@deslop/gateway 0.1.1248 → 0.1.1249

package/dist/server.js

@@ -5027,7 +5027,7 @@ const serviceNotFoundError = (service) => {
 * @category getters
 * @since 2.0.0
 */
-const getOption = /*#__PURE__*/ dual(2, (self, service) => {
+const getOption$1 = /*#__PURE__*/ dual(2, (self, service) => {
 	const value = lookup$1(self, service.key);
 	if (value !== notFound$2) return some$1(value);
 	return isReference(service) ? some$1(getDefaultValue(service)) : none();
@@ -5120,41 +5120,6 @@ const mergeAll$2 = (...ctxs) => {
 	return makeUnsafe$9(map);
 };
 /**
-* Returns a new `Context` with the specified service keys removed.
-*
-* **When to use**
-*
-* Use when you want to remove a denylist of services from a `Context`.
-*
-* **Example** (Omitting services from a context)
-*
-* ```ts import.meta.vitest
-* import { Context, Option, pipe } from "effect"
-*
-* const Port = Context.Service<{ PORT: number }>("Port")
-* const Timeout = Context.Service<{ TIMEOUT: number }>("Timeout")
-*
-* const someContext = pipe(
-*   Context.make(Port, { PORT: 8080 }),
-*   Context.add(Timeout, { TIMEOUT: 5000 })
-* )
-*
-* const context = pipe(someContext, Context.omit(Timeout))
-*
-* Context.getOption(context, Port) // => Option.some({ PORT: 8080 })
-* Context.getOption(context, Timeout) // => Option.none()
-* ```
-*
-* @see {@link pick} for keeping selected services
-*
-* @stability stable
-* @category filtering
-* @since 2.0.0
-*/
-const omit$3 = (...keys) => (self) => withFlat(self, (map) => {
-	for (let i = 0; i < keys.length; i++) map.delete(keys[i].key);
-});
-/**
 * Creates a context key with a default value.
 *
 * **When to use**
@@ -9916,7 +9881,7 @@ const exitAsVoidAll = (exits) => {
 	return failures.length === 0 ? exitVoid : exitFailCause(causeFromReasons(failures));
 };
 /** @internal */
-const serviceOption$1 = (service) => withFiber$1((fiber) => succeed$9(getOption(fiber.context, service)));
+const serviceOption$1 = (service) => withFiber$1((fiber) => succeed$9(getOption$1(fiber.context, service)));
 /** @internal */
 const updateContext$1 = /*#__PURE__*/ dual(2, (self, f) => withFiber$1((fiber) => {
 	const prevContext = fiber.context;
@@ -9962,7 +9927,7 @@ const forever$2 = /*#__PURE__*/ dual((args) => isEffect$1(args[0]), (self, optio
 	step: constVoid
 }));
 /** @internal */
-const catchCause$3 = /*#__PURE__*/ dual(2, (self, f) => new OnFailureImpl(self, f.length !== 1 ? (cause) => f(cause) : f));
+const catchCause$4 = /*#__PURE__*/ dual(2, (self, f) => new OnFailureImpl(self, f.length !== 1 ? (cause) => f(cause) : f));
 const OnFailureProto = /*#__PURE__*/ makePrimitiveProto({
 	op: "OnFailure",
 	[evaluate]: evaluateCont
@@ -9973,12 +9938,12 @@ const OnFailureImpl = function(self, f) {
 };
 OnFailureImpl.prototype = OnFailureProto;
 /** @internal */
-const catchCauseIf$1 = /*#__PURE__*/ dual(3, (self, predicate, f) => catchCause$3(self, (cause) => {
+const catchCauseIf$1 = /*#__PURE__*/ dual(3, (self, predicate, f) => catchCause$4(self, (cause) => {
 	if (!predicate(cause)) return failCause$6(cause);
 	return f(cause);
 }));
 /** @internal */
-const catchCauseFilter$1 = /*#__PURE__*/ dual(3, (self, filter, f) => catchCause$3(self, (cause) => {
+const catchCauseFilter$1 = /*#__PURE__*/ dual(3, (self, filter, f) => catchCause$4(self, (cause) => {
 	const eb = filter(cause);
 	return isFailure$1(eb) ? failCause$6(eb.failure) : f(eb.success, cause);
 }));
@@ -9987,9 +9952,9 @@ const catch_$3 = /*#__PURE__*/ dual(2, (self, f) => catchCauseFilter$1(self, fin
 /** @internal */
 const catchDefect$1 = /*#__PURE__*/ dual(2, (self, f) => catchCauseFilter$1(self, findDefect, f));
 /** @internal */
-const tapCause$1 = /*#__PURE__*/ dual(2, (self, f) => catchCause$3(self, (cause) => andThen$1(f(cause), failCause$6(cause))));
+const tapCause$1 = /*#__PURE__*/ dual(2, (self, f) => catchCause$4(self, (cause) => andThen$1(f(cause), failCause$6(cause))));
 /** @internal */
-const tapCauseFilter = /*#__PURE__*/ dual(3, (self, filter, f) => catchCause$3(self, (cause) => {
+const tapCauseFilter = /*#__PURE__*/ dual(3, (self, filter, f) => catchCause$4(self, (cause) => {
 	const result = filter(cause);
 	if (isFailure$1(result)) return failCause$6(cause);
 	return andThen$1(f(result.success, cause), failCause$6(cause));
@@ -10002,14 +9967,14 @@ const tapErrorTag$1 = /*#__PURE__*/ dual(3, (self, k, f) => {
 	return tapError$4(self, (error) => predicate(error) ? f(error) : void_$3);
 });
 /** @internal */
-const catchIf$1 = /*#__PURE__*/ dual((args) => isEffect$1(args[0]), (self, predicate, f, orElse) => catchCause$3(self, (cause) => {
+const catchIf$1 = /*#__PURE__*/ dual((args) => isEffect$1(args[0]), (self, predicate, f, orElse) => catchCause$4(self, (cause) => {
 	const error = findRecoverableError(cause);
 	if (isFailure$1(error)) return failCause$6(error.failure);
 	if (!predicate(error.success)) return orElse ? orElse(error.success) : failCause$6(cause);
 	return f(error.success);
 }));
 /** @internal */
-const catchFilter$1 = /*#__PURE__*/ dual((args) => isEffect$1(args[0]), (self, filter, f, orElse) => catchCause$3(self, (cause) => {
+const catchFilter$1 = /*#__PURE__*/ dual((args) => isEffect$1(args[0]), (self, filter, f, orElse) => catchCause$4(self, (cause) => {
 	const error = findRecoverableError(cause);
 	if (isFailure$1(error)) return failCause$6(error.failure);
 	const result = filter(error.success);
@@ -10036,7 +10001,7 @@ const catchReason$1 = /*#__PURE__*/ dual((args) => isEffect$1(args[0]), (self, e
 	return orElse ? orElse(reason, e) : fail$10(e);
 }));
 /** @internal */
-const mapError$3 = /*#__PURE__*/ dual(2, (self, f) => catchCause$3(self, (cause) => failCause$6(causeMap(cause, f))));
+const mapError$3 = /*#__PURE__*/ dual(2, (self, f) => catchCause$4(self, (cause) => failCause$6(causeMap(cause, f))));
 /** @internal */
 const mapBoth$1 = /*#__PURE__*/ dual(2, (self, options) => matchCauseEffect$1(self, {
 	onFailure: (cause) => failCause$6(causeMap(cause, options.onFailure)),
@@ -10164,9 +10129,9 @@ const delay$1 = /*#__PURE__*/ dual(2, (self, duration) => andThen$1(sleep$2(dura
 /** @internal */
 const timeoutOrElse$1 = /*#__PURE__*/ dual(2, (self, options) => flatMap$4(timeoutOption$1(self, options.duration), (option) => isNone(option) ? options.orElse() : succeed$9(option.value)));
 /** @internal */
-const timeoutErrorFromDuration = (duration) => new TimeoutError(`Operation timed out after '${format$3(duration)}'`);
+const timeoutErrorFromDuration = (duration) => new TimeoutError$1(`Operation timed out after '${format$3(duration)}'`);
 /** @internal */
-const timeout$1 = /*#__PURE__*/ dual(2, (self, duration) => {
+const timeout$2 = /*#__PURE__*/ dual(2, (self, duration) => {
 	const decoded = fromInputUnsafe$1(duration);
 	return timeoutOrElse$1(self, {
 		duration: decoded,
@@ -10208,7 +10173,7 @@ const runFinalizer = (finalizer, exit_) => {
 		return exitDie(defect);
 	}
 };
-const combineFinalizerCause = (exit_, finalizer) => exitIsSuccess(exit_) ? finalizer : catchCause$3(finalizer, (cause) => failCause$6(causeElectDefects(causeCombine(exit_.cause, cause))));
+const combineFinalizerCause = (exit_, finalizer) => exitIsSuccess(exit_) ? finalizer : catchCause$4(finalizer, (cause) => failCause$6(causeElectDefects(causeCombine(exit_.cause, cause))));
 const scopeCloseFinalizers = /*#__PURE__*/ fnUntraced$1(function* (self, finalizers, exit_) {
 	let exits = [];
 	const fibers = [];
@@ -11048,7 +11013,7 @@ const TimeoutErrorTypeId = "~effect/Cause/TimeoutError";
 /** @internal */
 const isTimeoutError$1 = (u) => hasProperty(u, TimeoutErrorTypeId);
 /** @internal */
-var TimeoutError = class extends (/*#__PURE__*/ TaggedError$2("TimeoutError")) {
+var TimeoutError$1 = class extends (/*#__PURE__*/ TaggedError$2("TimeoutError")) {
 	[TimeoutErrorTypeId] = TimeoutErrorTypeId;
 	constructor(message) {
 		super({ message });
@@ -11896,6 +11861,22 @@ const done$1 = done$2;
 */
 const isTimeoutError = isTimeoutError$1;
 /**
+* Constructs a `TimeoutError` with an optional message.
+*
+* **Example** (Creating a TimeoutError)
+*
+* ```ts import.meta.vitest
+* import { Cause } from "effect"
+*
+* new Cause.TimeoutError("Operation timed out").message // => "Operation timed out"
+* ```
+*
+* @stability stable
+* @category constructors
+* @since 4.0.0
+*/
+const TimeoutError = TimeoutError$1;
+/**
 * Constructs an `IllegalArgumentError` with an optional message.
 *
 * **Example** (Creating an IllegalArgumentError)
@@ -14384,6 +14365,63 @@ const provideMerge = /*#__PURE__*/ dual(2, (self, that) => provideWith(self, tha
 */
 const flatMap$3 = /*#__PURE__*/ dual(2, (self, f) => fromBuild((memoMap, scope) => flatMap$4(self.build(memoMap, scope), (context) => f(context).build(memoMap, scope))));
 /**
+* Recovers from any failure cause by switching to another layer.
+*
+* **When to use**
+*
+* Use when you need `Layer` recovery to inspect more than the typed error,
+* such as defects or interruption information.
+*
+* **Details**
+*
+* The handler receives the full `Cause` of the failed layer, including typed
+* errors, unexpected defects, and interruption information, and returns the
+* fallback layer to build instead. Finalizers for resources acquired by the
+* failed layer are still run before the fallback layer is acquired.
+*
+* **Example** (Recovering from layer failures by cause)
+*
+* ```ts import.meta.vitest
+* import { Context, Data, Effect, Layer } from "effect"
+*
+* class DatabaseError extends Data.TaggedError("DatabaseError")<{
+*   message: string
+* }> {}
+*
+* class Database extends Context.Service<Database, {
+*   readonly query: (sql: string) => Effect.Effect<string>
+* }>()("Database") {}
+*
+* const primaryDatabaseLayer = Layer.effect(Database,
+*   Effect.fail(new DatabaseError({ message: "Primary DB unreachable" }))
+* )
+*
+* const databaseWithFallback = primaryDatabaseLayer.pipe(
+*   Layer.catchCause(() => {
+*     return Layer.succeed(Database, {
+*       query: Effect.fn("Database.query")((sql: string) => Effect.succeed(`Memory: ${sql}`))
+*     })
+*   })
+* )
+*
+* const program = Effect.gen(function*() {
+*   const database = yield* Database
+*   return yield* database.query("SELECT * FROM users")
+* }).pipe(
+*   Effect.provide(databaseWithFallback)
+* )
+*
+* await Effect.runPromise(program) // => "Memory: SELECT * FROM users"
+* ```
+*
+* @see {@link catchTag} for recovering from specific tagged errors
+*
+* @stability stable
+* @category error handling
+* @since 4.0.0
+*/
+const catchCause$3 = /*#__PURE__*/ dual(2, (self, onError) => fromBuildUnsafe((memoMap, scope) => catchCause$4(self.build(memoMap, scope), (cause) => onError(cause).build(memoMap, scope))));
+/**
 * Creates a fresh version of this layer that will not be shared.
 *
 * **When to use**
@@ -15184,6 +15222,23 @@ const capitalize = (self) => {
 */
 const replace = (searchValue, replaceValue) => (self) => self.replace(searchValue, replaceValue);
 /**
+* Removes whitespace from both ends of a string.
