weifuwu 0.25.0 → 0.25.2

package/cli/template/index.ts

@@ -5,6 +5,6 @@ loadEnv()
 const port = Number(process.env.PORT) || 3000
 const srv = serve(app.handler(), { port, websocket: app.websocketHandler(), shutdown: false })
 process.on('SIGINT', () => {
-  srv.stop()
+  srv.close()
   process.exit(0)
 })

package/dist/agent/run.d.ts

@@ -5,9 +5,9 @@ import type { AIProvider } from '../ai/provider.ts';
 import type { RunParams, RunResult, KnowledgeDoc } from './types.ts';
 interface RunnerDeps {
     sql: SqlClient;
-    agents: BoundTable<any>;
-    runs: BoundTable<any>;
-    knowledge: BoundTable<any>;
+    agents: BoundTable<Record<string, unknown>>;
+    runs: BoundTable<Record<string, unknown>>;
+    knowledge: BoundTable<Record<string, unknown>>;
     provider: AIProvider;
     modelName?: string;
     userTools?: Record<string, Tool>;

package/dist/analytics.d.ts

@@ -1,13 +1,22 @@
 import type { Middleware, Closeable } from './types.ts';
 import { Router } from './router.ts';
+/** Tagged-template SQL function from the postgres.js library. */
+type PgSql = (strings: TemplateStringsArray, ...values: unknown[]) => Promise<unknown[]>;
+/** Schema table builder callback. */
+type PgTable = (name: string, cols: Record<string, unknown>) => {
+    create(): Promise<void>;
+    createIndex(cols: string[], opts: {
+        unique: boolean;
+    }): Promise<void>;
+};
 /** Options for {@link analytics}. */
 export interface AnalyticsOptions {
     /** Path prefixes to exclude from analytics (default: `['/__analytics', '/__wfw', '/static']`). */
     excluded?: string[];
     /** PostgreSQL client for persistent storage. Required for production use. */
     pg?: {
-        sql: (strings: TemplateStringsArray, ...values: any[]) => Promise<any[]>;
-        table: (name: string, cols: any) => any;
+        sql: PgSql;
+        table: PgTable;
     };
 }
 /** Analytics module returned by {@link analytics}. */
@@ -33,3 +42,4 @@ export interface AnalyticsModule extends Router, Closeable {
  * ```
  */
 export declare function analytics(options?: AnalyticsOptions): AnalyticsModule;
+export {};

package/dist/compile.d.ts

@@ -13,5 +13,3 @@ export declare function compile(path: string): Promise<any>;
 export declare let vendorHash: string;
 /** Build a single vendor bundle containing all needed vendor modules */
 export declare function compileVendorBundle(): Promise<string>;
-/** Clean up esbuild's internal worker pool. Call when you're done compiling. */
-export declare function closeCompile(): Promise<void>;

package/dist/csrf.d.ts

@@ -8,6 +8,8 @@ export interface CsrfInjected {
     token: string;
 }
 /** Options for {@link csrf}. */
+/** CSRF protection module — a {@link Middleware} that injects `ctx.csrf`. */
+export type CsrfModule = Middleware<Context, Context & CsrfInjected>;
 export interface CsrfOptions {
     /** Cookie name for CSRF token (default: `'_csrf'`). */
     cookie?: string;

package/dist/flash.d.ts

@@ -29,6 +29,8 @@ declare module './types.ts' {
         flash: FlashInjected;
     }
 }
+/** Flash message module — a {@link Middleware} that injects `ctx.flash`. */
+export type FlashModule = Middleware<Context, Context & FlashInjected>;
 /** Options for {@link flash}. */
 export interface FlashOptions {
     /**

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export type { Context, Handler, Middleware, ErrorHandler } from './types.ts';
+export { HttpError } from './types.ts';
 export { currentTraceId, currentTrace, runWithTrace, traceElapsed, trace } from './trace.ts';
 export type { TraceContext, TraceInjected, TraceOptions } from './trace.ts';
 export { loadEnv, isDev, isProd, isBundled, getPublicEnv, env } from './env.ts';
@@ -14,11 +15,11 @@ export type { CORSOptions } from './cors.ts';
 export { serveStatic } from './static.ts';
 export type { ServeStaticOptions } from './static.ts';
 export { validate } from './validate.ts';
-export type { ValidationSchemas } from './validate.ts';
+export type { ValidationSchemas, ValidateModule } from './validate.ts';
 export { getCookies, setCookie, deleteCookie } from './cookie.ts';
 export type { CookieOptions } from './cookie.ts';
 export { upload } from './upload.ts';
-export type { UploadOptions, UploadedFile } from './upload.ts';
+export type { UploadOptions, UploadedFile, UploadModule } from './upload.ts';
 export { rateLimit } from './rate-limit.ts';
 export type { RateLimitOptions } from './rate-limit.ts';
 export { compress } from './compress.ts';
@@ -26,7 +27,7 @@ export type { CompressOptions } from './compress.ts';
 export { helmet } from './helmet.ts';
 export type { HelmetOptions } from './helmet.ts';
 export { requestId } from './request-id.ts';
-export type { RequestIdOptions } from './request-id.ts';
+export type { RequestIdOptions, RequestIdModule } from './request-id.ts';
 export { createSSEStream, formatSSE, formatSSEData } from './sse.ts';
 export type { SSEEvent } from './sse.ts';
 export { testApp, TestApp, TestRequest, createTestDb, withTestDb } from './test-utils.ts';
@@ -69,13 +70,13 @@ export type { ThemeOptions, ThemeInjected } from './theme.ts';
 export { i18n } from './i18n.ts';
 export type { I18nOptions, I18nInjected } from './i18n.ts';
 export { flash } from './flash.ts';
-export type { FlashOptions, FlashInjected } from './flash.ts';
+export type { FlashOptions, FlashInjected, FlashModule } from './flash.ts';
 export { seo, seoMiddleware, seoTags } from './seo.ts';
 export type { SeoOptions, RobotsRule, SitemapUrl, SitemapConfig, SeoHeadersConfig, SeoTagsConfig, } from './seo.ts';
 export { mailer } from './mailer.ts';
 export type { MailerOptions, MailOptions, Mailer } from './mailer.ts';
 export { csrf } from './csrf.ts';
-export type { CsrfOptions, CsrfInjected } from './csrf.ts';
+export type { CsrfOptions, CsrfInjected, CsrfModule } from './csrf.ts';
