weifuwu 0.24.3 → 0.25.0

package/dist/index.js

@@ -467,6 +467,8 @@ var Router = class _Router {
   _hasWildcard = false;
   _hub;
   _wss;
+  /** Track which ctx fields have been injected so far (for dependency checking). */
+  _ctxFields = /* @__PURE__ */ new Set();
   get wss() {
     if (!this._wss) this._wss = new WebSocketServer({ noServer: true });
     return this._wss;
@@ -490,17 +492,47 @@ var Router = class _Router {
           node = getOrCreateChild(node, segment, createTrieNode, false);
         }
         node.pathMws.push(arg2);
+        this._checkMiddlewareMeta(arg2, `${arg1}`);
       }
     } else if (typeof arg1 === "function") {
       this.globalMws.push(arg1);
+      this._checkMiddlewareMeta(arg1, "global");
     } else if (typeof arg1 === "object" && arg1 !== null && "middleware" in arg1 && // eslint-disable-next-line @typescript-eslint/no-explicit-any
     typeof arg1.middleware === "function" && arg1 instanceof _Router) {
       const mod = arg1;
-      this.globalMws.push(mod.middleware());
+      const mw = mod.middleware();
+      this.globalMws.push(mw);
+      this._checkMiddlewareMeta(mw, "global (auto-registered)");
       this._mountRouter("/", mod);
     }
     return this;
   }
+  /**
+   * Check a middleware's dependency metadata and emit warnings if
+   * required fields haven't been injected yet.
+   * Attach __meta to a middleware function:
+   *
+   * ```ts
+   * mw.__meta = { injects: ['sql'], depends: ['session'] }
+   * ```
+   */
+  _checkMiddlewareMeta(mw, location) {
+    const meta = mw.__meta ?? mw.middleware?.().__meta;
+    if (!meta) return;
+    for (const dep of meta.depends) {
+      if (!this._ctxFields.has(dep)) {
+        console.warn(
+          `[weifuwu] Middleware at "${location}" depends on ctx.${dep} but it hasn't been registered yet.
+  Register the provider before this middleware:
+    app.use(${dep}())  // add before this middleware
+  Current ctx fields: [${[...this._ctxFields].join(", ")}]`
+        );
+      }
+    }
+    for (const field of meta.injects) {
+      this._ctxFields.add(field);
+    }
+  }
   // Route registration — returns Router<T> unchanged.
   // Route-level middleware and handlers get Context<T>.
   get(path2, ...args) {
@@ -1568,6 +1600,7 @@ function rateLimit(options) {
     const res = await next(req, ctx);
     return addRateLimitHeaders(res, max, remaining, reset);
   };
+  mw.__meta = { injects: [], depends: [] };
   mw.close = () => {
     if (interval) clearInterval(interval);
     hits.clear();
@@ -1751,6 +1784,7 @@ function createSSEStream(iterable, opts) {
 }
 
 // test-utils.ts
+import { WebSocket as WSWebSocket } from "ws";
 var TestResponseImpl = class {
   response;
   constructor(response) {
@@ -1846,9 +1880,22 @@ var TestRequest = class {
 };
 var TestApp = class {
   router;
+  wsServer = null;
+  wsConnections = [];
   constructor() {
     this.router = new Router();
   }
+  /**
+   * Register a WebSocket handler.
+   */
+  ws(path2, handler) {
+    this.router.ws(path2, handler);
+    return this;
+  }
+  /** Get the raw Router (for advanced use). */
+  get _router() {
+    return this.router;
+  }
   /** Add global middleware */
   use(mw) {
     this.router.use(mw);
@@ -1908,6 +1955,195 @@ var TestApp = class {
   handler() {
     return this.router.handler();
   }
+  /** Start building a WebSocket connection to the given path. */
+  wsReq(path2) {
+    return new TestWSRequest(this, path2);
+  }
+  /**
+   * Internal: ensure HTTP server is running for WebSocket connections.
+   * Starts on a random port.
+   */
+  /* @internal */
+  async _ensureServer() {
+    if (this.wsServer) {
+      return `http://localhost:${this.wsServer.port}`;
+    }
+    const wsHandler = this.router.websocketHandler();
+    if (!wsHandler) {
+      throw new Error(
+        "No WebSocket routes registered. Use app.ws(path, handler) before calling wsReq()."
+      );
+    }
+    this.wsServer = serve(this.router.handler(), {
+      websocket: wsHandler
+    });
+    await this.wsServer.ready;
+    return `http://localhost:${this.wsServer.port}`;
+  }
+  /**
+   * Internal: register a WS connection for cleanup.
+   */
+  /* @internal */
+  _trackConnection(conn) {
+    this.wsConnections.push(conn);
+  }
+  /**
+   * Cleanup all WebSocket connections and stop the server.
+   */
+  async close() {
+    for (const conn of this.wsConnections) {
+      try {
+        conn.close();
+      } catch {
+      }
+    }
+    this.wsConnections = [];
+    if (this.wsServer) {
+      this.wsServer.stop();
+      this.wsServer = null;
+    }
+  }
+};
+var TestWSRequest = class {
+  app;
+  path;
+  _timeout = 5e3;
+  constructor(app, path2) {
+    this.app = app;
+    this.path = path2;
+  }
+  /** Set the timeout for operations (default: 5000ms). */
+  timeout(ms) {
+    this._timeout = ms;
+    return this;
+  }
+  /**
+   * Connect to the WebSocket endpoint.
+   * Starts a real HTTP server (random port) if not already running.
+   */
+  async connect() {
+    const baseUrl = await this.app._ensureServer();
+    const wsUrl = baseUrl.replace(/^http/, "ws") + this.path;
+    const ws = new WSWebSocket(wsUrl, { handshakeTimeout: this._timeout });
+    return new Promise((resolve16, reject) => {
+      const timer = setTimeout(() => {
+        reject(new Error(`WebSocket connection timed out after ${this._timeout}ms`));
+        ws.close();
+      }, this._timeout);
+      ws.on("open", () => {
+        clearTimeout(timer);
+        const conn = new TestWSConnection(ws, this._timeout);
+        this.app._trackConnection(conn);
+        resolve16(conn);
+      });
+      ws.on("error", (err) => {
+        clearTimeout(timer);
+        reject(new Error(`WebSocket connection error: ${err.message}`));
+      });
+      ws.on("unexpected-response", (_req, res) => {
+        clearTimeout(timer);
+        let body = "";
+        res.on("data", (chunk) => {
+          body += chunk.toString();
+        });
+        res.on("end", () => {
+          reject(new Error(`WebSocket upgrade rejected (${res.statusCode}): ${body.slice(0, 200)}`));
+        });
+      });
+    });
+  }
+};
+var TestWSConnection = class {
+  ws;
+  _timeout;
+  messageQueue = [];
+  resolveQueue = [];
+  _closed = false;
+  constructor(ws, timeout = 5e3) {
+    this.ws = ws;
+    this._timeout = timeout;
+    ws.on("message", (data) => {
+      const str = data.toString();
+      if (this.resolveQueue.length > 0) {
+        const resolve16 = this.resolveQueue.shift();
+        resolve16(str);
+      } else {
+        this.messageQueue.push(str);
+      }
+    });
+    ws.on("close", () => {
+      this._closed = true;
+      for (const _r of this.resolveQueue) {
+      }
+    });
+  }
+  /** Send a text message. */
+  send(data) {
+    this.ws.send(data);
+  }
+  /** Send a JSON message. */
+  json(data) {
+    this.ws.send(JSON.stringify(data));
+  }
+  /**
+   * Wait for the next message. Returns the raw text.