+*
+* **Example** (Trimming whitespace)
+*
+* ```ts import.meta.vitest
+* import { String } from "effect"
+*
+* String.trim(" a ") // => "a"
+* String.trim("  hello world  ") // => "hello world"
+* ```
+*
+* @stability stable
+* @category transforming
+* @since 2.0.0
+*/
+const trim = (self) => self.trim();
+/**
 * Extracts a section of a string and returns it as a new string.
 *
 * **Example** (Slicing strings)
@@ -15201,6 +15256,23 @@ const replace = (searchValue, replaceValue) => (self) => self.replace(searchValu
 */
 const slice = (start, end) => (self) => self.slice(start, end);
 /**
+* Checks whether a `string` is non-empty.
+*
+* **Example** (Checking for non-empty strings)
+*
+* ```ts import.meta.vitest
+* import { String } from "effect"
+*
+* String.isNonEmpty("") // => false
+* String.isNonEmpty("a") // => true
+* ```
+*
+* @stability stable
+* @category predicates
+* @since 2.0.0
+*/
+const isNonEmpty$1 = (self) => self.length > 0;
+/**
 * Splits a string into an array of substrings using a separator.
 *
 * **Example** (Splitting strings)
@@ -15666,7 +15738,7 @@ const fromStepWithMetadata = (step) => fromStep(map$7(step, (f) => {
 * @category destructors
 * @since 4.0.0
 */
-const toStep = (schedule) => catchCause$3(schedule.step, (cause) => succeed$9(() => failCause$6(cause)));
+const toStep = (schedule) => catchCause$4(schedule.step, (cause) => succeed$9(() => failCause$6(cause)));
 /**
 * Extracts a step function from a `Schedule` that sleeps for each computed
 * delay and returns metadata for the completed step.
@@ -18020,7 +18092,7 @@ const catchReason = catchReason$1;
 * @category error handling
 * @since 4.0.0
 */
-const catchCause$2 = catchCause$3;
+const catchCause$2 = catchCause$4;
 /**
 * Recovers from defects using a provided recovery function.
 *
@@ -18656,7 +18728,7 @@ const orElseSucceed = orElseSucceed$1;
 * @category delays & timeouts
 * @since 2.0.0
 */
-const timeout = timeout$1;
+const timeout$1 = timeout$2;
 /**
 * Runs an effect with a time limit and represents only the timeout case as
 * `Option.none`.
@@ -30322,7 +30394,7 @@ const compose = /*#__PURE__*/ dual(2, (self, other) => {
 	if (other._tag === "Passthrough") return self;
 	switch (self._tag) {
 		case "Transform": switch (other._tag) {
-			case "Transform": return transform$3((input) => other.transform(self.transform(input)));
+			case "Transform": return transform$4((input) => other.transform(self.transform(input)));
 			case "TransformOptional": return transformOptional((input) => other.transform(map$11(input, self.transform)));
 			case "TransformEffect": return transformEffect$1((input, options) => other.transform(self.transform(input), options));
 			case "TransformOptionalEffect": return composeOptionalEffect(self, other);
@@ -30492,7 +30564,7 @@ function passthrough$1() {
 * @category transforming
 * @since 4.0.0
 */
-function transform$3(f) {
+function transform$4(f) {
 	return makeGetter({
 		_tag: "Transform",
 		transform: f
@@ -30687,7 +30759,7 @@ function withDefault$4(defaultValue) {
 * @since 4.0.0
 */
 function String$8() {
-	return transform$3(globalThis.String);
+	return transform$4(globalThis.String);
 }
 /**
 * Coerces any value to a `number` using the global `Number()` constructor.
@@ -30718,7 +30790,7 @@ function String$8() {
 * @since 4.0.0
 */
 function Number$4() {
-	return transform$3(globalThis.Number);
+	return transform$4(globalThis.Number);
 }
 /**
 * Coerces a value to `bigint` using the global `BigInt()` constructor.
@@ -30844,7 +30916,7 @@ function splitKeyValue$1(options) {
 	const keyValueSeparator = options?.keyValueSeparator ?? "=";
 	const trim = options?.trim ?? false;
 	const keepEmptyValues = options?.keepEmptyValues ?? false;
-	return transform$3((input) => input.split(separator).reduce((acc, pair) => {
+	return transform$4((input) => input.split(separator).reduce((acc, pair) => {
 		let key;
 		let value;
 		if (keyValueSeparator === "") {
@@ -30898,7 +30970,7 @@ function splitKeyValue$1(options) {
 function joinKeyValue(options) {
 	const separator = options?.separator ?? ",";
 	const keyValueSeparator = options?.keyValueSeparator ?? "=";
-	return transform$3((input) => Object.entries(input).map(([key, value]) => `${key}${keyValueSeparator}${value}`).join(separator));
+	return transform$4((input) => Object.entries(input).map(([key, value]) => `${key}${keyValueSeparator}${value}`).join(separator));
 }
 /**
 * Splits a string into an array of strings by a separator.
@@ -30931,7 +31003,7 @@ function joinKeyValue(options) {
 */
 function split(options) {
 	const separator = options?.separator ?? ",";
-	return transform$3((input) => input === "" ? [] : input.split(separator));
+	return transform$4((input) => input === "" ? [] : input.split(separator));
 }
 /**
 * Encodes a `Uint8Array` or string to a Base64 string.
@@ -30959,7 +31031,7 @@ function split(options) {
 * @since 4.0.0
 */
 function encodeBase64() {
-	return transform$3(encode$2);
+	return transform$4(encode$2);
 }
 /**
 * Decodes a Base64 string to a `Uint8Array`.
@@ -31014,7 +31086,7 @@ function decodeBase64() {
 * @since 4.0.0
 */
 function encodeUriComponent() {
-	return transform$3(encodeURIComponent);
+	return transform$4(encodeURIComponent);
 }
 /**
 * Decodes a URI component encoded string using `decodeURIComponent`.
@@ -31259,8 +31331,8 @@ function transformEffect(options) {
 * @category transforming
 * @since 3.10.0
 */
-function transform$2(options) {
-	return new Transformation(transform$3(options.decode), transform$3(options.encode));
+function transform$3(options) {
+	return new Transformation(transform$4(options.decode), transform$4(options.encode));
 }
 /**
 * Transforms a string into a record of key-value pairs and
@@ -31418,7 +31490,7 @@ const makeEncodeDefect = (options) => {
 };
 const decodeDefect = (input) => isJsonError(input) ? decodeJsonError(input) : input;
 /** @internal */
-const defectFromJson = (options) => transform$2({
+const defectFromJson = (options) => transform$3({
 	decode: decodeDefect,
 	encode: makeEncodeDefect(options)
 });
@@ -31791,7 +31863,7 @@ const Undefined$1 = class extends ASTNodeImpl {
 		return "undefined";
 	}
 };
-const undefinedToNull = /*#__PURE__*/ new Link$1(null_, /*#__PURE__*/ new Transformation(/*#__PURE__*/ transform$3(() => void 0), /*#__PURE__*/ transform$3(() => null)));
+const undefinedToNull = /*#__PURE__*/ new Link$1(null_, /*#__PURE__*/ new Transformation(/*#__PURE__*/ transform$4(() => void 0), /*#__PURE__*/ transform$4(() => null)));
 const undefined_ = /*#__PURE__*/ new Undefined$1();
 /**
 * Constructs a {@link Void}.
@@ -32016,7 +32088,7 @@ function templateLiteralTransformation(template) {
 		const segments = segmentTemplateLiteralParts(template, s, options);
 		if (segments) return succeed$5(segments);
 		return fail$6(new InvalidValue$1({ expected: "a string matching template literal parts" }, s, options));
-	}), transform$3((parts) => parts.join("")));
+	}), transform$4((parts) => parts.join("")));
 }
 /**
 * Constructs a {@link Literal}.
@@ -32056,7 +32128,7 @@ const Literal$1 = class extends ASTNodeImpl {
 };
 function literalToString(ast) {
 	const literalAsString = globalThis.String(ast.literal);
-	return replaceEncoding(ast, [new Link$1(new Literal$1(literalAsString), new Transformation(transform$3(() => ast.literal), transform$3(() => literalAsString)))]);
+	return replaceEncoding(ast, [new Link$1(new Literal$1(literalAsString), new Transformation(transform$4(() => ast.literal), transform$4(() => literalAsString)))]);
 }
 /**
 * Constructs a {@link String}.
@@ -33182,7 +33254,7 @@ function isFinite(annotations) {
 }
 /** @internal */
 const finite = /*#__PURE__*/ appendChecks(number$4, [/*#__PURE__*/ isFinite()]);
-const numberToJson = /*#__PURE__*/ new Link$1(/*#__PURE__*/ new Union$1([finite, nonFiniteLiterals]), /*#__PURE__*/ new Transformation(/*#__PURE__*/ Number$4(), /*#__PURE__*/ transform$3((n) => globalThis.Number.isFinite(n) ? n : globalThis.String(n))));
+const numberToJson = /*#__PURE__*/ new Link$1(/*#__PURE__*/ new Union$1([finite, nonFiniteLiterals]), /*#__PURE__*/ new Transformation(/*#__PURE__*/ Number$4(), /*#__PURE__*/ transform$4((n) => globalThis.Number.isFinite(n) ? n : globalThis.String(n))));
 /**
 * Creates a {@link Filter} that validates strings by running `RegExp.test`.
 *
@@ -34750,9 +34822,9 @@ function toCodecStringTreeASTStep(ast, recur, onMissingAnnotation) {
 	}
 	return ast;
 }
-const nullToString = /*#__PURE__*/ new Link$1(/*#__PURE__*/ new Literal$1("null"), /*#__PURE__*/ new Transformation(/*#__PURE__*/ transform$3(() => null), /*#__PURE__*/ transform$3(() => "null")));
-const booleanToString = /*#__PURE__*/ new Link$1(/*#__PURE__*/ new Union$1([/*#__PURE__*/ new Literal$1("true"), /*#__PURE__*/ new Literal$1("false")]), /*#__PURE__*/ new Transformation(/*#__PURE__*/ transform$3((s) => s === "true"), /*#__PURE__*/ String$8()));
-const arrayFromSingleTransformation = /*#__PURE__*/ new Transformation(/*#__PURE__*/ transform$3((input) => typeof input === "string" ? [input] : input), /*#__PURE__*/ passthrough$1());
+const nullToString = /*#__PURE__*/ new Link$1(/*#__PURE__*/ new Literal$1("null"), /*#__PURE__*/ new Transformation(/*#__PURE__*/ transform$4(() => null), /*#__PURE__*/ transform$4(() => "null")));
+const booleanToString = /*#__PURE__*/ new Link$1(/*#__PURE__*/ new Union$1([/*#__PURE__*/ new Literal$1("true"), /*#__PURE__*/ new Literal$1("false")]), /*#__PURE__*/ new Transformation(/*#__PURE__*/ transform$4((s) => s === "true"), /*#__PURE__*/ String$8()));
+const arrayFromSingleTransformation = /*#__PURE__*/ new Transformation(/*#__PURE__*/ transform$4((input) => typeof input === "string" ? [input] : input), /*#__PURE__*/ passthrough$1());
 const isCodecArrayFromSingleLink = (link) => link.transformation === arrayFromSingleTransformation;
 const toCodecStringTreeAST = /*#__PURE__*/ makeCodecDerivation((ast, recur) => toCodecStringTreeASTStep(ast, recur, (ast) => {
 	throw new globalThis.Error("Missing structural codec for StringTree", { cause: ast });
@@ -37374,8 +37446,8 @@ function Literal(literal) {
 		literal,
 		transform(to) {
 			return out.pipe(decodeTo(Literal(to), {
-				decode: transform$3(() => to),
-				encode: transform$3(() => literal)
+				decode: transform$4(() => to),
+				encode: transform$4(() => literal)
 			}));
 		}
 	});
@@ -37862,7 +37934,7 @@ const FalseLiterals = /*#__PURE__*/ Literals([
 	"n"
 ]);
 /** @internal */
-const BooleanLiterals = /*#__PURE__*/ Literals([...TrueLiterals.literals, ...FalseLiterals.literals]).pipe(/*#__PURE__*/ decodeTo(Boolean$5, /*#__PURE__*/ transform$2({
+const BooleanLiterals = /*#__PURE__*/ Literals([...TrueLiterals.literals, ...FalseLiterals.literals]).pipe(/*#__PURE__*/ decodeTo(Boolean$5, /*#__PURE__*/ transform$3({
 	decode: (value) => value === "true" || value === "yes" || value === "on" || value === "1" || value === "y",
 	encode: (value) => value ? "true" : "false"
 })));
@@ -38963,7 +39035,7 @@ function CauseReason(error, defect) {
 				_tag: Literal("Interrupt"),
 				fiberId: UndefinedOr(Finite)
 			})
-		]), transform$2({
+		]), transform$3({
 			decode: (e) => {
 				switch (e._tag) {
 					case "Fail": return makeFailReason(e.error);
@@ -39037,7 +39109,7 @@ function Cause(error, defect) {
 			importDeclarations: [`import * as Cause from "effect/Cause"`]
 		}),
 		expected: "Cause",
-		toCodec: ([error, defect]) => link$1()(ArraySchema(CauseReason(error, defect)), transform$2({
+		toCodec: ([error, defect]) => link$1()(ArraySchema(CauseReason(error, defect)), transform$3({
 			decode: fromReasons,
 			encode: ({ reasons: failures }) => failures
 		}))
@@ -39104,7 +39176,7 @@ const DateTimeUtc = /*#__PURE__*/ declare((u) => isDateTime(u) && isUtc(u), {
 	expected: "DateTime.Utc",
 	toCodecArbitrary: ({ constraint }) => {
 		const [minimum, maximum] = dateTimeArbitraryBounds(constraint, arbitraryMinimumDateTimestamp, arbitraryMaximumDateTimestamp);
-		return linkDecoding()(dateTimeArbitraryInteger(minimum, maximum), transform$3(makeUnsafe$4));
+		return linkDecoding()(dateTimeArbitraryInteger(minimum, maximum), transform$4(makeUnsafe$4));
 	},
 	toCodecJson: () => link$1()(String$6, dateTimeUtcFromString),
 	toFormatter: () => (utc) => utc.toString()
@@ -39152,7 +39224,7 @@ const Duration = /*#__PURE__*/ declare(isDuration, {
 			_tag: Literal("Millis"),
 			value: Int$1
 		})
-	]), transform$2({
+	]), transform$3({
 		decode: (e) => {
 			switch (e._tag) {
 				case "Infinity": return infinity;
@@ -39227,7 +39299,7 @@ function Exit(value, error, defect) {
 		}), Struct({
 			_tag: Literal("Failure"),
 			cause: Cause(error, defect)
-		})]), transform$2({
+		})]), transform$3({
 			decode: (e) => e._tag === "Success" ? succeed$8(e.value) : failCause$5(e.cause),
 			encode: (exit) => isSuccess(exit) ? {
 				_tag: "Success",
@@ -39296,8 +39368,8 @@ function Redacted(value, options) {
 		}),
 		expected: "Redacted",
 		toCodecJson: ([value]) => link$1()(value, {
-			decode: transform$3((e) => make$67(e, { label })),
-			encode: disallowJsonEncode ? forbidden((oe) => "Cannot serialize Redacted" + (isSome(oe) && typeof oe.value.label === "string" ? ` with label: "${oe.value.label}"` : "")) : transform$3(value$2)
+			decode: transform$4((e) => make$67(e, { label })),
+			encode: disallowJsonEncode ? forbidden((oe) => "Cannot serialize Redacted" + (isSome(oe) && typeof oe.value.label === "string" ? ` with label: "${oe.value.label}"` : "")) : transform$4(value$2)
 		}),
 		toEquivalence: ([value]) => makeEquivalence(value)
 	});
@@ -39386,7 +39458,7 @@ function makeClassTrusted(self, fields) {
 	} });
 }
 function getClassTransformation(self) {
-	return new Transformation(transform$3((input) => makeClassTrusted(self, input)), passthrough$1());
+	return new Transformation(transform$4((input) => makeClassTrusted(self, input)), passthrough$1());
 }
 function getClassTypeId(identifier) {
 	return `~effect/Schema/Class/${identifier}`;
@@ -40089,6 +40161,125 @@ const checkCapacity = (self) => {
 	}
 };
 /**
+* Reads an existing cache entry without invoking the lookup function.
