zevairouter 1.0.154 → 1.0.155

package/src/lib/auth/oidc.js

@@ -1,303 +0,0 @@
-import crypto from "node:crypto";
-import dns from "node:dns/promises";
-import net from "node:net";
-import { createRemoteJWKSet, customFetch, jwtVerify } from "jose";
-import { Agent, fetch as undiciFetch } from "undici";
-import { getSettings } from "@/lib/localDb";
-
-export const OIDC_COOKIE_NAMES = {
-  state: "oidc_state",
-  nonce: "oidc_nonce",
-  verifier: "oidc_code_verifier",
-};
-
-const DEFAULT_SCOPES = "openid profile email";
-const DEFAULT_LOGIN_LABEL = "Sign in with OIDC";
-
-function trimTrailingSlashes(value) {
-  return (value || "").trim().replace(/\/+$/, "");
-}
-
-function normalizeScopes(value) {
-  return (value || DEFAULT_SCOPES).trim() || DEFAULT_SCOPES;
-}
-
-export function getPublicOrigin(request) {
-  const configuredBaseUrl =
-    process.env.BASE_URL ||
-    process.env.NEXT_PUBLIC_BASE_URL ||
-    "";
-
-  if (configuredBaseUrl) {
-    return trimTrailingSlashes(configuredBaseUrl);
-  }
-
-  const forwardedProto = request?.headers?.get?.("x-forwarded-proto") || "";
-  const forwardedHost = request?.headers?.get?.("x-forwarded-host") || "";
-  const host = forwardedHost || request?.headers?.get?.("host") || "";
-  if (host) {
-    const protocol = (forwardedProto || new URL(request.url).protocol || "http:").replace(/:$/, "");
-    return `${protocol}://${host}`.replace(/\/+$/, "");
-  }
-
-  return trimTrailingSlashes(new URL(request.url).origin);
-}
-
-export function isOidcConfigured(settings) {
-  return !!(
-    trimTrailingSlashes(settings?.oidcIssuerUrl) &&
-    (settings?.oidcClientId || "").trim() &&
-    (settings?.oidcClientSecret || "").trim()
-  );
-}
-
-export async function getOidcRuntimeConfig() {
-  const settings = await getSettings();
-  if (!["oidc", "both"].includes(settings.authMode) || !isOidcConfigured(settings)) return null;
-
-  const issuerUrl = trimTrailingSlashes(settings.oidcIssuerUrl);
-  return {
-    issuerUrl,
-    clientId: settings.oidcClientId.trim(),
-    clientSecret: settings.oidcClientSecret.trim(),
-    scopes: normalizeScopes(settings.oidcScopes),
-    loginLabel: (settings.oidcLoginLabel || DEFAULT_LOGIN_LABEL).trim() || DEFAULT_LOGIN_LABEL,
-  };
-}
-
-function isPrivateAddress(address) {
-  const normalized = address.toLowerCase().replace(/^::ffff:/, "");
-  if (net.isIPv4(normalized)) {
-    const [a, b] = normalized.split(".").map(Number);
-    return a === 0 || a === 10 || a === 127 || (a === 169 && b === 254) ||
-      (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168);
-  }
-  return normalized === "::" || normalized === "::1" || normalized.startsWith("fc") ||
-    normalized.startsWith("fd") || /^fe[89ab]/.test(normalized);
-}
-
-function validateOidcUrl(rawUrl, expectedOrigin) {
-  const url = new URL(rawUrl);
-  if (url.protocol !== "https:" || url.username || url.password || (expectedOrigin && url.origin !== expectedOrigin)) {
-    throw new Error("OIDC endpoints must use HTTPS on the issuer origin");
-  }
-  return url;
-}
-
-async function createOidcDispatcher(rawUrl, expectedOrigin) {
-  const url = validateOidcUrl(rawUrl, expectedOrigin);
-  const addresses = await dns.lookup(url.hostname, { all: true });
-  if (!addresses.length || addresses.some(({ address }) => isPrivateAddress(address))) {
-    throw new Error("OIDC endpoints must resolve to public addresses");
-  }
-  let next = 0;
-  return {
-    url,
-    dispatcher: new Agent({
-      connect: {
-        lookup(_hostname, options, callback) {
-          const candidates = addresses.filter(({ family }) => !options.family || family === options.family);
-          if (options.all) {
-            callback(null, candidates.length ? candidates : addresses);
-            return;
-          }
-          const selected = candidates[next++ % candidates.length] || addresses[0];
-          callback(null, selected.address, selected.family);
-        },
-      },
-    }),
-  };
-}
-
-async function oidcFetch(rawUrl, options = {}, expectedOrigin) {
-  const { url, dispatcher } = await createOidcDispatcher(rawUrl, expectedOrigin);
-  try {
-    return await undiciFetch(url, { ...options, redirect: "error", dispatcher });
-  } finally {
-    await dispatcher.close();
-  }
-}
-
-export async function fetchOidcDiscovery(issuerUrl) {
-  const normalizedIssuer = trimTrailingSlashes(issuerUrl);
-  const issuer = validateOidcUrl(normalizedIssuer);
-  const discoveryUrl = `${normalizedIssuer}/.well-known/openid-configuration`;
-  const res = await oidcFetch(discoveryUrl, { cache: "no-store" });
-  if (!res.ok) {
-    throw new Error(`Failed to load OIDC discovery document from ${discoveryUrl}`);
-  }
-  const discovery = await res.json();