 export { logdb } from './logdb/index.ts';
 export type { LogdbOptions, LogdbModule, LogEntry, LogEntryInput } from './logdb/types.ts';
 export { iii, createWorker, registerWorker } from './iii/index.ts';

package/dist/index.js

@@ -4,6 +4,16 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// types.ts
+var HttpError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+  }
+};
+
 // trace.ts
 import crypto2 from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -110,14 +120,6 @@ function env() {
 
 // serve.ts
 import http from "node:http";
-var HttpError = class extends Error {
-  status;
-  constructor(message, status) {
-    super(message);
-    this.status = status;
-    this.name = "HttpError";
-  }
-};
 var DEFAULT_MAX_BODY = 10 * 1024 * 1024;
 async function readBody(req, maxSize) {
   const limit = maxSize ?? DEFAULT_MAX_BODY;
@@ -254,6 +256,7 @@ function serve(handler, options) {
       resolveReady();
       return {
         stop: () => Promise.resolve(),
+        close: () => Promise.resolve(),
         ready,
         get port() {
           return 0;
@@ -287,30 +290,29 @@ function serve(handler, options) {
     const displayHost = _cachedHostname === "0.0.0.0" ? "localhost" : _cachedHostname || "localhost";
     console.log(`weifuwu listening on http://${displayHost}:${_cachedPort}`);
   });
-  return {
-    stop: (timeoutMs = 1e4) => {
-      if (shutdownHandler) {
-        process.off("SIGTERM", shutdownHandler);
-        process.off("SIGINT", shutdownHandler);
-        shutdownHandler = null;
-      }
-      return new Promise((resolve16) => {
-        if (!server.listening) {
-          resolve16();
-          return;
-        }
-        server.close();
-        server.closeIdleConnections();
-        const timer = setTimeout(() => {
-          server.closeAllConnections();
-          resolve16();
-        }, timeoutMs);
-        server.on("close", () => {
-          clearTimeout(timer);
-          resolve16();
-        });
+  async function stop(timeoutMs = 1e4) {
+    if (shutdownHandler) {
+      process.off("SIGTERM", shutdownHandler);
+      process.off("SIGINT", shutdownHandler);
+      shutdownHandler = null;
+    }
+    if (!server.listening) return;
+    server.close();
+    server.closeIdleConnections();
+    return new Promise((resolve16) => {
+      const timer = setTimeout(() => {
+        server.closeAllConnections();
+        resolve16();
+      }, timeoutMs);
+      server.on("close", () => {
+        clearTimeout(timer);
+        resolve16();
       });
-    },
+    });
+  }
+  return {
+    close: stop,
+    stop,
     ready,
     get port() {
       if (!server.listening) return 0;
@@ -517,7 +519,7 @@ var Router = class _Router {
    * ```
    */
   _checkMiddlewareMeta(mw, location) {
-    const meta = mw.__meta ?? mw.middleware?.().__meta;
+    const meta = mw.__meta ?? (typeof mw === "object" && mw && "middleware" in mw ? mw.middleware().__meta : void 0);
     if (!meta) return;
     for (const dep of meta.depends) {
       if (!this._ctxFields.has(dep)) {
@@ -1271,7 +1273,7 @@ function parseBody(text2, ct) {
   return text2;
 }
 function validate(schemas) {
-  return async (req, ctx, next) => {
+  const mw = async (req, ctx, next) => {
     const parsed = {};
     const issues = [];
     if (schemas?.params) {
@@ -1358,6 +1360,8 @@ function validate(schemas) {
     ctx.parsed = { ...ctx.parsed, ...parsed };
     return next(req, ctx);
   };
+  mw.__meta = { injects: ["parsed"], depends: [] };
+  return mw;
 }
 
 // cookie.ts
@@ -1461,7 +1465,7 @@ function detectMimeFromExtension(filename) {
 }
 function upload(options) {
   const saveDir = options?.dir;
-  return async (req, ctx, next) => {
+  const mw = async (req, ctx, next) => {
     const ct = req.headers.get("content-type") ?? "";
     if (!ct.includes("multipart/form-data")) return next(req, ctx);
     try {
@@ -1517,6 +1521,8 @@ function upload(options) {
     ctx.parsed = { ...ctx.parsed, files, fields };
     return next(req, ctx);
   };
+  mw.__meta = { injects: ["parsed"], depends: [] };
+  return mw;
 }
 
 // rate-limit.ts
@@ -1601,7 +1607,7 @@ function rateLimit(options) {
     return addRateLimitHeaders(res, max, remaining, reset);
   };
   mw.__meta = { injects: [], depends: [] };
-  mw.close = () => {
+  mw.close = async () => {
     if (interval) clearInterval(interval);
     hits.clear();
   };
@@ -1728,7 +1734,7 @@ import crypto3 from "node:crypto";
 function requestId(options) {
   const header = options?.header ?? "X-Request-ID";
   const gen = options?.generator ?? (() => crypto3.randomUUID());
-  return async (req, ctx, next) => {
+  const mw = async (req, ctx, next) => {
     const existing = req.headers.get(header);
     const id2 = existing ?? gen();
     ctx.requestId = id2;
@@ -1738,6 +1744,8 @@ function requestId(options) {
     h.set(header, id2);
     return new Response(res.body, { status: res.status, statusText: res.statusText, headers: h });
   };
+  mw.__meta = { injects: ["requestId"], depends: [] };
+  return mw;
 }
 
 // sse.ts
@@ -1763,7 +1771,7 @@ function createSSEStream(iterable, opts) {
             controller.enqueue(encoder.encode(text2));
           }
         } catch (e) {
-          if (e.name !== "AbortError") {
+          if (e instanceof Error && e.name !== "AbortError") {
             controller.enqueue(encoder.encode(formatSSE("error", { error: e.message })));
           }
         } finally {
@@ -1833,6 +1841,7 @@ var TestRequest = class {
   }
   /** Shortcut: set ctx.user */
   withUser(user2) {
+    ;
     this.ctxMixin.user = user2;
     return this;
   }
@@ -1999,7 +2008,7 @@ var TestApp = class {
     }
     this.wsConnections = [];
     if (this.wsServer) {
-      this.wsServer.stop();
+      this.wsServer.close();
       this.wsServer = null;