+*
+* **Details**
+*
+* Returns `Option.none()` when the key is missing or expired, and `Option.some`
+* when a cached lookup has succeeded. If the entry is still pending, waits for
+* it to complete. If the cached or pending lookup fails, this effect fails with
+* the same error.
+*
+* **Example** (Reading cached values without lookup)
+*
+* ```ts import.meta.vitest
+* import { Cache, Effect, Option } from "effect"
+*
+* const program = Effect.gen(function*() {
+*   const cache = yield* Cache.make({
+*     capacity: 10,
+*     lookup: (key: string) => Effect.succeed(key.length)
+*   })
+*
+*   // No value in cache yet - returns None without lookup
+*   const empty = yield* Cache.getOption(cache, "hello")
+*
+*   // Populate cache using get
+*   yield* Cache.get(cache, "hello")
+*
+*   // Now getOption returns the cached value
+*   const cached = yield* Cache.getOption(cache, "hello")
+*   return [empty, cached] as const
+* })
+*
+* const actual = await Effect.runPromise(program)
+* actual // => [Option.none(), Option.some(5)]
+* ```
+*
+* **Example** (Skipping expired entries)
+*
+* ```ts import.meta.vitest
+* import { Cache, Effect, Option } from "effect"
+* import { TestClock } from "effect/testing"
+*
+* // Expired entries return None
+* const program = Effect.gen(function*() {
+*   const cache = yield* Cache.make({
+*     capacity: 10,
+*     lookup: (key: string) => Effect.succeed(key.length),
+*     timeToLive: "1 hour"
+*   })
+*
+*   // Add value to cache
+*   yield* Cache.get(cache, "hello")
+*
+*   // Value exists before expiration
+*   const beforeExpiry = yield* Cache.getOption(cache, "hello")
+*
+*   // Simulate time passing
+*   yield* TestClock.adjust("2 hours")
+*
+*   // Value expired - returns None
+*   const afterExpiry = yield* Cache.getOption(cache, "hello")
+*   return [beforeExpiry, afterExpiry] as const
+* })
+*
+* const actual = await Effect.runPromise(Effect.provide(program, TestClock.layer()))
+* actual // => [Option.some(5), Option.none()]
+* ```
+*
+* **Example** (Waiting for pending lookups)
+*
+* ```ts import.meta.vitest
+* import { Cache, Deferred, Effect, Fiber, Option } from "effect"
+*
+* // Waits for ongoing computation to complete
+* const program = Effect.gen(function*() {
+*   const deferred = yield* Deferred.make<void>()
+*   const cache = yield* Cache.make({
+*     capacity: 10,
+*     lookup: (_key: string) => Deferred.await(deferred).pipe(Effect.as(42))
+*   })
+*
+*   // Start lookup in background
+*   const getFiber = yield* Effect.forkChild(Cache.get(cache, "key"))
+*
+*   // getOption waits for ongoing computation
+*   const optionFiber = yield* Effect.forkChild(Cache.getOption(cache, "key"))
+*
+*   // Complete the computation
+*   yield* Deferred.succeed(deferred, void 0)
+*
+*   const result = yield* Fiber.join(optionFiber)
+*   const value = yield* Fiber.join(getFiber)
+*   return [result, value] as const
+* })
+*
+* const actual = await Effect.runPromise(program)
+* actual // => [Option.some(42), 42]
+* ```
+*
+* @stability stable
+* @category combinators
+* @since 4.0.0
+*/
+const getOption = /*#__PURE__*/ dual(2, (self, key) => withFiber$1((fiber) => {
+	const entry = getImpl(self, key, fiber);
+	return entry ? asSome$1(entry.await(fiber)) : succeedNone$1;
+}));
+const getImpl = (self, key, fiber, isRead = true) => {
+	const oentry = get$8(self.map, key);
+	if (isNone(oentry)) return;
+	else if (hasExpired(oentry.value, fiber)) {
+		remove$6(self.map, key);
+		return;
+	} else if (isRead) {
+		remove$6(self.map, key);
+		set$4(self.map, key, oentry.value);
+	}
+	return oentry.value;
+};
+/**
 * Sets the value associated with the specified key in the cache. This will
 * overwrite any existing value for that key, skipping the lookup function.
 *
@@ -47690,7 +47881,7 @@ function Array$1(value, pathOrOptions, options) {
 	const separator = resolvedOptions?.separator ?? ",";
 	return schema$1(Union([String$6.pipe(decodeTo(toCodecStringTree(array), {
 		decode: split(resolvedOptions),
-		encode: compose(passthrough$1({ strict: false }), transform$3((input) => input.join(separator)))
+		encode: compose(passthrough$1({ strict: false }), transform$4((input) => input.join(separator)))
 	})), array]), hasPath ? pathOrOptions : void 0);
 }
 function Record(key, value, pathOrOptions, options) {
@@ -49943,11 +50134,10 @@ const setUnsafe = (self, value) => {
 	publishUnsafe(self.pubsub, value);
 };
 /**
-* Modifies the `SubscriptionRef` atomically with an effectful function that
-* computes a return value and a new value, notifying subscribers of the
-* change.
+* Updates the value of the `SubscriptionRef` with the result of applying an
+* effectful function, notifying subscribers of the change.
 *
-* **Example** (Modifying with an effect)
+* **Example** (Updating with an effect)
 *
 * ```ts import.meta.vitest
 * import { Effect, SubscriptionRef } from "effect"
@@ -49955,25 +50145,19 @@ const setUnsafe = (self, value) => {
 * const program = Effect.gen(function*() {
 *   const ref = yield* SubscriptionRef.make(10)
 *
-*   const result = yield* SubscriptionRef.modifyEffect(
-*     ref,
-*     (n) => Effect.succeed([`Doubled from ${n}`, n * 2] as const)
-*   )
-*   const newValue = yield* SubscriptionRef.get(ref)
-*   return [result, newValue]
+*   yield* SubscriptionRef.updateEffect(ref, (n) => Effect.succeed(n + 5))
+*
+*   return yield* SubscriptionRef.get(ref)
 * })
 *
-* await Effect.runPromise(program) // => ["Doubled from 10", 20]
+* await Effect.runPromise(program) // => 15
 * ```
 *
 * @stability stable
 * @category mutations
 * @since 2.0.0
 */
-const modifyEffect = /*#__PURE__*/ dual(2, (self, modify) => self.semaphore.withPermit(suspend$2(() => map$5(modify(self.value), ([b, newValue]) => {
-	setUnsafe(self, newValue);
-	return b;
-}))));
+const updateEffect = /*#__PURE__*/ dual(2, (self, update) => self.semaphore.withPermit(suspend$2(() => map$5(update(self.value), (newValue) => setUnsafe(self, newValue)))));
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/Terminal.js
 const TypeId$22 = "~effect/Terminal";
 const QuitErrorTypeId = "~effect/Terminal/QuitError";
@@ -53564,6 +53748,18 @@ const TypeId$13 = "~effect/http/HttpClient";
 */
 const HttpClient = /*#__PURE__*/ Service$1("effect/HttpClient");
 /**
+* Transforms a client by wrapping the response effect for each request.
+*
+* **Details**
+*
+* The transformation receives both the response effect and the original request, allowing it to change success, error, and environment behavior.
+*
+* @stability unstable
+* @category mapping
+* @since 4.0.0
+*/
+const transform$2 = /*#__PURE__*/ dual(2, (self, f) => makeWith(flatMap$2((request) => f(self.postprocess(succeed$5(request)), request)), self.preprocess));
+/**
 * Transforms a client by applying an effectful transformation to each response effect.
 *
 * @stability unstable
@@ -53717,6 +53913,77 @@ const retryTransient = /*#__PURE__*/ dual(2, (self, options) => {
 		times
 	})));
 });
+/**
+* Fails requests that do not receive a response within the given duration.
+*
+* **When to use**
+*
+* Use to configure a timeout once on the client, for example when providing
+* the `HttpClient` service, while keeping the standard `HttpClientError` error
+* model.
+*
+* **Details**
+*
+* A timed out request is interrupted and fails with an `HttpClientError` whose
+* reason is a `TransportError` with a `Cause.TimeoutError` cause.
+* `retryTransient` treats it as transient. Interrupting a request aborts the
+* underlying transport, unless the request is attached to a scope with
+* `withScope`, in which case it stays open until the scope closes.
+*
+* The timer starts after request preprocessing and covers everything the
+* wrapped client does to produce a response. For a plain client this ends when
+* the response headers arrive, but response middleware applied before
+* `timeout`, such as `tap` or `retryTransient`, runs inside the budget,
+* including any body reads it performs. Composition order therefore decides
+* how it interacts with retries: applying `timeout` before `retryTransient`
+* gives each attempt its own budget, while applying it after bounds the whole
+* retry loop.
+*
+* **Gotchas**
+*
+* Body reads outside the timed client are not covered, including those made
+* by response middleware applied after `timeout` and by consumers of the
+* `HttpClient` service. Apply a separate timeout to body reads such as
+* `response.json` or `response.stream` when needed.
