weifuwu 0.56.0 → 0.57.0

package/dist/index.js

@@ -93,7 +93,7 @@ function serve(router, options) {
   const ws = router.websocketHandler();
   const handler = router.handler();
   const port = options?.port ?? 0;
-  const hostname = options?.hostname ?? "0.0.0.0";
+  const hostname2 = options?.hostname ?? "0.0.0.0";
   const server = http.createServer(async (req, res) => {
     const traceId = req.headers["x-trace-id"] || req.headers["traceparent"]?.split("-")[1] || crypto.randomUUID();
     try {
@@ -102,16 +102,15 @@ function serve(router, options) {
       const response = await handler(request, { params: {}, query });
       await sendResponse(res, response, { traceId });
     } catch (err) {
-      if (err instanceof HttpError && err.status === 413) {
-        res.writeHead(413, { "Content-Type": "text/plain" });
-        res.end("Request Body Too Large");
+      const e = err instanceof Error ? err : new Error(String(err));
+      if (e instanceof HttpError) {
+        res.writeHead(e.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: e.message }));
         return;
       }
-      if (!(err instanceof HttpError) || err.status >= 500) {
-        const url = req.url ?? "/";
-        const method = req.method ?? "GET";
-        console.error(`[serve] ${method} ${url}:`, err instanceof Error ? err.stack || err.message : err);
-      }
+      const url = req.url ?? "/";
+      const method = req.method ?? "GET";
+      console.error(`[serve] ${method} ${url}:`, e.stack || e.message);
       res.writeHead(500, { "Content-Type": "text/plain" });
       res.end("Internal Server Error");
     }
@@ -157,7 +156,7 @@ function serve(router, options) {
           return 0;
         },
         get hostname() {
-          return hostname;
+          return hostname2;
         }
       };
     }
@@ -175,7 +174,7 @@ function serve(router, options) {
     _cachedPort = 0;
     resolveReady();
   });
-  server.listen(port, hostname, () => {
+  server.listen(port, hostname2, () => {
     const addr = server.address();
     if (addr && typeof addr !== "string") {
       _cachedPort = addr.port;
@@ -204,8 +203,8 @@ function serve(router, options) {
       return _cachedPort;
     },
     get hostname() {
-      if (!server.listening) return hostname;
-      return _cachedHostname || hostname;
+      if (!server.listening) return hostname2;
+      return _cachedHostname || hostname2;
     }
   };
 }
@@ -812,8 +811,15 @@ var Router = class _Router {
   }
   async handleError(e, req, ctx) {
     const err = e instanceof Error ? e : new Error(String(e));
+    if (this.errorHandler) return this.errorHandler(err, req, ctx);
+    if (err instanceof HttpError) {
+      return new Response(JSON.stringify({ error: err.message }), {
+        status: err.status,
+        headers: { "Content-Type": "application/json" }
+      });
+    }
     console.error(`[router] ${req.method} ${new URL(req.url).pathname}:`, err.stack || err.message || err);
-    return this.errorHandler ? this.errorHandler(err, req, ctx) : new Response("Internal Server Error", { status: 500 });
+    return new Response("Internal Server Error", { status: 500 });
   }
   // ── Private: Middleware chain ───────────────────────────────
   async runChain(mws, finalHandler, req, ctx) {
@@ -1078,553 +1084,723 @@ var MIME_TYPES = {
   ".wav": "audio/wav"
 };
 
-// src/ui/index.ts
-import { build } from "esbuild";
-import { readFile, stat } from "node:fs/promises";
-import { resolve as resolve2 } from "node:path";
-import { fileURLToPath } from "node:url";
-
-// src/ui/html-safe.ts
-var HtmlSafe = class {
-  value;
-  constructor(value) {
-    this.value = value;
-  }
-  toString() {
-    return this.value;
+// src/middleware/rate-limit.ts
+var PREFIX = "rl:";
+function rateLimit(options) {
+  const opts = {
+    windowMs: options?.windowMs ?? 6e4,
+    max: options?.max ?? 100,
+    key: options?.key ?? ((req) => req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ?? "unknown"),
+    algorithm: options?.algorithm ?? "fixed",
+    store: options?.store ?? "redis",
+    statusCode: options?.statusCode ?? 429,
+    message: options?.message ?? "Too Many Requests",
+    headers: options?.headers ?? true
+  };
+  if (opts.store === "memory" && opts.algorithm === "sliding") {
+    throw new Error('rateLimit: algorithm "sliding" requires store "redis" (memory store \u4EC5\u652F\u6301 fixed)');
+  }
+  let redisPool = null;
+  const memoryStore = /* @__PURE__ */ new Map();
+  function requireRedis(ctx) {
+    if (redisPool) return;
+    const pool = ctx.redis;
+    if (!pool) {
+      throw new Error(
+        'rateLimit: store "redis" requires redis() middleware first \u2014 app.use(redis()) \u5FC5\u987B\u5728 rateLimit \u4E4B\u524D\u6CE8\u518C'
+      );
+    }
+    redisPool = pool;
+  }
+  async function check(key, max, windowMs) {
+    if (opts.store === "memory") {
+      const now2 = Date.now();
+      const state = memoryStore.get(key);
+      if (!state || state.resetAt <= now2) {
+        memoryStore.set(key, { count: 1, resetAt: now2 + windowMs });
+        return { allowed: true, remaining: Math.max(0, max - 1), resetSeconds: Math.ceil(windowMs / 1e3) };
+      }
+      if (state.count >= max) {
+        return { allowed: false, remaining: 0, resetSeconds: Math.ceil((state.resetAt - now2) / 1e3) };
+      }
+      state.count++;
+      return { allowed: true, remaining: Math.max(0, max - state.count), resetSeconds: Math.ceil((state.resetAt - now2) / 1e3) };
+    }
+    if (opts.algorithm === "fixed") {
+      const count2 = await redisPool.incr(PREFIX + key);
+      if (count2 === 1) {
+        await redisPool.expire(PREFIX + key, Math.ceil(windowMs / 1e3));
+      }
+      return {
+        allowed: count2 <= max,
+        remaining: Math.max(0, max - count2),
+        resetSeconds: Math.max(1, Math.ceil(await redisPool.ttl(PREFIX + key)))
+      };
+    }
+    const fullKey = PREFIX + key;
+    const now = Date.now();
+    const min = now - windowMs;
+    await redisPool.command("ZREMRANGEBYSCORE", fullKey, 0, min);
+    const count = Number(await redisPool.command("ZCARD", fullKey));
+    if (count >= max) {
+      const ttl = Number(await redisPool.command("TTL", fullKey));
+      return { allowed: false, remaining: 0, resetSeconds: Math.max(1, ttl) };
+    }
+    const added = Number(
+      await redisPool.command("ZADD", fullKey, now, `${now}-${Math.random().toString(36).slice(2)}`)
+    );
+    if (added === 1) {
+      await redisPool.command("EXPIRE", fullKey, Math.ceil(windowMs / 1e3) * 2);
+    }
+    return { allowed: true, remaining: Math.max(0, max - count - 1), resetSeconds: Math.ceil(windowMs / 1e3) };
+  }
+  function tooMany(resetSeconds) {
+    const headers = { "Content-Type": "application/json" };
+    if (opts.headers) {
+      headers["Retry-After"] = String(resetSeconds);
+      headers["RateLimit-Limit"] = String(opts.max);
+      headers["RateLimit-Remaining"] = "0";
+      headers["RateLimit-Reset"] = String(resetSeconds);
+    }
+    return new Response(JSON.stringify({ error: opts.message, retryAfter: resetSeconds }), {
+      status: opts.statusCode,
+      headers
+    });
   }
-};
-
-// src/client/vnode.ts
-var ASYNC_MARK = "__wfAsyncComponent";
-function isAsyncComponent(type) {
-  return typeof type === "function" && type?.[ASYNC_MARK] === true;
+  const mw = (async (req, ctx, next) => {
+    if (opts.store === "redis") requireRedis(ctx);
+    ctx.limit = async (name, manual) => {
+      const key = `${PREFIX}${name}`;
+      const max = manual?.max ?? opts.max;
+      const windowMs = manual?.windowMs ?? opts.windowMs;
+      const r2 = await check(key, max, windowMs);
+      if (!r2.allowed) {
+        const err = new HttpError(opts.message, opts.statusCode);
+        err.retryAfter = r2.resetSeconds;
+        throw err;
+      }
+    };
+    const r = await check(PREFIX + "global:" + opts.key(req), opts.max, opts.windowMs);
+    if (!r.allowed) return tooMany(r.resetSeconds);
+    const res = await next(req, ctx);
+    if (opts.headers) {
+      res.headers.set("RateLimit-Limit", String(opts.max));
+      res.headers.set("RateLimit-Remaining", String(r.remaining));
+      res.headers.set("RateLimit-Reset", String(r.resetSeconds));
+    }
+    return res;
+  });
+  mw.__meta = { injects: ["limit"], depends: opts.store === "redis" ? ["redis"] : [] };
+  return mw;
 }
-var Fragment = /* @__PURE__ */ Symbol("Fragment");
-var Portal = /* @__PURE__ */ Symbol("Portal");
 
-// src/client/reactive.ts
-function createReactiveState(dirty) {
-  const proxyCache = /* @__PURE__ */ new WeakMap();
-  const reactive = (target) => {
-    if (target === null || typeof target !== "object") return target;
-    if (proxyCache.has(target)) return proxyCache.get(target);
-    const proxy = new Proxy(target, {
-      set(target2, key, value) {
-        const old = Reflect.get(target2, key);
-        if (old === value) return true;
-        Reflect.set(target2, key, value);
-        dirty();
-        return true;
-      },
-      get(target2, key) {
-        const value = Reflect.get(target2, key);
-        if (typeof value === "object" && value !== null) return reactive(value);
-        return value;
-      },
-      deleteProperty(target2, key) {
-        if (Reflect.has(target2, key)) {
-          Reflect.deleteProperty(target2, key);
-          dirty();
+// src/email/smtp.ts
+import net from "node:net";
+import tls from "node:tls";
+function encodeWord(s) {
+  if (/^[\x20-\x7e]*$/.test(s)) return s;
+  return `=?UTF-8?B?${Buffer.from(s, "utf8").toString("base64")}?=`;
+}
+function buildMessage(msg) {
+  const lines = [];
+  lines.push(`From: ${msg.from}`);
+  lines.push(`To: ${msg.to.join(", ")}`);
+  lines.push(`Subject: ${encodeWord(msg.subject)}`);
+  lines.push("MIME-Version: 1.0");
+  lines.push(
+    msg.html ? "Content-Type: text/html; charset=utf-8" : "Content-Type: text/plain; charset=utf-8"
+  );
+  lines.push("");
+  lines.push((msg.html ?? msg.text ?? "").replace(/\r?\n/g, "\r\n"));
+  return lines.join("\r\n");
+}
+function sendSmtp(cfg, msg) {
+  return new Promise((resolve3, reject) => {
+    const port = cfg.port ?? (cfg.secure ? 465 : 587);
+    const timeoutMs = cfg.timeoutMs ?? 3e4;
+    let socket = null;
+    let buf = "";
+    let pending = null;
+    const timer = setTimeout(() => {
+      fail(new Error(`smtp: timeout after ${timeoutMs}ms (${cfg.host}:${port})`));
+    }, timeoutMs);
+    function fail(err) {
+      clearTimeout(timer);
+      if (socket && !socket.destroyed) socket.destroy();
+      reject(err);
+    }
+    function onData(chunk) {
+      buf += chunk.toString("utf8");
+      while (true) {
+        const nl = buf.indexOf("\r\n");
+        if (nl === -1) return;
+        const line = buf.slice(0, nl);
+        buf = buf.slice(nl + 2);
+        if (!pending) continue;
+        if (line.length >= 4 && line[3] === " ") {
+          const p = pending;
+          pending = null;
+          p.resolve({ code: parseInt(line.slice(0, 3), 10), lines: p.lines });
+          return;
         }
-        return true;
+        pending.lines.push(line);
+      }
+    }
+    function exchange(cmd) {
+      return new Promise((resolveResp, rejectResp) => {
+        if (pending) {
+          rejectResp(new Error("smtp: concurrent exchange"));
+          return;
+        }
+        pending = {
+          resolve: (r) => r.code >= 400 ? rejectResp(new Error(`smtp: ${cmd} \u2192 ${r.code} ${r.lines[0]}`)) : resolveResp(r),
+          lines: []
+        };
+        socket?.write(cmd + "\r\n");
+      });
+    }
+    function upgradeTls() {
+      return new Promise((resolveUp, rejectUp) => {
+        const tlsSocket = tls.connect({
+          socket,
+          rejectUnauthorized: cfg.rejectUnauthorized ?? false
+        });
+        tlsSocket.once("secureConnect", () => {
+          socket = tlsSocket;
+          tlsSocket.on("data", onData);
+          resolveUp();
+        });
+        tlsSocket.once("error", rejectUp);
+      });
+    }
+    const run = async () => {
+      try {
+        const raw = cfg.secure ? tls.connect(port, cfg.host, { rejectUnauthorized: cfg.rejectUnauthorized ?? false }) : net.connect(port, cfg.host);
+        socket = raw;
+        raw.on("data", onData);
+        raw.on("error", (e) => fail(e));
+        await new Promise((r) => raw.once("connect", r));
+        const greeting = await new Promise((r) => {
+          pending = { resolve: r, lines: [] };
+        });
+        if (greeting.code !== 220) throw new Error(`smtp: greeting ${greeting.code} ${greeting.lines[0]}`);
+        const ehlo = await exchange(`EHLO ${cfg.host}`);
+        const features = ehlo.lines.join("\n");
+        if (!cfg.secure && /STARTTLS/i.test(features)) {
+          try {
+            const stls = await exchange("STARTTLS");
+            if (stls.code === 220) {
+              await upgradeTls();
+              await exchange(`EHLO ${cfg.host}`);
+            }
+          } catch (e) {
+            if (cfg.requireTls) throw e;
+          }
+        }
+        if (cfg.user) {
+          const plain = Buffer.from(`\0${cfg.user}\0${cfg.pass ?? ""}`, "utf8").toString("base64");
+          const auth = await exchange(`AUTH PLAIN ${plain}`);
+          if (auth.code !== 235 && auth.code !== 250 && auth.code !== 334) {
+            throw new Error(`smtp: auth failed ${auth.code}`);
+          }
+        }
+        await exchange(`MAIL FROM:<${msg.from}>`);
+        for (const to of msg.to) {
+          await exchange(`RCPT TO:<${to}>`);
+        }
+        const data = await exchange("DATA");
+        if (data.code !== 354) throw new Error(`smtp: DATA rejected ${data.code}`);
+        const body = buildMessage(msg);
+        const stuffed = body.split("\r\n").map((l) => l.startsWith(".") ? "." + l : l).join("\r\n");
+        await new Promise((r, j) => {
+          socket?.write(stuffed + "\r\n.\r\n", (err) => err ? j(err) : r());
+        });
+        const done = await new Promise((r) => {
+          pending = { resolve: r, lines: [] };
+        });
+        if (done.code !== 250) throw new Error(`smtp: message rejected ${done.code} ${done.lines[0]}`);
+        await exchange("QUIT").catch(() => {
+        });
+        clearTimeout(timer);
+        socket.end();
+        resolve3();
+      } catch (e) {
+        fail(e instanceof Error ? e : new Error(String(e)));
       }
+    };
+    run();
+  });
+}
+
+// src/email/index.ts
+function resendAdapter(opts, from) {
+  const apiKey = opts.apiKey ?? process.env.RESEND_API_KEY;
+  if (!apiKey) {
+    throw new Error('email: adapter "resend" requires resend.apiKey or RESEND_API_KEY');
+  }
+  const baseUrl = opts.baseUrl ?? "https://api.resend.com";
+  return async (msg) => {
+    const res = await fetch(`${baseUrl}/emails`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        from: msg.from ?? from,
+        to: Array.isArray(msg.to) ? msg.to : [msg.to],
+        subject: msg.subject,
+        text: msg.text,
+        html: msg.html
+      })
     });
-    proxyCache.set(target, proxy);
-    return proxy;
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      const detail = data?.message;
+      throw new HttpError(`email: resend ${res.status}${detail ? ` ${detail}` : ""}`, 502);
+    }
+    return { id: data?.id, accepted: true };
   };
-  return reactive({});
+}
+function smtpAdapter(opts, from) {
+  if (!opts.host) throw new Error('email: adapter "smtp" requires smtp.host');
+  return async (msg) => {
+    await sendSmtp(opts, {
+      from: msg.from ?? from,
+      to: Array.isArray(msg.to) ? msg.to : [msg.to],
+      subject: msg.subject,
+      text: msg.text,
+      html: msg.html
+    });
+    return { accepted: true };
+  };
+}
+function email(options) {
+  if (!options.from) throw new Error("email: options.from is required");
+  const adapter = typeof options.adapter === "function" ? options.adapter : options.adapter === "smtp" ? smtpAdapter(options.smtp, options.from) : resendAdapter(options.resend ?? {}, options.from);
+  const mw = (async (req, ctx, next) => {
+    ctx.email = {
+      send: (msg) => adapter(msg)
+    };
+    return next(req, ctx);
+  });
+  mw.__meta = { injects: ["email"], depends: [] };
+  return mw;
 }
 