+   * Throws on timeout or if the connection is closed.
+   */
+  async receive(timeout) {
+    if (this.messageQueue.length > 0) {
+      return this.messageQueue.shift();
+    }
+    if (this._closed) {
+      throw new Error("WebSocket connection closed");
+    }
+    return new Promise((resolve16, reject) => {
+      const timer = setTimeout(() => {
+        const idx = this.resolveQueue.indexOf(resolve16);
+        if (idx !== -1) this.resolveQueue.splice(idx, 1);
+        reject(new Error(`WebSocket receive timed out after ${timeout ?? this._timeout}ms`));
+      }, timeout ?? this._timeout);
+      this.resolveQueue.push((msg) => {
+        clearTimeout(timer);
+        resolve16(msg);
+      });
+    });
+  }
+  /** Wait for the next message and parse as JSON. */
+  async receiveJson() {
+    const msg = await this.receive();
+    return JSON.parse(msg);
+  }
+  /**
+   * Assert that no message is received within the given silence period.
+   * Useful for verifying that something did NOT happen.
+   */
+  async expectSilent(ms) {
+    return new Promise((resolve16, reject) => {
+      if (this.messageQueue.length > 0) {
+        reject(new Error(`Expected silence but got message: ${this.messageQueue[0].slice(0, 100)}`));
+        return;
+      }
+      const timer = setTimeout(() => resolve16(), ms);
+      const origPush = this.resolveQueue.push.bind(this.resolveQueue);
+      this.resolveQueue.push = (_fn) => {
+        clearTimeout(timer);
+        reject(new Error("Expected silence but received a message"));
+        return 0;
+      };
+      setTimeout(() => {
+        this.resolveQueue.push = origPush;
+      }, ms + 10).unref();
+    });
+  }
+  /** Close the connection. */
+  close() {
+    this._closed = true;
+    this.ws.close();
+  }
+  /** Whether the connection is closed. */
+  get closed() {
+    return this._closed;
+  }
 };
 function testApp() {
   return new TestApp();
@@ -2507,6 +2743,7 @@ function aiProvider(options) {
     ctx.ai = provider;
     return next(req, ctx);
   };
+  mw.__meta = { injects: ["ai"], depends: [] };
   return Object.assign(mw, provider);
 }
 
@@ -3116,6 +3353,7 @@ function postgres(opts) {
     ctx.sql = sql2;
     return next(req, ctx);
   });
+  mw.__meta = { injects: ["sql"], depends: [] };
   mw.sql = sql2;
   mw.table = ((tableOrSchema, builders) => {
     if (typeof tableOrSchema === "string") {
@@ -3192,7 +3430,7 @@ var PgModule = class {
 };
 
 // user/client.ts
-import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+import { randomBytes, scryptSync, timingSafeEqual, createHash } from "node:crypto";
 import jwt2 from "jsonwebtoken";
 import { z as z2 } from "zod";
 
@@ -3739,6 +3977,10 @@ var LoginSchema = z2.object({
   email: z2.string().email(),
   password: z2.string().min(1)
 });
+var CreateApiKeySchema = z2.object({
+  name: z2.string().min(1),
+  scopes: z2.array(z2.string()).optional()
+});
 function escapeIdent2(s) {
   return `"${s.replace(/"/g, '""')}"`;
 }
@@ -3785,6 +4027,7 @@ function user(options) {
   const secret = options.jwtSecret;
   const expiresIn = options.expiresIn ?? "24h";
   const oauth2Enabled = options.oauth2?.server ?? false;
+  const apiKeysEnabled = options.apiKeys ?? false;
   const base = hasDb ? new PgModule(pg) : null;
   const users = hasDb ? pg.table(table, {
     id: serial("id").primaryKey(),
@@ -3822,6 +4065,28 @@ function user(options) {
         ON "_auth_providers"(user_id)
       `);
     }
+    if (apiKeysEnabled) {
+      await _pg.sql.unsafe(`
+        CREATE TABLE IF NOT EXISTS "_api_keys" (
+          id          SERIAL PRIMARY KEY,
+          user_id     INTEGER NOT NULL REFERENCES ${escapeIdent2(table)}(id) ON DELETE CASCADE,
+          name        TEXT NOT NULL,
+          key_prefix  TEXT NOT NULL,
+          key_hash    TEXT NOT NULL,
+          scopes      TEXT[] DEFAULT '{}',
+          last_used_at TIMESTAMPTZ,
+          expires_at  TIMESTAMPTZ,
+          created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+          revoked     BOOLEAN DEFAULT false
+        )
+      `);
+      await _pg.sql.unsafe(`
+        CREATE INDEX IF NOT EXISTS "_api_keys_user_idx" ON "_api_keys"(user_id)
+      `);
+      await _pg.sql.unsafe(`
+        CREATE UNIQUE INDEX IF NOT EXISTS "_api_keys_hash_idx" ON "_api_keys"(key_hash)
+      `);
+    }
     if (!oauth2Enabled) return;
     const clients3 = _pg.table("_oauth2_clients", {
       id: serial("id").primaryKey(),
@@ -3922,8 +4187,79 @@ function user(options) {
       return null;
     }
   }
+  function hashApiKey(key) {
+    return createHash("sha256").update(key).digest("hex");
+  }
+  function generateApiKey() {
+    const random = randomBytes(32).toString("hex");
+    return `sk_live_${random}`;
+  }
+  async function createApiKey(userId2, name, scopes) {
+    if (!hasDb) throw new Error("user(): pg required for API key management");
+    const key = generateApiKey();
+    const keyHash = hashApiKey(key);
+    const prefix = key.slice(0, 12) + "..." + key.slice(-4);
+    const [row] = await _pg.sql.unsafe(
+      `INSERT INTO "_api_keys" (user_id, name, key_prefix, key_hash, scopes)
+       VALUES ($1, $2, $3, $4, $5) RETURNING id`,
+      [userId2, name, prefix, keyHash, scopes ?? []]
+    );
+    return { id: row.id, key };
+  }
+  async function listApiKeys(userId2) {
+    if (!hasDb) return [];
+    const rows = await _pg.sql.unsafe(
+      `SELECT id, name, key_prefix, scopes, last_used_at, created_at, revoked
+       FROM "_api_keys" WHERE user_id = $1 ORDER BY created_at DESC`,
+      [userId2]
+    );
+    return rows.map((r2) => ({
+      id: r2.id,
+      name: r2.name,
+      prefix: r2.key_prefix,
+      scopes: Array.isArray(r2.scopes) ? r2.scopes : [],
+      last_used_at: r2.last_used_at ? new Date(r2.last_used_at).toISOString() : null,
+      created_at: new Date(r2.created_at).toISOString(),
+      revoked: !!r2.revoked
+    }));
+  }
+  async function revokeApiKey(userId2, keyId) {
+    if (!hasDb) throw new Error("user(): pg required for API key management");
+    await _pg.sql.unsafe(`UPDATE "_api_keys" SET revoked = true WHERE id = $1 AND user_id = $2`, [
+      keyId,
+      userId2
+    ]);
+  }
+  async function verifyApiKey(key) {
+    if (!hasDb || !apiKeysEnabled) return null;
+    const keyHash = hashApiKey(key);
+    const [row] = await _pg.sql.unsafe(
+      `SELECT id, user_id, scopes, revoked, expires_at
+       FROM "_api_keys" WHERE key_hash = $1 LIMIT 1`,
+      [keyHash]
+    );
+    if (!row) return null;
+    if (row.revoked) return null;
+    if (row.expires_at && new Date(row.expires_at) < /* @__PURE__ */ new Date()) return null;
+    await _pg.sql.unsafe(
+      `UPDATE "_api_keys" SET last_used_at = NOW() WHERE id = $1 AND last_used_at IS NULL OR last_used_at < NOW() - interval '1 minute'`,
