weifuwu 0.24.2 → 0.25.0

package/dist/index.js

@@ -65,7 +65,8 @@ function isBundled() {
   return true ? true : false;
 }
 function isDev() {
-  return process.env.NODE_ENV === "development";
+  const env2 = process.env.NODE_ENV;
+  return env2 !== "production" && env2 !== "test";
 }
 function isProd() {
   return process.env.NODE_ENV === "production";
@@ -293,20 +294,20 @@ function serve(handler, options) {
         process.off("SIGINT", shutdownHandler);
         shutdownHandler = null;
       }
-      return new Promise((resolve14) => {
+      return new Promise((resolve16) => {
         if (!server.listening) {
-          resolve14();
+          resolve16();
           return;
         }
         server.close();
         server.closeIdleConnections();
         const timer = setTimeout(() => {
           server.closeAllConnections();
-          resolve14();
+          resolve16();
         }, timeoutMs);
         server.on("close", () => {
           clearTimeout(timer);
-          resolve14();
+          resolve16();
         });
       });
     },
@@ -466,6 +467,8 @@ var Router = class _Router {
   _hasWildcard = false;
   _hub;
   _wss;
+  /** Track which ctx fields have been injected so far (for dependency checking). */
+  _ctxFields = /* @__PURE__ */ new Set();
   get wss() {
     if (!this._wss) this._wss = new WebSocketServer({ noServer: true });
     return this._wss;
@@ -489,17 +492,47 @@ var Router = class _Router {
           node = getOrCreateChild(node, segment, createTrieNode, false);
         }
         node.pathMws.push(arg2);
+        this._checkMiddlewareMeta(arg2, `${arg1}`);
       }
     } else if (typeof arg1 === "function") {
       this.globalMws.push(arg1);
+      this._checkMiddlewareMeta(arg1, "global");
     } else if (typeof arg1 === "object" && arg1 !== null && "middleware" in arg1 && // eslint-disable-next-line @typescript-eslint/no-explicit-any
     typeof arg1.middleware === "function" && arg1 instanceof _Router) {
       const mod = arg1;
-      this.globalMws.push(mod.middleware());
+      const mw = mod.middleware();
+      this.globalMws.push(mw);
+      this._checkMiddlewareMeta(mw, "global (auto-registered)");
       this._mountRouter("/", mod);
     }
     return this;
   }
+  /**
+   * Check a middleware's dependency metadata and emit warnings if
+   * required fields haven't been injected yet.
+   * Attach __meta to a middleware function:
+   *
+   * ```ts
+   * mw.__meta = { injects: ['sql'], depends: ['session'] }
+   * ```
+   */
+  _checkMiddlewareMeta(mw, location) {
+    const meta = mw.__meta ?? mw.middleware?.().__meta;
+    if (!meta) return;
+    for (const dep of meta.depends) {
+      if (!this._ctxFields.has(dep)) {
+        console.warn(
+          `[weifuwu] Middleware at "${location}" depends on ctx.${dep} but it hasn't been registered yet.
+  Register the provider before this middleware:
+    app.use(${dep}())  // add before this middleware
+  Current ctx fields: [${[...this._ctxFields].join(", ")}]`
+        );
+      }
+    }
+    for (const field of meta.injects) {
+      this._ctxFields.add(field);
+    }
+  }
   // Route registration — returns Router<T> unchanged.
   // Route-level middleware and handlers get Context<T>.
   get(path2, ...args) {
@@ -1487,7 +1520,7 @@ function upload(options) {
 }
 
 // rate-limit.ts
-function defaultKey(_req, _ctx) {
+function defaultKey(_req, _ctx2) {
   const forwarded = _req.headers.get("x-forwarded-for");
   if (forwarded) return forwarded.split(",")[0].trim();
   const realIp = _req.headers.get("x-real-ip");
@@ -1567,6 +1600,7 @@ function rateLimit(options) {
     const res = await next(req, ctx);
     return addRateLimitHeaders(res, max, remaining, reset);
   };
+  mw.__meta = { injects: [], depends: [] };
   mw.close = () => {
     if (interval) clearInterval(interval);
     hits.clear();
@@ -1750,6 +1784,7 @@ function createSSEStream(iterable, opts) {
 }
 
 // test-utils.ts
+import { WebSocket as WSWebSocket } from "ws";
 var TestResponseImpl = class {
   response;
   constructor(response) {
@@ -1845,9 +1880,22 @@ var TestRequest = class {
 };
 var TestApp = class {
   router;
+  wsServer = null;
+  wsConnections = [];
   constructor() {
     this.router = new Router();
   }
+  /**
+   * Register a WebSocket handler.
+   */
+  ws(path2, handler) {
+    this.router.ws(path2, handler);
+    return this;
+  }
+  /** Get the raw Router (for advanced use). */
+  get _router() {
+    return this.router;
+  }
   /** Add global middleware */
   use(mw) {
     this.router.use(mw);
@@ -1907,6 +1955,195 @@ var TestApp = class {
   handler() {
     return this.router.handler();
   }
+  /** Start building a WebSocket connection to the given path. */
+  wsReq(path2) {
+    return new TestWSRequest(this, path2);
+  }
+  /**
+   * Internal: ensure HTTP server is running for WebSocket connections.
+   * Starts on a random port.
+   */
+  /* @internal */
+  async _ensureServer() {
+    if (this.wsServer) {
+      return `http://localhost:${this.wsServer.port}`;
+    }
+    const wsHandler = this.router.websocketHandler();
+    if (!wsHandler) {
+      throw new Error(
+        "No WebSocket routes registered. Use app.ws(path, handler) before calling wsReq()."
+      );
+    }
+    this.wsServer = serve(this.router.handler(), {
+      websocket: wsHandler
+    });
+    await this.wsServer.ready;
+    return `http://localhost:${this.wsServer.port}`;
+  }
+  /**
+   * Internal: register a WS connection for cleanup.
+   */
+  /* @internal */
+  _trackConnection(conn) {
+    this.wsConnections.push(conn);
+  }
+  /**
+   * Cleanup all WebSocket connections and stop the server.
+   */
+  async close() {
+    for (const conn of this.wsConnections) {
+      try {
+        conn.close();
+      } catch {
+      }
+    }
+    this.wsConnections = [];
+    if (this.wsServer) {
+      this.wsServer.stop();
+      this.wsServer = null;
+    }
+  }
+};
+var TestWSRequest = class {
+  app;
+  path;
+  _timeout = 5e3;
+  constructor(app, path2) {
+    this.app = app;
+    this.path = path2;
+  }
+  /** Set the timeout for operations (default: 5000ms). */
+  timeout(ms) {
+    this._timeout = ms;
+    return this;
+  }
+  /**
+   * Connect to the WebSocket endpoint.
+   * Starts a real HTTP server (random port) if not already running.
+   */
+  async connect() {
+    const baseUrl = await this.app._ensureServer();
+    const wsUrl = baseUrl.replace(/^http/, "ws") + this.path;
+    const ws = new WSWebSocket(wsUrl, { handshakeTimeout: this._timeout });
+    return new Promise((resolve16, reject) => {
+      const timer = setTimeout(() => {
+        reject(new Error(`WebSocket connection timed out after ${this._timeout}ms`));
+        ws.close();
+      }, this._timeout);
+      ws.on("open", () => {
+        clearTimeout(timer);
+        const conn = new TestWSConnection(ws, this._timeout);
+        this.app._trackConnection(conn);
+        resolve16(conn);
+      });
+      ws.on("error", (err) => {
+        clearTimeout(timer);
+        reject(new Error(`WebSocket connection error: ${err.message}`));
+      });
+      ws.on("unexpected-response", (_req, res) => {
+        clearTimeout(timer);
+        let body = "";
+        res.on("data", (chunk) => {
+          body += chunk.toString();
+        });
+        res.on("end", () => {
+          reject(new Error(`WebSocket upgrade rejected (${res.statusCode}): ${body.slice(0, 200)}`));
+        });
+      });
+    });
+  }
+};
+var TestWSConnection = class {
+  ws;
+  _timeout;
+  messageQueue = [];
+  resolveQueue = [];
+  _closed = false;
+  constructor(ws, timeout = 5e3) {
+    this.ws = ws;
+    this._timeout = timeout;
+    ws.on("message", (data) => {
+      const str = data.toString();
+      if (this.resolveQueue.length > 0) {
+        const resolve16 = this.resolveQueue.shift();
+        resolve16(str);
+      } else {
+        this.messageQueue.push(str);
+      }
+    });
+    ws.on("close", () => {
+      this._closed = true;
+      for (const _r of this.resolveQueue) {
+      }
+    });
+  }
+  /** Send a text message. */
+  send(data) {
+    this.ws.send(data);
+  }
+  /** Send a JSON message. */
+  json(data) {
+    this.ws.send(JSON.stringify(data));
+  }
+  /**
+   * Wait for the next message. Returns the raw text.
+   * Throws on timeout or if the connection is closed.
+   */
+  async receive(timeout) {
+    if (this.messageQueue.length > 0) {
+      return this.messageQueue.shift();
+    }
+    if (this._closed) {
+      throw new Error("WebSocket connection closed");
+    }
+    return new Promise((resolve16, reject) => {
+      const timer = setTimeout(() => {
+        const idx = this.resolveQueue.indexOf(resolve16);
+        if (idx !== -1) this.resolveQueue.splice(idx, 1);
+        reject(new Error(`WebSocket receive timed out after ${timeout ?? this._timeout}ms`));
+      }, timeout ?? this._timeout);
+      this.resolveQueue.push((msg) => {
+        clearTimeout(timer);
+        resolve16(msg);
+      });
+    });
+  }
+  /** Wait for the next message and parse as JSON. */
+  async receiveJson() {
+    const msg = await this.receive();
+    return JSON.parse(msg);
+  }
+  /**
+   * Assert that no message is received within the given silence period.
+   * Useful for verifying that something did NOT happen.
+   */
+  async expectSilent(ms) {
+    return new Promise((resolve16, reject) => {
+      if (this.messageQueue.length > 0) {
+        reject(new Error(`Expected silence but got message: ${this.messageQueue[0].slice(0, 100)}`));
+        return;
+      }
+      const timer = setTimeout(() => resolve16(), ms);
+      const origPush = this.resolveQueue.push.bind(this.resolveQueue);
+      this.resolveQueue.push = (_fn) => {
+        clearTimeout(timer);
+        reject(new Error("Expected silence but received a message"));
+        return 0;
+      };
+      setTimeout(() => {
+        this.resolveQueue.push = origPush;
+      }, ms + 10).unref();
+    });
+  }
+  /** Close the connection. */
+  close() {
+    this._closed = true;
+    this.ws.close();
+  }
+  /** Whether the connection is closed. */
+  get closed() {
+    return this._closed;
+  }
 };
 function testApp() {
   return new TestApp();
@@ -2506,6 +2743,7 @@ function aiProvider(options) {
     ctx.ai = provider;
     return next(req, ctx);
   };
+  mw.__meta = { injects: ["ai"], depends: [] };
   return Object.assign(mw, provider);
 }
 
@@ -3115,6 +3353,7 @@ function postgres(opts) {
     ctx.sql = sql2;
     return next(req, ctx);
   });
+  mw.__meta = { injects: ["sql"], depends: [] };
   mw.sql = sql2;
   mw.table = ((tableOrSchema, builders) => {
     if (typeof tableOrSchema === "string") {
@@ -3191,7 +3430,7 @@ var PgModule = class {
 };
 
 // user/client.ts
-import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import { randomBytes, scryptSync, timingSafeEqual, createHash } from "node:crypto";
 import jwt2 from "jsonwebtoken";
 import { z as z2 } from "zod";
 