+*
+* **Example** (Timing out each attempt)
+*
+* ```ts
+* import { Effect, Layer } from "effect"
+* import { FetchHttpClient, HttpClient } from "effect/http"
+*
+* const TimedHttpClient = Layer.effect(
+*   HttpClient.HttpClient,
+*   Effect.map(
+*     HttpClient.HttpClient,
+*     HttpClient.timeout("5 seconds")
+*   )
+* ).pipe(Layer.provide(FetchHttpClient.layer))
+*
+* const program = Effect.gen(function*() {
+*   const client = (yield* HttpClient.HttpClient).pipe(
+*     HttpClient.retryTransient({ times: 3 })
+*   )
+*   return yield* client.get("https://example.com")
+* }).pipe(Effect.provide(TimedHttpClient))
+* ```
+*
+* @stability unstable
+* @category error handling
+* @since 4.1.0
+*/
+const timeout = /*#__PURE__*/ dual(2, (self, duration) => {
+	const decoded = fromInputUnsafe$1(duration);
+	const description = `timed out after ${format$3(decoded)}`;
+	return transform$2(self, (effect, request) => timeoutOrElse(effect, {
+		duration: decoded,
+		orElse: () => fail$6(new HttpClientError({ reason: new TransportError({
+			request,
+			cause: new TimeoutError(`Operation ${description}`),
+			description
+		}) }))
+	}));
+});
 const parseRetryAfter = (nowMillis, value) => {
 	if (value === void 0) return;
 	const retryAfter = parseRetryAfter$1(value);
@@ -58756,7 +59023,7 @@ function withCycleGuard(target) {
 	return decodeTo(declareConstructor()([type], ([type]) => (input, ast, options) => {
 		if (isObjectOrArray(input) && decoded.delete(input)) return succeed$5(input);
 		return isCyclic(input) ? fail$6(new InvalidType(ast, input, options)) : decodeUnknownEffect$1(type)(input, options);
-	}, { identifier: "acyclic value" }), transform$2({
+	}, { identifier: "acyclic value" }), transform$3({
 		decode: (value) => {
 			if (isObjectOrArray(value)) decoded.add(value);
 			return value;
@@ -59304,7 +59571,7 @@ const makeNoSerialization$1 = /*#__PURE__*/ fnUntraced(function* (group, options
 				interruptors
 			},
 			context
-		}).pipe(timeout(1e3), runForkWith(parentFiber.context)).addObserver(() => {
+		}).pipe(timeout$1(1e3), runForkWith(parentFiber.context)).addObserver(() => {
 			resume(void_$1);
 		});
 	});
@@ -59741,20 +60008,6 @@ const Service = () => (id, options) => {
 	ServiceClass_.requiredForClient = options?.requiredForClient ?? false;
 	return ServiceClass;
 };
-/**
-* Provides the client-side implementation for an RPC middleware service,
-* capturing the layer's environment and merging it into each middleware
-* invocation.
-*
-* @stability unstable
-* @category layers
-* @since 4.0.0
-*/
-const layerClient = (tag, service) => effectContext(gen(function* () {
-	const services = (yield* context()).pipe(omit$3(Scope));
-	const middleware = isEffect(service) ? yield* service : service;
-	return makeUnsafe$9(/* @__PURE__ */ new Map([[`${tag.key}/Client`, (options) => updateContext(middleware(options), (requestContext) => merge$5(services, requestContext))]]));
-}));
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/ai/McpSchema.js
 /**
 * Defines schemas for Model Context Protocol messages.
@@ -72048,7 +72301,7 @@ const registerToolkit = /*#__PURE__*/ fnUntraced(function* (toolkit) {
 			inputSchema,
 			outputSchema,
 			annotations: {
-				...getOption(tool.annotations, Title).pipe(map$11((title) => ({ title })), getOrUndefined$1),
+				...getOption$1(tool.annotations, Title).pipe(map$11((title) => ({ title })), getOrUndefined$1),
 				readOnlyHint: get$10(tool.annotations, Readonly),
 				destructiveHint: get$10(tool.annotations, Destructive),
 				idempotentHint: get$10(tool.annotations, Idempotent),
@@ -87550,7 +87803,7 @@ const Port = String$6.check(isPattern(/^\d{1,5}$/u), makeFilter((value) => exist
 const AppVersion = String$6.check(isPattern(/^0\.1\.\d+$/u));
 const RUNTIME_PATH = "/api/runtime";
 const RuntimeConfig = Struct({
-	auth: optionalKey(String$6),
+	auth: optionalKey(Origin),
 	name: String$6,
 	traces: String$6,
 	version: AppVersion
@@ -88252,8 +88505,9 @@ const SpanKind = {
 };
 // ../../packages/runtime/src/telemetry.ts
 function layerOtlp(serviceName, url, runtime, version) {
-	return unwrap$7(gen(function* () {
+	return pipe$1(unwrap$7(gen(function* () {
 		const start = `${yield* currentTimeNanos}`;
+		const redacted = yield* CurrentRedactedNames;
 		const resource = {
 			attributes: {
 				"scope.run.started_unix_nano": start,
@@ -88264,14 +88518,28 @@ function layerOtlp(serviceName, url, runtime, version) {
 			serviceVersion: getOrUndefined$1(liftPredicate(version, (current) => current !== "0.1.0"))
 		};
 		return pipe$1(mergeAll$1(layer({
-			exportInterval: "250 millis",
 			resource,
 			url: new URL("/v1/traces", url).href
 		}), layer$1({
-			exportInterval: "250 millis",
 			resource,
 			url: new URL("/v1/logs", url).href
-		})), provide$2([layerJson, layer$12]));
+		}), succeed$6(CurrentRedactedNames)([
+			...redacted,
+			"code",
+			"state",
+			"request",
+			"access_token",
+			"refresh_token",
+			"id_token",
+			"client_secret",
+			"client_assertion",
+			"code_verifier",
+			"session",
+			"token"
+		])), provide$2([layerJson, layer$12]));
+	})), catchCause$3((cause) => {
+		if (hasInterrupts$1(cause)) return effectDiscard(interrupt$1);
+		return effectDiscard(logWarning("Telemetry is unavailable"));
 	}));
 }
 // ../../packages/runtime/src/auth/lib/utils.ts
@@ -88295,15 +88563,15 @@ function isAdmin(admins, id) {
 function signInUrl(next) {
 	return `${new URL(next).origin}/auth/sign-in?${new URLSearchParams({ next })}`;
 }
+function failureOptions(error, status) {
+	if (is$2(AuthError)(error) && error.error === "temporarily_unavailable") return {
+		headers: { "retry-after": "5" },
+		status: 503
+	};
+	return { status };
+}
 var CurrentUser = class extends Service$1()("@deslop/runtime/auth/lib/utils/CurrentUser") {};
-var RpcAuth = class RpcAuth extends Service()("@deslop/runtime/auth/lib/utils/RpcAuth", { error: AuthError }) {
-	static layerClient = (token) => layerClient(RpcAuth, (options) => gen(function* () {
-		return yield* options.next({
-			...options.request,
-			headers: set$2(options.request.headers, "authorization", `Bearer ${yield* token}`)
-		});
-	}));
-};
+var RpcAuth = class extends Service()("@deslop/runtime/auth/lib/utils/RpcAuth", { error: AuthError }) {};
 // ../../packages/runtime/src/auth/service.ts
 function rejected$1(message) {
 	return mapError$2((cause) => {
@@ -88327,7 +88595,10 @@ const unavailable = text("The authorization service is temporarily unavailable;
 	status: 503
 });
 var Auth = class Auth extends Service$1()("@deslop/runtime/auth/service/Auth") {
-	static makeContext = (auth) => pipe$1(make$82(Auth, auth), add$1(RpcAuth, RpcAuth.of((effect, request) => pipe$1(auth.user(request.headers), flatMap$2((user) => raceFirst(provideService(effect, CurrentUser, user), pipe$1(delay(auth.user(request.headers), "5 minutes"), retry({ while: (error) => error.error === "temporarily_unavailable" }), forever)))))));
+	static makeContext = (auth) => pipe$1(make$82(Auth, auth), add$1(RpcAuth, RpcAuth.of((effect, request) => pipe$1(auth.user(request.headers), tap$1(() => {
+		if (isStreamSchema(request.rpc.successSchema)) return annotateCurrentSpan("rpc.stream", true);
+		return void_$1;
+	}), flatMap$2((user) => raceFirst(provideService(effect, CurrentUser, user), pipe$1(delay(auth.user(request.headers), "5 minutes"), retry({ while: (error) => error.error === "temporarily_unavailable" }), forever)))))));
 	static layer = effectContext(gen(function* () {
 		if (yield* localAuth) return Auth.makeContext(Auth.of({
 			access: developer,
@@ -88340,13 +88611,13 @@ var Auth = class Auth extends Service$1()("@deslop/runtime/auth/service/Auth") {
 			return yield* pipe$1(client.get(new URL(VERIFY_PATH, issuer).href, {
 				headers: { authorization: headers["authorization"] ?? "" },
 				urlParams: { resource: audience }
-			}), flatMap$2(schemaBodyJson(User)), timeout("10 seconds"));
+			}), flatMap$2(schemaBodyJson(User)), timeout$1("10 seconds"));
 		}, rejected$1("Sign in first"));
 		return Auth.makeContext(Auth.of({
 			access,
 			user: fn("Auth.user")(function* (headers) {
 				if (isSome(get$6(headers, "authorization"))) return yield* access(headers, canonical);
-				return yield* pipe$1(client.get(new URL(SESSION_PATH, issuer).href, { headers: { cookie: headers["cookie"] ?? "" } }), flatMap$2(schemaBodyJson(User)), timeout("10 seconds"));
+				return yield* pipe$1(client.get(new URL(SESSION_PATH, issuer).href, { headers: { cookie: headers["cookie"] ?? "" } }), flatMap$2(schemaBodyJson(User)), timeout$1("10 seconds"));
 			}, rejected$1("Sign in first"))
 		}));
 	}));
@@ -88416,7 +88687,7 @@ const dataDirectory = gen(function* () {
 	});
 	return directory;
 });
-fnUntraced(function* (name) {
+const tool = fnUntraced(function* (name) {
 	const fs = yield* FileSystem;
 	const path = yield* Path$1;
 	const version = (yield* packageMetadata).version;
@@ -88433,6 +88704,9 @@ fnUntraced(function* (name) {
 	yield* forEach$1(filter$5(yield* fs.readDirectory(tools), (entry) => entry !== version), (entry) => fs.remove(path.join(tools, entry), { recursive: true }), { concurrency: 1 });
 	return target;
 });
+var ToolPath = class extends Service$1()("@deslop/runtime/server/ToolPath") {
+	static layer = succeed$6(this, tool);
+};
 const guard = make$21((app) => gen(function* () {
 	const request = yield* HttpServerRequest;
 	const host = request.headers["host"] ?? "";
@@ -88466,7 +88740,7 @@ function layerKeyValueStore(directory) {
 				return pipe$1(gen(function* () {
 					if (isString$1(value)) yield* fs.writeFileString(`${target}.tmp`, value, { mode: 384 });
 					else yield* fs.writeFile(`${target}.tmp`, value, { mode: 384 });
-				}), andThen(fs.rename(`${target}.tmp`, target)), withPermit(writes), uninterruptible, mapError$2((cause) => new KeyValueStoreError({
