gemi 0.123.0 → 0.125.0

package/dist/services/router/globalMiddleware.d.ts

@@ -25,9 +25,10 @@ export interface GlobalMiddlewareOutcome {
  * `HttpRequest` a global middleware gets has no params and an empty
  * `routePath`, and its `kind` is read off the url the way `App.fetch` picks a
  * dispatcher. The scope is not the one the route later runs in: the route's
- * dispatcher opens a fresh one, as it always has. Two things cross over.
- * Headers and cookies reach the response through `apply`, and the user is
- * `carried` into the route's context, so a gate that looked the user up does
+ * dispatcher opens a fresh one, as it always has. Three things cross over.
+ * Headers and cookies reach the response through `apply`; the request state
+ * the list set (`req.state`, #887) is `carried` into the route's request; and
+ * so is the user, so a gate that looked the user up does
  * not make `auth` or `Auth.user()` look them up again. Both trust a user they
  * find on the context without checking it against a session or asking for a
  * token, so whatever a global middleware sets is treated as authenticated by

package/dist/services/router/globalMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"globalMiddleware.d.ts","sourceRoot":"","sources":["../../../services/router/globalMiddleware.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,2BAA2B,CAAC;AAShF,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IACzB;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACpC;;;OAGG;IACH,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;CAChC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAuDxF"}
+{"version":3,"file":"globalMiddleware.d.ts","sourceRoot":"","sources":["../../../services/router/globalMiddleware.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAkB,MAAM,2BAA2B,CAAC;AAShF,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IACzB;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACpC;;;OAGG;IACH,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;CAChC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAuDxF"}

package/dist/stats/route-table.js

@@ -1,4 +1,4 @@
 // @bun
-import"../chunk-ay8nat73.js";import M from"path";import{writeFileSync as Q}from"fs";var L=new Set(["FILE","REDIRECT"]);function H(j){return j.run(()=>{let x=[];for(let{group:z,view:D}of j.domains().viewGroups())for(let[G,B]of Object.entries(D.flatViewRoutes)){let C=D.routeManifest[G]??B.segments.map((K)=>K.viewPath);if(C.length===0||L.has(C.at(-1)))continue;x.push({path:G,group:z,views:C,...B.static?{static:{...B.static.layout?{layout:B.static.layout}:{},...B.static.navigation?{navigation:!0}:{}}}:{}})}return x})}var J=process.argv[2];async function U(){if(!J)throw Error("usage: route-table <out.json>");let j=M.resolve(process.cwd(),"app/kernel/Kernel.ts"),x=await import(j);if(typeof x.default!=="function")throw Error(`${j} has no default export (the Kernel subclass).`);let z=new x.default;z.boot();try{Q(J,JSON.stringify(H(z)))}finally{z.destroy()}}U().then(()=>process.exit(0),(j)=>{console.error(j?.stack??String(j)),process.exit(1)});
+import"../chunk-hxn0s3zh.js";import M from"path";import{writeFileSync as Q}from"fs";var L=new Set(["FILE","REDIRECT"]);function H(j){return j.run(()=>{let x=[];for(let{group:z,view:D}of j.domains().viewGroups())for(let[G,B]of Object.entries(D.flatViewRoutes)){let C=D.routeManifest[G]??B.segments.map((K)=>K.viewPath);if(C.length===0||L.has(C.at(-1)))continue;x.push({path:G,group:z,views:C,...B.static?{static:{...B.static.layout?{layout:B.static.layout}:{},...B.static.navigation?{navigation:!0}:{}}}:{}})}return x})}var J=process.argv[2];async function U(){if(!J)throw Error("usage: route-table <out.json>");let j=M.resolve(process.cwd(),"app/kernel/Kernel.ts"),x=await import(j);if(typeof x.default!=="function")throw Error(`${j} has no default export (the Kernel subclass).`);let z=new x.default;z.boot();try{Q(J,JSON.stringify(H(z)))}finally{z.destroy()}}U().then(()=>process.exit(0),(j)=>{console.error(j?.stack??String(j)),process.exit(1)});
 
 //# debugId=05EB0087C5A2060D64756E2164756E21

package/dist/support/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{Yc as Y}from"../chunk-30xxc6r7.js";import{ji as M}from"../chunk-73v34hw8.js";import{lj as P,nj as R}from"../chunk-hnrzm5pf.js";import"../chunk-kzstewtm.js";import{Cj as Q,Dj as U,Ej as V,Fj as W}from"../chunk-1kdga1b2.js";import"../chunk-ay8nat73.js";class S{static token;async boot(){}static inject(){if(!this.token)throw Error(`Service [${this.name}] does not declare a \`static token\`, so the container has no key to resolve it by.`);try{return R(this)}catch(x){throw Error(`Could not inject [${this.name}]. Services are constructed when the kernel boots, so `+"inject() only works from code that runs after that \u2014 a constructor default or a method "+`body, never module top level. Check that [${this.name}] is listed in \`services\` on your Kernel.`,{cause:x})}}static with(x){let f=new this;for(let[C,g]of Object.entries(x))if(g!==void 0)f[C]=g;return f}}import{readdir as z}from"fs/promises";import{join as B,parse as j}from"path";var H=[".ts",".tsx",".js",".mjs",".jsx"];function J(x={}){let f={};for(let[C,g]of Object.entries(x))f[C]=q(g);return new P(f)}async function L(x,f=new P){let C=[];try{C=await z(x)}catch(D){return f}let g=C.filter((D)=>{let{ext:v,name:F}=j(D);return H.includes(v)&&!F.startsWith(".")}).sort();for(let D of g){let{name:v}=j(D),F=await import(B(x,D));f.set(v,q(F))}return f}function q(x){if(x&&typeof x==="object"&&"default"in x)return x.default;return x}export{M as withDefaults,Q as sourceFiles,W as projectRoot,L as loadConfigFrom,V as discoverClasses,J as createConfigRepository,Y as ServiceProvider,S as Service,P as Repository,U as DiscoveryError};
+import{Ld as Y}from"../chunk-rmgkc3a2.js";import{dj as M}from"../chunk-sv125fqq.js";import{fk as P,hk as R}from"../chunk-6gwxvmjv.js";import"../chunk-rwmja4zs.js";import{Ak as W,xk as Q,yk as U,zk as V}from"../chunk-yhht1j7f.js";import"../chunk-hxn0s3zh.js";class S{static token;async boot(){}static inject(){if(!this.token)throw Error(`Service [${this.name}] does not declare a \`static token\`, so the container has no key to resolve it by.`);try{return R(this)}catch(x){throw Error(`Could not inject [${this.name}]. Services are constructed when the kernel boots, so `+"inject() only works from code that runs after that \u2014 a constructor default or a method "+`body, never module top level. Check that [${this.name}] is listed in \`services\` on your Kernel.`,{cause:x})}}static with(x){let f=new this;for(let[C,g]of Object.entries(x))if(g!==void 0)f[C]=g;return f}}import{readdir as z}from"fs/promises";import{join as B,parse as j}from"path";var H=[".ts",".tsx",".js",".mjs",".jsx"];function J(x={}){let f={};for(let[C,g]of Object.entries(x))f[C]=q(g);return new P(f)}async function L(x,f=new P){let C=[];try{C=await z(x)}catch(D){return f}let g=C.filter((D)=>{let{ext:v,name:F}=j(D);return H.includes(v)&&!F.startsWith(".")}).sort();for(let D of g){let{name:v}=j(D),F=await import(B(x,D));f.set(v,q(F))}return f}function q(x){if(x&&typeof x==="object"&&"default"in x)return x.default;return x}export{M as withDefaults,Q as sourceFiles,W as projectRoot,L as loadConfigFrom,V as discoverClasses,J as createConfigRepository,Y as ServiceProvider,S as Service,P as Repository,U as DiscoveryError};
 
-//# debugId=7EED1B372EF7426564756E2164756E21
+//# debugId=3937A60BDA2B21DC64756E2164756E21

package/dist/support/index.js.map

@@ -6,6 +6,6 @@
     "import { readdir } from \"node:fs/promises\";\nimport { join, parse } from \"node:path\";\n\nimport { Repository } from \"./Repository\";\n\nconst CONFIG_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".mjs\", \".jsx\"];\n\n// Builds a Repository from an already-imported map of config modules. The map\n// key becomes the top-level config key, so `{ mail: mailModule }` is readable\n// as `config.get(\"mail.driver\")`. Each entry may be either the module namespace\n// (its `default` export is unwrapped) or the config object itself.\nexport function createConfigRepository(\n  modules: Record<string, any> = {},\n): Repository {\n  const items: Record<string, any> = {};\n\n  for (const [key, mod] of Object.entries(modules)) {\n    items[key] = unwrap(mod);\n  }\n\n  return new Repository(items);\n}\n\n// Reads every config module in an app's `app/config` directory into a\n// Repository. The file's basename is the top-level key: `app/config/mail.ts`\n// populates `mail.*`. A missing directory yields an empty Repository so apps\n// that declare no config still boot.\nexport async function loadConfigFrom(\n  directory: string,\n  repository = new Repository(),\n): Promise<Repository> {\n  let entries: string[] = [];\n\n  try {\n    entries = await readdir(directory);\n  } catch (err) {\n    return repository;\n  }\n\n  const files = entries\n    .filter((entry) => {\n      const { ext, name } = parse(entry);\n      return CONFIG_EXTENSIONS.includes(ext) && !name.startsWith(\".\");\n    })\n    .sort();\n\n  for (const file of files) {\n    const { name } = parse(file);\n    const mod = await import(join(directory, file));\n    repository.set(name, unwrap(mod));\n  }\n\n  return repository;\n}\n\nfunction unwrap(mod: any) {\n  if (mod && typeof mod === \"object\" && \"default\" in mod) {\n    return mod.default;\n  }\n  return mod;\n}\n"
   ],
   "mappings": ";2RAgCO,CAAe,JAAQ,EAOrB,OAMD,AAAI,EAAkB,QAmBrB,OAAS,EAKX,CACH,GAAI,CAAC,KAAK,MACR,MAAU,MACR,YAAY,KAAK,0FACnB,EAGF,GAAI,CACF,OAAO,EAAI,IAAuB,EAClC,MAAO,EAAO,CACd,MAAU,MACR,qBAAqB,KAAK,6DACxB,+FACA,6CAA6C,KAAK,kDAEpD,CAAE,OAAM,CACV,SAoBG,KAAuB,CAAoB,EAA0B,CAC1E,IAAM,EAAW,IAAI,KACrB,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAS,EACjD,GAAI,IAAU,OAAW,EAAS,GAAO,EAE3C,OAAO,EAEX,CChHA,kBAAS,oBACT,eAAS,WAAM,aAIf,IAAM,EAAoB,CAAC,MAAO,OAAQ,MAAO,OAAQ,MAAM,EAMxD,SAAS,CAAsB,CACpC,EAA+B,CAAC,EACpB,CACZ,IAAM,EAA6B,CAAC,EAEpC,QAAY,EAAK,KAAQ,OAAO,QAAQ,CAAO,EAC7C,EAAM,GAAO,EAAO,CAAG,EAGzB,OAAO,IAAI,EAAW,CAAK,EAO7B,eAAsB,CAAc,CAClC,EACA,EAAa,IAAI,EACI,CACrB,IAAI,EAAoB,CAAC,EAEzB,GAAI,CACF,EAAU,MAAM,EAAQ,CAAS,EACjC,MAAO,EAAK,CACZ,OAAO,EAGT,IAAM,EAAQ,EACX,OAAO,CAAC,IAAU,CACjB,IAAQ,MAAK,QAAS,EAAM,CAAK,EACjC,OAAO,EAAkB,SAAS,CAAG,GAAK,CAAC,EAAK,WAAW,GAAG,EAC/D,EACA,KAAK,EAER,QAAW,KAAQ,EAAO,CACxB,IAAQ,QAAS,EAAM,CAAI,EACrB,EAAM,MAAa,SAAK,EAAW,CAAI,GAC7C,EAAW,IAAI,EAAM,EAAO,CAAG,CAAC,EAGlC,OAAO,EAGT,SAAS,CAAM,CAAC,EAAU,CACxB,GAAI,GAAO,OAAO,IAAQ,UAAY,YAAa,EACjD,OAAO,EAAI,QAEb,OAAO",
-  "debugId": "7EED1B372EF7426564756E2164756E21",
+  "debugId": "3937A60BDA2B21DC64756E2164756E21",
   "names": []
 }