-// src/ui/ssr.ts
-function escape(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+// src/user/password.ts
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { promisify } from "node:util";
+var scryptAsync = promisify(scrypt);
+var KEYLEN = 64;
+var PARAMS = { N: 16384, r: 8, p: 1 };
+async function hashPassword(password) {
+  const salt = randomBytes(16);
+  const hash = await scryptAsync(password, salt, KEYLEN, PARAMS);
+  return `scrypt$${PARAMS.N}$${PARAMS.r}$${PARAMS.p}$${salt.toString("hex")}$${hash.toString("hex")}`;
 }
-var VOID_TAGS = /* @__PURE__ */ new Set([
-  "area",
-  "base",
-  "br",
-  "col",
-  "embed",
-  "hr",
-  "img",
-  "input",
-  "link",
-  "meta",
-  "param",
-  "source",
-  "track",
-  "wbr"
-]);
-function classToString(v) {
-  if (typeof v === "string") return v;
-  if (Array.isArray(v)) return v.filter(Boolean).join(" ");
-  if (v && typeof v === "object") {
-    return Object.entries(v).filter(([, b]) => b).map(([k]) => k).join(" ");
-  }
-  return "";
+async function verifyPassword(password, stored) {
+  const parts = stored.split("$");
+  if (parts.length !== 6 || parts[0] !== "scrypt") return false;
+  const [, N, r, p, saltHex, hashHex] = parts;
+  const expected = Buffer.from(hashHex, "hex");
+  const actual = await scryptAsync(password, Buffer.from(saltHex, "hex"), expected.length, {
+    N: Number(N),
+    r: Number(r),
+    p: Number(p)
+  });
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
 }
-function styleToString(v) {
-  if (typeof v === "string") return v;
-  if (v && typeof v === "object") {
-    return Object.entries(v).filter(([, x]) => x != null).map(([k, x]) => `${k}:${typeof x === "number" ? x + "px" : String(x)}`).join(";");
+
+// src/user/token.ts
+import { createHash, createHmac, randomBytes as randomBytes2, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
+var b64 = (obj) => Buffer.from(JSON.stringify(obj)).toString("base64url");
+function signToken(payload, secret, ttlSeconds) {
+  const now = Math.floor(Date.now() / 1e3);
+  const data = `${b64({ alg: "HS256", typ: "JWT" })}.${b64({ ...payload, iat: now, exp: now + ttlSeconds })}`;
+  const sig = createHmac("sha256", secret).update(data).digest("base64url");
+  return `${data}.${sig}`;
+}
+function verifyToken(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const [h, p, s] = parts;
+  const data = `${h}.${p}`;
+  const expected = createHmac("sha256", secret).update(data).digest("base64url");
+  const sigBuf = Buffer.from(s);
+  const expBuf = Buffer.from(expected);
+  if (sigBuf.length !== expBuf.length || !timingSafeEqual2(sigBuf, expBuf)) return null;
+  try {
+    const payload = JSON.parse(Buffer.from(p, "base64url").toString("utf8"));
+    if (typeof payload.exp === "number" && payload.exp < Date.now() / 1e3) return null;
+    return payload;
+  } catch {
+    return null;
   }
-  return "";
 }
-function createSsrContext(serverCtx, dataStore) {
-  const usedIds = /* @__PURE__ */ new Set();
-  const ui2 = {
-    $: () => createReactiveState(() => {
-    }),
-    dirty: () => {
-    },
-    render: () => {
-    },
-    selfId: (name) => {
-      if (usedIds.has(name)) throw new Error(`[weifuwu] Duplicate component ID: "${name}"`);
-      usedIds.add(name);
-    },
-    useMedia: () => {
-    },
-    useBreakpoint: () => {
-    },
-    usePopupPosition: () => ({ top: 0, left: 0, refresh: () => {
-    } })
-  };
-  const ctx = Object.create(serverCtx ?? {});
-  ctx.ui = ui2;
-  ctx.data = {
-    async get(key, fetcher) {
-      if (dataStore.has(key)) return dataStore.get(key);
-      if (!fetcher) return void 0;
-      const val = await fetcher();
-      dataStore.set(key, val);
-      return val;
-    },
-    set(key, val) {
-      dataStore.set(key, val);
-    },
-    has(key) {
-      return dataStore.has(key);
-    }
-  };
-  return ctx;
+function generateRefreshToken() {
+  return randomBytes2(32).toString("hex");
 }
-async function renderSsr(input, ctx) {
-  if (input == null || typeof input === "boolean") return "";
-  if (typeof input === "string" || typeof input === "number") return escape(String(input));
-  if (Array.isArray(input)) {
-    let s = "";
-    for (const c of input) s += await renderSsr(c, ctx);
-    return s;
+function hashRefreshToken(token) {
+  return createHash("sha256").update(token).digest("hex");
+}
+
+// src/response.ts
+function ok(data, init) {
+  return Response.json(data, { status: 200, ...init });
+}
+function created(data, init) {
+  return Response.json(data, { status: 201, ...init });
+}
+function noContent(init) {
+  return new Response(null, { status: 204, ...init });
+}
+function badRequest(message) {
+  return Response.json({ error: message ?? "Bad Request" }, { status: 400 });
+}
+function unauthorized(message) {
+  return Response.json({ error: message ?? "Unauthorized" }, { status: 401 });
+}
+function forbidden(message) {
+  return Response.json({ error: message ?? "Forbidden" }, { status: 403 });
+}
+function notFound(message) {
+  return Response.json({ error: message ?? "Not Found" }, { status: 404 });
+}
+function conflict(message) {
+  return Response.json({ error: message ?? "Conflict" }, { status: 409 });
+}
+function unprocessable(message) {
+  return Response.json({ error: message ?? "Unprocessable Entity" }, { status: 422 });
+}
+function tooManyRequests(message) {
+  return Response.json({ error: message ?? "Too Many Requests" }, { status: 429 });
+}
+function serverError(message) {
+  return Response.json({ error: message ?? "Internal Server Error" }, { status: 500 });
+}
+function redirect(url, status = 302) {
+  return new Response(null, { status, headers: { Location: url } });
+}
+
+// src/user/index.ts
+var USERS_TABLE = "_weifuwu_users";
+var SESSIONS_TABLE = "_weifuwu_sessions";
+function normalizeEmail(email2) {
+  return email2.trim().toLowerCase();
+}
+function userSystem(options) {
+  const sql = options.sql;
+  const secretRaw = options.secret ?? process.env.AUTH_SECRET;
+  if (!secretRaw) {
+    throw new Error(
+      "userSystem: secret is required \u2014 pass options.secret or set AUTH_SECRET (at least 32 chars)"
+    );
   }
-  const vnode = input;
-  if (vnode.type === Portal) return renderSsr(vnode.props?.children, ctx);
-  if (vnode.type === Fragment) return renderSsr(vnode.props?.children, ctx);
-  if (typeof vnode.type === "function") {
-    let def;
-    if (isAsyncComponent(vnode.type)) {
-      def = await vnode.type(ctx);
-      if (typeof def !== "function") {
-        throw new Error(
-          `asyncComponent factory <${vnode.type.name || "anonymous"}> must return a Component (initProps, ctx) => (props) => VNode.`
-        );
-      }
-    } else {
-      def = vnode.type;
-    }
-    const childCtx = Object.create(ctx);
-    const renderFn = def(vnode.props ?? {}, childCtx);
-    if (typeof renderFn !== "function") {
-      throw new Error(
-        `Component ${vnode.type.name || "anonymous"} must return a render function. Use (init_props, ctx) => (props) => VNode pattern.`
-      );
-    }
-    return renderSsr(renderFn(vnode.props ?? {}), childCtx);
-  }
-  const tag = vnode.type;
-  const props = vnode.props ?? {};
-  const attrs = [];
-  let innerHTML;
-  for (const [key, value] of Object.entries(props)) {
-    if (key === "children" || key === "key") continue;
-    if (key === "ref") continue;
-    if (key.startsWith("on") && typeof value === "function") continue;
-    if (key === "innerHTML") {
-      innerHTML = String(value ?? "");
-      continue;
-    }
-    if (key === "class" || key === "className") {
-      const cls = classToString(value);
-      if (cls) attrs.push(` class="${escape(cls)}"`);
-      continue;
-    }
-    if (key === "style" && value && typeof value === "object") {
-      attrs.push(` style="${escape(styleToString(value))}"`);
-      continue;
-    }
-    if (value === true) {
-      attrs.push(` ${key}`);
-      continue;
-    }
-    if (value === false || value == null) continue;
-    attrs.push(` ${key}="${escape(String(value))}"`);
+  if (secretRaw.length < 16) {
+    throw new Error("userSystem: secret must be at least 16 characters");
+  }
+  const secret = secretRaw;
+  const accessTtlSeconds = options.accessTtlSeconds ?? 3600;
+  const refreshTtlDays = options.refreshTtlDays ?? 30;
+  const prefix = options.prefix ?? "/api/auth";
+  let currentUser = null;
+  async function findUserById(id) {
+    const rows = await sql.unsafe(
+      `SELECT id, email, name, role, tenant FROM ${USERS_TABLE} WHERE id = $1`,
+      [id]
+    );
+    return rows.length ? rows[0] : null;
+  }
+  async function issueSession(user) {
+    const token = signToken({ sub: user.id }, secret, accessTtlSeconds);
+    const refreshToken = generateRefreshToken();
+    const expiresAt = new Date(Date.now() + refreshTtlDays * 24 * 3600 * 1e3);
+    await sql.unsafe(
+      `INSERT INTO ${SESSIONS_TABLE} (token_hash, user_id, expires_at) VALUES ($1, $2, $3)`,
+      [hashRefreshToken(refreshToken), user.id, expiresAt]
+    );
+    return { token, refreshToken };
   }
-  const attrStr = attrs.join("");
-  if (VOID_TAGS.has(tag)) return `<${tag}${attrStr}>`;
-  if (innerHTML !== void 0) return `<${tag}${attrStr}>${innerHTML}</${tag}>`;
-  const children = await renderSsr(props.children, ctx);
-  return `<${tag}${attrStr}>${children}</${tag}>`;
-}
-async function ssrToString(Comp, props, serverCtx, opts = {}) {
-  const dataStore = opts.data ?? /* @__PURE__ */ new Map();
-  const ctx = createSsrContext(serverCtx, dataStore);
-  const html = await renderSsr({ type: Comp, props: props ?? {}, key: void 0 }, ctx);
-  return new HtmlSafe(html);
-}
-function serializeData(data) {
-  const json = JSON.stringify(Object.fromEntries(data)).replace(/</g, "\\u003c");
-  return `<script>window.__DATA__=${json};</script>`;
-}
-
-// src/ui/index.ts
-function escape2(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-function stringify(v) {
-  if (v == null || v === false || v === true) return "";
-  if (Array.isArray(v)) return v.map(stringify).join("");
-  if (v instanceof HtmlSafe) return v.value;
-  return escape2(String(v));
-}
-function unsafe(s) {
-  return new HtmlSafe(s);
-}
-var jsCache = /* @__PURE__ */ new Map();
-async function jsCacheFresh(inputs) {
-  for (const [file, mtime] of Object.entries(inputs)) {
-    try {
-      const st = await stat(file);
-      if (st.mtimeMs !== mtime) return false;
-    } catch {
-      return false;
+  async function consumeRefreshToken(refreshToken) {
+    const rows = await sql.unsafe(
+      `SELECT s.user_id, s.expires_at FROM ${SESSIONS_TABLE} s
+       WHERE s.token_hash = $1 AND s.revoked_at IS NULL`,
+      [hashRefreshToken(refreshToken)]
+    );
+    if (!rows.length) throw new HttpError("Invalid refresh token", 401);
+    const row = rows[0];
+    if (new Date(row.expires_at) < /* @__PURE__ */ new Date()) {
+      throw new HttpError("Refresh token expired", 401);
     }
+    const user = await findUserById(row.user_id);
+    if (!user) throw new HttpError("User not found", 401);
+    return user;
   }
-  return true;
-}
-var cssCache = /* @__PURE__ */ new Map();
-var postcssAvailable;
-async function checkPostcss() {
-  if (postcssAvailable !== void 0) return postcssAvailable;
-  try {
-    await import("postcss");
-    await import("@tailwindcss/postcss");
-    postcssAvailable = true;
-  } catch {
-    postcssAvailable = false;
-  }
-  return postcssAvailable;
-}
-function resolveEntry(entryPath) {
-  if (entryPath.startsWith(".") || entryPath.startsWith("/")) {
-    return resolve2(entryPath);
-  }
-  try {
-    return fileURLToPath(import.meta.resolve(entryPath));
-  } catch {
-    return resolve2(entryPath);
-  }
-}
-function ui() {
-  return async (_req, ctx, next) => {
-    function htmlTag(strings, ...values) {
-      let body = "";
-      for (let i = 0; i < strings.length; i++) {
-        body += strings[i];
-        if (i < values.length) body += stringify(values[i]);
+  const mw = (async (req, ctx, next) => {
+    currentUser = null;
+    const authHeader = req.headers.get("authorization");
+    if (authHeader?.startsWith("Bearer ")) {
+      const payload = verifyToken(authHeader.slice(7), secret);
+      if (payload?.sub) {
+        currentUser = await findUserById(String(payload.sub));
       }
-      return new Response(body, {
-        headers: { "Content-Type": "text/html; charset=utf-8" }
-      });
     }
-    ctx.ui = {
-      html: Object.assign(htmlTag, { unsafe }),
-      /** SSR 渲染组件 → HTML 片段（HtmlSafe：内联进 ctx.ui.html 不二次转义） */
-      async ssr(Comp, props, opts) {
-        const safe = await ssrToString(Comp, props ?? {}, ctx, opts);
-        return safe;
+    ctx.user = currentUser;
+    ctx.auth = {
+      async register(input) {
+        if (!input.email || !input.password) throw new HttpError("email and password are required", 400);
+        if (input.password.length < 8) throw new HttpError("password must be at least 8 characters", 400);
+        const email2 = normalizeEmail(input.email);
+        const passwordHash = await hashPassword(input.password);
+        const rows = await sql.unsafe(
+          `INSERT INTO ${USERS_TABLE} (email, password_hash, name, role, tenant)
+           VALUES ($1, $2, $3, $4, $5) RETURNING id, email, name, role, tenant`,
+          [email2, passwordHash, input.name ?? null, input.role ?? null, input.tenant ?? null]
+        );
+        const user = rows[0];
+        const session = await issueSession(user);
+        return { ...session, user };
       },
-      /** 序列化 SSR 数据存储 → window.__DATA__ 脚本（HtmlSafe） */
-      ssrData(data) {
-        return new HtmlSafe(serializeData(data));
+      async login(email2, password) {
+        const rows = await sql.unsafe(
+          `SELECT id, email, password_hash, name, role, tenant FROM ${USERS_TABLE} WHERE email = $1`,
+          [normalizeEmail(email2)]
+        );
+        const row = rows[0];
+        if (!row) throw new HttpError("Invalid email or password", 401);
+        const valid = await verifyPassword(password, String(row.password_hash));
+        if (!valid) throw new HttpError("Invalid email or password", 401);
+        const user = {
+          id: String(row.id),
+          email: String(row.email),
+          name: row.name,
+          role: row.role,
+          tenant: row.tenant
+        };
+        const session = await issueSession(user);
+        return { ...session, user };
       },
-      async js(entryPath) {
-        const absPath = resolveEntry(entryPath);
-        const cached = jsCache.get(absPath);
-        if (cached && await jsCacheFresh(cached.inputs)) {
-          return new Response(cached.code, {
-            headers: { "Content-Type": "application/javascript", "Cache-Control": "no-cache" }
-          });
-        }
-        const result = await build({
-          entryPoints: [absPath],
-          bundle: true,
-          format: "esm",
-          platform: "browser",
-          jsx: "automatic",
-          jsxImportSource: "weifuwu/client",
-          write: false,
-          metafile: true
-        });
-        const code = result.outputFiles[0].text;
-        const inputs = {};
-        for (const file of Object.keys(result.metafile?.inputs ?? {})) {
-          const abs = resolve2(file);
-          try {
-            inputs[abs] = (await stat(abs)).mtimeMs;
-          } catch {
-          }
-        }
-        jsCache.set(absPath, { code, inputs });
-        return new Response(code, {
-          headers: { "Content-Type": "application/javascript", "Cache-Control": "no-cache" }
-        });
+      async logout(refreshToken) {
+        await sql.unsafe(`UPDATE ${SESSIONS_TABLE} SET revoked_at = now() WHERE token_hash = $1`, [
+          hashRefreshToken(refreshToken)
+        ]);
       },
-      async css(entryPath) {
-        const absPath = resolveEntry(entryPath);
-        const st = await import("node:fs").then((fs) => fs.promises.stat(absPath));
-        const cached = cssCache.get(absPath);
-        if (cached && cached.mtime === st.mtimeMs) {
-          return new Response(cached.code, {
-            headers: { "Content-Type": "text/css; charset=utf-8", "Cache-Control": "no-cache" }
-          });
-        }
-        let code = await readFile(absPath, "utf-8");
-        if (await checkPostcss()) {
-          try {
-            const postcss = await import("postcss");
-            const tw = await import("@tailwindcss/postcss");
-            const plugin = tw.default || tw;
-            const instance = typeof plugin === "function" ? plugin() : plugin;
-            const result = await postcss.default([instance]).process(code, { from: absPath });
-            code = result.css;
-          } catch (e) {
-            throw new Error(`PostCSS \u7F16\u8BD1\u5931\u8D25 (${absPath}): ${e.message}`, { cause: e });
-          }
-        }
-        cssCache.set(absPath, { code, mtime: st.mtimeMs });
-        return new Response(code, {
-          headers: { "Content-Type": "text/css; charset=utf-8", "Cache-Control": "no-cache" }
-        });
+      requireAuth() {
+        if (!currentUser) throw new HttpError("Unauthorized", 401);
+        return currentUser;
+      },
+      async setPassword(userId, newPassword) {
+        if (newPassword.length < 8) throw new HttpError("password must be at least 8 characters", 400);
+        const passwordHash = await hashPassword(newPassword);
+        await sql.unsafe(`UPDATE ${USERS_TABLE} SET password_hash = $1 WHERE id = $2`, [
+          passwordHash,
+          userId
+        ]);
+      },
+      createToken(type, payload, opts) {
+        return signToken({ type, ...payload }, secret, opts.ttlSeconds);
       }
     };
-    return next(_req, ctx);
+    return next(req, ctx);
+  });
+  mw.__meta = { injects: ["user", "auth"], depends: ["sql"] };
+  mw.migrate = async () => {
+    await sql.unsafe(`
+      CREATE TABLE IF NOT EXISTS ${USERS_TABLE} (
+        id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+        email TEXT NOT NULL UNIQUE,
+        password_hash TEXT NOT NULL,
+        name TEXT,
+        role TEXT,
+        tenant TEXT,
+        email_verified BOOLEAN NOT NULL DEFAULT false,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )
+    `);
+    await sql.unsafe(`
+      CREATE TABLE IF NOT EXISTS ${SESSIONS_TABLE} (
+        token_hash TEXT PRIMARY KEY,
+        user_id UUID NOT NULL REFERENCES ${USERS_TABLE}(id) ON DELETE CASCADE,
+        expires_at TIMESTAMPTZ NOT NULL,
+        revoked_at TIMESTAMPTZ,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+      )
+    `);
+  };
+  mw.routes = (app, routeOpts) => {
+    const p = routeOpts?.prefix ?? prefix;
+    app.post(`${p}/register`, async (req, ctx) => {
+      const body = await req.json().catch(() => ({}));
+      const result = await ctx.auth.register(body);
+      return created(result);
+    });
+    app.post(`${p}/login`, async (req, ctx) => {
+      const body = await req.json().catch(() => ({}));
+      if (!body.email || !body.password) return badRequest("email and password are required");
+      const result = await ctx.auth.login(body.email, body.password);
+      return ok(result);
+    });
+    app.post(`${p}/logout`, async (req, ctx) => {
+      const body = await req.json().catch(() => ({}));
+      if (!body.refreshToken) return badRequest("refreshToken is required");
+      await ctx.auth.logout(body.refreshToken);
+      return noContent();
+    });
+    app.post(`${p}/refresh`, async (req, ctx) => {
+      const body = await req.json().catch(() => ({}));
+      if (!body.refreshToken) throw new HttpError("refreshToken is required", 400);
+      const user = await consumeRefreshToken(body.refreshToken);
+      await ctx.auth.logout(body.refreshToken);
+      const session = await issueSession(user);
+      return ok({ ...session, user });
+    });
+    app.get(`${p}/me`, async (_req, ctx) => {
+      if (!ctx.user) throw new HttpError("Unauthorized", 401);
+      return ok(ctx.user);
+    });
   };
+  return mw;
 }
 
-// src/client/route-match.ts
-function joinPaths(a, b) {
-  if (!b || b === "/") return a || "/";
-  const left = a.endsWith("/") ? a.slice(0, -1) : a;
-  const right = b.startsWith("/") ? b : "/" + b;
-  return left + right;
-}
-function compilePath(path) {
-  const keys = [];
-  const reStr = path.replace(/:(\w+)/g, (_, key) => {
-    keys.push(key);
-    return "([^/]+)";
-  }).replace(/\*/g, ".*");
-  return { re: new RegExp(`^${reStr}$`), keys };
-}
-function flattenRoutes(routes, basePath = "", chain = []) {
-  const result = [];
-  for (const route of routes) {
-    const fullPath = joinPaths(basePath, route.path);
-    const { re, keys } = compilePath(fullPath);
-    const fullChain = [...chain, route];
-    result.push({ re, keys, def: route, chain: fullChain });
-    if (route.children) {
-      result.push(...flattenRoutes(route.children, fullPath, fullChain));
-    }
-  }
-  return result;
-}
-function matchRoute(path, routes) {
-  let best = null;
-  for (const fr of routes) {
-    if (path.match(fr.re)) {
-      if (!best || fr.chain.length > best.chain.length) best = fr;
-    }
-  }
-  return best;
-}
-function extractParams(path, match) {
-  const params = {};
-  const m = path.match(match.re);
-  if (m) {
-    for (let i = 0; i < match.keys.length; i++) {
-      params[match.keys[i]] = decodeURIComponent(m[i + 1]);
-    }
-  }
-  return params;
-}
+// src/queue/index.ts
+import { randomUUID } from "node:crypto";
+import { hostname } from "node:os";
 
-// src/ui/ssr-page.ts
-var DEFAULT_TEMPLATE = (p) => `<!DOCTYPE html>
-<html lang="zh-CN">
-<head>
-  <meta charset="UTF-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>${escapeHtml(p.title)}</title>
-  ${(p.styles ?? []).map((s) => `<link rel="stylesheet" href="${escapeHtml(s)}">`).join("\n  ")}
-</head>
-<body>
-  <div id="root">${p.html}</div>
-  ${p.dataScript}
-  ${p.bundle ? `<script src="${escapeHtml(p.bundle)}"></script>` : ""}
-</body>
-</html>`;
-function escapeHtml(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-}
-function uiSsr(opts) {
-  const flatRoutes = flattenRoutes(opts.routes);
-  const template = opts.template ?? DEFAULT_TEMPLATE;
-  return async (req, ctx, next) => {
-    if (req.method !== "GET") return next(req, ctx);
-    const url = new URL(req.url);
-    const match = matchRoute(url.pathname, flatRoutes);
-    if (!match) return next(req, ctx);
-    const params = extractParams(url.pathname, match);
-    const def = match.chain[match.chain.length - 1] ?? match.def;
-    const pageCtx = Object.assign(Object.create(ctx), {
-      params,
-      route: { path: url.pathname, params, query: Object.fromEntries(url.searchParams) }
-    });
-    if (!def.component) return next(req, ctx);
-    const data = /* @__PURE__ */ new Map();
-    const html = await ssrToString(def.component, {}, pageCtx, { data });
-    const title = opts.title ? opts.title({ params, def }) : def.title || "weifuwu";
-    const dataScript = new HtmlSafe(serializeData(data)).toString();
-    const body = template({ html: html.toString(), dataScript, title, bundle: opts.bundle, styles: opts.styles });
-    return new Response(body, {
-      headers: { "Content-Type": "text/html; charset=utf-8" }
-    });
-  };
-}
+// src/db/redis/connection.ts
+import net2 from "node:net";
 
-// src/db/postgres/connection.ts
-import net from "node:net";
-import crypto2 from "node:crypto";
+// src/db/errors.ts
+var DbError = class extends Error {
+  kind;
+  code;
+  cause;
+  constructor(kind, message, options) {
+    super(message);
+    this.name = "DbError";
+    this.kind = kind;
+    this.code = options?.code;
+    this.cause = options?.cause;
+  }
+};
+var ConnectionError = class extends DbError {
+  attempts;
+  constructor(message, attempts = 1, cause) {
+    super("connection", message, { cause });
+    this.name = "ConnectionError";
+    this.attempts = attempts;
+  }
+};
+var TimeoutError = class extends DbError {
+  operation;
+  ms;
+  constructor(operation, ms) {
+    super("timeout", `${operation} timed out after ${ms}ms`);
+    this.name = "TimeoutError";
+    this.operation = operation;
+    this.ms = ms;
+  }
+};
+var ValidationError = class extends DbError {
+  constructor(message) {
+    super("validation", message);
+    this.name = "ValidationError";
+  }
+};
 