+      [row.id]
+    ).catch(() => {
+    });
+    return {
+      userId: row.user_id,
+      scopes: Array.isArray(row.scopes) ? row.scopes : []
+    };
+  }
+  async function tryApiKeyAuth(token) {
+    if (!apiKeysEnabled || !hasDb) return null;
+    if (!token.startsWith("sk_")) return null;
+    return verifyApiKey(token);
+  }
   const headerName = options.header ?? "Authorization";
   async function resolveUser(req, ctx) {
+    const _ctx2 = ctx;
+    if (_ctx2.user) return _ctx2.user;
     const s = ctx;
     const sessionUserId = s.session?.userId;
     if (sessionUserId !== void 0 && sessionUserId !== null) {
@@ -3999,6 +4335,17 @@ function user(options) {
         return null;
       }
     }
+    if (token.startsWith("sk_")) {
+      const result = await tryApiKeyAuth(token);
+      if (result) {
+        if (hasDb) {
+          const row = await findById(result.userId);
+          if (row) return { ...stripPassword(row), _apiKeyScopes: result.scopes };
+        }
+        return { id: result.userId, _apiKeyScopes: result.scopes };
+      }
+      return null;
+    }
     if (secret && hasDb) {
       try {
         const payload = jwt2.verify(token, secret);
@@ -4084,6 +4431,33 @@ function user(options) {
       }
     });
   }
+  if (apiKeysEnabled) {
+    r.get("/api-keys", middleware(), async (_req, ctx) => {
+      const keys = await listApiKeys(ctx.user.id);
+      return Response.json(keys);
+    });
+    r.post("/api-keys", middleware(), async (req, ctx) => {
+      try {
+        const body = await parseBody2(req);
+        const { name, scopes } = CreateApiKeySchema.parse(body);
+        const result = await createApiKey(ctx.user.id, name, scopes);
+        return Response.json(result, { status: 201 });
+      } catch (err) {
+        if (err instanceof z2.ZodError) {
+          return Response.json({ error: "Validation failed", issues: err.issues }, { status: 400 });
+        }
+        return Response.json({ error: err.message }, { status: 500 });
+      }
+    });
+    r.delete("/api-keys/:id", middleware(), async (req, ctx) => {
+      const keyId = parseInt(ctx.params.id, 10);
+      if (isNaN(keyId)) {
+        return Response.json({ error: "Invalid key ID" }, { status: 400 });
+      }
+      await revokeApiKey(ctx.user.id, keyId);
+      return Response.json({ ok: true });
+    });
+  }
   if (oauth2) {
     r.get("/oauth/authorize", (req, ctx) => oauth2.authorizeHandler(req, ctx));
     r.post("/oauth/consent", (req) => oauth2.consentHandler(req));
@@ -4128,6 +4502,21 @@ function user(options) {
   mod.revokeClient = oauth2 ? (clientId) => oauth2.revokeClient(clientId) : async () => {
     throw new Error("OAuth2 server is not enabled");
   };
+  mod.createApiKey = hasDb && apiKeysEnabled ? createApiKey : async () => {
+    throw new Error(
+      "API key management is not enabled. Pass apiKeys: true in user() options."
+    );
+  };
+  mod.listApiKeys = hasDb && apiKeysEnabled ? listApiKeys : async () => {
+    throw new Error(
+      "API key management is not enabled. Pass apiKeys: true in user() options."
+    );
+  };
+  mod.revokeApiKey = hasDb && apiKeysEnabled ? revokeApiKey : async () => {
+    throw new Error(
+      "API key management is not enabled. Pass apiKeys: true in user() options."
+    );
+  };
   mod.close = hasDb ? () => base.close() : async () => {
   };
   return mod;
@@ -4144,6 +4533,7 @@ function redis(opts) {
     ctx.redis = client;
     return next(req, ctx);
   });
+  mw.__meta = { injects: ["redis"], depends: [] };
   mw.redis = client;
   mw.close = () => client.quit();
   return mw;
@@ -6993,7 +7383,7 @@ import { createOpenAI as createOpenAI3 } from "@ai-sdk/openai";
 
 // ssr.ts
 import { createElement as createElement3 } from "react";
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { existsSync as existsSync6, readdirSync } from "node:fs";
 import { readdir, stat } from "node:fs/promises";
 import { dirname as dirname4, join as join5, resolve as resolve8, relative as relative3 } from "node:path";
@@ -7004,7 +7394,7 @@ import * as esbuild2 from "esbuild";
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3 } from "node:fs";
 import { join as join2, resolve as resolve4, dirname as dirname2 } from "node:path";
 import { pathToFileURL } from "node:url";
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { createRequire as createRequire2 } from "node:module";
 
 // server-registry.ts
@@ -7195,7 +7585,7 @@ function resolveAliases2() {
   return {};
 }
 function id(s) {
-  return createHash("md5").update(s).digest("hex").slice(0, 8);
+  return createHash2("md5").update(s).digest("hex").slice(0, 8);
 }
 function clearCompileCache() {
   cache.clear();
@@ -7479,7 +7869,7 @@ ws.onclose=function(){
 var ssrEntries = /* @__PURE__ */ new Map();
 
 // tailwind.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync } from "node:fs";
 import { join as join3, relative, resolve as resolve5 } from "node:path";
 var extraSources = /* @__PURE__ */ new Set();
@@ -7531,7 +7921,7 @@ ${src}`;
 ${src}`;
     }
     const result = await postcss([tailwindPlugin()]).process(src, { from: cssPath });
-    const hash = createHash2("md5").update(result.css).digest("hex").slice(0, 8);
+    const hash = createHash3("md5").update(result.css).digest("hex").slice(0, 8);
     cssCache.set(cssPath, { css: result.css, hash });
     return result.css;
   } catch (err) {
@@ -7549,7 +7939,7 @@ import { join as join4, resolve as resolve7 } from "node:path";
 import * as esbuild3 from "esbuild";
 import { existsSync as existsSync4, readFileSync as readFileSync5 } from "node:fs";
 import { resolve as resolve6, dirname as dirname3, relative as relative2 } from "node:path";
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 var moduleCache = /* @__PURE__ */ new Map();
 var hashCache = /* @__PURE__ */ new Map();
 function clearModuleCache(filePath) {
@@ -7573,7 +7963,7 @@ function fileHash(absPath) {
   if (cached) return cached;
   try {
     const content = readFileSync5(absPath);
-    const h = createHash3("md5").update(content).digest("hex").slice(0, 8);
+    const h = createHash4("md5").update(content).digest("hex").slice(0, 8);
     hashCache.set(absPath, h);
     return h;
   } catch {
@@ -7852,7 +8242,7 @@ var isDev2 = isDev();
 var als2 = new AsyncLocalStorage2();
 __registerAls(() => als2.getStore());
 function hashId(s) {
-  return createHash4("md5").update(s).digest("hex").slice(0, 8);
+  return createHash5("md5").update(s).digest("hex").slice(0, 8);
 }
 function serializeLoaderData(ctx) {
   const ld = ctx.loaderData;
@@ -10016,381 +10406,6 @@ function logdb(options) {
 // iii/client.ts
 import crypto8 from "node:crypto";
 
-// iii/stream.ts
-function notify(channels, stream, group, item, event, data) {