package/dist/testing/index.js

@@ -1,4 +1,4 @@
-import { D as I18nProvider, F as createMemoryHistory, I as RealtimeContext, K as QueryManagerContext, L as channelKey, N as ProgressManager, O as ServerDataContext, P as Action, U as toVariantKey, W as applyParams, i as RouteTransitionProvider, o as ClientRouterContext, q as QueryManagerProvider, r as m, t as ThemeProvider, tt as Subject } from "../chunks/ThemeProvider-CgK2mmVV.js";
+import { D as I18nProvider, F as createMemoryHistory, I as RealtimeContext, K as QueryManagerContext, L as channelKey, N as ProgressManager, O as ServerDataContext, P as Action, U as toVariantKey, W as applyParams, i as RouteTransitionProvider, o as ClientRouterContext, q as QueryManagerProvider, r as m, t as ThemeProvider, tt as Subject } from "../chunks/ThemeProvider-CS2a1snV.js";
 import { r as RouteStateProvider } from "../chunks/useParams-BN3XXfmG.js";
 import { Suspense, createElement, useContext, useMemo, useRef, useState } from "react";
 import { jsx } from "react/jsx-runtime";

package/dist/vitest/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{fa as B,ga as D}from"../chunk-j8vc3bze.js";import"../chunk-0tc0j3pf.js";import"../chunk-9p7eq7bz.js";import{Aa as J}from"../chunk-w0jfqnw9.js";import"../chunk-dmj6ysym.js";import"../chunk-ay8nat73.js";function N(){return{name:"gemi-custom-request",enforce:"pre",async transform(G,H){let j=H.split("?",1)[0];if(j.includes("/node_modules/")||!B.test(j))return null;return{code:await D(G),map:null}}}}export{N as gemiRequestPlugin,J as gemiIslandPlugin};
+import{fa as B,ga as D}from"../chunk-zq5375wd.js";import"../chunk-dxyxd7b3.js";import"../chunk-hff9w6rt.js";import{Aa as J}from"../chunk-5fh4pvyt.js";import"../chunk-xe2pm36q.js";import"../chunk-hxn0s3zh.js";function N(){return{name:"gemi-custom-request",enforce:"pre",async transform(G,H){let j=H.split("?",1)[0];if(j.includes("/node_modules/")||!B.test(j))return null;return{code:await D(G),map:null}}}}export{N as gemiRequestPlugin,J as gemiIslandPlugin};
 
 //# debugId=C11E8611E15123D864756E2164756E21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gemi",
-  "version": "0.123.0",
+  "version": "0.125.0",
   "private": false,
   "license": "MIT",
   "author": "Enes Tufekci <enes@gemijs.dev>",

package/skills/gemi-react-best-practices/SKILL.md

@@ -141,7 +141,7 @@ carried for free.
 - `query-lazy-vs-mount-gate` - A lazy query does not refetch when its variant changes
 - `query-share-cache-key` - Identical path + params + search dedupes across components for free
 - `query-keep-previous-data` - Keep the previous page rendered while the next variant loads
-- `query-mutate-over-refetch` - Write the cache with `mutate` / `useMutate` instead of refetching
+- `query-mutate-over-refetch` - Write the cache with `mutate` / `useMutate` / `updates` instead of refetching
 - `query-debounce-search-variant` - Debounce a value before it becomes a query variant
 - `query-revalidate-on-focus` - Opt in only for cross-tab-mutable data; let `staleTime` gate it
 - `query-live-over-polling` - Prefer `live` / `useChannelInvalidate` over a bare `refetchUntil` poll