     }
   }
@@ -2413,7 +2422,16 @@ async function getStreamObject() {
 async function aiStream(handler, provider) {
   const r = new Router();
   r.post("/", async (req, ctx) => {
-    const options = await handler(req, ctx);
+    let options;
+    try {
+      options = await handler(req, ctx);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      return new Response(JSON.stringify({ error: message }), {
+        status: 500,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
     if (provider && !options.model) {
       options.model = provider.model();
     }
@@ -3819,7 +3837,8 @@ function registerOAuthLoginRoutes(router, deps, providers) {
     if (email) {
       const existingUser = await deps.findUserByEmail(email);
       if (existingUser) {
-        await linkProvider(existingUser.id, provider, providerId, email, name, avatarUrl);
+        const uid = existingUser.id;
+        await linkProvider(uid, provider, providerId, email, name, avatarUrl);
         return existingUser;
       }
     }
@@ -3827,7 +3846,8 @@ function registerOAuthLoginRoutes(router, deps, providers) {
       email || `${provider}_${providerId}@oauth.local`,
       name || provider
     );
-    await linkProvider(newUser.id, provider, providerId, email, name, avatarUrl);
+    const userId2 = newUser.id;
+    await linkProvider(userId2, provider, providerId, email, name, avatarUrl);
     return newUser;
   }
   function getProviderMeta(providerName) {
@@ -3857,8 +3877,9 @@ function registerOAuthLoginRoutes(router, deps, providers) {
     const state = crypto5.randomUUID();
     const redirectUri = new URL(req.url);
     redirectUri.pathname = redirectUri.pathname.replace(/\/[^/]+$/, "/") + providerName + "/callback";
-    if (ctx.session) {
-      ctx.session.oauthState = { state, provider: providerName };
+    const sess = ctx.session;
+    if (sess) {
+      sess.oauthState = { state, provider: providerName };
     }
     const scope = config.scope ?? meta.scope;
     const params = new URLSearchParams({
@@ -3885,11 +3906,12 @@ function registerOAuthLoginRoutes(router, deps, providers) {
     if (!code || !state) {
       return Response.json({ error: "Missing code or state parameter" }, { status: 400 });
     }
-    const savedState = ctx.session?.oauthState;
+    const sess = ctx.session;
+    const savedState = sess?.oauthState;
     if (!savedState || savedState.state !== state || savedState.provider !== providerName) {
       return Response.json({ error: "Invalid state \u2014 possible CSRF attack" }, { status: 403 });
     }
-    if (ctx.session) delete ctx.session.oauthState;
+    if (sess) delete sess.oauthState;
     const redirectUri = url.origin + url.pathname.replace(/\/callback$/, "");
     let tokenRes;
     try {
@@ -3947,9 +3969,10 @@ function registerOAuthLoginRoutes(router, deps, providers) {
       return Response.json({ error: "Failed to create/link user" }, { status: 500 });
     }
     const token = signToken(user2);
-    if (ctx.session) {
-      ctx.session.userId = user2.id;
-      ctx.session.role = user2.role;
+    const sess2 = ctx.session;
+    if (sess2) {
+      sess2.userId = user2.id;
+      sess2.role = user2.role;
     }
     const accept = req.headers.get("accept") ?? "";
     if (accept.includes("application/json")) {
@@ -4147,9 +4170,7 @@ function user(options) {
     const { email, password, name } = RegisterSchema.parse(data);
     const existing = await findByEmail(email);
     if (existing) {
-      const err = new Error("Email already registered");
-      err.status = 409;
-      throw err;
+      throw new HttpError("Email already registered", 409);
     }
     const hashed = hashPassword(password);
     const row = await _users.insert({ email, password: hashed, name });
@@ -4162,14 +4183,10 @@ function user(options) {
     const { data: rows } = await _users.readMany({ email });
     const row = rows[0];
     if (!row) {
-      const err = new Error("Invalid email or password");
-      err.status = 401;
-      throw err;
+      throw new HttpError("Invalid email or password", 401);
     }
     if (!verifyPassword(password, row.password)) {
-      const err = new Error("Invalid email or password");
-      err.status = 401;
-      throw err;
+      throw new HttpError("Invalid email or password", 401);
     }
     const userData = row;
     const token = signToken(userData);
@@ -4359,7 +4376,7 @@ function user(options) {
     return null;
   }
   function middleware() {
-    return async (req, ctx, next) => {
+    const mw = async (req, ctx, next) => {
       const userData = await resolveUser(req, ctx);
       if (userData) {
         ctx.user = userData;
@@ -4370,9 +4387,11 @@ function user(options) {
         headers: headerName.toLowerCase() === "authorization" ? { "WWW-Authenticate": "Bearer" } : void 0
       });
     };
+    mw.__meta = { injects: ["user"], depends: [] };
+    return mw;
   }
   function middlewareOptional(_opts) {
-    return async (req, ctx, next) => {
+    const mw = async (req, ctx, next) => {
       const userData = await resolveUser(req, ctx);
       if (userData) {
         ;
@@ -4380,6 +4399,8 @@ function user(options) {
       }
       return next(req, ctx);
     };
+    mw.__meta = { injects: ["user"], depends: [] };
+    return mw;
   }
   async function parseBody2(req) {
     const ct = req.headers.get("content-type") || "";
@@ -4404,8 +4425,9 @@ function user(options) {
         if (err instanceof z2.ZodError) {
           return Response.json({ error: "Validation failed", issues: err.issues }, { status: 400 });
         }
-        const status = err.status ?? 500;
-        return Response.json({ error: err.message }, { status });
+        const status = err instanceof HttpError ? err.status : 500;
+        const message = err instanceof Error ? err.message : String(err);
