@frankieai/server 0.2.0 → 0.2.2

package/dist/chunk-R5XGMQR4.js

@@ -1,1197 +0,0 @@
-// src/rate-limit.ts
-var MemoryRateLimiter = class {
-  hits = /* @__PURE__ */ new Map();
-  lastSweep = Date.now();
-  /**
-   * The longest window any caller has asked for. The sweep horizon has to cover
-   * it, or sweeping would discard hits the window still counts.
-   */
-  maxWindowMs = 0;
-  async take(key, limit, windowSeconds) {
-    const now = Date.now();
-    const windowMs = windowSeconds * 1e3;
-    if (windowMs > this.maxWindowMs) this.maxWindowMs = windowMs;
-    const cutoff = now - windowMs;
-    this.sweep(now);
-    const timestamps = (this.hits.get(key) ?? []).filter((t) => t > cutoff);
-    if (timestamps.length >= limit) {
-      this.hits.set(key, timestamps);
-      return false;
-    }
-    timestamps.push(now);
-    this.hits.set(key, timestamps);
-    return true;
-  }
-  /**
-   * Trim stale hits and drop empty buckets occasionally, so a long-lived process
-   * does not grow. The horizon tracks the longest window in use rather than a
-   * fixed hour: a shorter one would drop timestamps that window still counts,
-   * silently handing the caller a fresh budget mid-window.
-   */
-  sweep(now) {
-    if (now - this.lastSweep < 6e4) return;
-    this.lastSweep = now;
-    const horizon = now - this.maxWindowMs;
-    for (const [key, timestamps] of this.hits) {
-      const live = timestamps.filter((t) => t > horizon);
-      if (live.length === 0) this.hits.delete(key);
-      else this.hits.set(key, live);
-    }
-  }
-};
-
-// src/agent/models.ts
-import { builtinModels } from "@earendil-works/pi-ai/providers/all";
-import { hasApi } from "@earendil-works/pi-ai";
-var ModelResolutionError = class extends Error {
-};
-function resolveModel(config) {
-  const models = builtinModels();
-  const provider = models.getProvider(config.model.provider);
-  if (!provider) {
-    const known = models.getProviders().map((entry) => entry.id).sort().join(", ");
-    throw new ModelResolutionError(
-      `Unknown model provider "${config.model.provider}". Known providers: ${known}.`
-    );
-  }
-  const found = models.getModel(config.model.provider, config.model.model);
-  if (!found) {
-    throw new ModelResolutionError(
-      `Provider "${config.model.provider}" has no model "${config.model.model}". Available: ${provider.getModels().map((entry) => entry.id).slice(0, 10).join(", ")}\u2026`
-    );
-  }
-  const model = {
-    ...found,
-    ...config.model.baseUrl ? { baseUrl: config.model.baseUrl } : {},
-    maxTokens: Math.min(config.model.maxTokens, found.maxTokens)
-  };
-  return { models, model };
-}
-function resolveModelChoice(catalogue, config, requestedId) {
-  const choice = config.features.modelPicker.models.find((entry) => entry.id === requestedId);
-  const isDefault = requestedId === config.model.model;
-  if (!choice && !isDefault) return null;
-  const provider = choice?.provider ?? config.model.provider;
-  const found = catalogue.getModel(provider, requestedId);
-  if (!found) return null;
-  return {
-    ...found,
-    ...config.model.baseUrl ? { baseUrl: config.model.baseUrl } : {},
-    maxTokens: Math.min(config.model.maxTokens, found.maxTokens)
-  };
-}
-function modelHasApi(model, api) {
-  return hasApi(model, api);
-}
-
-// src/auth.ts
-import { createRemoteJWKSet, jwtVerify, SignJWT } from "jose";
-var AuthError = class extends Error {
-  constructor(message, code = "unauthorized") {
-    super(message);
-    this.code = code;
-  }
-  code;
-};
-var TokenService = class {
-  constructor(auth, secrets) {
-    this.auth = auth;
-    this.sessionKey = new TextEncoder().encode(secrets.sessionSecret);
-    this.userKey = secrets.jwtSecret ? new TextEncoder().encode(secrets.jwtSecret) : void 0;
-    if (!this.userKey && !auth.jwksUrl && !auth.allowAnonymous) {
-      throw new Error("Frankie auth needs either a JWT secret, a JWKS URL, or allowAnonymous.");
-    }
-  }
-  auth;
-  sessionKey;
-  userKey;
-  jwks;
-  /** Verify a host-signed user token. Throws `AuthError` on any failure. */
-  async verifyUserToken(token) {
-    const options = {
-      ...this.auth.jwtIssuer ? { issuer: this.auth.jwtIssuer } : {},
-      ...this.auth.jwtAudience ? { audience: this.auth.jwtAudience } : {},
-      clockTolerance: 30
-    };
-    let payload;
-    try {
-      if (this.auth.jwksUrl) {
-        this.jwks ??= createRemoteJWKSet(new URL(this.auth.jwksUrl));
-        ({ payload } = await jwtVerify(token, this.jwks, options));
-      } else if (this.userKey) {
-        ({ payload } = await jwtVerify(token, this.userKey, { ...options, algorithms: ["HS256"] }));
-      } else {
-        throw new AuthError("This tenant is not configured to accept user tokens.");
-      }
-    } catch (error) {
-      if (error instanceof AuthError) throw error;
-      throw new AuthError(`Could not verify the user token: ${error.message}`);
-    }
-    const subject = typeof payload.sub === "string" ? payload.sub : void 0;
-    if (!subject) throw new AuthError("The user token has no `sub` claim.");
-    return {
-      id: subject,
-      displayName: stringClaim(payload, "name") ?? stringClaim(payload, "preferred_username"),
-      email: stringClaim(payload, "email"),
-      anonymous: false,
-      claims: payload
-    };
-  }
-  /** Mint the bearer token the widget uses for the rest of the conversation. */
-  async issueSessionToken(input) {
-    const expiresAt = new Date(Date.now() + this.auth.sessionTtlSeconds * 1e3);
-    const token = await new SignJWT({
-      sid: input.sessionId,
-      uid: input.user.id,
-      anon: input.user.anonymous,
-      tid: input.tenantId
-    }).setProtectedHeader({ alg: "HS256", typ: "JWT" }).setIssuedAt().setIssuer("frankie").setAudience("frankie-widget").setExpirationTime(Math.floor(expiresAt.getTime() / 1e3)).sign(this.sessionKey);
-    return { token, expiresAt };
-  }
-  async verifySessionToken(token) {
-    try {