package/skills/gemi-react-best-practices/rules/query-mutate-over-refetch.md

@@ -44,6 +44,20 @@ mutate(
 );
 ```
 
+**When the mutation answers with the data, write the answer.** If the response
+is (or contains) what another query holds, pass `updates` to the mutation hook:
+the answer is written into that query before `onSuccess`, with no refetch at
+all. `useSetQueryData()` does the same by hand.
+
+```tsx
+const move = usePost("/pages/:pageId/assets/move", { params: { pageId } }, {
+  updates: [{ path: "/pages/:pageId/assets", params: { pageId } }],
+});
+const create = usePost("/todos", {}, {
+  updates: [{ path: "/todos", data: (created, todos) => [...todos, created] }],
+});
+```
+
 **Refetch, don't guess, when the server derives the value.** If a write changes
 counts, totals, credit balances or anything else computed server-side, call
 `mutate()` with no callback — it refetches without an optimistic write, which is

package/skills/gemi-react-best-practices/rules/routing-middleware-dsl.md

@@ -59,7 +59,8 @@ a route cannot cancel it with `-name`.
 **Rate-limit buckets are per client IP *and* route path**, so `/api/search` and
 `/api/upload` hold separate budgets — a shared limit needs a configured `key`
 function, and a budget outside a route uses the `RateLimiter` facade
-(`RateLimiter.consume(key, { limit, window })`).
+(`RateLimiter.consume(key, { limit, window })`, or `RateLimiter.enforce(key,
+{ limit, window }, message)` to throw the middleware's 429 over budget).
 
 Reference: `app/config/middleware.ts`, `app/http/routes/view.ts`
 <https://nstfkc.github.io/gemi/middleware.md>

package/dist/chunk-39dx7xrz.js

@@ -1,10 +0,0 @@
-// @bun
-import{Ub as J9,Xb as G3,Yb as F9,fc as x3}from"./chunk-d0wr9jk4.js";import{qc as v3,sc as V3,vc as C9,wc as T9,xc as d9,zc as r9}from"./chunk-enta97jb.js";import{Bc as _9,Gc as s9,Ic as L9,Kc as D9,Rc as D,Sc as A9,Tc as O9,Vc as j9}from"./chunk-08fcqny0.js";import{Yc as F}from"./chunk-30xxc6r7.js";import{$d as y3,$e as N3,He as d3,Je as l,Ne as p3,Oe as R9,Pe as E9,Ud as e,Ue as k3,Ve as b9,We as Z3,Xe as f9,Ye as w9,Zd as Y3,Ze as R3,_e as s,ae as C,af as w3,ee as h9,fe as m9,ff as u9,gf as c9,hd as p,he as b,ld as V9,lf as $$,pd as Z$,se as l9,te as h3,xe as U3}from"./chunk-gvp6brdt.js";import{Gg as c3,Ug as r3,Yg as J3,Zg as Q3,_g as $3,pg as u,rg as w}from"./chunk-z23h4s1a.js";import{eh as q9}from"./chunk-n1a2zj5z.js";import{kh as E}from"./chunk-kc924zjz.js";import{qh as f3}from"./chunk-ebx5hnqn.js";import{Bh as n9,th as p9,uh as g3,xh as H3,yh as u3}from"./chunk-nvngb4ed.js";import{Ph as M9,Uh as k9}from"./chunk-96a1459v.js";import{gi as P9,ii as v}from"./chunk-1f1sb3w7.js";import{ji as L}from"./chunk-73v34hw8.js";import{pi as a9}from"./chunk-2vc72qez.js";import{dj as m3}from"./chunk-fyk07w01.js";import{kj as K3,nj as k}from"./chunk-hnrzm5pf.js";import{wj as b3}from"./chunk-eevna943.js";import{Gj as y9}from"./chunk-rkgsvsrj.js";var X$="mcp",Y$=/^[\x21\x23-\x5B\x5D-\x7E]+$/;class O extends x3{status;constructor($,Z){super($);this.status=Z;this.name="McpToolError"}}class a extends Error{reason;constructor($,Z){super($);this.reason=Z;this.name="McpCallRefusedError"}}var K$=/^[A-Za-z0-9_-]{1,64}$/,Q$=/:([A-Za-z_][A-Za-z0-9_]*)([?*+]?)/g,l3=4000,c=1e5,U$=/^(text\/|application\/([\w.+-]*\+)?(json|xml))/i;class d{router;dispatcher;static token="router.mcp";plans=new Map;scopeTools=new Map;files;constructor($,Z,z={}){this.router=$;this.dispatcher=Z;this.files=V$(z.files);for(let[G,W]of Object.entries($.routes??{}))this.plans.set(G,this.plan(G,W));this.resolveScopes()}list($,Z){if(i3($),$.kind==="local")return this.descriptors(Z);let z=[];for(let[G,W]of this.plans){if(!W.remote||!this.grants($.principal,G))continue;if(n3(W.remote,Z))z.push(W.remote)}return z}descriptors($){let Z=[];for(let{descriptor:z}of this.plans.values())if(n3(z,$))Z.push(z);return Z}get maxFileBytes(){return this.files.maxBytes}scopes(){return[...this.scopeTools].map(([$,{description:Z}])=>({name:$,description:Z}))}scopesFor($){return[...this.scopeTools].filter(([,{tools:Z}])=>Z.has($)).map(([Z])=>Z)}async execute($,Z,z,G,W={}){i3($);let X=this.plans.get(Z);if($.kind==="remote"){if(!X?.remote||!this.grants($.principal,Z))throw new a(`There is no tool named "${Z}".`,"unknown-tool");if(X.descriptor.requiresApproval&&W.approved!==!0)throw new a(`"${Z}" needs the user's approval, and this call does not have it.`,"approval-required");G=void 0}if(!X)throw Error(`McpRegistry: there is no tool named "${Z}".`);let Y=X,K=$.kind==="remote"?Y.remote:Y.descriptor,U=K.inputSchema.safeParse(z);if(U.ok===!1)throw new O(`Invalid arguments for "${Z}": ${U.errors.join(", ")}`);let Q=U.value,H={caller:$,req:$.req,tool:K,input:Q,ctx:G},V=await this.fillPath(Y,H),{path:N}=this.dispatcher.getRouteHandlerAndParams(new Request(`http://gemi.internal/api${V}`));if(N!==K.url)throw new O(`"${Z}" has nothing at ${V}.`,404);let _={};for(let T of Y.jsonKeys)if(Q[T]!==void 0)_[T]=Q[T];let P,I="";if(Y.fileFields.length>0)P=await this.formData(Y,_,H);else if(K.method==="GET")I=A$(_);else if(Y.jsonKeys.length>0)P=_;let y=this.router.credentials?await this.bind(Y,"the credentials",()=>this.router.credentials(H)):void 0,m={...y?{credentials:y}:{},...W.signal?{signal:W.signal}:{},...W.progress?{progress:W.progress}:{},...$.kind==="remote"?{identity:{user:$.principal.user,grant:{via:$.principal.via,id:$.principal.id,scopes:$.principal.scopes,...$.principal.clientId?{clientId:$.principal.clientId}:{}}}}:{}},o;try{let T=I?`${V}?${I}`:V;o=Object.keys(m).length>0?await this.dispatcher.dispatchAs($.req,K.method,T,P,m):await this.dispatcher.dispatchAs($.req,K.method,T,P)}catch(T){throw console.error(`[gemi/mcp] Dispatching "${Z}" failed:`,T),new O(`"${Z}" failed on the server.`,500)}if(!Y.result&&!K.outputSchema)return await a3(Z,o);return await this.project(Y,H,o)}plan($,Z){if(!K$.test($))throw Error(`McpRouter: "${$}" is not a valid tool name. A routes key is the tool's name as a model and an MCP client see it, used verbatim \u2014 letters, digits, "_" and "-", at most 64.`);let z=`McpRouter: "${$}" (${Z?.method} ${Z?.url})`;if(!(Z instanceof Object)||Z.__internal_brand!=="McpRoute")throw Error(`McpRouter: "${$}" is not a route. Declare it with this.fromApiRoute(...).`);let{method:G,url:W,meta:X}=Z;if(W.startsWith("/__gemi__"))throw Error(`${z} is a framework route, not an app route.`);let Y=this.dispatcher.flatRoutes[W]?.[G];if(!Y)throw Error(`${z} names no route of this app. Expose a route by the path and verb it is mounted at.`);let K=[...W.matchAll(Q$)].map(([,J,A])=>({name:J,modifier:A})),U=X.params??{};for(let J of K)if(!(J.name in U))throw Error(`${z}: the path param "${J.name}" must be bound or declared "input".`);for(let[J,A]of Object.entries(U)){if(!K.some((f)=>f.name===J))throw Error(`${z}: "${J}" in params is not a param of the url.`);if(s3(A))x$(z,`params.${J}`,A);else t3(z,`params.${J}`,A)}let Q=[],H;if(X.input){if(H=X.input.toJSONSchema(),H.type!=="object"||!H.properties)throw Error(`${z}: input must be an s.object(...), the fields of the request body.`);Q=Object.keys(H.properties)}let V=Object.entries(X.files??{}).map(([J,A])=>({name:J,binder:A}));for(let J of V)t3(z,`files.${J.name}`,J.binder);if(X.result!==void 0&&typeof X.result!=="function")throw Error(`${z}: result must be a function.`);if(X.output!==void 0&&typeof X.output?.safeParse!=="function")throw Error(`${z}: output must be a schema, built with s.`);if(X.title!==void 0&&(typeof X.title!=="string"||X.title===""))throw Error(`${z}: title must be a non-empty string.`);let N=_$(z,G,X.annotations);if(V.length>0&&G==="GET")throw Error(`${z}: a GET has no body to carry a file.`);let _={},P=(J,A)=>{if(J in _)throw Error(`${z}: "${J}" is the input key of two params or files, and the model can only send one.`);_[J]=A},I=new Map,y=new Map;for(let J of K){let A=U[J.name];if(A==="input"){let f=u.string().describe(`The ":${J.name}" segment of the url.`);P(J.name,J.modifier==="?"||J.modifier==="*"?f.optional():f)}else if(s3(A)){let f=A.as??J.name;P(f,A.input),y.set(J.name,{key:f,param:A})}else I.set(J.name,A)}let m={};for(let J of V)if(J.binder==="input")P(J.name,u.string().describe("The id of an attachment the user uploaded or a tool produced (gemi_att_\u2026), whose file is sent as this field.")),m[J.name]=this.remoteFileSchema();let o=[...Object.keys(_),...V.map((J)=>J.name)];for(let J of new Set(o))if(Q.includes(J))throw Error(`${z}: "${J}" is both an input field and a param or file, and the model can only send one.`);let T=Object.freeze({name:$,description:X.description,method:G,url:W,inputSchema:o3(X.input,H,u.object(_)),...X.output?{outputSchema:X.output}:{},...X.title?{title:X.title}:{},annotations:N,tags:Object.freeze([...X.tags??[]]),requiresApproval:X.requiresApproval===!0,...Y.source?{source:Y.source}:{}}),W$=!V.every((J)=>J.binder==="input")?null:V.length===0?T:Object.freeze({...T,inputSchema:o3(X.input,H,u.object(L$(_,Object.keys(m))),m)});return{descriptor:T,remote:W$,params:K,paramBinders:I,modelParams:y,fileFields:V,jsonKeys:Q,...X.result?{result:X.result}:{}}}remoteFileSchema(){let{maxBytes:$,fetch:Z}=this.files,z={name:{type:"string",description:"The file's name, like report.pdf."},mimeType:{type:"string",description:"The file's media type, like application/pdf."},data:{type:"string",contentEncoding:"base64",description:`The file's bytes, base64-encoded (RFC 4648, standard alphabet). At most ${$} bytes decoded.`}};if(Z)z.url={type:"string",format:"uri",description:"An https URL the server downloads the file from, instead of data."};let G={type:"object",description:Z?"A file, sent as base64 in data or fetched from url: exactly one of the two.":"A file, sent as base64 in data.",properties:z,required:["name","mimeType"],additionalProperties:!1},W=Object.keys(z),X=(Y)=>{if(typeof Y!=="object"||Y===null||Array.isArray(Y))return{ok:!1,errors:["a file must be an object"]};let K=[],U={};for(let Q of Object.keys(Y))if(!W.includes(Q))K.push(`a file has no field "${Q}"`);for(let Q of W){let H=Y[Q];if(H===void 0||H===null){if(Q==="name"||Q==="mimeType")K.push(`a file needs "${Q}"`);continue}if(typeof H!=="string")K.push(`a file's "${Q}" must be a string`);else U[Q]=H}return K.length>0?{ok:!1,errors:K}:{ok:!0,value:U}};return{toJSONSchema:()=>G,safeParse:X,parse(Y){let K=X(Y);if(K.ok===!1)throw Error(K.errors.join(", "));return K.value}}}async fillPath($,Z){let{input:z,req:G}=Z,W=$.descriptor.url;for(let X of $.params){let Y=$.paramBinders.get(X.name),K=$.modelParams.get(X.name),U;if(Y||K){if(U=K?await this.bind($,`the param "${X.name}"`,()=>K.param.bind(z[K.key],G,Z),{refusals:!0}):await this.bind($,`the param "${X.name}"`,()=>Y(G,Z)),U===void 0||U===null||U==="")throw console.error(`[gemi/mcp] The ${K?"resolver":"binder"} for "${X.name}" of "${$.descriptor.name}" returned ${JSON.stringify(U)}.`),new O(`"${$.descriptor.name}" failed on the server.`,500)}else U=z[X.name];let Q=`:${X.name}${X.modifier}`;if(U===void 0||U===null||U===""){if(X.modifier!=="?"&&X.modifier!=="*")throw new O(`"${X.name}" of "${$.descriptor.name}" must not be empty.`);W=W.replace(`/${Q}`,"");continue}W=W.replace(Q,D$($.descriptor.name,X,String(U)))}return W}async formData($,Z,z){let{input:G,ctx:W}=z,X=$.descriptor.name;if(z.caller.kind==="remote"){let K=new FormData;for(let[U,Q]of Object.entries(Z))B3(K,U,Q);for(let U of $.fileFields)K.append(U.name,await this.remoteFile(X,U.name,G[U.name]));return K}if(!W)throw Error(`McpRegistry: "${X}" sends a file, which is resolved through the tool context's attachments, and none was passed to execute().