gemi 0.130.0 → 0.131.0

package/dist/services/queue/work.js

@@ -1,4 +1,4 @@
 // @bun
-import{Fd as H,Id as _}from"../../chunk-t7gvgz20.js";import{vj as O}from"../../chunk-pgh7gsag.js";import"../../chunk-2z1gd231.js";import"../../chunk-4yp84g2y.js";import"../../chunk-peng31np.js";import"../../chunk-1yttk239.js";import"../../chunk-cp84b0ev.js";import"../../chunk-njaxnv6c.js";import{Ok as U,Pk as V,Tk as Z}from"../../chunk-np73p641.js";import{Xk as Y}from"../../chunk-ty5sp1ym.js";import"../../chunk-xtnbcbkf.js";import X from"path";function T(z){if(!z.config.get("route.channels"))return null;let C=z.config.get("broadcast",{}).driver;if(!(C===void 0||C==="memory"||C instanceof O))return null;return'[gemi] Broadcasts from this worker reach no one: the broadcast driver is "memory", which delivers to the sockets of the process that emits, and a worker has none. Set `driver: "redis"` in app/config/broadcast.ts.'}class J extends Error{name="QueueWorkerRefused"}class N{kernel;stopping;keepAlive;settings;constructor(z,C={}){this.kernel=z;this.settings={...V(),...C}}async start(){if(await this.kernel.waitForBoot(),this.stopping)return;let z=this.kernel.app;if(!z.bound(H))throw new J("[gemi] `gemi queue:work` has no queue to claim from: this application does not register QueueServiceProvider.");let C=z.make(H);if(!C.durable)throw new J('[gemi] `gemi queue:work` refuses to start: the queue uses the memory driver, which keeps each job in the process that dispatched it, so a worker never sees one. Set `driver: "database"` (or another driver every process can reach) in app/config/queue.ts, or run jobs in the server and drop the worker.');C.start(),this.keepAlive=setInterval(()=>{},1073741824),console.log(`[gemi] Queue worker started: claiming up to ${C.config.concurrency} job(s) at a time.`);let E=T(z);if(E)console.warn(E)}stop(z={}){return this.stopping??=this.drain({...this.settings,...z}),this.stopping}async drain(z){U();let C=this.kernel.app,E=C.resolved(H)?C.make(H):void 0;if(E)console.log(`[gemi] Shutting down: waiting for ${E.running} running job(s) (up to ${z.timeoutMs/1000}s).`),await E.drain(z.timeoutMs);let F=await this.kernel.shutdown({timeoutMs:z.providerTimeoutMs});clearInterval(this.keepAlive);let G=(E?.running??0)===0&&F.failed.length===0&&F.timedOut.length===0;return console.log(`[gemi] Shutdown ${G?"complete":"finished with errors"}.`),G?0:1}}async function $(){let z=Y();process.env.ROOT_DIR=z,process.env.APP_DIR=X.join(z,"app"),_();let C=X.join(z,"app/kernel/Kernel.ts"),{default:E}=await import(C);if(typeof E!=="function")return console.error(`[gemi] ${C} has no default export to boot the worker from.`),1;let F=new E;F.boot();let G=new N(F);Z(()=>G.stop());try{await G.start()}catch(L){if(!(L instanceof J))throw L;return console.error(L.message),1}return}$().then((z)=>{if(z!==void 0)process.exit(z)},(z)=>{console.error("[gemi] The queue worker failed to start:",z),process.exit(1)});
+import{Fd as H,Id as _}from"../../chunk-0g5f8ymy.js";import{wj as O}from"../../chunk-z1gjgr1c.js";import"../../chunk-j4y0sjdc.js";import"../../chunk-w26cw41m.js";import"../../chunk-0q68t71d.js";import"../../chunk-e4ay1vg9.js";import"../../chunk-35zw2s61.js";import"../../chunk-h0xye69a.js";import{Pk as U,Qk as V,Uk as Z}from"../../chunk-mz73066c.js";import{Yk as Y}from"../../chunk-hdgbh8hn.js";import"../../chunk-aprjvzrz.js";import X from"path";function T(z){if(!z.config.get("route.channels"))return null;let C=z.config.get("broadcast",{}).driver;if(!(C===void 0||C==="memory"||C instanceof O))return null;return'[gemi] Broadcasts from this worker reach no one: the broadcast driver is "memory", which delivers to the sockets of the process that emits, and a worker has none. Set `driver: "redis"` in app/config/broadcast.ts.'}class J extends Error{name="QueueWorkerRefused"}class N{kernel;stopping;keepAlive;settings;constructor(z,C={}){this.kernel=z;this.settings={...V(),...C}}async start(){if(await this.kernel.waitForBoot(),this.stopping)return;let z=this.kernel.app;if(!z.bound(H))throw new J("[gemi] `gemi queue:work` has no queue to claim from: this application does not register QueueServiceProvider.");let C=z.make(H);if(!C.durable)throw new J('[gemi] `gemi queue:work` refuses to start: the queue uses the memory driver, which keeps each job in the process that dispatched it, so a worker never sees one. Set `driver: "database"` (or another driver every process can reach) in app/config/queue.ts, or run jobs in the server and drop the worker.');C.start(),this.keepAlive=setInterval(()=>{},1073741824),console.log(`[gemi] Queue worker started: claiming up to ${C.config.concurrency} job(s) at a time.`);let E=T(z);if(E)console.warn(E)}stop(z={}){return this.stopping??=this.drain({...this.settings,...z}),this.stopping}async drain(z){U();let C=this.kernel.app,E=C.resolved(H)?C.make(H):void 0;if(E)console.log(`[gemi] Shutting down: waiting for ${E.running} running job(s) (up to ${z.timeoutMs/1000}s).`),await E.drain(z.timeoutMs);let F=await this.kernel.shutdown({timeoutMs:z.providerTimeoutMs});clearInterval(this.keepAlive);let G=(E?.running??0)===0&&F.failed.length===0&&F.timedOut.length===0;return console.log(`[gemi] Shutdown ${G?"complete":"finished with errors"}.`),G?0:1}}async function $(){let z=Y();process.env.ROOT_DIR=z,process.env.APP_DIR=X.join(z,"app"),_();let C=X.join(z,"app/kernel/Kernel.ts"),{default:E}=await import(C);if(typeof E!=="function")return console.error(`[gemi] ${C} has no default export to boot the worker from.`),1;let F=new E;F.boot();let G=new N(F);Z(()=>G.stop());try{await G.start()}catch(L){if(!(L instanceof J))throw L;return console.error(L.message),1}return}$().then((z)=>{if(z!==void 0)process.exit(z)},(z)=>{console.error("[gemi] The queue worker failed to start:",z),process.exit(1)});
 