@@ -3317,7 +3556,7 @@ h2{color:#dc2626}.desc{color:#555}</style>
       { status: 400, headers: { "Content-Type": "text/html; charset=utf-8" } }
     );
   }
-  async function authorizeHandler(req, _ctx) {
+  async function authorizeHandler(req, _ctx2) {
     const url = new URL(req.url);
     const clientId = url.searchParams.get("client_id") || "";
     const redirectUri = url.searchParams.get("redirect_uri") || "";
@@ -3738,6 +3977,10 @@ var LoginSchema = z2.object({
   email: z2.string().email(),
   password: z2.string().min(1)
 });
+var CreateApiKeySchema = z2.object({
+  name: z2.string().min(1),
+  scopes: z2.array(z2.string()).optional()
+});
 function escapeIdent2(s) {
   return `"${s.replace(/"/g, '""')}"`;
 }
@@ -3784,6 +4027,7 @@ function user(options) {
   const secret = options.jwtSecret;
   const expiresIn = options.expiresIn ?? "24h";
   const oauth2Enabled = options.oauth2?.server ?? false;
+  const apiKeysEnabled = options.apiKeys ?? false;
   const base = hasDb ? new PgModule(pg) : null;
   const users = hasDb ? pg.table(table, {
     id: serial("id").primaryKey(),
@@ -3821,6 +4065,28 @@ function user(options) {
         ON "_auth_providers"(user_id)
       `);
     }
+    if (apiKeysEnabled) {
+      await _pg.sql.unsafe(`
+        CREATE TABLE IF NOT EXISTS "_api_keys" (
+          id          SERIAL PRIMARY KEY,
+          user_id     INTEGER NOT NULL REFERENCES ${escapeIdent2(table)}(id) ON DELETE CASCADE,
+          name        TEXT NOT NULL,
+          key_prefix  TEXT NOT NULL,
+          key_hash    TEXT NOT NULL,
+          scopes      TEXT[] DEFAULT '{}',
+          last_used_at TIMESTAMPTZ,
+          expires_at  TIMESTAMPTZ,
+          created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+          revoked     BOOLEAN DEFAULT false
+        )
+      `);
+      await _pg.sql.unsafe(`
+        CREATE INDEX IF NOT EXISTS "_api_keys_user_idx" ON "_api_keys"(user_id)
+      `);
+      await _pg.sql.unsafe(`
+        CREATE UNIQUE INDEX IF NOT EXISTS "_api_keys_hash_idx" ON "_api_keys"(key_hash)
+      `);
+    }
     if (!oauth2Enabled) return;
     const clients3 = _pg.table("_oauth2_clients", {
       id: serial("id").primaryKey(),
@@ -3921,8 +4187,79 @@ function user(options) {
       return null;
     }
   }
+  function hashApiKey(key) {
+    return createHash("sha256").update(key).digest("hex");
+  }
+  function generateApiKey() {
+    const random = randomBytes(32).toString("hex");
+    return `sk_live_${random}`;
+  }
+  async function createApiKey(userId2, name, scopes) {
+    if (!hasDb) throw new Error("user(): pg required for API key management");
+    const key = generateApiKey();
+    const keyHash = hashApiKey(key);
+    const prefix = key.slice(0, 12) + "..." + key.slice(-4);
+    const [row] = await _pg.sql.unsafe(
+      `INSERT INTO "_api_keys" (user_id, name, key_prefix, key_hash, scopes)
+       VALUES ($1, $2, $3, $4, $5) RETURNING id`,
+      [userId2, name, prefix, keyHash, scopes ?? []]
+    );
+    return { id: row.id, key };
+  }
+  async function listApiKeys(userId2) {
+    if (!hasDb) return [];
+    const rows = await _pg.sql.unsafe(
+      `SELECT id, name, key_prefix, scopes, last_used_at, created_at, revoked
+       FROM "_api_keys" WHERE user_id = $1 ORDER BY created_at DESC`,
+      [userId2]
+    );
+    return rows.map((r2) => ({
+      id: r2.id,
+      name: r2.name,
+      prefix: r2.key_prefix,
+      scopes: Array.isArray(r2.scopes) ? r2.scopes : [],
+      last_used_at: r2.last_used_at ? new Date(r2.last_used_at).toISOString() : null,
+      created_at: new Date(r2.created_at).toISOString(),
+      revoked: !!r2.revoked
+    }));
+  }
+  async function revokeApiKey(userId2, keyId) {
+    if (!hasDb) throw new Error("user(): pg required for API key management");
+    await _pg.sql.unsafe(`UPDATE "_api_keys" SET revoked = true WHERE id = $1 AND user_id = $2`, [
+      keyId,
+      userId2
+    ]);
+  }
+  async function verifyApiKey(key) {
+    if (!hasDb || !apiKeysEnabled) return null;
+    const keyHash = hashApiKey(key);
+    const [row] = await _pg.sql.unsafe(
+      `SELECT id, user_id, scopes, revoked, expires_at
+       FROM "_api_keys" WHERE key_hash = $1 LIMIT 1`,
+      [keyHash]
+    );
+    if (!row) return null;
+    if (row.revoked) return null;
+    if (row.expires_at && new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
+    await _pg.sql.unsafe(
+      `UPDATE "_api_keys" SET last_used_at = NOW() WHERE id = $1 AND last_used_at IS NULL OR last_used_at < NOW() - interval '1 minute'`,
+      [row.id]
+    ).catch(() => {
+    });
+    return {
+      userId: row.user_id,
+      scopes: Array.isArray(row.scopes) ? row.scopes : []
+    };
+  }
+  async function tryApiKeyAuth(token) {
+    if (!apiKeysEnabled || !hasDb) return null;
+    if (!token.startsWith("sk_")) return null;
+    return verifyApiKey(token);
+  }
   const headerName = options.header ?? "Authorization";
   async function resolveUser(req, ctx) {
+    const _ctx2 = ctx;
+    if (_ctx2.user) return _ctx2.user;
     const s = ctx;
     const sessionUserId = s.session?.userId;
     if (sessionUserId !== void 0 && sessionUserId !== null) {
@@ -3998,6 +4335,17 @@ function user(options) {
         return null;
       }
     }
+    if (token.startsWith("sk_")) {
+      const result = await tryApiKeyAuth(token);
+      if (result) {
+        if (hasDb) {
+          const row = await findById(result.userId);
+          if (row) return { ...stripPassword(row), _apiKeyScopes: result.scopes };
+        }
+        return { id: result.userId, _apiKeyScopes: result.scopes };
+      }
+      return null;
+    }
     if (secret && hasDb) {
       try {
         const payload = jwt2.verify(token, secret);
@@ -4083,6 +4431,33 @@ function user(options) {
       }
     });
   }
+  if (apiKeysEnabled) {
+    r.get("/api-keys", middleware(), async (_req, ctx) => {
+      const keys = await listApiKeys(ctx.user.id);
+      return Response.json(keys);
+    });
+    r.post("/api-keys", middleware(), async (req, ctx) => {
+      try {
+        const body = await parseBody2(req);
+        const { name, scopes } = CreateApiKeySchema.parse(body);
+        const result = await createApiKey(ctx.user.id, name, scopes);
+        return Response.json(result, { status: 201 });
+      } catch (err) {
+        if (err instanceof z2.ZodError) {
+          return Response.json({ error: "Validation failed", issues: err.issues }, { status: 400 });
+        }
+        return Response.json({ error: err.message }, { status: 500 });
+      }
+    });
+    r.delete("/api-keys/:id", middleware(), async (req, ctx) => {
+      const keyId = parseInt(ctx.params.id, 10);
+      if (isNaN(keyId)) {
+        return Response.json({ error: "Invalid key ID" }, { status: 400 });
+      }
+      await revokeApiKey(ctx.user.id, keyId);
+      return Response.json({ ok: true });
+    });
+  }
   if (oauth2) {
     r.get("/oauth/authorize", (req, ctx) => oauth2.authorizeHandler(req, ctx));
     r.post("/oauth/consent", (req) => oauth2.consentHandler(req));
@@ -4127,6 +4502,21 @@ function user(options) {
   mod.revokeClient = oauth2 ? (clientId) => oauth2.revokeClient(clientId) : async () => {
     throw new Error("OAuth2 server is not enabled");
   };
+  mod.createApiKey = hasDb && apiKeysEnabled ? createApiKey : async () => {
+    throw new Error(
+      "API key management is not enabled. Pass apiKeys: true in user() options."
+    );
+  };
+  mod.listApiKeys = hasDb && apiKeysEnabled ? listApiKeys : async () => {
+    throw new Error(
+      "API key management is not enabled. Pass apiKeys: true in user() options."
+    );
+  };
+  mod.revokeApiKey = hasDb && apiKeysEnabled ? revokeApiKey : async () => {
+    throw new Error(
+      "API key management is not enabled. Pass apiKeys: true in user() options."
+    );
+  };
   mod.close = hasDb ? () => base.close() : async () => {
   };
   return mod;
@@ -4143,6 +4533,7 @@ function redis(opts) {
     ctx.redis = client;
     return next(req, ctx);
   });
+  mw.__meta = { injects: ["redis"], depends: [] };
   mw.redis = client;
   mw.close = () => client.quit();
   return mw;
@@ -5590,23 +5981,23 @@ function buildGraphQLHandler(sql2) {
     });
     return Response.json(result, { status: result.errors ? 400 : 200 });
   });
-  r.get("/", async (req, _ctx) => {
+  r.get("/", async (req, _ctx2) => {
     const url = new URL(req.url);
     if (url.searchParams.has("query")) {
-      return handleGET(req, _ctx);
+      return handleGET(req, _ctx2);
     }
     return new Response("GraphQL endpoint. Send POST /graphql with { query, variables }", {
       status: 200,
       headers: { "Content-Type": "text/plain" }
     });
   });
-  async function handleGET(req, _ctx) {
+  async function handleGET(req, _ctx2) {
     const tables = await sql2`
       SELECT * FROM "_user_tables"
-      WHERE tenant_id = ${_ctx.tenant.id}
+      WHERE tenant_id = ${_ctx2.tenant.id}
       ORDER BY created_at ASC
     `;
-    const buildCtx = { sql: sql2, tenantId: _ctx.tenant.id, tables, typeCache: /* @__PURE__ */ new Map() };
+    const buildCtx = { sql: sql2, tenantId: _ctx2.tenant.id, tables, typeCache: /* @__PURE__ */ new Map() };
     const schema = new GraphQLSchema({
       query: new GraphQLObjectType({
         name: "Query",
@@ -5626,7 +6017,7 @@ function buildGraphQLHandler(sql2) {
       source: query,
       variableValues: variables,
       operationName: url.searchParams.get("operationName") || void 0,
-      contextValue: _ctx
+      contextValue: _ctx2
     });
     return Response.json(result, { status: result.errors ? 400 : 200 });
   }
@@ -6653,14 +7044,14 @@ function forkApp(opts) {
   return { child, port: opts.port };
 }
 function stopProcess(mp, timeout = 1e4) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve16) => {
     const timer = setTimeout(() => {
       mp.child.kill("SIGKILL");
-      resolve14();
+      resolve16();
     }, timeout);
     mp.child.on("exit", () => {
       clearTimeout(timer);
-      resolve14();
+      resolve16();
     });
     mp.child.kill("SIGTERM");
   });
@@ -6992,22 +7383,168 @@ import { createOpenAI as createOpenAI3 } from "@ai-sdk/openai";
 
