weifuwu 0.9.5 → 0.9.6

package/dist/ai.d.ts

@@ -1,7 +1,19 @@
-import { streamText } from 'ai';
 import type { Context } from './types.ts';
 import { Router } from './router.ts';
-type StreamTextParams = Parameters<typeof streamText>[0];
+type StreamTextParams = {
+    model: unknown;
+    prompt?: string;
+    system?: string;
+    messages?: unknown[];
+    maxTokens?: number;
+    temperature?: number;
+    [key: string]: unknown;
+};
 export type AIHandler = (req: Request, ctx: Context) => StreamTextParams | Promise<StreamTextParams>;
-export declare function ai(handler: AIHandler): Router;
+export declare const _ai: {
+    streamText: (params: StreamTextParams) => {
+        toTextStreamResponse: () => Response;
+    };
+};
+export declare function ai(handler: AIHandler): Promise<Router>;
 export {};

package/dist/index.js

@@ -41,7 +41,12 @@ function createRequest(req, body) {
 async function sendResponse(res, response) {
   const headers = {};
   response.headers.forEach((value, key) => {
-    headers[key] = value;
+    if (key.toLowerCase() === "set-cookie") {
+      const existing = headers[key];
+      headers[key] = existing ? Array.isArray(existing) ? [...existing, value] : [existing, value] : value;
+    } else {
+      headers[key] = value;
+    }
   });
   res.writeHead(response.status, response.statusText, headers);
   if (response.body) {
@@ -104,6 +109,10 @@ function serve(handler, options) {
       server.close();
     }, { once: true });
   }
+  server.on("error", (err) => {
+    console.error("Failed to start server:", err.message);
+    process.exit(1);
+  });
   server.listen(port, hostname, () => {
     resolveReady();
   });
@@ -167,6 +176,10 @@ var matchTrieNode = (node, segment, params) => {
   return null;
 };
 var getWsNode = (node, segment) => {
+  if (segment === "*") {
+    node.wildcard = true;
+    return node;
+  }
   if (segment.startsWith(":")) {
     if (!node.children.has(":")) {
       const child2 = createWsNode();
@@ -193,6 +206,7 @@ var matchWsNode = (node, segment, params) => {
     if (child.param) params[child.param] = segment;
     return child;
   }
+  if (node.wildcard) return node;
   return null;
 };
 var Router = class _Router {
@@ -200,6 +214,7 @@ var Router = class _Router {
   wsRoot = createWsNode();
   globalMws = [];
   errorHandler;
+  wss = new WebSocketServer({ noServer: true });
   use(arg1, arg2) {
     if (typeof arg1 === "string") {
       if (arg2 instanceof _Router) {
@@ -255,6 +270,10 @@ var Router = class _Router {
     let node = this.root;
     for (const segment of segments) {
       if (segment === "*") {
+        const remaining = segments.indexOf("*") < segments.length - 1;
+        if (remaining) {
+          console.warn(`Route "${path2}": segments after "*" are ignored`);
+        }
         node.wildcard = true;
         node.handlers.set(method, handler);
         if (middlewares.length > 0) node.middlewares.set(method, middlewares);
@@ -285,7 +304,6 @@ var Router = class _Router {
     };
   }
   websocketHandler() {
-    const wss = new WebSocketServer({ noServer: true });
     const wsRoot = this.wsRoot;
     const router = this;
     return (req, socket, head) => {
@@ -302,7 +320,7 @@ var Router = class _Router {
         });
         const ctx = { params: match.params, query };
         if (match.middlewares.length === 0) {
-          upgradeSocket(wss, req, socket, head, match.handler, ctx);
+          upgradeSocket(router.wss, req, socket, head, match.handler, ctx);
           return;
         }
         let index = 0;
@@ -313,7 +331,7 @@ var Router = class _Router {
           }
           return await new Promise((resolve3) => {
             try {
-              upgradeSocket(wss, req, socket, head, match.handler, ctx2);
+              upgradeSocket(router.wss, req, socket, head, match.handler, ctx2);
               resolve3(new Response(null, { status: 101 }));
             } catch {
               socket.destroy();
@@ -346,7 +364,7 @@ var Router = class _Router {
   matchTrie(method, segments) {
     let node = this.root;
     const params = {};
-    const pathMws = [...this.root.pathMws];
+    const pathMws = [];
     let wildcardHandler = null;
     let wildcardMws = [];
     let wildcardIdx = -1;
@@ -380,6 +398,7 @@ var Router = class _Router {
       }
       node = next;
     }
+    pathMws.push(...node.pathMws);
     if (node.subRouter) {
       return {
         pathMws,
@@ -388,7 +407,6 @@ var Router = class _Router {
         subRouter: { router: node.subRouter, remainingIdx: segments.length }
       };
     }
-    pathMws.push(...node.pathMws);
     const handler = node.handlers.get(method) || node.handlers.get("*");
     if (handler) {
       if (node.wildcard) params["*"] = segments.slice(segments.length).join("/");
@@ -430,7 +448,8 @@ var Router = class _Router {
           mountPath: (ctx.mountPath || "") + levelMount
         });
       } catch (e) {
-        return this.errorHandler ? this.errorHandler(e, req, ctx) : new Response("Internal Server Error", { status: 500 });
+        const err = e instanceof Error ? e : new Error(String(e));
+        return this.errorHandler ? this.errorHandler(err, req, ctx) : new Response("Internal Server Error", { status: 500 });
       }
     }
     if (match?.handler) {
@@ -440,7 +459,8 @@ var Router = class _Router {
       try {
         return await this.runChain(allMws, handler, req, ctxWithMatch);
       } catch (e) {
-        return this.errorHandler ? this.errorHandler(e, req, ctxWithMatch) : new Response("Internal Server Error", { status: 500 });
+        const err = e instanceof Error ? e : new Error(String(e));
+        return this.errorHandler ? this.errorHandler(err, req, ctxWithMatch) : new Response("Internal Server Error", { status: 500 });
       }
     }
     if (this.globalMws.length > 0) {
@@ -448,7 +468,8 @@ var Router = class _Router {
         const delegate = () => new Response("Not Found", { status: 404 });
         return await this.runChain(this.globalMws, delegate, req, ctx);
       } catch (e) {
-        return this.errorHandler ? this.errorHandler(e, req, ctx) : new Response("Internal Server Error", { status: 500 });
+        const err = e instanceof Error ? e : new Error(String(e));
+        return this.errorHandler ? this.errorHandler(err, req, ctx) : new Response("Internal Server Error", { status: 500 });
       }
     }
     return new Response("Not Found", { status: 404 });
@@ -533,8 +554,13 @@ var isDev = process.env.NODE_ENV !== "production";
 var _uiDir = "";
 var _allFiles = [];
 var _outDir = "";
+var _router = null;
+var _pagesDir = "";
+var _nodeEntries = {};
 var tailwindCssUrl = null;
 var tailwindCssCode = "";
+var _tailwindPlugin = null;
+var _postcss = null;
 var _cjsRequire = createRequire(import.meta.url);
 var _vmCtx = vm.createContext(Object.create(globalThis));
 function loadSSRModule(code) {
@@ -713,7 +739,7 @@ function startFileWatcher() {
   let timeout = null;
   const pending = /* @__PURE__ */ new Set();
   chokidar.watch(_uiDir, {
-    ignored: /(^|[/\\])\.(?!\.)|node_modules|\.weifuwu|dist/,
+    ignored: /(^|[/\\])\.(?!\.)|node_modules|[/\\]\.weifuwu[/\\]|[/\\]dist[/\\]/,
     persistent: false,
     ignoreInitial: true
   }).on("all", async (event, filePath) => {
@@ -731,6 +757,8 @@ function startFileWatcher() {
       );
       if (allKnown) {
         for (const f of exists) await recompileAndSwap(f, _outDir);
+        await reprocessTailwind();
+        broadcastReload();
       } else {
         await recompileAll();
       }
@@ -756,6 +784,7 @@ async function recompileAndSwap(filePath, outDir) {
     const name15 = basename(filePath);
     if (name15 === "layout.tsx") {
       layoutModules.set(filePath, mod);