-//# debugId=DDC2C5523D47685664756E2164756E21
+//# debugId=D2C30B0C0F737DA264756E2164756E21

package/dist/services/queue/work.js.map

@@ -7,6 +7,6 @@
     "import type { Application, ShutdownReport } from \"../../foundation/Application\";\nimport { markShuttingDown, shutdownSettings, type ShutdownSettings } from \"../../server/shutdown\";\nimport { memoryBroadcastInWorker } from \"../broadcast/workerWarning\";\nimport { QueueManager } from \"./QueueManager\";\n\n/** The part of a `Kernel` a worker drives. */\nexport type WorkerKernel = {\n  readonly app: Application;\n  waitForBoot(): Promise<void>;\n  shutdown(options?: { timeoutMs?: number }): Promise<ShutdownReport>;\n};\n\n/**\n * A worker that was told to start in an application it cannot claim for. The\n * message is written for the operator reading the deploy's logs.\n */\nexport class QueueWorkerRefused extends Error {\n  name = \"QueueWorkerRefused\";\n}\n\n/**\n * The process `gemi queue:work` runs: the application booted as a server boots\n * it, claiming from the queue, and no `Bun.serve`. It exists so job capacity\n * can be scaled apart from request traffic, which needs a driver both kinds of\n * process can reach; see `start` for why the memory driver is refused.\n *\n * The caller marks the process as a worker (`markQueueWorker`) before the\n * kernel registers, so every claim rule that asks `claimsInThisProcess` sees a\n * process that claims, whatever `GEMI_QUEUE_CLAIM` says.\n */\nexport class QueueWorker {\n  private stopping: Promise<number> | undefined;\n  private keepAlive: ReturnType<typeof setInterval> | undefined;\n  private readonly settings: ShutdownSettings;\n\n  /**\n   * `settings` default to the `GEMI_SHUTDOWN_*` variables, read here rather\n   * than at the signal so a bad value is warned about while the deploy is\n   * being watched, as `Server.start` does.\n   */\n  constructor(\n    private readonly kernel: WorkerKernel,\n    settings: Partial<ShutdownSettings> = {},\n  ) {\n    this.settings = { ...shutdownSettings(), ...settings };\n  }\n\n  /**\n   * Boots the application and starts claiming. Rejects with\n   * `QueueWorkerRefused` when the application has no queue, or its queue uses\n   * the memory driver.\n   *\n   * Refused rather than warned about, because a memory worker can never do\n   * anything: its jobs live in a `Map` in the process that dispatched them,\n   * so a worker's is always empty. Left running, it looks like a healthy\n   * deploy — a process up, no errors — that runs nothing, and scaling it out\n   * adds no capacity. An exit the platform reports as a crash loop is a form\n   * of the mistake someone will see.\n   */\n  async start(): Promise<void> {\n    await this.kernel.waitForBoot();\n    // A signal during the boot has already drained and cleared the handle\n    // below. Going on would start the loop again and arm a handle nothing\n    // clears, holding open a worker that has finished shutting down.\n    if (this.stopping) return;\n\n    const application = this.kernel.app;\n    // `bound`, not `make` in a try: an application built without the queue\n    // provider is a configuration to name, not an unbound-token stack trace.\n    if (!application.bound(QueueManager)) {\n      throw new QueueWorkerRefused(\n        \"[gemi] `gemi queue:work` has no queue to claim from: this application \" +\n          \"does not register QueueServiceProvider.\",\n      );\n    }\n    const queue = application.make(QueueManager);\n    if (!queue.durable) {\n      throw new QueueWorkerRefused(\n        \"[gemi] `gemi queue:work` refuses to start: the queue uses the memory \" +\n          \"driver, which keeps each job in the process that dispatched it, so \" +\n          'a worker never sees one. Set `driver: \"database\"` (or another driver ' +\n          \"every process can reach) in app/config/queue.ts, or run jobs in the \" +\n          \"server and drop the worker.\",\n      );\n    }\n\n    // Idempotent: a production boot with a durable driver has already started\n    // it (`startClaimingIfServing`). Development has not, and a worker claims\n    // in either.\n    queue.start();\n    // The queue's poll timer is unref'd, so that a script's queue does not\n    // hold it open; here the queue is the process, and without a handle of its\n    // own an idle worker would exit 0 as soon as it booted.