 // ssr.ts
 import { createElement as createElement3 } from "react";
-import { createHash as createHash3 } from "node:crypto";
-import { existsSync as existsSync4, readFileSync as readFileSync4, readdirSync } from "node:fs";
+import { createHash as createHash5 } from "node:crypto";
+import { existsSync as existsSync6, readdirSync } from "node:fs";
 import { readdir, stat } from "node:fs/promises";
-import { dirname as dirname3, join as join5, resolve as resolve6, relative as relative2 } from "node:path";
+import { dirname as dirname4, join as join5, resolve as resolve8, relative as relative3 } from "node:path";
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 
 // compile.ts
-import * as esbuild from "esbuild";
-import { existsSync, mkdirSync, readFileSync as readFileSync2 } from "node:fs";
-import { join as join2, resolve as resolve3, dirname } from "node:path";
+import * as esbuild2 from "esbuild";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3 } from "node:fs";
+import { join as join2, resolve as resolve4, dirname as dirname2 } from "node:path";
 import { pathToFileURL } from "node:url";
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
+import { createRequire as createRequire2 } from "node:module";
+
+// server-registry.ts
+import * as esbuild from "esbuild";
+import { existsSync, readFileSync as readFileSync2, statSync } from "node:fs";
+import { resolve as resolve3, dirname } from "node:path";
 import vm from "node:vm";
 import { createRequire } from "node:module";
-var _cjsRequire = createRequire(import.meta.url);
 var _userRequire = null;
+function getUserRequire() {
+  if (!_userRequire) {
+    try {
+      _userRequire = createRequire(resolve3(process.cwd(), "package.json"));
+    } catch {
+      _userRequire = createRequire(import.meta.url);
+    }
+  }
+  return _userRequire;
+}
+var _alias = null;
+function resolveAliases() {
+  if (_alias) return _alias;
+  const configFiles = ["tsconfig.json", "jsconfig.json"];
+  for (const file of configFiles) {
+    const p = resolve3(file);
+    if (existsSync(p)) {
+      try {
+        const config = JSON.parse(readFileSync2(p, "utf-8"));
+        const paths = config.compilerOptions?.paths;
+        if (paths) {
+          const alias = {};
+          for (const [key, values] of Object.entries(paths)) {
+            const cleanKey = key.replace("/*", "");
+            const val = values[0]?.replace("/*", "");
+            if (val) alias[cleanKey] = resolve3(dirname(p), val);
+          }
+          _alias = alias;
+          return alias;
+        }
+      } catch {
+      }
+    }
+  }
+  _alias = {};
+  return {};
+}
+function applyAlias(id2, _moduleDir) {
+  const aliases = resolveAliases();
+  for (const [prefix, target] of Object.entries(aliases)) {
+    if (id2.startsWith(prefix)) {
+      const rest = id2.slice(prefix.length);
+      return target + rest;
+    }
+  }
+  return null;
+}
+var exts = [".tsx", ".ts", ".jsx", ".js"];
+function tryResolve(base) {
+  if (existsSync(base)) {
+    const stat3 = statSync(base);
+    if (stat3.isFile()) return base;
+    if (stat3.isDirectory()) {
+      for (const ext of exts) {
+        const p = resolve3(base, `index${ext}`);
+        if (existsSync(p)) return p;
+      }
+      return null;
+    }
+  }
+  for (const ext of exts) {
+    const p = base + ext;
+    if (existsSync(p)) return p;
+  }
+  return null;
+}
+var registry = /* @__PURE__ */ new Map();
+var _ctx = vm.createContext(Object.create(globalThis));
+function transformToCjs(absPath, source) {
+  const isTsx = absPath.endsWith(".tsx");
+  const result = esbuild.transformSync(source, {
+    loader: isTsx ? "tsx" : "ts",
+    format: "cjs",
+    jsx: isTsx ? "automatic" : void 0,
+    jsxImportSource: isTsx ? "react" : void 0,
+    sourcemap: false
+  });
+  return result.code;
+}
+function makeRequire(modulePath) {
+  const moduleDir = dirname(modulePath);
+  return (id2) => {
+    if (id2.startsWith(".")) {
+      const base = resolve3(moduleDir, id2);
+      const file = tryResolve(base);
+      if (!file) {
+        throw new Error(
+          `[server-registry] Cannot resolve '${id2}' from '${modulePath}'. Tried: ${[base, ...exts.map((e) => base + e)].filter((p) => !p.endsWith(base)).join(", ")}`
+        );
+      }
+      return getServerModule(file);
+    }
+    const aliased = applyAlias(id2, moduleDir);
+    if (aliased) {
+      const file = tryResolve(aliased);
+      if (file) return getServerModule(file);
+    }
+    return getUserRequire()(id2);
+  };
+}
+function evaluateModule(code, modulePath) {
+  const mod = { exports: {} };
+  const require2 = makeRequire(modulePath);
+  const _dirname = dirname(modulePath);
+  const _filename = modulePath;
+  const wrapped = `(function(require,module,exports,__dirname,__filename){
+${code}
+})`;
+  try {
+    new vm.Script(wrapped).runInContext(_ctx)(require2, mod, mod.exports, _dirname, _filename);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    const cause = err instanceof Error ? err : void 0;
+    throw new Error(
+      `[server-registry] Error evaluating '${modulePath}': ${msg}`,
+      cause ? { cause } : void 0
+    );
+  }
+  return mod.exports;
+}
+function getServerModule(absPath) {
+  const normalized = resolve3(absPath);
+  if (registry.has(normalized)) return registry.get(normalized).exports;
+  const source = readFileSync2(normalized, "utf-8");
+  const code = transformToCjs(normalized, source);
+  const exports = evaluateModule(code, normalized);
+  registry.set(normalized, { exports });
+  return exports;
+}
+function clearServerModule(absPath) {
+  if (absPath) {
+    const normalized = resolve3(absPath);
+    registry.delete(normalized);
+  } else {
+    registry.clear();
+    _alias = null;
+  }
+}
+
+// compile.ts
+var _userRequire2 = null;
 var OUT_DIR = ".weifuwu/ssr";
 var cache = /* @__PURE__ */ new Map();
 var externals = [
@@ -7020,48 +7557,49 @@ var externals = [
   "@graphql-tools/schema",
   "ai"
 ];
-var _alias = null;
-function resolveAliases() {
-  if (_alias) return _alias;
+var _alias2 = null;
+function resolveAliases2() {
+  if (_alias2) return _alias2;
   const configFiles = ["tsconfig.json", "jsconfig.json"];
   for (const file of configFiles) {
-    const p = resolve3(file);
-    if (existsSync(p)) {
+    const p = resolve4(file);
+    if (existsSync2(p)) {
       try {
-        const config = JSON.parse(readFileSync2(p, "utf-8"));
+        const config = JSON.parse(readFileSync3(p, "utf-8"));
         const paths = config.compilerOptions?.paths;
         if (paths) {
           const alias = {};
           for (const [key, values] of Object.entries(paths)) {
             const cleanKey = key.replace("/*", "");
             const val = values[0]?.replace("/*", "");
-            if (val) alias[cleanKey] = resolve3(dirname(p), val);
+            if (val) alias[cleanKey] = resolve4(dirname2(p), val);
           }
-          _alias = alias;
+          _alias2 = alias;
           return alias;
         }
       } catch {
       }
     }
   }
-  _alias = {};
+  _alias2 = {};
   return {};
 }
 function id(s) {
-  return createHash("md5").update(s).digest("hex").slice(0, 8);
+  return createHash2("md5").update(s).digest("hex").slice(0, 8);
 }
 function clearCompileCache() {
   cache.clear();
-  _alias = null;
+  clearServerModule();
+  _alias2 = null;
 }
 async function compileTsx(path2) {
-  const absPath = resolve3(path2);
+  const absPath = resolve4(path2);
   if (cache.has(absPath)) return cache.get(absPath);
-  const outDir = resolve3(OUT_DIR);
+  const outDir = resolve4(OUT_DIR);
   mkdirSync(outDir, { recursive: true });
   const hash = id(absPath);
   const outPath = join2(outDir, hash + ".js");
-  await esbuild.build({
+  await esbuild2.build({
     entryPoints: { [hash]: absPath },
     outdir: outDir,
     format: "esm",
@@ -7070,7 +7608,7 @@ async function compileTsx(path2) {
     jsxImportSource: "react",
     bundle: true,
     external: externals,
-    alias: resolveAliases(),
+    alias: resolveAliases2(),
     write: true,
     allowOverwrite: true
   });
@@ -7078,42 +7616,20 @@ async function compileTsx(path2) {
   cache.set(absPath, mod);
   return mod;
 }
-function loadSSRModule(code) {
-  const ctx = vm.createContext(Object.create(globalThis));
-  const mod = { exports: {} };
-  ctx.require = (name) => _cjsRequire(name);
-  ctx.module = mod;
-  ctx.exports = mod.exports;
-  new vm.Script(code).runInContext(ctx);
-  return mod.exports;
-}
-async function compileTsxDev(path2) {
-  const absPath = resolve3(path2);
-  if (cache.has(absPath)) return cache.get(absPath);
-  const result = await esbuild.build({
-    entryPoints: { [id(absPath)]: absPath },
-    format: "cjs",
-    platform: "node",
-    jsx: "automatic",
-    jsxImportSource: "react",
-    bundle: true,
-    external: externals,
-    alias: resolveAliases(),
-    write: false
-  });
-  const code = new TextDecoder().decode(result.outputFiles[0].contents);
-  const mod = loadSSRModule(code);
+function compileTsxDev(path2) {
+  const absPath = resolve4(path2);
+  const mod = getServerModule(absPath);
   cache.set(absPath, mod);
   return mod;
 }
 function compile(path2) {
-  return isDev() ? compileTsxDev(path2) : compileTsx(path2);
+  return isDev() ? Promise.resolve(compileTsxDev(path2)) : compileTsx(path2);
 }
 var vendorBundle = null;
 var vendorHash = "";
 async function compileVendorBundle() {
   if (vendorBundle) return vendorBundle;
-  if (!_userRequire) _userRequire = createRequire(join2(process.cwd(), "package.json"));
+  if (!_userRequire2) _userRequire2 = createRequire2(join2(process.cwd(), "package.json"));
   const modules = {
     react: [],
     "react-dom": ["react"],
@@ -7121,13 +7637,13 @@ async function compileVendorBundle() {
     "react/jsx-runtime": ["react"]
   };
   for (const request of Object.keys(modules)) {
-    const mod = _userRequire(request);
+    const mod = _userRequire2(request);
     const keys = Object.keys(mod).filter((k) => !k.startsWith("_") && k !== "default");
     modules[request] = keys;
   }
   const baseDir = import.meta.dirname ?? __dirname;
-  const reactAbsPath = isBundled() ? resolve3(baseDir, "react.js") : resolve3(baseDir, "react.ts");
-  const reactSrc = readFileSync2(reactAbsPath, "utf-8");
+  const reactAbsPath = isBundled() ? resolve4(baseDir, "react.js") : resolve4(baseDir, "react.ts");
+  const reactSrc = readFileSync3(reactAbsPath, "utf-8");
   const wfwKeys = [];
   if (reactAbsPath.endsWith(".ts")) {
     for (const line of reactSrc.split("\n")) {
@@ -7158,7 +7674,7 @@ async function compileVendorBundle() {
   const uidWfw = wfwKeys.filter((k) => !used.has(k) && used.add(k));
   if (uidWfw.length > 0)
     stmts.push(`export { ${uidWfw.join(", ")} } from ${JSON.stringify(reactAbsPath)};`);
-  const result = await esbuild.build({
+  const result = await esbuild2.build({
     stdin: { contents: stmts.join("\n"), resolveDir: process.cwd() },
     format: "esm",
     bundle: true,
@@ -7170,95 +7686,6 @@ async function compileVendorBundle() {
   vendorHash = Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 8);
   return vendorBundle;
 }
-async function compileBrowser(path2, outDir) {
-  const absPath = resolve3(path2);
-  const h = id(absPath);
-  outDir = outDir ?? resolve3(OUT_DIR);
-  const outPath = join2(outDir, h + ".js");
-  if (!isDev() && existsSync(outPath)) return h;
-  mkdirSync(outDir, { recursive: true });
-  const wfwDir = resolve3(import.meta.dirname ?? __dirname);
-  const plugin = {
-    name: "wfw-external",
-    setup(build2) {
-      build2.onResolve({ filter: /./ }, (args) => {
-        if (args.kind === "entry-point") return;
-        const abs = args.path.startsWith(".") ? join2(args.resolveDir, args.path) : args.path;
-        if (abs.startsWith(wfwDir) && !abs.includes("node_modules")) {
-          const rel = abs.slice(wfwDir.length + 1);
-          if (rel.includes("/")) return;
-          return { path: "weifuwu/react", external: true };
-        }
-      });
-    }
-  };
-  await esbuild.build({
-    entryPoints: { [h]: absPath },
-    outdir: outDir,
-    format: "esm",
-    platform: "browser",
-    jsx: "automatic",
-    jsxImportSource: "react",
-    bundle: true,
-    external: [
-      "react",
-      "react-dom",
-      "react-dom/client",
-      "react/jsx-runtime",
-      "weifuwu",
-      "weifuwu/react"
-    ],
-    plugins: [plugin],
-    write: true,
-    allowOverwrite: true
-  });
-  return h;
-}
-async function compileHotComponent(path2) {
-  const absPath = resolve3(path2);
-  const h = id(absPath);
-  const stdin = `import C from ${JSON.stringify(absPath)};
-(window.__WFW_REFRESH||function(){})(C)`;
-  const wfwDir = resolve3(import.meta.dirname ?? __dirname);
-  const plugin = {
-    name: "wfw-external",
-    setup(build2) {
-      build2.onResolve({ filter: /./ }, (args) => {
-        if (args.kind === "entry-point") return;
-        const abs = args.path.startsWith(".") ? join2(args.resolveDir, args.path) : args.path;
-        if (abs.startsWith(wfwDir) && !abs.includes("node_modules")) {
-          const rel = abs.slice(wfwDir.length + 1);
-          if (rel.includes("/")) return;
-          return { path: "weifuwu/react", external: true };
-        }
-      });
-    }
-  };
-  const result = await esbuild.build({
-    stdin: { contents: stdin, loader: "tsx", resolveDir: dirname(absPath) },
-    format: "esm",
-    platform: "browser",
-    jsx: "automatic",
-    jsxImportSource: "react",
-    bundle: true,
-    external: [
-      "react",
-      "react-dom",
-      "react-dom/client",
-      "react/jsx-runtime",
-      "weifuwu",
-      "weifuwu/react"
-    ],
-    plugins: [plugin],
-    write: false
-  });
-  let code = new TextDecoder().decode(result.outputFiles[0].contents);
-  if (code.includes("__require") && (code.includes('"react"') || code.includes("'react'"))) {
-    code = `import * as __r from 'react';
-` + code.replace(/__require\(["']react["']\)/g, "__r");
-  }
-  return { hash: h, code };
-}
 
 // stream.ts
 import { TextDecoder as TextDecoder2, TextEncoder as TextEncoder2 } from "node:util";
@@ -7276,6 +7703,8 @@ function getPublicEnv2() {
 function buildHeadPayload(opts) {
   const { ctx, base, tailwind } = opts;
   let result = "";
+  result += `<script>window.__wfw={_cache:{},_k:function(u){return u.split('?')[0]},h:async function(u){var k=this._k(u);if(this._cache[k])return this._cache[k];var m=await import(u);this._cache[k]=m;return m},_update:function(u,mod){var k=this._k(u);this._cache[k]=mod}}</script>
+`;
   const vUrl = `${base}/__wfw/v/bundle?h=${vendorHash}`;
   result += `<script type="importmap">{
   "imports": {
@@ -7360,26 +7789,37 @@ function streamResponse(reactStream, opts, hydrationScript) {
         if (built) bodyScripts += built;
         if (opts.isDev) {
           const wsUrl = `${opts.base}/__weifuwu/livereload`;
-          const hbUrl = `${opts.base}/__wfw/h/`;
           bodyScripts += `
 <script>
 (function(){
 var ws=new WebSocket((location.protocol==='https:'?'wss:':'ws:')+'//'+location.host+'${wsUrl}');
 var t=0;
+var _w=window;
 ws.onmessage=function(e){
   try{
     var m=JSON.parse(e.data);
-    if(m.type==='component'){
-      import('${hbUrl}'+m.hash+'?t='+Date.now()).catch(function(){location.reload()});
-      if(m.css){
-        var s=document.querySelector('style[data-lr]')||function(){
-          var x=document.createElement('style');
-          x.setAttribute('data-lr','');
-          document.head.appendChild(x);
-          return x
-        }();
-        s.textContent=m.css
-      }
+    if(m.type==='update'&&m.url&&m.code){
+      var blob=new Blob([m.code],{type:'application/javascript'});
+      var blobUrl=URL.createObjectURL(blob);
+      import(blobUrl).then(function(mod){
+        if(_w.__wfw) _w.__wfw._update(m.url,mod);
+        // Re-import page module so it re-evaluates its __wfw.h() imports
+        var pageUrl=_w.__WFW_PAGE_URL;
+        if(pageUrl&&_w.__WFW_REFRESH){
+          import(pageUrl.split('?')[0]+'?t='+Date.now()).then(function(pageMod){
+            if(pageMod.default) _w.__WFW_REFRESH(pageMod.default);
+            if(m.css){
+              var s=document.querySelector('style[data-lr]')||function(){
+                var x=document.createElement('style');
+                x.setAttribute('data-lr','');
+                document.head.appendChild(x);
+                return x
+              }();
+              s.textContent=m.css
+            }
+          });
+        }else{location.reload()}
+      }).catch(function(){location.reload()});
       return
     }
     if(m.type==='css'){
@@ -7429,13 +7869,13 @@ ws.onclose=function(){
 var ssrEntries = /* @__PURE__ */ new Map();
 