+        return Response.json({ error: message }, { status });
       }
     });
     r.post("/login", async (req, ctx) => {
@@ -4426,8 +4448,9 @@ function user(options) {
         if (err instanceof z2.ZodError) {
           return Response.json({ error: "Validation failed", issues: err.issues }, { status: 400 });
         }
-        const status = err.status ?? 500;
-        return Response.json({ error: err.message }, { status });
+        const status = err instanceof HttpError ? err.status : 500;
+        const message = err instanceof Error ? err.message : String(err);
+        return Response.json({ error: message }, { status });
       }
     });
   }
@@ -4446,7 +4469,8 @@ function user(options) {
         if (err instanceof z2.ZodError) {
           return Response.json({ error: "Validation failed", issues: err.issues }, { status: 400 });
         }
-        return Response.json({ error: err.message }, { status: 500 });
+        const message = err instanceof Error ? err.message : String(err);
+        return Response.json({ error: message }, { status: 500 });
       }
     });
     r.delete("/api-keys/:id", middleware(), async (req, ctx) => {
@@ -4522,7 +4546,7 @@ function user(options) {
   return mod;
 }
 
-// redis/index.ts
+// redis/client.ts
 import { Redis as IORedis } from "ioredis";
 function redis(opts) {
   const options = typeof opts === "string" ? { url: opts } : opts ?? {};
@@ -4718,15 +4742,12 @@ function createMemoryQueue(opts) {
     running = true;
     poll();
   };
-  mw.stop = function stop2() {
+  mw.close = async function close() {
     running = false;
     if (pollTimer) {
       clearTimeout(pollTimer);
       pollTimer = null;
     }
-  };
-  mw.close = async function close() {
-    mw.stop();
     while (inflight > 0) await new Promise((r) => setTimeout(r, 50));
   };
   mw.jobs = async function(limit) {
@@ -4891,15 +4912,12 @@ function createPgQueue(opts) {
     running = true;
     poll();
   };
-  mw.stop = function stop2() {
+  mw.close = async function close() {
     running = false;
     if (pollTimer) {
       clearTimeout(pollTimer);
       pollTimer = null;
     }
-  };
-  mw.close = async function close() {
-    mw.stop();
     while (inflight > 0) await new Promise((r) => setTimeout(r, 50));
   };
   mw.jobs = async function jobs(limit) {
@@ -5058,16 +5076,13 @@ function createRedisQueue(opts) {
     running = true;
     poll();
   };
-  mw.stop = function stop2() {
+  mw.close = async function close() {
     running = false;
     epoch++;
     if (pollTimer) {
       clearTimeout(pollTimer);
       pollTimer = null;
     }
-  };
-  mw.close = async function close() {
-    mw.stop();
     while (inflight > 0) await new Promise((r) => setTimeout(r, 50));
     redis2.disconnect();
   };
@@ -6065,7 +6080,7 @@ function tenant(options) {
     );
   }
   function middleware() {
-    return async (req, ctx, next) => {
+    const mw = async (req, ctx, next) => {
       const user2 = ctx.user;
       if (!user2) {
         return new Response("Unauthorized", { status: 401 });
@@ -6101,6 +6116,8 @@ function tenant(options) {
       ctx.tenant = { id: member.id, name: member.name, role: member.role };
       return next(req, ctx);
     };
+    mw.__meta = { injects: ["tenant"], depends: ["user"] };
+    return mw;
   }
   const r = buildRouter(sql2, usersTable);
   const mod = r;
@@ -6179,17 +6196,13 @@ function buildRouter2(deps) {
     if (!body.input && !body.messages) {
       return Response.json({ error: "input or messages is required" }, { status: 400 });
     }
-    try {
-      const result = await runner.run(id2, body);
-      if ("stream" in result) {
-        return new Response(result.stream, {
-          headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-cache" }
-        });
-      }
-      return Response.json(result);
-    } catch (err) {
-      return Response.json({ error: err.message }, { status: 500 });
+    const result = await runner.run(id2, body);
+    if ("stream" in result) {
+      return new Response(result.stream, {
+        headers: { "Content-Type": "text/event-stream", "Cache-Control": "no-cache" }
+      });
     }
+    return Response.json(result);
   });
   r.get("/agents/:id/runs", async (_req, ctx) => {
     const agentId = parseInt(ctx.params.id, 10);
@@ -6220,13 +6233,26 @@ function buildRouter2(deps) {
       { orderBy: { created_at: "desc" } }
     );
     const total = rows.length;
-    const success = rows.filter((r2) => r2.status === "success" || r2.status === "stream").length;
+    const success = rows.filter(
+      (r2) => r2.status === "success" || r2.status === "stream"
+    ).length;
     const error = rows.filter((r2) => r2.status === "error").length;
-    const totalTokensIn = rows.reduce((sum, r2) => sum + (r2.tokens_in || 0), 0);
-    const totalTokensOut = rows.reduce((sum, r2) => sum + (r2.tokens_out || 0), 0);
-    const totalElapsed = rows.reduce((sum, r2) => sum + (r2.elapsed_ms || 0), 0);
+    const totalTokensIn = rows.reduce(
+      (sum, r2) => sum + (r2.tokens_in || 0),
+      0
+    );
+    const totalTokensOut = rows.reduce(
+      (sum, r2) => sum + (r2.tokens_out || 0),
+      0
+    );
+    const totalElapsed = rows.reduce(
+      (sum, r2) => sum + (r2.elapsed_ms || 0),
+      0
+    );
     const avgElapsed = total > 0 ? Math.round(totalElapsed / total) : 0;
-    const sorted = [...rows].sort((a, b) => (a.elapsed_ms || 0) - (b.elapsed_ms || 0));
+    const sorted = [...rows].sort(
+      (a, b) => (a.elapsed_ms || 0) - (b.elapsed_ms || 0)
+    );
     const p95Idx = Math.ceil(sorted.length * 0.95) - 1;
     const p95Elapsed = sorted.length > 0 ? sorted[p95Idx]?.elapsed_ms || 0 : 0;
     return Response.json({
@@ -6252,7 +6278,10 @@ function buildRouter2(deps) {
