2_codes", {
+    const codes = _pg.table("_oauth2_codes", {
       id: serial("id").primaryKey(),
       code: text("code").unique().notNull(),
       client_id: text("client_id").notNull(),
@@ -3722,7 +3695,7 @@ function user(options) {
       used: boolean_("used").default(false)
     });
     await codes.create();
-    const tokens = pg.table("_oauth2_tokens", {
+    const tokens = _pg.table("_oauth2_tokens", {
       id: serial("id").primaryKey(),
       token: text("token").unique().notNull(),
       client_id: text("client_id").notNull(),
@@ -3745,15 +3718,15 @@ function user(options) {
     return user2;
   }
   async function findByEmail(email) {
-    const { data: rows } = await users.readMany({ email });
+    const { data: rows } = await _users.readMany({ email });
     return rows[0];
   }
   async function findById(id2) {
-    return await users.read(id2);
+    return await _users.read(id2);
   }
   async function createPlaceholderUser(email, name) {
     const randomPassword = randomBytes(32).toString("hex");
-    const row = await users.insert({ email, password: randomPassword, name });
+    const row = await _users.insert({ email, password: randomPassword, name });
     return row;
   }
   async function register(data) {
@@ -3765,14 +3738,14 @@ function user(options) {
       throw err;
     }
     const hashed = hashPassword(password);
-    const row = await users.insert({ email, password: hashed, name });
+    const row = await _users.insert({ email, password: hashed, name });
     const userData = row;
     const token = signToken(userData);
     return { user: stripPassword(userData), token };
   }
   async function login(data) {
     const { email, password } = LoginSchema.parse(data);
-    const { data: rows } = await users.readMany({ email });
+    const { data: rows } = await _users.readMany({ email });
     const row = rows[0];
     if (!row) {
       const err = new Error("Invalid email or password");
@@ -3792,61 +3765,121 @@ function user(options) {
     try {
       const payload = jwt2.verify(token, secret);
       if (payload.token_type === "client_credentials") return null;
-      const row = await findById(payload.sub);
+      if (!hasDb || !findById) return null;
+      const row = await findById(Number(payload.sub));
       if (!row) return null;
       return stripPassword(row);
     } catch {
       return null;
     }
   }
-  function extractToken(req, cookieName) {
-    const header = req.headers.get("Authorization");
-    if (header?.startsWith("Bearer ")) return header.slice(7);
-    if (cookieName) {
-      const cookies = req.headers.get("cookie")?.split(";").map((c) => c.trim()).filter(Boolean) || [];
-      for (const c of cookies) {
-        const eq2 = c.indexOf("=");
-        if (eq2 > 0 && c.slice(0, eq2) === cookieName) return c.slice(eq2 + 1);
-      }
-    }
-    return null;
-  }
-  function middleware() {
-    return async (req, ctx, next) => {
-      const sessionUserId = ctx.session?.userId;
-      if (sessionUserId) {
+  const headerName = options.header ?? "Authorization";
+  async function resolveUser(req, ctx) {
+    const s = ctx;
+    const sessionUserId = s.session?.userId;
+    if (sessionUserId !== void 0 && sessionUserId !== null) {
+      if (hasDb) {
         const row = await findById(sessionUserId);
         if (row) {
-          ctx.user = stripPassword(row);
-          return next(req, ctx);
+          return stripPassword(row);
         }
-        if (typeof ctx.session?.destroy === "function") {
-          ;
-          ctx.session.destroy();
-        } else {
-          delete ctx.session?.userId;
+        if (typeof s.session?.destroy === "function") {
+          s.session.destroy();
+        } else if (s.session) {
+          delete s.session.userId;
         }
-      }
-      const token = extractToken(req);
-      if (token) {
-        const userData = await verify(token);
+      } else if (options.resolveUser) {
+        const userData = await options.resolveUser(sessionUserId);
         if (userData) {
-          ctx.user = userData;
-          return next(req, ctx);
+          return userData;
+        }
+        if (typeof s.session?.destroy === "function") {
+          s.session.destroy();
+        }
+        console.warn(`[${currentTraceId()}] user: session userId ${sessionUserId} resolved to null`);
+      } else {
+        return { id: sessionUserId };
+      }
+    }
+    const token = extractToken(req, headerName);
+    if (!token) return null;
+    if (options.tokens?.length) {
+      if (options.tokens.includes(token)) {
+        return { id: token };
+      }
+      console.warn(`[${currentTraceId()}] user: invalid static token`);
+      return null;
+    }
+    if (options.verify) {
+      const result = await options.verify(token, req);
+      if (!result) {
+        console.warn(`[${currentTraceId()}] user: verify failed for token`);
+        return null;
+      }
+      return result;
+    }
+    if (options.proxy) {
+      let proxyUrl;
+      try {
+        proxyUrl = typeof options.proxy === "string" ? new URL(options.proxy) : options.proxy;
+      } catch {
+        return null;
+      }
+      const proxyHeaders = {};
+      proxyHeaders[headerName] = req.headers.get(headerName) ?? `Bearer ${token}`;
+      for (const name of ["x-forwarded-for", "x-real-ip", "user-agent", "content-type"]) {
+        const v = req.headers.get(name);
+        if (v) proxyHeaders[name] = v;
+      }
+      try {
+        const proxyRes = await fetch(proxyUrl.href, { headers: proxyHeaders });
+        if (proxyRes.status >= 400) {
+          console.warn(`[${currentTraceId()}] user: proxy auth rejected (${proxyRes.status})`);
+          return null;
         }
+        const ct = proxyRes.headers.get("content-type");
+        if (ct?.includes("application/json")) {
+          try {
+            return await proxyRes.json();
+          } catch {
+          }
+        }
+        return { id: token };
+      } catch (err) {
+        console.warn(`[${currentTraceId()}] user: proxy auth error: ${err}`);
+        return null;
+      }
+    }
+    if (secret && hasDb) {
+      try {
+        const payload = jwt2.verify(token, secret);