-      const { payload } = await jwtVerify(token, this.sessionKey, {
-        algorithms: ["HS256"],
-        issuer: "frankie",
-        audience: "frankie-widget"
-      });
-      const sessionId = stringClaim(payload, "sid");
-      const userId = stringClaim(payload, "uid");
-      const tenantId = stringClaim(payload, "tid");
-      if (!sessionId || !userId || !tenantId) throw new AuthError("Malformed session token.");
-      return { sessionId, userId, tenantId };
-    } catch (error) {
-      if (error instanceof AuthError) throw error;
-      throw new AuthError("Your chat session has expired. Reload the page to start a new one.");
-    }
-  }
-};
-function stringClaim(payload, key) {
-  const value = payload[key];
-  return typeof value === "string" ? value : void 0;
-}
-function isOriginAllowed(origin, allowed) {
-  if (allowed.length === 0) return origin === void 0;
-  if (!origin) return false;
-  return allowed.some((entry) => normaliseOrigin(entry) === normaliseOrigin(origin));
-}
-function normaliseOrigin(value) {
-  try {
-    const url = new URL(value);
-    return url.origin.toLowerCase();
-  } catch {
-    return value.trim().replace(/\/+$/, "").toLowerCase();
-  }
-}
-function safeEqual(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-function anonymousUser(seed) {
-  return { id: `anon_${seed}`, anonymous: true, claims: {} };
-}
-
-// src/agent/headers.ts
-function buildForwardedHeaders(source, session) {
-  const headers = { ...source.headers };
-  if (source.forwardUserTokenAs && session.userToken) {
-    headers[source.forwardUserTokenAs] = source.forwardUserTokenAs.toLowerCase() === "authorization" ? `Bearer ${session.userToken}` : session.userToken;
-  }
-  headers["x-frankie-user-id"] = session.user.id;
-  headers["x-frankie-session-id"] = session.id;
-  headers["x-frankie-tenant-id"] = session.tenantId;
-  for (const claim of source.forwardUserClaims) {
-    const value = session.user.claims[claim];
-    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-      headers[`x-frankie-${claim.toLowerCase()}`] = String(value);
-    }
-  }
-  return headers;
-}
-
-// src/agent/mcp.ts
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-
-// src/connector-fetch.ts
-import { lookup } from "dns/promises";
-import { isIP } from "net";
-import { request as httpsRequest } from "https";
-import { Readable, Transform } from "stream";
-function isPublicAddress(address) {
-  if (isIP(address) === 4) {
-    const [a, b] = address.split(".").map(Number);
-    return !(a === 0 || a === 10 || a === 127 || a >= 224 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && [0, 168].includes(b) || a === 198 && [18, 19, 51].includes(b) || a === 203 && b === 0);
-  }
-  if (isIP(address) !== 6) return false;
-  const first = Number.parseInt(address.split(":")[0], 16);
-  return first >= 8192 && first <= 16383 && first !== 8194 && !(first === 8193 && Number.parseInt(address.split(":")[1] || "0", 16) <= 511) && !address.toLowerCase().startsWith("2001:db8:") && !address.toLowerCase().startsWith("3fff:");
-}
-function assertConnectorUrl(value) {
-  const url = new URL(value);
-  if (url.protocol !== "https:" || url.username || url.password) throw new Error("Connectors require HTTPS URLs without embedded credentials.");
-  const host = url.hostname.replace(/^\[|\]$/g, "");
-  if (host === "localhost" || host.endsWith(".localhost") || host.endsWith(".local") || isIP(host) && !isPublicAddress(host)) {
-    throw new Error("Connectors cannot access local or private networks.");
-  }
-  return url;
-}
-async function resolvePublicHost(host, resolve2 = lookup) {
-  const addresses = await resolve2(host, { all: true, verbatim: true });
-  if (!addresses.length || addresses.some((entry) => !isPublicAddress(entry.address))) throw new Error("Connector DNS must resolve only to public addresses.");
-  return addresses[0];
-}
-var publicConnectorFetch = async (input, init) => {
-  const source = new Request(input, init);
-  const url = assertConnectorUrl(source.url);
-  const headers = Object.fromEntries(source.headers);
-  for (const key of ["host", "connection", "content-length", "transfer-encoding", "proxy-authorization", "upgrade"]) delete headers[key];
-  const outgoing = source.body ? await readLimited(source.body, 2e6) : void 0;
-  return new Promise((resolve2, reject) => {
-    const req = httpsRequest(url, {
-      method: source.method,
-      headers,
-      signal: source.signal,
-      lookup(host, options, callback) {
-        const done = callback;
-        void resolvePublicHost(host).then((entry) => options.all ? done(null, [entry]) : done(null, entry.address, entry.family), (error) => done(error));
-      }
-    }, (response) => {
-      const status = response.statusCode ?? 502;
-      if (status >= 300 && status < 400) {
-        response.destroy();
-        reject(new Error("Connector redirects are disabled. Configure the final HTTPS endpoint."));
-        return;
-      }
-      const responseHeaders = new Headers();
-      for (const [name, value] of Object.entries(response.headers)) if (value) responseHeaders.set(name, Array.isArray(value) ? value.join(", ") : value);
-      let bytes = 0;
-      const limit = new Transform({ transform(chunk, _encoding, done) {
-        bytes += chunk.length;
-        done(bytes > 8e6 ? new Error("Connector response exceeds the size limit.") : null, chunk);
-      } });
-      response.on("error", (error) => limit.destroy(error));
-      limit.on("error", () => response.destroy());
-      const body = [204, 205, 304].includes(status) || source.method === "HEAD" ? null : Readable.toWeb(response.pipe(limit));
-      if (!body) response.resume();
-      resolve2(new Response(body, { status, headers: responseHeaders }));
-    });
-    const timer = setTimeout(() => req.destroy(new Error("Connector request timed out.")), 6e4);
-    timer.unref();
-    req.on("close", () => clearTimeout(timer));
-    req.on("error", reject);