\n    this.keepAlive = setInterval(() => {}, 1 << 30);\n    console.log(\n      `[gemi] Queue worker started: claiming up to ${queue.config.concurrency} job(s) at a time.`,\n    );\n    const broadcastWarning = memoryBroadcastInWorker(application);\n    if (broadcastWarning) console.warn(broadcastWarning);\n  }\n\n  /**\n   * Stops claiming, waits for the running jobs, runs every provider's\n   * `shutdown()`, and resolves with the exit code: 0 when no job was left\n   * running and every provider finished in time, 1 otherwise. Idempotent.\n   *\n   * `gemi start`'s drain, with the jobs where the requests were:\n   * `isShuttingDown()` turns true, which stops a durable queue claiming;\n   * running jobs get `timeoutMs` (`GEMI_SHUTDOWN_TIMEOUT`), which a server\n   * spends on requests; then `Application.shutdown` gets `providerTimeoutMs`,\n   * and in it the queue provider waits for whatever is still running and\n   * names it. The two budgets add up as they do for a server, so a worker\n   * fits the same grace period. `delayMs` is not waited: it is for a load\n   * balancer, and nothing routes to a worker.\n   */\n  stop(settings: Partial<ShutdownSettings> = {}): Promise<number> {\n    this.stopping ??= this.drain({ ...this.settings, ...settings });\n    return this.stopping;\n  }\n\n  private async drain(settings: ShutdownSettings): Promise<number> {\n    markShuttingDown();\n    const application = this.kernel.app;\n    // Resolving the manager now would build a driver only to stop it, which\n    // is what a signal during the boot, before the provider resolved it, finds.\n    const queue = application.resolved(QueueManager) ? application.make(QueueManager) : undefined;\n    if (queue) {\n      console.log(\n        `[gemi] Shutting down: waiting for ${queue.running} running job(s) ` +\n          `(up to ${settings.timeoutMs / 1000}s).`,\n      );\n      await queue.drain(settings.timeoutMs);\n    }\n\n    const report = await this.kernel.shutdown({ timeoutMs: settings.providerTimeoutMs });\n    clearInterval(this.keepAlive);\n    const clean =\n      (queue?.running ?? 0) === 0 && report.failed.length === 0 && report.timedOut.length === 0;\n    console.log(`[gemi] Shutdown ${clean ? \"complete\" : \"finished with errors\"}.`);\n    return clean ? 0 : 1;\n  }\n}\n"
   ],
   "mappings": ";gcAYA,kBCDO,OAAS,DAAuB,DAAC,AAAyC,DAC/E,CAAI,DAAC,AAAY,KAAO,IAAI,gBAAgB,EAAG,OAAO,KACtD,IAAM,EAAS,EAAY,OAAO,IAAqB,YAAa,CAAC,CAAC,EAAE,OAGxE,GAAI,EADF,IAAW,QAAa,IAAW,UAAY,aAAkB,GACtD,OAAO,KACpB,MACE,uNCFG,MAAM,UAA2B,KAAM,CAC5C,KAAO,oBACT,CAYO,MAAM,CAAY,CAWJ,OAVX,SACA,UACS,SAOjB,WAAW,CACQ,EACjB,EAAsC,CAAC,EACvC,CAFiB,cAGjB,KAAK,SAAW,IAAK,EAAiB,KAAM,CAAS,OAejD,MAAK,EAAkB,CAK3B,GAJA,MAAM,KAAK,OAAO,YAAY,EAI1B,KAAK,SAAU,OAEnB,IAAM,EAAc,KAAK,OAAO,IAGhC,GAAI,CAAC,EAAY,MAAM,CAAY,EACjC,MAAM,IAAI,EACR,+GAEF,EAEF,IAAM,EAAQ,EAAY,KAAK,CAAY,EAC3C,GAAI,CAAC,EAAM,QACT,MAAM,IAAI,EACR,8SAKF,EAMF,EAAM,MAAM,EAIZ,KAAK,UAAY,YAAY,IAAM,GAAI,UAAO,EAC9C,QAAQ,IACN,+CAA+C,EAAM,OAAO,+BAC9D,EACA,IAAM,EAAmB,EAAwB,CAAW,EAC5D,GAAI,EAAkB,QAAQ,KAAK,CAAgB,EAiBrD,IAAI,CAAC,EAAsC,CAAC,EAAoB,CAE9D,OADA,KAAK,WAAa,KAAK,MAAM,IAAK,KAAK,YAAa,CAAS,CAAC,EACvD,KAAK,cAGA,MAAK,CAAC,EAA6C,CAC/D,EAAiB,EACjB,IAAM,EAAc,KAAK,OAAO,IAG1B,EAAQ,EAAY,SAAS,CAAY,EAAI,EAAY,KAAK,CAAY,EAAI,OACpF,GAAI,EACF,QAAQ,IACN,qCAAqC,EAAM,iCAC/B,EAAS,UAAY,SACnC,EACA,MAAM,EAAM,MAAM,EAAS,SAAS,EAGtC,IAAM,EAAS,MAAM,KAAK,OAAO,SAAS,CAAE,UAAW,EAAS,iBAAkB,CAAC,EACnF,cAAc,KAAK,SAAS,EAC5B,IAAM,GACH,GAAO,SAAW,KAAO,GAAK,EAAO,OAAO,SAAW,GAAK,EAAO,SAAS,SAAW,EAE1F,OADA,QAAQ,IAAI,mBAAmB,EAAQ,WAAa,yBAAyB,EACtE,EAAQ,EAAI,EAEvB,CF1HA,eAAe,CAAI,EAAgC,CACjD,IAAM,EAAU,EAAY,EAI5B,QAAQ,IAAI,SAAW,EACvB,QAAQ,IAAI,QAAU,EAAK,KAAK,EAAS,KAAK,EAE9C,EAAgB,EAEhB,IAAM,EAAa,EAAK,KAAK,EAAS,sBAAsB,GACpD,QAAS,GAAY,MAAa,UAG1C,GAAI,OAAO,IAAW,WAEpB,OADA,QAAQ,MAAM,UAAU,kDAA2D,EAC5E,EAET,IAAM,EAAS,IAAI,EACnB,EAAO,KAAK,EAEZ,IAAM,EAAS,IAAI,EAAY,CAAM,EAKrC,EAAuB,IAAM,EAAO,KAAK,CAAC,EAE1C,GAAI,CACF,MAAM,EAAO,MAAM,EACnB,MAAO,EAAO,CACd,GAAI,EAAE,aAAiB,GAAqB,MAAM,EAElD,OADA,QAAQ,MAAM,EAAM,OAAO,EACpB,EAGT,OAGF,EAAK,EAAE,KACL,CAAC,IAAS,CACR,GAAI,IAAS,OAAW,QAAQ,KAAK,CAAI,GAE3C,CAAC,IAAU,CACT,QAAQ,MAAM,2CAA4C,CAAK,EAC/D,QAAQ,KAAK,CAAC,EAElB",
-  "debugId": "DDC2C5523D47685664756E2164756E21",
+  "debugId": "D2C30B0C0F737DA264756E2164756E21",
   "names": []
 }