+        if (payload.token_type === "client_credentials") return null;
+        const row = await findById(Number(payload.sub));
+        if (row) return stripPassword(row);
+      } catch {
+      }
+      return null;
+    }
+    return null;
+  }
+  function middleware() {
+    return async (req, ctx, next) => {
+      const userData = await resolveUser(req, ctx);
+      if (userData) {
+        ctx.user = userData;
+        return next(req, ctx);
       }
-      return new Response("Unauthorized", { status: 401, headers: { "WWW-Authenticate": "Bearer" } });
+      return new Response("Unauthorized", {
+        status: 401,
+        headers: headerName.toLowerCase() === "authorization" ? { "WWW-Authenticate": "Bearer" } : void 0
+      });
     };
   }
-  function middlewareOptional(opts) {
-    const cookieName = opts?.cookie;
+  function middlewareOptional(_opts) {
     return async (req, ctx, next) => {
-      const token = extractToken(req, cookieName);
-      if (token) {
-        const userData = await verify(token);
-        if (userData) {
-          ctx.user = userData;
-        }
+      const userData = await resolveUser(req, ctx);
+      if (userData) {
+        ctx.user = userData;
       }
       return next(req, ctx);
     };
@@ -3863,9 +3896,9 @@ function user(options) {
     }
     return obj;
   }
-  function router() {
-    const r2 = new Router();
-    r2.post("/register", async (req) => {
+  const r = new Router();
+  if (hasDb) {
+    r.post("/register", async (req) => {
       try {
         const body = await parseBody2(req);
         const result = await register(body);
@@ -3878,17 +3911,17 @@ function user(options) {
         return Response.json({ error: err.message }, { status });
       }
     });
-    r2.post("/login", async (req, ctx) => {
+    r.post("/login", async (req, ctx) => {
       try {
         const body = await parseBody2(req);
         const result = await login(body);
-        if (ctx.session) {
-          ;
-          ctx.session.userId = result.user.id;
-          ctx.session.role = result.user.role;
+        const s = ctx;
+        if (s.session) {
+          s.session.userId = result.user.id;
+          s.session.role = result.user.role;
         }
         const res = Response.json(result);
-        if (!ctx.session) {
+        if (!s.session) {
           res.headers.set("Set-Cookie", `session=${result.token}; HttpOnly; SameSite=Lax; Path=/`);
         }
         return res;
@@ -3900,17 +3933,15 @@ function user(options) {
         return Response.json({ error: err.message }, { status });
       }
     });
-    if (oauth2) {
-      r2.get("/oauth/authorize", (req, ctx) => oauth2.authorizeHandler(req, ctx));
-      r2.post("/oauth/consent", (req) => oauth2.consentHandler(req));
-      r2.post("/oauth/token", (req) => oauth2.tokenHandler(req));
-    }
-    return r2;
   }
-  const r = router();
-  if (options.oauthLogin) {
+  if (oauth2) {
+    r.get("/oauth/authorize", (req, ctx) => oauth2.authorizeHandler(req, ctx));
+    r.post("/oauth/consent", (req) => oauth2.consentHandler(req));
+    r.post("/oauth/token", (req) => oauth2.tokenHandler(req));
+  }
+  if (hasDb && options.oauthLogin) {
     registerOAuthLoginRoutes(r, {
-      sql: pg.sql,
+      sql: _pg.sql,
       jwtSecret: secret,
       expiresIn,
       usersTable: table,
@@ -3925,10 +3956,15 @@ function user(options) {
   const mod = r;
   mod.middleware = middleware;
   mod.middlewareOptional = middlewareOptional;
-  mod.migrate = migrate;
-  mod.register = register;
-  mod.login = login;
-  mod.verify = verify;
+  mod.migrate = hasDb ? migrate : async () => {
+  };
+  mod.register = hasDb ? register : async () => {
+    throw new Error("user(): pg required for register");
+  };
+  mod.login = hasDb ? login : async () => {
+    throw new Error("user(): pg required for login");
+  };
+  mod.verify = hasDb ? verify : async () => null;
   mod.registerClient = oauth2 ? (data) => oauth2.registerClient(data) : async () => {
     throw new Error("OAuth2 server is not enabled");
   };
@@ -3938,7 +3974,8 @@ function user(options) {
   mod.revokeClient = oauth2 ? (clientId) => oauth2.revokeClient(clientId) : async () => {
     throw new Error("OAuth2 server is not enabled");
   };
-  mod.close = () => base.close();
+  mod.close = hasDb ? () => base.close() : async () => {
+  };
   return mod;
 }
 
@@ -3960,7 +3997,7 @@ function redis(opts) {
 
 // queue/index.ts
 import { Redis as IORedis2 } from "ioredis";
-import crypto5 from "node:crypto";
+import crypto6 from "node:crypto";
 
 // cron-utils.ts
 function parseField(field, min, max) {
@@ -4046,7 +4083,7 @@ function escapeIdent3(s) {
 function attachCron(q, handlers) {
   ;
   q.cron = function(pattern, handler) {
-    const id2 = "__cron_" + pattern.replace(/[^a-zA-Z0-9]/g, "_") + "_" + crypto5.randomUUID().slice(0, 8);
+    const id2 = "__cron_" + pattern.replace(/[^a-zA-Z0-9]/g, "_") + "_" + crypto6.randomUUID().slice(0, 8);
     q.process(id2, async () => {
       await handler();
     });
@@ -4085,7 +4122,7 @@ function createMemoryQueue(opts) {
     }
     if (job.schedule) {
       try {
-        insertJob({ ...job, id: crypto5.randomUUID(), runAt: cronNext(job.schedule), createdAt: Date.now() });
+        insertJob({ ...job, id: crypto6.randomUUID(), runAt: cronNext(job.schedule), createdAt: Date.now() });
       } catch (e) {
         console.error("[queue] cron re-queue failed:", e.message);
       }
@@ -4107,7 +4144,7 @@ function createMemoryQueue(opts) {
   });
   const q = mw;
   mw.add = function add(type, payload, opts2) {
-    const id2 = crypto5.randomUUID();
+    const id2 = crypto6.randomUUID();
     let runAt;
     if (opts2?.schedule) {
       try {
@@ -4209,7 +4246,7 @@ function createPgQueue(opts) {
     if (job.schedule) {
       try {
         const nextRun = cronNext(job.schedule);
-        await sql2.unsafe(`INSERT INTO ${escapeIdent3(table)} (id, type, payload, run_at, schedule) VALUES ($1, $2, $3::jsonb, $4, $5)`, [crypto5.randomUUID(), job.type, JSON.stringify(job.payload), new Date(nextRun).toISOString(), job.schedule]);
+        await sql2.unsafe(`INSERT INTO ${escapeIdent3(table)} (id, type, payload, run_at, schedule) VALUES ($1, $2, $3::jsonb, $4, $5)`, [crypto6.randomUUID(), job.type, JSON.stringify(job.payload), new Date(nextRun).toISOString(), job.schedule]);