       const doc = await runner.addKnowledge(agentId, body.title || "", body.content);
       return Response.json(doc, { status: 201 });
     } catch (err) {
-      return Response.json({ error: err.message }, { status: 500 });
+      return Response.json(
+        { error: err instanceof Error ? err.message : String(err) },
+        { status: 500 }
+      );
     }
   });
   r.get("/agents/:id/knowledge", async (_req, ctx) => {
@@ -6304,7 +6333,12 @@ async function searchKnowledge(sql2, provider, agentId, query, limit = 5) {
     `SELECT id, title, content, metadata, embedding <=> $1::vector AS _score FROM "_knowledge_documents" WHERE agent_id = $2 ORDER BY embedding <=> $1::vector LIMIT $3`,
     [vec, agentId, limit]
   );
-  return docs.map((d) => ({ id: d.id, title: d.title, content: d.content, score: d._score }));
+  return docs.map((d) => ({
+    id: d.id,
+    title: d.title,
+    content: d.content,
+    score: d._score
+  }));
 }
 async function loadAgent(agents, agentId) {
   const row = await agents.read(agentId);
@@ -7349,7 +7383,7 @@ async function deploy(config) {
           await stopProcess({ child: app.process, port: app.currentPort });
         }
       }
-      httpServer?.stop();
+      httpServer?.close();
     },
     ready: httpServer.ready,
     url: `http://localhost:${config.port}/`,
@@ -7734,11 +7768,12 @@ function buildHeadPayload(opts) {
     flash: ctx.flash,
     loaderData
   };
-  if (ctx.user && typeof ctx.user === "object") {
+  const rawUser = ctx.user;
+  if (rawUser && typeof rawUser === "object") {
     const safeUser = {};
     for (const k of ["id", "name", "email", "role", "avatar"]) {
-      if (k in ctx.user) {
-        safeUser[k] = ctx.user[k];
+      if (k in rawUser) {
+        safeUser[k] = rawUser[k];
       }
     }
     ctxData.user = safeUser;
@@ -8049,7 +8084,6 @@ function moduleServer(opts) {
   _setImportRoots(roots);
   const router = new Router();
   router.get("/__wfw/m/*", (async (req, ctx) => {
-    const reqUrl = new URL(req.url);
     const filePath = (ctx.params["*"] || "").split("?")[0];
     const ext = filePath.split(".").pop();
     if (ext !== "tsx" && ext !== "ts") {
@@ -8619,25 +8653,22 @@ async function getSession(sql2, id2) {
 }
 async function listSessions(sql2, userId2) {
   const opts = { orderBy: { updated_at: "desc" } };
-  if (userId2 !== void 0) {
-    const { data: rows2 } = await sessions.readMany(
-      sql2,
-      { user_id: userId2, active: true },
-      opts
-    );
-    return rows2;
-  }
-  const { data: rows } = await sessions.readMany(sql2, { active: true }, opts);
+  const filter = userId2 !== void 0 ? { user_id: userId2, active: true } : { active: true };
+  const { data: rows } = await sessions.readMany(sql2, filter, opts);
   return rows;
 }
 async function deleteSession(sql2, id2) {
   await sessions.update(sql2, id2, { active: false, updated_at: sql`NOW()` });
 }
 async function getHistory(sql2, sessionId, limit = 50) {
-  const { data: rows } = await messages.readMany(sql2, { session_id: sessionId }, {
-    orderBy: { created_at: "asc" },
-    limit
-  });
+  const { data: rows } = await messages.readMany(
+    sql2,
+    { session_id: sessionId },
+    {
+      orderBy: { created_at: "asc" },
+      limit
+    }
+  );
   return rows;
 }
 async function addTextMessage(sql2, sessionId, role, content, tokensIn = 0, tokensOut = 0) {
@@ -8838,7 +8869,7 @@ function createBashTool(ctx) {
 // opencode/tools/read.ts
 import { tool as tool4 } from "ai";
 import { z as z6 } from "zod";
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { resolve as resolve9 } from "node:path";
 function createReadTool(ctx) {
   return tool4({
@@ -8853,7 +8884,7 @@ function createReadTool(ctx) {
       if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions.permissions)) {
         return { error: "Path not allowed", content: null, totalLines: 0 };
       }
-      const content = readFileSync7(resolved, "utf-8");
+      const content = readFileSync6(resolved, "utf-8");
       const lines = content.split("\n");
       const totalLines = lines.length;
       if (offset !== void 0) {
@@ -8904,7 +8935,7 @@ function createWriteTool(ctx) {
 // opencode/tools/edit.ts
 import { tool as tool6 } from "ai";
 import { z as z8 } from "zod";
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync3 } from "node:fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "node:fs";
 import { resolve as resolve11 } from "node:path";
 function createEditTool(ctx) {
   return tool6({
@@ -8920,7 +8951,7 @@ function createEditTool(ctx) {
       if (!isPathAllowed(resolved, ctx.workspace, ctx.permissions.permissions)) {
         return { error: "Path not allowed" };
       }
-      const content = readFileSync8(resolved, "utf-8");
+      const content = readFileSync7(resolved, "utf-8");
       if (replaceAll) {
         if (!content.includes(oldString)) {
           return { error: "oldString not found in file", replaced: 0 };
@@ -9250,17 +9281,17 @@ async function buildRouter4(deps) {
       FROM "_opencode_messages"
       WHERE session_id = ${sessionId}
     `;
-    const stats = rows[0] || {
+    const raw = rows[0] || {
       message_count: 0,
       total_tokens_in: 0,
       total_tokens_out: 0
     };
     return Response.json({
       session_id: sessionId,
-      message_count: stats.message_count,
-      tokens_in: stats.total_tokens_in,
-      tokens_out: stats.total_tokens_out,
-      tokens_total: stats.total_tokens_in + stats.total_tokens_out
+      message_count: raw.message_count,
+      tokens_in: raw.total_tokens_in,
+      tokens_out: raw.total_tokens_out,
+      tokens_total: Number(raw.total_tokens_in) + Number(raw.total_tokens_out)
     });
   });
   try {
@@ -9316,8 +9347,13 @@ function createWSHandler2(deps) {
               client.mountPath
             );