-  const keys = [`${stream}`, `${stream}:${group}`, `${stream}:${group}:${item}`];
-  const msg = JSON.stringify({
-    type: "stream",
-    stream_name: stream,
-    group_id: group,
-    item_id: item,
-    event,
-    data
-  });
-  for (const key of keys) {
-    const subs = channels.get(key);
-    if (!subs) continue;
-    for (const ws of subs) {
-      try {
-        ws.send(msg);
-      } catch {
-      }
-    }
-  }
-}
-function deepClone(v) {
-  return JSON.parse(JSON.stringify(v));
-}
-function applyOps(value, ops) {
-  let current = deepClone(value ?? {});
-  for (const op2 of ops) {
-    switch (op2.op) {
-      case "set":
-        current = deepClone(op2.value);
-        break;
-      case "merge":
-        if (typeof current === "object" && current !== null && !Array.isArray(current)) {
-          current = { ...current, ...deepClone(op2.value) };
-        } else {
-          current = deepClone(op2.value);
-        }
-        break;
-      case "increment":
-        current = (typeof current === "number" ? current : 0) + op2.value;
-        break;
-      case "decrement":
-        current = (typeof current === "number" ? current : 0) - op2.value;
-        break;
-      case "append":
-        if (!Array.isArray(current)) current = [];
-        current.push(deepClone(op2.value));
-        break;
-      case "remove":
-        current = null;
-        break;
-    }
-  }
-  return current;
-}
-function createMemoryStore(channels) {
-  const store2 = /* @__PURE__ */ new Map();
-  function key(stream, group, item) {
-    return `${stream}:${group}:${item}`;
-  }
-  return {
-    async set(stream, group, item, data) {
-      const k = key(stream, group, item);
-      const old = store2.get(k) ?? null;
-      store2.set(k, deepClone(data));
-      notify(channels, stream, group, item, "set", data);
-      return { old_value: old, new_value: deepClone(data) };
-    },
-    async get(stream, group, item) {
-      const v = store2.get(key(stream, group, item)) ?? null;
-      return { value: deepClone(v) };
-    },
-    async delete(stream, group, item) {
-      const k = key(stream, group, item);
-      const old = store2.get(k) ?? null;
-      store2.delete(k);
-      notify(channels, stream, group, item, "delete", null);
-      return { old_value: old };
-    },
-    async list(stream, group) {
-      const items = [];
-      const prefix = `${stream}:${group}:`;
-      for (const [k, v] of store2) {
-        if (k.startsWith(prefix) && !k.slice(prefix.length).includes(":")) {
-          items.push({ item_id: k.slice(prefix.length), data: deepClone(v) });
-        }
-      }
-      return { items };
-    },
-    async list_groups(stream) {
-      const groups = /* @__PURE__ */ new Set();
-      const prefix = `${stream}:`;
-      for (const k of store2.keys()) {
-        if (k.startsWith(prefix)) {
-          const rest = k.slice(prefix.length);
-          const g = rest.split(":")[0];
-          if (g) groups.add(g);
-        }
-      }
-      return { groups: Array.from(groups) };
-    },
-    async list_all() {
-      const streamMap = /* @__PURE__ */ new Map();
-      for (const k of store2.keys()) {
-        const parts = k.split(":");
-        const s = parts[0];
-        const g = parts[1];
-        if (!streamMap.has(s)) streamMap.set(s, { groups: /* @__PURE__ */ new Set(), items: /* @__PURE__ */ new Set() });
-        const entry = streamMap.get(s);
-        if (g) entry.groups.add(g);
-        entry.items.add(k);
-      }
-      const streams = Array.from(streamMap.entries()).map(([name, info]) => ({
-        stream_name: name,
-        group_count: info.groups.size,
-        item_count: info.items.size
-      }));
-      return { streams, count: streams.length };
-    },
-    async send(stream, group, type, data, id2) {
-      notify(channels, stream, group, id2 ?? "", "send", { type, data });
-    },
-    async update(stream, group, item, ops) {
-      const k = key(stream, group, item);
-      const old = deepClone(store2.get(k) ?? null);
-      const newVal = applyOps(old, ops);
-      store2.set(k, deepClone(newVal));
-      notify(channels, stream, group, item, "update", newVal);
-      return { old_value: old, new_value: deepClone(newVal) };
-    }
-  };
-}
-function createPgStore(channels, pg) {
-  const sql2 = pg.sql;
-  return {
-    async set(stream, group, item, data) {
-      const rows = await sql2`
-        INSERT INTO "_iii_stream" (stream_name, group_id, item_id, data)
-        VALUES (${stream}, ${group}, ${item}, ${data})
-        ON CONFLICT (stream_name, group_id, item_id)
-        DO UPDATE SET data = ${data}, updated_at = NOW()
-        RETURNING data
-      `;
-      notify(channels, stream, group, item, "set", data);
-      return { old_value: null, new_value: data };
-    },
-    async get(stream, group, item) {
-      const rows = await sql2`
-        SELECT data FROM "_iii_stream"
-        WHERE stream_name = ${stream} AND group_id = ${group} AND item_id = ${item}
-      `;
-      const row = rows[0];
-      let value = row?.data ?? null;
-      if (typeof value === "string") value = JSON.parse(value);
-      return { value };
-    },
-    async delete(stream, group, item) {
-      const rows = await sql2`
-        DELETE FROM "_iii_stream"
-        WHERE stream_name = ${stream} AND group_id = ${group} AND item_id = ${item}
-        RETURNING data
-      `;
-      const old = rows[0]?.data ?? null;
-      notify(channels, stream, group, item, "delete", null);
-      return { old_value: old };
-    },
-    async list(stream, group) {
-      const rows = await sql2`
-        SELECT item_id, data FROM "_iii_stream"
-        WHERE stream_name = ${stream} AND group_id = ${group}
-        ORDER BY item_id
-      `;
-      const items = rows.map((r) => ({
-        item_id: r.item_id,
-        data: typeof r.data === "string" ? JSON.parse(r.data) : r.data
-      }));
-      return { items };
-    },
-    async list_groups(stream) {
-      const rows = await sql2`
-        SELECT DISTINCT group_id FROM "_iii_stream"
-        WHERE stream_name = ${stream}
-        ORDER BY group_id
-      `;
-      return { groups: rows.map((r) => r.group_id) };
-    },
-    async list_all() {
-      const rows = await sql2`
-        SELECT stream_name, COUNT(DISTINCT group_id) as group_count, COUNT(*) as item_count
-        FROM "_iii_stream"
-        GROUP BY stream_name
-        ORDER BY stream_name
-      `;
-      const streams = rows.map((r) => ({
-        stream_name: r.stream_name,
-        group_count: Number(r.group_count),
-        item_count: Number(r.item_count)
-      }));
-      return { streams, count: streams.length };
-    },
-    async send(stream, group, type, data, id2) {
-      notify(channels, stream, group, id2 ?? "", "send", { type, data });
-    },