       } catch (e) {
         console.error("[queue] cron re-queue failed:", e.message);
       }
@@ -4243,7 +4280,7 @@ function createPgQueue(opts) {
   const q = mw;
   mw.add = function add(type, payload, opts2) {
     return (async () => {
-      const id2 = crypto5.randomUUID();
+      const id2 = crypto6.randomUUID();
       let runAt;
       if (opts2?.schedule) {
         try {
@@ -4330,7 +4367,7 @@ function createRedisQueue(opts) {
     if (job.schedule) {
       try {
         const nextRun = cronNext(job.schedule);
-        await redis2.zadd(jobKey, nextRun, JSON.stringify({ ...job, id: crypto5.randomUUID(), runAt: nextRun, createdAt: Date.now() }));
+        await redis2.zadd(jobKey, nextRun, JSON.stringify({ ...job, id: crypto6.randomUUID(), runAt: nextRun, createdAt: Date.now() }));
       } catch (e) {
         console.error("[queue] cron re-queue failed:", e.message);
       }
@@ -4369,7 +4406,7 @@ function createRedisQueue(opts) {
   });
   const q = mw;
   mw.add = function add(type, payload, opts2) {
-    const id2 = crypto5.randomUUID();
+    const id2 = crypto6.randomUUID();
     let runAt;
     if (opts2?.schedule) {
       runAt = cronNext(opts2.schedule);
@@ -4658,6 +4695,27 @@ function buildColumnDDL(tenantId, field) {
 }
 
 // tenant/rest.ts
+function userId(ctx) {
+  return ctx.user?.id ?? null;
+}
+function extractCount(rows) {
+  return Number(rows[0]?.count ?? 0);
+}
+function asJson(val) {
+  return val;
+}
+function tableRef(s, name) {
+  return s(name);
+}
+function withTenant(ctx, data) {
+  ;
+  data.tenant_id = ctx.tenant.id;
+  return data;
+}
+function withoutTenant(data) {
+  delete data.tenant_id;
+  return data;
+}
 function zodType(field) {
   let t;
   switch (field.type) {
@@ -4715,7 +4773,7 @@ function buildRouter(sql2, usersTable) {
     `;
     await sql2`
       INSERT INTO "_tenant_members" ("tenant_id", "user_id", "role")
-      VALUES (${tenant2.id}, ${ctx.user.id}, 'admin')
+      VALUES (${tenant2.id}, ${userId(ctx)}, 'admin')
     `;
     return Response.json(tenant2, { status: 201 });
   });
@@ -4723,7 +4781,7 @@ function buildRouter(sql2, usersTable) {
     const rows = await sql2`
       SELECT t.*, tm.role FROM "_tenants" t
       JOIN "_tenant_members" tm ON tm.tenant_id = t.id
-      WHERE tm.user_id = ${ctx.user.id}
+      WHERE tm.user_id = ${userId(ctx)}
     `;
     return Response.json(rows);
   });
@@ -4732,7 +4790,7 @@ function buildRouter(sql2, usersTable) {
     if (err) return err;
     const { email, role = "member" } = await req.json();
     const [user2] = await sql2`
-      SELECT id FROM ${sql2(usersTable)} WHERE "email" = ${email} LIMIT 1
+      SELECT id FROM ${tableRef(sql2, usersTable)} WHERE "email" = ${email} LIMIT 1
     `;
     if (!user2) return Response.json({ error: "User not found" }, { status: 404 });
     const [existing] = await sql2`
@@ -4749,10 +4807,10 @@ function buildRouter(sql2, usersTable) {
   r.delete("/sys/tenants/members/:userId", async (req, ctx) => {
     const err = requireAdmin(ctx);
     if (err) return err;
-    const userId = parseInt(ctx.params.userId, 10);
+    const userId2 = parseInt(ctx.params.userId, 10);
     await sql2`
       DELETE FROM "_tenant_members"
-      WHERE tenant_id = ${ctx.tenant.id} AND user_id = ${userId}
+      WHERE tenant_id = ${ctx.tenant.id} AND user_id = ${userId2}
     `;
     return Response.json({ ok: true });
   });
@@ -4778,7 +4836,7 @@ function buildRouter(sql2, usersTable) {
     }
     const [row] = await sql2`
       INSERT INTO "_user_tables" ("tenant_id", "slug", "label", "fields")
-      VALUES (${ctx.tenant.id}, ${body.slug}, ${body.label || ""}, ${body.fields})
+      VALUES (${ctx.tenant.id}, ${body.slug}, ${body.label || ""}, ${asJson(body.fields)})
       RETURNING *
     `;
     return Response.json(row, { status: 201 });
@@ -4813,7 +4871,7 @@ function buildRouter(sql2, usersTable) {
     const merged = [...table.fields, ...newFields];
     await sql2`
       UPDATE "_user_tables"
-      SET fields = ${merged}
+      SET fields = ${asJson(merged)}
       WHERE id = ${table.id}
     `;
     return Response.json({ ...table, fields: merged });
@@ -4861,7 +4919,7 @@ function buildRouter(sql2, usersTable) {
             [ctx.tenant.id]
           )
         ]);
-        return Response.json({ rows: rows2, count: Number(countResult2[0]?.count ?? 0) });
+        return Response.json({ rows: rows2, count: extractCount(countResult2) });
       } catch {
         return Response.json({ error: "Invalid search_vector" }, { status: 400 });
       }
@@ -4877,7 +4935,7 @@ function buildRouter(sql2, usersTable) {
         [ctx.tenant.id]
       )
     ]);
-    return Response.json({ rows, count: Number(countResult[0]?.count ?? 0) });
+    return Response.json({ rows, count: extractCount(countResult) });
   });
   r.post("/:_slug", async (req, ctx) => {
     const table = await resolveTable(ctx);
@@ -4888,11 +4946,10 @@ function buildRouter(sql2, usersTable) {
       shape[f.name] = zodType(f);
     }
     const zodSchema = z3.object(shape);
-    const parsed = zodSchema.parse(data);
-    parsed.tenant_id = ctx.tenant.id;
+    const parsed = withTenant(ctx, zodSchema.parse(data));
     delete parsed.id;
     const name = internalName(ctx);
-    const [row] = await sql2`INSERT INTO ${sql2(name)} ${sql2(parsed)} RETURNING *`;
+    const [row] = await sql2`INSERT INTO ${tableRef(sql2, name)} ${sql2(parsed)} RETURNING *`;
     return Response.json(row, { status: 201 });
   });
   r.get("/:_slug/:id", async (_req, ctx) => {
@@ -4900,7 +4957,7 @@ function buildRouter(sql2, usersTable) {
     if (!table) return Response.json({ error: "Table not found" }, { status: 404 });
     const name = internalName(ctx);
     const [row] = await sql2`
-      SELECT * FROM ${sql2(name)}
+      SELECT * FROM ${tableRef(sql2, name)}
       WHERE id = ${parseInt(ctx.params.id, 10)} AND tenant_id = ${ctx.tenant.id}
       LIMIT 1
     `;
@@ -4916,13 +4973,12 @@ function buildRouter(sql2, usersTable) {
       shape[f.name] = zodType(f);
     }
     const zodSchema = z3.object(shape).partial();