 // tailwind.ts
-import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync } from "node:fs";
-import { join as join3, relative, resolve as resolve4 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync } from "node:fs";
+import { join as join3, relative, resolve as resolve5 } from "node:path";
 var extraSources = /* @__PURE__ */ new Set();
 var cssCache = /* @__PURE__ */ new Map();
 function tailwindContext(dir) {
-  const cssDir = resolve4(dir);
+  const cssDir = resolve5(dir);
   const cssPath = join3(cssDir, "app", "globals.css");
   return async (req, ctx, next) => {
     if (!cssCache.has(cssPath)) {
@@ -7449,10 +7889,10 @@ function tailwindContext(dir) {
   };
 }
 function tailwindRouter(dir) {
-  const cssDir = resolve4(dir);
+  const cssDir = resolve5(dir);
   const cssPath = join3(cssDir, "app", "globals.css");
   const r = new Router();
-  r.get("/__wfw/style/:hash.css", async (_req, _ctx) => {
+  r.get("/__wfw/style/:hash.css", async (_req, _ctx2) => {
     if (!cssCache.has(cssPath)) {
       await compileTailwindCss(cssPath, cssDir);
     }
@@ -7466,13 +7906,13 @@ function tailwindRouter(dir) {
 }
 async function compileTailwindCss(cssPath, cssDir) {
   try {
-    if (!existsSync2(cssPath)) {
+    if (!existsSync3(cssPath)) {
       mkdirSync2(cssDir, { recursive: true });
       writeFileSync(cssPath, '@import "tailwindcss"\n', "utf-8");
     }
     const { default: tailwindPlugin } = await import("@tailwindcss/postcss");
     const { default: postcss } = await import("postcss");
-    let src = readFileSync3(cssPath, "utf-8");
+    let src = readFileSync4(cssPath, "utf-8");
     src = `@source "./";
 ${src}`;
     for (const srcDir of extraSources) {
@@ -7481,7 +7921,7 @@ ${src}`;
 ${src}`;
     }
     const result = await postcss([tailwindPlugin()]).process(src, { from: cssPath });
-    const hash = createHash2("md5").update(result.css).digest("hex").slice(0, 8);
+    const hash = createHash3("md5").update(result.css).digest("hex").slice(0, 8);
     cssCache.set(cssPath, { css: result.css, hash });
     return result.css;
   } catch (err) {
@@ -7492,22 +7932,151 @@ ${src}`;
 
 // live.ts
 import chokidar from "chokidar";
-import { existsSync as existsSync3 } from "node:fs";
-import { dirname as dirname2, join as join4, resolve as resolve5 } from "node:path";
-var clients = /* @__PURE__ */ new Set();
-var hotBundleCache = /* @__PURE__ */ new Map();
-var hotKeys = [];
-var MAX_HOT = 10;
-function setHot(hash, code) {
-  if (!hotBundleCache.has(hash)) {
-    hotKeys.push(hash);
-    if (hotKeys.length > MAX_HOT) {
-      const old = hotKeys.shift();
-      hotBundleCache.delete(old);
-    }
+import { existsSync as existsSync5 } from "node:fs";
+import { join as join4, resolve as resolve7 } from "node:path";
+
+// module-server.ts
+import * as esbuild3 from "esbuild";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
+import { resolve as resolve6, dirname as dirname3, relative as relative2 } from "node:path";
+import { createHash as createHash4 } from "node:crypto";
+var moduleCache = /* @__PURE__ */ new Map();
+var hashCache = /* @__PURE__ */ new Map();
+function clearModuleCache(filePath) {
+  if (filePath) {
+    const abs = resolve6(filePath);
+    for (const key of moduleCache.keys()) {
+      if (key.endsWith(abs)) moduleCache.delete(key);
+    }
+    hashCache.delete(abs);
+  } else {
+    moduleCache.clear();
+    hashCache.clear();
   }
-  hotBundleCache.set(hash, code);
 }
+var _importRoots = [];
+function _setImportRoots(roots) {
+  _importRoots = roots;
+}
+function fileHash(absPath) {
+  const cached = hashCache.get(absPath);
+  if (cached) return cached;
+  try {
+    const content = readFileSync5(absPath);
+    const h = createHash4("md5").update(content).digest("hex").slice(0, 8);
+    hashCache.set(absPath, h);
+    return h;
+  } catch {
+    return "00000000";
+  }
+}
+function rewriteImports(code, absPath, mountPath) {
+  const prefix = mountPath ? `${mountPath}/__wfw/m` : "/__wfw/m";
+  let varCounter = 0;
+  return code.replace(
+    /^(import|export)\s+(.+?)\s+from\s+['"]([^'"]+)['"];?\s*$/gm,
+    (_match, keyword, clause, modPath) => {
+      if (!modPath.startsWith(".")) return _match;
+      const isReexport = keyword === "export";
+      const imports = clause.replace(/^type\s+/, "");
+      const resolved = resolve6(dirname3(absPath), modPath);
+      for (const root of _importRoots) {
+        const rel = relative2(root, resolved);
+        if (!rel.startsWith("..") && !rel.startsWith("/")) {
+          const v = fileHash(resolved);
+          const url = `${prefix}/${rel}?v=${v}`;
+          const defaultMatch = imports.match(/^\s*(\w[\w$]*)\s*$/);
+          const namedMatch = imports.match(/^\s*\{\s*([\w$,\s]+)\s*\}\s*$/);
+          const mixedMatch = imports.match(/^\s*(\w[\w$]*)\s*,\s*\{\s*([\w$,\s]+)\s*\}\s*$/);
+          if (defaultMatch) {
+            const name = defaultMatch[1];
+            if (isReexport) {
+              return `const { default: ${name} } = await __wfw.h("${url}");
+export { ${name} as default }`;
+            }
+            return `const { default: ${name} } = await __wfw.h("${url}");`;
+          }
+          if (namedMatch) {
+            const names = namedMatch[1].split(",").map((s) => s.trim()).filter(Boolean);
+            if (isReexport) {
+              const tmp = `__wfw$${varCounter++}`;
+              const lines = [`const ${tmp} = await __wfw.h("${url}");`];
+              for (const n of names) lines.push(`export const ${n} = ${tmp}.${n};`);
+              return lines.join("\n");
+            }
+            const decl = names.map((n) => `${n}`).join(", ");
+            return `const { ${decl} } = await __wfw.h("${url}");`;
+          }
+          if (mixedMatch) {
+            const defaultName = mixedMatch[1];
+            const namedNames = mixedMatch[2].split(",").map((s) => s.trim()).filter(Boolean);
+            const varName = `__wfw$${varCounter++}`;
+            const lines = [
+              `const ${varName} = await __wfw.h("${url}");`,
+              `const ${defaultName} = ${varName}.default;`
+            ];
+            for (const n of namedNames) lines.push(`const { ${n} } = ${varName};`);
+            return lines.join("\n");
+          }
+          return _match;
+        }
+      }
+      return _match;
+    }
+  );
+}
+async function transformModule(absPath, root, mountPath) {
+  const mp = mountPath || "";
+  const cacheKey = mp + absPath;
+  const cached = moduleCache.get(cacheKey);
+  if (cached) return { url: `${mp}/__wfw/m/${relative2(root, absPath)}`, code: cached };
+  const source = readFileSync5(absPath, "utf-8");
+  const isTsx = absPath.endsWith(".tsx");
+  const result = await esbuild3.transform(source, {
+    loader: isTsx ? "tsx" : "ts",
+    jsx: isTsx ? "automatic" : void 0,
+    jsxImportSource: isTsx ? "react" : void 0,
+    sourcemap: false
+  });
+  let code = result.code;
+  code = rewriteImports(code, absPath, mp);
+  moduleCache.set(cacheKey, code);
+  const url = `${mp}/__wfw/m/${relative2(root, absPath)}`;
+  return { url, code };
+}
+function moduleServer(opts) {
+  const roots = Array.isArray(opts.root) ? opts.root : [opts.root];
+  _setImportRoots(roots);
+  const router = new Router();
+  router.get("/__wfw/m/*", (async (req, ctx) => {
+    const reqUrl = new URL(req.url);
+    const filePath = (ctx.params["*"] || "").split("?")[0];
+    const ext = filePath.split(".").pop();
+    if (ext !== "tsx" && ext !== "ts") {
+      return new Response("Not Found", { status: 404 });
+    }
+    const mountPath = ctx.mountPath || "";
+    for (const root of roots) {
+      const absPath = resolve6(root, filePath);
+      if (existsSync4(absPath)) {
+        try {
+          const { code } = await transformModule(absPath, root, mountPath);
+          return new Response(code, {
+            headers: { "content-type": "application/javascript; charset=utf-8" }
+          });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return new Response(`/* Error: ${msg} */`, { status: 500 });
+        }
+      }
+    }
+    return new Response("Not Found", { status: 404 });
+  }));
+  return router;
+}
+
+// live.ts
+var clients = /* @__PURE__ */ new Set();
 function broadcastReload() {
   for (const ws of clients) {
     try {
@@ -7529,7 +8098,7 @@ function broadcastCss(css) {
 }
 function liveWs() {
   return {
-    open(ws) {
+    open(ws, _ctx2) {
       clients.add(ws);
       ws.on("close", () => clients.delete(ws));
       ws.on("error", () => clients.delete(ws));
@@ -7540,78 +8109,52 @@ function liveRouter(_dir) {
   const r = new Router();
   compileVendorBundle().catch(() => {
   });
-  r.get("/__wfw/h/:hash", async (req, ctx) => {
-    const hash = ctx.params.hash.replace(/\.js$/i, "");
-    const code = hotBundleCache.get(hash);
-    if (!code) return new Response("", { status: 404 });
-    return new Response(code, {
-      headers: { "content-type": "application/javascript; charset=utf-8" }
-    });
-  });
   return r;
 }
 function liveWatcher(dir) {
-  const resolved = resolve5(dir);
-  const entryPath = join4(resolved, "page.tsx");
+  const resolved = resolve7(dir);
   const watcher = chokidar.watch(dir, {
     ignored: /(^|[/\\])\.|node_modules|[/\\]\.weifuwu[/\\]/,
     ignoreInitial: true
   });
-  function findEntries(changedPath) {
-    const matched = [];
-    for (const [, entry] of ssrEntries) {
-      if (!entry.path.startsWith(resolved)) continue;
-      if (entry.path === changedPath) {
-        matched.push(entry.path);
-      } else {
-        const ed = dirname2(entry.path);
-        if (changedPath.startsWith(ed)) matched.push(entry.path);
-      }
-    }
-    if (matched.length === 0) {
-      for (const [, entry] of ssrEntries) {
-        if (entry.path.startsWith(resolved)) matched.push(entry.path);
-      }
-    }
-    return matched;
-  }
   watcher.on("change", async (filePath) => {
     if (/\.tsx?$/i.test(filePath)) {
       if (filePath.endsWith("layout.tsx")) {
         return broadcastReload();
       }
       clearCompileCache();
-      const targets = existsSync3(entryPath) ? [entryPath] : findEntries(resolve5(filePath));
-      if (targets.length === 0) return broadcastReload();
+      clearModuleCache();
       try {
-        let css;
-        const cssPath = join4(resolved, "app", "globals.css");
-        if (existsSync3(cssPath)) {
-          css = await compileTailwindCss(cssPath, resolved);
-        }
-        for (const target of targets) {
-          await compileTsxDev(target);
-          const { hash, code } = await compileHotComponent(target);
-          setHot(hash, code);
-          const entry = id(target);
-          const msg = { type: "component", hash, entry };
-          if (css) msg.css = css;
-          const str = JSON.stringify(msg);
-          for (const ws of clients) {
-            try {
-              ws.send(str);
-            } catch {
-              clients.delete(ws);
-            }
+        await compileTsxDev(filePath);
+      } catch (e) {
+        console.error("server-side recompile failed:", e);
+        return broadcastReload();
+      }
+      let css;
+      const cssPath = join4(resolved, "app", "globals.css");
+      if (existsSync5(cssPath)) {
+        css = await compileTailwindCss(cssPath, resolved);
+      }
+      try {
+        const absPath = resolve7(filePath);
+        const { url, code } = await transformModule(absPath, resolved);
+        const msg = { type: "update", url, code };
+        if (css) msg.css = css;
+        const str = JSON.stringify(msg);
+        for (const ws of clients) {
+          try {
+            ws.send(str);
+          } catch {
+            clients.delete(ws);
           }
         }
       } catch (e) {
-        console.error("live reload failed, fallback to full reload:", e);
+        console.error("module transform failed for HMR:", e);
         broadcastReload();
       }
     } else if (/\.css$/i.test(filePath)) {
       const cssPath = join4(resolved, "app", "globals.css");
-      if (existsSync3(cssPath)) {
+      if (existsSync5(cssPath)) {
         const css = await compileTailwindCss(cssPath, resolved);
         if (css) broadcastCss(css);
       }
@@ -7699,7 +8242,7 @@ var isDev2 = isDev();
 var als2 = new AsyncLocalStorage2();
 __registerAls(() => als2.getStore());
 function hashId(s) {
-  return createHash3("md5").update(s).digest("hex").slice(0, 8);
+  return createHash5("md5").update(s).digest("hex").slice(0, 8);
 }
 function serializeLoaderData(ctx) {
   const ld = ctx.loaderData;
@@ -7774,7 +8317,7 @@ async function resolveRoute(ssrDir, segments, routeCache) {
     return null;
   }
   const pageFile = join5(dir, "page.tsx");
-  if (!existsSync4(pageFile)) {
+  if (!existsSync6(pageFile)) {
     routeCache.set(cacheKey, null);
     return null;
   }
@@ -7785,28 +8328,28 @@ async function resolveRoute(ssrDir, segments, routeCache) {
   let d = dir;
   while (d.startsWith(appDir)) {
     const lf = join5(d, "layout.tsx");
-    if (existsSync4(lf)) layoutFiles.unshift(lf);
+    if (existsSync6(lf)) layoutFiles.unshift(lf);
     if (d === appDir) break;
-    d = dirname3(d);
+    d = dirname4(d);
   }
   const errorFiles = [];
   d = dir;
   while (d.startsWith(appDir)) {
     const ef = join5(d, "error.tsx");
-    if (existsSync4(ef)) errorFiles.unshift(ef);
+    if (existsSync6(ef)) errorFiles.unshift(ef);
     if (d === appDir) break;
-    d = dirname3(d);
+    d = dirname4(d);
   }
   let notFoundFile = null;
   d = dir;
   while (d.startsWith(appDir)) {
     const nf = join5(d, "not-found.tsx");
-    if (existsSync4(nf)) {
+    if (existsSync6(nf)) {
       notFoundFile = nf;
       break;
     }
     if (d === appDir) break;
-    d = dirname3(d);
+    d = dirname4(d);
   }
   const result = {
     routePath: "/" + routeParams.join("/"),
@@ -7818,8 +8361,7 @@ async function resolveRoute(ssrDir, segments, routeCache) {
   routeCache.set(cacheKey, result);
   return result;
 }
-function buildHydrationScript(entryId, ctxJson, base) {
-  const ssrPrefix = `${base}/__ssr`;
+function buildHydrationScript(pageUrl, ctxJson) {
   return `
 <script type="module">
 import { setCtx, TsxContext } from 'weifuwu/react';
@@ -7832,10 +8374,11 @@ setCtx(_ctx);
 const _root = document.getElementById('__weifuwu_root');
 