`);let Y=new FormData;for(let[K,U]of Object.entries(Z))B3(Y,K,U);for(let K of $.fileFields){let U=K.binder==="input"?G[K.name]:await this.bind($,`the file "${K.name}"`,()=>K.binder(W,z));if(typeof U!=="string"||U==="")throw new O(`"${X}" needs a file for "${K.name}", and this turn has none. Ask the user to attach one.`);Y.append(K.name,await W.attachments.file(U))}return Y}async remoteFile($,Z,z){let G=(H)=>new O(`"${Z}" of "${$}" ${H}`,400),W=z,{maxBytes:X,fetch:Y}=this.files;if(!J$(W.name))throw G("needs a name of 1 to 255 characters, without control characters or slashes.");if(!F$.test(W.mimeType))throw G(`has a mimeType that is not a media type: "${W.mimeType.slice(0,100)}".`);let K=typeof W.data==="string",U=typeof W.url==="string";if(K===U)throw G(Y?"needs exactly one of data or url.":"needs its bytes, base64, in data.");if(K){let H=W.data.replace(/\s+/g,"");if(Math.floor(H.length*3/4)-B$(H)>X)throw G(`is larger than the ${X} bytes a file may be.`);if(H.length%4!==0||!N$.test(H))throw G("has data that is not base64 (RFC 4648, standard alphabet, padded).");return new File([Buffer.from(H,"base64")],W.name,{type:W.mimeType})}if(!Y)throw G("cannot be fetched from a URL here. Send its bytes, base64, in data.");let Q;try{Q=new URL(W.url)}catch{throw G("has a url that is not a URL.")}if(Q.protocol!=="https:")throw G("can only be fetched from an https URL.");try{let H=await r3(Q.href,{...Y,maxSize:Math.min(Y.maxSize??X,X),redirect:"follow"});if(!H.ok)throw G(`could not be fetched: ${Q.host} answered ${H.status}.`);let V=await H.arrayBuffer();return new File([V],W.name,{type:W.mimeType})}catch(H){if(H instanceof O)throw H;throw G(`could not be fetched from ${Q.host}: ${H instanceof Error?H.message:"failed"}.`)}}grants($,Z){for(let z of $.scopes??[])if(this.scopeTools.get(z)?.tools.has(Z))return!0;return!1}resolveScopes(){let $=this.router.scopes;if($===void 0){this.scopeTools.set(X$,{description:"Use this app's tools as you",tools:new Set(this.plans.keys())});return}if(typeof $!=="object"||$===null)throw Error("McpRouter: scopes must be an object of scope names.");let Z=new Set([...this.plans.values()].flatMap(({descriptor:z})=>z.tags));for(let[z,G]of Object.entries($)){let W=`McpRouter: scope "${z}"`;if(!Y$.test(z))throw Error(`${W} is not a valid OAuth scope: printable ASCII, no spaces or quotes.`);if(typeof G?.description!=="string"||G.description==="")throw Error(`${W} needs a description: it is what a consent screen shows.`);let X=new Set;for(let Y of G.tags??[]){if(!Z.has(Y))throw Error(`${W} names the tag "${Y}", which no tool has.`);for(let[K,{descriptor:U}]of this.plans)if(U.tags.includes(Y))X.add(K)}for(let Y of G.names??[]){if(!this.plans.has(Y))throw Error(`${W} names "${Y}", which is no tool.`);X.add(Y)}if(X.size===0)throw Error(`${W} reaches no tool. Give it tags or names.`);this.scopeTools.set(z,{description:G.description,tools:X})}}async project($,Z,z){let{name:G,outputSchema:W}=$.descriptor;if(z.status<200||z.status>=300)return await a3(G,z);let X=(V,N)=>{if(N===void 0)console.error(`[gemi/mcp] "${G}" ${V}`);else console.error(`[gemi/mcp] "${G}" ${V}`,N);return new O(`"${G}" failed on the server.`,500)},Y=z.headers.get("Content-Type"),K=await z.text(),U=null;if(K!=="")try{U=JSON.parse(K)}catch{throw X(`answered ${Y??"a body with no content-type"} that is not JSON, and its result or output needs JSON.`)}let Q=U;if($.result)try{Q=await $.result(U,Z)}catch(V){throw X("failed in its result projection:",V)}if(W){let V=W.safeParse(Q);if(V.ok===!1)throw X(`answered what its output schema refuses: ${V.errors.join(", ")}`);Q=V.value}if(Q===void 0)return null;let H=JSON.stringify(Q);if(H!==void 0&&H.length>c)return`${H.slice(0,c)}\u2026 [cut at ${c} of ${H.length} characters]`;return Q}async bind($,Z,z,G={}){try{return await z()}catch(W){if(G.refusals&&W instanceof x3)throw W;throw console.error(`[gemi/mcp] Binding ${Z} of "${$.descriptor.name}" failed:`,W),new O(`"${$.descriptor.name}" failed on the server.`,500)}}}function i3($){if($?.kind==="local"&&$.req)return;if($?.kind==="remote"&&$.req&&$.principal?.user&&typeof $.principal.id==="string"&&Array.isArray($.principal.scopes))return;throw Error('McpRegistry: a caller is { kind: "local", req } or { kind: "remote", req, principal }, with the principal a caller resolver verified.')}function n3($,Z){if(Z?.names&&!Z.names.includes($.name))return!1;if(Z?.tags&&!$.tags.some((z)=>Z.tags.includes(z)))return!1;return!0}var H$=10485760;function V$($){let Z=$?.maxBytes??H$;if(!Number.isSafeInteger(Z)||Z<=0)throw Error("McpRegistry: files.maxBytes must be a positive whole number of bytes.");let z=$?.fetchUrls===!0?{}:typeof $?.fetchUrls==="object"&&$.fetchUrls!==null?$.fetchUrls:null;return{maxBytes:Z,fetch:z}}function J$($){if($.length===0||$.length>255)return!1;for(let Z of $){let z=Z.codePointAt(0);if(z<32||z===127||Z==="/"||Z==="\\")return!1}return!0}var F$=/^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}(\s*;.{0,200})?$/,N$=/^[A-Za-z0-9+/]*={0,2}$/;function B$($){return $.endsWith("==")?2:$.endsWith("=")?1:0}function t3($,Z,z){if(z!=="input"&&typeof z!=="function")throw Error(`${$}: ${Z} must be a function or "input".`)}function s3($){return $ instanceof Object&&$.__internal_brand==="McpModelParam"}function x$($,Z,z){if(z.as!==void 0&&(typeof z.as!=="string"||z.as===""))throw Error(`${$}: ${Z}.as must be a non-empty string.`);let G=z.input;if(typeof G?.safeParse!=="function"||typeof G.toJSONSchema!=="function")throw Error(`${$}: ${Z}.input must be a schema, built with s.`);if(typeof z.bind!=="function")throw Error(`${$}: ${Z}.bind must be a function.`)}var I$=new Set(["readOnlyHint","destructiveHint","idempotentHint","openWorldHint"]);function P$($){switch($){case"GET":return{readOnlyHint:!0};case"DELETE":return{destructiveHint:!0};case"PUT":return{idempotentHint:!0};default:return{}}}function _$($,Z,z){if(z!==void 0&&(typeof z!=="object"||z===null))throw Error(`${$}: annotations must be an object of hints.`);let G=P$(Z);for(let[W,X]of Object.entries(z??{})){if(!I$.has(W))throw Error(`${$}: "${W}" is not a tool annotation. Use readOnlyHint, destructiveHint, idempotentHint or openWorldHint.`);if(X===void 0)continue;if(typeof X!=="boolean")throw Error(`${$}: annotations.${W} must be true or false.`);G[W]=X}if(G.readOnlyHint===!0&&(G.destructiveHint||G.idempotentHint))throw Error(`${$} is read-only${z?.readOnlyHint?"":` (a ${Z})`} and also ${G.destructiveHint?"destructive":"idempotent"}, which only a tool that is not read-only can be. Set readOnlyHint: false if it changes something.`);return Object.freeze(G)}function o3($,Z,z,G={}){let W=z.toJSONSchema(),X=Object.fromEntries(Object.entries(G).map(([U,Q])=>[U,Q.toJSONSchema()])),Y={...Z??{},type:"object",properties:{...Z?.properties??{},...W.properties,...X},required:[...Z?.required??[],...W.required??[],...Object.keys(G)],additionalProperties:!1},K=(U)=>{if(typeof U!=="object"||U===null||Array.isArray(U))return{ok:!1,errors:["expected an object"]};let Q=[],H={};if($){let N=$.safeParse(U);if(N.ok===!1)Q.push(...N.errors);else H={...N.value}}let V=z.safeParse(U);if(V.ok===!1)Q.push(...V.errors);else H={...H,...V.value};for(let[N,_]of Object.entries(G)){let P=U[N];if(P===void 0){Q.push(`"${N}" is required`);continue}let I=_.safeParse(P);if(I.ok===!1)Q.push(...I.errors.map((y)=>`${N}: ${y}`));else H[N]=I.value}return Q.length>0?{ok:!1,errors:Q}:{ok:!0,value:H}};return{toJSONSchema:()=>Y,safeParse:K,parse(U){let Q=K(U);if(Q.ok===!1)throw Error(Q.errors.join(", "));return Q.value}}}function L$($,Z){return Object.fromEntries(Object.entries($).filter(([z])=>!Z.includes(z)))}function D$($,Z,z){let G=Z.modifier==="*"||Z.modifier==="+"?z.split("/"):[z];if(G.some((W)=>W==="."||W===".."))throw new O(`"${z}" is not a valid value for "${Z.name}" of "${$}".`);return G.map(encodeURIComponent).join("/")}function B3($,Z,z){if(z===void 0||z===null)return;if(Array.isArray(z)){for(let G of z)B3($,Z,G);return}$.append(Z,typeof z==="object"?JSON.stringify(z):String(z))}function A$($){let Z=new URLSearchParams,z=(G,W)=>{if(W===void 0||W===null)return;if(Array.isArray(W)){for(let X of W)z(G,X);return}Z.append(G,typeof W==="object"?JSON.stringify(W):String(W))};for(let[G,W]of Object.entries($))z(G,W);return Z.toString()}async function a3($,Z){if(Z.status>=200&&Z.status<300){let G=Z.headers.get("Content-Type");if(G&&!U$.test(G)){let X=(await Z.arrayBuffer()).byteLength;return`"${$}" answered with ${X} bytes of ${G}, which is not shown.`}let W=await Z.text();if(W==="")return null;if(W.length>c)return`${W.slice(0,c)}\u2026 [cut at ${c} of ${W.length} characters]`;try{return JSON.parse(W)}catch{return W}}let z=await Z.text();if(Z.status>=400&&Z.status<500){let G=z.length>l3?`${z.slice(0,l3)}\u2026`:z;throw new O(`"${$}" was refused with ${Z.status}${G?`: ${G}`:"."}`,Z.status)}if(Z.status<500)console.error(`[gemi/mcp] "${$}" answered ${Z.status}${Z.headers.get("Location")?` to ${Z.headers.get("Location")}`:""}, which a tool call cannot follow.`);throw new O(`"${$}" failed on the server.`,Z.status)}import{createHash as O$,randomBytes as j$,timingSafeEqual as C$}from"crypto";function I3($){let Z=$.headers.get("authorization");if(!Z)return null;let z=/^Bearer[ ]+([\x21-\x7e]+)$/i.exec(Z.trim());return z?z[1]:null}class T${options;name="api-key";constructor($){this.options=$;if(typeof $?.prefix!=="string"||!/^[A-Za-z0-9_-]{3,32}$/.test($.prefix))throw Error('McpApiKeyResolver: prefix is required: 3 to 32 letters, digits, _ or -, like "myapp_mcp_".');if(typeof $.verify!=="function")throw Error("McpApiKeyResolver: verify must be a function that looks a key up.")}static generate($){return`${$}${j$(32).toString("base64url")}`}static hash($){return O$("sha256").update($).digest("hex")}static hashesMatch($,Z){let z=Buffer.from($),G=Buffer.from(Z);return z.length===G.length&&C$(z,G)}async resolve($){let Z=I3($);if(!Z?.startsWith(this.options.prefix))return null;let z=await this.options.verify(Z,$);if(!z)return{ok:!1,error:"invalid_token",description:"The API key is not valid."};if(!z.user||typeof z.id!=="string"||z.id===""||!Array.isArray(z.scopes))throw Error("McpApiKeyResolver: verify must answer { user, id, scopes } for a key it knows, or null.");return{ok:!0,principal:{user:z.user,via:this.name,id:z.id,scopes:[...z.scopes]}}}}import{createHash as N9,randomBytes as z9}from"crypto";async function P3($,Z){let z=S$();if(!z)return null;let G=await z.consume($,Z);return G.allowed?null:Math.max(1,Math.ceil(G.retryAfter/1000))}function S$(){try{let $=k();return $.bound(p)?$.make(p):null}catch{return null}}var _3=["2026-07-28"],z3=["2025-11-25","2025-06-18","2025-03-26"],L3=[..._3,...z3],D3="io.modelcontextprotocol/protocolVersion",A3="io.modelcontextprotocol/clientCapabilities";var O3="io.modelcontextprotocol/serverInfo",x={ParseError:-32700,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602,InternalError:-32603,HeaderMismatch:-32020,MissingRequiredClientCapability:-32021,UnsupportedProtocolVersion:-32022};class B extends Error{code;data;status;constructor($,Z,z,G=200){super(Z);this.code=$;this.data=z;this.status=G;this.name="JsonRpcError"}}function S($,Z){return{jsonrpc:"2.0",id:$,error:{code:Z.code,message:Z.message,...Z.data!==void 0?{data:Z.data}:{}}}}function e3($){if(Array.isArray($))throw new B(x.InvalidRequest,"Batched requests are not supported.",void 0,400);if(typeof $!=="object"||$===null||$.jsonrpc!=="2.0")throw new B(x.InvalidRequest,"Not a JSON-RPC 2.0 message.",void 0,400);let Z=$,z=Z.id,G=typeof z==="string"||typeof z==="number"&&Number.isFinite(z);if(typeof Z.method==="string"){if(Z.params!==void 0&&(typeof Z.params!