-    const parsed = zodSchema.parse(data);
+    const parsed = withoutTenant(zodSchema.parse(data));
     delete parsed.id;
-    delete parsed.tenant_id;
     if (Object.keys(parsed).length === 0) {
       const name2 = internalName(ctx);
       const [row2] = await sql2`
-        SELECT * FROM ${sql2(name2)}
+        SELECT * FROM ${tableRef(sql2, name2)}
         WHERE id = ${parseInt(ctx.params.id, 10)} AND tenant_id = ${ctx.tenant.id}
         LIMIT 1
       `;
@@ -4930,7 +4986,7 @@ function buildRouter(sql2, usersTable) {
     }
     const name = internalName(ctx);
     const [row] = await sql2`
-      UPDATE ${sql2(name)} SET ${sql2(parsed)}
+      UPDATE ${tableRef(sql2, name)} SET ${sql2(parsed)}
       WHERE id = ${parseInt(ctx.params.id, 10)} AND tenant_id = ${ctx.tenant.id}
       RETURNING *
     `;
@@ -4940,7 +4996,7 @@ function buildRouter(sql2, usersTable) {
   r.delete("/:_slug/:id", async (_req, ctx) => {
     const name = internalName(ctx);
     const result = await sql2`
-      DELETE FROM ${sql2(name)}
+      DELETE FROM ${tableRef(sql2, name)}
       WHERE id = ${parseInt(ctx.params.id, 10)} AND tenant_id = ${ctx.tenant.id}
       RETURNING 1
     `;
@@ -4981,7 +5037,7 @@ function buildRouter(sql2, usersTable) {
             [parentId2, ctx.tenant.id]
           )
         ]);
-        return Response.json({ rows, count: Number(countResult[0]?.count ?? 0) });
+        return Response.json({ rows, count: extractCount(countResult) });
       }
       return Response.json({ error: "POST not supported on M2M nested routes" }, { status: 400 });
     }
@@ -4998,7 +5054,7 @@ function buildRouter(sql2, usersTable) {
           [parentId, ctx.tenant.id]
         )
       ]);
-      return Response.json({ rows, count: Number(countResult[0]?.count ?? 0) });
+      return Response.json({ rows, count: extractCount(countResult) });
     }
     const body = await req.json();
     const shape = {};
@@ -5010,7 +5066,7 @@ function buildRouter(sql2, usersTable) {
     parsed.tenant_id = ctx.tenant.id;
     parsed[relField.name] = parentId;
     delete parsed.id;
-    const [row] = await sql2`INSERT INTO ${sql2(childName)} ${sql2(parsed)} RETURNING *`;
+    const [row] = await sql2`INSERT INTO ${tableRef(sql2, childName)} ${sql2(parsed)} RETURNING *`;
     return Response.json(row, { status: 201 });
   }
   r.get("/:_slug/:id/:_nested", async (req, ctx) => handleNested(req, ctx, "GET"));
@@ -5080,7 +5136,6 @@ function buildObjectType(table, ctx) {
       if (other.id === table.id) continue;
       const relField = findRelation(other.fields, table.slug);
       if (relField) {
-        const otherName = pascalCase(other.slug);
         fields[other.slug] = {
           type: new GraphQLList(new GraphQLNonNull(buildObjectType(other, ctx))),
           args: {
@@ -5595,7 +5650,7 @@ async function loadAgent(agents, agentId) {
   return row ?? null;
 }
 function createRunner(deps) {
-  const { sql: sql2, agents, runs, provider, modelName, userTools } = deps;
+  const { sql: sql2, agents, runs, provider, userTools } = deps;
   function truncate(s, max = 200) {
     return s.length > max ? s.slice(0, max) + "..." : s;
   }
@@ -5905,32 +5960,32 @@ function createWSHandler(deps) {
     prefix: "messager:"
   });
   const userConnections = /* @__PURE__ */ new Map();
-  function trackConnection(userId, ws) {
-    let conns = userConnections.get(userId);
+  function trackConnection(userId2, ws) {
+    let conns = userConnections.get(userId2);
     if (!conns) {
       conns = /* @__PURE__ */ new Set();
-      userConnections.set(userId, conns);
+      userConnections.set(userId2, conns);
     }
     conns.add(ws);
   }
   function untrackConnection(ws) {
-    for (const [userId, conns] of userConnections) {
+    for (const [userId2, conns] of userConnections) {
       conns.delete(ws);
-      if (conns.size === 0) userConnections.delete(userId);
+      if (conns.size === 0) userConnections.delete(userId2);
     }
   }
   return {
     handler: {
       open(ws, ctx) {
-        const userId = ctx.user?.id;
-        if (!userId) {
+        const userId2 = ctx.user?.id;
+        if (!userId2) {
           ws.close(4001, "Unauthorized");
           return;
         }
       },
       async message(ws, ctx, data) {
-        const userId = ctx.user?.id;
-        if (!userId) return;
+        const userId2 = ctx.user?.id;
+        if (!userId2) return;
         let msg;
         try {
           msg = JSON.parse(data.toString());
@@ -5944,12 +5999,12 @@ function createWSHandler(deps) {
             if (!content || !channel_id) return;
             const [row] = await sql2`
               INSERT INTO "_messages" ("channel_id", "sender_id", "sender_type", "content")
-              VALUES (${channel_id}, ${userId}, 'user', ${content})
+              VALUES (${channel_id}, ${userId2}, 'user', ${content})
               RETURNING *
             `;
             const message = row;
             hub.join(`messager:${channel_id}`, ws);
-            trackConnection(userId, ws);
+            trackConnection(userId2, ws);
             broadcastToChannel(hub, channel_id, { type: "message", data: message });
             if (agents) {
               const insertMsg = (data2) => sql2`
@@ -5968,7 +6023,7 @@ function createWSHandler(deps) {
             broadcastToChannel(hub, channel_id, {
               type: "typing",
               channel_id,
-              user_id: userId,
+              user_id: userId2,
               is_typing: is_typing ?? false
             });
             break;
@@ -5979,12 +6034,12 @@ function createWSHandler(deps) {
             await sql2`
               UPDATE "_channel_members"
               SET last_read_id = ${last_message_id}, last_read_at = NOW()
-              WHERE channel_id = ${channel_id} AND member_id = ${userId} AND member_type = 'user'
+              WHERE channel_id = ${channel_id} AND member_id = ${userId2} AND member_type = 'user'
             `;
             broadcastToChannel(hub, channel_id, {
               type: "read",
               channel_id,
-              user_id: userId,
+              user_id: userId2,
               last_message_id
             });
             break;
@@ -6038,7 +6093,7 @@ function buildRouter3(deps) {
