gemi 0.113.0 → 0.114.0

package/dist/http/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{Bc as C,Cc as D,Dc as E,Ec as F,Fc as G,Gc as H,Hc as I,Mc as J,Nc as K,Nd as M,Oc as L,fe as N,ge as O,he as P,ie as Q,je as R,ke as S,le as T,me as U,ne as V,oe as W,pe as X,qe as Y,rc as n,re as Z,sc as o,se as _,tc as p,te as $,uc as q,ue as aa,vc as r,ve as ba,wc as y,we as ca,xc as z,xe as da,yc as A,ye as ea,zc as B,ze as fa}from"../chunk-6g20zec2.js";import"../chunk-qpttgn4k.js";import"../chunk-w45agtch.js";import{$f as w,Bf as a,Cf as b,Df as d,Hf as e,If as f,Jf as g,Kf as h,Lf as i,Mf as j,Rf as k,Sf as l,Wf as m,Xf as s,Yf as t,Zf as u,_f as v,ag as x}from"../chunk-cqnfp0n9.js";import{tg as c}from"../chunk-r7b12dmm.js";import"../chunk-y596ghpz.js";import"../chunk-c7mp2kyp.js";import"../chunk-y6v0x869.js";import"../chunk-4t1pbt9p.js";import"../chunk-vwprq300.js";import"../chunk-9tpx9ag3.js";import"../chunk-nysqgzp1.js";import"../chunk-z5hrymvn.js";import"../chunk-v4gwmhtf.js";import"../chunk-vc9phr57.js";import"../chunk-fr0arqdj.js";import"../chunk-fnkjmq94.js";import"../chunk-8mbyyh8j.js";export{g as toRangeHeaderValue,n as toMiddlewareList,fa as safeFetch,f as resolveRange,e as parseRangeHeader,h as parseContentRange,r as parseByteSize,I as middlewareConfigDefaults,D as httpError,d as getCookies,j as formatUnsatisfiedContentRange,i as formatContentRange,U as defineResourcePolicy,H as defineMiddlewareConfig,o as createUnsatisfiableResponse,p as createStreamResponse,E as createFileResponse,L as clientIp,V as classifyAddress,F as ViewRouter,k as ValidationError,ca as TooManyRedirectsError,aa as TooLargeError,$ as TimeoutError,ea as SafeResponse,W as SafeFetchError,T as ResourcePolicy,b as ResourceController,c as RequestBreakerError,K as RateLimitMiddleware,J as RateLimitExceededError,u as RangeNotSatisfiableError,R as PoliciesServiceProvider,S as Policies,q as PayloadTooLargeError,v as NotFoundError,da as NetworkError,G as Middleware,B as McpRouter,A as McpRouteDeclaration,z as McpModelParam,l as InvalidValidationRuleError,X as InvalidUrlError,t as InsufficientPermissionsError,C as HttpResponse,m as HttpRequest,w as FileNotFoundError,_ as DnsError,P as CorsMiddleware,a as Controller,ba as ContentTypeError,O as CacheMiddleware,Q as CSRFMiddleware,M as BodyLimitMiddleware,Y as BlockedHostError,Z as BlockedAddressError,s as AuthorizationError,N as AuthenticationMiddleware,x as AuthenticationError,y as ApiRouter};
+import{$c as H,Be as N,Ce as O,De as P,Ee as Q,Fe as R,Ge as S,He as T,Ie as U,Je as V,Ke as W,Le as X,Mc as n,Me as Y,Nc as o,Ne as Z,Oc as p,Oe as _,Pc as q,Pe as $,Qc as r,Qe as aa,Rc as y,Re as ba,Sc as z,Se as ca,Tc as A,Te as da,Uc as B,Ue as ea,Ve as fa,Wc as C,Xc as D,Yc as E,Zc as F,_c as G,ad as I,fd as J,gd as K,hd as L,he as M}from"../chunk-v9na3dny.js";import"../chunk-kqb4s1r0.js";import"../chunk-hytt9qyj.js";import{Xf as a,Yf as b,Zf as d,cg as e,dg as f,eg as g,fg as h,gg as i,hg as j,mg as k,ng as l,rg as m,sg as s,tg as t,ug as u,vg as v,wg as w,xg as x}from"../chunk-0n9vs1ad.js";import{Qg as c}from"../chunk-75wk4jxd.js";import"../chunk-jzp0fs6h.js";import"../chunk-8k8534kg.js";import"../chunk-583vxa2v.js";import"../chunk-8c2fs0n0.js";import"../chunk-6h9j3f1x.js";import"../chunk-erxv1jz7.js";import"../chunk-fv9mr1t4.js";import"../chunk-j3nr4cg0.js";import"../chunk-37qk5dh8.js";import"../chunk-wwmdqhzy.js";import"../chunk-56fgk5rq.js";import"../chunk-4szjp84e.js";import"../chunk-e6fp6dxx.js";export{g as toRangeHeaderValue,n as toMiddlewareList,fa as safeFetch,f as resolveRange,e as parseRangeHeader,h as parseContentRange,r as parseByteSize,I as middlewareConfigDefaults,D as httpError,d as getCookies,j as formatUnsatisfiedContentRange,i as formatContentRange,U as defineResourcePolicy,H as defineMiddlewareConfig,o as createUnsatisfiableResponse,p as createStreamResponse,E as createFileResponse,L as clientIp,V as classifyAddress,F as ViewRouter,k as ValidationError,ca as TooManyRedirectsError,aa as TooLargeError,$ as TimeoutError,ea as SafeResponse,W as SafeFetchError,T as ResourcePolicy,b as ResourceController,c as RequestBreakerError,K as RateLimitMiddleware,J as RateLimitExceededError,u as RangeNotSatisfiableError,R as PoliciesServiceProvider,S as Policies,q as PayloadTooLargeError,v as NotFoundError,da as NetworkError,G as Middleware,B as McpRouter,A as McpRouteDeclaration,z as McpModelParam,l as InvalidValidationRuleError,X as InvalidUrlError,t as InsufficientPermissionsError,C as HttpResponse,m as HttpRequest,w as FileNotFoundError,_ as DnsError,P as CorsMiddleware,a as Controller,ba as ContentTypeError,O as CacheMiddleware,Q as CSRFMiddleware,M as BodyLimitMiddleware,Y as BlockedHostError,Z as BlockedAddressError,s as AuthorizationError,N as AuthenticationMiddleware,x as AuthenticationError,y as ApiRouter};
 
-//# debugId=6A66B21B7D902D6C64756E2164756E21
+//# debugId=B934C75094AC118064756E2164756E21

package/dist/http/index.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "6A66B21B7D902D6C64756E2164756E21",
+  "debugId": "B934C75094AC118064756E2164756E21",
   "names": []
 }

package/dist/http/modelOriginated.d.ts

@@ -1,8 +1,42 @@
+/** One progress report a route makes during a remote tool call. */
+export type ProgressUpdate = {
+    /** How far along, in any unit; must grow with each report. */
+    progress: number;
+    /** The `progress` that means done, when it is known. */
+    total?: number;
+    /** A short line for the user: "Rendering page 3 of 8". */
+    message?: string;
+};
+export type ProgressSink = (update: ProgressUpdate) => void;
+/**
+ * The credential a remote MCP caller's tool call was made under (#762): which
+ * resolver verified it, its id, the scopes it carries and the OAuth client it
+ * was issued to. Never the secret.
+ *
+ * Read by a route as `req.mcpGrant()`, to hold a tool call to a scope of its
+ * own — `req.mcpGrant()?.scopes.includes("billing")` — on top of the user's
+ * own permissions, which the route's middleware checks either way.
+ */
+export type McpGrant = {
+    readonly via: string;
+    readonly id: string;
+    readonly scopes: readonly string[];
+    readonly clientId?: string;
+};
 /**
  * `clientAddress` is required so the one writer cannot mark a request without
- * saying whose rate-limit budget it spends.
+ * saying whose rate-limit budget it spends. `grant` is set for a remote MCP
+ * caller's call, and only by `dispatchAs`, from a principal a resolver
+ * verified.
+ */
+export declare function markModelOriginated(req: Request, clientAddress: string, grant?: McpGrant, progress?: ProgressSink): void;
+/**
+ * Where a dispatched request's progress reports go, when its caller listens
+ * for them: a remote MCP client that sent a `progressToken`.
  */
-export declare function markModelOriginated(req: Request, clientAddress: string): void;
+export declare function dispatchedProgress(req: Request): ProgressSink | undefined;
+/** The grant a remote MCP caller's tool call carries; `undefined` for any other request. */
+export declare function dispatchedGrant(req: Request): McpGrant | undefined;
 export declare function isModelOriginated(req: Request): boolean;
 /**
  * The client address `clientIp` resolved from the initiator, for a request the

package/dist/http/modelOriginated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modelOriginated.d.ts","sourceRoot":"","sources":["../../http/modelOriginated.ts"],"names":[],"mappings":"AAyBA;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,QAEtE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAExE"}
+{"version":3,"file":"modelOriginated.d.ts","sourceRoot":"","sources":["../../http/modelOriginated.ts"],"names":[],"mappings":"AA4BA,mEAAmE;AACnE,MAAM,MAAM,cAAc,GAAG;IAC3B,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0DAA0D;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,OAAO,EACZ,aAAa,EAAE,MAAM,EACrB,KAAK,CAAC,EAAE,QAAQ,EAChB,QAAQ,CAAC,EAAE,YAAY,QAOxB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAEzE;AAED,4FAA4F;AAC5F,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAElE;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAExE"}

package/dist/i18n/dictionaryRuntime.js

@@ -1,4 +1,4 @@
 // @bun
-import{ba as y,ca as p}from"../chunk-5x0aacrn.js";import{ta as c,ua as d,wa as l}from"../chunk-yer1r3t3.js";import{ih as e,jh as i,lh as t,mh as r,nh as o,oh as n,ph as a,qh as s}from"../chunk-9tpx9ag3.js";import"../chunk-8mbyyh8j.js";export{o as setActiveLocale,r as seedDictionaries,t as preloadDictionaries,d as localeStrings,i as loadDictionary,n as getActiveLocale,e as dictionaryRegistrationMark,c as dictionaryLocales,l as dictionaryId,y as defineDictionary,s as createDictionarySink,a as __resetDictionaryRegistry,p as __gemi_dict__};
+import{ba as y,ca as p}from"../chunk-h2r2rdhj.js";import{ta as c,ua as d,wa as l}from"../chunk-yer1r3t3.js";import{Fh as e,Gh as i,Ih as t,Jh as r,Kh as o,Lh as n,Mh as a,Nh as s}from"../chunk-erxv1jz7.js";import"../chunk-e6fp6dxx.js";export{o as setActiveLocale,r as seedDictionaries,t as preloadDictionaries,d as localeStrings,i as loadDictionary,n as getActiveLocale,e as dictionaryRegistrationMark,c as dictionaryLocales,l as dictionaryId,y as defineDictionary,s as createDictionarySink,a as __resetDictionaryRegistry,p as __gemi_dict__};
 