-    async update(stream, group, item, ops) {
-      const { value: oldVal } = await this.get(stream, group, item);
-      const newVal = applyOps(oldVal, ops);
-      await sql2`
-        INSERT INTO "_iii_stream" (stream_name, group_id, item_id, data)
-        VALUES (${stream}, ${group}, ${item}, ${newVal})
-        ON CONFLICT (stream_name, group_id, item_id)
-        DO UPDATE SET data = ${newVal}, updated_at = NOW()
-      `;
-      notify(channels, stream, group, item, "update", newVal);
-      return { old_value: oldVal, new_value: deepClone(newVal) };
-    }
-  };
-}
-function createRedisStore(channels, redis2, ttl) {
-  function hashKey(stream, group) {
-    return `iii:stream:${stream}:${group}`;
-  }
-  function setTTL(hk) {
-    if (ttl) redis2.expire(hk, ttl);
-  }
-  return {
-    async set(stream, group, item, data) {
-      const hk = hashKey(stream, group);
-      const oldRaw = await redis2.hget(hk, item);
-      const old = oldRaw ? JSON.parse(oldRaw) : null;
-      await redis2.hset(hk, item, JSON.stringify(data));
-      setTTL(hk);
-      await redis2.publish(
-        `iii:stream:${stream}`,
-        JSON.stringify({ event: "set", group, item, data })
-      );
-      notify(channels, stream, group, item, "set", data);
-      return { old_value: old, new_value: deepClone(data) };
-    },
-    async get(stream, group, item) {
-      const raw = await redis2.hget(hashKey(stream, group), item);
-      return { value: raw ? JSON.parse(raw) : null };
-    },
-    async delete(stream, group, item) {
-      const hk = hashKey(stream, group);
-      const oldRaw = await redis2.hget(hk, item);
-      const old = oldRaw ? JSON.parse(oldRaw) : null;
-      await redis2.hdel(hk, item);
-      const remaining = await redis2.hlen(hk);
-      if (remaining === 0) await redis2.del(hk);
-      await redis2.publish(`iii:stream:${stream}`, JSON.stringify({ event: "delete", group, item }));
-      notify(channels, stream, group, item, "delete", null);
-      return { old_value: old };
-    },
-    async list(stream, group) {
-      const raw = await redis2.hgetall(hashKey(stream, group));
-      const items = Object.entries(raw).map(([item_id, data]) => ({
-        item_id,
-        data: JSON.parse(data)
-      }));
-      return { items };
-    },
-    async list_groups(stream) {
-      const pattern = `iii:stream:${stream}:*`;
-      let cursor = "0";
-      const groups = /* @__PURE__ */ new Set();
-      do {
-        const [next, keys] = await redis2.scan(cursor, "MATCH", pattern, "COUNT", "1000");
-        cursor = next;
-        for (const k of keys) {
-          const parts = k.split(":");
-          const g = parts.slice(3).join(":");
-          if (g) groups.add(g);
-        }
-      } while (cursor !== "0");
-      return { groups: Array.from(groups) };
-    },
-    async list_all() {
-      const pattern = "iii:stream:*";
-      let cursor = "0";
-      const streamMap = /* @__PURE__ */ new Map();
-      do {
-        const [next, keys] = await redis2.scan(cursor, "MATCH", pattern, "COUNT", "1000");
-        cursor = next;
-        for (const k of keys) {
-          const parts = k.split(":");
-          const s = parts[2];
-          const g = parts.slice(3).join(":");
-          if (!streamMap.has(s)) streamMap.set(s, { groups: /* @__PURE__ */ new Set(), items: 0 });
-          const entry = streamMap.get(s);
-          if (g) entry.groups.add(g);
-          entry.items++;
-        }
-      } while (cursor !== "0");
-      const streams = Array.from(streamMap.entries()).map(([name, info]) => ({
-        stream_name: name,
-        group_count: info.groups.size,
-        item_count: info.items
-      }));
-      return { streams, count: streams.length };
-    },
-    async send(stream, group, type, data, id2) {
-      notify(channels, stream, group, id2 ?? "", "send", { type, data });
-    },
-    async update(stream, group, item, ops) {
-      const hk = hashKey(stream, group);
-      const oldRaw = await redis2.hget(hk, item);
-      const old = oldRaw ? JSON.parse(oldRaw) : null;
-      const newVal = applyOps(old, ops);
-      await redis2.hset(hk, item, JSON.stringify(newVal));
-      setTTL(hk);
-      await redis2.publish(
-        `iii:stream:${stream}`,
-        JSON.stringify({ event: "update", group, item, data: newVal })
-      );
-      notify(channels, stream, group, item, "update", newVal);
-      return { old_value: old, new_value: deepClone(newVal) };
-    }
-  };
-}
-function createStream(opts) {
-  const channels = /* @__PURE__ */ new Map();
-  const store2 = opts?.pg ? createPgStore(channels, opts.pg) : opts?.redis ? createRedisStore(channels, opts.redis, opts.streamTTL ?? 3600) : createMemoryStore(channels);
-  let redisSub = null;
-  if (opts?.redis) {
-    redisSub = opts.redis.duplicate();
-    redisSub.on("message", (rawChannel, rawData) => {
-      if (!rawChannel.startsWith("iii:stream:")) return;
-      const stream = rawChannel.slice("iii:stream:".length);
-      try {
-        const msg = JSON.parse(rawData);
-        if (msg.event === "set" || msg.event === "update") {
-          notify(channels, stream, msg.group, msg.item, msg.event, msg.data);
-        } else if (msg.event === "delete") {
-          notify(channels, stream, msg.group, msg.item, "delete", null);
-        }
-      } catch {
-      }
-    });
-  }
-  return {
-    ...store2,
-    subscribe(ws, sub) {
-      const key = sub.item_id ? `${sub.stream_name}:${sub.group_id}:${sub.item_id}` : sub.group_id ? `${sub.stream_name}:${sub.group_id}` : sub.stream_name;
-      if (!channels.has(key)) channels.set(key, /* @__PURE__ */ new Set());
-      channels.get(key).add(ws);
-      if (redisSub && sub.stream_name) {
-        redisSub.subscribe(`iii:stream:${sub.stream_name}`);
-      }
-    },
-    unsubscribe(ws) {
-      for (const [, subs] of channels) subs.delete(ws);
-    },
-    async migrate() {
-      if (opts?.pg) {
-        const sql2 = opts.pg.sql;
-        await sql2`
-          CREATE TABLE IF NOT EXISTS "_iii_stream" (
-            stream_name TEXT NOT NULL,
-            group_id TEXT NOT NULL,
-            item_id TEXT NOT NULL,
-            data JSONB,
-            updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
-            PRIMARY KEY (stream_name, group_id, item_id)
-          )
-        `;
-        await sql2`CREATE INDEX IF NOT EXISTS idx_iii_stream_group ON "_iii_stream" (stream_name, group_id)`;
-      }
-    },
-    async close() {
-      if (redisSub) await redisSub.quit();
-    }
-  };
-}
-
 // iii/ws.ts
 function createWsHandler(deps) {
   const wsToWorkerId = /* @__PURE__ */ new Map();
@@ -10424,9 +10439,9 @@ function createWsHandler(deps) {
           const workerId = getWorkerId(ws);
           if (workerId) {