package/dist/services/router/DomainResolver.d.ts

@@ -59,6 +59,18 @@ export declare class DomainResolver {
      * the platform's health checks and its own domain for the app keep working.
      */
     private forwardedHost;
+    /**
+     * The client address `trustProxy.clientIpHeader` names — its first entry —
+     * or `null` when no such header is configured, the secret is missing or
+     * wrong, or the header is absent or not an IPv4/IPv6 address.
+     */
+    trustedClientIp(req: Request): string | null;
+    /**
+     * Makes `trustedClientIp(req)`, when there is one, the address the rest of
+     * gemi reads: the only entry of `X-Forwarded-For`, with `X-Real-IP` dropped
+     * (as `gemi start` leaves them). Otherwise leaves `req` alone. Idempotent.
+     */
+    applyClientIp(req: Request): void;
     /** The hostname the request is addressed to, honouring `trustProxy`. */
     hostOf(req: Request): string | null;
     /**

package/dist/services/router/DomainResolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DomainResolver.d.ts","sourceRoot":"","sources":["../../../services/router/DomainResolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAyC,aAAa,EAAE,MAAM,UAAU,CAAC;AAErF,qDAAqD;AACrD,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,0CAA0C;AAC1C,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,wEAAwE;IACxE,MAAM,EAAE,OAAO,CAAC;CACjB;AAcD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAO7E;AA4DD,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAS5E;AAeD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,QAsE7D;AAED;;;;GAIG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuD;IAC7E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGlB;IACJ,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6D;IACtF,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;gBAE9B,MAAM,EAAE,aAAa;IAiBjC;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAWrB,wEAAwE;IACxE,MAAM,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM;IAkBlC,0FAA0F;IACpF,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAe3D;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1D,OAAO,CAAC,WAAW;YAIL,KAAK;YA0BL,aAAa;IAuC3B,wEAAwE;IACxE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM;CAUrB"}
+{"version":3,"file":"DomainResolver.d.ts","sourceRoot":"","sources":["../../../services/router/DomainResolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAyC,aAAa,EAAE,MAAM,UAAU,CAAC;AAErF,qDAAqD;AACrD,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,0CAA0C;AAC1C,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,oEAAoE;AACpE,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,wEAAwE;IACxE,MAAM,EAAE,OAAO,CAAC;CACjB;AAcD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAO7E;AAuFD,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAS5E;AAeD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,aAAa,QAsE7D;AAED;;;;GAIG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwC;IAC9D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuD;IAC7E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IACnD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAGlB;IACJ,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6D;IACtF,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;gBAE9B,MAAM,EAAE,aAAa;IAiBjC;;;;;;;;OAQG;IACH,OAAO,CAAC,aAAa;IAWrB;;;;OAIG;IACH,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAa5C;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IASjC,wEAAwE;IACxE,MAAM,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM;IAkBlC,0FAA0F;IACpF,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAe3D;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAK1D,OAAO,CAAC,WAAW;YAIL,KAAK;YA0BL,aAAa;IAuC3B,wEAAwE;IACxE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM;CAUrB"}

package/dist/services/router/ViewRouteDispatcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ViewRouteDispatcher.d.ts","sourceRoot":"","sources":["../../../services/router/ViewRouteDispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,KAAK,cAAc,EAAmC,MAAM,2BAA2B,CAAC;AAEjG,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAA2B,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAU7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAyBxD,OAAO,EAGL,KAAK,cAAc,EAEpB,MAAM,kBAAkB,CAAC;AAiH1B;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAY9D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAQ1D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAM7D;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,KAAK,SAAiB;IAE7B,cAAc,EAAE,cAAc,CAAM;IACpC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAM;IAC7C,0FAA0F;IAC1F,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAM;IACnD,aAAa,EAAE,aAAa,CAAM;IAClC,iBAAiB,EAAE,MAAM,EAAE,CAAM;IACjC;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAM;IAC5B,IAAI,EAAE,GAAG,CAAQ;IACjB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa,CAAgC;IAErD;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY,CAGhB;IAEJ,OAAO,CAAC,QAAQ,CAAC,KAAK,CAKpB;IAEF,8CAA8C;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAEnC,2CAA2C;IAC3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;gBAE1B,MAAM,EAAE,eAAe;IAwCnC;;;;;;OAMG;YACW,kBAAkB;IAQ1B,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO;IAY5E;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAatB,0BAA0B;IAC1B,OAAO,CAAC,kBAAkB;IA0C1B;;;;;;OAMG;YACW,YAAY;YAmHZ,MAAM;IA4cpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;IAyBnB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,gCA7Y7C;QACpB;;;;;WAKG;QACH,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,OAAO,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5F,aAAa,EAAE,GAAG,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClC;;;;;;;;;;;WAWG;QACH,WAAW,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QACpD;;;WAGG;QACH,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,wEAAwE;QACxE,aAAa,CAAC,EAAE,cAAc,CAAC;QAC/B;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;CAs7BJ"}
+{"version":3,"file":"ViewRouteDispatcher.d.ts","sourceRoot":"","sources":["../../../services/router/ViewRouteDispatcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,KAAK,cAAc,EAAmC,MAAM,2BAA2B,CAAC;AAEjG,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAA2B,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,UAAU,CAAC;AAU7F,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAyBxD,OAAO,EAIL,KAAK,cAAc,EAEpB,MAAM,kBAAkB,CAAC;AAkH1B;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAE/C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAY9D;AAaD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAQ1D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,YAM7D;AAED,qBAAa,mBAAmB;IAC9B,MAAM,CAAC,KAAK,SAAiB;IAE7B,cAAc,EAAE,cAAc,CAAM;IACpC,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAM;IAC7C,0FAA0F;IAC1F,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAM;IACnD,aAAa,EAAE,aAAa,CAAM;IAClC,iBAAiB,EAAE,MAAM,EAAE,CAAM;IACjC;;;;OAIG;IACH,YAAY,EAAE,MAAM,EAAE,CAAM;IAC5B,IAAI,EAAE,GAAG,CAAQ;IACjB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa,CAAgC;IAErD;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY,CAGhB;IAEJ,OAAO,CAAC,QAAQ,CAAC,KAAK,CAKpB;IAEF,8CAA8C;IAC9C,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAEnC,2CAA2C;IAC3C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;gBAE1B,MAAM,EAAE,eAAe;IAwCnC;;;;;;OAMG;YACW,kBAAkB;IAQ1B,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO;IAY5E;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IAatB,0BAA0B;IAC1B,OAAO,CAAC,kBAAkB;IA0C1B;;;;;;OAMG;YACW,YAAY;YAoIZ,MAAM;IA4cpB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,iBAAiB;IAyBnB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,IAAI,gCA7Y7C;QACpB;;;;;WAKG;QACH,SAAS,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,OAAO,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5F,aAAa,EAAE,GAAG,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACtC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3B;;;;WAIG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAClC;;;;;;;;;;;WAWG;QACH,WAAW,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;QACpD;;;WAGG;QACH,qBAAqB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,wEAAwE;QACxE,aAAa,CAAC,EAAE,cAAc,CAAC;QAC/B;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB;CAs7BJ"}