+      clientBundleCache.clear();
     } else if (name15 === "route.ts") {
       const handlers = /* @__PURE__ */ new Map();
       for (const m of ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]) {
@@ -768,14 +797,30 @@ async function recompileAndSwap(filePath, outDir) {
       pageModules.set(filePath, mod);
       clientBundleCache.delete(id(filePath));
     }
-    await reprocessTailwind();
-    broadcastReload();
   } catch (err) {
     console.error("recompile failed:", err.message);
   }
 }
 async function recompileAll() {
   try {
+    const freshPages = scanPages(_pagesDir);
+    const freshFiles = /* @__PURE__ */ new Set();
+    const nodeEntries = {};
+    for (const p of freshPages) {
+      const nodeKey = p.entryPath || p.routePath || "";
+      nodeEntries[nodeKey] = { route: p.route, entryPath: p.entryPath, layouts: p.layouts, loadPath: p.loadPath, routePath: p.routePath };
+      if (p.entryPath) freshFiles.add(p.entryPath);
+      if (p.loadPath) freshFiles.add(p.loadPath);
+      for (const lp of p.layouts) freshFiles.add(lp);
+      if (p.routePath) freshFiles.add(p.routePath);
+    }
+    const nfPath = join(_pagesDir, "not-found.tsx");
+    if (existsSync(nfPath)) {
+      freshFiles.add(nfPath);
+      const rootLayouts = resolveLayouts(_pagesDir, _pagesDir);
+      for (const lp of rootLayouts) freshFiles.add(lp);
+    }
+    _allFiles = [...freshFiles];
     const result = await esbuild.build({
       entryPoints: Object.fromEntries(_allFiles.map((f) => [id(f), f])),
       outdir: _outDir,
@@ -794,9 +839,54 @@ async function recompileAll() {
       const srcPath = _allFiles.find((f) => file.path.endsWith(id(f) + ".js"));
       if (!srcPath) continue;
       const name15 = basename(srcPath);
-      if (name15 === "layout.tsx") layoutModules.set(srcPath, mod);
-      else if (name15 === "load.ts") loadModules.set(srcPath, mod);
-      else pageModules.set(srcPath, mod);
+      if (name15 === "layout.tsx") {
+        layoutModules.set(srcPath, mod);
+      } else if (name15 === "route.ts") {
+        const handlers = /* @__PURE__ */ new Map();
+        for (const m of ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"]) {
+          if (mod[m]) handlers.set(m, mod[m]);
+        }
+        routeModules.set(srcPath, handlers);
+      } else if (name15 === "load.ts") {
+        loadModules.set(srcPath, mod);
+      } else if (name15 !== "not-found.tsx") {
+        pageModules.set(srcPath, mod);
+      }
+    }
+    if (_router) {
+      const methods = ["POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"];
+      for (const [key, entry] of Object.entries(nodeEntries)) {
+        if (_nodeEntries[key]) continue;
+        if (entry.routePath && !entry.entryPath) {
+          _router.route(
+            "GET",
+            entry.route,
+            (req, ctx) => routeModules.get(entry.routePath)?.get("GET")?.(req, ctx) ?? new Response("", { status: 501 })
+          );
+          for (const m of methods) {
+            _router.route(
+              m,
+              entry.route,
+              (req, ctx) => routeModules.get(entry.routePath)?.get(m)?.(req, ctx) ?? new Response("", { status: 501 })
+            );
+          }
+        }
+        if (entry.entryPath) {
+          const handler = makeSsrHandler(entry.entryPath, entry.layouts, entry.loadPath, _pagesDir, _router);
+          _router.get(entry.route, handler);
+          if (entry.routePath) {
+            for (const m of methods) {
+              _router.route(
+                m,
+                entry.route,
+                (req, ctx) => routeModules.get(entry.routePath)?.get(m)?.(req, ctx) ?? new Response("", { status: 501 })
+              );
+            }
+          }
+        }
+        console.log("\u2139 weifuwu/tsx: registered new route " + entry.route);
+      }
+      _nodeEntries = nodeEntries;
     }
     clientBundleCache.clear();
     await reprocessTailwind();
@@ -806,10 +896,9 @@ async function recompileAll() {
   }
 }
 async function setupTailwind(uiDir, router) {
-  let tailwindPlugin, postcss;
   try {
-    tailwindPlugin = (await import("@tailwindcss/postcss")).default;
-    postcss = (await import("postcss")).default;
+    _tailwindPlugin = (await import("@tailwindcss/postcss")).default;
+    _postcss = (await import("postcss")).default;
   } catch {
     return;
   }
@@ -821,7 +910,7 @@ async function setupTailwind(uiDir, router) {
   }
   try {
     const src = readFileSync(inputFile, "utf-8");
-    const result = await postcss([tailwindPlugin()]).process(src, { from: inputFile });
+    const result = await _postcss([_tailwindPlugin()]).process(src, { from: inputFile });
     tailwindCssCode = result.css;
   } catch (err) {
     console.warn("Tailwind CSS processing failed:", err.message);
@@ -835,7 +924,7 @@ async function setupTailwind(uiDir, router) {
     chokidar.watch(inputFile, { persistent: false }).on("change", async () => {
       try {
         const newSrc = readFileSync(inputFile, "utf-8");
-        const newResult = await postcss([tailwindPlugin()]).process(newSrc, { from: inputFile });
+        const newResult = await _postcss([_tailwindPlugin()]).process(newSrc, { from: inputFile });
         tailwindCssCode = newResult.css;
         broadcastReload();
       } catch (err) {
@@ -845,62 +934,77 @@ async function setupTailwind(uiDir, router) {
   }
 }
 async function reprocessTailwind() {
-  if (!tailwindCssUrl) return;
+  if (!tailwindCssUrl || !_postcss || !_tailwindPlugin) return;
   try {
     const inputFile = resolve(_uiDir, "app.css");
     if (!existsSync(inputFile)) return;
-    const tailwindPlugin = (await import("@tailwindcss/postcss")).default;
-    const postcss = (await import("postcss")).default;
     const src = readFileSync(inputFile, "utf-8");
-    const result = await postcss([tailwindPlugin()]).process(src, { from: inputFile });
+    const result = await _postcss([_tailwindPlugin()]).process(src, { from: inputFile });
     tailwindCssCode = result.css;
   } catch {
   }
 }
 var clientBundleCache = /* @__PURE__ */ new Map();
 var clientRouteLog = /* @__PURE__ */ new WeakMap();
+var clientBuildParams = /* @__PURE__ */ new Map();
+async function buildClientBundle(entryPath, layoutPaths, pagesDir) {
+  try {
+    const nested = layoutPaths.slice(1);
+    const layoutsImport = nested.map(
+      (p, i) => `import L${i} from${JSON.stringify(p)};`
+    ).join("");
+    const layoutsWrap = nested.map((_, i) => {
+      const idx = nested.length - 1 - i;
+      return `el=createElement(L${idx},null,el);`;
+    }).join("");
+    const code = [
+      `import{hydrateRoot}from'react-dom/client';`,
+      `import{createElement}from'react';`,
+      `import P from${JSON.stringify(entryPath)};`,
+      layoutsImport,
+      `const p=window.__WEIFUWU_PROPS;`,
+      `let el=createElement(P,p);`,
+      layoutsWrap,
+      `hydrateRoot(document.getElementById('__weifuwu_root'),el);`
+    ].join("");
+    const result = await esbuild.build({
+      stdin: { contents: code, loader: "tsx", resolveDir: pagesDir },
+      bundle: true,
+      format: "esm",
+      jsx: "automatic",
+      jsxImportSource: "react",
+      alias: resolveAliases(),
+      write: false,
+      minify: true
+    });
+    return result.outputFiles[0].contents;
+  } catch (err) {
+    console.error("hydration bundle failed:", err);
+    return null;
+  }
+}
 async function getOrBuildClientBundle(entryPath, layoutPaths, pagesDir, router) {
   const key = id(entryPath);
   const url = `/__wfw/client/${key}.js`;
+  clientBuildParams.set(key, { entryPath, layoutPaths, pagesDir });
   if (!clientRouteLog.get(router)?.has(url)) {
     if (!clientBundleCache.has(key)) {
-      try {
-        const nested = layoutPaths.slice(1);