-  if (!discovery.authorization_endpoint || !discovery.token_endpoint || !discovery.jwks_uri) {
-    throw new Error("OIDC discovery response is missing required endpoints");
-  }
-  await Promise.all([
-    createOidcDispatcher(discovery.authorization_endpoint, issuer.origin).then(({ dispatcher }) => dispatcher.close()),
-    createOidcDispatcher(discovery.token_endpoint, issuer.origin).then(({ dispatcher }) => dispatcher.close()),
-    createOidcDispatcher(discovery.jwks_uri, issuer.origin).then(({ dispatcher }) => dispatcher.close()),
-  ]);
-  return discovery;
-}
-
-export function createPkcePair() {
-  const verifier = crypto.randomBytes(32).toString("base64url");
-  const challenge = crypto.createHash("sha256").update(verifier).digest("base64url");
-  return { verifier, challenge };
-}
-
-export function createOidcState() {
-  return crypto.randomBytes(16).toString("base64url");
-}
-
-export function createOidcNonce() {
-  return crypto.randomBytes(16).toString("base64url");
-}
-
-export function buildOidcAuthorizationUrl({
-  authorizationEndpoint,
-  clientId,
-  redirectUri,
-  scopes = DEFAULT_SCOPES,
-  state,
-  nonce,
-  codeChallenge,
-}) {
-  const url = new URL(authorizationEndpoint);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("client_id", clientId);
-  url.searchParams.set("redirect_uri", redirectUri);
-  url.searchParams.set("scope", normalizeScopes(scopes));
-  url.searchParams.set("state", state);
-  url.searchParams.set("nonce", nonce);
-  url.searchParams.set("code_challenge", codeChallenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  return url.toString();
-}
-
-export async function exchangeOidcCode({
-  tokenEndpoint,
-  clientId,
-  clientSecret,
-  code,
-  redirectUri,
-  codeVerifier,
-}) {
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: clientId,
-    code,
-    redirect_uri: redirectUri,
-    code_verifier: codeVerifier,
-  });
-
-  if (clientSecret) {
-    body.set("client_secret", clientSecret);
-  }
-
-  const res = await oidcFetch(tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body,
-  });
-
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    const message = data?.error_description || data?.error || `OIDC token exchange failed (${res.status})`;
-    throw new Error(message);
-  }
-
-  return data;
-}
-
-export async function probeOidcClientSecret({
-  tokenEndpoint,
-  clientId,
-  clientSecret,
-  redirectUri,
-}) {
-  if (!clientSecret) {
-    return {
-      tested: false,
-      valid: null,
-      message: "No client secret was provided, so secret validation was skipped.",
-    };
-  }
-
-  const body = new URLSearchParams({
-    grant_type: "authorization_code",
-    client_id: clientId,
-    client_secret: clientSecret,
-    code: "__oidc_test_invalid_code__",
-    redirect_uri: redirectUri,
-    code_verifier: "__oidc_test_invalid_verifier__",
-  });
-
-  const res = await oidcFetch(tokenEndpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body,
-  });
-
-  const data = await res.json().catch(() => ({}));
-  const error = (data?.error || "").toLowerCase();
-  const errorDescription = data?.error_description || data?.error || "";
-
-  if (res.ok) {
-    return {
-      tested: true,
-      valid: true,
-      message: "Client secret was accepted by the token endpoint.",
-      raw: data,
-    };
-  }
-
-  if (error === "invalid_client" || error === "unauthorized_client" || /client.*(invalid|failed|mismatch)/i.test(errorDescription)) {
-    return {
-      tested: true,
-      valid: false,
-      message: errorDescription || "Client secret is not valid.",
-      raw: data,
-    };
-  }
-
-  if (error === "invalid_grant" || error === "invalid_code" || /grant|code/i.test(errorDescription)) {
-    return {
-      tested: true,
-      valid: true,
-      message: "Client secret was accepted; the token exchange failed only because the test authorization code is invalid.",
-      raw: data,
-    };
-  }
-
-  return {
-    tested: true,
-    valid: null,
-    message: errorDescription || `Token endpoint responded with ${res.status}`,
-    raw: data,
-  };
-}
-
-export async function verifyOidcIdToken({
-  idToken,
-  issuer,
-  audience,
-  jwksUri,
-  nonce,
-}) {
-  const jwks = createRemoteJWKSet(new URL(jwksUri), {
-    [customFetch]: (url, options) => oidcFetch(url, options),
-  });
-  const { payload } = await jwtVerify(idToken, jwks, {
-    issuer,
-    audience,
-    nonce,
-  });
-  return payload;
-}
-
-export function pickOidcDisplayName(payload = {}) {
-  return payload.preferred_username || payload.email || payload.name || payload.given_name || payload.sub || "OIDC user";
-}
-
-export function pickOidcEmail(payload = {}) {
-  return payload.email || "";
-}