-//# debugId=01298B4E3B31D4D764756E2164756E21
+//# debugId=B172ED693630131F64756E2164756E21

package/dist/i18n/dictionaryRuntime.js.map

@@ -4,6 +4,6 @@
   "sourcesContent": [
   ],
   "mappings": "",
-  "debugId": "01298B4E3B31D4D764756E2164756E21",
+  "debugId": "B172ED693630131F64756E2164756E21",
   "names": []
 }

package/dist/i18n/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{ba as w}from"../chunk-5x0aacrn.js";import"../chunk-yer1r3t3.js";import{eb as b}from"../chunk-fsfbyg5e.js";import{oc as R,pc as S}from"../chunk-x5yq097b.js";import"../chunk-f1y8eggf.js";import{_c as j}from"../chunk-6g20zec2.js";import"../chunk-qpttgn4k.js";import"../chunk-w45agtch.js";import"../chunk-cqnfp0n9.js";import"../chunk-r7b12dmm.js";import"../chunk-y596ghpz.js";import"../chunk-c7mp2kyp.js";import"../chunk-y6v0x869.js";import"../chunk-4t1pbt9p.js";import"../chunk-vwprq300.js";import"../chunk-9tpx9ag3.js";import{Ah as V,Bh as L,yh as X,zh as E}from"../chunk-nysqgzp1.js";import"../chunk-z5hrymvn.js";import"../chunk-v4gwmhtf.js";import"../chunk-vc9phr57.js";import"../chunk-fr0arqdj.js";import"../chunk-fnkjmq94.js";import"../chunk-8mbyyh8j.js";import{createElement as J,Fragment as M,isValidElement as U}from"react";function $(q,B){let G=Object.values(B).some((z)=>typeof z==="function"&&U(z(""))),Q=/{{([^{}]+?)(?::([^{}\[\]]+?))?(?:\[(.*?)\])?}}/g;if(!G)return q.replace(Q,(W,O,_,Z)=>{let C=O.includes(":")?O.split(":")[0]:O,H=B[C];if(H===void 0)return W;if(typeof H==="function"){let K=H(Z!==void 0?Z:"");if(U(K))throw Error("JSX returned in string context");return String(K)}if(_)switch(_.toLowerCase()){case"number":return Number(H).toString();case"string":return String(H);case"boolean":return Boolean(H).toString();default:return String(H)}return String(H)});else{let z=[],W=0,O=null;while((O=Q.exec(q))!==null){let[_,Z,C,H]=O,F=O.index,K=Z.includes(":")?Z.split(":")[0]:Z;if(F>W)z.push(q.substring(W,F));let Y=B[K];if(Y===void 0)z.push(_);else if(typeof Y==="function"){let A=Y(H!==void 0?H:"");z.push(A)}else if(C)switch(C.toLowerCase()){case"number":z.push(Number(Y).toString());break;case"string":z.push(String(Y));break;case"boolean":z.push(Boolean(Y).toString());break;default:z.push(String(Y))}else z.push(String(Y));W=F+_.length}if(W<q.length)z.push(q.substring(W));return J(M,{},...z)}}class P{name;dictionary;constructor(q,B){this.name=q;this.dictionary=B}reference(q){if(typeof window<"u")throw Error("Cannot use reference in the browser");if(!this.dictionary?.[q])throw Error(`Translation not found for ${String(q)}`);return this.dictionary[q]}render(q,...B){let{locale:G=j.locale(),params:Q}={params:{},...B[0]};if(typeof window<"u")throw Error("Cannot use render in the browser");if(!this.dictionary?.[q]?.[G])throw Error(`Translation not found for ${String(q)} in ${String(G)}`);return $(this.dictionary[q][G],Q??{})}static create(q,B){return new P(q,B)}static text(q,...B){let{locale:G=j.locale(),params:Q}={params:{},...B?.[0]};if(!q?.[G])throw Error(`Translation not found for ${String(G)}`);return $(q[G],Q??{})}}async function N(q,B,...G){let{locale:Q=j.locale(),params:z}={params:{},...G[0]},O=(await q.load(String(Q)))[B];if(typeof O!=="string")throw Error(`Translation not found for "${B}" in "${String(Q)}" (dictionary ${q.id})`);return $(O,z??{})}export{S as translationConfigDefaults,N as translate,E as isValidTimeZone,R as defineTranslationConfig,w as defineDictionary,V as createFormatter,L as Translator,b as TranslationServiceProvider,P as Dictionary,X as DEFAULT_TIME_ZONE};
+import{ba as w}from"../chunk-h2r2rdhj.js";import"../chunk-yer1r3t3.js";import{eb as b}from"../chunk-fakvf9wb.js";import{Jc as R,Kc as S}from"../chunk-zgn0p8qr.js";import"../chunk-n672d4g8.js";import{ud as j}from"../chunk-v9na3dny.js";import"../chunk-kqb4s1r0.js";import"../chunk-hytt9qyj.js";import"../chunk-0n9vs1ad.js";import"../chunk-75wk4jxd.js";import"../chunk-jzp0fs6h.js";import"../chunk-8k8534kg.js";import"../chunk-583vxa2v.js";import"../chunk-8c2fs0n0.js";import"../chunk-6h9j3f1x.js";import"../chunk-erxv1jz7.js";import{Vh as X,Wh as E,Xh as V,Yh as L}from"../chunk-fv9mr1t4.js";import"../chunk-j3nr4cg0.js";import"../chunk-37qk5dh8.js";import"../chunk-wwmdqhzy.js";import"../chunk-56fgk5rq.js";import"../chunk-4szjp84e.js";import"../chunk-e6fp6dxx.js";import{createElement as J,Fragment as M,isValidElement as U}from"react";function $(q,B){let G=Object.values(B).some((z)=>typeof z==="function"&&U(z(""))),Q=/{{([^{}]+?)(?::([^{}\[\]]+?))?(?:\[(.*?)\])?}}/g;if(!G)return q.replace(Q,(W,O,_,Z)=>{let C=O.includes(":")?O.split(":")[0]:O,H=B[C];if(H===void 0)return W;if(typeof H==="function"){let K=H(Z!==void 0?Z:"");if(U(K))throw Error("JSX returned in string context");return String(K)}if(_)switch(_.toLowerCase()){case"number":return Number(H).toString();case"string":return String(H);case"boolean":return Boolean(H).toString();default:return String(H)}return String(H)});else{let z=[],W=0,O=null;while((O=Q.exec(q))!==null){let[_,Z,C,H]=O,F=O.index,K=Z.includes(":")?Z.split(":")[0]:Z;if(F>W)z.push(q.substring(W,F));let Y=B[K];if(Y===void 0)z.push(_);else if(typeof Y==="function"){let A=Y(H!==void 0?H:"");z.push(A)}else if(C)switch(C.toLowerCase()){case"number":z.push(Number(Y).toString());break;case"string":z.push(String(Y));break;case"boolean":z.push(Boolean(Y).toString());break;default:z.push(String(Y))}else z.push(String(Y));W=F+_.length}if(W<q.length)z.push(q.substring(W));return J(M,{},...z)}}class P{name;dictionary;constructor(q,B){this.name=q;this.dictionary=B}reference(q){if(typeof window<"u")throw Error("Cannot use reference in the browser");if(!this.dictionary?.[q])throw Error(`Translation not found for ${String(q)}`);return this.dictionary[q]}render(q,...B){let{locale:G=j.locale(),params:Q}={params:{},...B[0]};if(typeof window<"u")throw Error("Cannot use render in the browser");if(!this.dictionary?.[q]?.[G])throw Error(`Translation not found for ${String(q)} in ${String(G)}`);return $(this.dictionary[q][G],Q??{})}static create(q,B){return new P(q,B)}static text(q,...B){let{locale:G=j.locale(),params:Q}={params:{},...B?.[0]};if(!q?.[G])throw Error(`Translation not found for ${String(G)}`);return $(q[G],Q??{})}}async function N(q,B,...G){let{locale:Q=j.locale(),params:z}={params:{},...G[0]},O=(await q.load(String(Q)))[B];if(typeof O!=="string")throw Error(`Translation not found for "${B}" in "${String(Q)}" (dictionary ${q.id})`);return $(O,z??{})}export{S as translationConfigDefaults,N as translate,E as isValidTimeZone,R as defineTranslationConfig,w as defineDictionary,V as createFormatter,L as Translator,b as TranslationServiceProvider,P as Dictionary,X as DEFAULT_TIME_ZONE};
 
-//# debugId=D779D7CEF585ACB764756E2164756E21
+//# debugId=0E8EB947444F11ED64756E2164756E21