     return Response.json(channel, { status: 201 });
   });
   r.get("/channels", async (_req, ctx) => {
-    const userId = ctx.user?.id ?? 1;
+    const userId2 = ctx.user?.id ?? 1;
     const rows = await sql2`
       SELECT c.*, (
         SELECT content FROM "_messages"
@@ -6047,7 +6102,7 @@ function buildRouter3(deps) {
       ) AS last_message
       FROM "_channels" c
       JOIN "_channel_members" m ON m.channel_id = c.id
-      WHERE m.member_id = ${userId} AND m.member_type = 'user'
+      WHERE m.member_id = ${userId2} AND m.member_type = 'user'
       ORDER BY c.created_at DESC
     `;
     return Response.json(rows);
@@ -6120,9 +6175,9 @@ function buildRouter3(deps) {
   r.post("/channels/:id/read", async (req, ctx) => {
     const channelId = parseInt(ctx.params.id, 10);
     const body = await req.json();
-    const userId = body.user_id ?? ctx.user?.id ?? 1;
+    const userId2 = body.user_id ?? ctx.user?.id ?? 1;
     await members.updateMany(
-      [eq("channel_id", channelId), eq("member_id", userId), eq("member_type", "user")],
+      [eq("channel_id", channelId), eq("member_id", userId2), eq("member_type", "user")],
       { last_read_id: body.last_message_id }
     );
     return Response.json({ ok: true });
@@ -6294,7 +6349,7 @@ function createGateway(config, getPort) {
 }
 
 // deploy/manager.ts
-import crypto6 from "node:crypto";
+import crypto7 from "node:crypto";
 
 // deploy/process.ts
 import { fork } from "node:child_process";
@@ -6347,27 +6402,27 @@ async function healthCheck(port, path2 = "/") {
 // deploy/manager.ts
 function createManager(config, apps, manager) {
   const router = new Router();
-  const auth2 = (req, ctx, next) => {
+  const auth = (req, ctx, next) => {
     if (!config.deployToken) return next(req, ctx);
     const header = req.headers.get("authorization") ?? "";
     const token = header.replace("Bearer ", "");
     const tokenBuf = Buffer.from(token);
     const secretBuf = Buffer.from(config.deployToken);
-    if (tokenBuf.length !== secretBuf.length || !crypto6.timingSafeEqual(tokenBuf, secretBuf)) {
+    if (tokenBuf.length !== secretBuf.length || !crypto7.timingSafeEqual(tokenBuf, secretBuf)) {
       return Response.json({ error: "Unauthorized" }, { status: 401 });
     }
     return next(req, ctx);
   };
-  router.get("/apps", auth2, () => {
+  router.get("/apps", auth, () => {
     const list = Array.from(apps.values()).map((a) => a.status);
     return Response.json(list);
   });
-  router.get("/apps/:name", auth2, (req, ctx) => {
+  router.get("/apps/:name", auth, (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     return Response.json(app.status);
   });
-  router.post("/apps/:name/deploy", auth2, async (req, ctx) => {
+  router.post("/apps/:name/deploy", auth, async (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     try {
@@ -6378,7 +6433,7 @@ function createManager(config, apps, manager) {
       return Response.json({ error: msg }, { status: 500 });
     }
   });
-  router.post("/apps/:name/restart", auth2, async (req, ctx) => {
+  router.post("/apps/:name/restart", auth, async (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     try {
@@ -6389,7 +6444,7 @@ function createManager(config, apps, manager) {
       return Response.json({ error: msg }, { status: 500 });
     }
   });
-  router.post("/apps/:name/stop", auth2, async (req, ctx) => {
+  router.post("/apps/:name/stop", auth, async (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     if (app.process) {
@@ -6399,7 +6454,7 @@ function createManager(config, apps, manager) {
     app.status = { ...app.status, status: "stopped", pid: void 0 };
     return Response.json({ success: true });
   });
-  router.post("/apps/:name/start", auth2, async (req, ctx) => {
+  router.post("/apps/:name/start", auth, async (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     try {
@@ -6410,7 +6465,7 @@ function createManager(config, apps, manager) {
       return Response.json({ error: msg }, { status: 500 });
     }
   });
-  router.get("/apps/:name/logs", auth2, (req, ctx) => {
+  router.get("/apps/:name/logs", auth, (req, ctx) => {
     const app = apps.get(ctx.params.name);
     if (!app) return new Response("Not Found", { status: 404 });
     let index = app.logs.length;
@@ -6462,9 +6517,9 @@ function defineConfig(config) {
 async function deploy(config) {
   const apps = /* @__PURE__ */ new Map();
   let httpServer;
-  async function forkAndCheck(name, cwd, entry, port, env, onLog, healthEndpoint) {
+  async function forkAndCheck(name, cwd, entry, port, env2, onLog, healthEndpoint) {
     try {
-      const mp = forkApp({ cwd, entry, port, env, onLog });
+      const mp = forkApp({ cwd, entry, port, env: env2, onLog });
       onLog(`[deploy] forked ${name} (pid ${mp.child.pid}) on port ${mp.port}`);
       const healthy = await healthCheck(port, healthEndpoint ?? "/");
       if (healthy) onLog(`[deploy] health check passed`);
@@ -6903,7 +6958,7 @@ async function compileHotComponent(path2) {
 // stream.ts
 import { TextDecoder as TextDecoder2, TextEncoder as TextEncoder2 } from "node:util";
 var _publicEnv = null;
-function getPublicEnv() {
+function getPublicEnv2() {
   if (_publicEnv) return _publicEnv;
   _publicEnv = {};
   for (const key of Object.keys(process.env)) {
@@ -6954,7 +7009,7 @@ function buildHeadPayload(opts) {
     }
     ctxData.user = safeUser;
   }
-  const publicEnv = getPublicEnv();
+  const publicEnv = getPublicEnv2();
   if (Object.keys(publicEnv).length > 0) {
     ctxData.env = publicEnv;
   }
@@ -7312,8 +7367,9 @@ function errorBoundary(errorPath) {
       const mod = await compile(errorPath);
       const ErrorComponent = mod.default;
       if (!ErrorComponent) throw err;
-      const layouts = (ctx.layoutStack || []).map((l) => l.component);
-      const base = (ctx.mountPath || "").replace(/\/$/, "");
+      const ctx2 = ctx;
+      const layouts = (ctx2.layoutStack || []).map((l) => l.component);
+      const base = (ctx2.mountPath || "").replace(/\/$/, "");
       let element = createElement2(ErrorComponent, {
         error: err instanceof Error ? err : new Error(String(err)),
         reset: () => {