             deps.registerRemoteTrigger(workerId, {
-              type: msg.trigger_type || msg.type,
-              function_id: msg.function_id,
-              config: msg.config || {}
+              type: msg.input?.type || "custom",
+              function_id: msg.input?.function_id || msg.id,
+              config: msg.input?.config || {}
             });
           }
           break;
@@ -10438,11 +10453,7 @@ function createWsHandler(deps) {
         }
         case "unregister_trigger": {
           const workerId = getWorkerId(ws);
-          if (workerId) deps.unregisterRemoteTrigger(workerId, msg.function_id);
-          break;
-        }
-        case "invoke": {
-          deps.handleInvoke(ws, msg.invocation_id, msg.function_id, msg.payload);
+          if (workerId) deps.unregisterRemoteTrigger(workerId, msg.function_id || msg.id);
           break;
         }
         case "invoke_result": {
@@ -10453,31 +10464,20 @@ function createWsHandler(deps) {
           deps.handleInvokeError(msg.invocation_id, msg.error);
           break;
         }
-        case "subscribe": {
-          deps.addStreamSubscriber(ws, {
-            stream_name: msg.stream_name || msg.channel || "",
-            group_id: msg.group_id,
-            item_id: msg.item_id
-          });
-          break;
-        }
-        case "unsubscribe": {
-          deps.removeStreamSubscriber(ws);
+        case "invoke": {
+          deps.handleInvoke(ws, msg.invocation_id, msg.function_id, msg.payload);
           break;
         }
+        default:
+          ws.send(JSON.stringify({ type: "error", message: `Unknown message type: ${msg.type}` }));
       }
     },
     close(ws) {
       const workerId = getWorkerId(ws);
-      if (workerId) deps.unregisterRemoteWorker(workerId);
-      wsToWorkerId.delete(ws);
-      deps.removeStreamSubscriber(ws);
-    },
-    error(ws) {
-      const workerId = getWorkerId(ws);
-      if (workerId) deps.unregisterRemoteWorker(workerId);
-      wsToWorkerId.delete(ws);
-      deps.removeStreamSubscriber(ws);
+      if (workerId) {
+        deps.unregisterRemoteWorker(workerId);
+        wsToWorkerId.delete(ws);
+      }
     }
   };
 }
@@ -10522,38 +10522,11 @@ function buildRouter5(engine, wsHandler) {
 }
 
 // iii/client.ts
-function iii(opts = {}) {
-  const stream = createStream({ pg: opts.pg, redis: opts.redis, streamTTL: opts.streamTTL });
+function iii(_opts = {}) {
   const workers = /* @__PURE__ */ new Map();
   const functions = /* @__PURE__ */ new Map();
   const triggers = /* @__PURE__ */ new Map();
   const pending = /* @__PURE__ */ new Map();
-  function registerBuiltin(id2, handler) {
-    functions.set(id2, {
-      id: id2,
-      handler,
-      workerId: "__iii__",
-      workerName: "__iii__",
-      triggers: []
-    });
-  }
-  registerBuiltin(
-    "stream::set",
-    (p) => stream.set(p.stream_name, p.group_id, p.item_id, p.data)
-  );
-  registerBuiltin("stream::get", (p) => stream.get(p.stream_name, p.group_id, p.item_id));
-  registerBuiltin("stream::delete", (p) => stream.delete(p.stream_name, p.group_id, p.item_id));
-  registerBuiltin("stream::list", (p) => stream.list(p.stream_name, p.group_id));
-  registerBuiltin("stream::list_groups", (p) => stream.list_groups(p.stream_name));
-  registerBuiltin("stream::list_all", () => stream.list_all());
-  registerBuiltin(
-    "stream::send",
-    (p) => stream.send(p.stream_name, p.group_id, p.type, p.data, p.id)
-  );
-  registerBuiltin(
-    "stream::update",
-    (p) => stream.update(p.stream_name, p.group_id, p.item_id, p.ops)
-  );
   function addLocalWorker(worker) {
     const workerId = crypto8.randomUUID();
     const reg = {
@@ -10672,12 +10645,6 @@ function iii(opts = {}) {
         worker.triggers = worker.triggers.filter((t) => t.function_id !== functionId);
       }
     },
-    addStreamSubscriber(ws, sub) {
-      stream.subscribe(ws, sub);
-    },
-    removeStreamSubscriber(ws) {
-      stream.unsubscribe(ws);
-    },
     handleInvokeResult(invocationId, result) {
       const p = pending.get(invocationId);
       if (p) {
@@ -10730,7 +10697,7 @@ function iii(opts = {}) {
   }
   function trigger(request) {
     const fn = functions.get(request.function_id);
-    if (!fn) throw new Error(`Function "${request.function_id}" not found`);
+    if (!fn) return Promise.reject(new Error(`Function "${request.function_id}" not found`));
     const ctx = { engine: engineRef, functionId: request.function_id, workerName: fn.workerName };
     if (request.action === "void") {
       queueMicrotask(() => fn.handler(request.payload, ctx));
@@ -10777,7 +10744,6 @@ function iii(opts = {}) {
   mod.listFunctions = listFunctions;
   mod.listTriggers = listTriggers;
   mod.migrate = async () => {
-    await stream.migrate();
   };
   mod.close = async () => {
     for (const [, p] of pending) {
@@ -10789,7 +10755,6 @@ function iii(opts = {}) {
     workers.clear();
     functions.clear();
     triggers.clear();
-    await stream.close();
   };
   return mod;
 }
@@ -10926,11 +10891,6 @@ function registerWorker(url) {
           }
           break;
         }
-        case "stream": {
-          const handler = handlers.get("__stream__");
-          if (handler) handler(msg, {});
-          break;
-        }
       }
     };
     ws.onclose = () => {
@@ -11003,9 +10963,6 @@ function registerWorker(url) {
         });
       });
     },
-    onStream(handler) {
-      handlers.set("__stream__", handler);
-    },
     close() {
       intentionalClose = true;
       if (reconnectTimer) clearTimeout(reconnectTimer);
@@ -11257,6 +11214,7 @@ function session(options) {
     }
     return res;
   });
+  mw.__meta = { injects: ["session"], depends: [] };
   mw.close = async () => {
     await closeStore?.();
   };
@@ -12186,6 +12144,475 @@ function permissions(options) {
   mw.migrate = migrate;
   return mw;
 }
+
+// mcp.ts
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { z as z14 } from "zod";
+var _requestId = 0;
+function nextId() {
+  return ++_requestId;
+}
+function createRequest2(id2, method, params) {
+  return JSON.stringify({
+    jsonrpc: "2.0",
+    id: id2,
+    method,
+    params
+  });
+}
+function mcpClient(options) {
+  const { command, args = [], env: env2 } = options;
+  const timeout = options.timeout ?? 15e3;
+  const maxResponseSize = options.maxResponseSize ?? 10 * 1024 * 1024;
+  let proc = null;
+  let rl = null;
+  const pending = /* @__PURE__ */ new Map();
+  let _tools = null;
+  function ensureProcess() {
+    if (proc && !proc.killed) return;
+    proc = spawn(command, args, {
+      stdio: ["pipe", "pipe", "pipe"],
+      env: { ...process.env, ...env2 }
+    });
+    rl = createInterface({ input: proc.stdout, crlfDelay: Infinity });
+    let buffer = "";
+    rl.on("line", (line) => {