             ws.send(JSON.stringify({ type: "session_created", session: session2 }));
-          } catch (e) {
-            ws.send(JSON.stringify({ type: "error", error: e.message }));
+          } catch (err) {
+            ws.send(
+              JSON.stringify({
+                type: "error",
+                error: err instanceof Error ? err.message : String(err)
+              })
+            );
           }
           break;
         }
@@ -9371,9 +9407,9 @@ function createWSHandler2(deps) {
                 break;
               }
             }
-          } catch (e) {
-            if (e.name !== "AbortError") {
-              ws.send(JSON.stringify({ type: "error", error: e.message }));
+          } catch (err) {
+            if (err instanceof Error && err.name !== "AbortError") {
+              ws.send(JSON.stringify({ type: "error", error: err.message }));
             }
           }
           break;
@@ -9856,6 +9892,7 @@ function theme(options) {
     };
     return next(req, ctx);
   };
+  mw.__meta = { injects: ["theme"], depends: [] };
   class ThemeRouter extends Router {
     middleware() {
       return mw;
@@ -9957,6 +9994,7 @@ function i18n(options) {
     };
     return next(req, ctx);
   };
+  mw.__meta = { injects: ["i18n"], depends: [] };
   class I18nRouter extends Router {
     middleware() {
       return mw;
@@ -10001,7 +10039,7 @@ function makeSetFlash(name, location) {
 }
 function flash(options) {
   const name = options?.name ?? "flash";
-  return async (req, ctx, next) => {
+  const mw = async (req, ctx, next) => {
     const raw = getCookies(req)[name] ?? null;
     const referer = req.headers.get("referer") || "/";
     let value = void 0;
@@ -10024,6 +10062,8 @@ function flash(options) {
     }
     return res;
   };
+  mw.__meta = { injects: ["flash"], depends: [] };
+  return mw;
 }
 
 // seo.ts
@@ -10206,7 +10246,7 @@ function csrf(options) {
   const headerName = options?.header ?? "x-csrf-token";
   const bodyKey = options?.key ?? "_csrf";
   const excluded = new Set(options?.excludeMethods ?? ["GET", "HEAD", "OPTIONS"]);
-  return async (req, ctx, next) => {
+  const mw = async (req, ctx, next) => {
     const method = req.method.toUpperCase();
     if (excluded.has(method)) {
       let token = getCookies(req)[cookieName];
@@ -10243,6 +10283,8 @@ function csrf(options) {
     }
     return next(req, ctx);
   };
+  mw.__meta = { injects: ["csrf"], depends: [] };
+  return mw;
 }
 
 // logdb/rest.ts
@@ -11880,6 +11922,7 @@ function s3(options) {
   mw.url = url;
   mw.list = list;
   mw.client = client;
+  mw.__meta = { injects: ["s3"], depends: [] };
   return mw;
 }
 
@@ -12142,6 +12185,7 @@ function permissions(options) {
   mw.requireRole = requireRole;
   mw.requirePermission = requirePermission;
   mw.migrate = migrate;
+  mw.__meta = { injects: ["permissions"], depends: ["user"] };
   return mw;
 }
 
@@ -12615,6 +12659,7 @@ function notifier(opts) {
 }
 export {
   DEFAULT_MAX_BODY,
+  HttpError,
   MIGRATIONS_TABLE,
   MemoryCache,
   MemoryStore,

package/dist/module-server.d.ts

@@ -1,6 +1,5 @@
 import { Router } from './router.ts';
 export declare function clearModuleCache(filePath?: string): void;
-export declare function _setImportRoots(roots: string[]): void;
 export declare function transformModule(absPath: string, root: string, mountPath?: string): Promise<{
     url: string;
     code: string;

package/dist/opencode/rest.d.ts

@@ -1,8 +1,9 @@
 import { Router } from '../router.ts';
 import type { LanguageModel } from 'ai';
+import type { SqlClient } from '../vendor.ts';
 import type { SkillDef, SkillRegistry, OpencodePermissions, PendingQuestion } from './types.ts';
 interface RestDeps {
-    sql: any;
+    sql: SqlClient;
     model: LanguageModel;
     workspace: string;
     systemPrompt?: string;

package/dist/opencode/ws.d.ts

@@ -1,9 +1,9 @@
-import type { WebSocket } from '../vendor.ts';
+import type { WebSocket, SqlClient } from '../vendor.ts';
 import type { LanguageModel } from 'ai';
 import type { Context } from '../types.ts';
 import type { PendingQuestion, SkillDef, SkillRegistry, OpencodePermissions } from './types.ts';
 interface WsDeps {
-    sql: any;
+    sql: SqlClient;
     model: LanguageModel;
     workspace: string;
     systemPrompt?: string;

package/dist/queue/types.d.ts

@@ -43,7 +43,6 @@ export interface Queue extends Middleware<Context, Context & QueueInjected>, Clo
     }): Promise<string>;
     process<T>(type: string, handler: (job: QueueJob<T>) => Promise<void>): void;
     run(): Promise<void>;
-    stop(): void;
     stats(): {
         running: boolean;
         inflight: number;

package/dist/rate-limit.d.ts

@@ -1,5 +1,5 @@
 import type { Redis } from './vendor.ts';
-import type { Context, Middleware } from './types.ts';
+import type { Context, Middleware, Closeable } from './types.ts';
 /** Options for {@link rateLimit}. */
 export interface RateLimitOptions {
     /** Maximum requests within the window (default: 100). */
@@ -17,6 +17,14 @@ export interface RateLimitOptions {
     /** Redis key prefix (default: `'ratelimit:'`). */
     prefix?: string;
 }
+/** Rate limit module — middleware + stats. */
+export interface RateLimitModule extends Middleware<Context, Context>, Closeable {
+    stats(): {
+        store: string;
+        entries?: number;
+        maxEntries: number;
+    };
+}
 /**
  * Rate limiting middleware (in-memory or Redis-backed).
  *
@@ -34,7 +42,4 @@ export interface RateLimitOptions {
  * app.use(rateLimit({ store: 'redis', redis: new Redis(), max: 100 }))
  * ```
  */
-export declare function rateLimit(options?: RateLimitOptions): Middleware<Context, Context> & {
-    close: () => void;
-    stop?: () => void;
-};
+export declare function rateLimit(options?: RateLimitOptions): RateLimitModule;