=="object"||Z.params===null||Array.isArray(Z.params)))throw new B(x.InvalidRequest,"params must be an object.",void 0,400);if(z===void 0)return{kind:"notification",message:Z};if(!G)throw new B(x.InvalidRequest,"id must be a string or a number.",void 0,400);return{kind:"request",message:Z}}if(G&&(("result"in Z)||("error"in Z)))return{kind:"response",message:Z};throw new B(x.InvalidRequest,"Not a JSON-RPC request, notification or response.",void 0,400)}function j3($,Z){let z=$.outputSchema?.toJSONSchema(),G={...$.annotations,...$.title&&!Z?{title:$.title}:{}};return{name:$.name,...$.title?{title:$.title}:{},description:$.description,inputSchema:$.inputSchema.toJSONSchema(),...z&&(Z||z.type==="object")?{outputSchema:z}:{},...Object.keys(G).length>0?{annotations:G}:{}}}function j($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function $9($){let Z=/^=\?base64\?([A-Za-z0-9+/]*={0,2})\?=$/.exec($);if(!Z)return $;try{let z=Buffer.from(Z[1],"base64");return new TextDecoder("utf-8",{fatal:!0}).decode(z)}catch{return null}}import{createHmac as q$,timingSafeEqual as M$}from"crypto";function C3($,Z,z){let G=Buffer.from(JSON.stringify(z)).toString("base64url");return`${Z}.${G}.${Z9($,Z,G).toString("base64url")}`}function T3($,Z,z,G=Date.now()){if(typeof z!=="string"||z.length>8192)return null;let W=z.split(".");if(W.length!==3||W[0]!==Z)return null;let[,X,Y]=W,K=Buffer.from(Y,"base64url"),U=Z9($,Z,X);if(K.length!==U.length||!M$(K,U))return null;let Q;try{Q=JSON.parse(Buffer.from(X,"base64url").toString("utf8"))}catch{return null}if(typeof Q!=="object"||Q===null)return null;if(typeof Q.exp!=="number"||Q.exp<=G)return null;return Q}function Z9($,Z,z){return q$("sha256",G3($)).update(`${Z}.${z}`).digest()}var S3="gemi.mcp.request-state.v1",G9="gemi.mcp.session.v1",k$=86400000,W9=600000,X9="gemi_approval",q3=2000,R$={limit:600,window:60},E$={limit:30,window:60};class r{registry;static token="router.mcp.http";endpoint;resolvers;context;allowedOrigins;rateLimit;maxBodyBytes;serverInfo;instructions;nonces;approvalTimeoutMs;pending=new Map;inflight=new Map;constructor($,Z){this.registry=$;if(typeof Z.url!=="string")throw Error(`route.mcp.remote.url is required: the endpoint's canonical URL, like "https://example.com/mcp".`);this.endpoint=f$(Z.url);let z=Z.resolvers??[];if(!Array.isArray(z)||z.length===0)throw Error("route.mcp.remote is enabled without a caller resolver. Configure route.mcp.remote.resolvers \u2014 an McpOAuthServer, an McpApiKeyResolver, or your own \u2014 or leave the endpoint off. Without one every request would be refused, or answered as nobody.");for(let G of z)if(typeof G?.resolve!=="function"||typeof G.name!=="string"||G.name==="")throw Error("route.mcp.remote.resolvers: each resolver needs a name and a resolve().");this.resolvers=z,G3(S3),this.context={resource:this.resource,registry:$},this.allowedOrigins=new Set((Z.allowedOrigins??[]).map((G)=>{if(new URL(G).origin!==G)throw Error(`route.mcp.remote.allowedOrigins: "${G}" is not an origin (scheme://host[:port]).`);return G})),this.allowedOrigins.add(this.endpoint.origin),this.rateLimit=Z.rateLimit===!1?!1:Z.rateLimit??R$,this.maxBodyBytes=Z.maxBodyBytes??Math.ceil($.maxFileBytes*1.4)+1048576,this.serverInfo={name:Z.server?.name??"gemi",version:Z.server?.version??"1.0.0"},this.instructions=Z.server?.instructions,this.nonces=Z.nonces??new J9,this.approvalTimeoutMs=Z.approvalTimeoutMs??W9;for(let G of z)G.boot?.(this.context)}get resource(){return this.endpoint.href.replace(/\/$/,"")}async handle($){let Z=new URL($.url);if(Z.host!==this.endpoint.host)return null;for(let W of this.resolvers){let X=await W.handle?.($,this.context);if(X)return X}if(Z.pathname!==this.endpoint.pathname)return null;let z=$.headers.get("origin");if(z!==null&&!this.allowedOrigins.has(z))return R(S(null,new B(x.InvalidRequest,"Origin not allowed.")),403);let G=z?y$(z):{};if($.method==="OPTIONS")return new Response(null,{status:204,headers:{...G,"Access-Control-Allow-Methods":"POST","Access-Control-Allow-Headers":"Authorization, Content-Type, Accept, MCP-Protocol-Version, Mcp-Session-Id, Mcp-Method, Mcp-Name, Last-Event-ID","Access-Control-Max-Age":"600"}});if($.method!=="POST")return Y9(new Response(null,{status:405,headers:{Allow:"POST, OPTIONS"}}),G);return Y9(await this.post($),G)}async post($){let Z=null;for(let Y of this.resolvers){let K=await Y.resolve($,this.context);if(K===null)continue;if(K.ok===!1)return await this.failedAttempt($)??this.unauthorized(K.description);Z={...K.principal,via:Y.name};break}if(!Z)return(I3($)!==null?await this.failedAttempt($):null)??this.unauthorized();let z=await this.spend(Z);if(z)return z;let G=$.headers.get("content-type")??"";if(!/^application\/json\s*(;|$)/i.test(G))return new Response("Content-Type must be application/json.",{status:415});let W;try{W=JSON.parse(await b$($,this.maxBodyBytes))}catch(Y){if(Y instanceof X3)return R(S(null,new B(x.InvalidRequest,`The request is larger than ${this.maxBodyBytes} bytes.`)),413);return R(S(null,new B(x.ParseError,"Parse error.")),400)}let X=new w($,{},"api",this.endpoint.pathname);return await E.run(X,async()=>{try{return await this.dispatch($,X,Z,W)}catch(Y){if(Y instanceof B){let K=j(W)&&(typeof W.id==="string"||typeof W.id==="number")?W.id:null;return R(S(K,Y),Y.status)}return console.error("[gemi/mcp] The MCP endpoint failed:",Y),R(S(null,new B(x.InternalError,"Internal error.")),500)}},{user:Z.user})}async dispatch($,Z,z,G){let W=e3(G),X={kind:"remote",req:Z,principal:z};if(W.kind==="response"){let P=this.session($,z),I=this.pending.get(String(W.message.id));if(I&&I.session===P.id)this.pending.delete(String(W.message.id)),I.resolve(W.message);return new Response(null,{status:202})}let{message:Y}=W,K=Y.params??{},U=j(K._meta)?K._meta:{};if(typeof U[D3]==="string"){if(this.checkModernHeaders($,Y,U[D3]),W.kind==="notification")return new Response(null,{status:202});return await this.respond(Y,async(P,I)=>this.modern({principal:z,caller:X,message:Y,params:K,era:{modern:!0},stream:P,signal:I}),Q9(K),$.signal)}if(Y.method==="initialize"){if(W.kind!=="request")throw new B(x.InvalidRequest,"initialize is a request.",void 0,400);return this.initialize(W.message,K,z)}let Q=this.session($,z),H=$.headers.get("mcp-protocol-version");if(H!==null&&H!==Q.state.v)throw new B(x.InvalidRequest,`MCP-Protocol-Version ${H} is not the session's ${Q.state.v}.`,void 0,400);if(W.kind==="notification"){if(Y.method==="notifications/cancelled"){let P=K.requestId;this.inflight.get(`${Q.id}:${String(P)}`)?.abort()}return new Response(null,{status:202})}let V=`${Q.id}:${String(Y.id)}`,N=new AbortController;this.inflight.set(V,N);let _=AbortSignal.any([N.signal,$.signal]);try{return await this.respond(Y,async(P,I)=>this.legacy({principal:z,caller:X,message:Y,params:K,era:{modern:!1,session:Q.state,sessionId:Q.id},stream:P,signal:I}),Q9(K)||v$(this.registry,Y,Q.state),_,()=>this.inflight.delete(V))}catch(P){throw this.inflight.delete(V),P}}async modern($){switch($.message.method){case"server/discover":return this.complete({supportedVersions:L3,capabilities:{tools:{}},...this.instructions?{instructions:this.instructions}:{},ttlMs:60000,cacheScope:"private"});case"tools/list":return this.complete({tools:this.registry.list($.caller).map((Z)=>j3(Z,!0)),ttlMs:60000,cacheScope:"private"});case"tools/call":return await this.callTool($);default:throw new B(x.MethodNotFound,`Method not found: ${$.message.method}`,void 0,404)}}async legacy($){switch($.message.method){case"ping":return{};case"tools/list":return{tools:this.registry.list($.caller).map((Z)=>j3(Z,!1))};case"tools/call":return await this.callTool($);default:throw new B(x.MethodNotFound,`Method not found: ${$.message.method}`)}}complete($){return{resultType:"complete",...$,_meta:{[O3]:this.serverInfo}}}initialize($,Z,z){let G=Z.protocolVersion,W=z3.includes(G)?G:z3[0],X=j(Z.capabilities)?Z.capabilities:{},Y={v:W,e:K9(X.elicitation),p:W3(z),exp:Date.now()+k$},K=C3(G9,"gms1",Y);return R({jsonrpc:"2.0",id:$.id,result:{protocolVersion:W,capabilities:{tools:{listChanged:!1}},serverInfo:this.serverInfo,...this.instructions?{instructions:this.instructions}:{}}},200,{"Mcp-Session-Id":K})}session($,Z){let z=$.headers.get("mcp-session-id");if(!z)throw new B(x.InvalidRequest,"Missing Mcp-Session-Id. Send initialize first, or a request carrying io.modelcontextprotocol/protocolVersion in _meta.",void 0,400);let G=T3(G9,"gms1",z);if(!G||G.p!==W3(Z))throw new B(x.InvalidRequest,"Session not found.",void 0,404);return{id:z,state:G}}checkModernHeaders($,Z,z){if(!_3.includes(z))throw new B(x.UnsupportedProtocolVersion,"Unsupported protocol version",{supported:L3,requested:z},400);let G=(Y)=>new B(x.HeaderMismatch,`Header mismatch: ${Y}`,void 0,400);if($.headers.get("mcp-protocol-version")!==z)throw G("MCP-Protocol-Version does not match the protocol version in _meta.");if($.headers.get("mcp-method")!==Z.method)throw G("Mcp-Method does not match the method.");let W=Z.params??{},X=Z.method==="tools/call"||Z.method==="prompts/get"?W.name:Z.method==="resources/read"?W.uri:void 0;if(X!==void 0){let Y=$.headers.get("mcp-name");if(Y===null||$9(Y)!==X)throw G("Mcp-Name does not match the request's name.")}}async callTool($){let{params:Z,caller:z,principal:G}=$,W=Z.name;if(typeof W!=="string")throw new B(x.InvalidParams,"tools/call needs a tool name.");let X=Z.arguments??{},Y=this.registry.list(z,{names:[W]})[0];if(!Y)throw new B(x.InvalidParams,`Unknown tool: ${W}`);let K=!1;if(Y.requiresApproval){let N=Y.inputSchema.safeParse(X);if(N.ok===!1)return this.toolResult($,{content:[{type:"text",text:`Invalid arguments for "${W}": ${N.errors.join(", ")}`}],isError:!0});let _=await this.approval($,Y,X);if(_.kind==="answer")return _.result;K=!0}let U=g$($),Q;try{Q=await this.registry.execute(z,W,X,void 0,{approved:K,signal:$.signal,...U?{progress:U}:{}})}catch(N){if(N instanceof O)return this.toolResult($,{content:[{type:"text",text:N.message}],isError:!0});if(N instanceof a)throw new B(x.InvalidParams,N.reason==="unknown-tool"?`Unknown tool: ${W}`:N.message);return console.error(`[gemi/mcp] "${W}" failed for ${G.via}:${G.id}:`,N),this.toolResult($,{content:[{type:"text",text:`"${W}" failed on the server.`}],isError:!0})}let H=typeof Q==="string"?Q:JSON.stringify(Q??null),V=Y.outputSchema&&($.era.modern||j(Q))?{structuredContent:Q}:{};return this.toolResult($,{content:[{type:"text",text:H}],...V,isError:!1})}toolResult($,Z){return $.era.modern?this.complete(Z):Z}async approval($,Z,z){let G=h$(Z,z),W=(Q)=>({kind:"answer",result:this.toolResult($,{content:[{type:"text",text:Q}],isError:!0})});if($.era.modern){let Q=j($.params._meta)?$.params._meta:{},H=j(Q[A3])?Q[A3]:{},V=j($.params.inputResponses)?$.params.inputResponses:null,N=$.params.requestState,_=w$(z);if(V&&N!==void 0){let I=T3(S3,"grs1",N);if(!I||I.p!==W3($.principal)||I.t!==Z.name||I.a!==_)throw new B(x.InvalidParams,"requestState is not valid for this call.");if(!await this.spendNonce(I.n,I.exp))throw new B(x.InvalidParams,"requestState has already been used.");return U9(V[X9])?{kind:"approved"}:W(`The user did not approve "${Z.name}", and it did not run.`)}if(!K9(H.elicitation))throw new B(x.MissingRequiredClientCapability,`"${Z.name}" needs the user's approval, and this client cannot ask for it (elicitation).`,{requiredCapabilities:{elicitation:{form:{}}}},400);let P={p:W3($.principal),t:Z.name,a:_,n:z9(16).toString("base64url"),exp:Date.now()+W9};return{kind:"answer",result:{resultType:"input_required",inputRequests:{[X9]:{method:"elicitation/create",params:{mode:"form",...G}}},requestState:C3(S3,"grs1",P),_meta:{[O3]:this.serverInfo}}}}let X=$.era;if(!X.session.e||!