+      buffer += line;
+      try {
+        const msg = JSON.parse(buffer);
+        buffer = "";
+        handleMessage(msg);
+      } catch {
+      }
+    });
+    proc.stderr?.on("data", (chunk) => {
+      const text2 = chunk.toString().trim();
+      if (text2) {
+        console.debug(`[mcp:${command}] stderr:`, text2);
+      }
+    });
+    proc.on("exit", (code, signal) => {
+      console.debug(`[mcp:${command}] exited (code=${code} signal=${signal})`);
+      for (const [id2, { reject, timer }] of pending) {
+        clearTimeout(timer);
+        reject(new Error(`MCP server exited (code=${code} signal=${signal})`));
+        pending.delete(id2);
+      }
+      proc = null;
+      rl = null;
+    });
+    proc.on("error", (err) => {
+      console.error(`[mcp:${command}] error:`, err.message);
+      for (const [, { reject, timer }] of pending) {
+        clearTimeout(timer);
+        reject(err);
+      }
+      pending.clear();
+    });
+  }
+  function handleMessage(msg) {
+    if (msg.id !== void 0 && pending.has(msg.id)) {
+      const { resolve: resolve16, reject, timer } = pending.get(msg.id);
+      clearTimeout(timer);
+      pending.delete(msg.id);
+      if (msg.error) {
+        reject(new Error(`MCP error: ${JSON.stringify(msg.error)}`));
+      } else {
+        resolve16(msg.result);
+      }
+    }
+  }
+  function sendRequest(method, params) {
+    ensureProcess();
+    const id2 = nextId();
+    const body = createRequest2(id2, method, params);
+    return new Promise((resolve16, reject) => {
+      const timer = setTimeout(() => {
+        pending.delete(id2);
+        reject(new Error(`MCP request "${method}" timed out after ${timeout}ms`));
+      }, timeout);
+      pending.set(id2, { resolve: resolve16, reject, timer });
+      if (proc?.stdin?.writable) {
+        proc.stdin.write(body + "\n");
+      } else {
+        clearTimeout(timer);
+        pending.delete(id2);
+        reject(new Error("MCP server stdin not available"));
+      }
+    });
+  }
+  async function initialize() {
+    ensureProcess();
+    await sendRequest("initialize", {
+      protocolVersion: "0.1.0",
+      capabilities: {},
+      clientInfo: { name: "weifuwu", version: "0.25.0" }
+    });
+    try {
+      if (proc?.stdin?.writable) {
+        proc.stdin.write(
+          JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }) + "\n"
+        );
+      }
+    } catch {
+    }
+  }
+  function mcpSchemaToZod(inputSchema) {
+    if (!inputSchema || !inputSchema.properties) {
+      return z14.object({});
+    }
+    const shape = {};
+    const required = new Set(inputSchema.required ?? []);
+    for (const [key, prop] of Object.entries(inputSchema.properties)) {
+      const p = prop;
+      let field;
+      switch (p.type) {
+        case "string":
+          field = z14.string();
+          break;
+        case "number":
+          field = z14.number();
+          break;
+        case "integer":
+          field = z14.number().int();
+          break;
+        case "boolean":
+          field = z14.boolean();
+          break;
+        case "array":
+          field = z14.array(z14.any());
+          break;
+        case "object":
+          field = z14.record(z14.string(), z14.any());
+          break;
+        default:
+          field = z14.any();
+      }
+      if (p.description) {
+        field = field.describe(p.description);
+      }
+      if (!required.has(key)) {
+        field = field.optional();
+      }
+      shape[key] = field;
+    }
+    return z14.object(shape);
+  }
+  async function refresh() {
+    _tools = null;
+    await getTools();
+  }
+  async function getTools() {
+    if (_tools) return _tools;
+    await initialize();
+    const result = await sendRequest("tools/list");
+    const defs = result?.tools ?? [];
+    const tools = {};
+    for (const def of defs) {
+      const paramsSchema = mcpSchemaToZod(def.inputSchema);
+      tools[def.name] = {
+        description: def.description ?? "MCP tool: " + def.name,
+        parameters: paramsSchema,
+        execute: async (args2) => {
+          const raw = await callToolInternal(def.name, args2);
+          return raw;
+        }
+      };
+    }
+    _tools = tools;
+    return tools;
+  }
+  async function callToolInternal(name, args2) {
+    const result = await sendRequest("tools/call", {
+      name,
+      arguments: args2
+    });
+    const content = result?.content;
+    if (Array.isArray(content)) {
+      const textParts = content.filter((c) => c.type === "text").map((c) => c.text ?? "");
+      if (textParts.length > 0) {
+        let combined = textParts.join("\n");
+        if (combined.length > maxResponseSize) {
+          combined = combined.slice(0, maxResponseSize) + "\n... [truncated]";
+        }
+        return combined;
+      }
+      const resourceParts = content.filter((c) => c.type === "resource");
+      if (resourceParts.length > 0) {
+        return resourceParts;
+      }
+      return content;
+    }
+    return result;
+  }
+  async function callTool(name, args2) {
+    return callToolInternal(name, args2);
+  }
+  async function close() {
+    try {
+      await sendRequest("shutdown");
+    } catch {
+    }
+    if (proc && !proc.killed) {
+      proc.kill("SIGTERM");
+      setTimeout(() => {
+        if (proc && !proc.killed) {
+          try {
+            proc.kill("SIGKILL");
+          } catch {
+          }
+        }
+      }, 3e3);
+    }
+    for (const [, { reject, timer }] of pending) {
+      clearTimeout(timer);
+      reject(new Error("MCP client closed"));
+    }
+    pending.clear();
+    proc = null;
+    rl = null;
+  }
+  return {
+    getTools,
+    refresh,
+    callTool,
+    close
+  };
+}
+
+// notifier/client.ts
+var DEFAULT_CHANNELS = ["inbox"];
+function notifier(opts) {
+  const { sql: sql2, mailer: mailer2, hub } = opts;
+  const table = opts.table ?? "_notifications";
+  const fromName = opts.fromName ?? "System";
+  const pageSize = opts.pageSize ?? 50;
+  function escapeIdent7(s) {
+    return `"${s.replace(/"/g, '""')}"`;
+  }
+  const tbl = escapeIdent7(table);
+  async function migrate() {
+    await sql2.unsafe(`
+      CREATE TABLE IF NOT EXISTS ${tbl} (
+        id          SERIAL PRIMARY KEY,
+        user_id     INTEGER NOT NULL,
+        title       TEXT NOT NULL,
+        body        TEXT NOT NULL DEFAULT '',
+        action_url  TEXT,
+        action_text TEXT,
+        type        TEXT NOT NULL DEFAULT 'default',
+        metadata    JSONB NOT NULL DEFAULT '{}',
+        read_at     TIMESTAMPTZ,
+        created_at  TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+    await sql2.unsafe(`
+      CREATE INDEX IF NOT EXISTS "${table}_user_unread"
+      ON ${tbl} (user_id, created_at DESC)