-        const layoutsImport = nested.map(
-          (p, i) => `import L${i} from${JSON.stringify(p)};`
-        ).join("");
-        const layoutsWrap = nested.map((_, i) => {
-          const idx = nested.length - 1 - i;
-          return `el=createElement(L${idx},null,el);`;
-        }).join("");
-        const code = [
-          `import{hydrateRoot}from'react-dom/client';`,
-          `import{createElement}from'react';`,
-          `import P from${JSON.stringify(entryPath)};`,
-          layoutsImport,
-          `const p=window.__WEIFUWU_PROPS;`,
-          `let el=createElement(P,p);`,
-          layoutsWrap,
-          `hydrateRoot(document.getElementById('__weifuwu_root'),el);`
-        ].join("");
-        const result = await esbuild.build({
-          stdin: { contents: code, loader: "tsx", resolveDir: pagesDir },
-          bundle: true,
-          format: "esm",
-          jsx: "automatic",
-          jsxImportSource: "react",
-          alias: resolveAliases(),
-          write: false,
-          minify: true
-        });
-        clientBundleCache.set(key, result.outputFiles[0].contents);
-      } catch (err) {
-        console.error("hydration bundle failed:", err);
-        return null;
+      const buf = await buildClientBundle(entryPath, layoutPaths, pagesDir);
+      if (!buf) return null;
+      clientBundleCache.set(key, buf);
+    }
+    router.get(url, async () => {
+      let buf = clientBundleCache.get(key);
+      if (!buf) {
+        const params = clientBuildParams.get(key);
+        if (params) {
+          const rebuilt = await buildClientBundle(params.entryPath, params.layoutPaths, params.pagesDir);
+          if (rebuilt) {
+            clientBundleCache.set(key, rebuilt);
+            buf = rebuilt;
+          }
+        }
       }
-    }
-    router.get(url, () => {
-      const buf = clientBundleCache.get(key);
       return buf ? new Response(buf, {
         headers: { "content-type": "application/javascript; charset=utf-8" }
       }) : new Response("", { status: 500 });
@@ -913,7 +1017,7 @@ async function getOrBuildClientBundle(entryPath, layoutPaths, pagesDir, router)
 }
 function makeSsrHandler(entryPath, layoutPaths, loadPath, pagesDir, router) {
   return async (req, ctx) => {
-    const base = ctx.mountPath || "";
+    const base = (ctx.mountPath || "").replace(/\/$/, "");
     const pageMod = pageModules.get(entryPath);
     if (!pageMod) return new Response("", { status: 500 });
     const Component = pageMod.default;
@@ -944,9 +1048,9 @@ function makeSsrHandler(entryPath, layoutPaths, loadPath, pagesDir, router) {
     if (bundle) {
       scripts.push(`<script type="module" src="${base}${bundle.url}"></script>`);
     }
-    let html = `<!DOCTYPE html>
-${body}
-${scripts.join("\n")}`;
+    let html = body.startsWith("<!DOCTYPE html>") ? body : `<!DOCTYPE html>
+${body}`;
+    html += "\n" + scripts.join("\n");
     if (tailwindCssUrl && html.includes("</head>")) {
       html = html.replace(
         "</head>",
@@ -967,6 +1071,7 @@ async function tsx(options) {
   const uiDir = resolve(options.dir);
   const pagesDir = existsSync(join(uiDir, "pages")) ? join(uiDir, "pages") : uiDir;
   _uiDir = uiDir;
+  _pagesDir = pagesDir;
   const outDir = join(uiDir, ".weifuwu", "ssr");
   _outDir = outDir;
   const pages = scanPages(pagesDir);
@@ -989,8 +1094,11 @@ async function tsx(options) {
   _allFiles = [...allFiles];
   await compileAll(_allFiles, outDir, "node", resolveAliases());
   const router = new Router();
+  _router = router;
   const methods = ["POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS"];
   for (const p of pages) {
+    const nodeKey = p.entryPath || p.routePath || "";
+    _nodeEntries[nodeKey] = { route: p.route, entryPath: p.entryPath || "", layouts: p.layouts, loadPath: p.loadPath, routePath: p.routePath };
     if (p.routeOnly && p.routePath) {
       const rUrl = compiledUrl(p.routePath, outDir);
       const modR = await import(rUrl);
@@ -1055,7 +1163,7 @@ async function tsx(options) {
       }
     }
     const handler = async (req, ctx) => {
-      const base = ctx.mountPath || "";
+      const base = (ctx.mountPath || "").replace(/\/$/, "");
       const nfMod = pageModules.get(nfPath);
       if (!nfMod) return new Response("Not Found", { status: 404 });
       const NfComponent = nfMod.default;
@@ -1070,7 +1178,7 @@ async function tsx(options) {
       }, element);
       const stream = await renderToReadableStream(element);
       const body = await readStream(stream);
-      let html = `<!DOCTYPE html>
+      let html = body.startsWith("<!DOCTYPE html>") ? body : `<!DOCTYPE html>
 ${body}`;
       if (tailwindCssUrl && html.includes("</head>")) {
         html = html.replace(
@@ -1127,7 +1235,12 @@ function cors(options) {
     ...options
   };
   function resolveOrigin(requestOrigin) {
-    if (typeof opts.origin === "string") return opts.origin === "*" ? "*" : opts.origin;
+    if (typeof opts.origin === "string") {
+      if (opts.origin === "*") {
+        return opts.credentials ? requestOrigin : "*";
+      }
+      return opts.origin;
+    }
     if (Array.isArray(opts.origin)) {
       return opts.origin.includes(requestOrigin) ? requestOrigin : "";
     }
@@ -1142,7 +1255,7 @@ function cors(options) {
     headers.set("Access-Control-Allow-Origin", acao);
     if (opts.credentials) headers.set("Access-Control-Allow-Credentials", "true");
     if (opts.exposedHeaders?.length) headers.set("Access-Control-Expose-Headers", opts.exposedHeaders.join(", "));
-    headers.set("Vary", "Origin");
+    if (acao !== "*") headers.set("Vary", "Origin");
     return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
   }
   return (req, ctx, next) => {
@@ -1155,7 +1268,7 @@ function cors(options) {
       headers.set("Access-Control-Allow-Headers", opts.allowedHeaders.join(", "));
       if (opts.credentials) headers.set("Access-Control-Allow-Credentials", "true");
       if (opts.maxAge != null) headers.set("Access-Control-Max-Age", String(opts.maxAge));
-      headers.set("Vary", "Origin");
+      if (acao !== "*") headers.set("Vary", "Origin");
       return new Response(null, { status: 204, headers });
     }
     if (!acao) return next(req, ctx);
@@ -1163,20 +1276,23 @@ function cors(options) {
   };
 }
 function auth(options) {
+  if (!options.token && !options.verify && !options.proxy) {
+    throw new Error("auth() requires at least one of: token, verify, or proxy");
+  }
   return async (req, ctx, next) => {
     const headerName = options.header ?? "Authorization";
     let from = "header";
     let header = req.headers.get(headerName);
     let token = "";
     if (header) {
-      token = header;
+      token = header.trim();
       if (headerName.toLowerCase() === "authorization") {
         const parts = header.split(" ");
         if (parts[0]?.toLowerCase() === "bearer") {
-          token = parts.slice(1).join(" ");
+          token = parts.slice(1).join(" ").trim();
         }
       }
-    } else {
+    } else if (!options.header) {
       const url = new URL(req.url);
       const qsToken = url.searchParams.get("access_token");
       if (qsToken) {
@@ -1191,7 +1307,12 @@ function auth(options) {
       });
     }
     if (options.proxy) {
-      const proxyUrl = typeof options.proxy === "string" ? new URL(options.proxy) : options.proxy;
+      let proxyUrl;
+      try {
+        proxyUrl = typeof options.proxy === "string" ? new URL(options.proxy) : options.proxy;
+      } catch {
+        return new Response("Invalid proxy URL", { status: 500 });
+      }
       const proxyHeaders = {};
       if (from === "header" && header) {
         proxyHeaders[headerName] = header;
@@ -1241,7 +1362,7 @@ function auth(options) {
 