package/src/lib/auth/terminalSession.js

@@ -1,88 +0,0 @@
-import { SignJWT, jwtVerify } from "jose";
-import { shouldUseSecureCookie, verifyDashboardAuthToken } from "@/lib/auth/dashboardSession";
-import { getConsistentMachineId } from "@/shared/utils/machineId";
-
-// Same secret loader pattern as dashboard — import via dynamic to share SECRET
-// We re-use createDashboardAuthToken's secret by verifying with the same module path.
-import fs from "node:fs";
-import path from "node:path";
-import crypto from "node:crypto";
-import { DATA_DIR } from "@/lib/dataDir";
-
-function loadJwtSecret() {
-  if (process.env.JWT_SECRET) return process.env.JWT_SECRET;
-  const file = path.join(DATA_DIR, "jwt-secret");
-  try {
-    return fs.readFileSync(file, "utf8").trim();
-  } catch {}
-  fs.mkdirSync(DATA_DIR, { recursive: true });
-  const generated = crypto.randomBytes(32).toString("hex");
-  fs.writeFileSync(file, generated, { mode: 0o600 });
-  return generated;
-}
-
-const SECRET = new TextEncoder().encode(loadJwtSecret());
-const COOKIE_NAME = "terminal_token";
-const TTL = "4h";
-const CLI_TOKEN_HEADER = "x-zevai-cli-token";
-const CLI_TOKEN_SALT = "zevai-cli-auth";
-
-function ownerId(type, token) {
-  return crypto.createHash("sha256").update(`${type}\0${token}`).digest("hex");
-}
-
-export async function getTerminalOwner(request) {
-  const cliToken = request.headers.get(CLI_TOKEN_HEADER);
-  if (cliToken && cliToken === await getConsistentMachineId(CLI_TOKEN_SALT)) {
-    return ownerId("cli", cliToken);
-  }
-
-  const terminalToken = request.cookies.get(COOKIE_NAME)?.value;
-  if (await verifyTerminalUnlockToken(terminalToken)) {
-    return ownerId("terminal", terminalToken);
-  }
-
-  const dashboardToken = request.cookies.get("auth_token")?.value;
-  if (await verifyDashboardAuthToken(dashboardToken)) {
-    return ownerId("dashboard", dashboardToken);
-  }
-
-  return null;
-}
-
-export function getTerminalCookieName() {
-  return COOKIE_NAME;
-}
-
-export async function createTerminalUnlockToken() {
-  return new SignJWT({ terminal: true, scope: "web-shell" })
-    .setProtectedHeader({ alg: "HS256" })
-    .setIssuedAt()
-    .setExpirationTime(TTL)
-    .sign(SECRET);
-}
-
-export async function verifyTerminalUnlockToken(token) {
-  if (!token) return false;
-  try {
-    const { payload } = await jwtVerify(token, SECRET);
-    return payload?.terminal === true && payload?.scope === "web-shell";
-  } catch {
-    return false;
-  }
-}
-
-export async function setTerminalUnlockCookie(cookieStore, request) {
-  const token = await createTerminalUnlockToken();
-  cookieStore.set(COOKIE_NAME, token, {
-    httpOnly: true,
-    secure: shouldUseSecureCookie(request),
-    sameSite: "lax",
-    path: "/",
-    maxAge: 4 * 60 * 60,
-  });
-}
-
-export function clearTerminalUnlockCookie(cookieStore) {
-  cookieStore.delete(COOKIE_NAME);
-}