+      WHERE read_at IS NULL
+    `);
+    await sql2.unsafe(`
+      CREATE INDEX IF NOT EXISTS "${table}_user_all"
+      ON ${tbl} (user_id, created_at DESC)
+    `);
+    await sql2.unsafe(`
+      CREATE TABLE IF NOT EXISTS "_notify_prefs" (
+        user_id  INTEGER PRIMARY KEY,
+        channels JSONB NOT NULL DEFAULT '["inbox"]'::jsonb
+      )
+    `);
+  }
+  async function insertNotification(userId2, message) {
+    await sql2.unsafe(
+      `INSERT INTO ${tbl} (user_id, title, body, action_url, action_text, type, metadata)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)`,
+      [
+        userId2,
+        message.title,
+        message.body ?? "",
+        message.actionUrl ?? null,
+        message.actionText ?? null,
+        message.type ?? "default",
+        message.metadata ?? {}
+      ]
+    );
+  }
+  async function send(to, message) {
+    const prefs = await getPreferences(to.userId);
+    if (prefs.channels.includes("inbox")) {
+      await insertNotification(to.userId, message);
+    }
+    if (prefs.channels.includes("email") && mailer2 && to.email) {
+      const html = renderEmail(message);
+      mailer2.send({
+        to: to.email,
+        subject: message.title,
+        text: message.body ?? "",
+        html
+      }).catch((err) => console.error("[notifier] email send failed:", err.message));
+    }
+    if (prefs.channels.includes("ws") && hub) {
+      hub.broadcast(`notify:${to.userId}`, {
+        type: "notification",
+        data: {
+          title: message.title,
+          body: message.body,
+          actionUrl: message.actionUrl,
+          actionText: message.actionText,
+          type: message.type ?? "default",
+          metadata: message.metadata,
+          created_at: (/* @__PURE__ */ new Date()).toISOString()
+        }
+      });
+    }
+  }
+  async function broadcast(message) {
+    const rows = await sql2`
+      SELECT user_id FROM "_notify_prefs"
+      WHERE channels @> ${sql2.json(["inbox"])}
+    `;
+    for (const row of rows) {
+      await insertNotification(row.user_id, message);
+      if (hub) {
+        hub.broadcast(`notify:${row.user_id}`, {
+          type: "notification",
+          data: {
+            title: message.title,
+            body: message.body,
+            actionUrl: message.actionUrl,
+            actionText: message.actionText,
+            type: message.type ?? "default",
+            metadata: message.metadata,
+            created_at: (/* @__PURE__ */ new Date()).toISOString()
+          }
+        });
+      }
+    }
+  }
+  async function unreadCount(userId2) {
+    const [row] = await sql2.unsafe(
+      `SELECT COUNT(*)::int AS count FROM ${tbl} WHERE user_id = $1 AND read_at IS NULL`,
+      [userId2]
+    );
+    return row?.count ?? 0;
+  }
+  async function count(userId2, unreadOnly = false) {
+    if (unreadOnly) return unreadCount(userId2);
+    const [row] = await sql2.unsafe(
+      `SELECT COUNT(*)::int AS count FROM ${tbl} WHERE user_id = $1`,
+      [userId2]
+    );
+    return row?.count ?? 0;
+  }
+  async function markRead(userId2, notificationIds) {
+    if (notificationIds && notificationIds.length > 0) {
+      const ids = notificationIds.map((_, i) => `$${i + 2}`).join(", ");
+      await sql2.unsafe(
+        `UPDATE ${tbl} SET read_at = NOW() WHERE user_id = $1 AND id IN (${ids}) AND read_at IS NULL`,
+        [userId2, ...notificationIds]
+      );
+    } else {
+      await sql2.unsafe(`UPDATE ${tbl} SET read_at = NOW() WHERE user_id = $1 AND read_at IS NULL`, [
+        userId2
+      ]);
+    }
+  }
+  async function list(userId2, opts2) {
+    const limit = opts2?.limit ?? pageSize;
+    const offset = opts2?.offset ?? 0;
+    let where = `user_id = $1`;
+    const params = [userId2];
+    const paramIdx = 2;
+    if (opts2?.unreadOnly) {
+      where += ` AND read_at IS NULL`;
+    }
+    const rows = await sql2.unsafe(
+      `SELECT id, user_id, title, body, action_url, action_text, type, metadata, read_at, created_at
+       FROM ${tbl}
+       WHERE ${where}
+       ORDER BY created_at DESC
+       LIMIT $${paramIdx} OFFSET $${paramIdx + 1}`,
+      [...params, limit, offset]
+    );
+    return rows.map(normalizeNotification);
+  }
+  function normalizeNotification(row) {
+    return {
+      ...row,
+      metadata: typeof row.metadata === "string" ? JSON.parse(row.metadata) : row.metadata ?? {}
+    };
+  }
+  async function getPreferences(userId2) {
+    const [row] = await sql2.unsafe(`SELECT channels FROM "_notify_prefs" WHERE user_id = $1`, [
+      userId2
+    ]);
+    if (!row) {
+      return { channels: [...DEFAULT_CHANNELS] };
+    }
+    let channels;
+    if (typeof row.channels === "string") {
+      channels = JSON.parse(row.channels);
+    } else if (Array.isArray(row.channels)) {
+      channels = row.channels;
+    } else {
+      channels = [...DEFAULT_CHANNELS];
+    }
+    return { channels };
+  }
+  async function setPreferences(userId2, prefs) {
+    await sql2`
+      INSERT INTO "_notify_prefs" (user_id, channels)
+      VALUES (${userId2}, ${sql2.json(prefs.channels)})
+      ON CONFLICT (user_id)
+      DO UPDATE SET channels = ${sql2.json(prefs.channels)}
+    `;
+  }
+  async function clean(days) {
+    const result = await sql2.unsafe(`DELETE FROM ${tbl} WHERE created_at < NOW() - $1::interval`, [
+      `${days} days`
+    ]);
+    return Array.isArray(result) ? result.length : 0;
+  }
+  function renderEmail(message) {
+    const actionHtml = message.actionUrl ? `
+<p><a href="${escapeHtml3(message.actionUrl)}" style="display:inline-block;padding:10px 20px;background:#0066cc;color:#fff;text-decoration:none;border-radius:4px">${escapeHtml3(message.actionText ?? "View")}</a></p>` : "";
+    return `<!DOCTYPE html>
+<html>
+<head><meta charset="utf-8"></head>
+<body style="font-family:sans-serif;padding:20px;max-width:600px">
+  <h2>${escapeHtml3(message.title)}</h2>
+  ${message.body ? `<p>${escapeHtml3(message.body)}</p>` : ""}
+  ${actionHtml}
+  <hr style="margin-top:30px;border:none;border-top:1px solid #eee">
+  <p style="color:#999;font-size:12px">${escapeHtml3(fromName)}</p>
+</body>
+</html>`;
+  }
+  function escapeHtml3(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+  }
+  const mw = async (req, ctx, next) => {
+    ;
+    ctx.notifier = api;
+    return next(req, ctx);
+  };
+  const api = {
+    send,
+    broadcast,
+    unreadCount,
+    count,
+    markRead,
+    list,
+    getPreferences,
+    setPreferences,
+    clean,
+    migrate,
+    close: async () => {
+    }
+  };
+  return Object.assign(mw, api);
+}
 export {
   DEFAULT_MAX_BODY,
   MIGRATIONS_TABLE,
@@ -12240,7 +12667,9 @@ export {
   logdb,
   logger,
   mailer,
+  mcpClient,
   messager,
+  notifier,
   openai,
   opencode,
   permissions,