 // static.ts
 import { createHash as createHash2 } from "node:crypto";
-import { open } from "node:fs/promises";
+import { open, realpath } from "node:fs/promises";
 import { extname, resolve as resolve2, normalize, sep as sep2 } from "node:path";
 function serveStatic(root, options) {
   const rootDir = resolve2(root);
@@ -1259,7 +1380,12 @@ function serveStatic(root, options) {
     let fileHandle;
     try {
       fileHandle = await open(filePath, "r");
-      const stat = await fileHandle.stat();
+      let stat = await fileHandle.stat();
+      const realPath = await realpath(filePath);
+      if (!realPath.startsWith(rootDir + sep2) && realPath !== rootDir) {
+        await fileHandle.close();
+        return new Response("Forbidden", { status: 403 });
+      }
       if (stat.isDirectory()) {
         await fileHandle.close();
         const indexFile = opts.index ?? "index.html";
@@ -1268,8 +1394,8 @@ function serveStatic(root, options) {
           return new Response("Forbidden", { status: 403 });
         }
         fileHandle = await open(filePath, "r");
-        const dirStat = await fileHandle.stat();
-        if (!dirStat.isFile()) {
+        stat = await fileHandle.stat();
+        if (!stat.isFile()) {
           await fileHandle.close();
           return new Response("Not Found", { status: 404 });
         }
@@ -1309,8 +1435,8 @@ var MIME_TYPES = {
   ".html": "text/html; charset=utf-8",
   ".htm": "text/html; charset=utf-8",
   ".css": "text/css; charset=utf-8",
-  ".js": "application/javascript; charset=utf-8",
-  ".mjs": "application/javascript; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
   ".json": "application/json",
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -1330,7 +1456,16 @@ var MIME_TYPES = {
   ".pdf": "application/pdf",
   ".zip": "application/zip",
   ".wasm": "application/wasm",
-  ".map": "application/json"
+  ".map": "application/json",
+  ".ts": "application/x-typescript",
+  ".tsx": "application/x-typescript",
+  ".md": "text/markdown; charset=utf-8",
+  ".yaml": "application/x-yaml",
+  ".yml": "application/x-yaml",
+  ".csv": "text/csv; charset=utf-8",
+  ".mp4": "video/mp4",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav"
 };
 