+				}), andThen(fs.rename(`${target}.tmp`, target)), uninterruptible, withPermit(writes), mapError$2((cause) => new KeyValueStoreError({
 					cause,
 					key,
 					message: "Cannot save the value",
@@ -88477,7 +88751,15 @@ function layerKeyValueStore(directory) {
 	})), provide$2(layerFileSystem(directory)));
 }
 const layerDataStore = unwrap$7(map$5(dataDirectory, layerKeyValueStore));
-const layerProtocol = mergeAll$1(layerSchemaBinary(), succeed$6(MaxBodySize)(mebibytes(10)));
+const layerProtocol = mergeAll$1(layerSchemaBinary(), succeed$6(MaxBodySize)(mebibytes(10)), effect(TracerDisabledWhen, map$5(TracerDisabledWhen, (previous) => (request) => {
+	const path = headNonEmpty(split$1(request.url, "?"));
+	return previous(request) || path === "/api/rpc" && toLowerCase(request.headers["upgrade"] ?? "") === "websocket" || startsWith("/assets/")(path) || contains$1([
+		"/icon",
+		"/favicon.ico",
+		"/apple-touch-icon.png",
+		"/manifest.webmanifest"
+	], path);
+})));
 const layerTelemetry = unwrap$7(gen(function* () {
 	const metadata = yield* packageMetadata;
 	return match$8(yield* option(String$5("OTEL_URL")), {
@@ -88490,6 +88772,7 @@ const layerRoutes = use((router) => gen(function* () {
 	const canonical = new URL(yield* String$5("APP_URL")).origin;
 	const issuer = yield* option(String$5("AUTH_URL"));
 	const traces = yield* pipe$1(String$5("OTEL_URL"), withDefault$2(""));
+	const metadata = yield* cached$1(packageMetadata);
 	const toIssuer = fnUntraced(function* (search) {
 		const request = yield* HttpServerRequest;
 		const next = filter$7(liftThrowable(() => new URL(new URL(request.url, canonical).searchParams.get("next") ?? canonical, canonical))(), (url) => url.origin === canonical);
@@ -88505,21 +88788,22 @@ const layerRoutes = use((router) => gen(function* () {
 		});
 	});
 	yield* router.add("GET", RUNTIME_PATH, gen(function* () {
+		const release = yield* metadata;
 		return yield* schemaJson(RuntimeConfig)({
 			...match$8(issuer, {
 				onNone: () => ({}),
 				onSome: (origin) => ({ auth: origin })
 			}),
-			name: yield* appName,
+			name: replace("@deslop/", "")(release.name),
 			traces,
-			version: (yield* packageMetadata).version
+			version: release.version
 		});
 	}));
 	yield* router.add("GET", "/auth/sign-in", toIssuer({}));
 	yield* router.add("GET", "/auth/sign-out", toIssuer({ "sign-out": "" }));
 	yield* router.add("GET", "/auth/user", gen(function* () {
 		const user = yield* result$1(auth.user((yield* HttpServerRequest).headers));
-		if (isFailure$1(user)) return empty({ status: 401 });
+		if (isFailure$1(user)) return empty(failureOptions(user.failure, 401));
 		return yield* schemaJson(Account)({
 			...user.success,
 			signOut: isSome(issuer)
@@ -88528,14 +88812,14 @@ const layerRoutes = use((router) => gen(function* () {
 }));
 const layerAnnounce = effectDiscard(gen(function* () {
 	const origin = new URL(yield* String$5("APP_URL")).origin;
-	const client = filterStatusOk(yield* HttpClient);
+	const client = pipe$1(yield* HttpClient, filterStatusOk, timeout("10 seconds"), retryTransient({
+		schedule: spaced("1 minute"),
+		times: 60
+	}));
 	yield* match$8(yield* option(String$5("AUTH_URL")), {
 		onNone: () => void_$1,
 		onSome: fnUntraced(function* (issuer) {
-			yield* pipe$1(post(new URL(APPS_PATH, issuer).href), bodyJsonUnsafe({ origin }), client.execute, delay("2 seconds"), retry({
-				schedule: spaced("1 minute"),
-				times: 60
-			}), ignore$1({
+			yield* pipe$1(post(new URL(APPS_PATH, issuer).href), bodyJsonUnsafe({ origin }), client.execute, delay("2 seconds"), ignore$1({
 				log: "Warn",
 				message: "Auth did not list this app"
 			}), forkScoped);
@@ -88554,11 +88838,10 @@ const layerWeb = unwrap$7(gen(function* () {
 	if (!(yield* (yield* FileSystem).exists((yield* Path$1).join(client, "index.html")))) return empty$12;
 	const name = capitalize(yield* appName);
 	return mergeAll$1(add("GET", MANIFEST_PATH, succeed$5(jsonUnsafe({
-		background_color: "#0a0a0a",
+		background_color: "#0d0c0c",
 		display: "standalone",
 		icons: [{
 			purpose: "any",
-			sizes: "512x512",
 			src: "/apple-touch-icon.png",
 			type: "image/png"
 		}],
@@ -88567,7 +88850,7 @@ const layerWeb = unwrap$7(gen(function* () {
 		scope: "/",
 		short_name: name,
 		start_url: "/",
-		theme_color: "#0a0a0a"
+		theme_color: "#0d0c0c"
 	}, {
 		contentType: "application/manifest+json",
 		headers: { "cache-control": "no-cache" }
@@ -88607,7 +88890,7 @@ function layerMcp(options) {
 				v2025_11_25,
 				v2025_06_18
 			],
-			registrations: pipe$1(toolkit(options.tools), provide$2(options.handlers)),
+			registrations: options.registrations,
 			version: metadata.version
 		}), provide$2(layerMcpAuth(resource)));
 		return match$8(issuer, {
@@ -88647,7 +88930,7 @@ const execute = fnUntraced(function* (command, args) {
 	}, { concurrency: "unbounded" });
 	if (result.code !== 0) return yield* AppError.make({ message: `${command} failed: ${result.stderr}` });
 	return result.stdout;
-});
+}, scoped);
 function systemctl(...args) {
 	return execute("systemctl", ["--user", ...args]);
 }
@@ -88697,7 +88980,7 @@ function status(name) {
 	return systemctl("show", `deslop-${name}.service`, "--property=LoadState,ActiveState,SubState,MainPID");
 }
 function restart(name) {
-	return pipe$1(systemctl("restart", `deslop-${name}.service`), timeout("30 seconds"));
+	return pipe$1(systemctl("restart", `deslop-${name}.service`), timeout$1("30 seconds"));
 }
 // ../../packages/runtime/src/cli/update.ts
 const serviceDirectory = fnUntraced(function* (name) {
@@ -88721,7 +89004,7 @@ const update = fnUntraced(function* (name) {
 	const path = yield* Path$1;
 	const root = yield* serviceDirectory(name);
 	const running = (yield* decodeEffect(fromJsonString(Struct({ version: AppVersion })))(yield* fs.readFileString(path.join(root, "current", "package.json")))).version;
-	const latest = (yield* pipe$1(filterStatusOk(yield* HttpClient).get(`https://registry.npmjs.org/@deslop%2f${name}/latest`), flatMap$2(schemaBodyJson(Struct({ version: AppVersion }))), timeout("15 seconds"))).version;
+	const latest = (yield* pipe$1(filterStatusOk(yield* HttpClient).get(`https://registry.npmjs.org/@deslop%2f${name}/latest`), flatMap$2(schemaBodyJson(Struct({ version: AppVersion }))), timeout$1("15 seconds"))).version;
 	if (latest === running) return `${name} ${running} is current\n`;
 	const npm = path.resolve(path.dirname(execPath), "../lib/node_modules/npm/bin/npm-cli.js");
 	if (!(yield* fs.exists(npm))) return yield* AppError.make({ message: "This Node runtime does not include npm; install Node with Vite+" });
@@ -88738,7 +89021,7 @@ const update = fnUntraced(function* (name) {
 		"--prefer-online",
 		"--registry=https://registry.npmjs.org",
 		`@deslop/${name}@${latest}`
-	]), timeout("5 minutes"));
+	]), timeout$1("5 minutes"));
 	const previous = yield* option$1(fs.readLink(path.join(root, "current")));
 	yield* activate(name, path.join(directory, "node_modules", "@deslop", name));
 	yield* restart(name);
@@ -88747,6 +89030,7 @@ const update = fnUntraced(function* (name) {
 	return `Updated ${name} from ${running} to ${latest}\n`;
 });
 // ../../packages/runtime/src/cli.ts
+const DEFAULT_HOST = "127.0.0.1";
 const SETTINGS = {
 	APP_URL: {
 		description: "Canonical origin, such as the HTTPS name a proxy serves",
@@ -88759,7 +89043,7 @@ const SETTINGS = {
 		schema: SecureOrigin
 	},
 	HOST: {
-		description: "Listen address; defaults to 127.0.0.1",
+		description: `Listen address; defaults to ${DEFAULT_HOST}`,
 		flag: "host",
 		schema: NonEmptyString
 	},
@@ -88767,11 +89051,6 @@ const SETTINGS = {
 		description: "Scope origin to export traces and logs to",
 		flag: "traces",
 		schema: Origin
-	},
-	PORT: {
-		description: "Listen port; defaults to the package's config.port",
-		flag: "port",
-		schema: Port
 	}
 };
 const ADMINS = {
@@ -88780,14 +89059,14 @@ const ADMINS = {
 	schema: String$6.check(isPattern(/^\d+(?:,\d+)*$/u))
 };
 function flagsOf(settings) {
-	return map$9(settings, (setting, key) => pipe$1(String$1(setting.flag), withSchema(setting.schema), withFallbackConfig(schema$1(setting.schema, key)), withDescription(setting.description), optional$1));
+	return map$9(settings, (setting, key) => pipe$1(String$1(setting.flag), withSchema(setting.schema), withFallbackConfig(schema$1(setting.schema, key)), withDescription(`${setting.description} [${key}]`), optional$1));
 }
-const provider = fnUntraced(function* (given) {
-	const port = given["PORT"] ?? `${(yield* packageMetadata).config.port}`;
+const provider = fnUntraced(function* (given, defaultPort) {
+	const port = given["PORT"] ?? `${defaultPort}`;
 	const url = given["APP_URL"] ?? `http://localhost:${port}`;
 	if (given["AUTH_URL"] !== void 0 && new URL(url).protocol !== "https:") return yield* AppError.make({ message: "With --auth, set --url to the app's HTTPS origin" });
 	return orElse$2(fromUnknown({
-		HOST: "127.0.0.1",
+		HOST: DEFAULT_HOST,
 		...given,
 		APP_URL: url,
 		PORT: port
@@ -88795,9 +89074,12 @@ const provider = fnUntraced(function* (given) {
 });
 const layerPlatform = mergeAll$1(layer$4, layer$12, layer$15);
 function server(app) {
-	return pipe$1(serve(pipe$1(mergeAll$1(app.routes, layerRoutes, layerIcon(app.icon), layerWeb, layerAnnounce), provide$2(Auth.layer)), {
+	return pipe$1(serve(pipe$1(mergeAll$1(app.routes, layerRoutes, layerIcon(app.icon), layerWeb, layerAnnounce), provide$2(match$8(fromUndefinedOr(app.middleware), {
+		onNone: () => empty$12,
+		onSome: (middleware$1) => middleware()(middleware$1).layer
+	})), provide$2(Auth.layer)), {
 		disableLogger: true,
-		middleware: (http) => guard(app.middleware?.(http) ?? http)
+		middleware: guard
 	}), provide$2(mergeAll$1(layerProtocol, match$1(app.telemetry === false, {
 		onFalse: () => layerTelemetry,
 		onTrue: () => empty$12
@@ -88807,21 +89089,26 @@ function output(text) {