-// src/db/postgres/protocol.ts
-function encodeMessage(type, payload) {
-  const out = new Uint8Array(1 + 4 + payload.length);
-  out[0] = type.charCodeAt(0);
-  const len = 4 + payload.length;
-  out[1] = len >> 24 & 255;
-  out[2] = len >> 16 & 255;
-  out[3] = len >> 8 & 255;
-  out[4] = len & 255;
-  out.set(payload, 5);
-  return out;
-}
-function startupMessage(params) {
-  const body = [];
-  body.push(0, 3, 0, 0);
-  for (const [k, v] of Object.entries(params)) {
-    for (const c of utf8(k)) body.push(c);
-    body.push(0);
-    for (const c of utf8(v)) body.push(c);
-    body.push(0);
+// src/db/redis/resp.ts
+var RespError = class extends DbError {
+  constructor(message) {
+    super("protocol", message, { code: "RESP" });
+    this.name = "RespError";
   }
-  body.push(0);
-  const out = new Uint8Array(4 + body.length);
-  const len = 4 + body.length;
-  out[0] = len >> 24 & 255;
-  out[1] = len >> 16 & 255;
-  out[2] = len >> 8 & 255;
-  out[3] = len & 255;
-  out.set(body, 4);
-  return out;
-}
-function queryMessage(sql) {
-  return encodeMessage("Q", concat(utf8(sql), new Uint8Array([0])));
-}
-function parseMessage(name, sql, paramTypes = []) {
-  const body = concat(utf8(name), new Uint8Array([0]), utf8(sql), new Uint8Array([0]));
-  const types = new Uint8Array(2 + paramTypes.length * 4);
-  types[0] = paramTypes.length >> 8 & 255;
-  types[1] = paramTypes.length & 255;
-  paramTypes.forEach((oid, i) => {
-    const off = 2 + i * 4;
-    types[off] = oid >> 24 & 255;
-    types[off + 1] = oid >> 16 & 255;
-    types[off + 2] = oid >> 8 & 255;
-    types[off + 3] = oid & 255;
-  });
-  return encodeMessage("P", concat(body, types));
+};
+var IncompleteError = class extends Error {
+  constructor() {
+    super("incomplete RESP message");
+    this.name = "IncompleteError";
+  }
+};
+function decodeValue(v, decodeBytes) {
+  if (v instanceof Uint8Array) return decodeBytes ? _decoder.decode(v) : v;
+  if (Array.isArray(v)) return v.map((x) => decodeValue(x, decodeBytes));
+  return v;
 }
-function bindMessage(statement, params, paramFormats = []) {
-  const body = [...utf8(""), 0, ...utf8(statement), 0];
-  body.push(0, paramFormats.length);
-  for (const f of paramFormats) {
-    body.push(f >> 8 & 255, f & 255);
+function encodeCommand(args) {
+  const lens = new Array(args.length);
+  let total = headerLen(args.length);
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    const len = typeof arg === "string" ? Buffer.byteLength(arg) : arg instanceof Buffer ? arg.length : String(arg).length;
+    lens[i] = len;
+    total += headerLen(len) + len + 2;
   }
-  body.push(0, params.length);
-  for (const p of params) {
-    if (p === null) {
-      body.push(255, 255, 255, 255);
+  const out = new Uint8Array(total);
+  let off = 0;
+  const head = `*${args.length}\r
+`;
+  out.set(_encoder.encode(head), 0);
+  off = head.length;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    const len = lens[i];
+    const lh = `$${len}\r
+`;
+    out.set(_encoder.encode(lh), off);
+    off += lh.length;
+    if (typeof arg === "string") {
+      out.set(_encoder.encode(arg), off);
+    } else if (arg instanceof Buffer) {
+      out.set(arg, off);
     } else {
-      const bytes = typeof p === "string" ? utf8(p) : p;
-      body.push(bytes.length >> 24 & 255, bytes.length >> 16 & 255, bytes.length >> 8 & 255, bytes.length & 255);
-      for (const b of bytes) body.push(b);
+      out.set(_encoder.encode(String(arg)), off);
     }
+    off += len;
+    out[off] = 13;
+    out[off + 1] = 10;
+    off += 2;
   }
-  body.push(0, 0);
-  return encodeMessage("B", new Uint8Array(body));
-}
-function executeMessage(portal = "", maxRows = 0) {
-  const body = new Uint8Array(portal.length + 1 + 4);
-  body.set(utf8(portal), 0);
-  body[portal.length] = 0;
-  const off = portal.length + 1;
-  body[off] = maxRows >> 24 & 255;
-  body[off + 1] = maxRows >> 16 & 255;
-  body[off + 2] = maxRows >> 8 & 255;
-  body[off + 3] = maxRows & 255;
-  return encodeMessage("E", body);
-}
-function syncMessage() {
-  return encodeMessage("S", new Uint8Array(0));
-}
-function flushMessage() {
-  return encodeMessage("H", new Uint8Array(0));
-}
-function describeMessage(kind, name = "") {
-  return encodeMessage("D", concat(utf8(kind), utf8(name), new Uint8Array([0])));
-}
-function terminateMessage() {
-  return encodeMessage("X", new Uint8Array(0));
+  return out;
 }
-function passwordMessage(password) {
-  return encodeMessage("p", utf8(password));
+function headerLen(n) {
+  if (n < 10) return 4;
+  if (n < 100) return 5;
+  if (n < 1e3) return 6;
+  if (n < 1e4) return 7;
+  return 8;
 }
-var MessageStream = class {
+var _decoder = new TextDecoder();
+var _encoder = new TextEncoder();
+var RespParser = class {
   buf = new Uint8Array(0);
   off = 0;
+  /** 喂入数据分片。返回 { value, incomplete }；incomplete=true 时需继续喂。 */
   push(chunk) {
+    this.append(chunk);
+    const saved = this.off;
+    try {
+      const value = this.parseValue();
+      this.compact();
+      return { value, incomplete: false };
+    } catch (e) {
+      this.off = saved;
+      if (e instanceof IncompleteError) return { value: null, incomplete: true };
+      throw e;
+    }
+  }
+  /** 喂入分片并解析 buffer 中所有完整响应（连接层：一次 data 事件可能含多个回复） */
+  pushAll(chunk) {
     this.append(chunk);
     const out = [];
     while (true) {
       const saved = this.off;
-      const msg = this.tryRead();
-      if (!msg) {
+      try {
+        out.push(this.parseValue());
+      } catch (e) {
         this.off = saved;
-        break;
+        if (e instanceof IncompleteError) break;
+        throw e;
       }
-      out.push(msg);
     }
     if (out.length > 0) this.compact();
     return out;
@@ -1644,6 +1820,7 @@ var MessageStream = class {
     this.buf = merged;
     this.off = 0;
   }
+  /** 全部消费后压缩（释放底层） */
   compact() {
     if (this.off === this.buf.length) {
       this.buf = new Uint8Array(0);
@@ -1653,1011 +1830,1339 @@ var MessageStream = class {
       this.off = 0;
     }
   }
-  /** 尝试读一条完整消息；不完整返回 null（不消费） */
-  tryRead() {
-    if (this.buf.length - this.off < 5) return null;
-    const len = this.buf[this.off + 1] << 24 | this.buf[this.off + 2] << 16 | this.buf[this.off + 3] << 8 | this.buf[this.off + 4];
-    if (this.buf.length - this.off < 1 + len) return null;
+  parseValue() {
+    if (this.buf.length - this.off < 3) throw new IncompleteError();
     const type = String.fromCharCode(this.buf[this.off]);
-    const payload = this.buf.subarray(this.off + 5, this.off + 1 + len);
-    this.off += 1 + len;
-    return { type, payload };
+    this.off++;
+    switch (type) {
+      case "+": {
+        const line = this.readLine();
+        return line;
+      }
+      case "-": {
+        const line = this.readLine();
+        return new RespError(line);
+      }
+      case ":": {
+        return this.readInt();
+      }
+      case "$": {
+        const len = this.readInt();
+        if (len === -1) return null;
+        return this.readBulkBytes(len);
+      }
+      case "*": {
+        const count = this.readInt();
+        if (count === -1) return null;
+        const items = [];
+        for (let i = 0; i < count; i++) items.push(this.parseValue());
+        return items;
+      }
+      default:
+        throw new DbError("protocol", `unknown RESP type byte: ${type}`, { code: "RESP" });
+    }
+  }
+  /**
+   * 读整数（: 或 $ 长度）：扫描数字字符边算值，直到 \r\n（手动解析，免 parseInt + 字符串）。
+   * 支持负号（-1）。未读到终止符抛 IncompleteError（push 回滚）。
+   */
+  readInt() {
+    const buf = this.buf;
+    let i = this.off;
+    let neg = false;
+    if (i < buf.length && buf[i] === 45) {
+      neg = true;
+      i++;
+    }
+    let n = 0;
+    while (i < buf.length && buf[i] >= 48 && buf[i] <= 57) {
+      n = n * 10 + (buf[i] - 48);
+      i++;
+    }
+    if (i + 1 < buf.length && buf[i] === 13 && buf[i + 1] === 10) {
+      this.off = i + 2;
+      return neg ? -n : n;
+    }
+    throw new IncompleteError();
+  }
+  /** 读一行（到 \r\n），返回行内容（不含 type 字节与 \r\n），并推进 off */
+  readLine() {
+    const idx = indexOfCRLF(this.buf, this.off);
+    if (idx === -1) throw new IncompleteError();
+    const line = _decoder.decode(this.buf.subarray(this.off, idx));
+    this.off = idx + 2;
+    return line;
+  }
+  /** 读 len 字节的 bulk 内容 + \r\n（字节中立——不 decode，由调用方决定 string/Buffer） */
+  readBulkBytes(len) {
+    if (this.buf.length - this.off < len + 2) throw new IncompleteError();
+    const value = this.buf.subarray(this.off, this.off + len);
+    this.off += len + 2;
+    return value;
   }
 };
-function authCode(msg) {
-  if (msg.type !== "R" || msg.payload.length < 4) return -1;
-  return msg.payload[0] << 24 | msg.payload[1] << 16 | msg.payload[2] << 8 | msg.payload[3];
-}
-function parseRowDescription(payload) {
-  const count = payload[0] << 8 | payload[1];
-  const cols = [];
-  let i = 2;
-  for (let c = 0; c < count; c++) {
-    let j = i;
-    while (payload[j] !== 0) j++;
-    const name = new TextDecoder().decode(payload.subarray(i, j));
-    i = j + 1;
-    i += 6;
-    const typeOid = payload[i] << 24 | payload[i + 1] << 16 | payload[i + 2] << 8 | payload[i + 3];
-    i += 4;
-    const typeLen = payload[i] << 8 | payload[i + 1];
-    i += 2;
-    i += 6;
-    cols.push({ name, typeOid, typeLen });
-  }
-  return cols;
-}
-function parseDataRow(payload) {
-  const count = payload[0] << 8 | payload[1];
-  const values = [];
-  let i = 2;
-  for (let c = 0; c < count; c++) {
-    const len = payload[i] << 24 | payload[i + 1] << 16 | payload[i + 2] << 8 | payload[i + 3];
-    i += 4;
-    if (len === -1) {
-      values.push(null);
-    } else {
-      values.push(new TextDecoder().decode(payload.subarray(i, i + len)));
-      i += len;
-    }
-  }
-  return values;
-}
-function parseErrorFields(payload) {
-  const out = {};
-  let i = 0;
-  while (i < payload.length && payload[i] !== 0) {
-    const type = String.fromCharCode(payload[i]);
-    let j = i + 1;
-    while (j < payload.length && payload[j] !== 0) j++;
-    const value = new TextDecoder().decode(payload.subarray(i + 1, j));
-    switch (type) {
-      case "S":
-        out.severity = value;
-        break;
-      case "C":
-        out.code = value;
-        break;
-      case "M":
-        out.message = value;
-        break;
-      case "D":
-        out.detail = value;
-        break;
-      case "H":
-        out.hint = value;
-        break;
-      case "P":
-        out.position = value;
-        break;
-    }
-    i = j + 1;
-  }
-  return out;
-}
-function utf8(s) {
-  return new TextEncoder().encode(s);
-}
-function concat(...parts) {
-  let total = 0;
-  for (const p of parts) total += p.length;
-  const out = new Uint8Array(total);
-  let off = 0;
-  for (const p of parts) {
-    out.set(p, off);
-    off += p.length;
+function indexOfCRLF(buf, from = 0) {
+  let i = buf.indexOf(13, from);
+  while (i !== -1) {
+    if (i + 1 < buf.length && buf[i + 1] === 10) return i;
+    i = buf.indexOf(13, i + 1);
   }
-  return out;
+  return -1;
 }
 