 // validate.ts
@@ -1376,18 +1511,28 @@ function validate(schemas) {
       }
     }
     if (schemas.body) {
-      if (req.body === null) {
+      if (req.method === "GET" || req.method === "HEAD") {
+      } else if (req.body === null) {
         issues.push({ path: ["body"], message: "Request body is required" });
       } else {
         const bodyText = await req.text();
-        if (!bodyText && req.method !== "GET" && req.method !== "HEAD") {
+        if (!bodyText) {
           issues.push({ path: ["body"], message: "Request body is required" });
         } else {
-          let bodyValue;
-          try {
-            bodyValue = JSON.parse(bodyText);
-          } catch {
+          const ct = req.headers.get("content-type") ?? "";
+          let bodyValue = bodyText;
+          if (ct.includes("application/json") || ct.includes("text/") || ct.includes("*/json")) {
+            try {
+              bodyValue = JSON.parse(bodyText);
+            } catch {
+            }
+          } else if (ct.includes("application/x-www-form-urlencoded") || ct.includes("multipart/form-data")) {
             bodyValue = bodyText;
+          } else {
+            try {
+              bodyValue = JSON.parse(bodyText);
+            } catch {
+            }
           }
           const result = schemas.body.safeParse(bodyValue);
           if (result.success) {
@@ -1417,14 +1562,20 @@ function getCookies(req) {
   for (const pair of header.split(";")) {
     const idx = pair.indexOf("=");
     if (idx === -1) continue;
-    const name15 = pair.slice(0, idx).trim();
-    const value = pair.slice(idx + 1).trim();
-    if (name15) {
-      try {
-        cookies[name15] = decodeURIComponent(value);
-      } catch {
-        cookies[name15] = value;
-      }
+    let name15 = pair.slice(0, idx).trim();
+    let value = pair.slice(idx + 1).trim();
+    if (!name15) continue;
+    try {
+      name15 = decodeURIComponent(name15);
+    } catch {
+    }
+    if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+      value = value.slice(1, -1);
+    }
+    try {
+      cookies[name15] = decodeURIComponent(value);
+    } catch {
+      cookies[name15] = value;
     }
   }
   return cookies;
@@ -1451,7 +1602,11 @@ function setCookie(res, name15, value, options) {
 }
 function deleteCookie(res, name15, options) {
   const headers = new Headers(res.headers);
-  headers.append("Set-Cookie", serializeCookie(name15, "", { ...options, maxAge: 0 }));
+  headers.append("Set-Cookie", serializeCookie(name15, "", {
+    ...options,
+    maxAge: 0,
+    expires: /* @__PURE__ */ new Date(0)
+  }));
   return new Response(res.body, {
     status: res.status,
     statusText: res.statusText,
@@ -1462,12 +1617,43 @@ function deleteCookie(res, name15, options) {
 // upload.ts
 import { writeFile, mkdir } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
-import { join as join2 } from "node:path";
+import { join as join2, extname as extname2 } from "node:path";
+var extensionMimeMap = {
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".png": "image/png",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".pdf": "application/pdf",
+  ".doc": "application/msword",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".xls": "application/vnd.ms-excel",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".zip": "application/zip",
+  ".gz": "application/gzip",
+  ".mp4": "video/mp4",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".json": "application/json",
+  ".csv": "text/csv",
+  ".txt": "text/plain",
+  ".html": "text/html",
+  ".css": "text/css",
+  ".js": "text/javascript",
+  ".ts": "application/x-typescript",
+  ".tsx": "application/x-typescript"
+};
+function detectMimeFromExtension(filename) {
+  return extensionMimeMap[extname2(filename).toLowerCase()];
+}
 function upload(options) {
   const saveDir = options?.dir;
   return async (req, ctx, next) => {
     const ct = req.headers.get("content-type") ?? "";
     if (!ct.includes("multipart/form-data")) return next(req, ctx);
+    if (saveDir) await mkdir(saveDir, { recursive: true }).catch(() => {
+    });
     let formData;
     try {
       formData = await req.formData();
@@ -1478,8 +1664,13 @@ function upload(options) {
     const fields = {};
     for (const [key, value] of formData) {
       if (value instanceof File) {
-        if (options?.allowedTypes && !options.allowedTypes.includes(value.type)) {
-          return Response.json({ error: `File type not allowed: ${value.type}` }, { status: 415 });
+        if (options?.allowedTypes) {
+          const clientOk = options.allowedTypes.includes(value.type);
+          const extType = detectMimeFromExtension(value.name);
+          const extOk = extType ? options.allowedTypes.includes(extType) : false;
+          if (!clientOk && !extOk) {
+            return Response.json({ error: `File type not allowed: ${value.type}` }, { status: 415 });
+          }
         }
         if (options?.maxFileSize && value.size > options.maxFileSize) {
           return Response.json({ error: `File too large: ${value.name}` }, { status: 413 });
@@ -1492,9 +1683,8 @@ function upload(options) {
           buffer: saveDir ? void 0 : buf
         };
         if (saveDir) {
-          const safeName = value.name.replace(/[/\\]/g, "");
+          const safeName = value.name.replace(/[/\\\0]/g, "_");
           const filePath = join2(saveDir, `${randomUUID()}-${safeName}`);
-          await mkdir(saveDir, { recursive: true });
           await writeFile(filePath, buf);
           uf.path = filePath;
         }
@@ -1520,7 +1710,11 @@ function rateLimit(options) {
   const getKey = options?.key ?? ((req) => {
     const forwarded = req.headers.get("x-forwarded-for");
     if (forwarded) return forwarded.split(",")[0].trim();
-    return new URL(req.url).hostname;
+    const realIp = req.headers.get("x-real-ip");
+    if (realIp) return realIp;
+    const cfIp = req.headers.get("cf-connecting-ip");
+    if (cfIp) return cfIp;
+    return req.headers.get("x-forwarded-for") || req.headers.get("x-real-ip") || "global";
   });
   const message = options?.message ?? "Too Many Requests";
   const hits = /* @__PURE__ */ new Map();
@@ -1531,7 +1725,7 @@ function rateLimit(options) {
     }
   }, window);
   if (interval.unref) interval.unref();
-  return async (req, ctx, next) => {
+  const mw = async (req, ctx, next) => {
     const key = getKey(req);
     const now = Date.now();
     const entry = hits.get(key);
@@ -1564,10 +1758,15 @@ function rateLimit(options) {
     headers.set("X-RateLimit-Reset", String(Math.ceil(entry.reset / 1e3)));
     return new Response(res.body, { status: res.status, statusText: res.statusText, headers });
   };
+  mw.stop = () => {
+    clearInterval(interval);
+    hits.clear();
+  };
+  return mw;
 }
 