-    req.end(outgoing);
-  });
-};
-async function readLimited(stream, max) {
-  const reader = stream.getReader();
-  const chunks = [];
-  let bytes = 0;
-  try {
-    for (; ; ) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      bytes += value.length;
-      if (bytes > max) {
-        await reader.cancel();
-        throw new Error("Connector request exceeds the size limit.");
-      }
-      chunks.push(value);
-    }
-    return Buffer.concat(chunks);
-  } finally {
-    reader.releaseLock();
-  }
-}
-var trustedLocalConnectors = () => process.env["FRANKIE_TRUST_LOCAL_CONNECTORS"] === "true";
-var connectorFetch = (input, init) => trustedLocalConnectors() ? fetch(input, init) : publicConnectorFetch(input, init);
-
-// src/agent/mcp.ts
-import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { Type } from "@earendil-works/pi-ai";
-import { describeTool, evaluateToolPolicy } from "@frankieai/core";
-var MCP_TOOL_PREFIX = "mcp__";
-async function connectMcpTools(options) {
-  const clients = [];
-  const tools = [];
-  const failed = [];
-  const results = await Promise.all(
-    options.servers.filter((server) => server.enabled).map(async (server) => {
-      try {
-        return { server, client: await connectOne(server, options) };
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        options.onWarning?.("mcp_connect_failed", { server: server.name, error: message });
-        failed.push({ name: server.name, error: message });
-        return null;
-      }
-    })
-  );
-  for (const result of results) {
-    if (!result) continue;
-    clients.push(result.client);
-    try {
-      const listed = await withTimeout(result.client.listTools(), options.connectTimeoutMs ?? 1e4, "MCP tool discovery timed out.");
-      for (const tool of listed.tools) {
-        if (result.server.selectedTools && !result.server.selectedTools.includes(tool.name)) continue;
-        const name = `${MCP_TOOL_PREFIX}${result.server.name}__${tool.name}`;
-        if (!evaluateToolPolicy(name, options.policy).allowed) continue;
-        tools.push(adaptTool(name, tool, result.client, options.callTimeoutMs));
-      }
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      options.onWarning?.("mcp_list_tools_failed", { server: result.server.name, error: message });
-      failed.push({ name: result.server.name, error: message });
-    }
-  }
-  return {
-    tools,
-    failed,
-    async close() {
-      await Promise.all(clients.map((client) => client.close().catch(() => void 0)));
-    }
-  };
-}
-async function connectOne(server, options) {
-  const headers = buildForwardedHeaders(server, options.session);
-  const url = new URL(server.url);
-  const transport = server.transport === "sse" ? new SSEClientTransport(url, { requestInit: { headers }, fetch: connectorFetch, eventSourceInit: { fetch: connectorFetch } }) : new StreamableHTTPClientTransport(url, { requestInit: { headers }, fetch: connectorFetch });
-  const client = new Client({ name: "frankie", version: "0.1.0" }, { capabilities: {} });
-  try {
-    await withTimeout(
-      client.connect(transport),
-      options.connectTimeoutMs ?? 1e4,
-      `MCP server "${server.name}" did not complete the handshake in time.`
-    );
-  } catch (error) {
-    await client.close().catch(() => void 0);
-    throw error;
-  }
-  return client;
-}
-function adaptTool(name, tool, client, callTimeoutMs = 6e4) {
-  return {
-    name,
-    label: describeTool(name, {}),
-    description: tool.description ?? `The ${tool.name} tool.`,
-    // MCP gives us JSON Schema; `Type.Unsafe` passes it through untouched
-    // rather than round-tripping it into a typebox equivalent and losing
-    // whatever the server actually declared.
-    parameters: Type.Unsafe(normaliseSchema(tool.inputSchema)),
-    async execute(_toolCallId, params, signal) {
-      const response = await withTimeout(
-        client.callTool(
-          { name: tool.name, arguments: params ?? {} },
-          void 0,
-          signal ? { signal } : void 0
-        ),
-        callTimeoutMs,
-        `The ${tool.name} tool did not respond in time.`
-      );
-      const content = toAgentContent(response.content);
-      if (response.isError) {
-        throw new Error(textOf(content) || `The ${tool.name} tool reported an error.`);
-      }
-      return { content, details: response.structuredContent ?? null };
-    }
-  };
-}
-function normaliseSchema(schema) {
-  if (typeof schema !== "object" || schema === null || Array.isArray(schema)) {
-    return { type: "object", properties: {} };
-  }
-  const copy = { ...schema };
-  if (copy["type"] !== "object") copy["type"] = "object";
-  if (typeof copy["properties"] !== "object" || copy["properties"] === null) copy["properties"] = {};
-  return copy;
-}
-function toAgentContent(content) {
-  if (!Array.isArray(content)) return [{ type: "text", text: "" }];
-  const out = [];
-  for (const part of content) {
-    if (typeof part !== "object" || part === null) continue;
-    const block = part;
-    if (block["type"] === "text" && typeof block["text"] === "string") {
-      out.push({ type: "text", text: block["text"] });
-    } else if (block["type"] === "image" && typeof block["data"] === "string" && typeof block["mimeType"] === "string") {
-      out.push({ type: "image", data: block["data"], mimeType: block["mimeType"] });
-    } else if (block["type"] === "resource") {
-      const resource = block["resource"];
-      const text = typeof resource === "object" && resource !== null && typeof resource["text"] === "string" ? String(resource["text"]) : "[resource omitted]";
-      out.push({ type: "text", text });
-    }
-  }
-  return out.length > 0 ? out : [{ type: "text", text: "" }];
-}
-function textOf(content) {
-  return content.map((part) => part.type === "text" ? part.text : "").filter(Boolean).join("\n").trim();
-}
-async function withTimeout(promise, ms, message) {
-  let timer;
-  try {
-    return await Promise.race([