 async function init() {
-  const { default: Page } = await import('${ssrPrefix}/${entryId}.js');
-  const app = createElement(TsxContext.Provider, { value: _ctx },
-    createElement(Page));
+  const { default: Page } = await import('${pageUrl}');
   ${isDev2 ? `
+  // Store page URL for __wfw runtime
+  window.__WFW_PAGE_URL = '${pageUrl}';
+
   // Stable proxy \u2014 same function ref = React preserves fiber + useState state across HMR
   const _pageImpl = { current: Page };
   const _pageProxy = new Proxy(function __wfw_page(){}, {
@@ -7852,14 +8395,22 @@ async function init() {
   }
   renderPage();
 
+  // HMR: re-render page (sub-modules resolved via __wfw.h() pick up changes)
+  window.__WFW_RERENDER = () => {
+    _tick++;
+    reactRoot.render(createElement(TsxContext.Provider, { value: _ctx },
+      createElement(_pageProxy, { __t: _tick })));
+  };
+
+  // Fallback: swap entire page component
   window.__WFW_REFRESH = async (NewComponent) => {
     const store = globalThis.__WEIFUWU_CTX_STORE?._ctx || _ctx;
     _pageImpl.current = NewComponent;
-    _tick++;
-    reactRoot.render(createElement(TsxContext.Provider, { value: store },
-      createElement(_pageProxy, { __t: _tick })));
+    __WFW_RERENDER();
   };
   ` : `
+  const app = createElement(TsxContext.Provider, { value: _ctx },
+    createElement(Page));
   hydrateRoot(_root, app);
   `}
 }
@@ -7867,8 +8418,8 @@ async function init() {
 init();
 </script>`;
 }
-function renderPage(pageFile, outDir) {
-  const absPath = resolve6(pageFile);
+function renderPage(pageFile, projectDir) {
+  const absPath = resolve8(pageFile);
   const entryId = hashId(absPath);
   ssrEntries.set(entryId, { path: absPath });
   return async (req, ctx) => {
@@ -7897,9 +8448,10 @@ function renderPage(pageFile, outDir) {
       loaderData,
       env: ctx.env ?? {}
     };
+    const pageRelative = relative3(projectDir, absPath);
+    const pageUrl = `${base}/__wfw/m/${pageRelative}`;
     return als2.run(ctxValue, async () => {
       setCtx(ctxValue);
-      await compileBrowser(absPath, outDir);
       let element = createElement3(
         "div",
         { id: "__weifuwu_root" },
@@ -7917,7 +8469,7 @@ function renderPage(pageFile, outDir) {
           loaderData,
           tailwind: ctx.tailwind
         },
-        buildHydrationScript(entryId, JSON.stringify(ctxValue), base)
+        buildHydrationScript(pageUrl, JSON.stringify(ctxValue))
       );
     });
   };
@@ -7932,7 +8484,7 @@ function runChain(mws, handler, req, ctx) {
 }
 function discoverRoutes(dir) {
   const appDir = join5(dir, "app");
-  if (!existsSync4(appDir)) return [];
+  if (!existsSync6(appDir)) return [];
   const result = [];
   function walk(currentDir, routePath) {
     let entries;
@@ -7953,7 +8505,7 @@ function discoverRoutes(dir) {
       } else if (entry.name === "page.tsx") {
         result.push({
           path: routePath || "/",
-          file: relative2(appDir, join5(currentDir, entry.name))
+          file: relative3(appDir, join5(currentDir, entry.name))
         });
       }
     }
@@ -7963,28 +8515,19 @@ function discoverRoutes(dir) {
 }
 function ssr(opts) {
   const r = new Router();
-  const dir = resolve6(opts.dir);
-  const outDir = resolve6(OUT_DIR);
+  const dir = resolve8(opts.dir);
   const routeCache = /* @__PURE__ */ new Map();
+  const wfwRoot = resolve8(import.meta.dirname ?? __dirname);
+  r.use("/", moduleServer({ root: [dir, wfwRoot] }));
   compileVendorBundle().catch(() => {
   });
-  r.get("/__ssr/:file", (req, ctx) => {
-    const filePath = join5(outDir, ctx.params.file);
-    if (!filePath.startsWith(outDir) || !existsSync4(filePath)) {
-      return new Response("Not Found", { status: 404 });
-    }
-    const content = readFileSync4(filePath, "utf-8");
-    return new Response(content, {
-      headers: { "content-type": "application/javascript; charset=utf-8" }
-    });
-  });
   r.get("/__wfw/v/bundle", async () => {
     const code = await compileVendorBundle();
     return new Response(code, {
       headers: { "content-type": "application/javascript; charset=utf-8" }
     });
   });
-  if (existsSync4(join5(dir, "app", "globals.css"))) {
+  if (existsSync6(join5(dir, "app", "globals.css"))) {
     r.use("/", tailwindRouter(dir));
   }
   let devWatcher;
@@ -8020,7 +8563,7 @@ function ssr(opts) {
       ...resolved.layoutFiles.map((f) => layout(f)),
       tailwindContext(dir)
     ];
-    const handler = (req2, ctx2) => renderPage(resolved.pageFile, outDir)(req2, ctx2);
+    const handler = (req2, ctx2) => renderPage(resolved.pageFile, dir)(req2, ctx2);
     return runChain(mws, handler, req, ctx);
   });
   const mod = r;
@@ -8272,13 +8815,13 @@ function createBashTool(ctx) {
         return { stdout: "", stderr: "Command denied: potentially dangerous command", exitCode: 1 };
       }
       const cwd = workdir ? `${ctx.workspace}/${workdir}` : ctx.workspace;
-      return new Promise((resolve14) => {
+      return new Promise((resolve16) => {
         const child = exec(
           command,
           { cwd, timeout: timeout * 1e3, maxBuffer: 1024 * 1024 },
           (error, stdout, stderr) => {
             const truncated = stdout.length > 1e6 || stderr.length > 1e6;
-            resolve14({
+            resolve16({
               stdout: stdout.slice(0, 1e6),
               stderr: stderr.slice(0, 1e6),
               exitCode: error?.code ?? 0,
@@ -8295,8 +8838,8 @@ function createBashTool(ctx) {
 // opencode/tools/read.ts
 import { tool as tool4 } from "ai";
 import { z as z6 } from "zod";
-import { readFileSync as readFileSync5 } from "node:fs";
-import { resolve as resolve7 } from "node:path";
+import { readFileSync as readFileSync7 } from "node:fs";
+import { resolve as resolve9 } from "node:path";
 function createReadTool(ctx) {
   return tool4({
     description: "Read file contents. Supports offset and limit for reading specific line ranges.",
@@ -8306,11 +8849,11 @@ function createReadTool(ctx) {
       limit: z6.number().optional().describe("Number of lines to read")
     }),
     execute: async ({ path: path2, offset, limit }) => {
-      const resolved = resolve7(ctx.workspace, path2);
+      const resolved = resolve9(ctx.workspace, path2);
       if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions.permissions)) {
         return { error: "Path not allowed", content: null, totalLines: 0 };
       }
-      const content = readFileSync5(resolved, "utf-8");
+      const content = readFileSync7(resolved, "utf-8");
       const lines = content.split("\n");
       const totalLines = lines.length;
       if (offset !== void 0) {
@@ -8338,7 +8881,7 @@ function createReadTool(ctx) {
 import { tool as tool5 } from "ai";
 import { z as z7 } from "zod";
 import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "node:fs";
-import { resolve as resolve8, dirname as dirname4 } from "node:path";
+import { resolve as resolve10, dirname as dirname5 } from "node:path";
 function createWriteTool(ctx) {
   return tool5({
     description: "Create or overwrite a file. Parent directories are created automatically.",
@@ -8347,11 +8890,11 @@ function createWriteTool(ctx) {
       content: z7.string().describe("File content")
     }),
     execute: async ({ path: path2, content }) => {
-      const resolved = resolve8(ctx.workspace, path2);
+      const resolved = resolve10(ctx.workspace, path2);
       if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions.permissions)) {
         return { error: "Path not allowed" };
       }
-      mkdirSync3(dirname4(resolved), { recursive: true });
+      mkdirSync3(dirname5(resolved), { recursive: true });
       writeFileSync2(resolved, content, "utf-8");
       return { path: path2, size: content.length };
     }
@@ -8361,8 +8904,8 @@ function createWriteTool(ctx) {
 // opencode/tools/edit.ts
 import { tool as tool6 } from "ai";
 import { z as z8 } from "zod";
-import { readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
-import { resolve as resolve9 } from "node:path";
+import { readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "node:fs";
+import { resolve as resolve11 } from "node:path";
 function createEditTool(ctx) {
   return tool6({
     description: "Perform exact string replacements in a file. If oldString appears multiple times, provide more surrounding context.",
@@ -8373,11 +8916,11 @@ function createEditTool(ctx) {
       replaceAll: z8.boolean().default(false).describe("Replace all occurrences")
     }),
     execute: async ({ path: path2, oldString, newString, replaceAll }) => {
-      const resolved = resolve9(ctx.workspace, path2);
+      const resolved = resolve11(ctx.workspace, path2);
       if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions.permissions)) {
         return { error: "Path not allowed" };
       }
-      const content = readFileSync6(resolved, "utf-8");
+      const content = readFileSync8(resolved, "utf-8");
       if (replaceAll) {
         if (!content.includes(oldString)) {
           return { error: "oldString not found in file", replaced: 0 };
@@ -8409,8 +8952,8 @@ function createEditTool(ctx) {
 import { tool as tool7 } from "ai";
 import { z as z9 } from "zod";
 import { execFileSync } from "node:child_process";
-import { resolve as resolve10 } from "node:path";
-import { existsSync as existsSync5 } from "node:fs";
+import { resolve as resolve12 } from "node:path";
+import { existsSync as existsSync7 } from "node:fs";
 function createGrepTool(ctx) {
   return tool7({
     description: "Search file contents using regex. Supports file type filtering and context lines.",
@@ -8421,10 +8964,10 @@ function createGrepTool(ctx) {
       context: z9.number().default(0).describe("Number of context lines before and after each match")
     }),
     execute: async ({ pattern, include, path: path2, context }) => {
-      const searchDir = path2 ? resolve10(ctx.workspace, path2) : ctx.workspace;
+      const searchDir = path2 ? resolve12(ctx.workspace, path2) : ctx.workspace;
       try {
         let stdout;
-        if (existsSync5("/usr/bin/rg") || existsSync5("/usr/local/bin/rg")) {
+        if (existsSync7("/usr/bin/rg") || existsSync7("/usr/local/bin/rg")) {
           const args = ["-n"];
           if (context > 0) args.push("-C", String(context));
           if (include) args.push("-g", include);
@@ -8457,7 +9000,7 @@ function createGrepTool(ctx) {
 import { tool as tool8 } from "ai";
 import { z as z10 } from "zod";
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve13 } from "node:path";
 function createGlobTool(ctx) {
   return tool8({
     description: "Find files matching a glob pattern.",
@@ -8466,7 +9009,7 @@ function createGlobTool(ctx) {
       path: z10.string().optional().describe("Subdirectory relative to workspace")
     }),
     execute: async ({ pattern, path: path2 }) => {
-      const searchDir = path2 ? resolve11(ctx.workspace, path2) : ctx.workspace;
+      const searchDir = path2 ? resolve13(ctx.workspace, path2) : ctx.workspace;
       try {
         const stdout = execFileSync2(
           "find",
@@ -8492,7 +9035,7 @@ function createGlobTool(ctx) {
 // opencode/tools/web.ts
 import { tool as tool9 } from "ai";
 import { z as z11 } from "zod";
-function createWebTool(_ctx) {
+function createWebTool(_ctx2) {
   return tool9({
     description: "Fetch a URL and return the content as text.",
     inputSchema: z11.object({
@@ -8528,7 +9071,7 @@ function createQuestionTool(ctx) {
       options: z12.array(z12.string()).optional().describe("Optional multiple choice options")
     }),
     execute: async ({ question, options }, { toolCallId }) => {
-      return new Promise((resolve14, reject) => {
+      return new Promise((resolve16, reject) => {
         const timeout = setTimeout(() => {
           ctx.pendingQuestions.delete(toolCallId);
           reject(new Error("Question timed out"));
@@ -8536,7 +9079,7 @@ function createQuestionTool(ctx) {
         ctx.pendingQuestions.set(toolCallId, {
           resolve: (answer) => {
             clearTimeout(timeout);
-            resolve14(answer);
+            resolve16(answer);
           },
           reject: (err) => {
             clearTimeout(timeout);
@@ -8857,7 +9400,7 @@ function createWSHandler2(deps) {
         clients2.delete(ws);
       }
     },
-    error(ws, _ctx, _err) {
+    error(ws, _ctx2, _err) {
       const client = clients2.get(ws);
       if (client) {
         client.abortController?.abort();
@@ -8870,7 +9413,7 @@ function createWSHandler2(deps) {
 // opencode/skills.ts
 import { readFile, glob } from "node:fs/promises";
 import { homedir } from "node:os";
-import { resolve as resolve12 } from "node:path";
+import { resolve as resolve14 } from "node:path";
 import { parse as parseYaml } from "yaml";
 var SEARCH_DIRS = [
   (ws) => `${ws}/.opencode/skills`,
@@ -8908,7 +9451,7 @@ async function scanDir(dir) {
   try {
     const files = [];
     for await (const entry of glob("*/SKILL.md", { cwd: dir })) {
-      const skill = await parseSkillFile(resolve12(dir, entry));
+      const skill = await parseSkillFile(resolve14(dir, entry));
       if (skill) files.push(skill);
     }
     return files;
@@ -9335,7 +9878,7 @@ function theme(options) {
 