-// src/db/errors.ts
-var DbError = class extends Error {
-  kind;
-  code;
-  cause;
-  constructor(kind, message, options) {
-    super(message);
-    this.name = "DbError";
-    this.kind = kind;
-    this.code = options?.code;
-    this.cause = options?.cause;
-  }
-};
-var ConnectionError = class extends DbError {
-  attempts;
-  constructor(message, attempts = 1, cause) {
-    super("connection", message, { cause });
-    this.name = "ConnectionError";
-    this.attempts = attempts;
-  }
-};
-var TimeoutError = class extends DbError {
-  operation;
-  ms;
-  constructor(operation, ms) {
-    super("timeout", `${operation} timed out after ${ms}ms`);
-    this.name = "TimeoutError";
-    this.operation = operation;
-    this.ms = ms;
-  }
-};
-var ValidationError = class extends DbError {
-  constructor(message) {
-    super("validation", message);
-    this.name = "ValidationError";
-  }
-};
-
-// src/db/postgres/connection.ts
-var PgConnection = class {
+// src/db/redis/connection.ts
+var PUSH_TYPES = /* @__PURE__ */ new Set(["message", "pmessage"]);
+var RedisConnection = class {
+  ready = false;
   opts;
-  timeoutSet = false;
-  awaitingReady = false;
-  pendingErrorZ = false;
   socket = null;
-  stream = new MessageStream();
+  parser = new RespParser();
+  pending = [];
+  /** pending 头指针（避免 shift() O(n)——消费后定期 compact） */
+  pendingHead = 0;
+  offlineQueue = [];
+  subs = /* @__PURE__ */ new Map();
+  psubs = /* @__PURE__ */ new Map();
   status = "idle";
-  waiters = [];
+  retries = 0;
+  reconnectTimer = null;
+  connectPromise = null;
+  closed = false;
+  connectedOnce = false;
   constructor(options = {}) {
     this.opts = {
       host: options.host ?? "127.0.0.1",
-      port: options.port ?? 5432,
-      user: options.user ?? "postgres",
-      database: options.database ?? "postgres",
-      connectTimeoutMs: options.connectTimeoutMs ?? 1e4,
-      statementTimeoutMs: options.statementTimeoutMs ?? 0,
-      password: options.password
+      port: options.port ?? 6379,
+      retryDelayMs: options.retryDelayMs ?? 100,
+      maxRetries: options.maxRetries ?? 10,
+      enableOfflineQueue: options.enableOfflineQueue ?? true,
+      maxOfflineQueue: options.maxOfflineQueue ?? 5e3
     };
   }
-  get connected() {
-    return this.status === "ready";
-  }
+  /** 建立连接并等待 ready。重连失败（超过 maxRetries）抛 ConnectionError。 */
   connect() {
-    return new Promise((resolve3, reject) => {
-      this.status = "connecting";
-      const sock = net.connect(this.opts.port, this.opts.host);
-      this.socket = sock;
-      const timeout = setTimeout(() => {
-        sock.destroy();
-        reject(new ConnectionError(`postgres: connect timeout after ${this.opts.connectTimeoutMs}ms`));
-      }, this.opts.connectTimeoutMs);
-      sock.once("connect", () => {
-        sock.setNoDelay(true);
-        sock.write(
-          Buffer.from(
-            startupMessage({ user: this.opts.user, database: this.opts.database })
-          )
-        );
-      });
-      sock.on("data", (chunk) => this.onData(chunk));
-      sock.on("error", (err) => {
-        clearTimeout(timeout);
-        if (this.status === "connecting") {
-          reject(new ConnectionError(`postgres: ${err.message}`));
-        }
-      });
-      sock.on("close", () => {
-        clearTimeout(timeout);
-        this.socket = null;
-        if (this.status !== "closed") {
-          this.status = "closed";
-          const q = this.currentQuery;
-          this.currentQuery = null;
-          if (q) q.reject(new ConnectionError("postgres: connection closed"));
-        }
-      });
-      this.onReady = () => {
-        clearTimeout(timeout);
-        this.status = "ready";
-        resolve3();
-      };
-      this.onAuthFail = (err) => {
-        clearTimeout(timeout);
-        reject(err);
-      };
+    if (this.connectPromise) return this.connectPromise;
+    this.closed = false;
+    this.connectPromise = new Promise((resolve3, reject) => {
+      this.openSocket();
+      this.onceReady = () => resolve3();
+      this.onceFailed = (err) => reject(err);
+    }).finally(() => {
+      this.connectPromise = null;
+      this.onceReady = void 0;
+      this.onceFailed = void 0;
     });
+    return this.connectPromise;
   }
-  onReady = null;
-  onAuthFail = null;
-  expectingAuth = true;
-  authStage = "start";
-  authCtx = null;
-  prepared = /* @__PURE__ */ new Map();
-  // sig → stmt + 列缓存
-  stmtSeq = 0;
-  currentQuery = null;
-  onData(chunk) {
-    const msgs = this.stream.push(new Uint8Array(chunk));
-    for (const msg of msgs) {
-      this.handle(msg);
+  onceReady;
+  onceFailed;
+  openSocket() {
+    this.status = "connecting";
+    const sock = net2.connect(this.opts.port, this.opts.host);
+    this.socket = sock;
+    sock.on("connect", () => {
+      sock.setNoDelay(true);
+      this.status = "ready";
+      this.retries = 0;
+      this.flushOffline();
+      this.onceReady?.();
+      if (this.connectedOnce) {
+        for (const ch of this.subs.keys()) this.sendNow("SUBSCRIBE", [ch]);
+        for (const pat of this.psubs.keys()) this.sendNow("PSUBSCRIBE", [pat]);
+      }
+      this.connectedOnce = true;
+    });
+    sock.on("data", (chunk) => this.onData(new Uint8Array(chunk)));
+    sock.on("error", (err) => {
+      if (this.status === "connecting") {
+        this.handleDisconnect(err);
+      }
+    });
+    sock.on("close", () => {
+      this.socket = null;
+      if (this.status !== "closed" && this.status !== "idle") {
+        this.handleDisconnect(new ConnectionError("redis: socket closed"));
+      }
+    });
+  }
+  handleDisconnect(err) {
+    const queue2 = this.pending.slice(this.pendingHead);
+    this.pending = [];
+    this.pendingHead = 0;
+    for (const p of queue2) p.reject(err);
+    if (this.closed || this.status === "closed") return;
+    this.retries++;
+    if (this.opts.maxRetries > 0 && this.retries > this.opts.maxRetries) {
+      this.status = "closed";
+      const failErr = err instanceof ConnectionError ? err : new ConnectionError(`redis: connect to ${this.opts.host}:${this.opts.port} failed`, this.retries, err);
+      this.onceFailed?.(failErr);
+      return;
     }
+    const delay = Math.min(this.opts.retryDelayMs * 2 ** (this.retries - 1), 5e3);
+    this.reconnectTimer = setTimeout(() => {
+      this.reconnectTimer = null;
+      this.openSocket();
+    }, delay);
   }
-  handle(msg) {
-    if (this.expectingAuth) {
-      if (msg.type === "R") {
-        const code = authCode(msg);
-        if (code === 0) {
-        } else if (code === 3) {
-          this.send(passwordMessage(this.opts.password ?? ""));
-        } else if (code === 5) {
-          const salt = msg.payload.subarray(8, 12);
-          const inner = crypto2.createHash("md5").update(this.opts.password + this.opts.user).digest("hex");
-          const outer = crypto2.createHash("md5").update(inner + Buffer.from(salt).toString("latin1")).digest("hex");
-          this.send(passwordMessage(`md5${outer}`));
-        } else if (code === 10) {
-          this.authStage = "sasl-initial";
-          const nonce = crypto2.randomBytes(18).toString("base64url");
-          const clientFirstBare = `n=,r=${nonce}`;
-          this.authCtx = { clientNonce: nonce, clientFirstBare, serverFirst: "" };
-          const mech = utf82("SCRAM-SHA-256\0");
-          const resp = utf82(`n,,${clientFirstBare}`);
-          const payload = new Uint8Array(mech.length + 4 + resp.length);
-          payload.set(mech, 0);
-          payload[mech.length] = resp.length >> 24 & 255;
-          payload[mech.length + 1] = resp.length >> 16 & 255;
-          payload[mech.length + 2] = resp.length >> 8 & 255;
-          payload[mech.length + 3] = resp.length & 255;
-          payload.set(resp, mech.length + 4);
-          this.send(encodeP(payload));
-        } else if (code === 11) {
-          const serverFirst = new TextDecoder().decode(msg.payload.subarray(4));
-          if (!this.authCtx) {
-            this.onAuthFail?.(new ConnectionError("postgres: unexpected SASL continue"));
-            return;
-          }
-          this.authCtx.serverFirst = serverFirst;
-          const clientFinal = this.scramFinal(this.authCtx);
-          this.authStage = "sasl-final";
-          this.send(encodeP(utf82(clientFinal)));
-        } else if (code === 12) {
-          const serverFinal = new TextDecoder().decode(msg.payload.subarray(4));
-          const vMatch = serverFinal.match(/v=([A-Za-z0-9+/=]+)/);
-          if (vMatch && this.authCtx) {
-            const expected = this.scramServerSignature(this.authCtx);
-            if (vMatch[1] !== expected) {
-              this.onAuthFail?.(new ConnectionError("postgres: SCRAM server signature mismatch"));
-              return;
-            }
-          }
+  onData(chunk) {
+    try {
+      const values = this.parser.pushAll(chunk);
+      for (const raw of values) {
+        const first = Array.isArray(raw) && raw.length > 0 ? decodeValue(raw[0], true) : void 0;
+        if (typeof first === "string" && PUSH_TYPES.has(first)) {
+          this.dispatchSubscribe(decodeValue(raw, true));
+          continue;
         }
-        return;
+        const p = this.pending[this.pendingHead++];
+        if (!p) break;
+        if (raw instanceof RespError) p.reject(raw);
+        else p.resolve(decodeValue(raw, !p.asBuffer));
       }
-      if (msg.type === "E") {
-        const fields = parseErrorFields(msg.payload);
-        this.expectingAuth = false;
-        this.onAuthFail?.(new ConnectionError(`postgres: auth failed: ${fields.message ?? "unknown"}`));
-        this.socket?.destroy();
-        return;
+      if (this.pendingHead > 64 && this.pendingHead * 2 > this.pending.length) {
+        this.pending = this.pending.slice(this.pendingHead);
+        this.pendingHead = 0;
       }
-      if (msg.type === "Z") {
-        this.expectingAuth = false;
-        if (this.opts.statementTimeoutMs > 0 && !this.timeoutSet) {
-          this.timeoutSet = true;
-          this.awaitingReady = true;
-          this.socket?.write(
-            Buffer.from(queryMessage(`SET statement_timeout = ${this.opts.statementTimeoutMs}`))
-          );
-          return;
-        }
-        this.onReady?.();
-        return;
-      }
-      return;
+    } catch (e) {
+      const queue2 = this.pending.slice(this.pendingHead);
+      this.pending = [];
+      this.pendingHead = 0;
+      for (const q of queue2) q.reject(e);
+      this.socket?.destroy();
     }
-    switch (msg.type) {
-      case "T": {
-        if (this.currentQuery) {
-          this.currentQuery.columns = parseRowDescription(msg.payload);
-          const entry = this.prepared.get(
-            `${this.currentQuery.sql}|${this.currentQuery.params?.length ?? 0}`
-          );
-          if (entry) entry.columns = this.currentQuery.columns;
-        }
-        break;
-      }
-      case "D": {
-        const values = parseDataRow(msg.payload);
-        if (this.currentQuery && this.currentQuery.columns) {
-          const row = {};
-          this.currentQuery.columns.forEach((col, i) => {
-            row[col.name] = convertValue(col.typeOid, values[i] ?? null);
-          });
-          this.currentQuery.rows.push(row);
-        }
-        break;
-      }
-      case "C":
-        break;
-      // CommandComplete——忽略 tag
-      case "t": {
-        if (this.currentQuery?.awaitingDescribe && this.currentQuery.sql !== void 0) {
-          this.currentQuery.awaitingDescribe = false;
-          if (this.currentQuery.prepKey && this.currentQuery.prepName) {
-            this.prepared.set(this.currentQuery.prepKey, {
-              name: this.currentQuery.prepName,
-              columns: this.currentQuery.columns
-            });
+  }
+  /**
+   * 发送命令并等待响应（单连接严格有序）。未 ready 时入离线队列（enableOfflineQueue）或拒绝。
+   * opts.asBuffer=true：响应保留原始字节（Uint8Array）——getBuffer 等二进制场景。
+   */
+  command(name, ...args) {
+    const last = args[args.length - 1];
+    const opts = typeof last === "object" && last !== null && !(last instanceof Uint8Array) ? args.pop() : void 0;
+    if (this.status === "ready" && this.socket) {
+      return this.sendNow(name, args, opts?.asBuffer);
+    }
+    if (this.closed || this.status === "closed" || !this.opts.enableOfflineQueue) {
+      return Promise.reject(new ConnectionError("redis: not connected"));
+    }
+    if (this.offlineQueue.length >= this.opts.maxOfflineQueue) {
+      return Promise.reject(new ConnectionError(`redis: offline queue full (${this.opts.maxOfflineQueue})`));
+    }
+    return new Promise((resolve3, reject) => {
+      this.offlineQueue.push({ name, args, resolve: resolve3, reject, asBuffer: opts?.asBuffer });
+    });
+  }
+  sendNow(name, args, asBuffer) {
+    return new Promise((resolve3, reject) => {
+      this.pending.push({ resolve: resolve3, reject, asBuffer });
+      this.socket.write(encodeCommand([name, ...args]));
+    });
+  }
+  flushOffline() {
+    const queue2 = this.offlineQueue;
+    this.offlineQueue = [];
+    for (const q of queue2) {
+      this.sendNow(q.name, q.args, q.asBuffer).then(q.resolve, q.reject);
+    }
+  }
+  /** 批量执行：一次 write 发送所有命令字节，响应按序路由（管道） */
+  batch(payload, count) {
+    if (this.status !== "ready" || !this.socket) {
+      return Promise.reject(new ConnectionError("redis: not connected"));
+    }
+    return new Promise((resolve3, reject) => {
+      const results = [];
+      const maybeResolve = () => {
+        if (results.length === count) resolve3(results);
+      };
+      for (let i = 0; i < count; i++) {
+        this.pending.push({
+          // 正常响应与错误响应（RespError）都作为结果值收集——管道语义
+          resolve: (v) => {
+            results.push(v);
+            maybeResolve();
+          },
+          reject: (e) => {
+            results.push(e);
+            maybeResolve();
           }
-          this.send(bindMessage(this.currentQuery.prepName ?? "", this.currentQuery.params ?? []));
-          this.send(executeMessage());
-          this.send(syncMessage());
-        }
-        break;
-      }
-      case "Z": {
-        if (this.pendingErrorZ) {
-          this.pendingErrorZ = false;
-          break;
-        }
-        const q = this.currentQuery;
-        this.currentQuery = null;
-        if (q) q.resolve(q.rows);
-        if (this.awaitingReady) {
-          this.awaitingReady = false;
-          this.onReady?.();
-        }
-        this.notifyIdle();
-        break;
-      }
-      case "E": {
-        const fields = parseErrorFields(msg.payload);
-        const q = this.currentQuery;
-        this.currentQuery = null;
-        if (q) {
-          this.pendingErrorZ = true;
-          if (q.awaitingDescribe) this.send(syncMessage());
-          const err = new Error(fields.message ?? "postgres query error");
-          err.code = fields.code;
-          q.reject(err);
-        }
-        break;
+        });
       }
-      case "N":
-        break;
-      // NoticeResponse 忽略
-      default:
-        break;
+      this.socket.write(payload);
+    });
+  }
+  /** 订阅频道：回调式（channel, message） */
+  async subscribe(channel, fn) {
+    this.subs.set(channel, fn);
+    await this.command("SUBSCRIBE", channel);
+  }
+  /** 订阅模式：回调式（channel, message） */
+  async psubscribe(pattern, fn) {
+    this.psubs.set(pattern, fn);
+    await this.command("PSUBSCRIBE", pattern);
+  }
+  /** 旁路分发订阅消息（RESP 数组路由到回调） */
+  dispatchSubscribe(value) {
+    const [type, a, b] = value;
+    if (type === "message") {
+      const fn = this.subs.get(a);
+      fn?.(a, b);
+    } else if (type === "pmessage") {
+      const fn = this.psubs.get(a);
+      fn?.(b, value[3] ?? "");
+    }
+  }
+  /** 主动关闭——不再重连 */
+  async close() {
+    this.closed = true;
+    this.status = "closed";
+    if (this.reconnectTimer) {
+      clearTimeout(this.reconnectTimer);
+      this.reconnectTimer = null;
+    }
+    const queue2 = this.pending.slice(this.pendingHead);
+    this.pending = [];
+    this.pendingHead = 0;
+    for (const p of queue2) p.reject(new ConnectionError("redis: connection closed"));
+    const oq = this.offlineQueue;
+    this.offlineQueue = [];
+    for (const q of oq) q.reject(new ConnectionError("redis: connection closed"));
+    const sock = this.socket;
+    this.socket = null;
+    sock?.destroy();
+  }
+  get connected() {
+    return this.status === "ready";
+  }
+};
+
+// src/db/redis/client.ts
+var RedisClient = class _RedisClient {
+  conn;
+  constructor(conn) {
+    this.conn = conn;
+  }
+  /** 建立连接并返回就绪的客户端 */
+  static async connect(options = {}) {
+    const conn = new RedisConnection(options);
+    await conn.connect();
+    return new _RedisClient(conn);
+  }
+  /** 底层命令透传（RESP 值）；Buffer 参数字节原样发送 */
+  command(name, ...args) {
+    return this.conn.command(name, ...args);
+  }
+  // ── 基础命令 ──────────────────────────────
+  async get(key) {
+    const v = await this.conn.command("GET", key);
+    return v === null ? null : String(v);
+  }
+  /**
+   * 二进制安全读取：返回原始字节（Uint8Array），不经过字符串解码。
+   * 用于缓存二进制 payload（序列化字节、图片等）。key 不存在返回 null。
+   */
+  async getBuffer(key) {
+    const v = await this.conn.command("GET", key, { asBuffer: true });
+    if (v === null) return null;
+    return v instanceof Uint8Array ? v : new TextEncoder().encode(String(v));
+  }
+  /**
+   * SET。ttl 秒可省略；传入即安全生效（内部转 SET key val EX ttl）。
+   */
+  async set(key, value, ttl) {
+    const reply = ttl !== void 0 ? await this.conn.command("SET", key, value, "EX", ttl) : await this.conn.command("SET", key, value);
+    return String(reply);
+  }
+  /** DEL 多 key，返回删除数量 */
+  async del(...keys) {
+    const v = await this.conn.command("DEL", ...keys);
+    return Number(v);
+  }
+  /** INCR，返回自增后的值 */
+  async incr(key) {
+    return Number(await this.conn.command("INCR", key));
+  }
+  /** EXPIRE，返回 1=设置成功 0=key 不存在 */
+  async expire(key, seconds) {
+    return Number(await this.conn.command("EXPIRE", key, seconds));
+  }
+  /** TTL 剩余秒数；-1=无 TTL -2=key 不存在 */
+  async ttl(key) {
+    return Number(await this.conn.command("TTL", key));
+  }
+  // ── JSON 存取（自动序列化） ────────────────
+  /** 读取并 JSON.parse；key 不存在返回 null */
+  async jsonGet(key) {
+    const raw = await this.conn.command("GET", key);
+    if (raw === null) return null;
+    try {
+      return JSON.parse(String(raw));
+    } catch {
+      throw new ValidationError(`redis: value of key '${key}' is not valid JSON`);
+    }
+  }
+  /** JSON.stringify 后写入，可选 TTL */
+  async jsonSet(key, value, ttl) {
+    return this.set(key, JSON.stringify(value), ttl);
+  }
+  // ── 缓存便捷 ──────────────────────────────
+  /**
+   * 缓存读-算-写。命中返回缓存值；miss 执行 fn 并回填。
+   * fn 返回 null 时不缓存（防穿透）。
+   */
+  async cache(key, fn, ttl) {
+    const hit = await this.jsonGet(key);
+    if (hit !== null) return hit;
+    const value = await fn();
+    if (value !== null) await this.jsonSet(key, value, ttl);
+    return value;
+  }
+  /** 主动关闭连接 */
+  async close() {
+    await this.conn.close();
+  }
+};
+
+// src/db/redis/subscriber.ts
+var RedisSubscriber = class {
+  conn;
+  constructor(options = {}) {
+    this.conn = new RedisConnection(options);
+  }
+  async connect() {
+    await this.conn.connect();
+  }
+  /** 订阅频道：回调式 */
+  subscribe(channel, fn) {
+    return this.conn.subscribe(channel, fn);
+  }
+  /** 订阅模式（通配符）：回调式 */
+  psubscribe(pattern, fn) {
+    return this.conn.psubscribe(pattern, fn);
+  }
+  async close() {
+    await this.conn.close();
+  }
+};
+
+// src/db/redis/pool.ts
+var RedisPool = class _RedisPool {
+  clients = [];
+  rr = 0;
+  closed = false;
+  keyPrefix;
+  opts;
+  initPromise = null;
+  /** 懒连接模式：构造不连接，首命令时初始化（中间件注入场景） */
+  constructor(opts = {}) {
+    this.keyPrefix = opts.keyPrefix ?? "";
+    this.opts = opts;
+  }
+  /** 建立池：创建 poolSize 个连接（eager） */
+  static async create(options = {}) {
+    const pool = new _RedisPool(options);
+    await pool.ensure();
+    return pool;
+  }
+  /** 懒连接：首次使用时初始化连接（中间件场景：构造即注入，首命令才连） */
+  readyPromise = null;
+  ensure() {
+    if (this.readyPromise) return this.readyPromise;
+    if (!this.initPromise) {
+      this.initPromise = this.init();
     }
+    return this.initPromise;
+  }
+  async init() {
+    const poolSize = this.opts.poolSize ?? 5;
+    this.clients = await Promise.all(
+      Array.from({ length: poolSize }, () => RedisClient.connect(this.opts))
+    );
+    this.readyPromise = Promise.resolve();
+  }
+  /** 应用 key 前缀（command 透传不加） */
+  k(key) {
+    return this.keyPrefix + key;
+  }
+  /** round-robin 选择连接 */
+  next() {
+    if (this.closed || this.clients.length === 0) {
+      throw new ConnectionError("redis: pool is closed");
+    }
+    const client = this.clients[this.rr % this.clients.length];
+    this.rr++;
+    return client;
+  }
+  // ── 与 RedisClient 相同的方法面（代理到轮询连接） ──
+  async command(name, ...args) {
+    await this.ensure();
+    return this.next().command(name, ...args);
+  }
+  async get(key) {
+    await this.ensure();
+    return this.next().get(this.k(key));
+  }
+  /** 二进制安全读取（原始字节，不解码） */
+  async getBuffer(key) {
+    await this.ensure();
+    return this.next().getBuffer(this.k(key));
+  }
+  async set(key, value, ttl) {
+    await this.ensure();
+    return this.next().set(this.k(key), value, ttl);
+  }
+  async del(...keys) {
+    await this.ensure();
+    return this.next().del(...keys.map((k) => this.k(k)));
+  }
+  async incr(key) {
+    await this.ensure();
+    return this.next().incr(this.k(key));
+  }
+  async expire(key, seconds) {
+    await this.ensure();
+    return this.next().expire(this.k(key), seconds);
   }
-  /** SCRAM client-final 消息 */
-  scramFinal(ctx) {
-    const parts = new Map(
-      ctx.serverFirst.split(",").map((kv) => {
-        const i = kv.indexOf("=");
-        return [kv.slice(0, i), kv.slice(i + 1)];
-      })
-    );
-    const salt = Buffer.from(parts.get("s") ?? "", "base64");
-    const iterations = parseInt(parts.get("i") ?? "4096", 10);
-    const nonce = parts.get("r") ?? "";
-    const password = this.opts.password ?? "";
-    const saltedPassword = crypto2.pbkdf2Sync(password, salt, iterations, 32, "sha256");
-    const clientKey = hmac(saltedPassword, "Client Key");
-    const storedKey = crypto2.createHash("sha256").update(clientKey).digest();
-    const channelBinding = "c=biws";
-    const clientFinalWithoutProof = `${channelBinding},r=${nonce}`;
-    const authMessage = `${ctx.clientFirstBare},${ctx.serverFirst},${clientFinalWithoutProof}`;
-    const clientSignature = hmac(storedKey, authMessage);
-    const clientProof = xor(clientKey, clientSignature);
-    return `${clientFinalWithoutProof},p=${Buffer.from(clientProof).toString("base64")}`;
+  async ttl(key) {
+    await this.ensure();
+    return this.next().ttl(this.k(key));
   }
-  scramServerSignature(ctx) {
-    const parts = new Map(
-      ctx.serverFirst.split(",").map((kv) => {
-        const i = kv.indexOf("=");
-        return [kv.slice(0, i), kv.slice(i + 1)];
-      })
-    );
-    const salt = Buffer.from(parts.get("s") ?? "", "base64");
-    const iterations = parseInt(parts.get("i") ?? "4096", 10);
-    const nonce = parts.get("r") ?? "";
-    const saltedPassword = crypto2.pbkdf2Sync(this.opts.password ?? "", salt, iterations, 32, "sha256");
-    const serverKey = hmac(saltedPassword, "Server Key");
-    const clientFinalWithoutProof = `c=biws,r=${nonce}`;
-    const authMessage = `${ctx.clientFirstBare},${ctx.serverFirst},${clientFinalWithoutProof}`;
-    return Buffer.from(hmac(serverKey, authMessage)).toString("base64");
+  async jsonGet(key) {
+    await this.ensure();
+    return this.next().jsonGet(this.k(key));
   }
-  /** 事务：BEGIN → fn(tx) → COMMIT；fn 抛错 → ROLLBACK（回滚失败吞掉，保留原始错误） */
-  async transaction(fn) {
-    await this.query("BEGIN");
-    try {
-      const result = await fn({ query: (sql, params) => this.query(sql, params) });
-      await this.query("COMMIT");
-      return result;
-    } catch (e) {
-      await this.query("ROLLBACK").catch(() => {
-      });
-      throw e;
-    }
+  async jsonSet(key, value, ttl) {
+    await this.ensure();
+    return this.next().jsonSet(this.k(key), value, ttl);
   }
-  /** 查询：无参数走简单协议（Q），有参数走扩展查询（Parse/Bind/Execute/Sync） */
-  query(sql, params) {
-    return new Promise((resolve3, reject) => {
-      if (this.status !== "ready" || !this.socket) {
-        reject(new ConnectionError("postgres: not connected"));
-        return;
-      }
-      if (this.currentQuery) {
-        reject(new ConnectionError("postgres: query already in progress"));
-        return;
-      }
-      if (!params || params.length === 0) {
-        this.currentQuery = {
-          columns: [],
-          rows: [],
-          resolve: resolve3,
-          reject
-        };
-        this.socket.write(Buffer.from(queryMessage(sql)));
-      } else {
-        const sig = `${sql}|${params.length}`;
-        let stmtEntry = this.prepared.get(sig);
-        const encoded = encodeParams(params);
-        if (!stmtEntry) {
-          const name = `wf_s${++this.stmtSeq}`;
-          this.currentQuery = {
-            columns: [],
-            rows: [],
-            resolve: resolve3,
-            reject,
-            sql,
-            params: encoded,
-            awaitingDescribe: true,
-            prepKey: sig,
-            prepName: name
-          };
-          this.socket.write(Buffer.from(parseMessage(name, sql, params.map(() => 0))));
-          this.socket.write(Buffer.from(describeMessage("S", name)));
-          this.socket.write(Buffer.from(flushMessage()));
-        } else {
-          this.currentQuery = {
-            columns: [...stmtEntry.columns],
-            rows: [],
-            resolve: resolve3,
-            reject,
-            sql,
-            params: encoded,
-            awaitingDescribe: false
-          };
-          this.socket.write(Buffer.from(bindMessage(stmtEntry.name, encoded)));
-          this.socket.write(Buffer.from(executeMessage()));
-          this.socket.write(Buffer.from(syncMessage()));
-        }
-      }
-    });
+  async cache(key, fn, ttl) {
+    await this.ensure();
+    return this.next().cache(this.k(key), fn, ttl);
   }
-  send(data) {
-    this.socket?.write(Buffer.from(data));
+  /** PUBLISH 消息到频道，返回收到消息的订阅者数 */
+  async publish(channel, message) {
+    await this.ensure();
+    return Number(await this.next().command("PUBLISH", channel, message));
   }
-  notifyIdle() {
-    const ws = this.waiters;
-    this.waiters = [];
-    for (const w of ws) w();
+  /** 创建独立订阅者连接（Pub/Sub 场景） */
+  createSubscriber() {
+    return new RedisSubscriber({ ...this.opts });
   }
-  /** 等待连接空闲（事务/多语句流程用） */
-  waitIdle() {
-    if (!this.currentQuery) return Promise.resolve();
-    return new Promise((resolve3) => this.waiters.push(resolve3));
+  /** 清空当前库（测试/重置场景） */
+  async flushdb() {
+    await this.ensure();
+    const v = await this.next().command("FLUSHDB");
+    return String(v);
   }
-  /** 终止连接 */
+  /** 关闭所有池内连接 */
   async close() {
-    const sock = this.socket;
-    if (this.status === "ready" && sock) {
-      sock.write(Buffer.from(terminateMessage()));
-    }
-    this.status = "closed";
-    if (sock) sock.destroy();
+    this.closed = true;
+    this.readyPromise = null;
+    await Promise.all(this.clients.map((c) => c.close()));
+    this.clients = [];
+  }
+  get size() {
+    return this.clients.length;
   }
 };
-function utf82(s) {
-  return new TextEncoder().encode(s);
-}
-function encodeP(payload) {
-  const out = new Uint8Array(1 + 4 + payload.length);
-  out[0] = 112;
-  const len = 4 + payload.length;
-  out[1] = len >> 24 & 255;
-  out[2] = len >> 16 & 255;
-  out[3] = len >> 8 & 255;
-  out[4] = len & 255;
-  out.set(payload, 5);
-  return out;
-}
-function hmac(key, data) {
-  return crypto2.createHmac("sha256", key).update(data).digest();
-}
-function xor(a, b) {
-  const out = new Uint8Array(a.length);
-  for (let i = 0; i < a.length; i++) out[i] = a[i] ^ b[i];
-  return out;
-}
-function encodeParams(params) {
-  return params.map((p) => {
-    if (p === null || p === void 0) return null;
-    if (typeof p === "object") return JSON.stringify(p);
-    return String(p);
+
+// src/queue/index.ts
+var GROUP = "workers";
+function makePool(options) {
+  const url = options?.url ?? process.env.REDIS_URL ?? "redis://localhost:6379";
+  const u = new URL(url);
+  return new RedisPool({
+    host: u.hostname,
+    port: Number(u.port || 6379),
+    poolSize: options?.poolSize
   });
 }
-function convertValue(oid, value) {
-  if (value === null) return null;
-  switch (oid) {
-    case 114:
-    case 3802:
-      return JSON.parse(value);
-    case 20: {
-      const n = BigInt(value);
-      if (n > BigInt(Number.MAX_SAFE_INTEGER) || n < BigInt(-Number.MAX_SAFE_INTEGER)) {
-        return value;
-      }
-      return Number(n);
-    }
-    case 21:
-    case 23:
-    case 26:
-      return Number(value);
-    case 700:
-    case 701:
-    case 1700:
-      return parseFloat(value);
-    case 16:
-      return value === "t";
-    default:
-      return value;
-  }
-}
-
-// src/db/postgres/schema.ts
-function validateValue(def, value, column) {
-  if (value === void 0 || value === null) {
-    if (def.required) {
-      throw new ValidationError(`schema: '${column}' is required`);
-    }
-    return;
-  }
-  switch (def.type) {
-    case "text":
-      if (typeof value !== "string") {
-        throw new ValidationError(`schema: '${column}' must be a string, got ${typeof value}`);
+function queue(options) {
+  const prefix = options?.prefix ?? "q:";
+  const pool = makePool(options);
+  const stream = (name) => `${prefix}${name}`;
+  const deadStream = (name) => `${prefix}${name}:dead`;
+  async function pushJob(name, payload) {
+    const id = await pool.command("XADD", stream(name), "*", "payload", JSON.stringify(payload));
+    return String(id);
+  }
+  const queueClient = {
+    async add(name, data, opts) {
+      const id = await pushJob(name, {
+        id: randomUUID(),
+        name,
+        data,
+        attempts: 0,
+        maxAttempts: opts?.attempts ?? 3,
+        addedAt: Date.now()
+      });
+      return { id };
+    },
+    length: async (name) => Number(await pool.command("XLEN", stream(name))),
+    worker(name, handler, opts) {
+      const consumer = opts?.consumer ?? `${hostname()}-${process.pid}-${Math.random().toString(36).slice(2, 6)}`;
+      const concurrency = opts?.concurrency ?? 1;
+      const visibilityTimeout = opts?.visibilityTimeout ?? 3e4;
+      const s = stream(name);
+      const dead = deadStream(name);
+      const delayed = `${prefix}${name}:delayed`;
+      let running = false;
+      const inflight = /* @__PURE__ */ new Set();
+      async function ensureGroup() {
+        try {
+          await pool.command("XGROUP", "CREATE", s, GROUP, "0", "MKSTREAM");
+        } catch (e) {
+          if (!String(e.message).includes("BUSYGROUP")) throw e;
+        }
       }
-      break;
-    case "int":
-      if (typeof value !== "number" || !Number.isInteger(value)) {
-        throw new ValidationError(`schema: '${column}' must be an integer, got ${typeof value}`);
+      async function processEntry(entryId, fields) {
+        let payload;
+        try {
+          payload = JSON.parse(fields.payload ?? "{}");
+        } catch {
+          await pool.command("XACK", s, GROUP, entryId);
+          await pool.command("XADD", dead, "*", "payload", JSON.stringify({
+            originalId: entryId,
+            name,
+            error: "unparseable payload",
+            attempts: -1
+          }));
+          return;
+        }
+        const attempts = Number(payload.attempts ?? 0);
+        const maxAttempts = Number(payload.maxAttempts ?? 3);
+        try {
+          await handler({
+            id: entryId,
+            name,
+            data: payload.data,
+            attempts
+          });
+          await pool.command("XACK", s, GROUP, entryId);
+        } catch (err) {
+          const nextAttempt = attempts + 1;
+          await pool.command("XACK", s, GROUP, entryId);
+          if (nextAttempt >= maxAttempts) {
+            await pool.command("XADD", dead, "*", "payload", JSON.stringify({
+              originalId: entryId,
+              name,
+              data: payload.data,
+              error: err instanceof Error ? err.message : String(err),
+              attempts: nextAttempt
+            }));
+            console.error(`[queue] ${name} job failed permanently (attempt ${nextAttempt}/${maxAttempts}):`, err);
+          } else {
+            await pool.command("ZADD", delayed, String(Date.now() + visibilityTimeout), JSON.stringify({
+              ...payload,
+              attempts: nextAttempt
+            }));
+            console.error(
+              `[queue] ${name} job failed (attempt ${nextAttempt}/${maxAttempts}), retry in ${visibilityTimeout}ms:`,
+              err
+            );
+          }
+        }
       }
-      break;
-    case "jsonb":
-      if (typeof value !== "object" || value === null || Array.isArray(value)) {
-        throw new ValidationError(`schema: '${column}' must be a JSON object`);
+      async function requeueDelayed() {
+        const now = Date.now();
+        let due;
+        try {
+          due = await pool.command("ZRANGEBYSCORE", delayed, 0, now);
+        } catch (e) {
+          if (isPoolClosed(e)) {
+            running = false;
+            return;
+          }
+          if (running) console.error("[queue] ZRANGEBYSCORE:", e instanceof Error ? e.message : e);
+          return;
+        }
+        for (const member of due) {
+          const removed = await pool.command("ZREM", delayed, member);
+          if (removed) {
+            await pool.command("XADD", s, "*", "payload", member);
+          }
+        }
       }
-      break;
-    case "enum":
-      if (!def.values?.includes(value)) {
-        throw new ValidationError(
-          `schema: '${column}' must be one of [${def.values?.join(", ")}], got ${String(value)}`
-        );
+      async function claimStale() {
+        try {
+          const result = await pool.command(
+            "XAUTOCLAIM",
+            s,
+            GROUP,
+            consumer,
+            visibilityTimeout,
+            "0",
+            "COUNT",
+            String(concurrency)
+          );
+          const entries = result[1];
+          for (const [entryId, fields] of entries) {
+            await processEntry(entryId, flatFieldsToRecord(fields));
+          }
+        } catch (e) {
+          if (isPoolClosed(e)) {
+            running = false;
+            return;
+          }
+          if (running) console.error("[queue] XAUTOCLAIM:", e instanceof Error ? e.message : e);
+        }
       }
-      break;
+      async function loop() {
+        await ensureGroup();
+        while (running) {
+          await claimStale();
+          await requeueDelayed();
+          let result;
+          try {
+            result = await pool.command(
+              "XREADGROUP",
+              "GROUP",
+              GROUP,
+              consumer,
+              "COUNT",
+              String(concurrency),
+              "BLOCK",
+              "1000",
+              "STREAMS",
+              s,
+              ">"
+            );
+          } catch (e) {
+            if (isPoolClosed(e)) {
+              running = false;
+              return;
+            }
+            if (running) console.error("[queue] XREADGROUP:", e instanceof Error ? e.message : e);
+            continue;
+          }
+          if (!result) continue;
+          const streamEntries = result[0];
+          const entries = streamEntries[1];
+          for (const [entryId, fields] of entries) {
+            const p = processEntry(entryId, flatFieldsToRecord(fields));
+            inflight.add(p);
+            p.finally(() => inflight.delete(p)).catch(() => {
+            });
+          }
+        }
+      }
+      return {
+        start: async () => {
+          if (running) return;
+          running = true;
+          loop().catch((e) => console.error("[queue] worker loop crashed:", e));
+        },
+        stop: async () => {
+          running = false;
+          await Promise.allSettled([...inflight]);
+        }
+      };
+    }
+  };
+  const mw = (async (req, ctx, next) => {
+    ctx.queue = queueClient;
+    return next(req, ctx);
+  });
+  mw.__meta = { injects: ["queue"], depends: [] };
+  mw.queue = queueClient;
+  mw.close = () => pool.close();
+  return mw;
+}
+function flatFieldsToRecord(fields) {
+  const rec = {};
+  for (let i = 0; i + 1 < fields.length; i += 2) {
+    rec[String(fields[i])] = String(fields[i + 1]);
   }
+  return rec;
 }
-function validateRow(schema, row) {
-  for (const [col, def] of Object.entries(schema)) {
-    if (def.required && (row[col] === void 0 || row[col] === null)) {
-      throw new ValidationError(`schema: '${col}' is required`);
-    }
+function isPoolClosed(e) {
+  const msg = e instanceof Error ? e.message : String(e);
+  return /pool is closed|connection closed/.test(msg);
+}
+
+// src/ui/index.ts
+import { build } from "esbuild";
+import { readFile, stat } from "node:fs/promises";
+import { resolve as resolve2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/ui/html-safe.ts
+var HtmlSafe = class {
+  value;
+  constructor(value) {
+    this.value = value;
   }
-  for (const [col, value] of Object.entries(row)) {
-    const def = schema[col];
-    if (!def) continue;
-    validateValue(def, value, col);
+  toString() {
+    return this.value;
   }
+};
+
+// src/client/vnode.ts
+var ASYNC_MARK = "__wfAsyncComponent";
+function isAsyncComponent(type) {
+  return typeof type === "function" && type?.[ASYNC_MARK] === true;
 }
+var Fragment = /* @__PURE__ */ Symbol("Fragment");
+var Portal = /* @__PURE__ */ Symbol("Portal");
 