 	return flatMap$2(Stdio, (stdio) => run$4(make$51(text), stdio.stdout()));
 }
 function runApp(app) {
-	const settings = {
-		...SETTINGS,
-		...app.settings
-	};
 	const program = gen(function* () {
 		const metadata = yield* packageMetadata;
 		const name = yield* appName;
+		const settings = {
+			...SETTINGS,
+			PORT: {
+				description: `Listen port; defaults to ${metadata.config.port}`,
+				flag: "port",
+				schema: Port
+			},
+			...app.settings
+		};
 		const root = pipe$1(make$5(name), withSharedFlags(flagsOf(settings)));
 		const given = map$5(root, (input) => getSomes$1(input));
-		return yield* pipe$1(root, withHandler((input) => flatMap$2(provider(getSomes$1(input)), (values) => provideService(server(app), ConfigProvider, values))), withSubcommands([pipe$1(make$5("service"), withSubcommands([
+		return yield* pipe$1(root, withHandler((input) => flatMap$2(provider(getSomes$1(input), metadata.config.port), (values) => provideService(server(app), ConfigProvider, values))), withSubcommands([pipe$1(make$5("service"), withSubcommands([
 			make$5("install", {}, fnUntraced(function* () {
 				const fs = yield* FileSystem;
 				const path = yield* Path$1;
 				const flags = yield* given;
-				yield* provider(flags);
+				yield* provider(flags, metadata.config.port);
 				const entry = path.join(yield* activate(name, yield* fs.realPath(packageRoot)), "dist", "server.js");
 				const args = flatten$3(collect$1(flags, (key, value) => [`--${settings[key]?.flag ?? key}`, value]));
 				yield* output(yield* install(name, [
@@ -115416,12 +115703,14 @@ const ServerUrl = NonEmptyString.check(isMaxLength(2048), makeFilter((value) =>
 const AddServer = Struct({ url: ServerUrl });
 const ServerParams = Struct({ id: ServerId });
 const Metadata = Struct({
-	authorization_endpoint: NonEmptyString,
+	authorization_endpoint: ServerUrl,
 	authorization_response_iss_parameter_supported: optionalKey(Boolean$5),
 	client_id_metadata_document_supported: optionalKey(Boolean$5),
-	issuer: NonEmptyString,
-	registration_endpoint: optionalKey(NonEmptyString),
-	token_endpoint: NonEmptyString
+	code_challenge_methods_supported: optionalKey(ArraySchema(String$6)),
+	issuer: ServerUrl,
+	registration_endpoint: optionalKey(ServerUrl),
+	response_types_supported: optionalKey(ArraySchema(String$6)),
+	token_endpoint: ServerUrl
 });
 const Registration = Struct({ client_id: NonEmptyString });
 const Token = Struct({
@@ -115508,7 +115797,7 @@ function endSession(transport, client, fail, kind) {
 	return pipe$1(tryPromise({
 		catch: fail,
 		try: () => transport.terminateSession()
-	}), timeout("3 seconds"), ignore$1({
+	}), timeout$1("3 seconds"), ignore$1({
 		log: "Warn",
 		message: `Cannot terminate the ${kind} MCP session`
 	}), andThen(tryPromise({
@@ -115594,14 +115883,6 @@ function failed(message) {
 		});
 	});
 }
-function validMetadata(metadata) {
-	return every$1([
-		metadata.issuer,
-		metadata.authorization_endpoint,
-		metadata.token_endpoint,
-		...toArray$1(fromUndefinedOr(metadata.registration_endpoint))
-	], (endpoint) => is$2(ServerUrl)(endpoint));
-}
 var Connections = class Connections extends Service$1()("@deslop/gateway/services/connections/service/Connections") {
 	static make = gen(function* () {
 		const origin = yield* gatewayUrl;
@@ -115624,27 +115905,27 @@ var Connections = class Connections extends Service$1()("@deslop/gateway/service
 		const client = filterStatusOk(yield* HttpClient);
 		const fetch = yield* Fetch;
 		const random = yield* SecureRandom;
-		const digest = yield* Digest;
 		const pending = yield* make$59({
 			capacity: 64,
 			lookup: () => fail$6(AuthError.make({ message: "The connection expired; connect it again" })),
 			timeToLive: "10 minutes"
 		});
+		const callbacks = yield* make$72(1);
 		const nonce = map$5(random.randomBytes(32), encode$1);
 		const change = fnUntraced(function* (update) {
-			return yield* modifyEffect(state, (current) => tap$1(update(current), (result) => store.set("servers", result[1])));
+			return yield* updateEffect(state, (current) => tap$1(update(current), (next) => store.set("servers", next)));
 		}, uninterruptible);
 		const get$11 = fnUntraced(function* (id) {
 			return yield* pipe$1(get$9(yield* get(state), id), fromOption, mapError$2(() => AuthError.make({ message: "This MCP was removed. Add it again on the MCP page." })));
 		});
 		const update = fnUntraced(function* (id, generation, next) {
-			yield* change((current) => succeed$5([void 0, match$8(filter$7(get$9(current, id), (found) => found.generation === generation), {
+			yield* change((current) => succeed$5(match$8(filter$7(get$9(current, id), (found) => found.generation === generation), {
 				onNone: () => current,
 				onSome: (found) => ({
 					...current,
 					[id]: next(found)
 				})
-			})]));
+			})));
 		});
 		const list = gen(function* () {
 			const now = yield* currentTimeMillis;
@@ -115686,7 +115967,7 @@ var Connections = class Connections extends Service$1()("@deslop/gateway/service
 			}), (request) => client.execute(request), flatMap$2(schemaBodyJson(Token)), tapErrorTag("HttpClientError", (cause) => {
 				if (cause.reason._tag !== "StatusCodeError" || !contains$1([400, 401], cause.reason.response.status)) return void_$1;
 				return ended();
-			}), timeout("20 seconds"));
+			}), timeout$1("20 seconds"));
 			const now = yield* currentTimeMillis;
 			const next = {
 				...token,
@@ -115731,7 +116012,7 @@ var Connections = class Connections extends Service$1()("@deslop/gateway/service
 					Connected: () => fail$6(notConnected),
 					Disconnected: () => fail$6(notConnected)
 				});
-			}), timeout("20 seconds")));
+			}), timeout$1("20 seconds")));
 		}, failed("Cannot refresh this MCP; reconnect it from the MCP page"));
 		const discover = fnUntraced(function* (initial) {
 			const probe = yield* encodeEffect(fromJsonString(Unknown))({
@@ -115797,7 +116078,7 @@ var Connections = class Connections extends Service$1()("@deslop/gateway/service
 					icons: serverIcons(anonymous.getServerVersion()),
 					link: { _tag: "Connected" },
 					mode: "public",
-					name: anonymous.getServerVersion()?.name ?? initial.name,
+					name: pipe$1(fromUndefinedOr(anonymous.getServerVersion()?.name), map$11(trim), filter$7(isNonEmpty$1), getOrElse(() => initial.name)),
 					toolDescriptions: fromEntries(flatMap$5(tools.tools, (tool) => match$8(fromUndefinedOr(tool.description), {
 						onNone: () => [],
 						onSome: (description) => [[tool.name, description]]
@@ -115806,12 +116087,11 @@ var Connections = class Connections extends Service$1()("@deslop/gateway/service
 				};
 			}
 			const metadata = yield* decodeEffect(Metadata)(discovery.authorizationServerMetadata);
-			if (!validMetadata(metadata)) return yield* AuthError.make({ message: "The MCP returned unsafe authorization endpoints." });
 			return {
 				...initial,
 				link: { _tag: "Disconnected" },
 				mode: "oauth",
-				name: discovery.resourceMetadata?.resource_name ?? initial.name,
+				name: pipe$1(fromUndefinedOr(discovery.resourceMetadata?.resource_name), map$11(trim), filter$7(isNonEmpty$1), getOrElse(() => initial.name)),
 				oauth: {
 					client: yield* register(metadata, initial.id),
 					metadata,
@@ -115834,19 +116114,19 @@ var Connections = class Connections extends Service$1()("@deslop/gateway/service
 			yield* admin(user);
 			yield* change((current) => gen(function* () {
 				const found = yield* mapError$2(fromOption(get$9(current, id)), () => AuthError.make({ message: "This MCP was removed. Add it again on the MCP page." }));
-				return [void 0, match$8(next(found), {
+				return match$8(next(found), {
 					onNone: () => remove$7(current, id),
 					onSome: (row) => ({
 						...current,
 						[id]: row
 					})
-				})];
+				});
 			}));
 		}, failed("Cannot change this MCP connection"));
 		return Connections.of({
 			add: fn("Connections.add")(function* (input, user) {
 				yield* admin(user);
-				const url = new URL(yield* decodeEffect(ServerUrl)(input)).href;
+				const url = new URL(input).href;
 				if (new URL(url).origin === origin) return yield* AuthError.make({ message: "The gateway cannot connect to itself" });
 				const current = yield* get(state);
 				if (some(values(current), (row) => row.url === url)) return yield* AuthError.make({ message: "This MCP has already been added." });
@@ -115865,17 +116145,18 @@ var Connections = class Connections extends Service$1()("@deslop/gateway/service
 				});
 				yield* change((latest) => {
 					if (has$4(latest, id) || some(values(latest), (row) => row.url === url)) return fail$6(AuthError.make({ message: "This MCP has already been added." }));
-					return succeed$5([void 0, {
+					return succeed$5({
 						...latest,
 						[id]: connection
-					}]);
+					});
 				});
 				return connectionInfo(connection, yield* currentTimeMillis);
-			}, scoped, timeout("20 seconds"), failed("Cannot add this MCP. Check its public HTTPS URL and OAuth discovery support")),
+			}, scoped, timeout$1("20 seconds"), failed("Cannot add this MCP. Check its public HTTPS URL and OAuth discovery support")),
 			begin: fn("Connections.begin")(function* (id, user) {
 				yield* admin(user);
 				const connection = yield* get$11(id);
-				if (connection.oauth === void 0) {
+				const oauth = connection.oauth;
+				if (oauth === void 0) {
 					yield* update(id, connection.generation, (found) => ({
 						...omit$1(found, ["error"]),
 						link: { _tag: "Connected" }
@@ -115885,56 +116166,84 @@ var Connections = class Connections extends Service$1()("@deslop/gateway/service
 						url: "/"
 					};
 				}
-				const registered = yield* register(connection.oauth.metadata, id);
-				const stateId = yield* nonce;
-				const verifier = yield* nonce;
-				yield* set$1(pending, stateId, {
-					client: registered,
-					generation: connection.generation,
-					id,