$.stream)return W(`"${Z.name}" needs the user's approval, and this client cannot ask for it (elicitation). It did not run.`);let Y=`gemi-approval-${z9(12).toString("base64url")}`,K=X.sessionId,U=await new Promise((Q)=>{let H=setTimeout(()=>{this.pending.delete(Y),Q(null)},this.approvalTimeoutMs),V=(N)=>{clearTimeout(H),Q(N)};this.pending.set(Y,{session:K,resolve:V}),$.signal.addEventListener("abort",()=>{this.pending.delete(Y),V(null)}),$.stream.send({jsonrpc:"2.0",id:Y,method:"elicitation/create",params:X.session.v==="2025-11-25"?{mode:"form",...G}:G})});return U&&!U.error&&U9(U.result)?{kind:"approved"}:W(`The user did not approve "${Z.name}", and it did not run.`)}async spendNonce($,Z){try{return await this.nonces.consume($,Z)}catch(z){return console.error("[gemi/mcp] Spending an approval failed:",z),!1}}async respond($,Z,z,G,W){if(!z)try{let U=await Z(null,G);return R({jsonrpc:"2.0",id:$.id,result:U},200)}finally{W?.()}let X=new AbortController,Y=AbortSignal.any([X.signal,G]),K=new B9(()=>X.abort());return(async()=>{try{let U=await Z(K,Y);K.send({jsonrpc:"2.0",id:$.id,result:U})}catch(U){if(U instanceof B)K.send(S($.id,U));else console.error("[gemi/mcp] The MCP endpoint failed:",U),K.send(S($.id,new B(x.InternalError,"Internal error.")))}finally{W?.(),K.close()}})(),new Response(K.readable,{status:200,headers:{"Content-Type":"text/event-stream","Cache-Control":"no-store","X-Accel-Buffering":"no"}})}unauthorized($){let Z=this.resolvers.map((G)=>G.challenge?.(this.context)).find(Boolean)??'Bearer realm="mcp"',z=$?`${Z}, error="invalid_token", error_description="${$.replace(/["\\]/g,"")}"`:Z;return R(S(null,new B(x.InvalidRequest,"Unauthorized.")),401,{"WWW-Authenticate":z})}async failedAttempt($){let Z=V9(new w($,{},"api",this.endpoint.pathname)),z=await P3(`mcp-auth-failed:${Z}`,E$);return z===null?null:H9(z)}async spend($){if(!this.rateLimit)return null;let Z=await P3(`mcp-endpoint:${$.via}:${$.id}`,this.rateLimit);return Z===null?null:H9(Z)}}class B9{readable;controller;closed=!1;encoder=new TextEncoder;constructor($){this.readable=new ReadableStream({start:(Z)=>{this.controller=Z},cancel:()=>{this.closed=!0,$()}})}send($){if(this.closed)return;this.controller.enqueue(this.encoder.encode(`event: message
-data: ${JSON.stringify($)}
-
-`))}close(){if(this.closed)return;this.closed=!0,this.controller.close()}}class X3 extends Error{}async function b$($,Z){let z=Number($.headers.get("content-length"));if(Number.isFinite(z)&&z>Z)throw new X3;if(!$.body)return"";let G=$.body.getReader(),W=[],X=0;for(;;){let{done:Y,value:K}=await G.read();if(Y)break;if(X+=K.byteLength,X>Z)throw await G.cancel(),new X3;W.push(K)}return Buffer.concat(W).toString("utf8")}function R($,Z,z={}){return new Response(JSON.stringify($),{status:Z,headers:{"Content-Type":"application/json","Cache-Control":"no-store",...z}})}function Y9($,Z){for(let[z,G]of Object.entries(Z))$.headers.set(z,G);return $}function y$($){return{"Access-Control-Allow-Origin":$,"Access-Control-Expose-Headers":"Mcp-Session-Id, WWW-Authenticate",Vary:"Origin"}}function f$($){let Z;try{Z=new URL($)}catch{throw Error(`route.mcp.remote.url: "${$}" is not a URL.`)}let z=Z.hostname==="localhost"||Z.hostname==="127.0.0.1"||Z.hostname==="[::1]";if(Z.protocol!=="https:"&&!(Z.protocol==="http:"&&z))throw Error("route.mcp.remote.url must be https (http only on localhost): tokens travel to it.");if(Z.search||Z.hash||Z.username||Z.password)throw Error("route.mcp.remote.url must have no query, fragment or credentials.");if(Z.pathname==="/"||Z.pathname.endsWith("/"))throw Error('route.mcp.remote.url needs a path of its own, like "/mcp", without a trailing slash.');return Z}function W3($){return N9("sha256").update(`${$.via}\x00${$.id}\x00${$.user?.id}`).digest("base64url").slice(0,32)}function w$($){return N9("sha256").update(F9($??{})).digest("base64url")}function K9($){if(!j($))return!1;if(Object.keys($).length===0)return!0;return"form"in $}function Q9($){let Z=j($._meta)?$._meta:{};return typeof Z.progressToken==="string"||typeof Z.progressToken==="number"}function v$($,Z,z){if(Z.method!=="tools/call"||!z.e)return!1;let G=Z.params?.name;return typeof G==="string"&&$.descriptors({names:[G]})[0]?.requiresApproval===!0}function g$($){let z=(j($.params._meta)?$.params._meta:{}).progressToken;if(!$.stream||typeof z!=="string"&&typeof z!=="number")return;let G=-1/0;return(W)=>{if(typeof W?.progress!=="number"||!Number.isFinite(W.progress)||W.progress<=G)return;G=W.progress,$.stream.send({jsonrpc:"2.0",method:"notifications/progress",params:{progressToken:z,progress:W.progress,...typeof W.total==="number"?{total:W.total}:{},...typeof W.message==="string"?{message:W.message.slice(0,1000)}:{}}})}}function h$($,Z){let z=JSON.stringify(Z??{},null,1),G=z.length>q3?`${z.slice(0,q3)}\u2026 (${z.length-q3} more characters not shown)`:z;return{message:`Allow "${$.title??$.name}" to run? ${$.description}
-
-Arguments: ${G}`,requestedSchema:{type:"object",properties:{approve:{type:"boolean",title:"Approve",description:`Run "${$.title??$.name}" with these arguments.`}},required:["approve"]}}}function U9($){return j($)&&$.action==="accept"&&j($.content)&&$.content.approve===!0}function H9($){return R(S(null,new B(x.InvalidRequest,"Rate limit exceeded.")),429,{"Retry-After":String($)})}async function m$($,Z={}){try{if(!await $.shouldRun.call($))return}catch(W){console.error(`Error evaluating shouldRun for cron job ${$.name}:`,W);return}let z=u$($.withoutOverlapping);if(!$.onOneServer&&z===void 0){await M3($);return}let G;try{if(G=Z.locks?.()??c$(),$.onOneServer){let W=Math.floor((Z.now??Date.now())/60000);if(!await G.store.advance(`gemi:cron-tick:${$.name}`,W))return}}catch(W){console.error(`Could not claim the tick of cron job ${$.name}; skipped it:`,W);return}if(z===void 0){await M3($);return}try{await G.run(`gemi:cron:${$.name}`,{ttl:z},(W)=>M3($,W))}catch(W){if(W instanceof P9)console.error(`Cron job ${$.name} lost its withoutOverlapping lock while running: another tick may have started alongside it.`,W);else console.error(`Could not take the withoutOverlapping lock of cron job ${$.name}:`,W)}}var x9=300000;function u$($){if(!$)return;if($===!0)return x9;return $.expiresAfter??x9}var I9;function c$(){return I9??=new v(new _9),I9}async function M3($,Z){try{await $.onTick.call($)}catch(z){console.error(`Error executing cron job ${$.name}:`,z)}try{await $.callback.call($,Z)}catch(z){console.error(`Error in cron job ${$.name}:`,z)}try{await $.onComplete.call($)}catch(z){console.error(`Error completing cron job ${$.name}:`,z)}}class g{static token="scheduler";handles=[];resolved;inFlight=new Map;stopped=!1;locks;constructor($){this.resolved=$.jobs}get jobs(){return[...this.resolved]}useJobs($){this.resolved=$}useLocks($){this.locks=$}start($=(Z)=>Z()){if(this.stopped=!1,this.resolved.length===0)return;let Z=globalThis.__gemiCronJobs??=new Map,z=new Map;for(let G of this.resolved){let W=new G;if(!W.name){console.error(`Cron job must have a name \u2014 ${G.name||"an anonymous class"} has none, so it is not scheduled. If this is a base class that other jobs extend, move it out of the discovered directory: \`abstract\` does not survive to runtime, so a class under app/cron is indistinguishable from a job.`);continue}if(!W.cron){console.error(`Cron job must have an expression. Job: ${W.name}`);continue}let X=z.get(W.name);if(X!==void 0){console.error(`Two cron jobs claim the name "${W.name}" \u2014 ${X} is scheduled and ${G.name||"an anonymous class"} is not. A name is the scheduler's key, so only one job can hold it. Rename one.`);continue}z.set(W.name,G.name||"an anonymous class"),Z.get(W.name)?.stop();let Y=Bun.cron(W.cron,()=>{if(this.stopped)return;let K=this.locks;return this.track(W.name,()=>$(()=>m$(W,{locks:K})))});Z.set(W.name,Y),this.handles.push(Y)}}stop(){this.stopped=!0;for(let $ of this.handles)$.stop();this.handles=[]}async drain($=1/0){this.stop();let Z,z=new Promise((G)=>{if($!==1/0)Z=setTimeout(G,$)});return await Promise.race([Promise.allSettled([...this.inFlight.values()].map((G)=>G.done)),z]),clearTimeout(Z),{unfinished:[...this.inFlight.values()].map((G)=>({...G.tick}))}}get running(){return this.inFlight.size}track($,Z){let z={},G=Promise.resolve().then(Z).finally(()=>this.inFlight.delete(z));return this.inFlight.set(z,{tick:{name:$,startedAt:new Date},done:G}),G}}import{isMainThread as d$}from"worker_threads";var p$=100,l$=($)=>Math.min(p$,Math.floor($/10));class i$ extends F{register(){this.app.singleton(D,()=>new D(this.app.config.get("queue",{}),{application:this.app})),this.app.singleton(v,()=>this.app.make(D).locks)}async boot(){let $=this.app.config.get("queue",{}),{jobsDir:Z,workflowsDir:z}=L(L9(),$);if($.jobs===void 0)this.app.make(D).useJobs(await C9(Z));if($.workflows===void 0){let G=await T9(z);if(G.length>0)this.app.make(D).useWorkflows(G)}}async shutdown($){if(!this.app.resolved(D))return;let Z=this.app.make(D);if(Z.running>0)console.log(`[gemi] Shutting down: waiting for ${Z.running} running queued job(s).`);let z=$?.timeoutMs,{unfinished:G}=await Z.drain(z===void 0?1/0:Math.max(0,z-l$(z)));if(G.length>0)return console.error("[gemi] Queued jobs still running at shutdown: "+G.map((W)=>`${W.name} (${W.id})`).join(", ")),{abandoned:!0}}}function V2($){if(t$($),Bun.env.NODE_ENV!=="production")return s$($);if(S9($))return;if(!A9())return;if(!$.bound(D))return;$.make(D).start()}function S9($){let Z=$.config.get("queue",{}).driver??"memory";return Z==="memory"||Z instanceof D9}function n$($){if(S9($))return!0;if(typeof $.config.get("queue",{}).driver!=="function"||!$.bound(D))return!1;try{return!$.make(D).durable}catch{return!1}}function t$($){let Z=process.env.GEMI_QUEUE_CLAIM;if(Z===void 0||j9())return;if(process.env.ROOT_DIR===void 0||!d$)return;if(O9()){if(!n$($))return;console.warn('[gemi] GEMI_QUEUE_CLAIM=off is ignored: the memory queue driver keeps jobs in the process that dispatched them, so no worker could run them. This server runs its own jobs. Use a driver other processes can read, such as "database", to hand jobs to `gemi queue:work`.')}else if(Z.trim().toLowerCase()!=="on")console.warn(`[gemi] GEMI_QUEUE_CLAIM="${Z}" is not "off" or "on", so this server claims jobs. Set it to "off" to leave them to \`gemi queue:work\`.`)}function s$($){let Z=globalThis.__gemiDevQueue;if(!Z)return;if(globalThis.__gemiDevQueue=void 0,Z.stop(),$.bound(D))$.make(D).start()}function o$($){let Z=$.headers.get("Cache-Control")?.toLowerCase()??"";return/(^|[\s,])(public|s-maxage)\b/.test(Z)}var a$=new Set,r$={refusal:null,apply:($)=>$,carried:null};async function v9($){let Z=k(l);if(Z.config.global.length===0)return r$;let{pathname:z}=new URL($.url),G=y9(z),W=new w($,{},G?"api":"view","");return await E.run(W,async()=>{let X=E.getStore(),{headers:Y,cookies:K}=X,U=(Q)=>{if(!o$(Q))return R3(Q,Y,K);let H=new Headers(Y);return H.delete("Set-Cookie"),R3(Q,H,a$)};try{return await Z.runGlobalMiddleware(),{refusal:null,apply:U,carried:{user:X.user}}}catch(Q){let H=!G&&z.endsWith(".json");if(Q?.kind===q9){let V=G?w9(Q.payload.api):H?b9(Q.payload.viewData??Q.payload.api):k3(Q.payload.view);return{refusal:U(V),apply:U,carried:null}}if(M9(Q)&&(G||H))return{refusal:U(f9()),apply:U,carried:null};if(k9(Q)){console.error(Q);let V=G||H?R9():k3(E9());return{refusal:U(V),apply:U,carried:null}}throw Q}finally{X.destroy()}})}var e$=120,$Z=3;class n{manager;application;static token="broadcast.sockets";server=null;sockets=new Set;byTopic=new Map;topicReady=new Map;perIp=new Map;perUser=new Map;connections=0;revocationSeq=0;revokedAt=new Map;closing=!1;closed=null;onAllClosed=null;startPromise=null;constructor($,Z){this.manager=$;this.application=Z}get config(){return this.manager.config}matches($){try{return new URL($.url).pathname===this.config.path}catch{return!1}}get size(){return this.sockets.size}start($){return this.server=$,this.startPromise??