-// src/db/postgres/pool.ts
-var PgPool = class _PgPool {
-  all = [];
-  available = [];
-  waiters = [];
-  closed = false;
-  opts;
-  initPromise = null;
-  schemas = /* @__PURE__ */ new Map();
-  /** 懒连接：构造不连接，ensure() 首次初始化（中间件注入场景） */
-  constructor(options = {}) {
-    this.opts = options;
+// src/client/reactive.ts
+function createReactiveState(dirty) {
+  const proxyCache = /* @__PURE__ */ new WeakMap();
+  const reactive = (target) => {
+    if (target === null || typeof target !== "object") return target;
+    if (proxyCache.has(target)) return proxyCache.get(target);
+    const proxy = new Proxy(target, {
+      set(target2, key, value) {
+        const old = Reflect.get(target2, key);
+        if (old === value) return true;
+        Reflect.set(target2, key, value);
+        dirty();
+        return true;
+      },
+      get(target2, key) {
+        const value = Reflect.get(target2, key);
+        if (typeof value === "object" && value !== null) return reactive(value);
+        return value;
+      },
+      deleteProperty(target2, key) {
+        if (Reflect.has(target2, key)) {
+          Reflect.deleteProperty(target2, key);
+          dirty();
+        }
+        return true;
+      }
+    });
+    proxyCache.set(target, proxy);
+    return proxy;
+  };
+  return reactive({});
+}
+
+// src/ui/ssr.ts
+function escape(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+var VOID_TAGS = /* @__PURE__ */ new Set([
+  "area",
+  "base",
+  "br",
+  "col",
+  "embed",
+  "hr",
+  "img",
+  "input",
+  "link",
+  "meta",
+  "param",
+  "source",
+  "track",
+  "wbr"
+]);
+function classToString(v) {
+  if (typeof v === "string") return v;
+  if (Array.isArray(v)) return v.filter(Boolean).join(" ");
+  if (v && typeof v === "object") {
+    return Object.entries(v).filter(([, b]) => b).map(([k]) => k).join(" ");
   }
-  static async create(options = {}) {
-    const pool = new _PgPool(options);
-    await pool.ensure();
-    return pool;
+  return "";
+}
+function styleToString(v) {
+  if (typeof v === "string") return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).filter(([, x]) => x != null).map(([k, x]) => `${k}:${typeof x === "number" ? x + "px" : String(x)}`).join(";");
   }
-  readyPromise = null;
-  ensure() {
-    if (this.readyPromise) return this.readyPromise;
-    if (!this.initPromise) {
-      this.initPromise = this.init();
+  return "";
+}
+function createSsrContext(serverCtx, dataStore) {
+  const usedIds = /* @__PURE__ */ new Set();
+  const ui2 = {
+    $: () => createReactiveState(() => {
+    }),
+    dirty: () => {
+    },
+    render: () => {
+    },
+    selfId: (name) => {
+      if (usedIds.has(name)) throw new Error(`[weifuwu] Duplicate component ID: "${name}"`);
+      usedIds.add(name);
+    },
+    useMedia: () => {
+    },
+    useBreakpoint: () => {
+    },
+    usePopupPosition: () => ({ top: 0, left: 0, refresh: () => {
+    } })
+  };
+  const ctx = Object.create(serverCtx ?? {});
+  ctx.ui = ui2;
+  ctx.data = {
+    async get(key, fetcher) {
+      if (dataStore.has(key)) return dataStore.get(key);
+      if (!fetcher) return void 0;
+      const val = await fetcher();
+      dataStore.set(key, val);
+      return val;
+    },
+    set(key, val) {
+      dataStore.set(key, val);
+    },
+    has(key) {
+      return dataStore.has(key);
     }
-    return this.initPromise;
-  }
-  async init() {
-    const poolSize = this.opts.poolSize ?? 5;
-    const conns = await Promise.all(
-      Array.from({ length: poolSize }, async () => {
-        const c = new PgConnection(this.opts);
-        await c.connect();
-        return c;
-      })
-    );
-    this.all = conns;
-    this.available = [...conns];
-    this.readyPromise = Promise.resolve();
+  };
+  return ctx;
+}
+async function renderSsr(input, ctx) {
+  if (input == null || typeof input === "boolean") return "";
+  if (typeof input === "string" || typeof input === "number") return escape(String(input));
+  if (Array.isArray(input)) {
+    let s = "";
+    for (const c of input) s += await renderSsr(c, ctx);
+    return s;
   }
-  /** 获取一个空闲连接（全忙则排队等待） */
-  acquire() {
-    if (this.closed) return Promise.reject(new ConnectionError("postgres: pool is closed"));
-    if (this.available.length > 0) {
-      return Promise.resolve(this.available.pop());
-    }
-    const timeoutMs = this.opts.acquireTimeoutMs ?? 3e4;
-    return new Promise((resolve3, reject) => {
-      const waiter = {
-        resolve: resolve3,
-        reject
-      };
-      if (timeoutMs > 0) {
-        waiter.timer = setTimeout(() => {
-          const idx = this.waiters.indexOf(waiter);
-          if (idx >= 0) this.waiters.splice(idx, 1);
-          reject(new TimeoutError("postgres: pool acquire", timeoutMs));
-        }, timeoutMs);
+  const vnode = input;
+  if (vnode.type === Portal) return renderSsr(vnode.props?.children, ctx);
+  if (vnode.type === Fragment) return renderSsr(vnode.props?.children, ctx);
+  if (typeof vnode.type === "function") {
+    let def;
+    if (isAsyncComponent(vnode.type)) {
+      def = await vnode.type(ctx);
+      if (typeof def !== "function") {
+        throw new Error(
+          `asyncComponent factory <${vnode.type.name || "anonymous"}> must return a Component (initProps, ctx) => (props) => VNode.`
+        );
       }
-      this.waiters.push(waiter);
-    });
+    } else {
+      def = vnode.type;
+    }
+    const childCtx = Object.create(ctx);
+    const renderFn = def(vnode.props ?? {}, childCtx);
+    if (typeof renderFn !== "function") {
+      throw new Error(
+        `Component ${vnode.type.name || "anonymous"} must return a render function. Use (init_props, ctx) => (props) => VNode pattern.`
+      );
+    }
+    return renderSsr(renderFn(vnode.props ?? {}), childCtx);
   }
-  release(conn) {
-    if (this.closed) {
-      conn.close();
-      return;
+  const tag = vnode.type;
+  const props = vnode.props ?? {};
+  const attrs = [];
+  let innerHTML;
+  for (const [key, value] of Object.entries(props)) {
+    if (key === "children" || key === "key") continue;
+    if (key === "ref") continue;
+    if (key.startsWith("on") && typeof value === "function") continue;
+    if (key === "innerHTML") {
+      innerHTML = String(value ?? "");
+      continue;
     }
-    if (!conn.connected) {
-      conn.close();
-      this.replenish();
-      return;
+    if (key === "class" || key === "className") {
+      const cls = classToString(value);
+      if (cls) attrs.push(` class="${escape(cls)}"`);
+      continue;
     }
-    this.dispatchAvailable(conn);
-  }
-  /** 连接可用事件统一入口：优先唤醒等待者，否则回空闲池（release 与 replenish 共用） */
-  dispatchAvailable(conn) {
-    const waiter = this.waiters.shift();
-    if (waiter) {
-      if (waiter.timer) clearTimeout(waiter.timer);
-      waiter.resolve(conn);
-    } else {
-      this.available.push(conn);
+    if (key === "style" && value && typeof value === "object") {
+      attrs.push(` style="${escape(styleToString(value))}"`);
+      continue;
     }
-  }
-  /** 坏连接剔除后异步重建（池容量保持）——就绪后走统一分发（唤醒 waiter） */
-  replenish() {
-    if (this.closed) return;
-    const c = new PgConnection(this.opts);
-    c.connect().then(() => {
-      if (this.closed) {
-        c.close();
-        return;
-      }
-      this.all.push(c);
-      this.dispatchAvailable(c);
-    }).catch(() => {
-      setTimeout(() => this.replenish(), 500);
-    });
-  }
-  async query(sql, params) {
-    await this.ensure();
-    const conn = await this.acquire();
-    const start = performance.now();
-    try {
-      const rows = await conn.query(sql, params);
-      this.opts.onQuery?.(sql, performance.now() - start, rows.length);
-      return rows;
-    } finally {
-      this.release(conn);
+    if (value === true) {
+      attrs.push(` ${key}`);
+      continue;
     }
+    if (value === false || value == null) continue;
+    attrs.push(` ${key}="${escape(String(value))}"`);
   }
-  /** 注册表结构（元数据闭环：校验/类型推断的起点） */
-  register(table, schema) {
-    this.schemas.set(table, schema);
-  }
-  /** 写前校验 + 参数化插入（schema 驱动，脏数据源头拦截） */
-  async insert(table, row) {
-    const schema = this.schemas.get(table);
-    if (!schema) {
-      throw new ValidationError(`schema: table '${table}' not registered\u2014call register() first`);
+  const attrStr = attrs.join("");
+  if (VOID_TAGS.has(tag)) return `<${tag}${attrStr}>`;
+  if (innerHTML !== void 0) return `<${tag}${attrStr}>${innerHTML}</${tag}>`;
+  const children = await renderSsr(props.children, ctx);
+  return `<${tag}${attrStr}>${children}</${tag}>`;
+}
+async function ssrToString(Comp, props, serverCtx, opts = {}) {
+  const dataStore = opts.data ?? /* @__PURE__ */ new Map();
+  const ctx = createSsrContext(serverCtx, dataStore);
+  const html = await renderSsr({ type: Comp, props: props ?? {}, key: void 0 }, ctx);
+  return new HtmlSafe(html);
+}
+function serializeData(data) {
+  const json = JSON.stringify(Object.fromEntries(data)).replace(/</g, "\\u003c");
+  return `<script>window.__DATA__=${json};</script>`;
+}
+
+// src/ui/index.ts
+function escape2(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function stringify(v) {
+  if (v == null || v === false || v === true) return "";
+  if (Array.isArray(v)) return v.map(stringify).join("");
+  if (v instanceof HtmlSafe) return v.value;
+  return escape2(String(v));
+}
+function unsafe(s) {
+  return new HtmlSafe(s);
+}
+var jsCache = /* @__PURE__ */ new Map();
+async function jsCacheFresh(inputs) {
+  for (const [file, mtime] of Object.entries(inputs)) {
+    try {
+      const st = await stat(file);
+      if (st.mtimeMs !== mtime) return false;
+    } catch {
+      return false;
     }
-    validateRow(schema, row);
-    const cols = Object.keys(row);
-    if (cols.length === 0) throw new ValidationError("schema: insert requires at least one column");
-    const placeholders = cols.map((_, i) => `$${i + 1}`).join(", ");
-    const sql = `INSERT INTO ${table} (${cols.join(", ")}) VALUES (${placeholders})`;
-    return this.query(sql, cols.map((c) => row[c]));
   }
-  /**
-   * tagged template: sql\`SELECT * FROM t WHERE id = \${id}\`
-   * 插值 = 参数（postgres.js 语义，防注入）；表名必须硬编码（插值会被当参数）。
-   * 对象插值自动 JSON.stringify → jsonb。
-   */
-  tag(strings, ...values) {
-    const { sql, params } = parseTagged(strings, values);
-    return this.query(sql, params);
+  return true;
+}
+var cssCache = /* @__PURE__ */ new Map();
+var postcssAvailable;
+async function checkPostcss() {
+  if (postcssAvailable !== void 0) return postcssAvailable;
+  try {
+    await import("postcss");
+    await import("@tailwindcss/postcss");
+    postcssAvailable = true;
+  } catch {
+    postcssAvailable = false;
   }
-  /** postgres.js 兼容事务 API: begin(fn)——fn 收到 tagged template 事务 sql */
-  async begin(fn) {
-    await this.ensure();
-    return this.transaction(async (tx) => {
-      const txSql = (strings, ...values) => {
-        const { sql, params } = parseTagged(strings, values);
-        return tx.query(sql, params);
-      };
-      return fn(txSql);
-    });
+  return postcssAvailable;
+}
+function resolveEntry(entryPath) {
+  if (entryPath.startsWith(".") || entryPath.startsWith("/")) {
+    return resolve2(entryPath);
   }
-  /** 片段：可嵌套的 SQL 片段（postgres.js fragment 语义，条件过滤模式） */
-  frag(strings, ...values) {
-    const { sql, params } = parseTagged(strings, values);
-    return { __fragment: { sql, params } };
+  try {
+    return fileURLToPath(import.meta.resolve(entryPath));
+  } catch {
+    return resolve2(entryPath);
   }
-  /** 原生 SQL（DDL / 动态表名场景）；$1 占位符 + 参数数组 */
-  async unsafe(sql, params) {
-    await this.ensure();
-    const conn = await this.acquire();
-    try {
-      return await conn.query(sql, params);
-    } finally {
-      this.release(conn);
+}
+function ui() {
+  return async (_req, ctx, next) => {
+    function htmlTag(strings, ...values) {
+      let body = "";
+      for (let i = 0; i < strings.length; i++) {
+        body += strings[i];
+        if (i < values.length) body += stringify(values[i]);
+      }
+      return new Response(body, {
+        headers: { "Content-Type": "text/html; charset=utf-8" }
+      });
     }
-  }
-  /** 事务：固定在单个连接上执行整个 BEGIN→fn→COMMIT/ROLLBACK */
-  async transaction(fn) {
-    await this.ensure();
-    const conn = await this.acquire();
-    try {
-      await conn.query("BEGIN");
-      try {
-        const result = await fn({ query: (sql, params) => conn.query(sql, params) });
-        await conn.query("COMMIT");
-        return result;
-      } catch (e) {
-        await conn.query("ROLLBACK").catch(() => {
+    ctx.ui = {
+      html: Object.assign(htmlTag, { unsafe }),
+      /** SSR 渲染组件 → HTML 片段（HtmlSafe：内联进 ctx.ui.html 不二次转义） */
+      async ssr(Comp, props, opts) {
+        const safe = await ssrToString(Comp, props ?? {}, ctx, opts);
+        return safe;
+      },
+      /** 序列化 SSR 数据存储 → window.__DATA__ 脚本（HtmlSafe） */
+      ssrData(data) {
+        return new HtmlSafe(serializeData(data));
+      },
+      async js(entryPath) {
+        const absPath = resolveEntry(entryPath);
+        const cached = jsCache.get(absPath);
+        if (cached && await jsCacheFresh(cached.inputs)) {
+          return new Response(cached.code, {
+            headers: { "Content-Type": "application/javascript", "Cache-Control": "no-cache" }
+          });
+        }
+        const result = await build({
+          entryPoints: [absPath],
+          bundle: true,
+          format: "esm",
+          platform: "browser",
+          jsx: "automatic",
+          jsxImportSource: "weifuwu/client",
+          write: false,
+          metafile: true
         });
-        throw e;
-      }
-    } finally {
-      this.release(conn);
+        const code = result.outputFiles[0].text;
+        const inputs = {};
+        for (const file of Object.keys(result.metafile?.inputs ?? {})) {
+          const abs = resolve2(file);
+          try {
+            inputs[abs] = (await stat(abs)).mtimeMs;
+          } catch {
+          }
+        }
+        jsCache.set(absPath, { code, inputs });
+        return new Response(code, {
+          headers: { "Content-Type": "application/javascript", "Cache-Control": "no-cache" }
+        });
+      },
+      async css(entryPath) {
+        const absPath = resolveEntry(entryPath);
+        const st = await import("node:fs").then((fs) => fs.promises.stat(absPath));
+        const cached = cssCache.get(absPath);
+        if (cached && cached.mtime === st.mtimeMs) {
+          return new Response(cached.code, {
+            headers: { "Content-Type": "text/css; charset=utf-8", "Cache-Control": "no-cache" }
+          });
+        }
+        let code = await readFile(absPath, "utf-8");
+        if (await checkPostcss()) {
+          try {
+            const postcss = await import("postcss");
+            const tw = await import("@tailwindcss/postcss");
+            const plugin = tw.default || tw;
+            const instance = typeof plugin === "function" ? plugin() : plugin;
+            const result = await postcss.default([instance]).process(code, { from: absPath });
+            code = result.css;
+          } catch (e) {
+            throw new Error(`PostCSS \u7F16\u8BD1\u5931\u8D25 (${absPath}): ${e.message}`, { cause: e });
+          }
+        }
+        cssCache.set(absPath, { code, mtime: st.mtimeMs });
+        return new Response(code, {
+          headers: { "Content-Type": "text/css; charset=utf-8", "Cache-Control": "no-cache" }
+        });
+      }
+    };
+    return next(_req, ctx);
+  };
+}
+
+// src/client/route-match.ts
+function joinPaths(a, b) {
+  if (!b || b === "/") return a || "/";
+  const left = a.endsWith("/") ? a.slice(0, -1) : a;
+  const right = b.startsWith("/") ? b : "/" + b;
+  return left + right;
+}
+function compilePath(path) {
+  const keys = [];
+  const reStr = path.replace(/:(\w+)/g, (_, key) => {
+    keys.push(key);
+    return "([^/]+)";
+  }).replace(/\*/g, ".*");
+  return { re: new RegExp(`^${reStr}$`), keys };
+}
+function flattenRoutes(routes, basePath = "", chain = []) {
+  const result = [];
+  for (const route of routes) {
+    const fullPath = joinPaths(basePath, route.path);
+    const { re, keys } = compilePath(fullPath);
+    const fullChain = [...chain, route];
+    result.push({ re, keys, def: route, chain: fullChain });
+    if (route.children) {
+      result.push(...flattenRoutes(route.children, fullPath, fullChain));
     }
   }
-  async close() {
-    this.closed = true;
-    this.readyPromise = null;
-    this.available = [];
-    await Promise.all(this.all.map((c) => c.close()));
-    this.all = [];
-    const ws = this.waiters;
-    this.waiters = [];
-    for (const w of ws) {
-      if (w.timer) clearTimeout(w.timer);
-      w.reject(new ConnectionError("postgres: pool is closed"));
+  return result;
+}
+function matchRoute(path, routes) {
+  let best = null;
+  for (const fr of routes) {
+    if (path.match(fr.re)) {
+      if (!best || fr.chain.length > best.chain.length) best = fr;
     }
   }
-  get size() {
-    return this.available.length + this.waiters.length;
-  }
-};
-function parseTagged(strings, values) {
-  let sql = strings[0];
-  const params = [];
-  for (let i = 0; i < values.length; i++) {
-    const frag = values[i]?.__fragment;
-    if (frag) {
-      const renumbered = frag.sql.replace(/\$(\d+)/g, (_m, idx) => {
-        params.push(frag.params[parseInt(idx, 10) - 1]);
-        return `$${params.length}`;
-      });
-      sql += renumbered + strings[i + 1];
-    } else {
-      params.push(values[i]);
-      sql += `$${params.length}` + strings[i + 1];
+  return best;
+}
+function extractParams(path, match) {
+  const params = {};
+  const m = path.match(match.re);
+  if (m) {
+    for (let i = 0; i < match.keys.length; i++) {
+      params[match.keys[i]] = decodeURIComponent(m[i + 1]);
     }
   }
-  return { sql, params };
+  return params;
 }
 