package/dist/i18n/index.js.map

@@ -7,6 +7,6 @@
     "import { Lang } from \"../facades\";\nimport { parseTranslation } from \"../utils/parseTranslation\";\nimport type { ParseTranslationParamsServer, Prettify } from \"../utils/type\";\nimport type { DictionaryHandle } from \"./defineDictionary\";\nimport type { DictionaryTranslations } from \"./dictionaryShape\";\n\n/**\n * Read one string from a `defineDictionary` dictionary outside React — a\n * controller, a job, an email template.\n *\n * Async because a bundled dictionary loads its locale on demand. Server code\n * does not go through the bundler, so in practice this resolves without ever\n * yielding; the `await` is what makes the same call work either way.\n *\n * Kept out of `defineDictionary.ts` on purpose: that module is imported by\n * components and has to stay free of the server facades this one needs.\n */\nexport async function translate<\n  T extends DictionaryTranslations,\n  K extends keyof T & string,\n  U extends keyof T[K],\n  R = Prettify<ParseTranslationParamsServer<T[K][U] & string>>,\n>(\n  dictionary: DictionaryHandle<T>,\n  key: K,\n  ...args: R extends Record<string, never>\n    ? [args?: { locale?: U | (string & {}) }]\n    : [args: { locale?: U | (string & {}); params: R }]\n): Promise<string> {\n  const { locale = Lang.locale(), params } = { params: {}, ...args[0] };\n  const strings = await dictionary.load(String(locale));\n  const template = strings[key];\n\n  if (typeof template !== \"string\") {\n    throw new Error(\n      `Translation not found for \"${key}\" in \"${String(locale)}\" (dictionary ${dictionary.id})`,\n    );\n  }\n\n  return parseTranslation(template, (params ?? {}) as any) as string;\n}\n"
   ],
   "mappings": ";02BAAA,mBAAS,SAAe,eAAU,SAO3B,IAAS,JAAgB,JAAC,HAAkB,HAAwB,JAEzE,DAAM,HAAS,EAAO,EAAO,JAAM,HAAE,AACnC,JAAC,DACC,EAAO,DAAU,OACjB,EAAgB,EAAkC,EAAE,CAAC,CACzD,EAMM,EAAQ,kDAEd,GAAI,CAAC,EAqCH,OAnCe,EAAS,QAAQ,EAAO,CAAC,EAAO,EAAM,EAAM,IAAY,CAErE,IAAM,EAAY,EAAK,SAAS,GAAG,EAAI,EAAK,MAAM,GAAG,EAAE,GAAK,EAEtD,EAAQ,EAAO,GACrB,GAAI,IAAU,OACZ,OAAO,EAGT,GAAI,OAAO,IAAU,WAAY,CAG/B,IAAM,EAAiB,EADD,IAAY,OAAY,EAAU,EACd,EAE1C,GAAI,EAAe,CAAc,EAC/B,MAAU,MAAM,gCAAgC,EAElD,OAAO,OAAO,CAAc,EAI9B,GAAI,EACF,OAAQ,EAAK,YAAY,OAClB,SACH,OAAO,OAAO,CAAK,EAAE,SAAS,MAC3B,SACH,OAAO,OAAO,CAAK,MAChB,UACH,OAAO,QAAQ,CAAK,EAAE,SAAS,UAE/B,OAAO,OAAO,CAAK,EAGzB,OAAO,OAAO,CAAK,EACpB,EAEI,KAEL,IAAM,EAAqC,CAAC,EACxC,EAAY,EACZ,EAAgC,KAEpC,OAAQ,EAAQ,EAAM,KAAK,CAAQ,KAAO,KAAM,CAC9C,IAAO,EAAW,EAAM,EAAM,GAAW,EACnC,EAAa,EAAM,MAGnB,EAAY,EAAK,SAAS,GAAG,EAAI,EAAK,MAAM,GAAG,EAAE,GAAK,EAG5D,GAAI,EAAa,EACf,EAAM,KAAK,EAAS,UAAU,EAAW,CAAU,CAAC,EAGtD,IAAM,EAAQ,EAAO,GACrB,GAAI,IAAU,OAEZ,EAAM,KAAK,CAAS,EACf,QAAI,OAAO,IAAU,WAAY,CAGtC,IAAM,EAAiB,EADD,IAAY,OAAY,EAAU,EACd,EAC1C,EAAM,KAAK,CAAc,EACpB,QAAI,EAET,OAAQ,EAAK,YAAY,OAClB,SACH,EAAM,KAAK,OAAO,CAAK,EAAE,SAAS,CAAC,EACnC,UACG,SACH,EAAM,KAAK,OAAO,CAAK,CAAC,EACxB,UACG,UACH,EAAM,KAAK,QAAQ,CAAK,EAAE,SAAS,CAAC,EACpC,cAEA,EAAM,KAAK,OAAO,CAAK,CAAC,EAG5B,OAAM,KAAK,OAAO,CAAK,CAAC,EAG1B,EAAY,EAAa,EAAU,OAIrC,GAAI,EAAY,EAAS,OACvB,EAAM,KAAK,EAAS,UAAU,CAAS,CAAC,EAI1C,OAAO,EAAc,EAAU,CAAC,EAAG,GAAG,CAAK,GChGxC,MAAM,CAAmC,CAErC,KACA,WAFT,WAAW,CACF,EACA,EACP,CAFO,YACA,kBAGT,SAAS,CAAC,EAAc,CACtB,GAAI,OAAO,OAAW,IACpB,MAAU,MAAM,qCAAqC,EAEvD,GAAI,CAAC,KAAK,aAAa,GACrB,MAAU,MAAM,6BAA6B,OAAO,CAAG,GAAG,EAE5D,OAAO,KAAK,WAAW,GAGzB,MAIC,CACC,KACG,EAGH,CACA,IAAQ,SAAS,EAAK,OAAO,EAAG,UAAW,CACzC,OAAQ,CAAC,KACN,EAAK,EACV,EAEA,GAAI,OAAO,OAAW,IACpB,MAAU,MAAM,kCAAkC,EAGpD,GAAI,CAAC,KAAK,aAAa,KAAO,GAC5B,MAAU,MACR,6BAA6B,OAAO,CAAG,QAAQ,OAAO,CAAM,GAC9D,EAEF,OAAO,EAAiB,KAAK,WAAW,GAAK,GAAS,GAAU,CAAC,CAAC,QAU7D,OAAoC,CAAC,EAAc,EAAiB,CACzE,OAAO,IAAI,EAAc,EAAM,CAAY,QAGtC,KAA+D,CACpE,KACG,EAWK,CACR,IAAQ,SAAS,EAAK,OAAO,EAAG,UAAW,CAAE,OAAQ,CAAC,KAAM,IAAO,EAAG,EAEtE,GAAI,CAAC,IAAU,GACb,MAAU,MAAM,6BAA6B,OAAO,CAAM,GAAG,EAG/D,OAAO,EAAiB,EAAQ,GAAS,GAAU,CAAC,CAAC,EAEzD,CC7EA,eAAsB,CAKrB,CACC,EACA,KACG,EAGc,CACjB,IAAQ,SAAS,EAAK,OAAO,EAAG,UAAW,CAAE,OAAQ,CAAC,KAAM,EAAK,EAAG,EAE9D,GADU,MAAM,EAAW,KAAK,OAAO,CAAM,CAAC,GAC3B,GAEzB,GAAI,OAAO,IAAa,SACtB,MAAU,MACR,8BAA8B,UAAY,OAAO,CAAM,kBAAkB,EAAW,KACtF,EAGF,OAAO,EAAiB,EAAW,GAAU,CAAC,CAAS",
-  "debugId": "D779D7CEF585ACB764756E2164756E21",
+  "debugId": "0E8EB947444F11ED64756E2164756E21",
   "names": []
 }

package/dist/kernel/Kernel.d.ts

@@ -1,3 +1,4 @@
+import { McpHttpServer } from "../services/mcp/http/McpHttpServer";
 import { Application } from "../foundation/Application";
 import type { ServiceProviderConstructor, ShutdownReport } from "../foundation/Application";
 import type { ServiceToken } from "../container/Container";
@@ -114,6 +115,8 @@ export declare class Kernel {
     viewRoutes(): ViewRouteDispatcher;
     domains(): DomainRouter;
     queue(): QueueManager;
+    /** The MCP endpoint, or `null` when `route.mcp.remote` is not enabled. */
+    mcpHttp(): McpHttpServer | null;
     /** The `global` middleware list for one request. Call it inside `run`. */
     globalMiddleware(req: Request): Promise<import("../services/router/globalMiddleware").GlobalMiddlewareOutcome>;
     destroy(): void;

package/dist/kernel/Kernel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Kernel.d.ts","sourceRoot":"","sources":["../../kernel/Kernel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAItE,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAK/D;;;;GAIG;AACH,qBAAa,MAAM;IACjB;;;;OAIG;IACH,SAAS,CAAC,MAAM,EAAE,WAAW,CAAM;IAEnC;;;OAGG;IACH,SAAS,CAAC,SAAS,EAAE,0BAA0B,EAAE,CAAM;IAEvD;;;;;;;;;;OAUG;IACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,kBAAkB,GAAG,OAAO,CAAC,CAAM;IAE7D,OAAO,CAAC,gBAAgB,CAAiB;IACzC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,cAAc,CAAS;IAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAM;IAEtD,QAAQ,CAAC,GAAG,cAAqB;IAEjC;;;;;OAKG;IACH,IAAI;IAaJ;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAsDxB;;;OAGG;IACG,WAAW;IAOjB;;;;OAIG;YACW,YAAY;IAU1B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IAInE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC;IAIlB;;;;OAIG;IACH,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;IAOrC,SAAS,IAAI,kBAAkB;IAI/B,UAAU,IAAI,mBAAmB;IAIjC,OAAO,IAAI,YAAY;IAIvB,KAAK,IAAI,YAAY;IAIrB,0EAA0E;IAC1E,gBAAgB,CAAC,GAAG,EAAE,OAAO;IAI7B,OAAO;CAeR"}
+{"version":3,"file":"Kernel.d.ts","sourceRoot":"","sources":["../../kernel/Kernel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,KAAK,EAAE,0BAA0B,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAItE,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,wCAAwC,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAK/D;;;;GAIG;AACH,qBAAa,MAAM;IACjB;;;;OAIG;IACH,SAAS,CAAC,MAAM,EAAE,WAAW,CAAM;IAEnC;;;OAGG;IACH,SAAS,CAAC,SAAS,EAAE,0BAA0B,EAAE,CAAM;IAEvD;;;;;;;;;;OAUG;IACH,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,kBAAkB,GAAG,OAAO,CAAC,CAAM;IAE7D,OAAO,CAAC,gBAAgB,CAAiB;IACzC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,cAAc,CAAS;IAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAM;IAEtD,QAAQ,CAAC,GAAG,cAAqB;IAEjC;;;;;OAKG;IACH,IAAI;IAaJ;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAsDxB;;;OAGG;IACG,WAAW;IAOjB;;;;OAIG;YACW,YAAY;IAU1B;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IAInE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC;IAIlB;;;;OAIG;IACH,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC;IAOrC,SAAS,IAAI,kBAAkB;IAI/B,UAAU,IAAI,mBAAmB;IAIjC,OAAO,IAAI,YAAY;IAIvB,KAAK,IAAI,YAAY;IAIrB,0EAA0E;IAC1E,OAAO,IAAI,aAAa,GAAG,IAAI;IAM/B,0EAA0E;IAC1E,gBAAgB,CAAC,GAAG,EAAE,OAAO;IAI7B,OAAO;CAeR"}