package/dist/services/router/config.d.ts

@@ -127,7 +127,8 @@ export interface CustomDomainConfig {
 }
 /**
  * `route.domains.trustProxy` in its long form: which header carries the host
- * the client addressed, and what proves the proxy sent it.
+ * the client addressed, which one its IP address, and what proves the proxy
+ * sent them.
  */
 export interface TrustProxyConfig {
     /**
@@ -142,7 +143,22 @@ export interface TrustProxyConfig {
      */
     hostHeader?: string;
     /**
-     * Trusts `hostHeader` only on a request that carries this header with this
+     * A header the proxy writes the client's IP address into, e.g.
+     * `"x-client-ip"` set from Cloudflare's `CF-Connecting-IP`. On a request
+     * that carries `secret`, its first entry replaces the address
+     * `GEMI_TRUST_PROXY` settled on: gemi writes it into `X-Forwarded-For` (and
+     * drops `X-Real-IP`) before the global middleware runs, so `clientIp(req)`
+     * and every rate limit keyed on it see the visitor rather than the proxy.
+     *
+     * For a proxy whose request to the app is a new one (a Worker's `fetch()`),
+     * so the client's address is not in `X-Forwarded-For` at all. Requires
+     * `secret`: without proof the proxy sent it, any client that reaches the
+     * app directly could pick its own address. A missing header, or one that
+     * is not an IPv4/IPv6 address, changes nothing.
+     */
+    clientIpHeader?: string;
+    /**
+     * Trusts `hostHeader` and `clientIpHeader` only on a request that carries this header with this
      * value — a shared secret the proxy adds, so a client that reaches the app
      * directly, around the proxy, cannot name its own host. Without it the
      * request is routed by its own host, exactly as with `trustProxy` left out.
@@ -167,9 +183,9 @@ export interface DomainsConfig {
      * request URL. Only set it behind a proxy that overwrites that header, or a
      * client picks its own host.
      *
-     * `true` reads `X-Forwarded-Host`. An object names the header, and can make
-     * trusting it depend on a shared secret the proxy sends — see
-     * {@link TrustProxyConfig}.
+     * `true` reads `X-Forwarded-Host`. An object names the header, can make
+     * trusting it depend on a shared secret the proxy sends, and can name a
+     * header that carries the client's IP address — see {@link TrustProxyConfig}.
      *
      * The scheme is read from `X-Forwarded-Proto` whether or not this is set.
      */

package/dist/services/router/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../services/router/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD,MAAM,WAAW,cAAc;IAI7B,UAAU,EAAE,OAAO,SAAS,CAAC;IAE7B,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,KAAK,CAAC;AAG7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC;IAClC,UAAU,EAAE,UAAU,UAAU,CAAC;IAEjC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,CACjB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,aAAa,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAID,MAAM,WAAW,cAAc;IAG7B,MAAM,EAAE,UAAU,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,iCAAiC;IACjC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,mBAAmB;IAC1D;;;;OAIG;IACH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B;AAKD,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACnE,IAAI,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CACP,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,GAAG,EAAE,OAAO,KACT,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,OAAO,EAAE,CACP,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAE5E,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAID,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAExC,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAE7B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAE5B;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1B;AAGD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,cAAc,CAAC;IACpB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAElE;AAGD,wBAAgB,sBAAsB,IAAI,IAAI,CAC5C,QAAQ,CAAC,cAAc,CAAC,EACxB,YAAY,CACb,CAMA;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAC7C,QAAQ,CAAC,eAAe,CAAC,EACzB,MAAM,GAAG,YAAY,CACtB,CASA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../services/router/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGxD,MAAM,WAAW,cAAc;IAI7B,UAAU,EAAE,OAAO,SAAS,CAAC;IAE7B,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED,2CAA2C;AAC3C,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,KAAK,CAAC;AAG7C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC,OAAO,CAAC;IAClC,UAAU,EAAE,UAAU,UAAU,CAAC;IAEjC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvE;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,CACjB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,aAAa,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAID,MAAM,WAAW,cAAc;IAG7B,MAAM,EAAE,UAAU,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,iCAAiC;IACjC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,eAAgB,SAAQ,mBAAmB;IAC1D;;;;OAIG;IACH,KAAK,CAAC,EAAE,oBAAoB,CAAC;CAC9B;AAKD,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACnE,IAAI,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,iBAAkB,SAAQ,kBAAkB;IAC3D;;;;;OAKG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,CACP,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,GAAG,EAAE,OAAO,KACT,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;;;OAIG;IACH,OAAO,EAAE,CACP,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IAE5E,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAID,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;IAExC,MAAM,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAE7B,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAE5B;;;;;;;;;;;;;OAaG;IACH,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1B;AAGD,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,cAAc,CAAC;IACpB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,kBAAkB,CAAC;CAC/B;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAElE;AAGD,wBAAgB,sBAAsB,IAAI,IAAI,CAC5C,QAAQ,CAAC,cAAc,CAAC,EACxB,YAAY,CACb,CAMA;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAC7C,QAAQ,CAAC,eAAe,CAAC,EACzB,MAAM,GAAG,YAAY,CACtB,CASA"}