-// src/postgres/client.ts
-var MIGRATIONS_TABLE = "_weifuwu_migrations";
-function postgres(options) {
-  const opts = typeof options === "string" ? { connection: options } : options ?? {};
-  const connection = opts.connection ?? process.env.DATABASE_URL;
-  if (!connection) {
-    throw new Error(
-      "postgres: DATABASE_URL is not set. Pass a connection string or set the DATABASE_URL environment variable."
-    );
-  }
-  const u = new URL(connection);
-  const pool = new PgPool({
-    host: u.hostname,
-    port: Number(u.port || 5432),
-    user: decodeURIComponent(u.username),
-    password: decodeURIComponent(u.password),
-    database: u.pathname.replace(/^\//, ""),
-    poolSize: opts.max ?? opts.poolSize ?? 10,
-    acquireTimeoutMs: opts.acquireTimeoutMs,
-    statementTimeoutMs: opts.statementTimeoutMs ?? opts.statementTimeout,
-    onQuery: opts.onQuery
-  });
-  const sql = makeSql(pool);
-  const mw = ((req, ctx, next) => {
-    ctx.sql = sql;
-    return next(req, ctx);
-  });
-  mw.__meta = { injects: ["sql"], depends: [] };
-  mw.sql = sql;
-  mw.migrate = async () => {
-    await sql.unsafe(`
-      CREATE TABLE IF NOT EXISTS "_weifuwu_migrations" (
-        name TEXT PRIMARY KEY,
-        applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
-      )
-    `);
-  };
-  mw.markMigrated = async (moduleName) => {
-    await sql.unsafe(`INSERT INTO "_weifuwu_migrations" (name) VALUES ($1) ON CONFLICT DO NOTHING`, [
-      moduleName
-    ]);
-  };
-  mw.isMigrated = async (moduleName) => {
-    const rows = await sql.unsafe(`SELECT 1 FROM "_weifuwu_migrations" WHERE name = $1`, [moduleName]);
-    return rows.length > 0;
+// src/ui/ssr-page.ts
+var DEFAULT_TEMPLATE = (p) => `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>${escapeHtml(p.title)}</title>
+  ${(p.styles ?? []).map((s) => `<link rel="stylesheet" href="${escapeHtml(s)}">`).join("\n  ")}
+</head>
+<body>
+  <div id="root">${p.html}</div>
+  ${p.dataScript}
+  ${p.bundle ? `<script src="${escapeHtml(p.bundle)}"></script>` : ""}
+</body>
+</html>`;
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function uiSsr(opts) {
+  const flatRoutes = flattenRoutes(opts.routes);
+  const template = opts.template ?? DEFAULT_TEMPLATE;
+  return async (req, ctx, next) => {
+    if (req.method !== "GET") return next(req, ctx);
+    const url = new URL(req.url);
+    const match = matchRoute(url.pathname, flatRoutes);
+    if (!match) return next(req, ctx);
+    const params = extractParams(url.pathname, match);
+    const def = match.chain[match.chain.length - 1] ?? match.def;
+    const pageCtx = Object.assign(Object.create(ctx), {
+      params,
+      route: { path: url.pathname, params, query: Object.fromEntries(url.searchParams) }
+    });
+    if (!def.component) return next(req, ctx);
+    const data = /* @__PURE__ */ new Map();
+    const html = await ssrToString(def.component, {}, pageCtx, { data });
+    const title = opts.title ? opts.title({ params, def }) : def.title || "weifuwu";
+    const dataScript = new HtmlSafe(serializeData(data)).toString();
+    const body = template({ html: html.toString(), dataScript, title, bundle: opts.bundle, styles: opts.styles });
+    return new Response(body, {
+      headers: { "Content-Type": "text/html; charset=utf-8" }
+    });
   };
-  mw.transaction = (async (fn) => {
-    return sql.transaction(fn);
-  });
-  mw.poolStats = () => ({ active: 0, idle: pool.size, waiting: 0, max: pool.size });
-  mw.close = () => pool.close();
-  return mw;
 }
-var TaggedQuery = class {
-  text;
-  params;
-  executor;
-  constructor(text, params, executor) {
-    this.text = text;
-    this.params = params;
-    this.executor = executor;
-  }
-  then(resolve3, reject) {
-    return this.executor(this.text, this.params).then(resolve3, reject);
-  }
-  catch(reject) {
-    return this.executor(this.text, this.params).catch(reject);
-  }
-  finally(fn) {
-    return this.executor(this.text, this.params).finally(fn);
-  }
-  /** 嵌套片段（agent-platform 条件过滤模式） */
-  get __fragment() {
-    return { sql: this.text, params: this.params };
+
+// src/db/postgres/connection.ts
+import net3 from "node:net";
+import crypto2 from "node:crypto";
+
+// src/db/postgres/protocol.ts
+function encodeMessage(type, payload) {
+  const out = new Uint8Array(1 + 4 + payload.length);
+  out[0] = type.charCodeAt(0);
+  const len = 4 + payload.length;
+  out[1] = len >> 24 & 255;
+  out[2] = len >> 16 & 255;
+  out[3] = len >> 8 & 255;
+  out[4] = len & 255;
+  out.set(payload, 5);
+  return out;
+}
+function startupMessage(params) {
+  const body = [];
+  body.push(0, 3, 0, 0);
+  for (const [k, v] of Object.entries(params)) {
+    for (const c of utf8(k)) body.push(c);
+    body.push(0);
+    for (const c of utf8(v)) body.push(c);
+    body.push(0);
   }
-};
-function makeSql(pool) {
-  const sql = ((strings, ...values) => {
-    const { sql: text, params } = parseTaggedFromPool(strings, values);
-    return new TaggedQuery(text, params, (s, p) => wrapError(pool.query(s, p)));
-  });
-  sql.unsafe = (query, params) => wrapError(pool.unsafe(query, params));
-  sql.query = (query, params) => wrapError(pool.query(query, params));
-  sql.begin = (fn) => pool.begin(fn);
-  sql.transaction = (fn) => pool.transaction(fn);
-  sql.close = () => pool.close();
-  return sql;
+  body.push(0);
+  const out = new Uint8Array(4 + body.length);
+  const len = 4 + body.length;
+  out[0] = len >> 24 & 255;
+  out[1] = len >> 16 & 255;
+  out[2] = len >> 8 & 255;
+  out[3] = len & 255;
+  out.set(body, 4);
+  return out;
 }
-function parseTaggedFromPool(strings, values) {
-  let sql = strings[0];
-  const params = [];
-  for (let i = 0; i < values.length; i++) {
-    const frag = values[i]?.__fragment;
-    if (frag) {
-      const renumbered = frag.sql.replace(/\$(\d+)/g, (_m, idx) => {
-        params.push(frag.params[parseInt(idx, 10) - 1]);
-        return `$${params.length}`;
-      });
-      sql += renumbered + strings[i + 1];
+function queryMessage(sql) {
+  return encodeMessage("Q", concat(utf8(sql), new Uint8Array([0])));
+}
+function parseMessage(name, sql, paramTypes = []) {
+  const body = concat(utf8(name), new Uint8Array([0]), utf8(sql), new Uint8Array([0]));
+  const types = new Uint8Array(2 + paramTypes.length * 4);
+  types[0] = paramTypes.length >> 8 & 255;
+  types[1] = paramTypes.length & 255;
+  paramTypes.forEach((oid, i) => {
+    const off = 2 + i * 4;
+    types[off] = oid >> 24 & 255;
+    types[off + 1] = oid >> 16 & 255;
+    types[off + 2] = oid >> 8 & 255;
+    types[off + 3] = oid & 255;
+  });
+  return encodeMessage("P", concat(body, types));
+}
+function bindMessage(statement, params, paramFormats = []) {
+  const stmtBytes = utf8(statement);
+  const lens = new Array(params.length);
+  let total = 1 + stmtBytes.length + 1;
+  total += 2 + paramFormats.length * 2;
+  total += 2;
+  for (let i = 0; i < params.length; i++) {
+    const p = params[i];
+    total += 4;
+    if (p !== null) {
+      const len = typeof p === "string" ? utf8Len(p) : p.length;
+      lens[i] = len;
+      total += len;
+    }
+  }
+  total += 2;
+  const body = new Uint8Array(total);
+  let off = 0;
+  body[off++] = 0;
+  body.set(stmtBytes, off);
+  off += stmtBytes.length;
+  body[off++] = 0;
+  body[off] = paramFormats.length >> 8 & 255;
+  body[off + 1] = paramFormats.length & 255;
+  off += 2;
+  for (const f of paramFormats) {
+    body[off] = f >> 8 & 255;
+    body[off + 1] = f & 255;
+    off += 2;
+  }
+  body[off] = params.length >> 8 & 255;
+  body[off + 1] = params.length & 255;
+  off += 2;
+  for (let i = 0; i < params.length; i++) {
+    const p = params[i];
+    if (p === null) {
+      body[off] = body[off + 1] = body[off + 2] = body[off + 3] = 255;
+      off += 4;
     } else {
-      params.push(values[i]);
-      sql += `$${params.length}` + strings[i + 1];
+      const len = lens[i];
+      body[off] = len >> 24 & 255;
+      body[off + 1] = len >> 16 & 255;
+      body[off + 2] = len >> 8 & 255;
+      body[off + 3] = len & 255;
+      off += 4;
+      if (typeof p === "string") body.set(utf8(p), off);
+      else body.set(p, off);
+      off += len;
     }
   }
-  return { sql, params };
+  body[off] = 0;
+  body[off + 1] = 0;
+  return encodeMessage("B", body);
 }
-var PG_ERROR_MAP = {
-  "23505": 409,
-  // unique_violation
-  "23503": 400,
-  // foreign_key_violation
-  "23502": 400,
-  // not_null_violation
-  "23514": 400,
-  // check_violation
-  "22P02": 400,
-  // invalid_text_representation
-  "22003": 400
-  // numeric_value_out_of_range
-};
-function wrapError(promise) {
-  return promise.catch((err) => {
-    const code = err?.code;
-    if (code && PG_ERROR_MAP[code]) {
-      throw new HttpError(`\u6570\u636E\u5E93\u9519\u8BEF: ${err.message}`, PG_ERROR_MAP[code]);
-    }
-    throw err;
-  });
+function utf8Len(s) {
+  return Buffer.byteLength(s);
 }
-
-// src/db/redis/connection.ts
-import net2 from "node:net";
-
-// src/db/redis/resp.ts
-var RespError = class extends DbError {
-  constructor(message) {
-    super("protocol", message, { code: "RESP" });
-    this.name = "RespError";
-  }
-};
-var IncompleteError = class extends Error {
-  constructor() {
-    super("incomplete RESP message");
-    this.name = "IncompleteError";
-  }
-};
-function encodeCommand(args) {
-  const parts = [`*${args.length}\r
-`];
-  for (const arg of args) {
-    const s = typeof arg === "string" ? arg : arg instanceof Buffer ? arg.toString() : String(arg);
-    parts.push(`$${Buffer.byteLength(s)}\r
-${s}\r
-`);
-  }
-  return _encoder.encode(parts.join(""));
+function executeMessage(portal = "", maxRows = 0) {
+  const body = new Uint8Array(portal.length + 1 + 4);
+  body.set(utf8(portal), 0);
+  body[portal.length] = 0;
+  const off = portal.length + 1;
+  body[off] = maxRows >> 24 & 255;
+  body[off + 1] = maxRows >> 16 & 255;
+  body[off + 2] = maxRows >> 8 & 255;
+  body[off + 3] = maxRows & 255;
+  return encodeMessage("E", body);
 }
-var _decoder = new TextDecoder();
-var _encoder = new TextEncoder();
-var RespParser = class {
+function syncMessage() {
+  return encodeMessage("S", new Uint8Array(0));
+}
+function flushMessage() {
+  return encodeMessage("H", new Uint8Array(0));
+}
+function describeMessage(kind, name = "") {
+  return encodeMessage("D", concat(utf8(kind), utf8(name), new Uint8Array([0])));
+}
+function terminateMessage() {
+  return encodeMessage("X", new Uint8Array(0));
+}
+function passwordMessage(password) {
+  return encodeMessage("p", utf8(password));
+}
+var MessageStream = class {
   buf = new Uint8Array(0);
   off = 0;
-  /** 喂入数据分片。返回 { value, incomplete }；incomplete=true 时需继续喂。 */
   push(chunk) {
-    this.append(chunk);
-    const saved = this.off;
-    try {
-      const value = this.parseValue();
-      this.compact();
-      return { value, incomplete: false };
-    } catch (e) {
-      this.off = saved;
-      if (e instanceof IncompleteError) return { value: null, incomplete: true };
-      throw e;
-    }
-  }
-  /** 喂入分片并解析 buffer 中所有完整响应（连接层：一次 data 事件可能含多个回复） */
-  pushAll(chunk) {
     this.append(chunk);
     const out = [];
     while (true) {
       const saved = this.off;
-      try {
-        out.push(this.parseValue());
-      } catch (e) {
+      const msg = this.tryRead();
+      if (!msg) {
         this.off = saved;
-        if (e instanceof IncompleteError) break;
-        throw e;
+        break;
       }
+      out.push(msg);
     }
     if (out.length > 0) this.compact();
     return out;
@@ -2677,7 +3182,6 @@ var RespParser = class {
     this.buf = merged;
     this.off = 0;
   }
-  /** 全部消费后压缩（释放底层） */
   compact() {
     if (this.off === this.buf.length) {
       this.buf = new Uint8Array(0);
@@ -2687,388 +3191,596 @@ var RespParser = class {
       this.off = 0;
     }
   }
-  parseValue() {
-    if (this.buf.length - this.off < 3) throw new IncompleteError();
+  /** 尝试读一条完整消息；不完整返回 null（不消费） */
+  tryRead() {
+    if (this.buf.length - this.off < 5) return null;
+    const len = this.buf[this.off + 1] << 24 | this.buf[this.off + 2] << 16 | this.buf[this.off + 3] << 8 | this.buf[this.off + 4];
+    if (this.buf.length - this.off < 1 + len) return null;
     const type = String.fromCharCode(this.buf[this.off]);
-    this.off++;
-    switch (type) {
-      case "+": {
-        const line = this.readLine();
-        return line;
-      }
-      case "-": {
-        const line = this.readLine();
-        return new RespError(line);
-      }
-      case ":": {
-        const line = this.readLine();
-        return parseInt(line, 10);
-      }
-      case "$": {
-        const len = parseInt(this.readLine(), 10);
-        if (len === -1) return null;
-        return this.readBulk(len);
-      }
-      case "*": {
-        const count = parseInt(this.readLine(), 10);
-        if (count === -1) return null;
-        const items = [];
-        for (let i = 0; i < count; i++) items.push(this.parseValue());
-        return items;
-      }
-      default:
-        throw new DbError("protocol", `unknown RESP type byte: ${type}`, { code: "RESP" });
-    }
+    const payload = this.buf.subarray(this.off + 5, this.off + 1 + len);
+    this.off += 1 + len;
+    return { type, payload };
   }
-  /** 读一行（到 \r\n），返回行内容（不含 type 字节与 \r\n），并推进 off */
-  readLine() {
-    const idx = indexOfCRLF(this.buf, this.off);
-    if (idx === -1) throw new IncompleteError();
-    const line = _decoder.decode(this.buf.subarray(this.off, idx));
-    this.off = idx + 2;
-    return line;
+};
+function authCode(msg) {
+  if (msg.type !== "R" || msg.payload.length < 4) return -1;
+  return msg.payload[0] << 24 | msg.payload[1] << 16 | msg.payload[2] << 8 | msg.payload[3];
+}
+function parseRowDescription(payload) {
+  const count = payload[0] << 8 | payload[1];
+  const cols = [];
+  let i = 2;
+  for (let c = 0; c < count; c++) {
+    let j = i;
+    while (payload[j] !== 0) j++;
+    const name = _decoder2.decode(payload.subarray(i, j));
+    i = j + 1;
+    i += 6;
+    const typeOid = payload[i] << 24 | payload[i + 1] << 16 | payload[i + 2] << 8 | payload[i + 3];
+    i += 4;
+    const typeLen = payload[i] << 8 | payload[i + 1];
+    i += 2;
+    i += 6;
+    cols.push({ name, typeOid, typeLen });
   }
-  /** 读 len 字节的 bulk 内容 + \r\n */
-  readBulk(len) {
-    if (this.buf.length - this.off < len + 2) throw new IncompleteError();
-    const value = _decoder.decode(this.buf.subarray(this.off, this.off + len));
-    this.off += len + 2;
-    return value;
+  return cols;
+}
+function parseDataRow(payload) {
+  const count = payload[0] << 8 | payload[1];
+  const values = [];
+  let i = 2;
+  for (let c = 0; c < count; c++) {
+    const len = payload[i] << 24 | payload[i + 1] << 16 | payload[i + 2] << 8 | payload[i + 3];
+    i += 4;
+    if (len === -1) {
+      values.push(null);
+    } else {
+      values.push(_decoder2.decode(payload.subarray(i, i + len)));
+      i += len;
+    }
   }
-};
-function indexOfCRLF(buf, from = 0) {
-  for (let i = from; i < buf.length - 1; i++) {
-    if (buf[i] === 13 && buf[i + 1] === 10) return i;
+  return values;
+}
+function parseErrorFields(payload) {
+  const out = {};
+  let i = 0;
+  while (i < payload.length && payload[i] !== 0) {
+    const type = String.fromCharCode(payload[i]);
+    let j = i + 1;
+    while (j < payload.length && payload[j] !== 0) j++;
+    const value = _decoder2.decode(payload.subarray(i + 1, j));
+    switch (type) {
+      case "S":
+        out.severity = value;
+        break;
+      case "C":
+        out.code = value;
+        break;
+      case "M":
+        out.message = value;
+        break;
+      case "D":
+        out.detail = value;
+        break;
+      case "H":
+        out.hint = value;
+        break;
+      case "P":
+        out.position = value;
+        break;
+    }
+    i = j + 1;
   }
-  return -1;
+  return out;
+}
+var _decoder2 = new TextDecoder();
+var _encoder2 = new TextEncoder();
+function utf8(s) {
+  return _encoder2.encode(s);
+}
+function concat(...parts) {
+  let total = 0;
+  for (const p of parts) total += p.length;
+  const out = new Uint8Array(total);
+  let off = 0;
+  for (const p of parts) {
+    out.set(p, off);
+    off += p.length;
+  }
+  return out;
 }
 