 // compress.ts
-import { gzipSync, brotliCompressSync, constants } from "node:zlib";
+import { gzipSync, brotliCompressSync, deflateSync, constants } from "node:zlib";
 function compress(options) {
   const level = options?.level ?? 6;
   const threshold = options?.threshold ?? 1024;
@@ -1580,7 +1779,7 @@ function compress(options) {
       return next(req, ctx);
     }
     const res = await next(req, ctx);
-    if (res.status === 304 || res.status === 204 || res.status < 200 || res.status >= 300) {
+    if (res.status === 304 || res.status === 204 || res.status === 206 || res.status < 200 || res.status >= 300) {
       return res;
     }
     const ce = res.headers.get("content-encoding");
@@ -1602,14 +1801,15 @@ function compress(options) {
       compressed = gzipSync(body, { level: Math.min(level, 9) });
       encoding = "gzip";
     } else {
-      compressed = gzipSync(body, { level: Math.min(level, 9) });
+      compressed = deflateSync(body, { level: Math.min(level, 9) });
       encoding = "deflate";
     }
     const headers = new Headers(res.headers);
     headers.set("Content-Encoding", encoding);
     headers.set("Content-Length", String(compressed.byteLength));
     headers.delete("Content-Range");
-    headers.set("Vary", "Accept-Encoding");
+    const existingVary = headers.get("Vary");
+    headers.set("Vary", existingVary ? `${existingVary}, Accept-Encoding` : "Accept-Encoding");
     return new Response(compressed, {
       status: res.status,
       statusText: res.statusText,
@@ -1660,9 +1860,10 @@ async function executeQuery(schema, params, options, req, ctx) {
     variableValues: params.variables,
     operationName: params.operationName
   });
-  return Response.json(result, { status: result.errors ? 400 : 200 });
+  return Response.json(result, { status: result.errors ? 200 : 200 });
 }
 function graphiqlHTML(endpoint) {
+  const safeEndpoint = endpoint.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/</g, "\\x3C");
   return `<!doctype html>
 <html lang="en">
   <head>
@@ -1694,7 +1895,7 @@ function graphiqlHTML(endpoint) {
       import { createGraphiQLFetcher } from '@graphiql/toolkit';
       import 'graphiql/setup-workers/esm.sh';
 
