gemi 0.196.2 → 0.198.0

package/dist/{chunk-2yzv5v3m.js → chunk-tyvc46ns.js}

@@ -1,4 +1,4 @@
 // @bun
-import{h as Tr}from"./chunk-q1aaqhnw.js";import{A as Dr,B as ur,C as Hr,i as je,k as C,l as wr,m as fr,n as jr,p as It,q as Tt,r as qr,s as mr,t as We,u as zr,v as kr,w as Qe,x as Pr,y as Nr,z as br}from"./chunk-bc7hr358.js";import{D as Ir}from"./chunk-28fz99pn.js";import{E as lt,F as pr,H as vr,L as Te,P as q}from"./chunk-8fdk8bfd.js";import{Q as gr}from"./chunk-f6css3z6.js";import{R as ar}from"./chunk-07zfrfbg.js";import"./chunk-nk7nmtng.js";import"./chunk-paawtkza.js";import"./chunk-pqr01waj.js";import"./chunk-a02bmp0q.js";import{ba as ir}from"./chunk-tj7z65ba.js";import{ma as Or}from"./chunk-fhfkcmkc.js";import{Ql as us,Rl as u}from"./chunk-vgxkt9vd.js";var G=u((Y)=>{Object.defineProperty(Y,"__esModule",{value:!0});Y.resolveHttpAuthSchemeConfig=Y.defaultSSOHttpAuthSchemeProvider=Y.defaultSSOHttpAuthSchemeParametersProvider=void 0;var _t=C(),U=lt(),Et=async(e,t,r)=>{return{operation:(0,U.getSmithyContext)(t).operation,region:await(0,U.normalizeProvider)(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}};Y.defaultSSOHttpAuthSchemeParametersProvider=Et;function Rt(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"awsssoportal",region:e.region},propertiesExtractor:(t,r)=>({signingProperties:{config:t,context:r}})}}function yt(e){return{schemeId:"smithy.api#noAuth"}}var St=(e)=>{let t=[];switch(e.operation){case"GetRoleCredentials":{t.push(yt(e));break}default:t.push(Rt(e))}return t};Y.defaultSSOHttpAuthSchemeProvider=St;var xt=(e)=>{let t=(0,_t.resolveAwsSdkSigV4Config)(e);return Object.assign(t,{authSchemePreference:(0,U.normalizeProvider)(e.authSchemePreference??[])})};Y.resolveHttpAuthSchemeConfig=xt});var Ee=u((le)=>{Object.defineProperty(le,"__esModule",{value:!0});le.ruleSet=void 0;var ae="required",n="fn",i="argv",y="ref",X=!0,Z="isSet",S="booleanEquals",E="error",R="endpoint",c="tree",A="PartitionResult",g="getAttr",ee={[ae]:!1,type:"string"},te={[ae]:!0,default:!1,type:"boolean"},re={[y]:"Endpoint"},ue={[n]:S,[i]:[{[y]:"UseFIPS"},!0]},ce={[n]:S,[i]:[{[y]:"UseDualStack"},!0]},o={},se={[n]:g,[i]:[{[y]:A},"supportsFIPS"]},de={[y]:A},oe={[n]:S,[i]:[!0,{[n]:g,[i]:[de,"supportsDualStack"]}]},ne=[ue],ie=[ce],pe=[{[y]:"Region"}],qt={version:"1.0",parameters:{Region:ee,UseDualStack:te,UseFIPS:te,Endpoint:ee},rules:[{conditions:[{[n]:Z,[i]:[re]}],rules:[{conditions:ne,error:"Invalid Configuration: FIPS and custom endpoint are not supported",type:E},{conditions:ie,error:"Invalid Configuration: Dualstack and custom endpoint are not supported",type:E},{endpoint:{url:re,properties:o,headers:o},type:R}],type:c},{conditions:[{[n]:Z,[i]:pe}],rules:[{conditions:[{[n]:"aws.partition",[i]:pe,assign:A}],rules:[{conditions:[ue,ce],rules:[{conditions:[{[n]:S,[i]:[X,se]},oe],rules:[{endpoint:{url:"https://portal.sso-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",type:E}],type:c},{conditions:ne,rules:[{conditions:[{[n]:S,[i]:[se,X]}],rules:[{conditions:[{[n]:"stringEquals",[i]:[{[n]:g,[i]:[de,"name"]},"aws-us-gov"]}],endpoint:{url:"https://portal.sso.{Region}.amazonaws.com",properties:o,headers:o},type:R},{endpoint:{url:"https://portal.sso-fips.{Region}.{PartitionResult#dnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"FIPS is enabled but this partition does not support FIPS",type:E}],type:c},{conditions:ie,rules:[{conditions:[oe],rules:[{endpoint:{url:"https://portal.sso.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"DualStack is enabled but this partition does not support DualStack",type:E}],type:c},{endpoint:{url:"https://portal.sso.{Region}.