-// src/db/redis/connection.ts
-var PUSH_TYPES = /* @__PURE__ */ new Set(["message", "pmessage"]);
-var RedisConnection = class {
-  ready = false;
+// src/db/postgres/connection.ts
+var PgConnection = class _PgConnection {
   opts;
-  socket = null;
-  parser = new RespParser();
-  pending = [];
-  offlineQueue = [];
-  subs = /* @__PURE__ */ new Map();
-  psubs = /* @__PURE__ */ new Map();
-  status = "idle";
-  retries = 0;
-  reconnectTimer = null;
-  connectPromise = null;
-  closed = false;
-  connectedOnce = false;
+  timeoutSet = false;
+  awaitingReady = false;
+  pendingErrorZ = false;
+  socket = null;
+  stream = new MessageStream();
+  status = "idle";
+  waiters = [];
   constructor(options = {}) {
     this.opts = {
       host: options.host ?? "127.0.0.1",
-      port: options.port ?? 6379,
-      retryDelayMs: options.retryDelayMs ?? 100,
-      maxRetries: options.maxRetries ?? 10,
-      enableOfflineQueue: options.enableOfflineQueue ?? true
+      port: options.port ?? 5432,
+      user: options.user ?? "postgres",
+      database: options.database ?? "postgres",
+      connectTimeoutMs: options.connectTimeoutMs ?? 1e4,
+      statementTimeoutMs: options.statementTimeoutMs ?? 0,
+      password: options.password
     };
   }
-  /** 建立连接并等待 ready。重连失败（超过 maxRetries）抛 ConnectionError。 */
+  get connected() {
+    return this.status === "ready";
+  }
   connect() {
-    if (this.connectPromise) return this.connectPromise;
-    this.closed = false;
-    this.connectPromise = new Promise((resolve3, reject) => {
-      this.openSocket();
-      this.onceReady = () => resolve3();
-      this.onceFailed = (err) => reject(err);
-    }).finally(() => {
-      this.connectPromise = null;
-      this.onceReady = void 0;
-      this.onceFailed = void 0;
+    return new Promise((resolve3, reject) => {
+      this.status = "connecting";
+      const sock = net3.connect(this.opts.port, this.opts.host);
+      this.socket = sock;
+      const timeout = setTimeout(() => {
+        sock.destroy();
+        reject(new ConnectionError(`postgres: connect timeout after ${this.opts.connectTimeoutMs}ms`));
+      }, this.opts.connectTimeoutMs);
+      sock.once("connect", () => {
+        sock.setNoDelay(true);
+        sock.write(startupMessage({ user: this.opts.user, database: this.opts.database }));
+      });
+      sock.on("data", (chunk) => this.onData(chunk));
+      sock.on("error", (err) => {
+        clearTimeout(timeout);
+        if (this.status === "connecting") {
+          reject(new ConnectionError(`postgres: ${err.message}`));
+        }
+      });
+      sock.on("close", () => {
+        clearTimeout(timeout);
+        this.socket = null;
+        if (this.status !== "closed") {
+          this.status = "closed";
+          const q = this.currentQuery;
+          this.currentQuery = null;
+          if (q) q.reject(new ConnectionError("postgres: connection closed"));
+        }
+      });
+      this.onReady = () => {
+        clearTimeout(timeout);
+        this.status = "ready";
+        resolve3();
+      };
+      this.onAuthFail = (err) => {
+        clearTimeout(timeout);
+        reject(err);
+      };
     });
-    return this.connectPromise;
   }
-  onceReady;
-  onceFailed;
-  openSocket() {
-    this.status = "connecting";
-    const sock = net2.connect(this.opts.port, this.opts.host);
-    this.socket = sock;
-    sock.on("connect", () => {
-      sock.setNoDelay(true);
-      this.status = "ready";
-      this.retries = 0;
-      this.flushOffline();
-      this.onceReady?.();
-      if (this.connectedOnce) {
-        for (const ch of this.subs.keys()) this.sendNow("SUBSCRIBE", [ch]);
-        for (const pat of this.psubs.keys()) this.sendNow("PSUBSCRIBE", [pat]);
+  onReady = null;
+  onAuthFail = null;
+  expectingAuth = true;
+  authCtx = null;
+  prepared = /* @__PURE__ */ new Map();
+  // sig → stmt + 列缓存（LRU）
+  static PREPARED_MAX = 128;
+  stmtSeq = 0;
+  currentQuery = null;
+  onData(chunk) {
+    const msgs = this.stream.push(new Uint8Array(chunk));
+    for (const msg of msgs) {
+      this.handle(msg);
+    }
+  }
+  handle(msg) {
+    if (this.expectingAuth) {
+      if (msg.type === "R") {
+        const code = authCode(msg);
+        if (code === 0) {
+        } else if (code === 3) {
+          this.send(passwordMessage(this.opts.password ?? ""));
+        } else if (code === 5) {
+          const salt = msg.payload.subarray(8, 12);
+          const inner = crypto2.createHash("md5").update(this.opts.password + this.opts.user).digest("hex");
+          const outer = crypto2.createHash("md5").update(inner + Buffer.from(salt).toString("latin1")).digest("hex");
+          this.send(passwordMessage(`md5${outer}`));
+        } else if (code === 10) {
+          const nonce = crypto2.randomBytes(18).toString("base64url");
+          const clientFirstBare = `n=,r=${nonce}`;
+          this.authCtx = { clientNonce: nonce, clientFirstBare, serverFirst: "" };
+          const mech = utf82("SCRAM-SHA-256\0");
+          const resp = utf82(`n,,${clientFirstBare}`);
+          const payload = new Uint8Array(mech.length + 4 + resp.length);
+          payload.set(mech, 0);
+          payload[mech.length] = resp.length >> 24 & 255;
+          payload[mech.length + 1] = resp.length >> 16 & 255;
+          payload[mech.length + 2] = resp.length >> 8 & 255;
+          payload[mech.length + 3] = resp.length & 255;
+          payload.set(resp, mech.length + 4);
+          this.send(encodeP(payload));
+        } else if (code === 11) {
+          const serverFirst = new TextDecoder().decode(msg.payload.subarray(4));
+          if (!this.authCtx) {
+            this.onAuthFail?.(new ConnectionError("postgres: unexpected SASL continue"));
+            return;
+          }
+          this.authCtx.serverFirst = serverFirst;
+          const clientFinal = this.scramFinal(this.authCtx);
+          this.send(encodeP(utf82(clientFinal)));
+        } else if (code === 12) {
+          const serverFinal = new TextDecoder().decode(msg.payload.subarray(4));
+          const vMatch = serverFinal.match(/v=([A-Za-z0-9+/=]+)/);
+          if (vMatch && this.authCtx) {
+            const expected = this.scramServerSignature(this.authCtx);
+            if (vMatch[1] !== expected) {
+              this.onAuthFail?.(new ConnectionError("postgres: SCRAM server signature mismatch"));
+              return;
+            }
+          }
+        }
+        return;
       }
-      this.connectedOnce = true;
-    });
-    sock.on("data", (chunk) => this.onData(new Uint8Array(chunk)));
-    sock.on("error", (err) => {
-      if (this.status === "connecting") {
-        this.handleDisconnect(err);
+      if (msg.type === "E") {
+        const fields = parseErrorFields(msg.payload);
+        this.expectingAuth = false;
+        this.onAuthFail?.(new ConnectionError(`postgres: auth failed: ${fields.message ?? "unknown"}`));
+        this.socket?.destroy();
+        return;
       }
-    });
-    sock.on("close", () => {
-      this.socket = null;
-      if (this.status !== "closed" && this.status !== "idle") {
-        this.handleDisconnect(new ConnectionError("redis: socket closed"));
+      if (msg.type === "Z") {
+        this.expectingAuth = false;
+        if (this.opts.statementTimeoutMs > 0 && !this.timeoutSet) {
+          this.timeoutSet = true;
+          this.awaitingReady = true;
+          this.socket?.write(queryMessage(`SET statement_timeout = ${this.opts.statementTimeoutMs}`));
+          return;
+        }
+        this.onReady?.();
+        return;
       }
-    });
-  }
-  handleDisconnect(err) {
-    const queue = this.pending;
-    this.pending = [];
-    const retryErr = err instanceof ConnectionError ? err : err;
-    for (const p of queue) p.reject(retryErr);
-    if (this.closed || this.status === "closed") return;
-    this.retries++;
-    if (this.opts.maxRetries > 0 && this.retries > this.opts.maxRetries) {
-      this.status = "closed";
-      const failErr = err instanceof ConnectionError ? err : new ConnectionError(`redis: connect to ${this.opts.host}:${this.opts.port} failed`, this.retries, err);
-      this.onceFailed?.(failErr);
       return;
     }
-    const delay = Math.min(this.opts.retryDelayMs * 2 ** (this.retries - 1), 5e3);
-    this.reconnectTimer = setTimeout(() => {
-      this.reconnectTimer = null;
-      this.openSocket();
-    }, delay);
-  }
-  onData(chunk) {
-    try {
-      const values = this.parser.pushAll(chunk);
-      for (const value of values) {
-        if (Array.isArray(value) && typeof value[0] === "string" && PUSH_TYPES.has(value[0])) {
-          this.dispatchSubscribe(value);
-          continue;
+    switch (msg.type) {
+      case "T": {
+        if (this.currentQuery) {
+          this.currentQuery.columns = parseRowDescription(msg.payload);
+          const sig = `${this.currentQuery.sql}|${this.currentQuery.params?.length ?? 0}`;
+          const entry = this.getPrepared(sig);
+          if (entry) entry.columns = this.currentQuery.columns;
         }
-        const p = this.pending.shift();
-        if (!p) break;
-        if (value instanceof RespError) p.reject(value);
-        else p.resolve(value);
+        break;
       }
-    } catch (e) {
-      const queue = this.pending;
-      this.pending = [];
-      for (const q of queue) q.reject(e);
-      this.socket?.destroy();
+      case "D": {
+        const values = parseDataRow(msg.payload);
+        if (this.currentQuery && this.currentQuery.columns) {
+          const row = {};
+          this.currentQuery.columns.forEach((col, i) => {
+            row[col.name] = convertValue(col.typeOid, values[i] ?? null);
+          });
+          this.currentQuery.rows.push(row);
+        }
+        break;
+      }
+      case "C":
+        break;
+      // CommandComplete——忽略 tag
+      case "t": {
+        if (this.currentQuery?.awaitingDescribe && this.currentQuery.sql !== void 0) {
+          this.currentQuery.awaitingDescribe = false;
+          if (this.currentQuery.prepKey && this.currentQuery.prepName) {
+            this.setPrepared(this.currentQuery.prepKey, {
+              name: this.currentQuery.prepName,
+              columns: this.currentQuery.columns
+            });
+          }
+          this.send(bindMessage(this.currentQuery.prepName ?? "", this.currentQuery.params ?? []));
+          this.send(executeMessage());
+          this.send(syncMessage());
+        }
+        break;
+      }
+      case "Z": {
+        if (this.pendingErrorZ) {
+          this.pendingErrorZ = false;
+          break;
+        }
+        const q = this.currentQuery;
+        this.currentQuery = null;
+        if (q) q.resolve(q.rows);
+        if (this.awaitingReady) {
+          this.awaitingReady = false;
+          this.onReady?.();
+        }
+        this.notifyIdle();
+        break;
+      }
+      case "E": {
+        const fields = parseErrorFields(msg.payload);
+        const q = this.currentQuery;
+        this.currentQuery = null;
+        if (q) {
+          this.pendingErrorZ = true;
+          if (q.awaitingDescribe) this.send(syncMessage());
+          const err = new Error(fields.message ?? "postgres query error");
+          err.code = fields.code;
+          q.reject(err);
+        }
+        break;
+      }
+      case "N":
+        break;
+      // NoticeResponse 忽略
+      default:
+        break;
     }
   }
-  /** 发送命令并等待响应（单连接严格有序）。未 ready 时入离线队列（enableOfflineQueue）或拒绝。 */
-  command(name, ...args) {
-    if (this.status === "ready" && this.socket) {
-      return this.sendNow(name, args);
-    }
-    if (this.closed || this.status === "closed" || !this.opts.enableOfflineQueue) {
-      return Promise.reject(new ConnectionError("redis: not connected"));
-    }
-    return new Promise((resolve3, reject) => {
-      this.offlineQueue.push({ name, args, resolve: resolve3, reject });
-    });
+  /** SCRAM client-final 消息 */
+  scramFinal(ctx) {
+    const parts = new Map(
+      ctx.serverFirst.split(",").map((kv) => {
+        const i = kv.indexOf("=");
+        return [kv.slice(0, i), kv.slice(i + 1)];
+      })
+    );
+    const salt = Buffer.from(parts.get("s") ?? "", "base64");
+    const iterations = parseInt(parts.get("i") ?? "4096", 10);
+    const nonce = parts.get("r") ?? "";
+    const password = this.opts.password ?? "";
+    const saltedPassword = crypto2.pbkdf2Sync(password, salt, iterations, 32, "sha256");
+    const clientKey = hmac(saltedPassword, "Client Key");
+    const storedKey = crypto2.createHash("sha256").update(clientKey).digest();
+    const channelBinding = "c=biws";
+    const clientFinalWithoutProof = `${channelBinding},r=${nonce}`;
+    const authMessage = `${ctx.clientFirstBare},${ctx.serverFirst},${clientFinalWithoutProof}`;
+    const clientSignature = hmac(storedKey, authMessage);
+    const clientProof = xor(clientKey, clientSignature);
+    return `${clientFinalWithoutProof},p=${Buffer.from(clientProof).toString("base64")}`;
   }
-  sendNow(name, args) {
-    return new Promise((resolve3, reject) => {
-      this.pending.push({ resolve: resolve3, reject });
-      this.socket.write(encodeCommand([name, ...args]));
-    });
+  scramServerSignature(ctx) {
+    const parts = new Map(
+      ctx.serverFirst.split(",").map((kv) => {
+        const i = kv.indexOf("=");
+        return [kv.slice(0, i), kv.slice(i + 1)];
+      })
+    );
+    const salt = Buffer.from(parts.get("s") ?? "", "base64");
+    const iterations = parseInt(parts.get("i") ?? "4096", 10);
+    const nonce = parts.get("r") ?? "";
+    const saltedPassword = crypto2.pbkdf2Sync(this.opts.password ?? "", salt, iterations, 32, "sha256");
+    const serverKey = hmac(saltedPassword, "Server Key");
+    const clientFinalWithoutProof = `c=biws,r=${nonce}`;
+    const authMessage = `${ctx.clientFirstBare},${ctx.serverFirst},${clientFinalWithoutProof}`;
+    return Buffer.from(hmac(serverKey, authMessage)).toString("base64");
   }
-  flushOffline() {
-    const queue = this.offlineQueue;
-    this.offlineQueue = [];
-    for (const q of queue) {
-      this.sendNow(q.name, q.args).then(q.resolve, q.reject);
+  /** LRU 读取：命中移到尾部（最近使用），超限删最旧 */
+  getPrepared(sig) {
+    const entry = this.prepared.get(sig);
+    if (entry) {
+      this.prepared.delete(sig);
+      this.prepared.set(sig, entry);
+    }
+    return entry;
+  }
+  /** LRU 写入：刷新位置；超上限淘汰最旧（长运行服务防无限累积） */
+  setPrepared(sig, entry) {
+    this.prepared.delete(sig);
+    this.prepared.set(sig, entry);
+    if (this.prepared.size > _PgConnection.PREPARED_MAX) {
+      const oldest = this.prepared.keys().next().value;
+      if (oldest !== void 0) this.prepared.delete(oldest);
     }
   }
-  /** 批量执行：一次 write 发送所有命令字节，响应按序路由（管道） */
-  batch(payload, count) {
-    if (this.status !== "ready" || !this.socket) {
-      return Promise.reject(new ConnectionError("redis: not connected"));
+  /** 事务：BEGIN → fn(tx) → COMMIT；fn 抛错 → ROLLBACK（回滚失败吞掉，保留原始错误） */
+  async transaction(fn) {
+    await this.query("BEGIN");
+    try {
+      const result = await fn({ query: (sql, params) => this.query(sql, params) });
+      await this.query("COMMIT");
+      return result;
+    } catch (e) {
+      await this.query("ROLLBACK").catch(() => {
+      });
+      throw e;
     }
+  }
+  /** 查询：无参数走简单协议（Q），有参数走扩展查询（Parse/Bind/Execute/Sync） */
+  query(sql, params) {
     return new Promise((resolve3, reject) => {
-      const results = [];
-      const maybeResolve = () => {
-        if (results.length === count) resolve3(results);
-      };
-      for (let i = 0; i < count; i++) {
-        this.pending.push({
-          // 正常响应与错误响应（RespError）都作为结果值收集——管道语义
-          resolve: (v) => {
-            results.push(v);
-            maybeResolve();
-          },
-          reject: (e) => {
-            results.push(e);
-            maybeResolve();
-          }
-        });
+      if (this.status !== "ready" || !this.socket) {
+        reject(new ConnectionError("postgres: not connected"));
+        return;
+      }
+      if (this.currentQuery) {
+        reject(new ConnectionError("postgres: query already in progress"));
+        return;
+      }
+      if (!params || params.length === 0) {
+        this.currentQuery = {
+          columns: [],
+          rows: [],
+          resolve: resolve3,
+          reject
+        };
+        this.socket.write(queryMessage(sql));
+      } else {
+        const sig = `${sql}|${params.length}`;
+        let stmtEntry = this.getPrepared(sig);
+        const encoded = encodeParams(params);
+        if (!stmtEntry) {
+          const name = `wf_s${++this.stmtSeq}`;
+          this.currentQuery = {
+            columns: [],
+            rows: [],
+            resolve: resolve3,
+            reject,
+            sql,
+            params: encoded,
+            awaitingDescribe: true,
+            prepKey: sig,
+            prepName: name
+          };
+          this.socket.write(parseMessage(name, sql, params.map(() => 0)));
+          this.socket.write(describeMessage("S", name));
+          this.socket.write(flushMessage());
+        } else {
+          this.currentQuery = {
+            columns: [...stmtEntry.columns],
+            rows: [],
+            resolve: resolve3,
+            reject,
+            sql,
+            params: encoded,
+            awaitingDescribe: false
+          };
+          this.socket.write(bindMessage(stmtEntry.name, encoded));
+          this.socket.write(executeMessage());
+          this.socket.write(syncMessage());
+        }
       }
-      this.socket.write(payload);
     });
   }
-  /** 订阅频道：回调式（channel, message） */
-  async subscribe(channel, fn) {
-    this.subs.set(channel, fn);
-    await this.command("SUBSCRIBE", channel);
+  send(data) {
+    this.socket?.write(data);
   }
-  /** 订阅模式：回调式（channel, message） */
-  async psubscribe(pattern, fn) {
-    this.psubs.set(pattern, fn);
-    await this.command("PSUBSCRIBE", pattern);
+  notifyIdle() {
+    const ws = this.waiters;
+    this.waiters = [];
+    for (const w of ws) w();
   }
-  /** 旁路分发订阅消息（RESP 数组路由到回调） */
-  dispatchSubscribe(value) {
-    const [type, a, b] = value;
-    if (type === "message") {
-      const fn = this.subs.get(a);
-      fn?.(a, b);
-    } else if (type === "pmessage") {
-      const fn = this.psubs.get(a);
-      fn?.(b, value[3] ?? "");
-    }
+  /** 等待连接空闲（事务/多语句流程用） */
+  waitIdle() {
+    if (!this.currentQuery) return Promise.resolve();
+    return new Promise((resolve3) => this.waiters.push(resolve3));
   }
-  /** 主动关闭——不再重连 */
+  /** 终止连接 */
   async close() {
-    this.closed = true;
-    this.status = "closed";
-    if (this.reconnectTimer) {
-      clearTimeout(this.reconnectTimer);
-      this.reconnectTimer = null;
-    }
-    const queue = this.pending;
-    this.pending = [];
-    for (const p of queue) p.reject(new ConnectionError("redis: connection closed"));
     const sock = this.socket;
-    this.socket = null;
-    if (sock) {
-      sock.destroy();
-      await new Promise((r) => setTimeout(r, 0));
+    if (this.status === "ready" && sock) {
+      sock.write(terminateMessage());
     }
-  }
-  get connected() {
-    return this.status === "ready";
+    this.status = "closed";
+    if (sock) sock.destroy();
   }
 };
-
-// src/db/redis/client.ts
-var RedisClient = class _RedisClient {
-  conn;
-  constructor(conn) {
-    this.conn = conn;
-  }
-  /** 建立连接并返回就绪的客户端 */
-  static async connect(options = {}) {
-    const conn = new RedisConnection(options);
-    await conn.connect();
-    return new _RedisClient(conn);
-  }
-  /** 底层命令透传（RESP 值） */
-  command(name, ...args) {
-    return this.conn.command(name, ...args);
-  }
-  // ── 基础命令 ──────────────────────────────
-  async get(key) {
-    const v = await this.conn.command("GET", key);
-    return v === null ? null : String(v);
-  }
-  /**
-   * SET。ttl 秒可省略；传入即安全生效（内部转 SET key val EX ttl）。
-   */
-  async set(key, value, ttl) {
-    const reply = ttl !== void 0 ? await this.conn.command("SET", key, value, "EX", ttl) : await this.conn.command("SET", key, value);
-    return String(reply);
-  }
-  /** DEL 多 key，返回删除数量 */
-  async del(...keys) {
-    const v = await this.conn.command("DEL", ...keys);
-    return Number(v);
-  }
-  /** INCR，返回自增后的值 */
-  async incr(key) {
-    return Number(await this.conn.command("INCR", key));
-  }
-  /** EXPIRE，返回 1=设置成功 0=key 不存在 */
-  async expire(key, seconds) {
-    return Number(await this.conn.command("EXPIRE", key, seconds));
-  }
-  /** TTL 剩余秒数；-1=无 TTL -2=key 不存在 */
-  async ttl(key) {
-    return Number(await this.conn.command("TTL", key));
-  }
-  // ── JSON 存取（自动序列化） ────────────────
-  /** 读取并 JSON.parse；key 不存在返回 null */
-  async jsonGet(key) {
-    const raw = await this.conn.command("GET", key);
-    if (raw === null) return null;
-    try {
-      return JSON.parse(String(raw));
-    } catch {
-      throw new ValidationError(`redis: value of key '${key}' is not valid JSON`);
+function utf82(s) {
+  return new TextEncoder().encode(s);
+}
+function encodeP(payload) {
+  const out = new Uint8Array(1 + 4 + payload.length);
+  out[0] = 112;
+  const len = 4 + payload.length;
+  out[1] = len >> 24 & 255;
+  out[2] = len >> 16 & 255;
+  out[3] = len >> 8 & 255;
+  out[4] = len & 255;
+  out.set(payload, 5);
+  return out;
+}
+function hmac(key, data) {
+  return crypto2.createHmac("sha256", key).update(data).digest();
+}
+function xor(a, b) {
+  const out = new Uint8Array(a.length);
+  for (let i = 0; i < a.length; i++) out[i] = a[i] ^ b[i];
+  return out;
+}
+function encodeParams(params) {
+  return params.map((p) => {
+    if (p === null || p === void 0) return null;
+    if (typeof p === "object") return JSON.stringify(p);
+    return String(p);
+  });
+}
+function convertValue(oid, value) {
+  if (value === null) return null;
+  switch (oid) {
+    case 114:
+    case 3802:
+      return JSON.parse(value);
+    case 20: {
+      const n = BigInt(value);
+      if (n > BigInt(Number.MAX_SAFE_INTEGER) || n < BigInt(-Number.MAX_SAFE_INTEGER)) {
+        return value;
+      }
+      return Number(n);
     }
+    case 21:
+    case 23:
+    case 26:
+      return Number(value);
+    case 700:
+    case 701:
+    case 1700:
+      return parseFloat(value);
+    case 16:
+      return value === "t";
+    default:
+      return value;
   }
-  /** JSON.stringify 后写入，可选 TTL */
-  async jsonSet(key, value, ttl) {
-    return this.set(key, JSON.stringify(value), ttl);
-  }
-  // ── 缓存便捷 ──────────────────────────────
-  /**
-   * 缓存读-算-写。命中返回缓存值；miss 执行 fn 并回填。
-   * fn 返回 null 时不缓存（防穿透）。
-   */
-  async cache(key, fn, ttl) {
-    const hit = await this.jsonGet(key);
-    if (hit !== null) return hit;
-    const value = await fn();
-    if (value !== null) await this.jsonSet(key, value, ttl);
-    return value;
-  }
-  /** 主动关闭连接 */
-  async close() {
-    await this.conn.close();
-  }
-};
+}
 