@@ -7323,10 +7379,10 @@ function errorBoundary(errorPath) {
       const { renderToReadableStream } = await import("react-dom/server");
       const stream = await renderToReadableStream(element);
       return streamResponse(stream, {
-        ctx,
+        ctx: ctx2,
         base,
         isDev: isDev(),
-        tailwind: ctx.tailwind,
+        tailwind: ctx2.tailwind,
         status: 500
       });
     }
@@ -7662,7 +7718,7 @@ function ssr(opts) {
 }
 
 // opencode/session.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { join as join6 } from "node:path";
 import { mkdir as mkdir2 } from "node:fs/promises";
 var sessions = pgTable("_opencode_sessions", {
@@ -7688,7 +7744,7 @@ var messages = pgTable("_opencode_messages", {
   created_at: timestamptz("created_at")
 });
 async function createSession(sql2, opts, cwd, mountPath) {
-  const id2 = randomUUID3();
+  const id2 = randomUUID2();
   const ws = computeSessionWorkspace(cwd, mountPath, id2);
   await mkdir2(ws, { recursive: true });
   const [row] = await sql2`
@@ -7706,10 +7762,10 @@ async function getSession(sql2, id2) {
   const { data: rows } = await sessions.readMany(sql2, { id: id2, active: true });
   return rows[0] ?? null;
 }
-async function listSessions(sql2, userId) {
+async function listSessions(sql2, userId2) {
   const opts = { orderBy: { updated_at: "desc" } };
-  if (userId !== void 0) {
-    const { data: rows2 } = await sessions.readMany(sql2, { user_id: userId, active: true }, opts);
+  if (userId2 !== void 0) {
+    const { data: rows2 } = await sessions.readMany(sql2, { user_id: userId2, active: true }, opts);
     return rows2;
   }
   const { data: rows } = await sessions.readMany(sql2, { active: true }, opts);
@@ -8330,9 +8386,9 @@ function createWSHandler2(deps) {
   const { sql: sql2, model, workspace, systemPrompt, skills, skillsRegistry, permissions: permissions2, pendingQuestions } = deps;
   return {
     open(ws, ctx) {
-      const userId = ctx.user?.id ?? 0;
+      const userId2 = ctx.user?.id ?? 0;
       const mountPath = ctx.mountPath ?? "";
-      clients2.set(ws, { userId, mountPath });
+      clients2.set(ws, { userId: userId2, mountPath });
     },
     async message(ws, ctx, data) {
       const client = clients2.get(ws);
@@ -8841,7 +8897,7 @@ function analytics(options) {
     if (pg) await migratePg(pg.sql, pg.table);
   };
   const close = async () => {
-    if (store2) store2.stopCleanup();
+    store2?.stopCleanup();
   };
   const mod = r;
   mod.middleware = middleware;
@@ -8860,30 +8916,37 @@ function makeSetTheme(cookie, location) {
 }
 function theme(options) {
   const opts = { default: "system", cookie: "theme", ...options };
-  return async (req, ctx, next) => {
-    const url = new URL(req.url);
-    const match = url.pathname.match(/^\/__theme\/([\w-]+)$/);
-    if (match && req.method === "GET") {
-      const value = match[1];
-      const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
-      const accept = req.headers.get("accept") ?? "";
-      if (accept.includes("application/json")) {
-        return Response.json({ ok: true, theme: value }, { headers: { "Set-Cookie": cookie } });
-      }
-      const referer = req.headers.get("referer") || "/";
-      return new Response(null, { status: 302, headers: { Location: referer, "Set-Cookie": cookie } });
-    }
+  const mw = async (req, ctx, next) => {
     let themeValue = opts.default;
     if (opts.cookie) {
       const fromCookie = getCookies(req)[opts.cookie];
       if (fromCookie) themeValue = fromCookie;
     }
+    ;
     ctx.theme = {
       value: themeValue,
       set: makeSetTheme(opts.cookie, req.headers.get("referer") || "/")
     };
     return next(req, ctx);
   };
+  class ThemeRouter extends Router {
+    middleware() {
+      return mw;
+    }
+  }
+  const router = new ThemeRouter();
+  router.get("/__theme/:value", (req) => {
+    const url = new URL(req.url);
+    const value = url.pathname.split("/__theme/")[1] ?? "";
+    const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
+    const accept = req.headers.get("accept") ?? "";
+    if (accept.includes("application/json")) {
+      return Response.json({ ok: true, theme: value }, { headers: { "Set-Cookie": cookie } });
+    }
+    const referer = req.headers.get("referer") || "/";
+    return new Response(null, { status: 302, headers: { Location: referer, "Set-Cookie": cookie } });
+  });
+  return router;
 }
 
 // i18n.ts
@@ -8949,23 +9012,7 @@ function i18n(options) {
     }
     return opts.default;
   }
-  return async (req, ctx, next) => {
-    const url = new URL(req.url);
-    const match = url.pathname.match(/^\/__lang\/([\w-]+)$/);
-    if (match && req.method === "GET") {
-      const value = match[1];
-      const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
-      const messages2 = await loadMessages(value);
-      const accept = req.headers.get("accept") ?? "";
-      if (accept.includes("application/json")) {
-        return Response.json(
-          { ok: true, locale: value, messages: Object.keys(messages2).length > 0 ? messages2 : void 0 },
-          { headers: { "Set-Cookie": cookie } }
-        );
-      }
-      const referer = req.headers.get("referer") || "/";
-      return new Response(null, { status: 302, headers: { Location: referer, "Set-Cookie": cookie } });
-    }
+  const mw = async (req, ctx, next) => {
     const locale = detectLocale(req);
     const msgs = await loadMessages(locale);
     ctx.i18n = {
@@ -8980,6 +9027,28 @@ function i18n(options) {
     };
     return next(req, ctx);
   };
+  class I18nRouter extends Router {
+    middleware() {
+      return mw;
+    }
+  }
+  const router = new I18nRouter();
+  router.get("/__lang/:locale", async (req) => {
+    const url = new URL(req.url);
+    const value = url.pathname.split("/__lang/")[1] ?? "";
+    const cookie = `${opts.cookie}=${encodeURIComponent(value)}; Path=/; SameSite=Lax`;
+    const messages2 = await loadMessages(value);
+    const accept = req.headers.get("accept") ?? "";
+    if (accept.includes("application/json")) {
+      return Response.json(
+        { ok: true, locale: value, messages: Object.keys(messages2).length > 0 ? messages2 : void 0 },
+        { headers: { "Set-Cookie": cookie } }