package/dist/redis/client.d.ts

@@ -0,0 +1,2 @@
+import type { RedisOptions, RedisClient } from './types.ts';
+export declare function redis(opts?: string | RedisOptions): RedisClient;

package/dist/redis/index.d.ts

@@ -1,3 +1,2 @@
-import type { RedisOptions, RedisClient } from './types.ts';
-export { redis as default };
-export declare function redis(opts?: string | RedisOptions): RedisClient;
+export { redis } from './client.ts';
+export type { RedisOptions, RedisClient, RedisInjected } from './types.ts';

package/dist/request-id.d.ts

@@ -5,6 +5,10 @@ declare module './types.ts' {
     }
 }
 /** Options for {@link requestId}. */
+/** Request ID module — a {@link Middleware} that injects `ctx.requestId`. */
+export type RequestIdModule = Middleware<Context, Context & {
+    requestId: string;
+}>;
 export interface RequestIdOptions {
     /** Header name for request ID (default: `'X-Request-ID'`). */
     header?: string;

package/dist/router.d.ts

@@ -10,24 +10,6 @@ export type WebSocketHandler = {
     error?: (ws: WebSocket, ctx: Context, error: Error) => void | Promise<void>;
 };
 type WsUpgradeHandler = (req: IncomingMessage, socket: Duplex, head: Buffer) => void;
-/**
- * Middleware metadata for dependency checking.
- * Middleware factories can attach this to their return value for runtime validation.
- *
- * ```ts
- * function postgres(): PostgresClient {
- *   const mw = async (req, ctx, next) => { ... }
- *   mw.__meta = { injects: ['sql'], depends: [] }
- *   return Object.assign(mw, { sql, migrate, close })
- * }
- * ```
- */
-export interface MiddlewareMeta {
-    /** Fields this middleware injects into ctx. */
-    injects: string[];
-    /** Fields this middleware depends on (must be injected earlier). */
-    depends: string[];
-}
 export declare class Router<T extends Context = Context> {
     private root;
     private wsRoot;

package/dist/serve.d.ts

@@ -1,6 +1,6 @@
 import { type IncomingMessage, type ServerResponse } from 'node:http';
 import type { Duplex } from 'node:stream';
-import type { Handler } from './types.ts';
+import { type Handler } from './types.ts';
 export interface ServeOptions {
     port?: number;
     hostname?: string;
@@ -18,6 +18,8 @@ export interface ServeOptions {
 }
 export interface Server {
     stop: (timeoutMs?: number) => Promise<void>;
+    /** Alias for `stop()`. Prefer this for consistency with other modules. */
+    close: (timeoutMs?: number) => Promise<void>;
     readonly port: number;
     readonly hostname: string;
     ready: Promise<void>;

package/dist/server-registry.d.ts

@@ -8,5 +8,3 @@ export declare function getServerModule(absPath: string): any;
  * Otherwise clear all modules.
  */
 export declare function clearServerModule(absPath?: string): void;
-/** Release resources. Call when shutting down. */
-export declare function closeRegistry(): void;

package/dist/session.d.ts

@@ -80,6 +80,10 @@ export declare class MemoryStore implements SessionStore {
     /** Testing only: return approximate count. */
     get size(): number;
 }
+/**
+ * Redis-backed session store.
+ * Pass to `session({ store: new RedisStore({ redis }) })`.
+ */
 export declare class RedisStore implements SessionStore {
     private redis;
     private prefix;
@@ -90,6 +94,22 @@ export declare class RedisStore implements SessionStore {
     destroy(sid: string): Promise<void>;
     close(): Promise<void>;
 }
+/**
+ * Session middleware. Injects `ctx.session` with a persistent key-value store
+ * scoped to the request. Data is automatically saved to the store on response.
+ *
+ * Defaults to memory store. Use `{ store: 'redis', redis }` for multi-process setups.
+ *
+ * ```ts
+ * import { session } from 'weifuwu'
+ * app.use(session())
+ *
+ * app.get('/visit', (req, ctx) => {
+ *   ctx.session.count = (ctx.session.count ?? 0) + 1
+ *   return Response.json({ visits: ctx.session.count })
+ * })
+ * ```
+ */
 export declare function session(options?: SessionOptions): Middleware<Context, Context & SessionInjected> & {
     close: () => Promise<void>;
     store: SessionStore;

package/dist/ssr.d.ts

@@ -1,13 +1,4 @@
 import { Router } from './router.ts';
-interface ResolvedRoute {
-    routePath: string;
-    pageFile: string;
-    layoutFiles: string[];
-    errorFiles: string[];
-    notFoundFile: string | null;
-}
-/** Clear route cache (called by HMR watcher in dev mode). */
-export declare function clearRouteCache(cache: Map<string, ResolvedRoute | null>): void;
 export interface RouteEntry {
     path: string;
     file: string;
@@ -18,4 +9,3 @@ export declare function ssr(opts: {
     close?: () => void;
     pages?: () => RouteEntry[];
 };
-export {};