-      promise,
-      new Promise((_resolve, reject) => {
-        timer = setTimeout(() => reject(new Error(message)), ms);
-      })
-    ]);
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
-}
-
-// src/agent/openapi.ts
-import { readFile } from "fs/promises";
-import { Type as Type2 } from "@earendil-works/pi-ai";
-import { describeTool as describeTool2, evaluateToolPolicy as evaluateToolPolicy2 } from "@frankieai/core";
-import { parse as parseYaml } from "yaml";
-var API_TOOL_PREFIX = "api__";
-var OpenApiError = class extends Error {
-};
-async function inspectApiCapabilities(source, options = {}) {
-  const doc = await loadSpec(source.spec, options.fetchImpl);
-  const allowedMethods = new Set(source.methods);
-  const capabilities = [];
-  for (const [path, item] of Object.entries(doc.paths ?? {})) {
-    if (!isRecord(item)) continue;
-    if (source.includePaths.length > 0 && !source.includePaths.some((glob) => matchPath(glob, path))) continue;
-    for (const method of ["get", "post", "put", "patch", "delete"]) {
-      const operation = item[method];
-      if (!isRecord(operation)) continue;
-      const httpMethod = method.toUpperCase();
-      if (!allowedMethods.has(httpMethod)) continue;
-      const operationId = typeof operation["operationId"] === "string" ? operation["operationId"] : `${method}_${slug(path)}`;
-      if (source.operations.length > 0 && !source.operations.includes(operationId)) continue;
-      const toolName = `${API_TOOL_PREFIX}${source.name}__${sanitize(operationId)}`;
-      if (options.policy && !evaluateToolPolicy2(toolName, options.policy).allowed) continue;
-      const summary = typeof operation["summary"] === "string" ? operation["summary"] : void 0;
-      capabilities.push({ operationId, method: httpMethod, path, ...summary ? { summary } : {} });
-    }
-  }
-  return capabilities;
-}
-async function buildApiTools(options) {
-  const tools = [];
-  const failed = [];
-  for (const source of options.sources.filter((source2) => source2.enabled)) {
-    try {
-      tools.push(...await buildOne(source, options));
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error);
-      options.onWarning?.("api_spec_failed", { api: source.name, error: message });
-      failed.push({ name: source.name, error: message });
-    }
-  }
-  return { tools, failed };
-}
-async function buildOne(source, options) {
-  const doc = await loadSpec(source.spec, options.fetchImpl);
-  const baseUrl = (source.baseUrl ?? specBaseUrl(doc))?.replace(/\/+$/, "");
-  if (!baseUrl) {
-    throw new OpenApiError(
-      `API "${source.name}" needs a baseUrl: its spec declares no \`servers\` entry to fall back to.`
-    );
-  }
-  const headers = buildForwardedHeaders(source, options.session);
-  const doFetch = options.fetchImpl ?? connectorFetch;
-  const allowedMethods = new Set(source.methods);
-  const tools = [];
-  for (const [path, item] of Object.entries(doc.paths ?? {})) {
-    if (!isRecord(item)) continue;
-    if (source.includePaths.length > 0 && !source.includePaths.some((glob) => matchPath(glob, path))) continue;
-    for (const method of ["get", "post", "put", "patch", "delete"]) {
-      const operation = item[method];
-      if (!isRecord(operation)) continue;
-      if (!allowedMethods.has(method.toUpperCase())) continue;
-      const operationId = typeof operation["operationId"] === "string" ? operation["operationId"] : `${method}_${slug(path)}`;
-      if (source.operations.length > 0 && !source.operations.includes(operationId)) continue;
-      if (source.selectedTools && !source.selectedTools.includes(operationId)) continue;
-      const name = `${API_TOOL_PREFIX}${source.name}__${sanitize(operationId)}`;
-      if (!evaluateToolPolicy2(name, options.policy).allowed) continue;
-      const params = collectParameters(doc, item, operation);
-      const body = collectRequestBody(doc, operation);
-      tools.push({
-        name,
-        label: describeTool2(name, {}),
-        description: describeOperation(operation, method, path),
-        parameters: Type2.Unsafe(toolSchema(params, body)),
-        async execute(_id, args, signal) {
-          const input = isRecord(args) ? args : {};
-          const url = buildUrl(baseUrl, path, params, input);
-          const requestBody = body ? input["body"] : void 0;
-          const response = await doFetch(url, {
-            method: method.toUpperCase(),
-            headers: {
-              ...headers,
-              accept: "application/json, text/plain;q=0.9, */*;q=0.8",
-              ...requestBody !== void 0 ? { "content-type": "application/json" } : {}
-            },
-            ...requestBody !== void 0 ? { body: JSON.stringify(requestBody) } : {},
-            signal: signal ?? AbortSignal.timeout(source.timeoutMs)
-          });
-          const text = truncate(await response.text().catch(() => ""), source.maxResponseChars);
-          if (!response.ok) {
-            throw new Error(`${operationId} failed with HTTP ${response.status}: ${truncate(text, 400)}`);
-          }
-          return { content: [{ type: "text", text: text || "(empty response)" }], details: null };
-        }
-      });
-    }
-  }
-  if (tools.length === 0) {
-    options.onWarning?.("api_no_tools", { api: source.name, baseUrl });
-  }
-  return tools;
-}
-async function loadSpec(spec, fetchImpl) {
-  let raw;
-  if (spec.trimStart().startsWith("{")) {
-    raw = spec;
-  } else if (/^https?:\/\//i.test(spec)) {
-    const response = await (fetchImpl ?? connectorFetch)(spec, {
-      headers: { accept: "application/json, text/yaml, */*" }
-    });
-    if (!response.ok) throw new OpenApiError(`Could not fetch ${spec}: HTTP ${response.status}.`);
-    raw = await response.text();
-  } else {
-    if (!trustedLocalConnectors()) throw new OpenApiError("Local OpenAPI files are disabled. Paste JSON or use a public HTTPS document.");
-    raw = await readFile(spec, "utf8").catch(() => {