package/dist/services/router/documentScript.d.ts

@@ -0,0 +1,46 @@
+/**
+ * A static view's document script (#919): `.static({ script: "site/clicks" })`
+ * inlines `app/views/site/clicks.script.ts`, bundled and minified, once in the
+ * document's head.
+ *
+ * `gemi build` bundles every `app/views/**\/*.script.{ts,js}` into
+ * `dist/server/document-scripts.json` (name → source), which `gemi start`
+ * reads. Anywhere else (dev, a test through `app.fetch`) a script is bundled
+ * from source on each use, so an edit shows on the next load.
+ */
+/** The suffix that marks a file under `app/views` as a document script. */
+export declare const DOCUMENT_SCRIPT_SUFFIX = ".script";
+/** Under `dist/server`. */
+export declare const DOCUMENT_SCRIPTS_MANIFEST = "document-scripts.json";
+/** The attribute the inlined `<script>` carries, naming its script. */
+export declare const DOCUMENT_SCRIPT_ATTRIBUTE = "data-gemi-script";
+/** The source file of `name` under `appDir`, or `null` when there is none. */
+export declare function documentScriptFile(appDir: string, name: string): string | null;
+/**
+ * Bundles one script for the browser: imports inlined, minified, wrapped in an
+ * IIFE so nothing leaks into the page's scope. Throws when it does not bundle,
+ * or when the output holds `</script` or `<!--`, which would end (or confuse)
+ * the inline `<script>` element it is put in.
+ */
+export declare function bundleDocumentScript(file: string): Promise<string>;
+/** Every document script under `appDir/views`, bundled: what `gemi build` writes. */
+export declare function bundleDocumentScripts(appDir: string): Promise<Record<string, string>>;
+/** `'sha256-…'` of `source`, for a `script-src` directive. */
+export declare function cspHashOf(source: string): string;
+/** Forgets the manifest read by `documentScriptSource` (tests). @internal */
+export declare function resetDocumentScripts(): void;
+/**
+ * The inlined text of the document script `name`.
+ *
+ * In production, from `dist/server/document-scripts.json`. A name the
+ * manifest lacks (or no manifest) is bundled from source once. Elsewhere it is
+ * bundled from source each time. Throws when there is no such file.
+ */
+export declare function documentScriptSource(name: string): Promise<string>;
+/**
+ * `'sha256-…'` for the document script `name` exactly as a page inlines it,
+ * for a `script-src` directive next to `STATIC_NAVIGATION_CSP_HASH`. In dev
+ * it follows the source, so it changes as the file does.
+ */
+export declare function documentScriptCspHash(name: string): Promise<string>;
+//# sourceMappingURL=documentScript.d.ts.map

package/dist/services/router/documentScript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentScript.d.ts","sourceRoot":"","sources":["../../../services/router/documentScript.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AAEH,2EAA2E;AAC3E,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAEhD,2BAA2B;AAC3B,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AACjE,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAa5D,8EAA8E;AAC9E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9E;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBxE;AAED,qFAAqF;AACrF,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAa3F;AAED,8DAA8D;AAC9D,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAeD,6EAA6E;AAC7E,wBAAgB,oBAAoB,SAGnC;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBxE;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEzE"}

package/dist/services/router/staticDocument.d.ts

@@ -40,6 +40,11 @@ export interface StaticNavigationMarker {
     identity: string;
     prefetch: "intent" | "none";
 }
+/** A document script to inline: its name and bundled source (#919). */
+export interface DocumentScript {
+    name: string;
+    source: string;
+}
 /**
  * Adds the client runtime to a settled static document.
  *
@@ -54,8 +59,13 @@ export interface StaticNavigationMarker {
  *
  * Without a resolver (a test rendering through `app.fetch`), no island table
  * is injected and nothing is logged.
+ *
+ * A `script` (`.static({ script })`) is inlined at the end of the head as a
+ * module script, whatever else the page has. The navigation runtime leaves
+ * the head's scripts alone when it swaps a page in, so it runs once per
+ * document.
  */
-export declare function injectIslands(html: string, collector: StaticRenderCollector, resolveIsland: IslandResolver | undefined, dev: boolean, navigation?: StaticNavigationMarker): string;
+export declare function injectIslands(html: string, collector: StaticRenderCollector, resolveIsland: IslandResolver | undefined, dev: boolean, navigation?: StaticNavigationMarker, script?: DocumentScript): string;
 /**
  * Moves each island's children into its slot.
  *

package/dist/services/router/staticDocument.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"staticDocument.d.ts","sourceRoot":"","sources":["../../../services/router/staticDocument.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAElF,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,CAAC;AAE1D;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE7D,qFAAqF;AACrF,MAAM,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;AAE5E,uEAAuE;AACvE,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAEb,CAAC;AAgBvB;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAEjB,CAAC;AAWvB,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,qBAAqB,EAChC,aAAa,EAAE,cAAc,GAAG,SAAS,EACzC,GAAG,EAAE,OAAO,EACZ,UAAU,CAAC,EAAE,sBAAsB,GAClC,MAAM,CA0CR;AAcD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBtD"}
+{"version":3,"file":"staticDocument.d.ts","sourceRoot":"","sources":["../../../services/router/staticDocument.ts"],"names":[],"mappings":"AACA,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAGlF,OAAO,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,CAAC;AAE1D;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAE7D,qFAAqF;AACrF,MAAM,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;AAE5E,uEAAuE;AACvE,eAAO,MAAM,cAAc,iBAAiB,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAEb,CAAC;AAgBvB;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAEjB,CAAC;AAWvB,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAElD;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC;CAC7B;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,qBAAqB,EAChC,aAAa,EAAE,cAAc,GAAG,SAAS,EACzC,GAAG,EAAE,OAAO,EACZ,UAAU,CAAC,EAAE,sBAAsB,EACnC,MAAM,CAAC,EAAE,cAAc,GACtB,MAAM,CA+CR;AAcD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBtD"}