-      const fetcher = createGraphiQLFetcher({ url: "${endpoint}" });
+      const fetcher = createGraphiQLFetcher({ url: "${safeEndpoint}" });
 
       function App() {
         return React.createElement(GraphiQL, { fetcher });
@@ -1741,12 +1942,17 @@ function graphql(handler) {
 }
 
 // ai.ts
-import { streamText } from "ai";
-function ai(handler) {
+var _ai = {
+  streamText: null
+};
+async function ai(handler) {
+  if (!_ai.streamText) {
+    _ai.streamText = (await import("ai")).streamText;
+  }
   const r = new Router();
   r.post("/", async (req, ctx) => {
     const options = await handler(req, ctx);
-    const result = streamText(options);
+    const result = _ai.streamText(options);
     return result.toTextStreamResponse();
   });
   return r;
@@ -1763,9 +1969,11 @@ function tool(def) {
 }
 
 // workflow/reference.ts
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
 function getByPath(obj, path2) {
   let current = obj;
   for (const key of path2) {
+    if (DANGEROUS_KEYS.has(key)) return void 0;
     if (current === null || current === void 0) return void 0;
     if (typeof current === "object" && key in current) {
       current = current[key];
@@ -1835,27 +2043,42 @@ function evaluateExpression(expr, ctx) {
     { op: "!==", fn: (a, b) => a !== b },
     { op: ">=", fn: (a, b) => Number(a) >= Number(b) },
     { op: "<=", fn: (a, b) => Number(a) <= Number(b) },
-    { op: ">", fn: (a, b) => Number(a) > Number(b) },
-    { op: "<", fn: (a, b) => Number(a) < Number(b) },
     { op: "==", fn: (a, b) => a == b },
     { op: "!=", fn: (a, b) => a != b },
+    { op: "&&", fn: (a, b) => Boolean(a) && Boolean(b) },
+    { op: "||", fn: (a, b) => Boolean(a) || Boolean(b) },
+    { op: ">", fn: (a, b) => Number(a) > Number(b) },
+    { op: "<", fn: (a, b) => Number(a) < Number(b) },
     { op: "+", fn: (a, b) => Number(a) + Number(b) },
     { op: "-", fn: (a, b) => Number(a) - Number(b) },
     { op: "*", fn: (a, b) => Number(a) * Number(b) },
     { op: "/", fn: (a, b) => Number(a) / Number(b) },
-    { op: "%", fn: (a, b) => Number(a) % Number(b) },
-    { op: "&&", fn: (a, b) => Boolean(a) && Boolean(b) },
-    { op: "||", fn: (a, b) => Boolean(a) || Boolean(b) }
+    { op: "%", fn: (a, b) => Number(a) % Number(b) }
   ];
+  let bestIdx = -1;
+  let bestOp = null;
+  let bestFn = null;
   for (const { op, fn } of operators) {
     const idx = expr.indexOf(op);
-    if (idx > 0) {
-      const leftRaw = expr.slice(0, idx).trim();
-      const rightRaw = expr.slice(idx + op.length).trim();
-      const left = resolveValue(leftRaw, ctx);
-      const right = resolveValue(rightRaw, ctx);
-      return fn(left, right);
-    }
+    if (idx > 0 && (bestIdx === -1 || idx < bestIdx)) {
+      bestIdx = idx;
+      bestOp = op;
+      bestFn = fn;
+    }
+  }
+  function resolveOperand(raw) {
+    const trimmed2 = raw.trim();
+    if (/^[\d.]+$/.test(trimmed2)) return Number(trimmed2);
+    const subIdx = operators.findIndex(({ op }) => trimmed2.includes(op));
+    if (subIdx !== -1) return evaluateExpression(trimmed2, ctx);
+    return resolveValue(trimmed2, ctx);
+  }
+  if (bestIdx > 0 && bestOp && bestFn) {
+    const leftRaw = expr.slice(0, bestIdx).trim();
+    const rightRaw = expr.slice(bestIdx + bestOp.length).trim();
+    const left = resolveOperand(leftRaw);
+    const right = resolveOperand(rightRaw);
+    return bestFn(left, right);
   }
   const trimmed = expr.trim();
   if (trimmed === "true") return true;
@@ -2235,6 +2458,7 @@ data: ${JSON.stringify(event.data)}
 }
 
 // workflow/route.ts
+import crypto from "node:crypto";
 function workflow(handler) {
   const r = new Router();
   const sseManager = createSSEManager();
@@ -2797,7 +3021,12 @@ h2{color:#dc2626}.desc{color:#555}</style>
       if (!codeVerifier) {
         return Response.json({ error: "invalid_grant", error_description: "code_verifier required" }, { status: 400 });
       }
-      const expected = crypto2.createHash("sha256").update(codeVerifier).digest().toString("base64url");
+      let expected;
+      if (stored.code_challenge_method === "plain") {
+        expected = codeVerifier;
+      } else {
+        expected = crypto2.createHash("sha256").update(codeVerifier).digest().toString("base64url");
+      }
       if (expected !== stored.code_challenge) {
         return Response.json({ error: "invalid_grant", error_description: "code_verifier mismatch" }, { status: 400 });
       }
@@ -3266,7 +3495,7 @@ function sqlTypeForField(field) {
 }
 var RESERVED_SLUGS = /* @__PURE__ */ new Set(["sys", "graphql", "auth"]);
 function validateSlug(slug) {
-  if (!/^[a-z][a-z0-9_]+$/.test(slug)) {
+  if (!/^[a-z][a-z0-9_]*$/.test(slug)) {
     return "Slug must start with a letter and contain only lowercase letters, numbers, and underscores";
   }
   if (RESERVED_SLUGS.has(slug)) {
@@ -13688,15 +13917,16 @@ function buildRouter2(deps) {
     return Response.json(rows);
   });
   r.delete("/agents/:id/knowledge/:docId", async (_req, ctx) => {
+    const agentId = parseInt(ctx.params.id, 10);
     const docId = parseInt(ctx.params.docId, 10);
-    await sql`DELETE FROM "_knowledge_documents" WHERE id = ${docId}`;
+    await sql`DELETE FROM "_knowledge_documents" WHERE id = ${docId} AND agent_id = ${agentId}`;
     return Response.json({ ok: true });
   });
   return r;
 }
 