-      throw new OpenApiError(`Could not read the OpenAPI document at ${spec}.`);
-    });
-  }
-  try {
-    const parsed = raw.trimStart().startsWith("{") ? JSON.parse(raw) : parseYaml(raw);
-    if (!isRecord(parsed)) throw new Error("the document is not an object");
-    return parsed;
-  } catch (error) {
-    throw new OpenApiError(`Could not parse the OpenAPI document at ${spec}: ${error.message}`);
-  }
-}
-function specBaseUrl(doc) {
-  const url = doc.servers?.[0]?.url;
-  return typeof url === "string" && /^https?:\/\//i.test(url) ? url : void 0;
-}
-function collectParameters(doc, item, operation) {
-  const raw = [...asArray(item["parameters"]), ...asArray(operation["parameters"])];
-  const params = [];
-  for (const entry of raw) {
-    const resolved = resolveRef(doc, entry);
-    if (!isRecord(resolved)) continue;
-    const name = resolved["name"];
-    const location = resolved["in"];
-    if (typeof name !== "string") continue;
-    if (location !== "path" && location !== "query") continue;
-    const schema = resolveRef(doc, resolved["schema"]);
-    params.push({
-      name,
-      location,
-      required: resolved["required"] === true || location === "path",
-      schema: isRecord(schema) ? schema : { type: "string" },
-      ...typeof resolved["description"] === "string" ? { description: resolved["description"] } : {}
-    });
-  }
-  return params;
-}
-function collectRequestBody(doc, operation) {
-  const body = resolveRef(doc, operation["requestBody"]);
-  if (!isRecord(body)) return void 0;
-  const content = body["content"];
-  if (!isRecord(content)) return void 0;
-  const json = content["application/json"];
-  if (!isRecord(json)) return void 0;
-  const schema = resolveRef(doc, json["schema"]);
-  return isRecord(schema) ? schema : void 0;
-}
-function toolSchema(params, body) {
-  const properties = {};
-  const required = [];
-  for (const param of params) {
-    properties[param.name] = param.description ? { ...param.schema, description: param.description } : param.schema;
-    if (param.required) required.push(param.name);
-  }
-  if (body) {
-    properties["body"] = body;
-    required.push("body");
-  }
-  return {
-    type: "object",
-    properties,
-    ...required.length ? { required } : {},
-    additionalProperties: false
-  };
-}
-function buildUrl(baseUrl, path, params, input) {
-  let resolved = path;
-  for (const param of params) {
-    if (param.location !== "path") continue;
-    const value = input[param.name];
-    resolved = resolved.replace(`{${param.name}}`, encodeURIComponent(String(value ?? "")));
-  }
-  const url = new URL(`${baseUrl}${resolved.startsWith("/") ? "" : "/"}${resolved}`);
-  for (const param of params) {
-    if (param.location !== "query") continue;
-    const value = input[param.name];
-    if (value === void 0 || value === null) continue;
-    if (Array.isArray(value)) {
-      for (const entry of value) url.searchParams.append(param.name, String(entry));
-    } else {
-      url.searchParams.set(param.name, String(value));
-    }
-  }
-  return url.toString();
-}
-function describeOperation(operation, method, path) {
-  const summary = typeof operation["summary"] === "string" ? operation["summary"] : "";
-  const description = typeof operation["description"] === "string" ? operation["description"] : "";
-  const text = [summary, description].filter(Boolean).join(" - ");
-  return text || `${method.toUpperCase()} ${path}`;
-}
-function resolveRef(doc, node, depth = 0) {
-  if (!isRecord(node) || depth > 10) return node;
-  const ref = node["$ref"];
-  if (typeof ref !== "string" || !ref.startsWith("#/")) return node;
-  let current = doc;
-  for (const segment of ref.slice(2).split("/")) {
-    if (!isRecord(current)) return void 0;
-    current = current[segment.replace(/~1/g, "/").replace(/~0/g, "~")];
-  }
-  return resolveRef(doc, current, depth + 1);
-}
-function matchPath(glob, path) {
-  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-  const trailingDeep = escaped.endsWith("/**");
-  const body = trailingDeep ? escaped.slice(0, -3) : escaped;
-  const pattern = body.split("**").map((chunk) => chunk.replace(/\*/g, "[^/]*")).join(".*") + (trailingDeep ? "(?:/.*)?" : "");
-  return new RegExp(`^${pattern}$`).test(path);
-}
-function sanitize(value) {
-  return value.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 48);
-}
-function slug(path) {
-  return path.replace(/[{}]/g, "").replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_|_$/g, "");
-}
-function truncate(value, max) {
-  return value.length <= max ? value : `${value.slice(0, max)}
-[truncated]`;
-}
-function asArray(value) {
-  return Array.isArray(value) ? value : [];
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// src/control/store.ts
-import { mkdir, readFile as readFile2, readdir, rm, writeFile } from "fs/promises";
-import { join, resolve } from "path";
-import { parseFrankieConfig } from "@frankieai/core";
-var MEMBERS_FILE = "__members.json";
-function toPublicTenant(record) {
-  const { config } = record;
-  return {
-    skillHistory: record.skillHistory ?? [],
-    skills: config.skills,
-    id: record.id,
-    ...record.ownerId ? { ownerId: record.ownerId } : {},
-    name: config.branding.name,
-    publishableKey: config.auth.publishableKey,
-    allowedOrigins: config.auth.allowedOrigins,
-    allowAnonymous: config.auth.allowAnonymous,
-    connection: config.apis.length > 0 ? "openapi" : config.mcpServers.length > 0 ? "mcp" : "knowledge",
-    mcpServers: config.mcpServers.map((s) => s.name),
-    apis: config.apis.map((a) => a.name),
-    connections: [
-      ...config.mcpServers.map((s) => ({
-        kind: "mcp",
-        name: s.name,
-        url: s.url,
-        discoveredTools: s.discoveredTools,
-        ...s.selectedTools ? { selectedTools: s.selectedTools } : {},
-        forwardsToken: Boolean(s.forwardUserTokenAs),