package/dist/stats/route-table.js

@@ -1,4 +1,4 @@
 // @bun
-import"../chunk-xtnbcbkf.js";import M from"path";import{writeFileSync as Q}from"fs";var L=new Set(["FILE","REDIRECT"]);function H(j){return j.run(()=>{let x=[];for(let{group:z,view:D}of j.domains().viewGroups())for(let[G,B]of Object.entries(D.flatViewRoutes)){let C=D.routeManifest[G]??B.segments.map((K)=>K.viewPath);if(C.length===0||L.has(C.at(-1)))continue;x.push({path:G,group:z,views:C,...B.static?{static:{...B.static.layout?{layout:B.static.layout}:{},...B.static.navigation?{navigation:!0}:{}}}:{}})}return x})}var J=process.argv[2];async function U(){if(!J)throw Error("usage: route-table <out.json>");let j=M.resolve(process.cwd(),"app/kernel/Kernel.ts"),x=await import(j);if(typeof x.default!=="function")throw Error(`${j} has no default export (the Kernel subclass).`);let z=new x.default;z.boot();try{Q(J,JSON.stringify(H(z)))}finally{z.destroy()}}U().then(()=>process.exit(0),(j)=>{console.error(j?.stack??String(j)),process.exit(1)});
+import"../chunk-aprjvzrz.js";import M from"path";import{writeFileSync as Q}from"fs";var L=new Set(["FILE","REDIRECT"]);function H(j){return j.run(()=>{let x=[];for(let{group:z,view:D}of j.domains().viewGroups())for(let[G,B]of Object.entries(D.flatViewRoutes)){let C=D.routeManifest[G]??B.segments.map((K)=>K.viewPath);if(C.length===0||L.has(C.at(-1)))continue;x.push({path:G,group:z,views:C,...B.static?{static:{...B.static.layout?{layout:B.static.layout}:{},...B.static.navigation?{navigation:!0}:{}}}:{}})}return x})}var J=process.argv[2];async function U(){if(!J)throw Error("usage: route-table <out.json>");let j=M.resolve(process.cwd(),"app/kernel/Kernel.ts"),x=await import(j);if(typeof x.default!=="function")throw Error(`${j} has no default export (the Kernel subclass).`);let z=new x.default;z.boot();try{Q(J,JSON.stringify(H(z)))}finally{z.destroy()}}U().then(()=>process.exit(0),(j)=>{console.error(j?.stack??String(j)),process.exit(1)});
 
 //# debugId=05EB0087C5A2060D64756E2164756E21

package/dist/support/index.js

@@ -1,4 +1,4 @@
 // @bun
-import{Nd as Y}from"../chunk-py1twqh8.js";import{Aj as M}from"../chunk-4yp84g2y.js";import{Ck as P,Ek as R}from"../chunk-cp84b0ev.js";import"../chunk-njaxnv6c.js";import{Uk as Q,Vk as U,Wk as V,Xk as W}from"../chunk-ty5sp1ym.js";import"../chunk-xtnbcbkf.js";class S{static token;async boot(){}static inject(){if(!this.token)throw Error(`Service [${this.name}] does not declare a \`static token\`, so the container has no key to resolve it by.`);try{return R(this)}catch(x){throw Error(`Could not inject [${this.name}]. Services are constructed when the kernel boots, so `+"inject() only works from code that runs after that \u2014 a constructor default or a method "+`body, never module top level. Check that [${this.name}] is listed in \`services\` on your Kernel.`,{cause:x})}}static with(x){let f=new this;for(let[C,g]of Object.entries(x))if(g!==void 0)f[C]=g;return f}}import{readdir as z}from"fs/promises";import{join as B,parse as j}from"path";var H=[".ts",".tsx",".js",".mjs",".jsx"];function J(x={}){let f={};for(let[C,g]of Object.entries(x))f[C]=q(g);return new P(f)}async function L(x,f=new P){let C=[];try{C=await z(x)}catch(D){return f}let g=C.filter((D)=>{let{ext:v,name:F}=j(D);return H.includes(v)&&!F.startsWith(".")}).sort();for(let D of g){let{name:v}=j(D),F=await import(B(x,D));f.set(v,q(F))}return f}function q(x){if(x&&typeof x==="object"&&"default"in x)return x.default;return x}export{M as withDefaults,Q as sourceFiles,W as projectRoot,L as loadConfigFrom,V as discoverClasses,J as createConfigRepository,Y as ServiceProvider,S as Service,P as Repository,U as DiscoveryError};
+import{Nd as Y}from"../chunk-py1twqh8.js";import{Bj as M}from"../chunk-w26cw41m.js";import{Dk as P,Fk as R}from"../chunk-35zw2s61.js";import"../chunk-h0xye69a.js";import{Vk as Q,Wk as U,Xk as V,Yk as W}from"../chunk-hdgbh8hn.js";import"../chunk-aprjvzrz.js";class S{static token;async boot(){}static inject(){if(!this.token)throw Error(`Service [${this.name}] does not declare a \`static token\`, so the container has no key to resolve it by.`);try{return R(this)}catch(x){throw Error(`Could not inject [${this.name}]. Services are constructed when the kernel boots, so `+"inject() only works from code that runs after that \u2014 a constructor default or a method "+`body, never module top level. Check that [${this.name}] is listed in \`services\` on your Kernel.`,{cause:x})}}static with(x){let f=new this;for(let[C,g]of Object.entries(x))if(g!==void 0)f[C]=g;return f}}import{readdir as z}from"fs/promises";import{join as B,parse as j}from"path";var H=[".ts",".tsx",".js",".mjs",".jsx"];function J(x={}){let f={};for(let[C,g]of Object.entries(x))f[C]=q(g);return new P(f)}async function L(x,f=new P){let C=[];try{C=await z(x)}catch(D){return f}let g=C.filter((D)=>{let{ext:v,name:F}=j(D);return H.includes(v)&&!F.startsWith(".")}).sort();for(let D of g){let{name:v}=j(D),F=await import(B(x,D));f.set(v,q(F))}return f}function q(x){if(x&&typeof x==="object"&&"default"in x)return x.default;return x}export{M as withDefaults,Q as sourceFiles,W as projectRoot,L as loadConfigFrom,V as discoverClasses,J as createConfigRepository,Y as ServiceProvider,S as Service,P as Repository,U as DiscoveryError};
 