-// src/db/redis/subscriber.ts
-var RedisSubscriber = class {
-  conn;
-  constructor(options = {}) {
-    this.conn = new RedisConnection(options);
-  }
-  async connect() {
-    await this.conn.connect();
+// src/db/postgres/schema.ts
+function validateValue(def, value, column) {
+  if (value === void 0 || value === null) {
+    if (def.required) {
+      throw new ValidationError(`schema: '${column}' is required`);
+    }
+    return;
   }
-  /** 订阅频道：回调式 */
-  subscribe(channel, fn) {
-    return this.conn.subscribe(channel, fn);
+  switch (def.type) {
+    case "text":
+      if (typeof value !== "string") {
+        throw new ValidationError(`schema: '${column}' must be a string, got ${typeof value}`);
+      }
+      break;
+    case "int":
+      if (typeof value !== "number" || !Number.isInteger(value)) {
+        throw new ValidationError(`schema: '${column}' must be an integer, got ${typeof value}`);
+      }
+      break;
+    case "jsonb":
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new ValidationError(`schema: '${column}' must be a JSON object`);
+      }
+      break;
+    case "enum":
+      if (!def.values?.includes(value)) {
+        throw new ValidationError(
+          `schema: '${column}' must be one of [${def.values?.join(", ")}], got ${String(value)}`
+        );
+      }
+      break;
   }
-  /** 订阅模式（通配符）：回调式 */
-  psubscribe(pattern, fn) {
-    return this.conn.psubscribe(pattern, fn);
+}
+function validateRow(schema, row) {
+  for (const [col, def] of Object.entries(schema)) {
+    if (def.required && (row[col] === void 0 || row[col] === null)) {
+      throw new ValidationError(`schema: '${col}' is required`);
+    }
   }
-  async close() {
-    await this.conn.close();
+  for (const [col, value] of Object.entries(row)) {
+    const def = schema[col];
+    if (!def) continue;
+    validateValue(def, value, col);
   }
-};
+}
 
-// src/db/redis/pool.ts
-var RedisPool = class _RedisPool {
-  clients = [];
-  rr = 0;
+// src/db/postgres/pool.ts
+var PgPool = class _PgPool {
+  all = [];
+  available = [];
+  waiters = [];
   closed = false;
-  keyPrefix;
   opts;
   initPromise = null;
-  /** 懒连接模式：构造不连接，首命令时初始化（中间件注入场景） */
-  constructor(opts = {}) {
-    this.keyPrefix = opts.keyPrefix ?? "";
-    this.opts = opts;
+  schemas = /* @__PURE__ */ new Map();
+  /** 懒连接：构造不连接，ensure() 首次初始化（中间件注入场景） */
+  constructor(options = {}) {
+    this.opts = options;
   }
-  /** 建立池：创建 poolSize 个连接（eager） */
   static async create(options = {}) {
-    const pool = new _RedisPool(options);
+    const pool = new _PgPool(options);
     await pool.ensure();
     return pool;
   }
-  /** 懒连接：首次使用时初始化连接（中间件场景：构造即注入，首命令才连） */
   readyPromise = null;
   ensure() {
     if (this.readyPromise) return this.readyPromise;
@@ -3079,91 +3791,324 @@ var RedisPool = class _RedisPool {
   }
   async init() {
     const poolSize = this.opts.poolSize ?? 5;
-    this.clients = await Promise.all(
-      Array.from({ length: poolSize }, () => RedisClient.connect(this.opts))
+    const conns = await Promise.all(
+      Array.from({ length: poolSize }, async () => {
+        const c = new PgConnection(this.opts);
+        await c.connect();
+        return c;
+      })
     );
+    this.all = conns;
+    this.available = [...conns];
     this.readyPromise = Promise.resolve();
   }
-  /** 应用 key 前缀（command 透传不加） */
-  k(key) {
-    return this.keyPrefix + key;
+  /** 获取一个空闲连接（全忙则排队等待） */
+  acquire() {
+    if (this.closed) return Promise.reject(new ConnectionError("postgres: pool is closed"));
+    if (this.available.length > 0) {
+      return Promise.resolve(this.available.pop());
+    }
+    const timeoutMs = this.opts.acquireTimeoutMs ?? 3e4;
+    return new Promise((resolve3, reject) => {
+      const waiter = {
+        resolve: resolve3,
+        reject
+      };
+      if (timeoutMs > 0) {
+        waiter.timer = setTimeout(() => {
+          const idx = this.waiters.indexOf(waiter);
+          if (idx >= 0) this.waiters.splice(idx, 1);
+          reject(new TimeoutError("postgres: pool acquire", timeoutMs));
+        }, timeoutMs);
+      }
+      this.waiters.push(waiter);
+    });
   }
-  /** round-robin 选择连接 */
-  next() {
-    if (this.closed || this.clients.length === 0) {
-      throw new ConnectionError("redis: pool is closed");
+  release(conn) {
+    if (this.closed) {
+      conn.close();
+      return;
     }
-    const client = this.clients[this.rr % this.clients.length];
-    this.rr++;
-    return client;
+    if (!conn.connected) {
+      conn.close();
+      this.replenish();
+      return;
+    }
+    this.dispatchAvailable(conn);
   }
-  // ── 与 RedisClient 相同的方法面（代理到轮询连接） ──
-  async command(name, ...args) {
-    await this.ensure();
-    return this.next().command(name, ...args);
+  /** 连接可用事件统一入口：优先唤醒等待者，否则回空闲池（release 与 replenish 共用） */
+  dispatchAvailable(conn) {
+    const waiter = this.waiters.shift();
+    if (waiter) {
+      if (waiter.timer) clearTimeout(waiter.timer);
+      waiter.resolve(conn);
+    } else {
+      this.available.push(conn);
+    }
   }
-  async get(key) {
+  /** 坏连接剔除后异步重建（池容量保持）——就绪后走统一分发（唤醒 waiter） */
+  replenish() {
+    if (this.closed) return;
+    const c = new PgConnection(this.opts);
+    c.connect().then(() => {
+      if (this.closed) {
+        c.close();
+        return;
+      }
+      this.all.push(c);
+      this.dispatchAvailable(c);
+    }).catch(() => {
+      setTimeout(() => this.replenish(), 500);
+    });
+  }
+  async query(sql, params) {
     await this.ensure();
-    return this.next().get(this.k(key));
+    const conn = await this.acquire();
+    const start = performance.now();
+    try {
+      const rows = await conn.query(sql, params);
+      this.opts.onQuery?.(sql, performance.now() - start, rows.length);
+      return rows;
+    } finally {
+      this.release(conn);
+    }
   }
-  async set(key, value, ttl) {
+  /** 注册表结构（元数据闭环：校验/类型推断的起点） */
+  register(table, schema) {
+    this.schemas.set(table, schema);
+  }
+  /** 写前校验 + 参数化插入（schema 驱动，脏数据源头拦截） */
+  async insert(table, row) {
+    const schema = this.schemas.get(table);
+    if (!schema) {
+      throw new ValidationError(`schema: table '${table}' not registered\u2014call register() first`);
+    }
+    validateRow(schema, row);
+    const cols = Object.keys(row);
+    if (cols.length === 0) throw new ValidationError("schema: insert requires at least one column");
+    const placeholders = cols.map((_, i) => `$${i + 1}`).join(", ");
+    const sql = `INSERT INTO ${table} (${cols.join(", ")}) VALUES (${placeholders})`;
+    return this.query(sql, cols.map((c) => row[c]));
+  }
+  /**
+   * tagged template: sql\`SELECT * FROM t WHERE id = \${id}\`
+   * 插值 = 参数（postgres.js 语义，防注入）；表名必须硬编码（插值会被当参数）。
+   * 对象插值自动 JSON.stringify → jsonb。
+   */
+  tag(strings, ...values) {
+    const { sql, params } = parseTagged(strings, values);
+    return this.query(sql, params);
+  }
+  /** postgres.js 兼容事务 API: begin(fn)——fn 收到 tagged template 事务 sql */
+  async begin(fn) {
     await this.ensure();
-    return this.next().set(this.k(key), value, ttl);
+    return this.transaction(async (tx) => {
+      const txSql = (strings, ...values) => {
+        const { sql, params } = parseTagged(strings, values);
+        return tx.query(sql, params);
+      };
+      return fn(txSql);
+    });
+  }
+  /** 片段：可嵌套的 SQL 片段（postgres.js fragment 语义，条件过滤模式） */
+  frag(strings, ...values) {
+    const { sql, params } = parseTagged(strings, values);
+    return { __fragment: { sql, params } };
   }
-  async del(...keys) {
+  /** 原生 SQL（DDL / 动态表名场景）；$1 占位符 + 参数数组 */
+  async unsafe(sql, params) {
     await this.ensure();
-    return this.next().del(...keys.map((k) => this.k(k)));
+    const conn = await this.acquire();
+    try {
+      return await conn.query(sql, params);
+    } finally {
+      this.release(conn);
+    }
   }
-  async incr(key) {
+  /** 事务：固定在单个连接上执行整个 BEGIN→fn→COMMIT/ROLLBACK */
+  async transaction(fn) {
     await this.ensure();
-    return this.next().incr(this.k(key));
+    const conn = await this.acquire();
+    try {
+      await conn.query("BEGIN");
+      try {
+        const result = await fn({ query: (sql, params) => conn.query(sql, params) });
+        await conn.query("COMMIT");
+        return result;
+      } catch (e) {
+        await conn.query("ROLLBACK").catch(() => {
+        });
+        throw e;
+      }
+    } finally {
+      this.release(conn);
+    }
   }
-  async expire(key, seconds) {
-    await this.ensure();
-    return this.next().expire(this.k(key), seconds);
+  async close() {
+    this.closed = true;
+    this.readyPromise = null;
+    this.available = [];
+    await Promise.all(this.all.map((c) => c.close()));
+    this.all = [];
+    const ws = this.waiters;
+    this.waiters = [];
+    for (const w of ws) {
+      if (w.timer) clearTimeout(w.timer);
+      w.reject(new ConnectionError("postgres: pool is closed"));
+    }
   }
-  async ttl(key) {
-    await this.ensure();
-    return this.next().ttl(this.k(key));
+  get size() {
+    return this.available.length + this.waiters.length;
   }
-  async jsonGet(key) {
-    await this.ensure();
-    return this.next().jsonGet(this.k(key));
+};
+function parseTagged(strings, values) {
+  let sql = strings[0];
+  const params = [];
+  for (let i = 0; i < values.length; i++) {
+    const frag = values[i]?.__fragment;
+    if (frag) {
+      const renumbered = frag.sql.replace(/\$(\d+)/g, (_m, idx) => {
+        params.push(frag.params[parseInt(idx, 10) - 1]);
+        return `$${params.length}`;
+      });
+      sql += renumbered + strings[i + 1];
+    } else {
+      params.push(values[i]);
+      sql += `$${params.length}` + strings[i + 1];
+    }
   }
-  async jsonSet(key, value, ttl) {
-    await this.ensure();
-    return this.next().jsonSet(this.k(key), value, ttl);
+  return { sql, params };
+}
+
+// src/postgres/client.ts
+var MIGRATIONS_TABLE = "_weifuwu_migrations";
+function postgres(options) {
+  const opts = typeof options === "string" ? { connection: options } : options ?? {};
+  const connection = opts.connection ?? process.env.DATABASE_URL;
+  if (!connection) {
+    throw new Error(
+      "postgres: DATABASE_URL is not set. Pass a connection string or set the DATABASE_URL environment variable."
+    );
   }
-  async cache(key, fn, ttl) {
-    await this.ensure();
-    return this.next().cache(this.k(key), fn, ttl);
+  const u = new URL(connection);
+  const pool = new PgPool({
+    host: u.hostname,
+    port: Number(u.port || 5432),
+    user: decodeURIComponent(u.username),
+    password: decodeURIComponent(u.password),
+    database: u.pathname.replace(/^\//, ""),
+    poolSize: opts.max ?? opts.poolSize ?? 10,
+    acquireTimeoutMs: opts.acquireTimeoutMs,
+    statementTimeoutMs: opts.statementTimeoutMs ?? opts.statementTimeout,
+    onQuery: opts.onQuery
+  });
+  const sql = makeSql(pool);
+  const mw = ((req, ctx, next) => {
+    ctx.sql = sql;
+    return next(req, ctx);
+  });
+  mw.__meta = { injects: ["sql"], depends: [] };
+  mw.sql = sql;
+  mw.migrate = async () => {
+    await sql.unsafe(`
+      CREATE TABLE IF NOT EXISTS "_weifuwu_migrations" (
+        name TEXT PRIMARY KEY,
+        applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+      )
+    `);
+  };
+  mw.markMigrated = async (moduleName) => {
+    await sql.unsafe(`INSERT INTO "_weifuwu_migrations" (name) VALUES ($1) ON CONFLICT DO NOTHING`, [
+      moduleName
+    ]);
+  };
+  mw.isMigrated = async (moduleName) => {
+    const rows = await sql.unsafe(`SELECT 1 FROM "_weifuwu_migrations" WHERE name = $1`, [moduleName]);
+    return rows.length > 0;
+  };
+  mw.transaction = (async (fn) => {
+    return sql.transaction(fn);
+  });
+  mw.poolStats = () => ({ active: 0, idle: pool.size, waiting: 0, max: pool.size });
+  mw.close = () => pool.close();
+  return mw;
+}
+var TaggedQuery = class {
+  text;
+  params;
+  executor;
+  constructor(text, params, executor) {
+    this.text = text;
+    this.params = params;
+    this.executor = executor;
   }
-  /** PUBLISH 消息到频道，返回收到消息的订阅者数 */
-  async publish(channel, message) {
-    await this.ensure();
-    return Number(await this.next().command("PUBLISH", channel, message));
+  then(resolve3, reject) {
+    return this.executor(this.text, this.params).then(resolve3, reject);
   }
-  /** 创建独立订阅者连接（Pub/Sub 场景） */
-  createSubscriber() {
-    return new RedisSubscriber({ ...this.opts });
+  catch(reject) {
+    return this.executor(this.text, this.params).catch(reject);
   }
-  /** 清空当前库（测试/重置场景） */
-  async flushdb() {
-    await this.ensure();
-    const v = await this.next().command("FLUSHDB");
-    return String(v);
+  finally(fn) {
+    return this.executor(this.text, this.params).finally(fn);
   }
-  /** 关闭所有池内连接 */
-  async close() {
-    this.closed = true;
-    this.readyPromise = null;
-    await Promise.all(this.clients.map((c) => c.close()));
-    this.clients = [];
+  /** 嵌套片段（agent-platform 条件过滤模式） */
+  get __fragment() {
+    return { sql: this.text, params: this.params };
   }
-  get size() {
-    return this.clients.length;
+};
+function makeSql(pool) {
+  const sql = ((strings, ...values) => {
+    const { sql: text, params } = parseTaggedFromPool(strings, values);
+    return new TaggedQuery(text, params, (s, p) => wrapError(pool.query(s, p)));
+  });
+  sql.unsafe = (query, params) => wrapError(pool.unsafe(query, params));
+  sql.query = (query, params) => wrapError(pool.query(query, params));
+  sql.begin = (fn) => pool.begin(fn);
+  sql.transaction = (fn) => pool.transaction(fn);
+  sql.close = () => pool.close();
+  return sql;
+}
+function parseTaggedFromPool(strings, values) {
+  let sql = strings[0];
+  const params = [];
+  for (let i = 0; i < values.length; i++) {
+    const frag = values[i]?.__fragment;
+    if (frag) {
+      const renumbered = frag.sql.replace(/\$(\d+)/g, (_m, idx) => {
+        params.push(frag.params[parseInt(idx, 10) - 1]);
+        return `$${params.length}`;
+      });
+      sql += renumbered + strings[i + 1];
+    } else {
+      params.push(values[i]);
+      sql += `$${params.length}` + strings[i + 1];
+    }
   }
+  return { sql, params };
+}
+var PG_ERROR_MAP = {
+  "23505": 409,
+  // unique_violation
+  "23503": 400,
+  // foreign_key_violation
+  "23502": 400,
+  // not_null_violation
+  "23514": 400,
+  // check_violation
+  "22P02": 400,
+  // invalid_text_representation
+  "22003": 400
+  // numeric_value_out_of_range
 };
+function wrapError(promise) {
+  return promise.catch((err) => {
+    const code = err?.code;
+    if (code && PG_ERROR_MAP[code]) {
+      throw new HttpError(`\u6570\u636E\u5E93\u9519\u8BEF: ${err.message}`, PG_ERROR_MAP[code]);
+    }
+    throw err;
+  });
+}
 
 // src/redis/client.ts
 function redis(options) {
@@ -3187,44 +4132,6 @@ function redis(options) {
   return mw;
 }
 
-// src/response.ts
-function ok(data, init) {
-  return Response.json(data, { status: 200, ...init });
-}
-function created(data, init) {
-  return Response.json(data, { status: 201, ...init });
-}
-function noContent(init) {
-  return new Response(null, { status: 204, ...init });
-}
-function badRequest(message) {
-  return Response.json({ error: message ?? "Bad Request" }, { status: 400 });
-}
-function unauthorized(message) {
-  return Response.json({ error: message ?? "Unauthorized" }, { status: 401 });
-}
-function forbidden(message) {
-  return Response.json({ error: message ?? "Forbidden" }, { status: 403 });
-}
-function notFound(message) {
-  return Response.json({ error: message ?? "Not Found" }, { status: 404 });
-}
-function conflict(message) {
-  return Response.json({ error: message ?? "Conflict" }, { status: 409 });
-}
-function unprocessable(message) {
-  return Response.json({ error: message ?? "Unprocessable Entity" }, { status: 422 });
-}
-function tooManyRequests(message) {
-  return Response.json({ error: message ?? "Too Many Requests" }, { status: 429 });
-}
-function serverError(message) {
-  return Response.json({ error: message ?? "Internal Server Error" }, { status: 500 });
-}
-function redirect(url, status = 302) {
-  return new Response(null, { status, headers: { Location: url } });
-}
-
 // src/request.ts
 async function parseBody(req) {
   if (req.method === "GET" || req.method === "HEAD") {
@@ -3246,14 +4153,18 @@ export {
   cors,
   createMiddleware,
   created,
+  email,
   forbidden,
   noContent,
   notFound,
   ok,
   parseBody,
   postgres,
+  queue,
+  rateLimit,
   redirect,
   redis,
+  sendSmtp,
   serve,
   serveStatic,
   serverError,
@@ -3261,5 +4172,6 @@ export {
   ui,
   uiSsr,
   unauthorized,
-  unprocessable
+  unprocessable,
+  userSystem
 };