+      );
+    }
+    const referer = req.headers.get("referer") || "/";
+    return new Response(null, { status: 302, headers: { Location: referer, "Set-Cookie": cookie } });
+  });
+  return router;
 }
 
 // flash.ts
@@ -9209,13 +9278,13 @@ function csrf(options) {
       let token = getCookies(req)[cookieName];
       if (!token) {
         token = crypto.randomUUID();
-        ctx.csrfToken = token;
+        ctx.csrf = { token };
       } else {
         ;
-        ctx.csrfToken = token;
+        ctx.csrf = { token };
       }
       const res = await next(req, ctx);
-      const tokenToSet = ctx.csrfToken;
+      const tokenToSet = ctx.csrf?.token;
       if (tokenToSet && !getCookies(req)[cookieName]) {
         return setCookie(res, cookieName, tokenToSet, {
           httpOnly: true,
@@ -9400,7 +9469,7 @@ function logdb(options) {
 }
 
 // iii/client.ts
-import crypto7 from "node:crypto";
+import crypto8 from "node:crypto";
 
 // iii/stream.ts
 function notify(channels, stream, group, item, event, data) {
@@ -9929,7 +9998,7 @@ function iii(opts = {}) {
   registerBuiltin("stream::send", (p) => stream.send(p.stream_name, p.group_id, p.type, p.data, p.id));
   registerBuiltin("stream::update", (p) => stream.update(p.stream_name, p.group_id, p.item_id, p.ops));
   function addLocalWorker(worker) {
-    const workerId = crypto7.randomUUID();
+    const workerId = crypto8.randomUUID();
     const reg = {
       id: workerId,
       name: worker.name,
@@ -9944,7 +10013,7 @@ function iii(opts = {}) {
       const triggerIds = [];
       for (const t of worker.getTriggers()) {
         if (t.input.function_id === fn.id) {
-          const tid = crypto7.randomUUID();
+          const tid = crypto8.randomUUID();
           triggers.set(tid, {
             id: tid,
             type: t.input.type,
@@ -9973,7 +10042,7 @@ function iii(opts = {}) {
     if (!worker) return;
     const handler = async (payload) => {
       if (!worker.ws) throw new Error(`Worker "${worker.name}" disconnected`);
-      const invocationId = crypto7.randomUUID();
+      const invocationId = crypto8.randomUUID();
       return new Promise((resolve14, reject) => {
         const timer = setTimeout(() => {
           pending.delete(invocationId);
@@ -10008,7 +10077,7 @@ function iii(opts = {}) {
   let engineRef = null;
   const wsHandler = createWsHandler({
     registerRemoteWorker(ws, name) {
-      const id2 = crypto7.randomUUID();
+      const id2 = crypto8.randomUUID();
       workers.set(id2, { id: id2, name, ws, functions: [], triggers: [] });
       return id2;
     },
@@ -10019,7 +10088,7 @@ function iii(opts = {}) {
       addRemoteFunction(workerId, id2);
     },
     registerRemoteTrigger(workerId, input) {
-      const tid = crypto7.randomUUID();
+      const tid = crypto8.randomUUID();
       const reg = { id: tid, ...input, workerId };
       triggers.set(tid, reg);
       const worker = workers.get(workerId);
@@ -10143,7 +10212,7 @@ function iii(opts = {}) {
   mod.migrate = async () => {
     await stream.migrate();
   };
-  mod.shutdown = async () => {
+  mod.close = async () => {
     for (const [, p] of pending) {
       clearTimeout(p.timer);
       p.reject(new Error("Engine shutting down"));
@@ -10359,7 +10428,7 @@ function registerWorker(url) {
     onStream(handler) {
       handlers.set("__stream__", handler);
     },
-    shutdown() {
+    close() {
       intentionalClose = true;
       if (reconnectTimer) clearTimeout(reconnectTimer);
       ws?.close();
@@ -10369,7 +10438,7 @@ function registerWorker(url) {
 }
 
 // session.ts
-import crypto8 from "node:crypto";
+import crypto9 from "node:crypto";
 var kSaved = /* @__PURE__ */ Symbol("session.saved");
 var kDestroyed = /* @__PURE__ */ Symbol("session.destroyed");
 var kId = /* @__PURE__ */ Symbol("session.id");
@@ -10408,7 +10477,7 @@ var MemoryStore = class {
       if (entry.expires < now) this.store.delete(key);
     }
   }
-  close() {
+  async close() {
     clearInterval(this.interval);
     this.store.clear();
   }
@@ -10444,10 +10513,13 @@ var RedisStore = class {
   async destroy(sid) {
     await this.redis.del(this.key(sid));
   }
+  async close() {
+    this.redis.disconnect();
+  }
 };
 var COOKIE_SEPARATOR = ".";
 function signSessionId(sid, secret) {
-  const hmac = crypto8.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
+  const hmac = crypto9.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
   return sid + COOKIE_SEPARATOR + hmac;
 }
 function unsignSessionId(value, secret) {
@@ -10455,10 +10527,10 @@ function unsignSessionId(value, secret) {
   if (dot === -1) return null;
   const sid = value.slice(0, dot);
   const sig = value.slice(dot + 1);
-  const expected = crypto8.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
+  const expected = crypto9.createHmac("sha256", secret).update(sid).digest("base64url").slice(0, 16);
   if (sig.length !== expected.length) return null;
   try {
-    return crypto8.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) ? sid : null;
+    return crypto9.timingSafeEqual(Buffer.from(sig), Buffer.from(expected)) ? sid : null;
   } catch {
     return null;
   }
@@ -10517,6 +10589,7 @@ function session(options) {
   } else if (options?.store === "redis") {
     if (!options.redis) throw new Error('session: redis client required when store: "redis"');
     store2 = new RedisStore(options.redis);
+    closeStore = () => store2.close();
   } else {
     const mem = new MemoryStore();
     store2 = mem;
@@ -10546,11 +10619,11 @@ function session(options) {
         }
       } else {
         loadedSid = null;
-        session2 = createSessionObject({}, crypto8.randomUUID(), store2, ttl, Date.now());
+        session2 = createSessionObject({}, crypto9.randomUUID(), store2, ttl, Date.now());
       }
     } else {
       loadedSid = null;
-      session2 = createSessionObject({}, crypto8.randomUUID(), store2, ttl, Date.now());
+      session2 = createSessionObject({}, crypto9.randomUUID(), store2, ttl, Date.now());
     }
     const snapshot = isSessionActive(session2) ? JSON.stringify(session2) : null;
     ctx.session = session2;
@@ -10563,7 +10636,7 @@ function session(options) {