package/dist/kernel/index.js

@@ -1,5 +1,5 @@
 // @bun
-import{Ia as g}from"../chunk-7jnpnjth.js";import{db as r}from"../chunk-1p85fdrk.js";import{eb as w}from"../chunk-fsfbyg5e.js";import{Ab as c,Db as p,Gb as n,Jb as a,hb as T,ib as D,jb as jj,kb as A,lb as y,mb as P,qb as S,rb as h,tb as R,ub as u,vb as l,wb as v,zb as d}from"../chunk-5zzhypmt.js";import"../chunk-3z9vhjd7.js";import"../chunk-9vsj0ksk.js";import"../chunk-qx87cdfg.js";import{jc as e}from"../chunk-g8kx549d.js";import"../chunk-x5yq097b.js";import"../chunk-f1y8eggf.js";import{$d as m,Od as x,Tc as $j,Td as I,Uc as Gj,Ud as E,Xc as Hj,Yc as Nj,Yd as K,Zd as M,_d as t,ae as C,be as Q,ce as o,de as i}from"../chunk-6g20zec2.js";import{De as s}from"../chunk-qpttgn4k.js";import{Qe as V,Ve as f}from"../chunk-w45agtch.js";import{Wf as b}from"../chunk-cqnfp0n9.js";import{sg as B}from"../chunk-r7b12dmm.js";import{yg as L}from"../chunk-y596ghpz.js";import"../chunk-c7mp2kyp.js";import"../chunk-y6v0x869.js";import"../chunk-4t1pbt9p.js";import"../chunk-vwprq300.js";import"../chunk-9tpx9ag3.js";import"../chunk-vqa3agzw.js";import"../chunk-nysqgzp1.js";import{Ch as _,Eh as N,Fh as F}from"../chunk-z5hrymvn.js";import"../chunk-v4gwmhtf.js";import"../chunk-vc9phr57.js";import"../chunk-fr0arqdj.js";import{Sh as q}from"../chunk-fnkjmq94.js";import"../chunk-8mbyyh8j.js";function Wj(j){let X=j.headers.get("Cache-Control")?.toLowerCase()??"";return/(^|[\s,])(public|s-maxage)\b/.test(X)}var Xj=new Set,Yj={refusal:null,apply:(j)=>j,carried:null};async function k(j){let X=F(x);if(X.config.global.length===0)return Yj;let{pathname:Z}=new URL(j.url),W=q(Z),z=new b(j,{},W?"api":"view","");return await L.run(z,async()=>{let $=L.getStore(),{headers:H,cookies:Jj}=$,Y=(J)=>{if(!Wj(J))return Q(J,H,Jj);let G=new Headers(H);return G.delete("Set-Cookie"),Q(J,G,Xj)};try{return await X.runGlobalMiddleware(),{refusal:null,apply:Y,carried:{user:$.user}}}catch(J){let G=!W&&Z.endsWith(".json");if(J?.kind===B){let O=W?C(J.payload.api):G?M(J.payload.viewData??J.payload.api):K(J.payload.view);return{refusal:Y(O),apply:Y,carried:null}}if(V(J)&&(W||G))return{refusal:Y(m()),apply:Y,carried:null};if(f(J)){console.error(J);let O=W||G?I():K(E());return{refusal:Y(O),apply:Y,carried:null}}throw J}finally{$.destroy()}})}var U=[v,c,g,S,a,y,h,d,u,D,R,n,l,w,p,P,A];class zj{config={};providers=[];services=[];serviceInstances=[];serviceTokens=new Set;servicesBooted=!1;models=[];app=new N;boot(){if(this.models.length>0)r(...this.models);else Zj();this.app.config.merge(this.config),N.setInstance(this.app),this.app.registerMany([...U,...this.providers]),this.registerServices()}registerServices(){let j=this.serviceTokens;this.serviceInstances=[],this.serviceTokens=new Set,this.servicesBooted=!1;let X=new Map;for(let Z of this.services){let W=typeof Z==="function"?new Z:Z,z=W.constructor;if(!z.token)throw Error(`Service [${z.name}] is listed in \`services\` but does not declare a \`static token\`.`);let $=X.get(z.token);if($)throw Error(`Services [${$}] and [${z.name}] both declare the token "${z.token}". Tokens are the container's keys, so they must be unique.`);X.set(z.token,z.name);let H=z;if(!j.has(z.token)&&this.app.bound(H))throw Error(`Service [${z.name}] declares the token "${z.token}", which is already bound in the container by the framework or a provider. Binding it would replace that service everywhere, so pick a token nothing else owns.`);this.app.instance(H,W),this.serviceInstances.push(W),this.serviceTokens.add(z.token)}}async waitForBoot(){await this.app.boot(),await this.bootServices(),jj(this.app)}async bootServices(){if(this.servicesBooted)return;for(let j of this.serviceInstances)await j.boot();this.servicesBooted=!0}shutdown(j){return this.run(()=>this.app.shutdown(j))}run(j){return _.run(this.app,j)}resolve(j){return this.app.make(j)}apiRoutes(){return this.app.make(o)}viewRoutes(){return this.app.make(t)}domains(){return this.app.make(i)}queue(){return this.app.make(e)}globalMiddleware(j){return k(j)}destroy(){if(this.app.resolved(T))this.app.make(T).stop();if(this.app.flush(),N.getInstance()===this.app)N.setInstance(void 0);_.disable()}}function Zj(){if(Bun.env.NODE_ENV==="production")return;let j=s();if(j.length===0)return;console.warn(`[gemi] ${j.length} model${j.length===1?" is":"s are"} registered, but Kernel.models is empty.
+import{Ia as g}from"../chunk-3ma9m432.js";import{db as e}from"../chunk-h4pazcgg.js";import{eb as w}from"../chunk-fakvf9wb.js";import{Ab as S,Bb as h,Db as R,Eb as u,Fb as l,Gb as v,Jb as d,Kb as c,Nb as p,Qb as n,Rb as a,qb as r,rb as T,sb as D,tb as zj,ub as A,vb as y,wb as P}from"../chunk-60nyk1w8.js";import"../chunk-wysm6qte.js";import"../chunk-7rmjr8p7.js";import"../chunk-2z1981d0.js";import{Ec as jj}from"../chunk-8rt4wx8z.js";import"../chunk-zgn0p8qr.js";import"../chunk-n672d4g8.js";import{ie as x,md as Gj,nd as Nj,ne as I,oe as E,qd as Oj,rd as Hj,se as K,te as q,ue as t,ve as m,we as C,xe as Q,ye as o,ze as i}from"../chunk-v9na3dny.js";import{Ze as s}from"../chunk-kqb4s1r0.js";import{kf as V,pf as f}from"../chunk-hytt9qyj.js";import{rg as b}from"../chunk-0n9vs1ad.js";import{Pg as B}from"../chunk-75wk4jxd.js";import{Vg as L}from"../chunk-jzp0fs6h.js";import"../chunk-8k8534kg.js";import"../chunk-583vxa2v.js";import"../chunk-8c2fs0n0.js";import"../chunk-6h9j3f1x.js";import"../chunk-erxv1jz7.js";import"../chunk-5j76r5q8.js";import"../chunk-fv9mr1t4.js";import{$h as O,Zh as _,ai as F}from"../chunk-j3nr4cg0.js";import"../chunk-37qk5dh8.js";import"../chunk-wwmdqhzy.js";import"../chunk-56fgk5rq.js";import{ni as M}from"../chunk-4szjp84e.js";import"../chunk-e6fp6dxx.js";function Xj(j){let X=j.headers.get("Cache-Control")?.toLowerCase()??"";return/(^|[\s,])(public|s-maxage)\b/.test(X)}var Yj=new Set,Zj={refusal:null,apply:(j)=>j,carried:null};async function k(j){let X=F(x);if(X.config.global.length===0)return Zj;let{pathname:Z}=new URL(j.url),W=M(Z),z=new b(j,{},W?"api":"view","");return await L.run(z,async()=>{let $=L.getStore(),{headers:N,cookies:Wj}=$,Y=(J)=>{if(!Xj(J))return Q(J,N,Wj);let G=new Headers(N);return G.delete("Set-Cookie"),Q(J,G,Yj)};try{return await X.runGlobalMiddleware(),{refusal:null,apply:Y,carried:{user:$.user}}}catch(J){let G=!W&&Z.endsWith(".json");if(J?.kind===B){let H=W?C(J.payload.api):G?q(J.payload.viewData??J.payload.api):K(J.payload.view);return{refusal:Y(H),apply:Y,carried:null}}if(V(J)&&(W||G))return{refusal:Y(m()),apply:Y,carried:null};if(f(J)){console.error(J);let H=W||G?I():K(E());return{refusal:Y(H),apply:Y,carried:null}}throw J}finally{$.destroy()}})}var U=[v,c,g,S,a,y,h,d,u,D,R,n,l,w,p,P,A];class Jj{config={};providers=[];services=[];serviceInstances=[];serviceTokens=new Set;servicesBooted=!1;models=[];app=new O;boot(){if(this.models.length>0)e(...this.models);else $j();this.app.config.merge(this.config),O.setInstance(this.app),this.app.registerMany([...U,...this.providers]),this.registerServices()}registerServices(){let j=this.serviceTokens;this.serviceInstances=[],this.serviceTokens=new Set,this.servicesBooted=!1;let X=new Map;for(let Z of this.services){let W=typeof Z==="function"?new Z:Z,z=W.constructor;if(!z.token)throw Error(`Service [${z.name}] is listed in \`services\` but does not declare a \`static token\`.`);let $=X.get(z.token);if($)throw Error(`Services [${$}] and [${z.name}] both declare the token "${z.token}". Tokens are the container's keys, so they must be unique.`);X.set(z.token,z.name);let N=z;if(!j.has(z.token)&&this.app.bound(N))throw Error(`Service [${z.name}] declares the token "${z.token}", which is already bound in the container by the framework or a provider. Binding it would replace that service everywhere, so pick a token nothing else owns.`);this.app.instance(N,W),this.serviceInstances.push(W),this.serviceTokens.add(z.token)}}async waitForBoot(){await this.app.boot(),await this.bootServices(),zj(this.app)}async bootServices(){if(this.servicesBooted)return;for(let j of this.serviceInstances)await j.boot();this.servicesBooted=!0}shutdown(j){return this.run(()=>this.app.shutdown(j))}run(j){return _.run(this.app,j)}resolve(j){return this.app.make(j)}apiRoutes(){return this.app.make(o)}viewRoutes(){return this.app.make(t)}domains(){return this.app.make(i)}queue(){return this.app.make(jj)}mcpHttp(){return this.app.config.get("route.mcp.remote.enabled")===!0?this.app.make(r):null}globalMiddleware(j){return k(j)}destroy(){if(this.app.resolved(T))this.app.make(T).stop();if(this.app.flush(),O.getInstance()===this.app)O.setInstance(void 0);_.disable()}}function $j(){if(Bun.env.NODE_ENV==="production")return;let j=s();if(j.length===0)return;console.warn(`[gemi] ${j.length} model${j.length===1?" is":"s are"} registered, but Kernel.models is empty.
         Nested relation reads resolve a model by name, so a policy on a subclass that does not own its
 `+"        name is skipped inside every include \u2014 scoped at the root, "+`unscoped in an include, with nothing
         to notice it. Declaring the modules registers each class under its own name and audits the set:
@@ -11,6 +11,6 @@ import{Ia as g}from"../chunk-7jnpnjth.js";import{db as r}from"../chunk-1p85fdrk.
               models = [generated, models]
             }
 
-        See docs/orm.md#your-model-class. Development only; this never prints in production.`)}export{Gj as oneTimeSecretMatches,$j as hashOneTimeSecret,U as frameworkProviders,Nj as UserProvider,Hj as SESSION_SELECT,zj as Kernel};
+        See docs/orm.md#your-model-class. Development only; this never prints in production.`)}export{Nj as oneTimeSecretMatches,Gj as hashOneTimeSecret,U as frameworkProviders,Hj as UserProvider,Oj as SESSION_SELECT,Jj as Kernel};
 
-//# debugId=76AB660A5C6666BA64756E2164756E21
+//# debugId=D9DA50E00E2139D764756E2164756E21