package/src/lib/autoclaw/constants.js

@@ -1,63 +0,0 @@
-import { createHash } from "crypto";
-import { randomUUID } from "crypto";
-
-// AutoClaw (autoclaw.z.ai by Z.ai / Zhipu AI) constants. These mirror the
-// public web app's client credentials — APP_KEY is embedded in the browser
-// bundle, so it is not a secret we own, but we keep it in one place so the
-// executor, bulk-import manager, and balance fetcher all sign the same way.
-export const AUTOCLAW_APP_ID = "100003";
-export const AUTOCLAW_APP_KEY = "38d2391985e2369a5fb8227d8e6cd5e5";
-export const AUTOCLAW_BASE_URL = "https://autoglm-api.autoglm.ai";
-export const AUTOCLAW_PROXY_URL = `${AUTOCLAW_BASE_URL}/autoclaw-proxy/proxy/autoclaw`;
-export const AUTOCLAW_OAUTH_URL_ENDPOINT = `${AUTOCLAW_BASE_URL}/userapi/overseasv1/google-oauth-url`;
-export const AUTOCLAW_REDIRECT_URI = `${AUTOCLAW_BASE_URL}/userapi/oauth/google/callback`;
-export const AUTOCLAW_REFRESH_ENDPOINT = `${AUTOCLAW_BASE_URL}/userapi/v1/refresh`;
-export const AUTOCLAW_WALLET_ENDPOINT = `${AUTOCLAW_BASE_URL}/agent-assetmgr/api/v2/wallets?biz_app_id=autoclaw`;
-export const AUTOCLAW_VERSION = "1.10.0";
-
-// AutoClaw selects the model via the X-Request-Model header, not the body's
-// `model` field (which is a dummy). id = X-Request-Model value.
-export const AUTOCLAW_MODELS = [
-  { id: "openrouter_glm-5.2", name: "GLM-5.2" },
-  { id: "zai_glm-5-turbo", name: "GLM-5-Turbo" },
-  { id: "zai_auto", name: "DeepSeek-V4-Pro (Auto)" },
-];
-
-// x-auth-sign = md5(f"{APP_ID}&{timestamp}&{APP_KEY}")
-export function generateAutoClawSign(timestamp) {
-  const raw = `${AUTOCLAW_APP_ID}&${timestamp}&${AUTOCLAW_APP_KEY}`;
-  return createHash("md5").update(raw).digest("hex");
-}
-
-// Base signed headers shared by the OAuth-url, wallet, and chat calls.
-export function buildAutoClawAuthHeaders(extra = {}) {
-  const ts = String(Math.floor(Date.now() / 1000));
-  return {
-    accept: "*/*",
-    "content-type": "application/json",
-    origin: "https://autoclaw.z.ai",
-    referer: "https://autoclaw.z.ai/",
-    "user-agent":
-      "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36",
-    "x-auth-appid": AUTOCLAW_APP_ID,
-    "x-auth-timestamp": ts,
-    "x-auth-sign": generateAutoClawSign(ts),
-    "x-product": "autoclaw",
-    "x-version": AUTOCLAW_VERSION,
-    "x-tm": "web",
-    "x-channel": "official",
-    "x-client-type": "web",
-    "x-trace-id": randomUUID(),
-    "x-lang": "zh-CN",
-    ...extra,
-  };
-}
-
-// Wallet/asset endpoints authenticate via `authorization: Bearer <token>`
-// (unlike chat, which uses X-Authorization with the RAW token). This helper
-// normalizes the token (strips any existing "Bearer ") and re-applies it so
-// the balance/quota calls always send the correct shape.
-export function buildAutoClawWalletHeaders(accessToken) {
-  const raw = String(accessToken || "").replace(/^Bearer\s+/i, "");
-  return buildAutoClawAuthHeaders({ authorization: `Bearer ${raw}` });
-}