=this.manager.start((Z,z)=>this.deliver(Z,z),{onGap:()=>this.sendAll({op:"gap"}),onRevoke:(Z)=>this.applyRevocation(Z)}).catch((Z)=>{this.startPromise=null,console.error("[gemi] The broadcast driver could not start; events reach no socket.",Z)}),this.startPromise}upgrade($,Z){return this.run(()=>this.tryUpgrade($,Z))}async tryUpgrade($,Z){if(this.closing||b3())return M(503,"The server is restarting.",{"Retry-After":"5"});if($.method!=="GET"||$.headers.get("upgrade")?.toLowerCase()!=="websocket")return M(426,"This endpoint only accepts WebSocket upgrades.",{Upgrade:"websocket"});if(!($.headers.get("sec-websocket-protocol")??"").split(",").map((K)=>K.trim()).includes(Y3))return M(400,`Open the socket with the "${Y3}" subprotocol.`);let G=this.checkOrigin($);if(G!==!0)return M(403,G);if(this.connections>=this.config.maxConnectionsPerProcess)return M(503,"Too many connections.",{"Retry-After":"10"});let W=WZ($,Z);if(W&&(this.perIp.get(W)??0)>=this.config.maxConnectionsPerIp)return M(429,"Too many connections from this address.",{"Retry-After":"30"});let X=this.reserve(W),Y=!1;try{let K=await this.authenticate($,Z,X);return Y=K===void 0,K}finally{if(!Y)this.release(X)}}async authenticate($,Z,z){let G=await v9($);if(G.refusal)return G.refusal;let W=G.carried;if(this.closing||b3())return M(503,"The server is restarting.",{"Retry-After":"5"});let X;try{let H=new w($,{},"api",this.config.path);X=await E.run(H,async()=>{let V=E.getStore();try{return await u9(H)}finally{V.destroy()}},W)}catch(H){return console.error("[gemi] Resolving the session of a socket upgrade failed.",H),M(503,"The session could not be checked.",{"Retry-After":"5"})}let Y=GZ(X);if(Y&&(this.perUser.get(Y)??0)>=this.config.maxConnectionsPerUser)return M(429,"Too many connections for this user.",{"Retry-After":"30"});if(Y)z.userId=Y,this.perUser.set(Y,(this.perUser.get(Y)??0)+1);let K=m9(),U={gemiSocket:!0,hub:this,socketId:K,tag:h9(K),request:{url:$.url,headers:[...$.headers]},carried:W,userId:Y,ip:z.ip,subs:new Map,topics:new Map,rate:{windowStart:Date.now(),subs:0,pings:0},reservation:z,closing:!1,closed:!1};if(!Z.upgrade($,{headers:{"Sec-WebSocket-Protocol":Y3},data:U}))return M(400,"The WebSocket upgrade failed.");return}checkOrigin($){let Z=$.headers.get("origin"),z=Boolean($.headers.get("cookie"));if(!Z)return z?"A socket that carries cookies must send an Origin header.":!0;return this.originAllowed(Z,$)?!0:"This origin may not open a socket."}originAllowed($,Z){let z;try{z=new URL($)}catch{return!1}if(z.protocol!=="https:"&&z.protocol!=="http:")return!1;let G=Z.headers.get("host");if(G&&z.host.toLowerCase()===G.toLowerCase())return!0;for(let W of[process.env.APP_URL,process.env.HOST_NAME,...this.config.allowedOrigins])if(W&&ZZ(W.trim(),z))return!0;return!1}reserve($){if(this.connections++,$)this.perIp.set($,(this.perIp.get($)??0)+1);return{ip:$,userId:null}}release($){this.connections--,g9(this.perIp,$.ip),g9(this.perUser,$.userId)}get websocket(){return{open:($)=>$.data.hub.onOpen($),message:($,Z)=>$.data.hub.onMessage($,Z),close:($)=>$.data.hub.onClose($),...this.socketOptions()}}socketOptions(){return{maxPayloadLength:this.config.maxInboundMessageBytes,idleTimeout:this.config.idleTimeout,backpressureLimit:this.config.backpressureLimit*2,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!1}}onOpen($){let Z=$.data;if(this.closing){this.sayBye($);return}this.sockets.add($),i($,{op:"hello",socketId:Z.socketId,tag:Z.tag,heartbeatMs:this.config.heartbeatMs})}onMessage($,Z){if(typeof Z!=="string"){$.close(C.UnsupportedData,"Frames are JSON text.");return}if(Z.length>this.config.maxInboundMessageBytes){$.close(C.PolicyViolation,"Frame too large.");return}let z;try{z=JSON.parse(Z)}catch{$.close(C.UnsupportedData,"Frames are JSON text.");return}switch(z?.op){case"ping":if(this.countPing($))i($,{op:"pong"});return;case"sub":this.subscribe($,z).catch((G)=>{if(console.error("[gemi] A socket subscription failed.",G),typeof z.id==="string"&&$.data.subs.has(z.id)){let W=$.data.subs.get(z.id);if($.data.subs.delete(z.id),W.topic&&!$.data.closed)this.leave($,W.topic);if(!$.data.closed)q($,z.id,"error")}});return;case"unsub":this.unsubscribeFrame($,z);return;default:$.close(C.UnsupportedData,"Unknown op.")}}onClose($){let Z=$.data;if(Z.closed)return;Z.closed=!0;for(let[,z]of Z.subs)if(z.topic)this.leave($,z.topic);if(Z.subs.clear(),this.sockets.delete($),Z.reservation)this.release(Z.reservation),Z.reservation=null;if(this.closing&&this.sockets.size===0)this.onAllClosed?.()}rateWindow($){let Z=$.data.rate,z=Date.now();if(z-Z.windowStart>=this.config.subscribeRate.windowMs)Z.windowStart=z,Z.subs=0,Z.pings=0;return Z}countSub($){let{limit:Z}=this.config.subscribeRate,z=this.rateWindow($);if(z.subs++,z.subs>Z*2)return console.warn("[gemi] Socket closed for sending too many subscribe frames (1008)."),$.close(C.PolicyViolation,"Too many subscribe frames."),"closed";return z.subs>Z?"limited":"ok"}countPing($){let Z=this.rateWindow($);if(Z.pings++,Z.pings<=e$)return!0;return $.close(C.PolicyViolation,"Too many pings."),!1}async subscribe($,Z){let z=$.data,G=Z.id;if(typeof G!=="string"||!y3.test(G)){$.close(C.UnsupportedData,"A sub needs an id.");return}let W=this.countSub($);if(W==="closed")return;if(W==="limited")return q($,G,"rate_limited");let X=Z.ch,Y=Z.p??{};if(typeof X!=="string"||!zZ(Y))return q($,G,"invalid");if(z.subs.has(G))return q($,G,"invalid");if(z.subs.size>=this.config.maxChannelsPerSocket)return q($,G,"limit");let K={pattern:X,params:Y,topic:null};if(z.subs.set(G,K),!this.manager.channels)return z.subs.delete(G),q($,G,"unknown_channel");let U;for(let Q=1;;Q++){let H=this.revocationSeq;if(U=await this.authorize($,K),z.closed||z.subs.get(G)!==K)return;if(U.ok!==!0)break;if((this.revokedAt.get(U.topic)??0)<=H)break;if(Q>=$Z)return z.subs.delete(G),q($,G,"error")}if(U.ok!==!0)return z.subs.delete(G),q($,G,U.code);K.topic=U.topic;try{await this.join($,U.topic)}catch(Q){if(console.error(`[gemi] The broadcast driver could not subscribe to "${U.topic}".`,Q),z.subs.get(G)===K){if(z.subs.delete(G),!z.closed)this.leave($,U.topic);q($,G,"error")}return}if(z.closed||z.subs.get(G)!==K)return;i($,{op:"subscribed",id:G,t:U.topic})}authorize($,Z){let z=$.data,G=this.manager.channels;if(!G)return Promise.resolve({ok:!1,code:"unknown_channel"});return this.run(()=>G.authorize(new Request(z.request.url,{headers:z.request.headers}),Z.pattern,Z.params,{carried:z.carried}))}unsubscribeFrame($,Z){let z=Z.id;if(typeof z!=="string"||!y3.test(z)){$.close(C.UnsupportedData,"An unsub needs an id.");return}let G=$.data.subs.get(z);if(!G)return;if($.data.subs.delete(z),G.topic)this.leave($,G.topic)}join($,Z){let z=$.data,G=z.topics.get(Z)??0;if(z.topics.set(Z,G+1),G===0){$.subscribe(Z);let W=this.byTopic.get(Z);if(!W){W=new Set,this.byTopic.set(Z,W);let X=Promise.resolve().then(()=>this.manager.topicAdded(Z));this.topicReady.set(Z,X),X.catch(()=>{if(this.topicReady.get(Z)===X)this.topicReady.delete(Z)})}W.add($)}return this.topicReady.get(Z)??Promise.resolve()}leave($,Z){let z=$.data,G=z.topics.get(Z)??0;if(G>1){z.topics.set(Z,G-1);return}if(z.topics.delete(Z),!z.closed)$.unsubscribe(Z);let W=this.byTopic.get(Z);if(!W)return;if(W.delete($),W.size>0)return;this.byTopic.delete(Z),this.topicReady.delete(Z),Promise.resolve().then(()=>this.manager.topicRemoved(Z)).catch((X)=>console.error(`[gemi] The broadcast driver could not unsubscribe from "${Z}".`,X))}deliver($,Z){let z=this.byTopic.get($);if(!z||!this.server)return;let G=this.config.backpressureLimit;for(let W of z)if(!W.data.closing&&W.getBufferedAmount()>G)console.warn(`[gemi] Socket closed for backpressure (1013) on "${$}".`),E3(W,C.TryAgainLater,"Too far behind; reconnect.");this.server.publish($,Z)}applyRevocation($){if("user"in $){for(let W of this.sockets)if(W.data.userId===$.user&&!W.data.closing)E3(W,C.Revoked,"Revoked.");return}let Z=$.topic,z=++this.revocationSeq;this.revokedAt.set(Z,z);let G=this.byTopic.get(Z);if(!G)return;for(let W of G)this.reauthorize(W,Z,z)}async reauthorize($,Z,z){let G=$.data,W=[...G.subs].filter(([,Y])=>Y.topic===Z);if(W.length===0)return;$.unsubscribe(Z);let X=await Promise.all(W.map(([,Y])=>this.authorize($,Y).catch((K)=>{return console.error(`[gemi] Authorizing "${Z}" again after a revoke failed.`,K),{ok:!1,code:"revoked"}})));if(G.closed)return;if(this.revokedAt.get(Z)!==z)return;if(W.forEach(([Y,K],U)=>{let Q=X[U];if(G.subs.get(Y)!==K)return;if(Q.ok===!0&&Q.topic===Z)return;G.subs.delete(Y),this.leave($,Z),q($,Y,"revoked")}),!G.topics.has(Z))return;$.subscribe(Z);for(let[Y,K]of G.subs)if(K.topic===Z)i($,{op:"subscribed",id:Y,t:Z})}sendAll($){let Z=JSON.stringify($);for(let z of this.sockets)z.send(Z)}shutdown($={}){if(this.closed)return this.closed;this.closing=!0,this.closed=new Promise((G)=>{this.onAllClosed=G});let Z=[...this.sockets];if(Z.length===0)this.onAllClosed?.();if(Z.length>0)console.log(`[gemi] Closing ${Z.length} broadcast socket(s) (1012).`);for(let G of Z)this.sayBye(G);return setTimeout(()=>{for(let G of Z)try{G.terminate()}catch{}this.onAllClosed?.()},$.terminateAfterMs??2000).unref?.(),this.closed}get isClosing(){return this.closing}sayBye($){i($,{op:"bye",code:C.Restart,retryAfter:1000+Math.floor(Math.random()*4000)}),E3($,C.Restart,"Server restarting.")}run($){return K3.run(this.application,$)}}function ZZ($,Z){let z=/^(?:(https?):\/\/)?\*\.([^/:]+)(?::(\d+))?\/?$/i.exec($);if(z){let[,G,W,X]=z;if(G&&`${G.toLowerCase()}:`!==Z.protocol)return!1;if((X??"")!==Z.port)return!1;return Z.hostname.toLowerCase().endsWith(`.${W.toLowerCase().replace(/\.$/,"")}`)}if(/^https?:\/\//i.test($))try{return new URL($).origin===Z.origin}catch{return!1}return $.toLowerCase().replace(/\/$/,"")===Z.host.toLowerCase()}function E3($,Z,z){$.data.closing=!0,$.close(Z,z)}function i($,Z){$.send(JSON.stringify(Z))}function q($,Z,z){i($,{op:"denied",id:Z,code:z})}function M($,Z,z={}){return new Response(Z,{status:$,headers:{"Content-Type":"text/plain; charset=utf-8",...z}})}function zZ($){if(typeof $!=="object"||$===null||Array.isArray($))return!1;return Object.values($).every((Z)=>typeof Z==="string"||typeof Z==="number")}function GZ($){let Z=$?.id;return typeof Z==="string"||typeof Z==="number"?String(Z):null}function WZ($,Z){let z=$.headers.get("x-forwarded-for")?.split(",")[0]?.trim();if(z)return z;try{return Z.requestIP($)?.address??null}catch{return null}}function g9($,Z){if(!Z)return;let z=($.get(Z)??0)-1;if(z<=0)$.delete(Z);else $.set(Z,z)}class XZ extends F{register(){this.app.singleton(b,()=>new b(this.app.config.get("broadcast",{}),{application:this.app,channels:this.app.config.get("route.channels")})),this.app.singleton(n,()=>new n(this.app.make(b),this.app))}boot(){let $=this.app.config.get("route.channels");if($)c9(new $)}async shutdown(){if(this.app.resolved(n))this.app.make(n).shutdown();if(!this.app.resolved(b))return;await this.app.make(b).close()}}class YZ extends F{register(){this.app.singleton(e,()=>new e(this.app.config.get("changeFeed",{}),{application:this.app}))}async shutdown(){if(!this.app.resolved(e))return;await this.app.make(e).close()}}class KZ extends F{register(){this.app.singleton(w3,()=>new w3(this.app.config.get("auth",{}))),this.app.singleton(f3,()=>{let $=this.app.config.get("auth",{});return new f3({providers:$.connections??