 // i18n.ts
 import { readFile as readFile2, stat as stat2 } from "node:fs/promises";
-import { join as join7, resolve as resolve13 } from "node:path";
+import { join as join7, resolve as resolve15 } from "node:path";
 var DEFAULTS2 = {
   default: "en",
   cookie: "locale",
@@ -9353,7 +9896,7 @@ function translate(msgs, key, params, fallback) {
 }
 function i18n(options) {
   const opts = { ...DEFAULTS2, ...options };
-  const dir = opts.dir ? resolve13(opts.dir) : void 0;
+  const dir = opts.dir ? resolve15(opts.dir) : void 0;
   const cache3 = /* @__PURE__ */ new Map();
   function validLocale(locale) {
     return /^[\w-]+$/.test(locale) && !locale.includes("..");
@@ -9863,381 +10406,6 @@ function logdb(options) {
 // iii/client.ts
 import crypto8 from "node:crypto";
 
-// iii/stream.ts
-function notify(channels, stream, group, item, event, data) {
-  const keys = [`${stream}`, `${stream}:${group}`, `${stream}:${group}:${item}`];
-  const msg = JSON.stringify({
-    type: "stream",
-    stream_name: stream,
-    group_id: group,
-    item_id: item,
-    event,
-    data
-  });
-  for (const key of keys) {
-    const subs = channels.get(key);
-    if (!subs) continue;
-    for (const ws of subs) {
-      try {
-        ws.send(msg);
-      } catch {
-      }
-    }
-  }
-}
-function deepClone(v) {
-  return JSON.parse(JSON.stringify(v));
-}
-function applyOps(value, ops) {
-  let current = deepClone(value ?? {});
-  for (const op2 of ops) {
-    switch (op2.op) {
-      case "set":
-        current = deepClone(op2.value);
-        break;
-      case "merge":
-        if (typeof current === "object" && current !== null && !Array.isArray(current)) {
-          current = { ...current, ...deepClone(op2.value) };
-        } else {
-          current = deepClone(op2.value);
-        }
-        break;
-      case "increment":
-        current = (typeof current === "number" ? current : 0) + op2.value;
-        break;
-      case "decrement":
-        current = (typeof current === "number" ? current : 0) - op2.value;
-        break;
-      case "append":
-        if (!Array.isArray(current)) current = [];
-        current.push(deepClone(op2.value));
-        break;
-      case "remove":
-        current = null;
-        break;
-    }
-  }
-  return current;
-}
-function createMemoryStore(channels) {
-  const store2 = /* @__PURE__ */ new Map();
-  function key(stream, group, item) {
-    return `${stream}:${group}:${item}`;
-  }
-  return {
-    async set(stream, group, item, data) {
-      const k = key(stream, group, item);
-      const old = store2.get(k) ?? null;
-      store2.set(k, deepClone(data));
-      notify(channels, stream, group, item, "set", data);
-      return { old_value: old, new_value: deepClone(data) };
-    },
-    async get(stream, group, item) {
-      const v = store2.get(key(stream, group, item)) ?? null;
-      return { value: deepClone(v) };
-    },
-    async delete(stream, group, item) {
-      const k = key(stream, group, item);
-      const old = store2.get(k) ?? null;
-      store2.delete(k);
-      notify(channels, stream, group, item, "delete", null);
-      return { old_value: old };
-    },
-    async list(stream, group) {
-      const items = [];
-      const prefix = `${stream}:${group}:`;
-      for (const [k, v] of store2) {
-        if (k.startsWith(prefix) && !k.slice(prefix.length).includes(":")) {
-          items.push({ item_id: k.slice(prefix.length), data: deepClone(v) });
-        }
-      }
-      return { items };
-    },
-    async list_groups(stream) {
-      const groups = /* @__PURE__ */ new Set();
-      const prefix = `${stream}:`;
-      for (const k of store2.keys()) {
-        if (k.startsWith(prefix)) {
-          const rest = k.slice(prefix.length);
-          const g = rest.split(":")[0];
-          if (g) groups.add(g);
-        }
-      }
-      return { groups: Array.from(groups) };
-    },
-    async list_all() {
-      const streamMap = /* @__PURE__ */ new Map();
-      for (const k of store2.keys()) {
-        const parts = k.split(":");
-        const s = parts[0];
-        const g = parts[1];
-        if (!streamMap.has(s)) streamMap.set(s, { groups: /* @__PURE__ */ new Set(), items: /* @__PURE__ */ new Set() });
-        const entry = streamMap.get(s);
-        if (g) entry.groups.add(g);
-        entry.items.add(k);
-      }
-      const streams = Array.from(streamMap.entries()).map(([name, info]) => ({
-        stream_name: name,
-        group_count: info.groups.size,
-        item_count: info.items.size
-      }));
-      return { streams, count: streams.length };
-    },
-    async send(stream, group, type, data, id2) {
-      notify(channels, stream, group, id2 ?? "", "send", { type, data });
-    },
-    async update(stream, group, item, ops) {
-      const k = key(stream, group, item);
-      const old = deepClone(store2.get(k) ?? null);
-      const newVal = applyOps(old, ops);
-      store2.set(k, deepClone(newVal));
-      notify(channels, stream, group, item, "update", newVal);
-      return { old_value: old, new_value: deepClone(newVal) };
-    }
-  };
-}
-function createPgStore(channels, pg) {
-  const sql2 = pg.sql;
-  return {
-    async set(stream, group, item, data) {
-      const rows = await sql2`
-        INSERT INTO "_iii_stream" (stream_name, group_id, item_id, data)
-        VALUES (${stream}, ${group}, ${item}, ${data})
-        ON CONFLICT (stream_name, group_id, item_id)
-        DO UPDATE SET data = ${data}, updated_at = NOW()
-        RETURNING data
-      `;
-      notify(channels, stream, group, item, "set", data);
-      return { old_value: null, new_value: data };
-    },
-    async get(stream, group, item) {
-      const rows = await sql2`
-        SELECT data FROM "_iii_stream"
-        WHERE stream_name = ${stream} AND group_id = ${group} AND item_id = ${item}
-      `;
-      const row = rows[0];
-      let value = row?.data ?? null;
-      if (typeof value === "string") value = JSON.parse(value);
-      return { value };
-    },
-    async delete(stream, group, item) {
-      const rows = await sql2`
-        DELETE FROM "_iii_stream"
-        WHERE stream_name = ${stream} AND group_id = ${group} AND item_id = ${item}
-        RETURNING data
-      `;
-      const old = rows[0]?.data ?? null;
-      notify(channels, stream, group, item, "delete", null);
-      return { old_value: old };
-    },
-    async list(stream, group) {
-      const rows = await sql2`
-        SELECT item_id, data FROM "_iii_stream"
-        WHERE stream_name = ${stream} AND group_id = ${group}
-        ORDER BY item_id
-      `;
-      const items = rows.map((r) => ({
-        item_id: r.item_id,
-        data: typeof r.data === "string" ? JSON.parse(r.data) : r.data
-      }));
-      return { items };
-    },
-    async list_groups(stream) {
-      const rows = await sql2`
-        SELECT DISTINCT group_id FROM "_iii_stream"
-        WHERE stream_name = ${stream}
-        ORDER BY group_id
-      `;
-      return { groups: rows.map((r) => r.group_id) };
-    },
-    async list_all() {
-      const rows = await sql2`
-        SELECT stream_name, COUNT(DISTINCT group_id) as group_count, COUNT(*) as item_count
-        FROM "_iii_stream"
-        GROUP BY stream_name
-        ORDER BY stream_name
-      `;
-      const streams = rows.map((r) => ({
-        stream_name: r.stream_name,
-        group_count: Number(r.group_count),
-        item_count: Number(r.item_count)
-      }));
-      return { streams, count: streams.length };
-    },
-    async send(stream, group, type, data, id2) {
-      notify(channels, stream, group, id2 ?? "", "send", { type, data });
-    },
-    async update(stream, group, item, ops) {
-      const { value: oldVal } = await this.get(stream, group, item);
-      const newVal = applyOps(oldVal, ops);
-      await sql2`
-        INSERT INTO "_iii_stream" (stream_name, group_id, item_id, data)
-        VALUES (${stream}, ${group}, ${item}, ${newVal})
-        ON CONFLICT (stream_name, group_id, item_id)
-        DO UPDATE SET data = ${newVal}, updated_at = NOW()
-      `;
-      notify(channels, stream, group, item, "update", newVal);
-      return { old_value: oldVal, new_value: deepClone(newVal) };
-    }
-  };
-}
-function createRedisStore(channels, redis2, ttl) {
-  function hashKey(stream, group) {
-    return `iii:stream:${stream}:${group}`;
-  }
-  function setTTL(hk) {
-    if (ttl) redis2.expire(hk, ttl);
-  }
-  return {
-    async set(stream, group, item, data) {
-      const hk = hashKey(stream, group);
-      const oldRaw = await redis2.hget(hk, item);
-      const old = oldRaw ? JSON.parse(oldRaw) : null;
-      await redis2.hset(hk, item, JSON.stringify(data));
-      setTTL(hk);
-      await redis2.publish(
-        `iii:stream:${stream}`,
-        JSON.stringify({ event: "set", group, item, data })
-      );
-      notify(channels, stream, group, item, "set", data);
-      return { old_value: old, new_value: deepClone(data) };
-    },
-    async get(stream, group, item) {
-      const raw = await redis2.hget(hashKey(stream, group), item);
-      return { value: raw ? JSON.parse(raw) : null };
-    },
-    async delete(stream, group, item) {
-      const hk = hashKey(stream, group);
-      const oldRaw = await redis2.hget(hk, item);
-      const old = oldRaw ? JSON.parse(oldRaw) : null;
-      await redis2.hdel(hk, item);
-      const remaining = await redis2.hlen(hk);
-      if (remaining === 0) await redis2.del(hk);
-      await redis2.publish(`iii:stream:${stream}`, JSON.stringify({ event: "delete", group, item }));
-      notify(channels, stream, group, item, "delete", null);
-      return { old_value: old };
-    },
-    async list(stream, group) {
-      const raw = await redis2.hgetall(hashKey(stream, group));
-      const items = Object.entries(raw).map(([item_id, data]) => ({
-        item_id,
-        data: JSON.parse(data)
-      }));
-      return { items };
-    },
-    async list_groups(stream) {
-      const pattern = `iii:stream:${stream}:*`;
-      let cursor = "0";
-      const groups = /* @__PURE__ */ new Set();
-      do {
-        const [next, keys] = await redis2.scan(cursor, "MATCH", pattern, "COUNT", "1000");
-        cursor = next;
-        for (const k of keys) {
-          const parts = k.split(":");
-          const g = parts.slice(3).join(":");
-          if (g) groups.add(g);
-        }
-      } while (cursor !== "0");
-      return { groups: Array.from(groups) };
-    },
-    async list_all() {
-      const pattern = "iii:stream:*";
-      let cursor = "0";
-      const streamMap = /* @__PURE__ */ new Map();
-      do {
-        const [next, keys] = await redis2.scan(cursor, "MATCH", pattern, "COUNT", "1000");
-        cursor = next;
-        for (const k of keys) {
-          const parts = k.split(":");
-          const s = parts[2];
-          const g = parts.slice(3).join(":");
-          if (!streamMap.has(s)) streamMap.set(s, { groups: /* @__PURE__ */ new Set(), items: 0 });
-          const entry = streamMap.get(s);
-          if (g) entry.groups.add(g);
-          entry.items++;
-        }
-      } while (cursor !== "0");
-      const streams = Array.from(streamMap.entries()).map(([name, info]) => ({
-        stream_name: name,
-        group_count: info.groups.size,
-        item_count: info.items
-      }));
-      return { streams, count: streams.length };
-    },
-    async send(stream, group, type, data, id2) {
-      notify(channels, stream, group, id2 ?? "", "send", { type, data });
-    },
-    async update(stream, group, item, ops) {
-      const hk = hashKey(stream, group);
-      const oldRaw = await redis2.hget(hk, item);
-      const old = oldRaw ? JSON.parse(oldRaw) : null;
-      const newVal = applyOps(old, ops);
-      await redis2.hset(hk, item, JSON.stringify(newVal));
-      setTTL(hk);
-      await redis2.publish(
-        `iii:stream:${stream}`,
-        JSON.stringify({ event: "update", group, item, data: newVal })
-      );
-      notify(channels, stream, group, item, "update", newVal);
-      return { old_value: old, new_value: deepClone(newVal) };
-    }
-  };
-}
-function createStream(opts) {
-  const channels = /* @__PURE__ */ new Map();
-  const store2 = opts?.pg ? createPgStore(channels, opts.pg) : opts?.redis ? createRedisStore(channels, opts.redis, opts.streamTTL ?? 3600) : createMemoryStore(channels);
-  let redisSub = null;
-  if (opts?.redis) {
-    redisSub = opts.redis.duplicate();
-    redisSub.on("message", (rawChannel, rawData) => {
-      if (!rawChannel.startsWith("iii:stream:")) return;
-      const stream = rawChannel.slice("iii:stream:".length);
-      try {
-        const msg = JSON.parse(rawData);
-        if (msg.event === "set" || msg.event === "update") {
-          notify(channels, stream, msg.group, msg.item, msg.event, msg.data);
-        } else if (msg.event === "delete") {
-          notify(channels, stream, msg.group, msg.item, "delete", null);
-        }
-      } catch {
-      }
-    });
-  }
-  return {
-    ...store2,
-    subscribe(ws, sub) {
-      const key = sub.item_id ? `${sub.stream_name}:${sub.group_id}:${sub.item_id}` : sub.group_id ? `${sub.stream_name}:${sub.group_id}` : sub.stream_name;
-      if (!channels.has(key)) channels.set(key, /* @__PURE__ */ new Set());
-      channels.get(key).add(ws);
-      if (redisSub && sub.stream_name) {
-        redisSub.subscribe(`iii:stream:${sub.stream_name}`);
-      }
-    },
-    unsubscribe(ws) {
-      for (const [, subs] of channels) subs.delete(ws);
-    },
-    async migrate() {
-      if (opts?.pg) {
-        const sql2 = opts.pg.sql;
-        await sql2`
-          CREATE TABLE IF NOT EXISTS "_iii_stream" (
-            stream_name TEXT NOT NULL,
-            group_id TEXT NOT NULL,
-            item_id TEXT NOT NULL,
-            data JSONB,
-            updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-            PRIMARY KEY (stream_name, group_id, item_id)
-          )
-        `;
-        await sql2`CREATE INDEX IF NOT EXISTS idx_iii_stream_group ON "_iii_stream" (stream_name, group_id)`;
-      }
-    },
-    async close() {
-      if (redisSub) await redisSub.quit();
-    }
-  };
-}
-
 // iii/ws.ts
 function createWsHandler(deps) {
   const wsToWorkerId = /* @__PURE__ */ new Map();
@@ -10245,7 +10413,7 @@ function createWsHandler(deps) {
     return wsToWorkerId.get(ws) || "";
   }
   return {
-    open(_ws, _ctx) {
+    open(_ws, _ctx2) {
     },
     async message(ws, ctx, data) {
       let msg;
@@ -10271,9 +10439,9 @@ function createWsHandler(deps) {
           const workerId = getWorkerId(ws);
           if (workerId) {
             deps.registerRemoteTrigger(workerId, {
-              type: msg.trigger_type || msg.type,
-              function_id: msg.function_id,
-              config: msg.config || {}
+              type: msg.input?.type || "custom",
+              function_id: msg.input?.function_id || msg.id,
+              config: msg.input?.config || {}
             });
           }
           break;
@@ -10285,11 +10453,7 @@ function createWsHandler(deps) {
         }
         case "unregister_trigger": {
           const workerId = getWorkerId(ws);
-          if (workerId) deps.unregisterRemoteTrigger(workerId, msg.function_id);
-          break;
-        }
-        case "invoke": {
-          deps.handleInvoke(ws, msg.invocation_id, msg.function_id, msg.payload);
+          if (workerId) deps.unregisterRemoteTrigger(workerId, msg.function_id || msg.id);
           break;
         }
         case "invoke_result": {
@@ -10300,31 +10464,20 @@ function createWsHandler(deps) {
           deps.handleInvokeError(msg.invocation_id, msg.error);
           break;
         }
-        case "subscribe": {
-          deps.addStreamSubscriber(ws, {
-            stream_name: msg.stream_name || msg.channel || "",
-            group_id: msg.group_id,
-            item_id: msg.item_id
-          });
-          break;
-        }
-        case "unsubscribe": {
-          deps.removeStreamSubscriber(ws);
+        case "invoke": {
+          deps.handleInvoke(ws, msg.invocation_id, msg.function_id, msg.payload);
           break;
         }
+        default:
+          ws.send(JSON.stringify({ type: "error", message: `Unknown message type: ${msg.type}` }));
       }
     },
     close(ws) {
       const workerId = getWorkerId(ws);
-      if (workerId) deps.unregisterRemoteWorker(workerId);
-      wsToWorkerId.delete(ws);
-      deps.removeStreamSubscriber(ws);
-    },
-    error(ws) {
-      const workerId = getWorkerId(ws);
-      if (workerId) deps.unregisterRemoteWorker(workerId);
-      wsToWorkerId.delete(ws);
-      deps.removeStreamSubscriber(ws);
+      if (workerId) {
+        deps.unregisterRemoteWorker(workerId);
+        wsToWorkerId.delete(ws);
+      }
     }
   };
 }
@@ -10369,38 +10522,11 @@ function buildRouter5(engine, wsHandler) {
 }
 