 // agent/run.ts
-import { streamText as streamText2, generateText as generateText2, embed } from "ai";
+import { streamText, generateText as generateText2, embed } from "ai";
 import { z as z27 } from "zod";
 function chunkContent(content, chunkSize = 512, overlap = 64) {
   const paragraphs = content.split(/\n\n+/);
@@ -13761,7 +13991,7 @@ function createRunner(deps) {
     }
     const system = agent2.system_prompt || void 0;
     if (params.stream) {
-      const result = streamText2({
+      const result = streamText({
         model,
         system,
         messages,
@@ -14332,7 +14562,9 @@ function createManager(config, apps, manager) {
     if (!config.deployToken) return next(req, ctx);
     const header = req.headers.get("authorization") ?? "";
     const token = header.replace("Bearer ", "");
-    if (token !== config.deployToken) {
+    const tokenBuf = Buffer.from(token);
+    const secretBuf = Buffer.from(config.deployToken);
+    if (tokenBuf.length !== secretBuf.length || !crypto4.timingSafeEqual(tokenBuf, secretBuf)) {
       return Response.json({ error: "Unauthorized" }, { status: 401 });
     }
     return next(req, ctx);
@@ -14431,15 +14663,22 @@ function createManager(config, apps, manager) {
     }
   });
   router.post("/webhook", async (req) => {
+    const rawBody = await req.text();
     if (config.webhookSecret) {
       const sig = req.headers.get("x-hub-signature-256") ?? "";
-      const body = await req.clone().text();
-      const hmac = crypto4.createHmac("sha256", config.webhookSecret).update(body).digest("hex");
-      if (sig !== `sha256=${hmac}`) {
+      const expected = `sha256=${crypto4.createHmac("sha256", config.webhookSecret).update(rawBody).digest("hex")}`;
+      const sigBuf = Buffer.from(sig);
+      const expectedBuf = Buffer.from(expected);
+      if (sigBuf.length !== expectedBuf.length || !crypto4.timingSafeEqual(sigBuf, expectedBuf)) {
         return Response.json({ error: "invalid signature" }, { status: 401 });
       }
     }
-    const payload = await req.json();
+    let payload;
+    try {
+      payload = JSON.parse(rawBody);
+    } catch {
+      payload = {};
+    }
     const repoUrl = payload?.repository?.clone_url ?? payload?.repository?.html_url ?? "";
     if (!repoUrl) return Response.json({ deployed: [] });
     const deployed = [];
@@ -14567,6 +14806,12 @@ async function deploy(config) {
       if (logs.length > 1e3) logs.splice(0, logs.length - 1e3);
     };
     try {
+      if (typeof ac.repo !== "string" || !/^https?:\/\/[^\s"']+\/[^\s"']+/.test(ac.repo) && !/^git@[^\s"']+:[^\s"']+/.test(ac.repo)) {
+        throw new Error(`Invalid repo URL: ${ac.repo}`);
+      }
+      if (ac.branch && typeof ac.branch === "string" && !/^[\w.\-/]+$/.test(ac.branch)) {
+        throw new Error(`Invalid branch name: ${ac.branch}`);
+      }
       if (fs.existsSync(path.join(appDir, ".git"))) {
         execSync("git pull", { cwd: appDir, stdio: "pipe", timeout: 12e4 });
         log("[deploy] git pull done");
@@ -14574,7 +14819,7 @@ async function deploy(config) {
         if (fs.existsSync(appDir)) {
           fs.rmSync(appDir, { recursive: true });
         }
-        execSync(`git clone ${ac.repo} ${appDir}`, { stdio: "pipe", timeout: 12e4 });
+        execSync(`git clone --depth=1 ${ac.repo} ${appDir}`, { stdio: "pipe", timeout: 12e4 });
         log("[deploy] git clone done");
         if (ac.branch) {
           execSync(`git checkout ${ac.branch}`, { cwd: appDir, stdio: "pipe", timeout: 3e4 });
@@ -14601,6 +14846,10 @@ async function deploy(config) {
       return;
     }
     if (ac.buildCommand) {
+      if (typeof ac.buildCommand !== "string" || /[;&|`$()]/.test(ac.buildCommand)) {
+        log(`[deploy] invalid build command (rejected): ${ac.buildCommand}`);
+        return;
+      }
       try {
         execSync(ac.buildCommand, { cwd: appDir, stdio: "pipe", timeout: 12e4 });
         log("[deploy] build done");

package/dist/rate-limit.d.ts

@@ -5,4 +5,6 @@ export interface RateLimitOptions {
     key?: (req: Request) => string;
     message?: string;
 }
-export declare function rateLimit(options?: RateLimitOptions): Middleware;
+export declare function rateLimit(options?: RateLimitOptions): Middleware & {
+    stop: () => void;
+};

package/dist/router.d.ts

@@ -14,6 +14,7 @@ export declare class Router {
     private wsRoot;
     private globalMws;
     private errorHandler?;
+    private wss;
     use(mw: Middleware): this;
     use(path: string, router: Router): this;
     use(path: string, mw: Middleware): this;

package/dist/types.d.ts

@@ -7,4 +7,4 @@ export interface Context {
 }
 export type Handler = (req: Request, ctx: Context) => Response | Promise<Response>;
 export type Middleware = (req: Request, ctx: Context, next: Handler) => Response | Promise<Response>;
-export type ErrorHandler = (error: Error, req: Request, ctx: Context) => Response;
+export type ErrorHandler = (error: Error, req: Request, ctx: Context) => Response | Promise<Response>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weifuwu",
-  "version": "0.9.5",
+  "version": "0.9.6",
   "description": "Web-standard HTTP framework for Node.js — (req, ctx) => Response",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",