package/dist/kernel/index.js.map

@@ -4,9 +4,9 @@
   "sourcesContent": [
     "import { app } from \"../../foundation/app\";\nimport { GEMI_REQUEST_BREAKER_ERROR } from \"../../http/Error\";\nimport { HttpRequest } from \"../../http/HttpRequest\";\nimport { type CarriedContext, RequestContext } from \"../../http/requestContext\";\nimport { isPolicyDeniedError, isRecordNotFoundError } from \"../../orm/errors\";\nimport { MiddlewareRegistry } from \"../middleware/MiddlewareRegistry\";\nimport { breakResponse, mergeContextIntoResponse } from \"./ApiRouteDispatcher\";\nimport { isApiPath } from \"./apiPath\";\nimport { notFoundResponse } from \"./notFound\";\nimport { policyDeniedResponse, policyDeniedView } from \"./policyDenied\";\nimport { viewBreakResponse, viewDataBreakResponse } from \"./ViewRouteDispatcher\";\n\nexport interface GlobalMiddlewareOutcome {\n  /** The response that ends the request, when a global middleware refused it. */\n  refusal: Response | null;\n  /**\n   * Puts the headers and cookies the global middleware set on the request\n   * context onto the response the request ends with. The response's own\n   * headers win; the context only fills gaps, as it does for route middleware.\n   * Cookies are left off a response a shared cache may store (see\n   * `sharedCacheable`).\n   */\n  apply(response: Response): Response;\n  /**\n   * The user the list left on its context, for the route's context to start\n   * from. `null` when there is no list, or it refused.\n   */\n  carried: CarriedContext | null;\n}\n\n/**\n * Whether a shared cache may store this response: `public` or `s-maxage` in\n * its Cache-Control, as the static `dist/client` files carry\n * (`public, max-age=31536000`). A per-visitor cookie a global middleware set\n * would otherwise be stored with the asset, and a CDN that caches responses\n * with Set-Cookie would hand it to every visitor who gets that copy.\n */\nfunction sharedCacheable(response: Response) {\n  const cacheControl = response.headers.get(\"Cache-Control\")?.toLowerCase() ?? \"\";\n  return /(^|[\\s,])(public|s-maxage)\\b/.test(cacheControl);\n}\n\nconst noCookies = new Set<string>();\n\nconst passThrough: GlobalMiddlewareOutcome = {\n  refusal: null,\n  apply: (response) => response,\n  carried: null,\n};\n\n/**\n * Runs the `global` middleware list for one incoming request, before anything\n * is routed and before a static file is served. Called from `App`, once per\n * request (see `App.withGlobalMiddleware`), inside the kernel scope.\n *\n * It opens a request scope of its own. The router has not run, so the\n * `HttpRequest` a global middleware gets has no params and an empty\n * `routePath`, and its `kind` is read off the url the way `App.fetch` picks a\n * dispatcher. The scope is not the one the route later runs in: the route's\n * dispatcher opens a fresh one, as it always has. Two things cross over.\n * Headers and cookies reach the response through `apply`, and the user is\n * `carried` into the route's context, so a gate that looked the user up does\n * not make `auth` or `Auth.user()` look them up again. Both trust a user they\n * find on the context without checking it against a session or asking for a\n * token, so whatever a global middleware sets is treated as authenticated by\n * the route — which is what lets one sign a user in by SSO header or API key\n * (#577), and why it must set only a user it has verified. The rest stays\n * behind:\n * the locale, because the dispatchers decide it for the route, from its url,\n * and the feature evaluations, made against a request with no route and maybe\n * before a user was known.\n *\n * A break answers the way the same break from a route middleware would for\n * that url: the api's JSON for `/api`, the `.json` navigation's body for view\n * data, and the page response otherwise, static files included. A policy\n * denial is the same 403 the dispatchers give. Anything else is thrown, and\n * the caller answers it as the server's 500.\n */\nexport async function runGlobalMiddleware(req: Request): Promise<GlobalMiddlewareOutcome> {\n  const registry = app(MiddlewareRegistry);\n  if (registry.config.global.length === 0) {\n    return passThrough;\n  }\n\n  const { pathname } = new URL(req.url);\n  const isApi = isApiPath(pathname);\n  const httpRequest = new HttpRequest(req, {}, isApi ? \"api\" : \"view\", \"\");\n\n  return await RequestContext.run(httpRequest, async () => {\n    const ctx = RequestContext.getStore();\n    // Held past `destroy()` below, which only drops the store's references.\n    const { headers, cookies } = ctx;\n    const apply = (response: Response) => {\n      if (!sharedCacheable(response)) {\n        return mergeContextIntoResponse(response, headers, cookies);\n      }\n      const withoutCookies = new Headers(headers);\n      withoutCookies.delete(\"Set-Cookie\");\n      return mergeContextIntoResponse(response, withoutCookies, noCookies);\n    };\n\n    try {\n      await registry.runGlobalMiddleware();\n      return { refusal: null, apply, carried: { user: ctx.user } };\n    } catch (err) {\n      const isViewData = !isApi && pathname.endsWith(\".json\");\n      if (err?.kind === GEMI_REQUEST_BREAKER_ERROR) {\n        const refusal = isApi\n          ? breakResponse(err.payload.api)\n          : isViewData\n            ? viewDataBreakResponse(err.payload.viewData ?? err.payload.api)\n            : viewBreakResponse(err.payload.view);\n        return { refusal: apply(refusal), apply, carried: null };\n      }\n      // A global middleware that resolves the request's tenant or workspace by\n      // an id from the url asks the same question a route handler does, and a\n      // miss is the same 404. Only for the two json-shaped requests here: a\n      // full page load should render the application's `404` view rather than\n      // a bare body, and that is #614's to do.\n      if (isRecordNotFoundError(err) && (isApi || isViewData)) {\n        return { refusal: apply(notFoundResponse()), apply, carried: null };\n      }\n      if (isPolicyDeniedError(err)) {\n        console.error(err);\n        const refusal =\n          isApi || isViewData ? policyDeniedResponse() : viewBreakResponse(policyDeniedView());\n        return { refusal: apply(refusal), apply, carried: null };\n      }\n      throw err;\n    } finally {\n      ctx.destroy();\n    }\n  });\n}\n",
     "import type { ServiceProviderConstructor } from \"../foundation/Application\";\nimport { ChangeFeedServiceProvider } from \"../services/change-feed/ChangeFeedServiceProvider\";\nimport { AuthServiceProvider } from \"../auth/AuthServiceProvider\";\nimport { DatabaseServiceProvider } from \"../database/DatabaseServiceProvider\";\nimport { TranslationServiceProvider } from \"../i18n/TranslationServiceProvider\";\nimport { ScheduleServiceProvider } from \"../services/cron/ScheduleServiceProvider\";\nimport { FeaturesServiceProvider } from \"../services/features/FeaturesServiceProvider\";\nimport { MailServiceProvider } from \"../services/email/MailServiceProvider\";\nimport { EventServiceProvider } from \"../services/events/EventServiceProvider\";\nimport { FilesystemServiceProvider } from \"../services/file-storage/FilesystemServiceProvider\";\nimport { ImageServiceProvider } from \"../services/image-optimization/ImageServiceProvider\";\nimport { KernelIdServiceProvider } from \"../services/kernel-id/KernelIdServiceProvider\";\nimport { LogServiceProvider } from \"../services/logging/LogServiceProvider\";\nimport { MiddlewareServiceProvider } from \"../services/middleware/MiddlewareServiceProvider\";\nimport { QueueServiceProvider } from \"../services/queue/QueueServiceProvider\";\nimport { RateLimiterServiceProvider } from \"../services/rate-limiter/RateLimiterServiceProvider\";\nimport { RedisServiceProvider } from \"../services/redis/RedisServiceProvider\";\nimport { RouteServiceProvider } from \"../services/router/RouteServiceProvider\";\n\n/**\n * The providers every gemi app boots with, in registration order. Seventeen\n * providers for eighteen services — `RouteServiceProvider` owns both the api\n * and the view dispatcher, the way Laravel's does.\n *\n * Order only matters for `boot()`; `register()` binds factories and resolves\n * nothing, so no provider here depends on an earlier one having run — with one\n * exception, which is the reason to read this before reordering anything.\n *\n * **`EventServiceProvider` must stay after `QueueServiceProvider`.** A queued\n * listener is registered with the queue as a synthetic job, and\n * `EventServiceProvider.boot()` is what hands those over. `QueueManager.useJobs`\n * — which `QueueServiceProvider.boot()` calls with whatever it discovered under\n * `app/jobs` — *replaces* the registry (`this.jobs = {}`). Move the events\n * provider up and the two boots run in the order that discards: every\n * `listener:*` entry is registered and then thrown away. Nothing errors, boot\n * succeeds, and each queued dispatch afterwards lands on `next()`'s \"Dropped a\n * queued job: nothing is registered under the name listener:SendWelcomeEmail\",\n * long after `dispatch` returned to a caller that cannot hear it.\n */\nexport const frameworkProviders: ServiceProviderConstructor[] = [\n  KernelIdServiceProvider,\n  MiddlewareServiceProvider,\n  DatabaseServiceProvider,\n  // After the database, whose `boot()` its cache warm-up depends on, and before\n  // the route dispatchers, which evaluate flags on every view request.\n  FeaturesServiceProvider,\n  RouteServiceProvider,\n  AuthServiceProvider,\n  MailServiceProvider,\n  LogServiceProvider,\n  FilesystemServiceProvider,\n  QueueServiceProvider,\n  EventServiceProvider,\n  RedisServiceProvider,\n  ImageServiceProvider,\n  TranslationServiceProvider,\n  RateLimiterServiceProvider,\n  ScheduleServiceProvider,\n  ChangeFeedServiceProvider,\n];\n",