-					userId: user.id,
-					verifier
-				});
-				const url = new URL(connection.oauth.metadata.authorization_endpoint);
-				url.search = new URLSearchParams({
-					client_id: valueTags(registered, {
-						Document: () => clientInfo.client_id,
-						Registered: (found) => found.clientId
-					}),
-					code_challenge: encode$1(yield* digest.digest(sha256, new TextEncoder().encode(verifier))),
-					code_challenge_method: "S256",
-					redirect_uri: valueTags(registered, {
-						Document: () => callback,
-						Registered: () => `${callback}/${id}`
-					}),
-					resource: connection.url,
-					response_type: "code",
-					scope: connection.oauth.scope,
-					state: stateId
-				}).toString();
-				return {
-					state: some$1(stateId),
-					url: url.href
-				};
+				return yield* pipe$1(gen(function* () {
+					const metadata = yield* decodeUnknownEffect(Metadata)(yield* tryPromise({
+						catch: (cause) => UpstreamError.make({ cause }),
+						try: (signal) => discoverAuthorizationServerMetadata(oauth.metadata.issuer, { fetchFn: (target, init) => fetch(target, {
+							...init,
+							signal: AbortSignal.any([signal, ...toArray$1(fromNullishOr(init?.signal))])
+						}) })
+					}));
+					if (!contains$1(metadata.code_challenge_methods_supported ?? [], "S256")) return yield* AuthError.make({ message: "The provider must advertise S256 PKCE and safe authorization endpoints." });
+					const registered = yield* register(metadata, id);
+					const stateId = yield* nonce;
+					const authorization = yield* tryPromise({
+						catch: (cause) => UpstreamError.make({ cause }),
+						try: () => startAuthorization(metadata.issuer, {
+							clientInformation: { client_id: valueTags(registered, {
+								Document: () => clientInfo.client_id,
+								Registered: (found) => found.clientId
+							}) },
+							metadata: {
+								...metadata,
+								code_challenge_methods_supported: [...metadata.code_challenge_methods_supported ?? []],
+								response_types_supported: [...metadata.response_types_supported ?? []]
+							},
+							redirectUrl: valueTags(registered, {
+								Document: () => callback,
+								Registered: () => `${callback}/${id}`
+							}),
+							resource: connection.url,
+							scope: oauth.scope,
+							state: stateId
+						})
+					});
+					yield* set$1(pending, stateId, {
+						client: registered,
+						generation: connection.generation,
+						id,
+						metadata,
+						userId: user.id,
+						verifier: authorization.codeVerifier
+					});
+					return {
+						state: some$1(stateId),
+						url: authorization.authorizationUrl.href
+					};
+				}), timeout$1("20 seconds"), catch_$2((cause) => fail(connection, cause)));
 			}, failed("Cannot connect this MCP")),
 			called: (id) => asVoid(publish(traffic, id)),
 			calls: (user) => unwrap$3(as(admin(user), fromPubSub(traffic))),
 			complete: fn("Connections.complete")(function* (params, route, user) {
 				yield* admin(user);
-				const flow = yield* get$5(pending, params.state);
-				yield* invalidate(pending, params.state);
+				const flow = yield* pipe$1(getOption(pending, params.state), tap$1(() => invalidate(pending, params.state)), flatMap$2(match$8({
+					onNone: () => AuthError.make({ message: "The connection expired; connect it again" }),
+					onSome: succeed$5
+				})), uninterruptible, withPermit(callbacks));
 				const connection = yield* get$11(flow.id);
 				if (flow.userId !== user.id || flow.generation !== connection.generation || connection.oauth === void 0) return yield* AuthError.make({ message: "The connection expired; connect it again" });
 				const oauth = {
 					...connection.oauth,
-					client: flow.client
+					client: flow.client,
+					metadata: flow.metadata
 				};
 				yield* pipe$1(gen(function* () {
 					if (params.error !== void 0 || params.code === void 0) return yield* AuthError.make({ message: `The provider declined the connection (${params.error ?? "no code"})` });
 					if (!valueTags(oauth.client, {
-						Document: () => params.iss === oauth.metadata.issuer && isNone(route),
-						Registered: () => contains$2(route, connection.id) && (params.iss === void 0 || params.iss === oauth.metadata.issuer)
+						Document: () => isNone(route),
+						Registered: () => contains$2(route, connection.id)
 					})) return yield* AuthError.make({ message: "The answer came from another authorization server" });
+					yield* try_({
+						catch: (cause) => AuthError.make({
+							cause,
+							message: "The answer came from another authorization server"
+						}),
+						try: () => validateAuthorizationResponseIssuer({
+							expectedIssuer: oauth.metadata.issuer,
+							iss: params.iss,
+							issParameterSupported: oauth.client._tag === "Document" || oauth.metadata.authorization_response_iss_parameter_supported === true
+						})
+					});
 					yield* exchange(connection, oauth, {
 						code: params.code,
 						code_verifier: flow.verifier,
@@ -115944,7 +116253,7 @@ var Connections = class Connections extends Service$1()("@deslop/gateway/service
 							Registered: () => `${callback}/${connection.id}`
 						})
 					});
-				}), timeout("30 seconds"), catch_$2((cause) => fail(connection, cause)));
+				}), timeout$1("30 seconds"), catch_$2((cause) => fail(connection, cause)));
 			}, failed("Cannot finish the connection")),
 			definitions: map$5(get(state), values),
 			get: get$11,
@@ -116089,8 +116398,10 @@ var Gateway = class Gateway extends Service$1()("@deslop/gateway/services/gatewa
 			}), mapError$2(rejected(server)), scoped);
 		}
 		const call = fn("Gateway.call")(function* (server, tool, input) {
-			const request = yield* flatMap$2(serviceOption(HttpServerRequest), fromOption);
-			yield* auth.access(request.headers, `${url}/mcp`);
+			if (isNone(yield* serviceOption(CurrentUser))) {
+				const request = yield* flatMap$2(serviceOption(HttpServerRequest), fromOption);
+				yield* auth.access(request.headers, `${url}/mcp`);
+			}
 			yield* connections.called(server.id);
 			const args = yield* decodeUnknownEffect(ToolArguments)(input ?? {});
 			return yield* withClient(server, (client) => pipe$1(tryPromise({
@@ -116119,7 +116430,7 @@ var Gateway = class Gateway extends Service$1()("@deslop/gateway/services/gatewa
 					instructions: client.getInstructions(),
 					tools
 				})
-			}))), timeout("20 seconds"));
+			}))), timeout$1("20 seconds"));
 			const latest = yield* connections.get(server.id);
 			if (latest.generation !== server.generation || latest.link._tag === "Disconnected") return yield* AuthError.make({ message: `${server.name} changed while its tools were read` });
 			const reference = pick$1(server, [
@@ -116133,7 +116444,6 @@ var Gateway = class Gateway extends Service$1()("@deslop/gateway/services/gatewa
 				const upstreamName = tool.name;
 				const name = yield* namespaced(`${server.id}__${tool.name}`);
 				const fingerprint = yield* encodeEffect(fromJsonString(Tool$5))(tool);
-				if (isNone(match$3(/^[a-zA-Z0-9_-]{1,64}$/u)(name))) return yield* AuthError.make({ message: `${server.name} has a tool name that cannot be namespaced: ${tool.name}` });
 				if ((yield* get$1(installed))[name]?.fingerprint !== `${server.generation}:${fingerprint}`) {
 					yield* registry.addTool({
 						annotations: empty$16(),
@@ -116244,7 +116554,7 @@ const HttpHandlers = use((router) => gen(function* () {
 	yield* router.add("GET", "/oauth/callback/:id", flatMap$2(params, (params) => callback(fromUndefinedOr(params["id"]))));
 }));
 // src/routes/icon.svg
-var icon_default = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 64 64\" shape-rendering=\"crispEdges\"><path fill=\"#8b7ec8\" d=\"M13 20h2v1h-2zM15 21h2v1h-2zM17 22h2v1h-2zM19 23h2v1h-2zM19 24h1v17h-1zM21 24h2v1h-2zM22 25h3v1h-3zM15 26h1v3h-1zM22 26h2v16h-2zM25 26h2v1h-2zM16 27h2v3h-2zM27 27h2v1h-2zM18 28h1v3h-1zM29 28h2v1h-2zM30 29h3v1h-3zM30 30h2v3h-2zM33 30h2v1h-2zM24 31h2v3h-2zM35 31h2v1h-2zM26 32h2v3h-2zM37 32h2v1h-2zM28 33h2v3h-2zM31 33h1v4h-1zM37 33h1v17h-1zM39 33h2v1h-2zM30 34h1v3h-1zM40 34h3v1h-3zM32 35h2v3h-2zM40 35h2v16h-2zM43 35h2v1h-2zM34 36h2v3h-2zM45 36h2v1h-2zM36 37h1v3h-1zM42 40h2v3h-2zM44 41h2v3h-2z\"/><path fill=\"#0a0a0a\" d=\"M13 8h2v1h-2zM11 9h2v1h-2zM15 9h2v1h-2zM9 10h2v1h-2zM17 10h1v3h-1zM8 11h1v1h-1zM7 12h1v2h-1zM18 12h1v1h-1zM19 13h2v1h-2zM8 14h1v4h-1zM21 14h2v1h-2zM23 15h2v1h-2zM25 16h2v1h-2zM27 17h2v1h-2zM9 18h2v1h-2zM29 18h2v1h-2zM11 19h2v1h-2zM31 19h2v1h-2zM12 20h1v1h-1zM33 20h2v1h-2zM13 21h2v1h-2zM35 21h2v1h-2zM15 22h2v1h-2zM37 22h2v1h-2zM17 23h2v1h-2zM39 23h2v1h-2zM15 24h2v1h-2zM18 24h1v1h-1zM41 24h2v1h-2zM14 25h1v4h-1zM43 25h2v1h-2zM45 26h2v1h-2zM47 27h2v1h-2zM27 28h2v1h-2zM49 28h6v1h-6zM15 29h1v1h-1zM28 29h2v1h-2zM55 29h1v1h-1zM16 30h2v1h-2zM56 30h1v2h-1zM18 31h1v8h-1zM34 31h1v2h-1zM35 32h2v1h-2zM55 32h1v3h-1zM36 33h1v1h-1zM27 35h1v4h-1zM53 35h2v1h-2zM28 36h2v1h-2zM51 36h2v1h-2zM30 37h2v1h-2zM45 37h6v1h-6zM17 38h1v1h-1zM28 38h1v1h-1zM32 38h2v1h-2zM46 38h2v1h-2zM15 39h2v1h-2zM29 39h2v1h-2zM34 39h2v1h-2zM48 39h1v1h-1zM14 40h1v4h-1zM31 40h1v4h-1zM36 40h1v8h-1zM49 40h1v4h-1zM15 44h2v1h-2zM29 44h2v1h-2zM45 44h1v4h-1zM47 44h2v1h-2zM17 45h2v1h-2zM27 45h2v1h-2zM46 45h1v1h-1zM19 46h2v1h-2zM25 46h2v1h-2zM21 47h4v1h-4zM35 47h1v1h-1zM46 47h1v1h-1zM33 48h2v1h-2zM47 48h2v1h-2zM32 49h1v4h-1zM49 49h1v4h-1zM33 53h2v1h-2zM47 53h2v1h-2zM35 54h2v1h-2zM45 54h2v1h-2zM37 55h2v1h-2zM43 55h2v1h-2zM39 56h4v1h-4z\"/><path fill=\"#575653\" d=\"M13 9h2v2h-2zM11 10h2v2h-2zM9 11h2v1h-2zM15 13h4v4h-4zM13 14h2v2h-2zM19 14h2v5h-2zM21 15h2v5h-2zM23 16h2v5h-2zM17 17h2v1h-2zM25 17h2v5h-2zM27 18h2v5h-2zM29 19h2v5h-2zM31 20h2v5h-2zM33 21h2v5h-2zM35 22h2v5h-2zM37 23h2v5h-2zM39 24h2v5h-2zM41 25h2v5h-2zM43 26h2v5h-2zM45 27h2v5h-2zM47 28h2v3h-2zM49 29h6v1h-6zM49 30h4v1h-4zM49 31h2v1h-2z\"/><path fill=\"#403e3c\" d=\"M8 12h1v2h-1zM9 13h2v5h-2zM11 16h2v3h-2zM13 17h2v3h-2zM15 18h2v3h-2zM17 19h2v3h-2zM19 