package/src/lib/consoleLogBuffer.js

@@ -1,79 +0,0 @@
-import { EventEmitter } from "events";
-import { CONSOLE_LOG_CONFIG } from "@/shared/constants/config.js";
-
-const consoleLevels = ["log", "info", "warn", "error", "debug"];
-
-if (!global._consoleLogBufferState) {
-  global._consoleLogBufferState = {
-    logs: [],
-    patched: false,
-    originals: {},
-    emitter: new EventEmitter(),
-  };
-  global._consoleLogBufferState.emitter.setMaxListeners(50);
-}
-
-const state = global._consoleLogBufferState;
-
-// Ensure emitter exists (handles hot reload with stale global)
-if (!state.emitter) {
-  state.emitter = new EventEmitter();
-  state.emitter.setMaxListeners(50);
-}
-
-function toLogLine(level, args) {
-  return args.map(formatArg).join(" ");
-}
-
-// Strip ANSI escape codes so terminal colors don't bleed into UI
-const ANSI_RE = /\x1b\[[0-9;]*m/g;
-
-function stripAnsi(str) {
-  return str.replace(ANSI_RE, "");
-}
-
-function formatArg(arg) {
-  if (typeof arg === "string") return stripAnsi(arg);
-  if (arg instanceof Error) return stripAnsi(arg.stack || arg.message || String(arg));
-  try {
-    return stripAnsi(JSON.stringify(arg));
-  } catch {
-    return stripAnsi(String(arg));
-  }
-}
-
-function appendLine(line) {
-  state.logs.push(line);
-  const maxLines = CONSOLE_LOG_CONFIG.maxLines;
-  if (state.logs.length > maxLines) {
-    state.logs = state.logs.slice(-maxLines);
-  }
-  state.emitter.emit("line", line);
-}
-
-export function initConsoleLogCapture() {
-  if (state.patched) return;
-
-  for (const level of consoleLevels) {
-    state.originals[level] = console[level];
-    console[level] = (...args) => {
-      appendLine(toLogLine(level, args));
-      state.originals[level](...args);
-    };
-  }
-
-  state.patched = true;
-}
-
-export function getConsoleLogs() {
-  return state.logs;
-}
-
-export function clearConsoleLogs() {
-  state.logs = [];
-  state.emitter.emit("clear");
-}
-
-export function getConsoleEmitter() {
-  return state.emitter;
-}

package/src/lib/dataDir.js

@@ -1,29 +0,0 @@
-import fs from "node:fs";
-import path from "path";
-import os from "os";
-
-const APP_NAME = "zevai";
-
-function defaultDir() {
-  if (process.platform === "win32") {
-    return path.join(process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming"), APP_NAME);
-  }
-  return path.join(os.homedir(), `.${APP_NAME}`);
-}
-
-export function getDataDir() {
-  const configured = process.env.DATA_DIR;
-  if (!configured) return defaultDir();
-  try {
-    fs.mkdirSync(configured, { recursive: true });
-    return configured;
-  } catch (e) {
-    if (e?.code === "EACCES" || e?.code === "EPERM") {
-      console.warn(`[DATA_DIR] '${configured}' not writable → fallback ~/.${APP_NAME}`);
-      return defaultDir();
-    }
-    throw e;
-  }
-}
-
-export const DATA_DIR = getDataDir();