-    "import { Application } from \"../foundation/Application\";\nimport type { ServiceProviderConstructor, ShutdownReport } from \"../foundation/Application\";\nimport type { ServiceToken } from \"../container/Container\";\nimport type { ConfigItems } from \"../support/Repository\";\nimport type { Service, ServiceConstructor } from \"../support/Service\";\nimport { registerModels } from \"../orm/registration\";\nimport { registeredNames } from \"../orm/registry\";\nimport { Scheduler } from \"../services/cron/Scheduler\";\nimport { QueueManager } from \"../services/queue/QueueManager\";\nimport { startClaimingIfServing } from \"../services/queue/QueueServiceProvider\";\nimport { ApiRouteDispatcher } from \"../services/router/ApiRouteDispatcher\";\nimport { ViewRouteDispatcher } from \"../services/router/ViewRouteDispatcher\";\nimport { DomainRouter } from \"../services/router/DomainRouter\";\nimport { runGlobalMiddleware } from \"../services/router/globalMiddleware\";\nimport { kernelContext } from \"./context\";\nimport { frameworkProviders } from \"./providers\";\n\n/**\n * The app's entry point into the framework. A Kernel subclass declares what the\n * app adds — its `config` slices and any extra `providers` — and everything\n * else lives in the Application container it owns.\n */\nexport class Kernel {\n  /**\n   * App-level config, merged over the framework defaults. Each key is a config\n   * slice: `{ mail: { ... }, route: { ... } }`, normally the modules under\n   * `app/config`.\n   */\n  protected config: ConfigItems = {};\n\n  /**\n   * App-level providers, registered after the framework's own so they can\n   * rebind anything the framework bound.\n   */\n  protected providers: ServiceProviderConstructor[] = [];\n\n  /**\n   * The app's own singleton services. Each is constructed during the\n   * synchronous boot phase and its `boot()` awaited during the asynchronous\n   * one, in the order listed — so a service whose `boot()` depends on another\n   * goes after it.\n   *\n   * An entry is either the class itself or a configured instance from\n   * `Service.with({ ... })`. Listing is explicit rather than discovered because\n   * the order is load-bearing here, and because a service is always imported by\n   * whatever injects it — there is no file the import graph would miss.\n   */\n  protected services: Array<ServiceConstructor | Service> = [];\n\n  private serviceInstances: Service[] = [];\n  private serviceTokens = new Set<string>();\n  private servicesBooted = false;\n\n  /**\n   * The modules holding the app's model classes — normally\n   * `[generated, models]`, the generated namespace and the barrel of subclasses\n   * written over it. Every model class they export is registered under the name\n   * its schema carries, later modules winning, and the whole set is audited\n   * before anything else boots.\n   *\n   * ### Why this is a Kernel field and not a line in a file somewhere\n   *\n   * Registration used to be `register(\"User\", User)` next to each subclass, and\n   * the failure mode of forgetting it is an authorization hole that nothing\n   * reports: a relation read resolves its target by name, so an unregistered\n   * policied subclass leaves the generated base owning the name and every\n   * nested `include` of that model comes back unscoped. No error at the root\n   * either, because `$exec`'s divergence guard begins `registered !== this` and\n   * the base it is running on *is* the registered one. A model only ever read\n   * through an include — a membership, a pivot, the kind that carries a tenant\n   * scope — never trips anything.\n   *\n   * Listing the modules here says it once, in the same place the app already\n   * declares its config slices and providers, and turns the mistake into a\n   * failure to boot rather than a quiet cross-tenant read.\n   *\n   * It sees the modules it is given, so a model class in a file that no barrel\n   * re-exports is still invisible. That is the residual, and it is a smaller\n   * one: a barrel is a place to notice an omission, and thirteen `register`\n   * lines scattered across thirteen files is not.\n   */\n  protected models: Array<Record<string, unknown>> = [];\n\n  readonly app = new Application();\n\n  /**\n   * Phase one, synchronous: every provider is constructed and its `register()`\n   * runs. Only bindings are recorded here — no service is instantiated, so this\n   * is safe to call from a synchronous constructor (`new App({ kernel })`).\n   * Phase two is `waitForBoot()`.\n   */\n  boot() {\n    // Before the container, deliberately. This throws on a model whose policies\n    // would be skipped, and the useful moment for that is the one where nothing\n    // has been constructed and no request can be in flight.\n    if (this.models.length > 0) registerModels(...this.models);\n    else warnIfModelsAreRegisteredButUndeclared();\n\n    this.app.config.merge(this.config);\n    Application.setInstance(this.app);\n    this.app.registerMany([...frameworkProviders, ...this.providers]);\n    this.registerServices();\n  }\n\n  /**\n   * Constructs every listed service and binds it into the container. Runs after\n   * the providers have registered, so a provider's `boot()` can `inject()` one;\n   * a `Service` constructor does no I/O, so doing this synchronously costs\n   * nothing beyond the field initializers.\n   */\n  private registerServices() {\n    // What a previous pass bound, so re-running this on the same kernel is not\n    // mistaken for a collision with something else.\n    const ours = this.serviceTokens;\n\n    this.serviceInstances = [];\n    this.serviceTokens = new Set();\n    this.servicesBooted = false;\n\n    const owners = new Map<string, string>();\n\n    for (const declaration of this.services) {\n      const instance =\n        typeof declaration === \"function\" ? new declaration() : declaration;\n      const ctor = instance.constructor as ServiceConstructor;\n\n      if (!ctor.token) {\n        throw new Error(\n          `Service [${ctor.name}] is listed in \\`services\\` but does not declare a \\`static token\\`.`,\n        );\n      }\n\n      // Two services under one token is the failure this refuses to have\n      // silently: the second would replace the first in the container, and\n      // every `inject()` written against either would hand back whichever was\n      // listed last.\n      const owner = owners.get(ctor.token);\n      if (owner) {\n        throw new Error(\n          `Services [${owner}] and [${ctor.name}] both declare the token \"${ctor.token}\". Tokens are the container's keys, so they must be unique.`,\n        );\n      }\n      owners.set(ctor.token, ctor.name);\n\n      // The same failure one level out. `Container.instance()` writes into\n      // `instances`, which `make()` consults before `bindings`, so a token that\n      // is already spoken for is not shared with its owner — it replaces it, for\n      // every `app()` and `inject()` in the process. An app service that named\n      // itself \"mail\" would leave `Mail.send()` resolving to an object with no\n      // `send`, and the boot that caused it would report nothing. Providers have\n      // all registered by now, so anything bound here belongs to somebody else.\n      const token = ctor as unknown as ServiceToken<Service>;\n      if (!ours.has(ctor.token) && this.app.bound(token)) {\n        throw new Error(\n          `Service [${ctor.name}] declares the token \"${ctor.token}\", which is already bound in the container by the framework or a provider. Binding it would replace that service everywhere, so pick a token nothing else owns.`,\n        );\n      }\n\n      this.app.instance(token, instance);\n      this.serviceInstances.push(instance);\n      this.serviceTokens.add(ctor.token);\n    }\n  }\n\n  /**\n   * Phase two, asynchronous: every provider's `boot()` runs, in registration\n   * order, after all of them have registered. Idempotent.\n   */\n  async waitForBoot() {\n    await this.app.boot();\n    await this.bootServices();\n    // Last, once every job — queued listeners included — is registered.\n    startClaimingIfServing(this.app);\n  }\n\n  /**\n   * Phase two for services, after every provider's `boot()` — so a service may\n   * use the facades and anything else a provider owns. Idempotent, like the\n   * provider phase it follows.\n   */\n  private async bootServices() {\n    if (this.servicesBooted) {\n      return;\n    }\n    for (const service of this.serviceInstances) {\n      await service.boot();\n    }\n    this.servicesBooted = true;\n  }\n\n  /**\n   * Every provider's `shutdown()`, in reverse registration order, inside the\n   * application context — so a hook may use the facades, as a cron tick or a\n   * request would. See `Application.shutdown` for the deadline and the\n   * report. Idempotent.\n   */\n  shutdown(options?: { timeoutMs?: number }): Promise<ShutdownReport> {\n    return this.run(() => this.app.shutdown(options));\n  }\n\n  run<T>(cb: () => T) {\n    return kernelContext.run(this.app, cb);\n  }\n\n  /**\n   * Resolve a service by token. Callers outside this module should prefer the\n   * named accessors below or `app()`; this exists for tooling that holds a\n   * Kernel but no ambient context.\n   */\n  resolve<T>(token: ServiceToken<T>): T {\n    return this.app.make(token);\n  }\n\n  // Named accessors. `app/App.ts` goes through these rather than importing the\n  // service classes itself — see the note in that file about the two copies of\n  // gemi that coexist at build time.\n  apiRoutes(): ApiRouteDispatcher {\n    return this.app.make(ApiRouteDispatcher);\n  }\n\n  viewRoutes(): ViewRouteDispatcher {\n    return this.app.make(ViewRouteDispatcher);\n  }\n\n  domains(): DomainRouter {\n    return this.app.make(DomainRouter);\n  }\n\n  queue(): QueueManager {\n    return this.app.make(QueueManager);\n  }\n\n  /** The `global` middleware list for one request. Call it inside `run`. */\n  globalMiddleware(req: Request) {\n    return runGlobalMiddleware(req);\n  }\n\n  destroy() {\n    // Only touch services that were actually resolved — resolving one here\n    // would construct it purely to tear it down.\n    if (this.app.resolved(Scheduler)) {\n      this.app.make(Scheduler).stop();\n    }\n\n    this.app.flush();\n\n    if (Application.getInstance() === this.app) {\n      Application.setInstance(undefined);\n    }\n\n    kernelContext.disable();\n  }\n}\n\n/**\n * Says something to an application that has models and has not declared them.\n *\n * Without this the fix for #316 defaults to off. `models` is `[]`, `boot()`\n * no-ops, and an app upgrading from 0.48 is in exactly the state the issue\n * describes until somebody edits their Kernel by hand — while the only place\n * that says to is the **Setup** section of `docs/orm.md`, which an existing app\n * read once and will not read again. #316 was filed by an app mid-migration\n * with a 79-model schema, which is precisely the reader who never sees it.\n *\n * The condition is what makes this worth printing. A populated registry with an\n * empty `models` means the generated `index.ts` was imported and its bases are\n * what every nested read resolves to — so if any policy lives on a subclass, it\n * is being skipped inside includes right now. A Kernel with no ORM at all has\n * an empty registry and hears nothing.\n *\n * Development only, and a warning rather than a throw: an app in this state is\n * running today, and turning a working deploy into a failure to start over an\n * arrangement that *might* be fine is not a patch-level thing to do. The\n * failure it points at is silent, so the fix for it has to be noisy somewhere,\n * and the terminal an author is already looking at is the cheapest somewhere\n * there is.\n */\nfunction warnIfModelsAreRegisteredButUndeclared(): void {\n  if (process.env.NODE_ENV === \"production\") return;\n\n  const registered = registeredNames();\n  if (registered.length === 0) return;\n\n  console.warn(\n    `[gemi] ${registered.length} model${registered.length === 1 ? \" is\" : \"s are\"} ` +\n      `registered, but Kernel.models is empty.\\n` +\n      `        Nested relation reads resolve a model by name, so a policy on a ` +\n      `subclass that does not own its\\n` +\n      `        name is skipped inside every include — scoped at the root, ` +\n      `unscoped in an include, with nothing\\n` +\n      `        to notice it. Declaring the modules registers each class under ` +\n      `its own name and audits the set:\\n\\n` +\n      `            import * as generated from \"../models/generated\"\\n` +\n      `            import * as models from \"../models\"\\n\\n` +\n      `            export default class extends Kernel {\\n` +\n      `              models = [generated, models]\\n` +\n      `            }\\n\\n` +\n      `        See docs/orm.md#your-model-class. Development only; this never ` +\n      `prints in production.`,\n  );\n}\n"