 // iii/client.ts
-function iii(opts = {}) {
-  const stream = createStream({ pg: opts.pg, redis: opts.redis, streamTTL: opts.streamTTL });
+function iii(_opts = {}) {
   const workers = /* @__PURE__ */ new Map();
   const functions = /* @__PURE__ */ new Map();
   const triggers = /* @__PURE__ */ new Map();
   const pending = /* @__PURE__ */ new Map();
-  function registerBuiltin(id2, handler) {
-    functions.set(id2, {
-      id: id2,
-      handler,
-      workerId: "__iii__",
-      workerName: "__iii__",
-      triggers: []
-    });
-  }
-  registerBuiltin(
-    "stream::set",
-    (p) => stream.set(p.stream_name, p.group_id, p.item_id, p.data)
-  );
-  registerBuiltin("stream::get", (p) => stream.get(p.stream_name, p.group_id, p.item_id));
-  registerBuiltin("stream::delete", (p) => stream.delete(p.stream_name, p.group_id, p.item_id));
-  registerBuiltin("stream::list", (p) => stream.list(p.stream_name, p.group_id));
-  registerBuiltin("stream::list_groups", (p) => stream.list_groups(p.stream_name));
-  registerBuiltin("stream::list_all", () => stream.list_all());
-  registerBuiltin(
-    "stream::send",
-    (p) => stream.send(p.stream_name, p.group_id, p.type, p.data, p.id)
-  );
-  registerBuiltin(
-    "stream::update",
-    (p) => stream.update(p.stream_name, p.group_id, p.item_id, p.ops)
-  );
   function addLocalWorker(worker) {
     const workerId = crypto8.randomUUID();
     const reg = {
@@ -10447,12 +10573,12 @@ function iii(opts = {}) {
     const handler = async (payload) => {
       if (!worker.ws) throw new Error(`Worker "${worker.name}" disconnected`);
       const invocationId = crypto8.randomUUID();
-      return new Promise((resolve14, reject) => {
+      return new Promise((resolve16, reject) => {
         const timer = setTimeout(() => {
           pending.delete(invocationId);
           reject(new Error(`Invocation timed out for "${id2}"`));
         }, 3e4);
-        pending.set(invocationId, { resolve: resolve14, reject, timer });
+        pending.set(invocationId, { resolve: resolve16, reject, timer });
         worker.ws.send(
           JSON.stringify({
             type: "invoke",
@@ -10519,12 +10645,6 @@ function iii(opts = {}) {
         worker.triggers = worker.triggers.filter((t) => t.function_id !== functionId);
       }
     },
-    addStreamSubscriber(ws, sub) {
-      stream.subscribe(ws, sub);
-    },
-    removeStreamSubscriber(ws) {
-      stream.unsubscribe(ws);
-    },
     handleInvokeResult(invocationId, result) {
       const p = pending.get(invocationId);
       if (p) {
@@ -10577,7 +10697,7 @@ function iii(opts = {}) {
   }
   function trigger(request) {
     const fn = functions.get(request.function_id);
-    if (!fn) throw new Error(`Function "${request.function_id}" not found`);
+    if (!fn) return Promise.reject(new Error(`Function "${request.function_id}" not found`));
     const ctx = { engine: engineRef, functionId: request.function_id, workerName: fn.workerName };
     if (request.action === "void") {
       queueMicrotask(() => fn.handler(request.payload, ctx));
@@ -10624,7 +10744,6 @@ function iii(opts = {}) {
   mod.listFunctions = listFunctions;
   mod.listTriggers = listTriggers;
   mod.migrate = async () => {
-    await stream.migrate();
   };
   mod.close = async () => {
     for (const [, p] of pending) {
@@ -10636,7 +10755,6 @@ function iii(opts = {}) {
     workers.clear();
     functions.clear();
     triggers.clear();
-    await stream.close();
   };
   return mod;
 }
@@ -10703,8 +10821,8 @@ function registerWorker(url) {
   function connect() {
     if (intentionalClose) return;
     ws = new WebSocket(url);
-    ready = new Promise((resolve14) => {
-      resolveReady = resolve14;
+    ready = new Promise((resolve16) => {
+      resolveReady = resolve16;
     });
     ws.onopen = () => {
       reconnectAttempt = 0;
@@ -10773,11 +10891,6 @@ function registerWorker(url) {
           }
           break;
         }
-        case "stream": {
-          const handler = handlers.get("__stream__");
-          if (handler) handler(msg, {});
-          break;
-        }
       }
     };
     ws.onclose = () => {
@@ -10835,13 +10948,13 @@ function registerWorker(url) {
         }
         return Promise.resolve(fn(request.payload, ctx));
       }
-      return new Promise((resolve14, reject) => {
+      return new Promise((resolve16, reject) => {
         const invocationId = genId();
         const timer = setTimeout(() => {
           pendingInvocations.delete(invocationId);
           reject(new Error(`Invocation timed out for "${request.function_id}"`));
         }, request.timeout_ms || 3e4);
-        pendingInvocations.set(invocationId, { resolve: resolve14, reject, timer });
+        pendingInvocations.set(invocationId, { resolve: resolve16, reject, timer });
         send({
           type: "invoke",
           invocation_id: invocationId,
@@ -10850,9 +10963,6 @@ function registerWorker(url) {
         });
       });
     },
-    onStream(handler) {
-      handlers.set("__stream__", handler);
-    },
     close() {
       intentionalClose = true;
       if (reconnectTimer) clearTimeout(reconnectTimer);
@@ -11104,6 +11214,7 @@ function session(options) {
     }
     return res;
   });
+  mw.__meta = { injects: ["session"], depends: [] };
   mw.close = async () => {
     await closeStore?.();
   };
@@ -12033,6 +12144,475 @@ function permissions(options) {
   mw.migrate = migrate;
   return mw;
 }
+
+// mcp.ts
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { z as z14 } from "zod";
+var _requestId = 0;
+function nextId() {
+  return ++_requestId;
+}
+function createRequest2(id2, method, params) {
+  return JSON.stringify({
+    jsonrpc: "2.0",
+    id: id2,
+    method,
+    params
+  });
+}
+function mcpClient(options) {
+  const { command, args = [], env: env2 } = options;
+  const timeout = options.timeout ?? 15e3;
+  const maxResponseSize = options.maxResponseSize ?? 10 * 1024 * 1024;
+  let proc = null;
+  let rl = null;
+  const pending = /* @__PURE__ */ new Map();
+  let _tools = null;
+  function ensureProcess() {
+    if (proc && !proc.killed) return;
+    proc = spawn(command, args, {
+      stdio: ["pipe", "pipe", "pipe"],
+      env: { ...process.env, ...env2 }
+    });
+    rl = createInterface({ input: proc.stdout, crlfDelay: Infinity });
+    let buffer = "";
+    rl.on("line", (line) => {
+      buffer += line;
+      try {
+        const msg = JSON.parse(buffer);
+        buffer = "";
+        handleMessage(msg);
+      } catch {
+      }
+    });
+    proc.stderr?.on("data", (chunk) => {
+      const text2 = chunk.toString().trim();
+      if (text2) {
+        console.debug(`[mcp:${command}] stderr:`, text2);
+      }
+    });
+    proc.on("exit", (code, signal) => {
+      console.debug(`[mcp:${command}] exited (code=${code} signal=${signal})`);
+      for (const [id2, { reject, timer }] of pending) {
+        clearTimeout(timer);
+        reject(new Error(`MCP server exited (code=${code} signal=${signal})`));
+        pending.delete(id2);
+      }
+      proc = null;
+      rl = null;
+    });
+    proc.on("error", (err) => {
+      console.error(`[mcp:${command}] error:`, err.message);
+      for (const [, { reject, timer }] of pending) {
+        clearTimeout(timer);
+        reject(err);
+      }
+      pending.clear();
+    });
+  }
+  function handleMessage(msg) {
+    if (msg.id !== void 0 && pending.has(msg.id)) {
+      const { resolve: resolve16, reject, timer } = pending.get(msg.id);
+      clearTimeout(timer);
+      pending.delete(msg.id);
+      if (msg.error) {
+        reject(new Error(`MCP error: ${JSON.stringify(msg.error)}`));
+      } else {
+        resolve16(msg.result);
+      }
+    }
+  }
+  function sendRequest(method, params) {
+    ensureProcess();
+    const id2 = nextId();
+    const body = createRequest2(id2, method, params);
+    return new Promise((resolve16, reject) => {
+      const timer = setTimeout(() => {
+        pending.delete(id2);
+        reject(new Error(`MCP request "${method}" timed out after ${timeout}ms`));
+      }, timeout);
+      pending.set(id2, { resolve: resolve16, reject, timer });
+      if (proc?.stdin?.writable) {
+        proc.stdin.write(body + "\n");
+      } else {
+        clearTimeout(timer);
+        pending.delete(id2);
+        reject(new Error("MCP server stdin not available"));
+      }
+    });
+  }
+  async function initialize() {
+    ensureProcess();
+    await sendRequest("initialize", {
+      protocolVersion: "0.1.0",
+      capabilities: {},
+      clientInfo: { name: "weifuwu", version: "0.25.0" }
+    });
+    try {
+      if (proc?.stdin?.writable) {
+        proc.stdin.write(
+          JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }) + "\n"
+        );
+      }
+    } catch {
+    }
+  }
+  function mcpSchemaToZod(inputSchema) {
+    if (!inputSchema || !inputSchema.properties) {
+      return z14.object({});
+    }
+    const shape = {};
+    const required = new Set(inputSchema.required ?? []);
+    for (const [key, prop] of Object.entries(inputSchema.properties)) {
+      const p = prop;
+      let field;
+      switch (p.type) {
+        case "string":
+          field = z14.string();
+          break;
+        case "number":
+          field = z14.number();
+          break;
+        case "integer":
+          field = z14.number().int();
+          break;
+        case "boolean":
+          field = z14.boolean();
+          break;
+        case "array":
+          field = z14.array(z14.any());
+          break;
+        case "object":
+          field = z14.record(z14.string(), z14.any());
+          break;
+        default:
+          field = z14.any();
+      }
+      if (p.description) {
+        field = field.describe(p.description);
+      }
+      if (!required.has(key)) {
+        field = field.optional();
+      }
+      shape[key] = field;
+    }
+    return z14.object(shape);
+  }
+  async function refresh() {