-        enabled: s.enabled && config.agent.tools.allow.some((entry) => entry === `mcp__${s.name}` || entry.startsWith(`mcp__${s.name}__`)),
-        status: "configured"
-      })),
-      ...config.apis.map((a) => ({
-        kind: "openapi",
-        name: a.name,
-        spec: a.spec,
-        ...a.baseUrl ? { baseUrl: a.baseUrl } : {},
-        methods: a.methods,
-        ...a.selectedTools ? { selectedTools: a.selectedTools } : {},
-        exposeAsMcp: a.exposeAsMcp,
-        capabilities: a.capabilities.map((capability) => ({ ...capability })),
-        forwardsToken: Boolean(a.forwardUserTokenAs),
-        enabled: a.enabled && config.agent.tools.allow.some((entry) => entry === `api__${a.name}` || entry.startsWith(`api__${a.name}__`)),
-        status: a.capabilities.length ? "ready" : "needs_attention"
-      }))
-    ],
-    locked: record.locked ?? false,
-    ...record.repositoryInstall ? { repositoryInstall: record.repositoryInstall } : {},
-    theme: config.theme,
-    features: config.features,
-    createdAt: record.createdAt,
-    updatedAt: record.updatedAt
-  };
-}
-var FileTenantStore = class _FileTenantStore {
-  dir;
-  providerKeyEnv;
-  env;
-  index = /* @__PURE__ */ new Map();
-  // by publishable key
-  byId = /* @__PURE__ */ new Map();
-  members = /* @__PURE__ */ new Map();
-  // by `${org}\n${login}`
-  loaded = false;
-  static memberKey(org, login) {
-    return `${org}
-${login.toLowerCase()}`;
-  }
-  constructor(options) {
-    this.dir = resolve(options.dir);
-    this.providerKeyEnv = options.providerKeyEnv ?? "FIREWORKS_API_KEY";
-    this.env = options.env ?? process.env;
-  }
-  async load() {
-    if (this.loaded) return;
-    await mkdir(this.dir, { recursive: true });
-    const files = await readdir(this.dir).catch(() => []);
-    for (const file of files) {
-      if (!file.endsWith(".json")) continue;
-      if (file === MEMBERS_FILE) continue;
-      try {
-        const record = JSON.parse(await readFile2(join(this.dir, file), "utf8"));
-        record.config = parseFrankieConfig(record.config);
-        this.remember(record);
-      } catch {
-      }
-    }
-    try {
-      const raw = await readFile2(join(this.dir, MEMBERS_FILE), "utf8");
-      for (const member of JSON.parse(raw)) {
-        this.members.set(_FileTenantStore.memberKey(member.org, member.login), member);
-      }
-    } catch {
-    }
-    this.loaded = true;
-  }
-  async persistMembers() {
-    await mkdir(this.dir, { recursive: true });
-    await writeFile(join(this.dir, MEMBERS_FILE), JSON.stringify([...this.members.values()], null, 2), "utf8");
-  }
-  async listMembers(org) {
-    await this.load();
-    return [...this.members.values()].filter((m) => m.org === org).sort((a, b) => a.login.localeCompare(b.login));
-  }
-  async putMember(member) {
-    await this.load();
-    this.members.set(_FileTenantStore.memberKey(member.org, member.login), { ...member, login: member.login.toLowerCase() });
-    await this.persistMembers();
-  }
-  async deleteMember(org, login) {
-    await this.load();
-    if (this.members.delete(_FileTenantStore.memberKey(org, login))) await this.persistMembers();
-  }
-  async membershipsForLogin(login) {
-    await this.load();
-    const lower = login.toLowerCase();
-    return [...this.members.values()].filter((m) => m.login === lower);
-  }
-  remember(record) {
-    this.byId.set(record.id, record);
-    this.index.set(record.config.auth.publishableKey, record);
-  }
-  async byPublishableKey(key) {
-    await this.load();
-    const record = this.index.get(key);
-    if (!record) return null;
-    const providerApiKey = this.env[record.config.model.apiKeyEnv] ?? this.env[this.providerKeyEnv];
-    if (!providerApiKey) return null;
-    return {
-      config: record.config,
-      secrets: {
-        ...record.jwtSecret ? { jwtSecret: record.jwtSecret } : {},
-        sessionSecret: record.sessionSecret,
-        providerApiKey
-      }
-    };
-  }
-  /** All tenants, or — when an owner is given — only that owner's. */
-  async list(ownerId) {
-    await this.load();
-    return [...this.byId.values()].filter((record) => ownerId === void 0 || record.ownerId === ownerId).sort((a, b) => a.createdAt.localeCompare(b.createdAt));
-  }
-  async get(id) {
-    await this.load();
-    return this.byId.get(id) ?? null;
-  }
-  async put(record) {
-    await this.load();
-    const existing = this.index.get(record.config.auth.publishableKey);
-    if (existing && existing.id !== record.id) {
-      throw new Error(`Publishable key already belongs to tenant "${existing.id}".`);
-    }
-    this.remember(record);
-    await mkdir(this.dir, { recursive: true });
-    await writeFile(join(this.dir, `${record.id}.json`), JSON.stringify(record, null, 2), "utf8");
-  }
-  async compareAndSwap(previous, next) {
-    await this.load();
-    if (this.byId.get(previous.id) !== previous) return false;
-    this.remember(next);
-    await mkdir(this.dir, { recursive: true });
-    await writeFile(join(this.dir, `${next.id}.json`), JSON.stringify(next, null, 2), "utf8");
-    return true;
-  }
-  async delete(id) {
-    await this.load();
-    const record = this.byId.get(id);
-    if (!record) return;
-    this.byId.delete(id);
-    this.index.delete(record.config.auth.publishableKey);
-    await rm(join(this.dir, `${id}.json`), { force: true });
-  }
-};
-
-// src/control/postgres-store.ts
-import { parseFrankieConfig as parseFrankieConfig2 } from "@frankieai/core";
-var PostgresTenantStore = class {
-  snapshots = /* @__PURE__ */ new WeakMap();
-  db;
-  providerKeyEnv;
-  env;
-  ready;
-  constructor(options) {
-    this.db = options.db;
-    this.providerKeyEnv = options.providerKeyEnv ?? "FIREWORKS_API_KEY";
-    this.env = options.env ?? process.env;
-  }
-  /**
-   * Create the table on first use, once. Lazy so the server can start listening
-   * before the database is reachable — a failed connection then surfaces on a
-   * request (logged, a 502) instead of crashing boot on Cloud Run.