+    "import { McpHttpServer } from \"../services/mcp/http/McpHttpServer\";\nimport { Application } from \"../foundation/Application\";\nimport type { ServiceProviderConstructor, ShutdownReport } from \"../foundation/Application\";\nimport type { ServiceToken } from \"../container/Container\";\nimport type { ConfigItems } from \"../support/Repository\";\nimport type { Service, ServiceConstructor } from \"../support/Service\";\nimport { registerModels } from \"../orm/registration\";\nimport { registeredNames } from \"../orm/registry\";\nimport { Scheduler } from \"../services/cron/Scheduler\";\nimport { QueueManager } from \"../services/queue/QueueManager\";\nimport { startClaimingIfServing } from \"../services/queue/QueueServiceProvider\";\nimport { ApiRouteDispatcher } from \"../services/router/ApiRouteDispatcher\";\nimport { ViewRouteDispatcher } from \"../services/router/ViewRouteDispatcher\";\nimport { DomainRouter } from \"../services/router/DomainRouter\";\nimport { runGlobalMiddleware } from \"../services/router/globalMiddleware\";\nimport { kernelContext } from \"./context\";\nimport { frameworkProviders } from \"./providers\";\n\n/**\n * The app's entry point into the framework. A Kernel subclass declares what the\n * app adds — its `config` slices and any extra `providers` — and everything\n * else lives in the Application container it owns.\n */\nexport class Kernel {\n  /**\n   * App-level config, merged over the framework defaults. Each key is a config\n   * slice: `{ mail: { ... }, route: { ... } }`, normally the modules under\n   * `app/config`.\n   */\n  protected config: ConfigItems = {};\n\n  /**\n   * App-level providers, registered after the framework's own so they can\n   * rebind anything the framework bound.\n   */\n  protected providers: ServiceProviderConstructor[] = [];\n\n  /**\n   * The app's own singleton services. Each is constructed during the\n   * synchronous boot phase and its `boot()` awaited during the asynchronous\n   * one, in the order listed — so a service whose `boot()` depends on another\n   * goes after it.\n   *\n   * An entry is either the class itself or a configured instance from\n   * `Service.with({ ... })`. Listing is explicit rather than discovered because\n   * the order is load-bearing here, and because a service is always imported by\n   * whatever injects it — there is no file the import graph would miss.\n   */\n  protected services: Array<ServiceConstructor | Service> = [];\n\n  private serviceInstances: Service[] = [];\n  private serviceTokens = new Set<string>();\n  private servicesBooted = false;\n\n  /**\n   * The modules holding the app's model classes — normally\n   * `[generated, models]`, the generated namespace and the barrel of subclasses\n   * written over it. Every model class they export is registered under the name\n   * its schema carries, later modules winning, and the whole set is audited\n   * before anything else boots.\n   *\n   * ### Why this is a Kernel field and not a line in a file somewhere\n   *\n   * Registration used to be `register(\"User\", User)` next to each subclass, and\n   * the failure mode of forgetting it is an authorization hole that nothing\n   * reports: a relation read resolves its target by name, so an unregistered\n   * policied subclass leaves the generated base owning the name and every\n   * nested `include` of that model comes back unscoped. No error at the root\n   * either, because `$exec`'s divergence guard begins `registered !== this` and\n   * the base it is running on *is* the registered one. A model only ever read\n   * through an include — a membership, a pivot, the kind that carries a tenant\n   * scope — never trips anything.\n   *\n   * Listing the modules here says it once, in the same place the app already\n   * declares its config slices and providers, and turns the mistake into a\n   * failure to boot rather than a quiet cross-tenant read.\n   *\n   * It sees the modules it is given, so a model class in a file that no barrel\n   * re-exports is still invisible. That is the residual, and it is a smaller\n   * one: a barrel is a place to notice an omission, and thirteen `register`\n   * lines scattered across thirteen files is not.\n   */\n  protected models: Array<Record<string, unknown>> = [];\n\n  readonly app = new Application();\n\n  /**\n   * Phase one, synchronous: every provider is constructed and its `register()`\n   * runs. Only bindings are recorded here — no service is instantiated, so this\n   * is safe to call from a synchronous constructor (`new App({ kernel })`).\n   * Phase two is `waitForBoot()`.\n   */\n  boot() {\n    // Before the container, deliberately. This throws on a model whose policies\n    // would be skipped, and the useful moment for that is the one where nothing\n    // has been constructed and no request can be in flight.\n    if (this.models.length > 0) registerModels(...this.models);\n    else warnIfModelsAreRegisteredButUndeclared();\n\n    this.app.config.merge(this.config);\n    Application.setInstance(this.app);\n    this.app.registerMany([...frameworkProviders, ...this.providers]);\n    this.registerServices();\n  }\n\n  /**\n   * Constructs every listed service and binds it into the container. Runs after\n   * the providers have registered, so a provider's `boot()` can `inject()` one;\n   * a `Service` constructor does no I/O, so doing this synchronously costs\n   * nothing beyond the field initializers.\n   */\n  private registerServices() {\n    // What a previous pass bound, so re-running this on the same kernel is not\n    // mistaken for a collision with something else.\n    const ours = this.serviceTokens;\n\n    this.serviceInstances = [];\n    this.serviceTokens = new Set();\n    this.servicesBooted = false;\n\n    const owners = new Map<string, string>();\n\n    for (const declaration of this.services) {\n      const instance =\n        typeof declaration === \"function\" ? new declaration() : declaration;\n      const ctor = instance.constructor as ServiceConstructor;\n\n      if (!ctor.token) {\n        throw new Error(\n          `Service [${ctor.name}] is listed in \\`services\\` but does not declare a \\`static token\\`.`,\n        );\n      }\n\n      // Two services under one token is the failure this refuses to have\n      // silently: the second would replace the first in the container, and\n      // every `inject()` written against either would hand back whichever was\n      // listed last.\n      const owner = owners.get(ctor.token);\n      if (owner) {\n        throw new Error(\n          `Services [${owner}] and [${ctor.name}] both declare the token \"${ctor.token}\". Tokens are the container's keys, so they must be unique.`,\n        );\n      }\n      owners.set(ctor.token, ctor.name);\n\n      // The same failure one level out. `Container.instance()` writes into\n      // `instances`, which `make()` consults before `bindings`, so a token that\n      // is already spoken for is not shared with its owner — it replaces it, for\n      // every `app()` and `inject()` in the process. An app service that named\n      // itself \"mail\" would leave `Mail.send()` resolving to an object with no\n      // `send`, and the boot that caused it would report nothing. Providers have\n      // all registered by now, so anything bound here belongs to somebody else.\n      const token = ctor as unknown as ServiceToken<Service>;\n      if (!ours.has(ctor.token) && this.app.bound(token)) {\n        throw new Error(\n          `Service [${ctor.name}] declares the token \"${ctor.token}\", which is already bound in the container by the framework or a provider. Binding it would replace that service everywhere, so pick a token nothing else owns.`,\n        );\n      }\n\n      this.app.instance(token, instance);\n      this.serviceInstances.push(instance);\n      this.serviceTokens.add(ctor.token);\n    }\n  }\n\n  /**\n   * Phase two, asynchronous: every provider's `boot()` runs, in registration\n   * order, after all of them have registered. Idempotent.\n   */\n  async waitForBoot() {\n    await this.app.boot();\n    await this.bootServices();\n    // Last, once every job — queued listeners included — is registered.\n    startClaimingIfServing(this.app);\n  }\n\n  /**\n   * Phase two for services, after every provider's `boot()` — so a service may\n   * use the facades and anything else a provider owns. Idempotent, like the\n   * provider phase it follows.\n   */\n  private async bootServices() {\n    if (this.servicesBooted) {\n      return;\n    }\n    for (const service of this.serviceInstances) {\n      await service.boot();\n    }\n    this.servicesBooted = true;\n  }\n\n  /**\n   * Every provider's `shutdown()`, in reverse registration order, inside the\n   * application context — so a hook may use the facades, as a cron tick or a\n   * request would. See `Application.shutdown` for the deadline and the\n   * report. Idempotent.\n   */\n  shutdown(options?: { timeoutMs?: number }): Promise<ShutdownReport> {\n    return this.run(() => this.app.shutdown(options));\n  }\n\n  run<T>(cb: () => T) {\n    return kernelContext.run(this.app, cb);\n  }\n\n  /**\n   * Resolve a service by token. Callers outside this module should prefer the\n   * named accessors below or `app()`; this exists for tooling that holds a\n   * Kernel but no ambient context.