{},store:$.connectionStore??void 0})})}}var QZ=100,UZ=($)=>Math.min(QZ,Math.floor($/10));class HZ extends F{register(){this.app.singleton(g,()=>new g(L(v3(),this.app.config.get("schedule",{}))))}async boot(){let $=this.app.make(g),Z=this.app.config.get("schedule",{});if(Z.jobs===void 0){let{jobsDir:G}=L(v3(),Z);$.useJobs(await d9(G))}if(process.env.GEMI_NO_SCHEDULE==="1")return;let z=this.app;if(z.bound(v))$.useLocks(()=>z.make(v));$.start((G)=>K3.run(z,G))}async shutdown($){if(!this.app.resolved(g))return;let Z=this.app.make(g);if(Z.running>0)console.log(`[gemi] Shutting down: waiting for ${Z.running} running cron tick(s).`);let z=$?.timeoutMs,{unfinished:G}=await Z.drain(z===void 0?1/0:Math.max(0,z-UZ(z)));if(G.length>0)return console.error("[gemi] Cron jobs still running at shutdown: "+G.map((W)=>`${W.name} (started ${W.startedAt.toISOString()})`).join(", ")),{abandoned:!0}}}class t extends l9{modelName;constructor($="FeatureFlag"){super();this.modelName=$}get available(){return p9(this.modelName)}async load(){if(!this.available)throw new h3(this.modelName);let $=g3(this.modelName);return await $.asSystem(()=>$.findMany())}async write($,Z,z){if(!this.available)throw new h3(this.modelName);let G=g3(this.modelName),W=this.hasActorColumn(G),X={active:Z};if(W)X.updatedBy=z.actor;return await G.asSystem(()=>G.upsert({where:{key:$},create:{key:$,...X},update:X})),{actorRecorded:W}}hasActorColumn($){let Z=$?.$schema?.fields?.updatedBy;return Z!==void 0&&Z.type==="String"}}function W6($){return $}function i9(){return{features:void 0,enabled:!0,source:new t,model:"FeatureFlag",ttl:30,context:void 0,onEvaluate:void 0,maxClientFlags:200}}class VZ extends F{register(){this.app.singleton(U3,()=>{let $=this.app.config.get("features",{}),Z=L(i9(),$);if($?.model!==void 0&&$?.source===void 0)Z.source=new t($.model);else if($?.model!==void 0&&$.source instanceof t&&$.source.modelName!==$.model)Q3.warning(`app/config/features.ts sets \`model: "${$.model}"\` and a source reading "${$.source.modelName}". The source wins; drop \`model\` to silence this.`);return new U3(Z,(z)=>Q3.warning(z))})}async boot(){let $=this.app.make(U3);if(!$.config.enabled)return;try{await $.refresh()}catch(Z){Q3.error(`Could not warm the feature flag cache at boot. ${Z instanceof Error?Z.message:String(Z)}`)}}}class JZ extends F{register(){this.app.singleton(m3,()=>new m3(this.app.config.get("mail",{})))}}class FZ extends F{register(){this.app.singleton(H3,()=>new H3(this.app.config.get("encryption",{})))}boot(){if(this.app.make(H3).configured)return;let Z=this.app.config.get("auth",{}),z=Object.keys(Z?.connections??{});if(z.length>0&&!Z?.connectionStore)throw new u3(`auth.connections (${z.join(", ")}) keeps OAuth tokens encrypted, but no encryption key is configured. Add app/config/encryption.ts (defineEncryptionConfig({ keys: { k1: process.env.APP_ENCRYPTION_KEY } })) and list it as \`encryption\` in your Kernel's config. Generate a key with \`openssl rand -base64 32\`.`);let G=n9();if(G.length===0)return;throw new u3(`${G.join(", ")} ${G.length===1?"is an encrypted column":"are encrypted columns"}, but no encryption key is configured. Add app/config/encryption.ts (defineEncryptionConfig({ keys: { k1: process.env.APP_ENCRYPTION_KEY } })) and list it as \`encryption\` in your Kernel's config. Generate a key with \`openssl rand -base64 32\`.`)}}var NZ=Symbol.for("gemi.broadcastEvent");function t9($){return typeof $==="object"&&$!==null&&$[NZ]===!0}function BZ($){return`listener:${$}`}function o9($,Z){xZ($);let{maxAttempts:z,backoff:G,worker:W}=Z,X=$.event.name,Y=class extends s9{maxAttempts=z;backoff=G;worker=W;async run(...K){let[U,Q]=IZ(K),H=k(h).rehydrate(U,Q);await new $().handle(H)}onFail(K){console.error(`The listener ${$.name} threw while handling ${X} off the queue. The queue will retry it up to ${z} times in total; nothing the dispatcher did is waiting on it.`,K)}onDeadletter(K){console.error(`The listener ${$.name} failed every one of its ${z} attempts at ${X} and has been dead-lettered, so this side effect did not happen and will not be retried.`,K)}};return Object.defineProperty(Y,"name",{value:BZ($.name),writable:!0}),Y}function xZ($){if(Object.getOwnPropertyDescriptor($,"name")?.writable)return;throw Error(`The listener ${$.name} sets \`queued = true\` but does not declare \`static name\`, so it would be registered with the queue `+"under its class name \u2014 which a production build renames while the "+`payload that names it does not. Add: static name = "${$.name}";`)}function IZ($){return typeof $[0]==="string"?$:$[0]}class h{static token="events";listeners={};events={};warnedFor=new Set;warnedAboutWaiting=new Set;config;constructor($={}){this.config=L(V3(),$),this.useListeners(this.config.listeners)}useListeners($){this.config.listeners=$,this.listeners={},this.events={};let Z=new Set;for(let z of $){if(!z.event){console.error(`Listener ${z.name} does not declare \`static event\`, so there is no event name to register it under and its handle will never run. Add: static event = SomeEvent;`);continue}if(Z.has(z.name)){console.error(`Two event listeners are named "${z.name}" \u2014 the first is `+"registered and this one is not. A listener's name identifies it across the framework, so only one class can hold it. Rename one.");continue}Z.add(z.name);let G=z.event.name,W=new z;this.events[G]??=z.event,(this.listeners[G]??=[]).push({listener:z,job:W.queued?o9(z,W):null})}}get queuedListenerJobs(){return Object.values(this.listeners).flat().flatMap(({job:$})=>$?[$]:[])}get registeredListeners(){return[...this.config.listeners]}dispatch($,Z){if(this.deferToCommit($,Z,!1))return;this.runListeners($,Z)}async dispatchAndWait($,Z){if(this.deferToCommit($,Z,!0))return;return this.runListeners($,Z)}deferToCommit($,Z,z){let{name:G,afterCommit:W}=$.constructor;if(!W)return!1;let X=a9(()=>this.runListeners($,Z));if(X&&z)this.warnNothingIsWaitedFor(G);return X}async runListeners($,Z){let z=$.constructor.name,G=this.listeners[z]??[],W=t9($);if(G.length===0&&!W){this.warnNothingIsListening(z);return}for(let{listener:X,job:Y}of G){if(Y){this.enqueue(Y,X,z,Z);continue}try{await new X().handle($)}catch(K){console.error(`The listener ${X.name} threw while handling ${z}. The `+"listeners after it still ran \u2014 a listener's failure is its own.",K)}}if(W)this.broadcast($,z)}broadcast($,Z){try{k(b).broadcastEvent($)}catch(z){console.error(`The event ${Z} could not be broadcast.`,z)}}rehydrate($,Z=[]){let z=this.events[$];if(!z)throw Error(`Cannot rebuild the event "${$}" that came off the queue: no registered listener binds to an event of that name, so there is no class to construct. A queued listener runs in an application that `+"discovered its own listeners \u2014 check that this process sees the "+`same app/listeners as the one that dispatched, and that the event declares \`static name = "${$}"\`.`);return new z(...Z)}enqueue($,Z,z,G){if(G===void 0){console.error(`The listener ${Z.name} is queued, but ${z} reached the dispatcher without its constructor arguments, so there is nothing for the queue to rebuild it from and the listener was skipped. Dispatch through ${z}.dispatch(...) or ${z}.dispatchAndWait(...), which carry them.`);return}let W=(X)=>console.error(`The listener ${Z.name} could not be queued for ${z}, so it did not run and will not be retried. The listeners after it still ran.`,X);try{k(D).push($,JSON.stringify([z,G]),{reportFailure:!1}).catch(W)}catch(X){W(X)}}warnNothingIsWaitedFor($){if(Bun.env.NODE_ENV==="production")return;if(this.warnedAboutWaiting.has($))return;this.warnedAboutWaiting.add($),console.warn(`[gemi] ${$}.dispatchAndWait() was called inside a transaction and ${$} declares \`static afterCommit = true\`, so it resolved `+"immediately with no listener having run \u2014 they run when the "+"transaction commits. Await the transaction instead, or drop afterCommit if the caller needs the side effects first. Development only.")}warnNothingIsListening($){if(Bun.env.NODE_ENV==="production")return;if(this.warnedFor.has($))return;this.warnedFor.add($),console.warn(`[gemi] ${$} was dispatched and nothing is listening for it. A listener registers under the name its event declares, so check that app/listeners holds a Listener with \`static event = ${$}\` and that ${$} declares \`static name = "${$}"\`. Development only.`)}}class PZ extends F{register(){this.app.singleton(h,()=>new h(this.app.config.get("events",{})))}async boot(){let $=this.app.make(h),Z=this.app.config.get("events",{});if(Z.listeners===void 0){let{listenersDir:W}=L(V3(),Z);$.useListeners(await r9(W))}let z=$.queuedListenerJobs;if(z.length===0)return;let G=this.app.make(D);for(let W of z)G.registerJob(W)}}class _Z extends F{register(){this.app.singleton(c3,()=>new c3(this.app.config.get("filesystem",{})))}}class LZ extends F{register(){this.app.singleton(d3,()=>new d3(this.app.config.get("image",{})))}}class DZ extends F{register(){this.app.instance(p3,new p3)}}function a6($){return $}function e9(){return{maxFileSize:10485760,onLogFileClosed:()=>{},onLogCreated:()=>{}}}class AZ extends F{register(){this.app.singleton(J3,()=>new J3(L(e9(),this.app.config.get("log",{}))))}async boot(){if(!process.env.ROOT_DIR)return;await this.app.make(J3).boot()}}class OZ extends F{register(){this.app.singleton(l,()=>new l(L($$(),this.app.config.get("middleware",{}))))}boot(){this.app.make(l).assertGlobalMiddleware()}}function H8($){return $}function z$(){return{driver:new Z$,limit:1000,window:60}}class jZ extends F{register(){this.app.singleton(p,()=>new p(L(z$(),this.app.config.get("ratelimiter",{}))))}}function I8($){return $}function G$(){return{url:process.env.REDIS_URL,options:void 0}}class CZ extends F{register(){this.app.singleton($3,()=>new $3(L(G$(),this.app.config.get("redis",{}))))}shutdown(){if(!this.app.resolved($3))return;this.app.make($3).close()}}function F3($,Z){let z=$.get(Z);if(!z)throw Error(`Missing "${Z}" configuration. Route dispatching needs a root router \u2014 declare it in "app/config/route.ts".`);return z}class TZ extends F{register(){this.app.singleton(s,()=>new s(F3(this.app.config,"route.api"))),this.app.singleton(Z3,()=>new Z3(F3(this.app.config,"route.view"))),this.app.singleton(N3,()=>new N3({api:this.app.make(s),view:this.app.make(Z3)},{api:F3(this.app.config,"route.api"),view:F3(this.app.config,"route.view"),domains:this.app.config.get("route.domains")})),this.app.singleton(d,()=>{let $=this.app.config.get("route.mcp");if(!$?.router)throw Error('No MCP router is configured. Declare one as `mcp: { router }` in "app/config/route.ts".');return new d(new $.router,this.app.make(s),{files:$.remote?.files})}),this.registerMcpHttp()}registerMcpHttp(){this.app.singleton(r,()=>{let $=this.app.config.get("route.mcp");if(!$?.remote?.enabled)throw Error("The MCP endpoint is not enabled: set route.mcp.remote.enabled.");return new r(this.app.make(d),$.remote)})}boot(){if(this.app.make(s),this.app.make(Z3),this.app.make(N3),this.app.config.get("route.mcp"))this.app.make(d);let $=this.app.config.get("route.mcp.remote");if($?.enabled===!0)this.app.make(r);else if($?.enabled!==void 0&&$.enabled!==!1)throw Error("route.mcp.remote.enabled must be true or false.")}}
-export{X$ as db,O as eb,a as fb,d as gb,I3 as hb,T$ as ib,P3 as jb,C3 as kb,T3 as lb,r as mb,g as nb,i$ as ob,V2 as pb,v9 as qb,n as rb,XZ as sb,YZ as tb,KZ as ub,HZ as vb,t as wb,W6 as xb,i9 as yb,VZ as zb,JZ as Ab,FZ as Bb,NZ as Cb,t9 as Db,h as Eb,PZ as Fb,_Z as Gb,LZ as Hb,DZ as Ib,a6 as Jb,e9 as Kb,AZ as Lb,OZ as Mb,H8 as Nb,z$ as Ob,jZ as Pb,I8 as Qb,G$ as Rb,CZ as Sb,TZ as Tb};
-
-//# debugId=3D2EF7500AC449F164756E2164756E21