package/dist/tenant/utils.d.ts

@@ -5,6 +5,5 @@ export declare function sqlTypeForField(field: FieldDef): string;
 export declare function validateSlug(slug: string): string | null;
 export declare function validateFieldDefs(fields: FieldDef[]): string[];
 export declare function formatDefault(field: FieldDef): string;
-export declare function mapFieldToZod(field: FieldDef): string;
 export declare function getRelationFields(fields: FieldDef[]): FieldDef[];
 export declare function findRelation(fields: FieldDef[], targetSlug: string): FieldDef | undefined;

package/dist/types.d.ts

@@ -4,12 +4,25 @@ export interface Context {
     mountPath?: string;
     layoutStack?: {
         path: string;
-        component: any;
+        component: unknown;
     }[];
     [key: string]: unknown;
 }
 export type Handler<T extends Context = Context> = (req: Request, ctx: T) => Response | Promise<Response>;
-export type Middleware<In extends Context = Context, Out extends In = In> = (req: Request, ctx: In, next: Handler<Out>) => Response | Promise<Response>;
+/**
+ * Metadata for middleware dependency checking.
+ * Middleware factories attach this for runtime validation.
+ */
+export interface MiddlewareMeta {
+    /** Fields this middleware injects into ctx. */
+    injects: string[];
+    /** Fields this middleware depends on (must be injected earlier). */
+    depends: string[];
+}
+export type Middleware<In extends Context = Context, Out extends In = In> = {
+    (req: Request, ctx: In, next: Handler<Out>): Response | Promise<Response>;
+    __meta?: MiddlewareMeta;
+};
 export type ErrorHandler<T extends Context = Context> = (error: Error, req: Request, ctx: T) => Response | Promise<Response>;
 /**
  * Interface for resources that require explicit cleanup (connections, pools, timers).
@@ -19,3 +32,16 @@ export interface Closeable {
     /** Release all resources. Call once when shutting down. */
     close(): Promise<void>;
 }
+/**
+ * HTTP error with an explicit status code.
+ * Throw from a handler or middleware to return a non-200 response.
+ *
+ * ```ts
+ * if (!resource) throw new HttpError('Not found', 404)
+ * serve() catches it and returns the status code.
+ * ```
+ */
+export declare class HttpError extends Error {
+    status: number;
+    constructor(message: string, status: number);
+}

package/dist/upload.d.ts

@@ -4,6 +4,10 @@ declare module './types.ts' {
         parsed: Record<string, unknown>;
     }
 }
+/** Upload middleware — a {@link Middleware} that injects `ctx.parsed` with file fields. */
+export type UploadModule = Middleware<Context, Context & {
+    parsed: Record<string, unknown>;
+}>;
 /** A parsed file from a multipart upload. */
 export interface UploadedFile {
     /** Original filename from the client. */

package/dist/user/client.d.ts

@@ -1,4 +1,9 @@
-import type { UserOptions, UserModule } from './types.ts';
+import type { UserOptions, UserData, UserModule } from './types.ts';
+declare module '../types.ts' {
+    interface Context {
+        user: UserData;
+    }
+}
 /**
  * User authentication module — local register/login, JWT verification, OAuth2 server, social login.
  * Supports DB-less auth via tokens/verify/proxy options.

package/dist/user/oauth-login.d.ts

@@ -9,13 +9,13 @@ interface OAuthLoginDeps {
     /** Table for provider-user link, derived from usersTable. */
     providerTable: string;
     redirectUrl: string;
-    signToken: (user: any) => string;
+    signToken: (user: Record<string, unknown>) => string;
     /** Create a placeholder user for OAuth login (no password). */
-    createPlaceholderUser: (email: string, name: string) => Promise<any>;
+    createPlaceholderUser: (email: string, name: string) => Promise<Record<string, unknown>>;
     /** Find user by internal ID. */
-    findUserById: (id: number) => Promise<any | undefined>;
+    findUserById: (id: number) => Promise<Record<string, unknown> | undefined>;
     /** Find user by email. */
-    findUserByEmail: (email: string) => Promise<any | undefined>;
+    findUserByEmail: (email: string) => Promise<Record<string, unknown> | undefined>;
 }
 export declare function registerOAuthLoginRoutes(router: Router, deps: OAuthLoginDeps, providers: Record<string, OAuthProviderConfig>): void;
 export {};

package/dist/validate.d.ts

@@ -5,10 +5,28 @@ declare module './types.ts' {
         parsed: Record<string, unknown>;
     }
 }
+/** Validation middleware — a {@link Middleware} that injects `ctx.parsed` with validated data. */
+export type ValidateModule = Middleware;
 export interface ValidationSchemas {
     body?: ZodSchema;
     query?: ZodSchema;
     params?: ZodSchema;
     headers?: ZodSchema;
 }
+/**
+ * Request validation middleware using Zod schemas.
+ *
+ * Validates `params`, `query`, `body`, and/or `headers` against schemas.
+ * Returns 422 with error details on mismatch.
+ * Injects `ctx.parsed` with validated-and-transformed values.
+ *
+ * ```ts
+ * import { z } from 'zod'
+ *
+ * app.get('/users/:id', validate({
+ *   params: z.object({ id: z.string() }),
+ *   query: z.object({ include: z.string().optional() }),
+ * }), handler)
+ * ```
+ */
 export declare function validate(schemas?: ValidationSchemas): Middleware;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "weifuwu",
   "type": "module",
-  "version": "0.25.0",
+  "version": "0.25.2",
   "description": "Web-standard HTTP framework for Node.js — (req, ctx) => Response",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -31,8 +31,9 @@
     "lint": "eslint --ext .ts,.tsx .",
     "test": "node --test 'test/**/*.test.ts'",
     "test:coverage": "node --experimental-test-coverage --test 'test/**/*.test.ts'",
-    "test:unit": "bash scripts/test-unit.sh",
-    "test:ci": "node --test 'test/**/*.test.ts'",
+    "test:typecheck": "npx tsc -p tsconfig.test.json --noEmit",
+    "test:quick": "bash scripts/test-quick.sh",
+    "test:ci": "node --test --test-force-exit --test-timeout=60000 'test/**/*.test.ts'",
     "prepare": "husky"
   },
   "dependencies": {