package/src/lib/db/adapters/betterSqliteAdapter.js

@@ -1,58 +0,0 @@
-import Database from "better-sqlite3";
-import { PRAGMA_SQL } from "../schema.js";
-
-// Periodic checkpoint to keep WAL file small (avoid huge -wal/-shm growth)
-const CHECKPOINT_INTERVAL_MS = 60 * 1000;
-
-export function createBetterSqliteAdapter(filePath) {
-  const db = new Database(filePath);
-  db.exec(PRAGMA_SQL);
-  // Schema is created/synced by migrate.js after adapter init
-
-  const stmtCache = new Map();
-
-  function prepare(sql) {
-    let stmt = stmtCache.get(sql);
-    if (!stmt) {
-      stmt = db.prepare(sql);
-      stmtCache.set(sql, stmt);
-    }
-    return stmt;
-  }
-
-  // Truncate WAL periodically so file stays small for backup/copy
-  const checkpointTimer = setInterval(() => {
-    try { db.pragma("wal_checkpoint(TRUNCATE)"); } catch {}
-  }, CHECKPOINT_INTERVAL_MS);
-  if (typeof checkpointTimer.unref === "function") checkpointTimer.unref();
-
-  let closed = false;
-  function gracefulClose() {
-    if (closed) return;
-    closed = true;
-    try { db.pragma("wal_checkpoint(TRUNCATE)"); } catch {}
-    try { stmtCache.clear(); } catch {}
-    try { db.close(); } catch {}
-  }
-
-  // The app bootstrap owns SIGINT/SIGTERM so it can flush buffered writes
-  // before closing the database. This hook only covers a natural event-loop exit.
-  const onShutdown = () => gracefulClose();
-  process.once("beforeExit", onShutdown);
-
-  return {
-    driver: "better-sqlite3",
-    run(sql, params = []) { return prepare(sql).run(params); },
-    get(sql, params = []) { return prepare(sql).get(params); },
-    all(sql, params = []) { return prepare(sql).all(params); },
-    exec(sql) { return db.exec(sql); },
-    transaction(fn) { return db.transaction(fn)(); },
-    checkpoint() { db.pragma("wal_checkpoint(TRUNCATE)"); },
-    close() {
-      clearInterval(checkpointTimer);
-      process.removeListener("beforeExit", onShutdown);
-      gracefulClose();
-    },
-    raw: db,
-  };
-}

package/src/lib/db/adapters/bunSqliteAdapter.js

@@ -1,65 +0,0 @@
-// Bun runtime adapter — uses built-in bun:sqlite (native, fastest under Bun).
-// Loaded only when process.versions.bun is present.
-import { PRAGMA_SQL } from "../schema.js";
-
-const CHECKPOINT_INTERVAL_MS = 60 * 1000;
-
-export async function createBunSqliteAdapter(filePath) {
-  // Dynamic import — only resolves under Bun runtime
-  const { Database } = await import("bun:sqlite");
-  const db = new Database(filePath, { create: true });
-  db.exec(PRAGMA_SQL);
-
-  const stmtCache = new Map();
-  function prepare(sql) {
-    let stmt = stmtCache.get(sql);
-    if (!stmt) {
-      stmt = db.prepare(sql);
-      stmtCache.set(sql, stmt);
-    }
-    return stmt;
-  }
-
-  const checkpointTimer = setInterval(() => {
-    try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {}
-  }, CHECKPOINT_INTERVAL_MS);
-  if (typeof checkpointTimer.unref === "function") checkpointTimer.unref();
-
-  let closed = false;
-  function gracefulClose() {
-    if (closed) return;
-    closed = true;
-    try { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); } catch {}
-    try { stmtCache.clear(); } catch {}
-    try { db.close(); } catch {}
-  }
-  const onShutdown = () => gracefulClose();
-  process.once("beforeExit", onShutdown);
-
-  return {
-    driver: "bun:sqlite",
-    run(sql, params = []) {
-      const r = prepare(sql).run(...params);
-      return { changes: Number(r.changes ?? 0), lastInsertRowid: Number(r.lastInsertRowid ?? 0) };
-    },
-    get(sql, params = []) {
-      return prepare(sql).get(...params);
-    },
-    all(sql, params = []) {
-      return prepare(sql).all(...params);
-    },
-    exec(sql) { return db.exec(sql); },
-    transaction(fn) {
-      // bun:sqlite has db.transaction() API (similar to better-sqlite3)
-      const tx = db.transaction(fn);
-      return tx();
-    },
-    checkpoint() { db.exec("PRAGMA wal_checkpoint(TRUNCATE)"); },
-    close() {
-      clearInterval(checkpointTimer);
-      process.removeListener("beforeExit", onShutdown);
-      gracefulClose();
-    },
-    raw: db,
-  };
-}