-   */
-  ensureReady() {
-    return this.ready ??= this.init();
-  }
-  /** Create the table if it isn't there yet. Safe to call repeatedly. */
-  async init() {
-    await this.db.query(
-      `CREATE TABLE IF NOT EXISTS frankie_tenants (
-         id text PRIMARY KEY,
-         owner_id text,
-         publishable_key text NOT NULL UNIQUE,
-         record text NOT NULL,
-         created_at text NOT NULL,
-         updated_at text NOT NULL
-       )`
-    );
-    await this.db.query(`CREATE INDEX IF NOT EXISTS frankie_tenants_owner ON frankie_tenants (owner_id)`);
-    await this.db.query(
-      `CREATE TABLE IF NOT EXISTS frankie_org_members (
-         org text NOT NULL,
-         login text NOT NULL,
-         role text NOT NULL,
-         invited_by text,
-         created_at text NOT NULL,
-         PRIMARY KEY (org, login)
-       )`
-    );
-    await this.db.query(`CREATE INDEX IF NOT EXISTS frankie_org_members_login ON frankie_org_members (login)`);
-  }
-  memberRow(row) {
-    return {
-      org: String(row.org),
-      login: String(row.login),
-      role: row.role === "admin" ? "admin" : "member",
-      ...row.invited_by ? { invitedBy: String(row.invited_by) } : {},
-      createdAt: String(row.created_at)
-    };
-  }
-  async listMembers(org) {
-    await this.ensureReady();
-    const { rows } = await this.db.query(
-      `SELECT * FROM frankie_org_members WHERE org = $1 ORDER BY login ASC`,
-      [org]
-    );
-    return rows.map((row) => this.memberRow(row));
-  }
-  async putMember(member) {
-    await this.ensureReady();
-    await this.db.query(
-      `INSERT INTO frankie_org_members (org, login, role, invited_by, created_at)
-       VALUES ($1, $2, $3, $4, $5)
-       ON CONFLICT (org, login) DO UPDATE SET role = EXCLUDED.role`,
-      [member.org, member.login.toLowerCase(), member.role, member.invitedBy ?? null, member.createdAt]
-    );
-  }
-  async deleteMember(org, login) {
-    await this.ensureReady();
-    await this.db.query(`DELETE FROM frankie_org_members WHERE org = $1 AND login = $2`, [org, login.toLowerCase()]);
-  }
-  async membershipsForLogin(login) {
-    await this.ensureReady();
-    const { rows } = await this.db.query(`SELECT * FROM frankie_org_members WHERE login = $1`, [login.toLowerCase()]);
-    return rows.map((row) => this.memberRow(row));
-  }
-  parse(row) {
-    const record = JSON.parse(String(row.record));
-    this.snapshots.set(record, String(row.record));
-    record.config = parseFrankieConfig2(record.config);
-    return record;
-  }
-  async byPublishableKey(key) {
-    await this.ensureReady();
-    const { rows } = await this.db.query(`SELECT record FROM frankie_tenants WHERE publishable_key = $1`, [key]);
-    if (rows.length === 0 || !rows[0]) return null;
-    const record = this.parse(rows[0]);
-    const providerApiKey = this.env[record.config.model.apiKeyEnv] ?? this.env[this.providerKeyEnv];
-    if (!providerApiKey) return null;
-    return {
-      config: record.config,
-      secrets: {
-        ...record.jwtSecret ? { jwtSecret: record.jwtSecret } : {},
-        sessionSecret: record.sessionSecret,
-        providerApiKey
-      }
-    };
-  }
-  async list(ownerId) {
-    await this.ensureReady();
-    const { rows } = await this.db.query(
-      `SELECT record FROM frankie_tenants
-       WHERE $1::text IS NULL OR owner_id = $1
-       ORDER BY created_at ASC`,
-      [ownerId ?? null]
-    );
-    return rows.map((row) => this.parse(row));
-  }
-  async get(id) {
-    await this.ensureReady();
-    const { rows } = await this.db.query(`SELECT record FROM frankie_tenants WHERE id = $1`, [id]);
-    return rows.length && rows[0] ? this.parse(rows[0]) : null;
-  }
-  async put(record) {
-    await this.ensureReady();
-    const key = record.config.auth.publishableKey;
-    const clash = await this.db.query(`SELECT id FROM frankie_tenants WHERE publishable_key = $1 AND id <> $2`, [
-      key,
-      record.id
-    ]);
-    if (clash.rows.length > 0) {
-      throw new Error(`Publishable key already belongs to tenant "${String(clash.rows[0]?.id)}".`);
-    }
-    await this.db.query(
-      `INSERT INTO frankie_tenants (id, owner_id, publishable_key, record, created_at, updated_at)
-       VALUES ($1, $2, $3, $4, $5, $6)
-       ON CONFLICT (id) DO UPDATE SET
-         owner_id = EXCLUDED.owner_id,
-         publishable_key = EXCLUDED.publishable_key,
-         record = EXCLUDED.record,
-         updated_at = EXCLUDED.updated_at`,
-      [record.id, record.ownerId ?? null, key, JSON.stringify(record), record.createdAt, record.updatedAt]
-    );
-  }
-  async delete(id) {
-    await this.ensureReady();
-    await this.db.query(`DELETE FROM frankie_tenants WHERE id = $1`, [id]);
-  }
-  async compareAndSwap(previous, next) {
-    await this.ensureReady();
-    const snapshot = this.snapshots.get(previous);
-    if (!snapshot || next.id !== previous.id || next.config.auth.publishableKey !== previous.config.auth.publishableKey) return false;
-    const { rows } = await this.db.query("UPDATE frankie_tenants SET record = $1, updated_at = $2 WHERE id = $3 AND record = $4 RETURNING id", [JSON.stringify(next), next.updatedAt, previous.id, snapshot]);
-    return rows.length === 1;
-  }
-};
-
-// src/sessions.ts
-import { randomUUID } from "crypto";
-var MemorySessionStore = class {
-  constructor(ttlMs = 6 * 60 * 60 * 1e3) {
-    this.ttlMs = ttlMs;
-  }
-  ttlMs;
-  sessions = /* @__PURE__ */ new Map();
-  async create(session) {
-    this.evictExpired();
-    this.sessions.set(session.id, session);
-  }
-  async get(id) {
-    const session = this.sessions.get(id);
-    if (!session) return void 0;
-    if (Date.now() - session.lastActiveAt > this.ttlMs) {