-//# debugId=D730E9098CDA427664756E2164756E21
+//# debugId=C7BC5A516D5D322964756E2164756E21

package/dist/support/index.js.map

@@ -6,6 +6,6 @@
     "import { readdir } from \"node:fs/promises\";\nimport { join, parse } from \"node:path\";\n\nimport { Repository } from \"./Repository\";\n\nconst CONFIG_EXTENSIONS = [\".ts\", \".tsx\", \".js\", \".mjs\", \".jsx\"];\n\n// Builds a Repository from an already-imported map of config modules. The map\n// key becomes the top-level config key, so `{ mail: mailModule }` is readable\n// as `config.get(\"mail.driver\")`. Each entry may be either the module namespace\n// (its `default` export is unwrapped) or the config object itself.\nexport function createConfigRepository(\n  modules: Record<string, any> = {},\n): Repository {\n  const items: Record<string, any> = {};\n\n  for (const [key, mod] of Object.entries(modules)) {\n    items[key] = unwrap(mod);\n  }\n\n  return new Repository(items);\n}\n\n// Reads every config module in an app's `app/config` directory into a\n// Repository. The file's basename is the top-level key: `app/config/mail.ts`\n// populates `mail.*`. A missing directory yields an empty Repository so apps\n// that declare no config still boot.\nexport async function loadConfigFrom(\n  directory: string,\n  repository = new Repository(),\n): Promise<Repository> {\n  let entries: string[] = [];\n\n  try {\n    entries = await readdir(directory);\n  } catch (err) {\n    return repository;\n  }\n\n  const files = entries\n    .filter((entry) => {\n      const { ext, name } = parse(entry);\n      return CONFIG_EXTENSIONS.includes(ext) && !name.startsWith(\".\");\n    })\n    .sort();\n\n  for (const file of files) {\n    const { name } = parse(file);\n    const mod = await import(join(directory, file));\n    repository.set(name, unwrap(mod));\n  }\n\n  return repository;\n}\n\nfunction unwrap(mod: any) {\n  if (mod && typeof mod === \"object\" && \"default\" in mod) {\n    return mod.default;\n  }\n  return mod;\n}\n"
   ],
   "mappings": ";2RAgCO,CAAe,JAAQ,EAOrB,OAMD,AAAI,EAAkB,QAmBrB,OAAS,EAKX,CACH,GAAI,CAAC,KAAK,MACR,MAAU,MACR,YAAY,KAAK,0FACnB,EAGF,GAAI,CACF,OAAO,EAAI,IAAuB,EAClC,MAAO,EAAO,CACd,MAAU,MACR,qBAAqB,KAAK,6DACxB,+FACA,6CAA6C,KAAK,kDAEpD,CAAE,OAAM,CACV,SAoBG,KAAuB,CAAoB,EAA0B,CAC1E,IAAM,EAAW,IAAI,KACrB,QAAY,EAAK,KAAU,OAAO,QAAQ,CAAS,EACjD,GAAI,IAAU,OAAW,EAAS,GAAO,EAE3C,OAAO,EAEX,CChHA,kBAAS,oBACT,eAAS,WAAM,aAIf,IAAM,EAAoB,CAAC,MAAO,OAAQ,MAAO,OAAQ,MAAM,EAMxD,SAAS,CAAsB,CACpC,EAA+B,CAAC,EACpB,CACZ,IAAM,EAA6B,CAAC,EAEpC,QAAY,EAAK,KAAQ,OAAO,QAAQ,CAAO,EAC7C,EAAM,GAAO,EAAO,CAAG,EAGzB,OAAO,IAAI,EAAW,CAAK,EAO7B,eAAsB,CAAc,CAClC,EACA,EAAa,IAAI,EACI,CACrB,IAAI,EAAoB,CAAC,EAEzB,GAAI,CACF,EAAU,MAAM,EAAQ,CAAS,EACjC,MAAO,EAAK,CACZ,OAAO,EAGT,IAAM,EAAQ,EACX,OAAO,CAAC,IAAU,CACjB,IAAQ,MAAK,QAAS,EAAM,CAAK,EACjC,OAAO,EAAkB,SAAS,CAAG,GAAK,CAAC,EAAK,WAAW,GAAG,EAC/D,EACA,KAAK,EAER,QAAW,KAAQ,EAAO,CACxB,IAAQ,QAAS,EAAM,CAAI,EACrB,EAAM,MAAa,SAAK,EAAW,CAAI,GAC7C,EAAW,IAAI,EAAM,EAAO,CAAG,CAAC,EAGlC,OAAO,EAGT,SAAS,CAAM,CAAC,EAAU,CACxB,GAAI,GAAO,OAAO,IAAQ,UAAY,YAAa,EACjD,OAAO,EAAI,QAEb,OAAO",
-  "debugId": "D730E9098CDA427664756E2164756E21",
+  "debugId": "C7BC5A516D5D322964756E2164756E21",
   "names": []
 }

package/dist/testing/index.js

@@ -596,8 +596,8 @@ var hydrate = new Function("createElement", "hydrateRoot", `${ISLAND_HYDRATE_SOU
 * page.dispose();
 * ```
 *
-* The document's own scripts do not run (the helper runs the runtime itself),
-* and a link the runtime leaves alone is not followed. Islands hydrate
+* The document's own scripts do not run (the helper runs the runtime itself,
+* and the document script with `documentScript: true`), and a link the runtime leaves alone is not followed. Islands hydrate
 * asynchronously, as in a browser: wrap what follows in `act`, or wait for it.
 */
 function renderStaticDocument(html, options = {}) {
@@ -614,6 +614,7 @@ function renderStaticDocument(html, options = {}) {
 	});
 	history.replaceState(null, "", options.url ?? "/");
 	const parsed = new DOMParser().parseFromString(html, "text/html");
+	const documentScript = options.documentScript ? parsed.querySelector("head > script[data-gemi-script]")?.textContent : void 0;
 	for (const script of Array.from(parsed.querySelectorAll("script"))) if (!/json/.test(script.type)) script.remove();
 	document.replaceChild(document.importNode(parsed.documentElement, true), document.documentElement);
 	const fullLoad = (url) => {
@@ -683,6 +684,7 @@ function renderStaticDocument(html, options = {}) {
 	window.scrollTo = () => {};
 	const scrollIntoView = Element.prototype.scrollIntoView;
 	Element.prototype.scrollIntoView = function() {};
+	if (documentScript) new Function(documentScript)();
 	const source = STATIC_NAVIGATION_SOURCE.replace("import(", "__import(");
 	new Function("__import", "location", "fetch", source)(importIsland, location, fetch);
 	return {