+    _tools = null;
+    await getTools();
+  }
+  async function getTools() {
+    if (_tools) return _tools;
+    await initialize();
+    const result = await sendRequest("tools/list");
+    const defs = result?.tools ?? [];
+    const tools = {};
+    for (const def of defs) {
+      const paramsSchema = mcpSchemaToZod(def.inputSchema);
+      tools[def.name] = {
+        description: def.description ?? "MCP tool: " + def.name,
+        parameters: paramsSchema,
+        execute: async (args2) => {
+          const raw = await callToolInternal(def.name, args2);
+          return raw;
+        }
+      };
+    }
+    _tools = tools;
+    return tools;
+  }
+  async function callToolInternal(name, args2) {
+    const result = await sendRequest("tools/call", {
+      name,
+      arguments: args2
+    });
+    const content = result?.content;
+    if (Array.isArray(content)) {
+      const textParts = content.filter((c) => c.type === "text").map((c) => c.text ?? "");
+      if (textParts.length > 0) {
+        let combined = textParts.join("\n");
+        if (combined.length > maxResponseSize) {
+          combined = combined.slice(0, maxResponseSize) + "\n... [truncated]";
+        }
+        return combined;
+      }
+      const resourceParts = content.filter((c) => c.type === "resource");
+      if (resourceParts.length > 0) {
+        return resourceParts;
+      }
+      return content;
+    }
+    return result;
+  }
+  async function callTool(name, args2) {
+    return callToolInternal(name, args2);
+  }
+  async function close() {
+    try {
+      await sendRequest("shutdown");
+    } catch {
+    }
+    if (proc && !proc.killed) {
+      proc.kill("SIGTERM");
+      setTimeout(() => {
+        if (proc && !proc.killed) {
+          try {
+            proc.kill("SIGKILL");
+          } catch {
+          }
+        }
+      }, 3e3);
+    }
+    for (const [, { reject, timer }] of pending) {
+      clearTimeout(timer);
+      reject(new Error("MCP client closed"));
+    }
+    pending.clear();
+    proc = null;
+    rl = null;
+  }
+  return {
+    getTools,
+    refresh,
+    callTool,
+    close
+  };
+}
+
+// notifier/client.ts
+var DEFAULT_CHANNELS = ["inbox"];
+function notifier(opts) {
+  const { sql: sql2, mailer: mailer2, hub } = opts;
+  const table = opts.table ?? "_notifications";
+  const fromName = opts.fromName ?? "System";
+  const pageSize = opts.pageSize ?? 50;
+  function escapeIdent7(s) {
+    return `"${s.replace(/"/g, '""')}"`;
+  }
+  const tbl = escapeIdent7(table);
+  async function migrate() {
+    await sql2.unsafe(`
+      CREATE TABLE IF NOT EXISTS ${tbl} (
+        id          SERIAL PRIMARY KEY,
+        user_id     INTEGER NOT NULL,
+        title       TEXT NOT NULL,
+        body        TEXT NOT NULL DEFAULT '',
+        action_url  TEXT,
+        action_text TEXT,
+        type        TEXT NOT NULL DEFAULT 'default',
+        metadata    JSONB NOT NULL DEFAULT '{}',
+        read_at     TIMESTAMPTZ,
+        created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+    await sql2.unsafe(`
+      CREATE INDEX IF NOT EXISTS "${table}_user_unread"
+      ON ${tbl} (user_id, created_at DESC)
+      WHERE read_at IS NULL
+    `);
+    await sql2.unsafe(`
+      CREATE INDEX IF NOT EXISTS "${table}_user_all"
+      ON ${tbl} (user_id, created_at DESC)
+    `);
+    await sql2.unsafe(`
+      CREATE TABLE IF NOT EXISTS "_notify_prefs" (
+        user_id  INTEGER PRIMARY KEY,
+        channels JSONB NOT NULL DEFAULT '["inbox"]'::jsonb
+      )
+    `);
+  }
+  async function insertNotification(userId2, message) {
+    await sql2.unsafe(
+      `INSERT INTO ${tbl} (user_id, title, body, action_url, action_text, type, metadata)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+      [
+        userId2,
+        message.title,
+        message.body ?? "",
+        message.actionUrl ?? null,
+        message.actionText ?? null,
+        message.type ?? "default",
+        message.metadata ?? {}
+      ]
+    );
+  }
+  async function send(to, message) {
+    const prefs = await getPreferences(to.userId);
+    if (prefs.channels.includes("inbox")) {
+      await insertNotification(to.userId, message);
+    }
+    if (prefs.channels.includes("email") && mailer2 && to.email) {
+      const html = renderEmail(message);
+      mailer2.send({
+        to: to.email,
+        subject: message.title,
+        text: message.body ?? "",
+        html
+      }).catch((err) => console.error("[notifier] email send failed:", err.message));
+    }
+    if (prefs.channels.includes("ws") && hub) {
+      hub.broadcast(`notify:${to.userId}`, {
+        type: "notification",
+        data: {
+          title: message.title,
+          body: message.body,
+          actionUrl: message.actionUrl,
+          actionText: message.actionText,
+          type: message.type ?? "default",
+          metadata: message.metadata,
+          created_at: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
+    }
+  }
+  async function broadcast(message) {
+    const rows = await sql2`
+      SELECT user_id FROM "_notify_prefs"
+      WHERE channels @> ${sql2.json(["inbox"])}
+    `;
+    for (const row of rows) {
+      await insertNotification(row.user_id, message);
+      if (hub) {
+        hub.broadcast(`notify:${row.user_id}`, {
+          type: "notification",
+          data: {
+            title: message.title,
+            body: message.body,
+            actionUrl: message.actionUrl,
+            actionText: message.actionText,
+            type: message.type ?? "default",
+            metadata: message.metadata,
+            created_at: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        });
+      }
+    }
+  }
+  async function unreadCount(userId2) {
+    const [row] = await sql2.unsafe(
+      `SELECT COUNT(*)::int AS count FROM ${tbl} WHERE user_id = $1 AND read_at IS NULL`,
+      [userId2]
+    );
+    return row?.count ?? 0;
+  }
+  async function count(userId2, unreadOnly = false) {
+    if (unreadOnly) return unreadCount(userId2);
+    const [row] = await sql2.unsafe(
+      `SELECT COUNT(*)::int AS count FROM ${tbl} WHERE user_id = $1`,
+      [userId2]
+    );
+    return row?.count ?? 0;
+  }
+  async function markRead(userId2, notificationIds) {
+    if (notificationIds && notificationIds.length > 0) {
+      const ids = notificationIds.map((_, i) => `$${i + 2}`).join(", ");
+      await sql2.unsafe(
+        `UPDATE ${tbl} SET read_at = NOW() WHERE user_id = $1 AND id IN (${ids}) AND read_at IS NULL`,
+        [userId2, ...notificationIds]
+      );
+    } else {
+      await sql2.unsafe(`UPDATE ${tbl} SET read_at = NOW() WHERE user_id = $1 AND read_at IS NULL`, [
+        userId2
+      ]);
+    }
+  }
+  async function list(userId2, opts2) {
+    const limit = opts2?.limit ?? pageSize;
+    const offset = opts2?.offset ?? 0;
+    let where = `user_id = $1`;
+    const params = [userId2];
+    const paramIdx = 2;
+    if (opts2?.unreadOnly) {
+      where += ` AND read_at IS NULL`;
+    }
+    const rows = await sql2.unsafe(
+      `SELECT id, user_id, title, body, action_url, action_text, type, metadata, read_at, created_at
+       FROM ${tbl}
+       WHERE ${where}
+       ORDER BY created_at DESC
+       LIMIT $${paramIdx} OFFSET $${paramIdx + 1}`,
+      [...params, limit, offset]
+    );
+    return rows.map(normalizeNotification);
+  }
+  function normalizeNotification(row) {
+    return {
+      ...row,
+      metadata: typeof row.metadata === "string" ? JSON.parse(row.metadata) : row.metadata ?? {}
+    };
+  }
+  async function getPreferences(userId2) {
+    const [row] = await sql2.unsafe(`SELECT channels FROM "_notify_prefs" WHERE user_id = $1`, [
+      userId2
+    ]);
+    if (!row) {
+      return { channels: [...DEFAULT_CHANNELS] };
+    }
+    let channels;
+    if (typeof row.channels === "string") {
+      channels = JSON.parse(row.channels);
+    } else if (Array.isArray(row.channels)) {
+      channels = row.channels;
+    } else {
+      channels = [...DEFAULT_CHANNELS];
+    }
+    return { channels };
+  }
+  async function setPreferences(userId2, prefs) {
+    await sql2`
+      INSERT INTO "_notify_prefs" (user_id, channels)
+      VALUES (${userId2}, ${sql2.json(prefs.channels)})
+      ON CONFLICT (user_id)
+      DO UPDATE SET channels = ${sql2.json(prefs.channels)}
+    `;
+  }
+  async function clean(days) {
+    const result = await sql2.unsafe(`DELETE FROM ${tbl} WHERE created_at < NOW() - $1::interval`, [
+      `${days} days`
+    ]);
+    return Array.isArray(result) ? result.length : 0;
+  }
+  function renderEmail(message) {
+    const actionHtml = message.actionUrl ? `
+<p><a href="${escapeHtml3(message.actionUrl)}" style="display:inline-block;padding:10px 20px;background:#0066cc;color:#fff;text-decoration:none;border-radius:4px">${escapeHtml3(message.actionText ?? "View")}</a></p>` : "";
+    return `<!DOCTYPE html>
+<html>
+<head><meta charset="utf-8"></head>
+<body style="font-family:sans-serif;padding:20px;max-width:600px">
+  <h2>${escapeHtml3(message.title)}</h2>
+  ${message.body ? `<p>${escapeHtml3(message.body)}</p>` : ""}
+  ${actionHtml}
+  <hr style="margin-top:30px;border:none;border-top:1px solid #eee">
+  <p style="color:#999;font-size:12px">${escapeHtml3(fromName)}</p>
+</body>
+</html>`;
+  }
+  function escapeHtml3(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  }
+  const mw = async (req, ctx, next) => {
+    ;
+    ctx.notifier = api;
+    return next(req, ctx);
+  };
+  const api = {
+    send,
+    broadcast,
+    unreadCount,
+    count,
+    markRead,
+    list,
+    getPreferences,
+    setPreferences,
+    clean,
+    migrate,
+    close: async () => {
+    }
+  };
+  return Object.assign(mw, api);
+}
 export {
   DEFAULT_MAX_BODY,
   MIGRATIONS_TABLE,
@@ -12087,7 +12667,9 @@ export {
   logdb,
   logger,
   mailer,
+  mcpClient,
   messager,
+  notifier,
   openai,
   opencode,
   permissions,