       return deleteCookie(res, cookieName, cookieOpts);
     }
     if (needsRotation && loadedSid) {
-      const newId = crypto8.randomUUID();
+      const newId = crypto9.randomUUID();
       const data = JSON.parse(JSON.stringify(currentSession));
       data[kCreatedAt] = Date.now();
       await store2.set(newId, data, ttl);
@@ -10596,15 +10669,15 @@ function session(options) {
     }
     return res;
   });
-  mw.close = () => {
-    closeStore?.();
+  mw.close = async () => {
+    await closeStore?.();
   };
   mw.store = store2;
   return mw;
 }
 
 // cache.ts
-import crypto9 from "node:crypto";
+import crypto10 from "node:crypto";
 var BINARY_PREFIXES = [
   "image/",
   "audio/",
@@ -10624,7 +10697,7 @@ function isCacheableStatus(status, allowed) {
   return allowed.includes(status);
 }
 function defaultCacheKey(req) {
-  const hash = crypto9.createHash("sha256");
+  const hash = crypto10.createHash("sha256");
   hash.update(req.method);
   hash.update(req.url);
   return hash.digest("hex");
@@ -10691,7 +10764,7 @@ var MemoryCache = class {
       }
     }
   }
-  close() {
+  async close() {
     clearInterval(this.interval);
     this.store.clear();
     this.tagIndex.clear();
@@ -10832,17 +10905,17 @@ function cache2(options) {
   mw.store = store2;
   mw.invalidate = async (tag) => store2.invalidate(tag);
   mw.flush = async () => store2.flush();
-  mw.close = () => {
-    closeStore?.();
+  mw.close = async () => {
+    await closeStore?.();
   };
   return mw;
 }
 
 // webhook.ts
-import crypto10 from "node:crypto";
+import crypto11 from "node:crypto";
 function timingSafeEqual2(a, b) {
   try {
-    return crypto10.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+    return crypto11.timingSafeEqual(Buffer.from(a), Buffer.from(b));
   } catch {
     return false;
   }
@@ -10860,7 +10933,7 @@ function createStripeVerifier(config) {
     const signature = parts["v1"];
     if (!timestamp || !signature) return { valid: false, provider: "stripe", event: "", id: void 0 };
     const signed = `${timestamp}.${body}`;
-    const expected = crypto10.createHmac("sha256", config.secret).update(signed).digest("hex");
+    const expected = crypto11.createHmac("sha256", config.secret).update(signed).digest("hex");
     const valid = timingSafeEqual2(signature, expected);
     let event = "";
     let id2;
@@ -10877,7 +10950,7 @@ function createGitHubVerifier(config) {
   return (body, headers) => {
     const sig = headers["x-hub-signature-256"];
     if (!sig) return { valid: false, provider: "github", event: "", id: void 0 };
-    const expected = `sha256=${crypto10.createHmac("sha256", config.secret).update(body).digest("hex")}`;
+    const expected = `sha256=${crypto11.createHmac("sha256", config.secret).update(body).digest("hex")}`;
     const valid = timingSafeEqual2(sig, expected);
     let event = headers["x-github-event"] ?? "";
     let id2;
@@ -10900,7 +10973,7 @@ function createSlackVerifier(config) {
       return { valid: false, provider: "slack", event: "", id: void 0 };
     }
     const sigBase = `v0:${timestamp}:${body}`;
-    const expected = `v0=${crypto10.createHmac("sha256", config.secret).update(sigBase).digest("hex")}`;
+    const expected = `v0=${crypto11.createHmac("sha256", config.secret).update(sigBase).digest("hex")}`;
     const valid = timingSafeEqual2(signature, expected);
     let event = "";
     let id2;
@@ -11417,17 +11490,17 @@ function permissions(options) {
     );
     return created.id;
   }
-  async function assignRole(userId, role) {
+  async function assignRole(userId2, role) {
     const roleId = await ensureRole(role);
     await sql2.unsafe(
       `INSERT INTO ${escapeIdent6(userRolesTable)} (user_id, role_id) VALUES ($1, $2) ON CONFLICT DO NOTHING`,
-      [userId, roleId]
+      [userId2, roleId]
     );
   }
-  async function removeRole(userId, role) {
+  async function removeRole(userId2, role) {
     await sql2.unsafe(
       `DELETE FROM ${escapeIdent6(userRolesTable)} WHERE user_id = $1 AND role_id = (SELECT id FROM ${escapeIdent6(rolesTable)} WHERE name = $2)`,
-      [userId, role]
+      [userId2, role]
     );
   }
   async function grantPermission(role, permission) {
@@ -11443,31 +11516,31 @@ function permissions(options) {
       [role, permission]
     );
   }
-  async function getUserRoles(userId) {
+  async function getUserRoles(userId2) {
     const rows = await sql2.unsafe(
       `SELECT r.name FROM ${escapeIdent6(userRolesTable)} ur
        JOIN ${escapeIdent6(rolesTable)} r ON r.id = ur.role_id
        WHERE ur.user_id = $1 ORDER BY r.name`,
-      [userId]
+      [userId2]
     );
     return rows.map((r) => r.name);
   }
-  async function getUserPermissions(userId) {
+  async function getUserPermissions(userId2) {
     const rows = await sql2.unsafe(
       `SELECT DISTINCT rp.permission FROM ${escapeIdent6(userRolesTable)} ur
        JOIN ${escapeIdent6(rolePermsTable)} rp ON rp.role_id = ur.role_id
        WHERE ur.user_id = $1 ORDER BY rp.permission`,
-      [userId]
+      [userId2]
     );
     return rows.map((r) => r.permission);
   }
   const mw = (async (req, ctx, next) => {
-    const userId = ctx.user?.id;
+    const userId2 = ctx.user?.id;
     let roles = /* @__PURE__ */ new Set();
     let perms = /* @__PURE__ */ new Set();
-    if (userId) {
-      const userRoles = await getUserRoles(userId);
-      const userPerms = userId ? await getUserPermissions(userId) : [];
+    if (userId2) {
+      const userRoles = await getUserRoles(userId2);
+      const userPerms = userId2 ? await getUserPermissions(userId2) : [];
       roles = new Set(userRoles);
       perms = new Set(userPerms);
       const hasWildcard = userPerms.includes("*");
@@ -11534,7 +11607,6 @@ export {
   aiProvider,
   aiStream,
   analytics,
-  auth,
   cache2 as cache,
   compress,
   cors,
@@ -11552,6 +11624,7 @@ export {
   deploy,
   embed,
   embedMany,
+  env,
   flash,
   formatSSE,
   formatSSEData,
@@ -11559,6 +11632,7 @@ export {
   generateObject,
   generateText2 as generateText,
   getCookies,
+  getPublicEnv,
   graphql,
   health,
   helmet,
@@ -11600,6 +11674,7 @@ export {
   testApp,
   theme,
   tool2 as tool,
+  trace,
   traceElapsed,
   upload,
   user,