\n   */\n  resolve<T>(token: ServiceToken<T>): T {\n    return this.app.make(token);\n  }\n\n  // Named accessors. `app/App.ts` goes through these rather than importing the\n  // service classes itself — see the note in that file about the two copies of\n  // gemi that coexist at build time.\n  apiRoutes(): ApiRouteDispatcher {\n    return this.app.make(ApiRouteDispatcher);\n  }\n\n  viewRoutes(): ViewRouteDispatcher {\n    return this.app.make(ViewRouteDispatcher);\n  }\n\n  domains(): DomainRouter {\n    return this.app.make(DomainRouter);\n  }\n\n  queue(): QueueManager {\n    return this.app.make(QueueManager);\n  }\n\n  /** The MCP endpoint, or `null` when `route.mcp.remote` is not enabled. */\n  mcpHttp(): McpHttpServer | null {\n    return this.app.config.get(\"route.mcp.remote.enabled\") === true\n      ? this.app.make(McpHttpServer)\n      : null;\n  }\n\n  /** The `global` middleware list for one request. Call it inside `run`. */\n  globalMiddleware(req: Request) {\n    return runGlobalMiddleware(req);\n  }\n\n  destroy() {\n    // Only touch services that were actually resolved — resolving one here\n    // would construct it purely to tear it down.\n    if (this.app.resolved(Scheduler)) {\n      this.app.make(Scheduler).stop();\n    }\n\n    this.app.flush();\n\n    if (Application.getInstance() === this.app) {\n      Application.setInstance(undefined);\n    }\n\n    kernelContext.disable();\n  }\n}\n\n/**\n * Says something to an application that has models and has not declared them.\n *\n * Without this the fix for #316 defaults to off. `models` is `[]`, `boot()`\n * no-ops, and an app upgrading from 0.48 is in exactly the state the issue\n * describes until somebody edits their Kernel by hand — while the only place\n * that says to is the **Setup** section of `docs/orm.md`, which an existing app\n * read once and will not read again. #316 was filed by an app mid-migration\n * with a 79-model schema, which is precisely the reader who never sees it.\n *\n * The condition is what makes this worth printing. A populated registry with an\n * empty `models` means the generated `index.ts` was imported and its bases are\n * what every nested read resolves to — so if any policy lives on a subclass, it\n * is being skipped inside includes right now. A Kernel with no ORM at all has\n * an empty registry and hears nothing.\n *\n * Development only, and a warning rather than a throw: an app in this state is\n * running today, and turning a working deploy into a failure to start over an\n * arrangement that *might* be fine is not a patch-level thing to do. The\n * failure it points at is silent, so the fix for it has to be noisy somewhere,\n * and the terminal an author is already looking at is the cheapest somewhere\n * there is.\n */\nfunction warnIfModelsAreRegisteredButUndeclared(): void {\n  if (process.env.NODE_ENV === \"production\") return;\n\n  const registered = registeredNames();\n  if (registered.length === 0) return;\n\n  console.warn(\n    `[gemi] ${registered.length} model${registered.length === 1 ? \" is\" : \"s are\"} ` +\n      `registered, but Kernel.models is empty.\\n` +\n      `        Nested relation reads resolve a model by name, so a policy on a ` +\n      `subclass that does not own its\\n` +\n      `        name is skipped inside every include — scoped at the root, ` +\n      `unscoped in an include, with nothing\\n` +\n      `        to notice it. Declaring the modules registers each class under ` +\n      `its own name and audits the set:\\n\\n` +\n      `            import * as generated from \"../models/generated\"\\n` +\n      `            import * as models from \"../models\"\\n\\n` +\n      `            export default class extends Kernel {\\n` +\n      `              models = [generated, models]\\n` +\n      `            }\\n\\n` +\n      `        See docs/orm.md#your-model-class. Development only; this never ` +\n      `prints in production.`,\n  );\n}\n"
   ],
-  "mappings": ";24CAqCA,IAAS,HAAe,JAAC,HAAoB,JAC3C,DAAM,HAAe,HAAS,GAAQ,DAAI,UAAe,FAAG,OAAY,FAAK,FAC7E,CAAO,0BAA+B,AAAK,JAAY,HAGzD,DAAM,FAAY,DAAI,DAEhB,FAAuC,JAC3C,GAAS,AACT,MAAO,CAAC,IAAa,EACrB,QAAS,IACX,EA8BA,eAAsB,CAAmB,CAAC,EAAgD,CACxF,IAAM,EAAW,EAAI,CAAkB,EACvC,GAAI,EAAS,OAAO,OAAO,SAAW,EACpC,OAAO,GAGT,IAAQ,YAAa,IAAI,IAAI,EAAI,GAAG,EAC9B,EAAQ,EAAU,CAAQ,EAC1B,EAAc,IAAI,EAAY,EAAK,CAAC,EAAG,EAAQ,MAAQ,OAAQ,EAAE,EAEvE,OAAO,MAAM,EAAe,IAAI,EAAa,SAAY,CACvD,IAAM,EAAM,EAAe,SAAS,GAE5B,UAAS,YAAY,EACvB,EAAQ,CAAC,IAAuB,CACpC,GAAI,CAAC,GAAgB,CAAQ,EAC3B,OAAO,EAAyB,EAAU,EAAS,EAAO,EAE5D,IAAM,EAAiB,IAAI,QAAQ,CAAO,EAE1C,OADA,EAAe,OAAO,YAAY,EAC3B,EAAyB,EAAU,EAAgB,EAAS,GAGrE,GAAI,CAEF,OADA,MAAM,EAAS,oBAAoB,EAC5B,CAAE,QAAS,KAAM,QAAO,QAAS,CAAE,KAAM,EAAI,IAAK,CAAE,EAC3D,MAAO,EAAK,CACZ,IAAM,EAAa,CAAC,GAAS,EAAS,SAAS,OAAO,EACtD,GAAI,GAAK,OAAS,EAA4B,CAC5C,IAAM,EAAU,EACZ,EAAc,EAAI,QAAQ,GAAG,EAC7B,EACE,EAAsB,EAAI,QAAQ,UAAY,EAAI,QAAQ,GAAG,EAC7D,EAAkB,EAAI,QAAQ,IAAI,EACxC,MAAO,CAAE,QAAS,EAAM,CAAO,EAAG,QAAO,QAAS,IAAK,EAOzD,GAAI,EAAsB,CAAG,IAAM,GAAS,GAC1C,MAAO,CAAE,QAAS,EAAM,EAAiB,CAAC,EAAG,QAAO,QAAS,IAAK,EAEpE,GAAI,EAAoB,CAAG,EAAG,CAC5B,QAAQ,MAAM,CAAG,EACjB,IAAM,EACJ,GAAS,EAAa,EAAqB,EAAI,EAAkB,EAAiB,CAAC,EACrF,MAAO,CAAE,QAAS,EAAM,CAAO,EAAG,QAAO,QAAS,IAAK,EAEzD,MAAM,SACN,CACA,EAAI,QAAQ,GAEf,EC7FI,IAAM,EAAmD,CAC9D,EACA,EACA,EAGA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,CACF,ECrCO,MAAM,EAAO,CAMR,OAAsB,CAAC,EAMvB,UAA0C,CAAC,EAa3C,SAAgD,CAAC,EAEnD,iBAA8B,CAAC,EAC/B,cAAgB,IAAI,IACpB,eAAiB,GA8Bf,OAAyC,CAAC,EAE3C,IAAM,IAAI,EAQnB,IAAI,EAAG,CAIL,GAAI,KAAK,OAAO,OAAS,EAAG,EAAe,GAAG,KAAK,MAAM,EACpD,QAAuC,EAE5C,KAAK,IAAI,OAAO,MAAM,KAAK,MAAM,EACjC,EAAY,YAAY,KAAK,GAAG,EAChC,KAAK,IAAI,aAAa,CAAC,GAAG,EAAoB,GAAG,KAAK,SAAS,CAAC,EAChE,KAAK,iBAAiB,EAShB,gBAAgB,EAAG,CAGzB,IAAM,EAAO,KAAK,cAElB,KAAK,iBAAmB,CAAC,EACzB,KAAK,cAAgB,IAAI,IACzB,KAAK,eAAiB,GAEtB,IAAM,EAAS,IAAI,IAEnB,QAAW,KAAe,KAAK,SAAU,CACvC,IAAM,EACJ,OAAO,IAAgB,WAAa,IAAI,EAAgB,EACpD,EAAO,EAAS,YAEtB,GAAI,CAAC,EAAK,MACR,MAAU,MACR,YAAY,EAAK,0EACnB,EAOF,IAAM,EAAQ,EAAO,IAAI,EAAK,KAAK,EACnC,GAAI,EACF,MAAU,MACR,aAAa,WAAe,EAAK,iCAAiC,EAAK,kEACzE,EAEF,EAAO,IAAI,EAAK,MAAO,EAAK,IAAI,EAShC,IAAM,EAAQ,EACd,GAAI,CAAC,EAAK,IAAI,EAAK,KAAK,GAAK,KAAK,IAAI,MAAM,CAAK,EAC/C,MAAU,MACR,YAAY,EAAK,6BAA6B,EAAK,sKACrD,EAGF,KAAK,IAAI,SAAS,EAAO,CAAQ,EACjC,KAAK,iBAAiB,KAAK,CAAQ,EACnC,KAAK,cAAc,IAAI,EAAK,KAAK,QAQ/B,YAAW,EAAG,CAClB,MAAM,KAAK,IAAI,KAAK,EACpB,MAAM,KAAK,aAAa,EAExB,GAAuB,KAAK,GAAG,OAQnB,aAAY,EAAG,CAC3B,GAAI,KAAK,eACP,OAEF,QAAW,KAAW,KAAK,iBACzB,MAAM,EAAQ,KAAK,EAErB,KAAK,eAAiB,GASxB,QAAQ,CAAC,EAA2D,CAClE,OAAO,KAAK,IAAI,IAAM,KAAK,IAAI,SAAS,CAAO,CAAC,EAGlD,GAAM,CAAC,EAAa,CAClB,OAAO,EAAc,IAAI,KAAK,IAAK,CAAE,EAQvC,OAAU,CAAC,EAA2B,CACpC,OAAO,KAAK,IAAI,KAAK,CAAK,EAM5B,SAAS,EAAuB,CAC9B,OAAO,KAAK,IAAI,KAAK,CAAkB,EAGzC,UAAU,EAAwB,CAChC,OAAO,KAAK,IAAI,KAAK,CAAmB,EAG1C,OAAO,EAAiB,CACtB,OAAO,KAAK,IAAI,KAAK,CAAY,EAGnC,KAAK,EAAiB,CACpB,OAAO,KAAK,IAAI,KAAK,CAAY,EAInC,gBAAgB,CAAC,EAAc,CAC7B,OAAO,EAAoB,CAAG,EAGhC,OAAO,EAAG,CAGR,GAAI,KAAK,IAAI,SAAS,CAAS,EAC7B,KAAK,IAAI,KAAK,CAAS,EAAE,KAAK,EAKhC,GAFA,KAAK,IAAI,MAAM,EAEX,EAAY,YAAY,IAAM,KAAK,IACrC,EAAY,YAAY,MAAS,EAGnC,EAAc,QAAQ,EAE1B,CAyBA,SAAS,EAAsC,EAAS,CACtD,GAAI,mBAAyB,aAAc,OAE3C,IAAM,EAAa,EAAgB,EACnC,GAAI,EAAW,SAAW,EAAG,OAE7B,QAAQ,KACN,UAAU,EAAW,eAAe,EAAW,SAAW,EAAI,MAAQ;AAAA;AAAA,EAIpE,2EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6FAUJ",
-  "debugId": "76AB660A5C6666BA64756E2164756E21",
+  "mappings": ";o5CAqCA,IAAS,HAAe,JAAC,HAAoB,JAC3C,DAAM,HAAe,HAAS,GAAQ,DAAI,UAAe,FAAG,OAAY,FAAK,FAC7E,CAAO,0BAA+B,AAAK,JAAY,HAGzD,DAAM,FAAY,DAAI,DAEhB,FAAuC,JAC3C,GAAS,AACT,MAAO,CAAC,IAAa,EACrB,QAAS,IACX,EA8BA,eAAsB,CAAmB,CAAC,EAAgD,CACxF,IAAM,EAAW,EAAI,CAAkB,EACvC,GAAI,EAAS,OAAO,OAAO,SAAW,EACpC,OAAO,GAGT,IAAQ,YAAa,IAAI,IAAI,EAAI,GAAG,EAC9B,EAAQ,EAAU,CAAQ,EAC1B,EAAc,IAAI,EAAY,EAAK,CAAC,EAAG,EAAQ,MAAQ,OAAQ,EAAE,EAEvE,OAAO,MAAM,EAAe,IAAI,EAAa,SAAY,CACvD,IAAM,EAAM,EAAe,SAAS,GAE5B,UAAS,YAAY,EACvB,EAAQ,CAAC,IAAuB,CACpC,GAAI,CAAC,GAAgB,CAAQ,EAC3B,OAAO,EAAyB,EAAU,EAAS,EAAO,EAE5D,IAAM,EAAiB,IAAI,QAAQ,CAAO,EAE1C,OADA,EAAe,OAAO,YAAY,EAC3B,EAAyB,EAAU,EAAgB,EAAS,GAGrE,GAAI,CAEF,OADA,MAAM,EAAS,oBAAoB,EAC5B,CAAE,QAAS,KAAM,QAAO,QAAS,CAAE,KAAM,EAAI,IAAK,CAAE,EAC3D,MAAO,EAAK,CACZ,IAAM,EAAa,CAAC,GAAS,EAAS,SAAS,OAAO,EACtD,GAAI,GAAK,OAAS,EAA4B,CAC5C,IAAM,EAAU,EACZ,EAAc,EAAI,QAAQ,GAAG,EAC7B,EACE,EAAsB,EAAI,QAAQ,UAAY,EAAI,QAAQ,GAAG,EAC7D,EAAkB,EAAI,QAAQ,IAAI,EACxC,MAAO,CAAE,QAAS,EAAM,CAAO,EAAG,QAAO,QAAS,IAAK,EAOzD,GAAI,EAAsB,CAAG,IAAM,GAAS,GAC1C,MAAO,CAAE,QAAS,EAAM,EAAiB,CAAC,EAAG,QAAO,QAAS,IAAK,EAEpE,GAAI,EAAoB,CAAG,EAAG,CAC5B,QAAQ,MAAM,CAAG,EACjB,IAAM,EACJ,GAAS,EAAa,EAAqB,EAAI,EAAkB,EAAiB,CAAC,EACrF,MAAO,CAAE,QAAS,EAAM,CAAO,EAAG,QAAO,QAAS,IAAK,EAEzD,MAAM,SACN,CACA,EAAI,QAAQ,GAEf,EC7FI,IAAM,EAAmD,CAC9D,EACA,EACA,EAGA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,EACA,CACF,ECpCO,MAAM,EAAO,CAMR,OAAsB,CAAC,EAMvB,UAA0C,CAAC,EAa3C,SAAgD,CAAC,EAEnD,iBAA8B,CAAC,EAC/B,cAAgB,IAAI,IACpB,eAAiB,GA8Bf,OAAyC,CAAC,EAE3C,IAAM,IAAI,EAQnB,IAAI,EAAG,CAIL,GAAI,KAAK,OAAO,OAAS,EAAG,EAAe,GAAG,KAAK,MAAM,EACpD,QAAuC,EAE5C,KAAK,IAAI,OAAO,MAAM,KAAK,MAAM,EACjC,EAAY,YAAY,KAAK,GAAG,EAChC,KAAK,IAAI,aAAa,CAAC,GAAG,EAAoB,GAAG,KAAK,SAAS,CAAC,EAChE,KAAK,iBAAiB,EAShB,gBAAgB,EAAG,CAGzB,IAAM,EAAO,KAAK,cAElB,KAAK,iBAAmB,CAAC,EACzB,KAAK,cAAgB,IAAI,IACzB,KAAK,eAAiB,GAEtB,IAAM,EAAS,IAAI,IAEnB,QAAW,KAAe,KAAK,SAAU,CACvC,IAAM,EACJ,OAAO,IAAgB,WAAa,IAAI,EAAgB,EACpD,EAAO,EAAS,YAEtB,GAAI,CAAC,EAAK,MACR,MAAU,MACR,YAAY,EAAK,0EACnB,EAOF,IAAM,EAAQ,EAAO,IAAI,EAAK,KAAK,EACnC,GAAI,EACF,MAAU,MACR,aAAa,WAAe,EAAK,iCAAiC,EAAK,kEACzE,EAEF,EAAO,IAAI,EAAK,MAAO,EAAK,IAAI,EAShC,IAAM,EAAQ,EACd,GAAI,CAAC,EAAK,IAAI,EAAK,KAAK,GAAK,KAAK,IAAI,MAAM,CAAK,EAC/C,MAAU,MACR,YAAY,EAAK,6BAA6B,EAAK,sKACrD,EAGF,KAAK,IAAI,SAAS,EAAO,CAAQ,EACjC,KAAK,iBAAiB,KAAK,CAAQ,EACnC,KAAK,cAAc,IAAI,EAAK,KAAK,QAQ/B,YAAW,EAAG,CAClB,MAAM,KAAK,IAAI,KAAK,EACpB,MAAM,KAAK,aAAa,EAExB,GAAuB,KAAK,GAAG,OAQnB,aAAY,EAAG,CAC3B,GAAI,KAAK,eACP,OAEF,QAAW,KAAW,KAAK,iBACzB,MAAM,EAAQ,KAAK,EAErB,KAAK,eAAiB,GASxB,QAAQ,CAAC,EAA2D,CAClE,OAAO,KAAK,IAAI,IAAM,KAAK,IAAI,SAAS,CAAO,CAAC,EAGlD,GAAM,CAAC,EAAa,CAClB,OAAO,EAAc,IAAI,KAAK,IAAK,CAAE,EAQvC,OAAU,CAAC,EAA2B,CACpC,OAAO,KAAK,IAAI,KAAK,CAAK,EAM5B,SAAS,EAAuB,CAC9B,OAAO,KAAK,IAAI,KAAK,CAAkB,EAGzC,UAAU,EAAwB,CAChC,OAAO,KAAK,IAAI,KAAK,CAAmB,EAG1C,OAAO,EAAiB,CACtB,OAAO,KAAK,IAAI,KAAK,CAAY,EAGnC,KAAK,EAAiB,CACpB,OAAO,KAAK,IAAI,KAAK,EAAY,EAInC,OAAO,EAAyB,CAC9B,OAAO,KAAK,IAAI,OAAO,IAAI,0BAA0B,IAAM,GACvD,KAAK,IAAI,KAAK,CAAa,EAC3B,KAIN,gBAAgB,CAAC,EAAc,CAC7B,OAAO,EAAoB,CAAG,EAGhC,OAAO,EAAG,CAGR,GAAI,KAAK,IAAI,SAAS,CAAS,EAC7B,KAAK,IAAI,KAAK,CAAS,EAAE,KAAK,EAKhC,GAFA,KAAK,IAAI,MAAM,EAEX,EAAY,YAAY,IAAM,KAAK,IACrC,EAAY,YAAY,MAAS,EAGnC,EAAc,QAAQ,EAE1B,CAyBA,SAAS,EAAsC,EAAS,CACtD,GAAI,mBAAyB,aAAc,OAE3C,IAAM,EAAa,EAAgB,EACnC,GAAI,EAAW,SAAW,EAAG,OAE7B,QAAQ,KACN,UAAU,EAAW,eAAe,EAAW,SAAW,EAAI,MAAQ;AAAA;AAAA,EAIpE,2EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6FAUJ",
+  "debugId": "D9DA50E00E2139D764756E2164756E21",
   "names": []
 }