20h2v3h-2zM21 21h2v3h-2zM23 22h2v3h-2zM25 23h2v3h-2zM27 24h2v3h-2zM29 25h2v3h-2zM31 26h2v3h-2zM33 27h2v3h-2zM35 28h2v3h-2zM37 29h2v3h-2zM39 30h2v3h-2zM41 31h2v3h-2zM43 32h2v3h-2zM47 32h2v5h-2zM45 33h2v3h-2zM49 33h1v2h-1z\"/><path fill=\"#a699d0\" d=\"M17 24h1v2h-1zM20 24h1v18h-1zM16 25h1v1h-1zM18 25h1v2h-1zM21 25h1v17h-1zM26 29h2v2h-2zM28 30h2v2h-2zM33 33h3v1h-3zM38 33h1v18h-1zM34 34h3v1h-3zM39 34h1v17h-1zM36 35h1v1h-1zM44 38h2v2h-2zM46 39h2v1h-2zM46 40h1v1h-1z\"/><path fill=\"#5e409d\" d=\"M24 26h1v4h-1zM25 27h2v2h-2zM25 29h1v1h-1zM32 30h1v4h-1zM33 31h1v2h-1zM24 34h2v8h-2zM26 35h1v6h-1zM42 35h1v4h-1zM43 36h2v2h-2zM43 38h1v1h-1zM47 41h2v3h-2zM46 42h1v3h-1zM42 43h2v8h-2zM44 44h1v6h-1z\"/><path fill=\"#6f6e69\" d=\"M15 10h2v1h-2zM13 11h2v1h-2zM9 12h4v1h-4zM11 15h2v1h-2zM13 16h2v1h-2zM15 17h2v1h-2zM17 18h2v1h-2zM19 19h2v1h-2zM21 20h2v1h-2zM23 21h2v1h-2zM25 22h2v1h-2zM27 23h2v1h-2zM29 24h2v1h-2zM31 25h2v1h-2zM33 26h2v1h-2zM35 27h2v1h-2zM37 28h2v1h-2zM39 29h2v1h-2zM41 30h2v1h-2zM53 30h2v1h-2zM43 31h2v1h-2zM47 31h2v1h-2zM51 31h2v1h-2zM45 32h2v1h-2zM49 32h2v1h-2z\"/><path fill=\"#b7b5ac\" d=\"M15 41h2v3h-2zM17 42h2v3h-2zM19 43h2v3h-2zM21 44h2v3h-2zM33 50h2v3h-2zM35 51h2v3h-2zM37 52h2v3h-2zM39 53h2v3h-2z\"/><path fill=\"#878580\" d=\"M29 41h2v3h-2zM27 42h2v3h-2zM25 43h2v3h-2zM23 44h2v3h-2zM47 50h2v3h-2zM45 51h2v3h-2zM43 52h2v3h-2zM41 53h2v3h-2z\"/><path fill=\"#343331\" d=\"M15 11h2v2h-2zM13 12h2v2h-2zM11 13h2v2h-2zM55 30h1v2h-1zM53 31h2v4h-2zM51 32h2v4h-2zM50 33h1v4h-1zM49 35h1v2h-1z\"/><path fill=\"#e6e4d9\" d=\"M15 40h2v1h-2zM29 40h2v1h-2zM17 41h2v1h-2zM27 41h2v1h-2zM19 42h2v1h-2zM25 42h2v1h-2zM21 43h4v1h-4zM33 49h2v1h-2zM47 49h2v1h-2zM35 50h2v1h-2zM45 50h2v1h-2zM37 51h2v1h-2zM43 51h2v1h-2zM39 52h4v1h-4z\"/><path fill=\"#cecdc3\" d=\"M17 39h2v2h-2zM27 39h2v2h-2zM19 41h1v1h-1zM26 41h1v1h-1zM21 42h4v1h-4zM35 48h2v2h-2zM45 48h2v2h-2zM37 50h1v1h-1zM44 50h1v1h-1zM39 51h4v1h-4z\"/><path fill=\"#000000\" fill-opacity=\"0.353\" d=\"M17 46h2v1h-2zM27 46h2v1h-2zM19 47h2v1h-2zM25 47h2v1h-2zM21 48h4v1h-4zM35 55h2v1h-2zM45 55h2v1h-2zM37 56h2v1h-2zM43 56h2v1h-2zM39 57h4v1h-4z\"/><path fill=\"#c4b9e0\" d=\"M15 25h1v1h-1zM16 26h2v1h-2zM18 27h1v1h-1zM24 30h2v1h-2zM26 31h2v1h-2zM28 32h2v1h-2zM30 33h1v1h-1zM32 34h2v1h-2zM34 35h2v1h-2zM36 36h1v1h-1zM42 39h2v1h-2zM44 40h2v1h-2zM47 40h2v1h-2zM46 41h1v1h-1z\"/></svg>\n";
+var icon_default = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 64 64\" shape-rendering=\"crispEdges\"><path fill=\"#000\" fill-opacity=\".18\" d=\"M12 38h1v1h-1zM27 38h1v1h-1zM10 39h3v1h-3zM27 39h3v1h-3zM8 40h4v1h-4zM28 40h4v1h-4zM10 41h4v1h-4zM26 41h4v1h-4zM12 42h4v1h-4zM24 42h4v1h-4zM14 43h4v1h-4zM22 43h4v1h-4zM16 44h8v1h-8zM18 45h4v1h-4zM36 50h1v1h-1zM51 50h1v1h-1zM34 51h3v1h-3zM51 51h3v1h-3zM32 52h4v1h-4zM52 52h4v1h-4zM34 53h4v1h-4zM50 53h4v1h-4zM36 54h4v1h-4zM48 54h4v1h-4zM38 55h4v1h-4zM46 55h4v1h-4zM40 56h8v1h-8zM42 57h4v1h-4z\"/><path fill=\"#000\" fill-opacity=\".38\" d=\"M12 40h2v1h-2zM26 40h2v1h-2zM14 41h1v1h-1zM25 41h1v1h-1zM16 42h1v1h-1zM23 42h1v1h-1zM18 43h1v1h-1zM21 43h1v1h-1zM36 52h2v1h-2zM50 52h2v1h-2zM38 53h1v1h-1zM49 53h1v1h-1zM40 54h1v1h-1zM47 54h1v1h-1zM42 55h1v1h-1zM45 55h1v1h-1z\"/><path fill=\"#1e1e2b\" d=\"M13 8h4v1h-4zM11 9h2v1h-2zM17 9h1v1h-1zM9 10h2v1h-2zM17 10h1v1h-1zM8 11h1v1h-1zM17 11h2v1h-2zM8 12h1v1h-1zM19 12h2v1h-2zM8 13h1v1h-1zM21 13h2v1h-2zM8 14h1v1h-1zM23 14h2v1h-2zM9 15h2v1h-2zM25 15h2v1h-2zM10 16h1v1h-1zM27 16h2v1h-2zM11 17h2v1h-2zM29 17h2v1h-2zM13 18h1v1h-1zM31 18h2v1h-2zM33 19h2v1h-2zM35 20h2v1h-2zM37 21h2v1h-2zM39 22h2v1h-2zM41 23h2v1h-2zM43 24h2v1h-2zM45 25h2v1h-2zM47 26h2v1h-2zM49 27h6v1h-6zM55 28h1v1h-1zM55 29h1v1h-1zM55 30h1v1h-1zM55 31h1v1h-1zM53 32h2v1h-2zM51 33h2v1h-2zM48 34h3v1h-3zM15 36h1v1h-1zM24 36h1v1h-1zM14 37h1v1h-1zM25 37h1v1h-1zM13 38h1v1h-1zM26 38h1v1h-1zM13 39h1v1h-1zM25 39h2v1h-2zM14 40h1v1h-1zM23 40h3v1h-3zM15 41h2v1h-2zM21 41h4v1h-4zM17 42h2v1h-2zM20 42h3v1h-3zM19 43h2v1h-2zM39 48h1v1h-1zM48 48h1v1h-1zM38 49h1v1h-1zM49 49h1v1h-1zM37 50h1v1h-1zM50 50h1v1h-1zM37 51h1v1h-1zM49 51h2v1h-2zM38 52h1v1h-1zM47 52h3v1h-3zM39 53h2v1h-2zM45 53h4v1h-4zM41 54h2v1h-2zM44 54h3v1h-3zM43 55h2v1h-2z\"/><path fill=\"#5b5b6c\" d=\"M13 9h2v1h-2zM11 10h2v1h-2zM10 12h1v1h-1zM15 12h4v1h-4zM10 13h1v1h-1zM13 13h8v1h-8zM13 14h10v1h-10zM15 15h10v1h-10zM17 16h10v1h-10zM19 17h10v1h-10zM21 18h10v1h-10zM23 19h10v1h-10zM25 20h10v1h-10zM27 21h10v1h-10zM29 22h10v1h-10zM31 23h10v1h-10zM33 24h10v1h-10zM35 25h10v1h-10zM37 26h10v1h-10zM39 27h10v1h-10zM41 28h12v1h-12zM43 29h8v1h-8zM45 30h2v1h-2zM48 31h1v1h-1zM48 32h1v1h-1zM48 33h1v1h-1zM15 37h1v1h-1zM24 37h1v1h-1zM19 41h1v1h-1zM39 49h1v1h-1zM48 49h1v1h-1zM43 53h1v1h-1z\"/><path fill=\"#6d6c79\" d=\"M15 9h2v1h-2zM13 10h2v1h-2zM9 11h4v1h-4zM11 14h2v1h-2zM13 15h2v1h-2zM15 16h2v1h-2zM17 17h2v1h-2zM19 18h2v1h-2zM21 19h2v1h-2zM23 20h2v1h-2zM25 21h2v1h-2zM27 22h2v1h-2zM29 23h2v1h-2zM31 24h2v1h-2zM33 25h2v1h-2zM35 26h2v1h-2zM37 27h2v1h-2zM39 28h2v1h-2zM53 28h2v1h-2zM41 29h2v1h-2zM51 29h2v1h-2zM43 30h2v1h-2zM47 30h4v1h-4zM45 31h2v1h-2zM15 38h2v1h-2zM23 38h2v1h-2zM17 39h2v1h-2zM21 39h2v1h-2zM19 40h2v1h-2zM39 50h2v1h-2zM47 50h2v1h-2zM41 51h2v1h-2zM45 51h2v1h-2zM43 52h2v1h-2z\"/><path fill=\"#242435\" d=\"M15 10h2v1h-2zM13 11h4v1h-4zM11 12h4v1h-4zM11 13h2v1h-2zM53 29h2v1h-2zM51 30h4v1h-4zM49 31h6v1h-6zM49 32h4v1h-4zM49 33h2v1h-2zM25 38h1v1h-1zM23 39h2v1h-2zM21 40h2v1h-2zM20 41h1v1h-1zM49 50h1v1h-1zM47 51h2v1h-2zM45 52h2v1h-2zM44 53h1v1h-1z\"/><path fill=\"#4A4A5E\" d=\"M9 12h1v1h-1zM9 13h1v1h-1zM9 14h2v1h-2zM11 15h2v1h-2zM11 16h4v1h-4zM13 17h4v1h-4zM15 18h4v1h-4zM17 19h4v1h-4zM19 20h4v1h-4zM21 21h4v1h-4zM23 22h4v1h-4zM25 23h4v1h-4zM27 24h4v1h-4zM29 25h4v1h-4zM31 26h4v1h-4zM33 27h4v1h-4zM35 28h4v1h-4zM37 29h4v1h-4zM39 30h4v1h-4zM41 31h4v1h-4zM47 31h1v1h-1zM43 32h5v1h-5zM45 33h3v1h-3zM14 38h1v1h-1zM15 39h2v1h-2zM17 40h2v1h-2zM38 50h1v1h-1zM39 51h2v1h-2zM41 52h2v1h-2z\"/><path fill=\"#D27E99\" d=\"M14 18h1v1h-1zM15 19h2v1h-2zM16 20h3v1h-3zM16 21h5v1h-5zM16 22h3v1h-3zM21 22h2v1h-2zM16 23h3v1h-3zM23 23h2v1h-2zM16 24h3v1h-3zM25 24h2v1h-2zM16 25h3v1h-3zM27 25h2v1h-2zM16 26h3v1h-3zM29 26h2v1h-2zM16 27h5v1h-5zM31 27h2v1h-2zM16 28h7v1h-7zM33 28h2v1h-2zM16 29h3v1h-3zM21 29h4v1h-4zM35 29h2v1h-2zM16 30h3v1h-3zM23 30h4v1h-4zM37 30h2v1h-2zM16 31h3v1h-3zM25 31h4v1h-4zM39 31h2v1h-2zM16 32h3v1h-3zM27 32h4v1h-4zM40 32h3v1h-3zM16 33h3v1h-3zM29 33h4v1h-4zM40 33h5v1h-5zM16 34h3v1h-3zM31 34h4v1h-4zM40 34h3v1h-3zM16 35h3v1h-3zM33 35h4v1h-4zM40 35h3v1h-3zM16 36h3v1h-3zM35 36h4v1h-4zM40 36h3v1h-3zM16 37h3v1h-3zM37 37h6v1h-6zM17 38h2v1h-2zM39 38h4v1h-4zM40 39h3v1h-3zM40 40h3v1h-3zM40 41h3v1h-3zM40 42h3v1h-3zM40 43h3v1h-3zM40 44h3v1h-3zM40 45h3v1h-3zM40 46h3v1h-3zM40 47h3v1h-3zM40 48h3v1h-3zM40 49h3v1h-3zM41 50h2v1h-2z\"/><path fill=\"#5f2c45\" d=\"M14 19h1v1h-1zM15 20h1v1h-1zM15 21h1v1h-1zM15 22h1v1h-1zM15 23h1v1h-1zM15 24h1v1h-1zM24 24h1v1h-1zM15 25h1v1h-1zM24 25h3v1h-3zM15 26h1v1h-1zM24 26h1v1h-1zM27 26h2v1h-2zM15 27h1v1h-1zM25 27h2v1h-2zM29 27h2v1h-2zM15 28h1v1h-1zM27 28h2v1h-2zM31 28h2v1h-2zM15 29h1v1h-1zM29 29h2v1h-2zM33 29h2v1h-2zM15 30h1v1h-1zM31 30h2v1h-2zM35 30h2v1h-2zM15 31h1v1h-1zM24 31h1v1h-1zM33 31h2v1h-2zM37 31h2v1h-2zM15 32h1v1h-1zM24 32h3v1h-3zM35 32h2v1h-2zM39 32h1v1h-1zM15 33h1v1h-1zM24 33h1v1h-1zM27 33h2v1h-2zM37 33h3v1h-3zM15 34h1v1h-1zM24 34h1v1h-1zM29 34h2v1h-2zM39 34h1v1h-1zM15 35h1v1h-1zM24 35h1v1h-1zM31 35h2v1h-2zM48 35h1v1h-1zM33 36h2v1h-2zM48 36h1v1h-1zM35 37h2v1h-2zM48 37h1v1h-1zM37 38h2v1h-2zM48 38h1v1h-1zM39 39h1v1h-1zM48 39h1v1h-1zM39 40h1v1h-1zM48 40h1v1h-1zM39 41h1v1h-1zM48 41h1v1h-1zM39 42h1v1h-1zM48 42h1v1h-1zM39 43h1v1h-1zM48 43h1v1h-1zM39 44h1v1h-1zM48 44h1v1h-1zM39 45h1v1h-1zM48 45h1v1h-1zM39 46h1v1h-1zM48 46h1v1h-1zM39 47h1v1h-1zM48 47h1v1h-1z\"/><path fill=\"#df95a9\" d=\"M19 22h1v1h-1zM19 23h1v1h-1zM19 24h1v1h-1zM19 25h1v1h-1zM19 26h1v1h-1zM21 26h2v1h-2zM21 27h4v1h-4zM23 28h4v1h-4zM19 29h1v1h-1zM25 29h4v1h-4zM19 30h1v1h-1zM27 30h4v1h-4zM19 31h1v1h-1zM29 31h4v1h-4zM19 32h1v1h-1zM31 32h4v1h-4zM19 33h1v1h-1zM33 33h4v1h-4zM19 34h1v1h-1zM35 34h4v1h-4zM43 34h1v1h-1zM45 34h1v1h-1zM19 35h1v1h-1zM37 35h3v1h-3zM43 35h1v1h-1zM19 36h1v1h-1zM39 36h1v1h-1zM43 36h1v1h-1zM19 37h1v1h-1zM43 37h1v1h-1zM19 38h1v1h-1zM43 38h1v1h-1zM19 39h1v1h-1zM43 39h1v1h-1zM43 40h1v1h-1zM43 41h1v1h-1zM43 42h1v1h-1zM43 43h1v1h-1zM43 44h1v1h-1zM43 45h1v1h-1zM43 46h1v1h-1zM43 47h1v1h-1zM43 48h1v1h-1zM43 49h1v1h-1zM43 50h1v1h-1zM43 51h1v1h-1z\"/><path fill=\"#9c5473\" d=\"M20 22h1v1h-1zM20 23h3v1h-3zM20 24h4v1h-4zM20 25h4v1h-4zM20 26h1v1h-1zM23 26h1v1h-1zM20 29h1v1h-1zM20 30h3v1h-3zM20 31h4v1h-4zM20 32h4v1h-4zM20 33h4v1h-4zM20 34h4v1h-4zM44 34h1v1h-1zM46 34h2v1h-2zM20 35h4v1h-4zM44 35h4v1h-4zM20 36h4v1h-4zM44 36h4v1h-4zM20 37h4v1h-4zM44 37h4v1h-4zM20 38h3v1h-3zM44 38h4v1h-4zM20 39h1v1h-1zM44 39h4v1h-4zM44 40h4v1h-4zM44 41h4v1h-4zM44 42h4v1h-4zM44 43h4v1h-4zM44 44h4v1h-4zM44 45h4v1h-4zM44 46h4v1h-4zM44 47h4v1h-4zM44 48h4v1h-4zM44 49h4v1h-4zM44 50h3v1h-3zM44 51h1v1h-1z\"/><path fill=\"#38384a\" d=\"M14 39h1v1h-1zM15 40h2v1h-2zM17 41h2v1h-2zM19 42h1v1h-1zM38 51h1v1h-1zM39 52h2v1h-2zM41 53h2v1h-2zM43 54h1v1h-1z\"/></svg>";
 // src/rpcs/contracts.ts
 var RpcContracts = class extends make$29(make$31("gateway.servers", {
 	error: AuthError,
@@ -143702,13 +144012,12 @@ runApp({
 	}), unwrap$7(gen(function* () {
 		const now = yield* currentTimeMillis;
 		return pipe$1(layerMcp({
-			handlers: ToolHandlers,
 			instructions: join$2([
 				"Gateway to the user's MCP servers; tools are named <server>__<tool>.",
 				...map$8(filter$5(yield* (yield* Connections).definitions, (server) => connectionStatus(server, now) === "Connected"), (server) => `${server.id}: ${summary(server)}`),
 				"If a tool is missing or failing, list_mcp_connections says why."
 			], "\n"),
-			tools: Tools
+			registrations: pipe$1(toolkit(Tools), provide$2(ToolHandlers))
 		}), provide$2(GatewayDiscovery.layer), provide$2(McpServer.layer));
 	}))), provide$2(layerServices)),
 	settings: { GITHUB_ADMINS: ADMINS }