-      this.sessions.delete(id);
-      return void 0;
-    }
-    return session;
-  }
-  async listByUser(tenantId, userId) {
-    this.evictExpired();
-    return [...this.sessions.values()].filter((session) => session.tenantId === tenantId && session.user.id === userId).sort((a, b) => b.lastActiveAt - a.lastActiveAt);
-  }
-  async listByTenant(tenantId) {
-    this.evictExpired();
-    return [...this.sessions.values()].filter((session) => session.tenantId === tenantId).sort((a, b) => b.lastActiveAt - a.lastActiveAt);
-  }
-  async update(id, patch) {
-    const session = this.sessions.get(id);
-    if (!session) return;
-    this.sessions.set(id, { ...session, ...patch, lastActiveAt: Date.now() });
-  }
-  async delete(id) {
-    this.sessions.delete(id);
-  }
-  evictExpired() {
-    const cutoff = Date.now() - this.ttlMs;
-    for (const [id, session] of this.sessions) if (session.lastActiveAt < cutoff) this.sessions.delete(id);
-  }
-};
-function newSessionId() {
-  return randomUUID();
-}
-
-// src/postgres-sessions.ts
-var PostgresSessionStore = class {
-  db;
-  ttlMs;
-  ready;
-  constructor(options) {
-    this.db = options.db;
-    this.ttlMs = options.ttlMs ?? 90 * 24 * 60 * 60 * 1e3;
-  }
-  ensureReady() {
-    return this.ready ??= this.init();
-  }
-  async init() {
-    await this.db.query(
-      `CREATE TABLE IF NOT EXISTS frankie_sessions (
-         id text PRIMARY KEY,
-         data text NOT NULL,
-         last_active bigint NOT NULL
-       )`
-    );
-  }
-  async create(session) {
-    await this.ensureReady();
-    await this.db.query(
-      `INSERT INTO frankie_sessions (id, data, last_active) VALUES ($1, $2, $3)
-       ON CONFLICT (id) DO UPDATE SET data = EXCLUDED.data, last_active = EXCLUDED.last_active`,
-      [session.id, JSON.stringify(session), session.lastActiveAt]
-    );
-  }
-  async get(id) {
-    await this.ensureReady();
-    const { rows } = await this.db.query(`SELECT data, last_active FROM frankie_sessions WHERE id = $1`, [id]);
-    if (rows.length === 0 || !rows[0]) return void 0;
-    if (Date.now() - Number(rows[0].last_active) > this.ttlMs) {
-      await this.delete(id);
-      return void 0;
-    }
-    return JSON.parse(String(rows[0].data));
-  }
-  async listByUser(tenantId, userId) {
-    await this.ensureReady();
-    const { rows } = await this.db.query(`SELECT data, last_active FROM frankie_sessions ORDER BY last_active DESC`);
-    const sessions = [];
-    for (const row of rows) {
-      if (Date.now() - Number(row.last_active) > this.ttlMs) continue;
-      const session = JSON.parse(String(row.data));
-      if (session.tenantId === tenantId && session.user.id === userId) sessions.push(session);
-    }
-    return sessions;
-  }
-  async listByTenant(tenantId) {
-    await this.ensureReady();
-    const { rows } = await this.db.query(`SELECT data, last_active FROM frankie_sessions ORDER BY last_active DESC`);
-    const sessions = [];
-    for (const row of rows) {
-      if (Date.now() - Number(row.last_active) > this.ttlMs) continue;
-      const session = JSON.parse(String(row.data));
-      if (session.tenantId === tenantId) sessions.push(session);
-    }
-    return sessions;
-  }
-  async update(id, patch) {
-    const existing = await this.get(id);
-    if (!existing) return;
-    const next = { ...existing, ...patch, lastActiveAt: Date.now() };
-    await this.db.query(`UPDATE frankie_sessions SET data = $2, last_active = $3 WHERE id = $1`, [
-      id,
-      JSON.stringify(next),
-      next.lastActiveAt
-    ]);
-  }
-  async delete(id) {
-    await this.ensureReady();
-    await this.db.query(`DELETE FROM frankie_sessions WHERE id = $1`, [id]);
-  }
-};
-
-// src/control/resolve-store.ts
-async function resolveStores(env = process.env) {
-  const url = env["DATABASE_URL"];
-  if (url) {
-    const { Pool } = await import("pg");
-    const pool = new Pool({
-      connectionString: url,
-      max: 4,
-      ...env["DATABASE_SSL"] === "disable" ? {} : { ssl: { rejectUnauthorized: false } }
-    });
-    const tenants = new PostgresTenantStore({ db: pool, env });
-    const sessions = new PostgresSessionStore({ db: pool });
-    return { tenants, sessions, describe: "postgres" };
-  }
-  const dir = env["FRANKIE_TENANTS_DIR"] ?? "./.frankie/tenants";
-  return { tenants: new FileTenantStore({ dir, env }), sessions: new MemorySessionStore(), describe: `files:${dir}` };
-}
-async function resolveTenantStore(env = process.env) {
-  const url = env["DATABASE_URL"];
-  if (url) {
-    const { Pool } = await import("pg");
-    const pool = new Pool({
-      connectionString: url,
-      // Managed Postgres (Neon, Supabase, Cloud SQL over the proxy) expects TLS;
-      // opt out only for a local database via DATABASE_SSL=disable.
-      ...env["DATABASE_SSL"] === "disable" ? {} : { ssl: { rejectUnauthorized: false } }
-    });
-    const store = new PostgresTenantStore({ db: pool, env });
-    return { store, describe: "postgres" };
-  }
-  const dir = env["FRANKIE_TENANTS_DIR"] ?? "./.frankie/tenants";
-  return { store: new FileTenantStore({ dir, env }), describe: `files:${dir}` };
-}
-
-export {
-  connectorFetch,
-  MemoryRateLimiter,
-  ModelResolutionError,
-  resolveModel,
-  resolveModelChoice,
-  modelHasApi,
-  AuthError,
-  TokenService,
-  isOriginAllowed,
-  safeEqual,
-  anonymousUser,
-  buildForwardedHeaders,
-  MCP_TOOL_PREFIX,
-  connectMcpTools,
-  API_TOOL_PREFIX,
-  OpenApiError,
-  inspectApiCapabilities,
-  buildApiTools,
-  loadSpec,
-  matchPath,
-  toPublicTenant,
-  FileTenantStore,
-  PostgresTenantStore,
-  MemorySessionStore,
-  newSessionId,
-  PostgresSessionStore,
-  resolveStores,
-  resolveTenantStore
-};
-//# sourceMappingURL=chunk-R5XGMQR4.js.map