{PartitionResult#dnsSuffix}",properties:o,headers:o},type:R}],type:c}],type:c},{error:"Invalid Configuration: Missing Region",type:E}]};le.ruleSet=qt});var Se=u((Re)=>{Object.defineProperty(Re,"__esModule",{value:!0});Re.defaultEndpointResolver=void 0;var Pt=Tt(),w=It(),Nt=Ee(),bt=new w.EndpointCache({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS"]}),Dt=(e,t={})=>{return bt.get(e,()=>(0,w.resolveEndpoint)(Nt.ruleSet,{endpointParams:e,logger:t.logger}))};Re.defaultEndpointResolver=Dt;w.customEndpointFunctions.aws=Pt.awsEndpointFunctions});var I=u((j)=>{Object.defineProperty(j,"__esModule",{value:!0});j.SSOServiceException=j.__ServiceException=void 0;var xe=q();Object.defineProperty(j,"__ServiceException",{enumerable:!0,get:function(){return xe.ServiceException}});class f extends xe.ServiceException{constructor(e){super(e);Object.setPrototypeOf(this,f.prototype)}}j.SSOServiceException=f});var K=u((Oe)=>{Object.defineProperty(Oe,"__esModule",{value:!0});Oe.UnauthorizedException=Oe.TooManyRequestsException=Oe.ResourceNotFoundException=Oe.InvalidRequestException=void 0;var T=I();class m extends T.SSOServiceException{name="InvalidRequestException";$fault="client";constructor(e){super({name:"InvalidRequestException",$fault:"client",...e});Object.setPrototypeOf(this,m.prototype)}}Oe.InvalidRequestException=m;class z extends T.SSOServiceException{name="ResourceNotFoundException";$fault="client";constructor(e){super({name:"ResourceNotFoundException",$fault:"client",...e});Object.setPrototypeOf(this,z.prototype)}}Oe.ResourceNotFoundException=z;class k extends T.SSOServiceException{name="TooManyRequestsException";$fault="client";constructor(e){super({name:"TooManyRequestsException",$fault:"client",...e});Object.setPrototypeOf(this,k.prototype)}}Oe.TooManyRequestsException=k;class H extends T.SSOServiceException{name="UnauthorizedException";$fault="client";constructor(e){super({name:"UnauthorizedException",$fault:"client",...e});Object.setPrototypeOf(this,H.prototype)}}Oe.UnauthorizedException=H});var L=u((De)=>{Object.defineProperty(De,"__esModule",{value:!0});De.GetRoleCredentials$=De.RoleCredentials$=De.GetRoleCredentialsResponse$=De.GetRoleCredentialsRequest$=De.errorTypeRegistries=De.UnauthorizedException$=De.TooManyRequestsException$=De.ResourceNotFoundException$=De.InvalidRequestException$=De.SSOServiceException$=void 0;var Mt="AccessTokenType",Ut="GetRoleCredentials",Ct="GetRoleCredentialsRequest",Gt="GetRoleCredentialsResponse",At="InvalidRequestException",gt="RoleCredentials",wt="ResourceNotFoundException",ft="SecretAccessKeyType",jt="SessionTokenType",mt="TooManyRequestsException",zt="UnauthorizedException",kt="accountId",Ht="accessKeyId",Kt="accessToken",Lt="account_id",P="client",N="error",Vt="expiration",Bt="http",b="httpError",Wt="httpHeader",Ie="httpQuery",D="message",Qt="roleCredentials",Yt="roleName",Jt="role_name",Pe="smithy.ts.sdk.synthetic.com.amazonaws.sso",Xt="secretAccessKey",Zt="sessionToken",er="x-amz-sso_bearer_token",p="com.amazonaws.sso",Ne=Te(),$=K(),tr=I(),be=Ne.TypeRegistry.for(Pe);De.SSOServiceException$=[-3,Pe,"SSOServiceException",0,[],[]];be.registerError(De.SSOServiceException$,tr.SSOServiceException);var x=Ne.TypeRegistry.for(p);De.InvalidRequestException$=[-3,p,At,{[N]:P,[b]:400},[D],[0]];x.registerError(De.InvalidRequestException$,$.InvalidRequestException);De.ResourceNotFoundException$=[-3,p,wt,{[N]:P,[b]:404},[D],[0]];x.registerError(De.ResourceNotFoundException$,$.ResourceNotFoundException);De.TooManyRequestsException$=[-3,p,mt,{[N]:P,[b]:429},[D],[0]];x.registerError(De.TooManyRequestsException$,$.TooManyRequestsException);De.UnauthorizedException$=[-3,p,zt,{[N]:P,[b]:401},[D],[0]];x.registerError(De.UnauthorizedException$,$.UnauthorizedException);De.errorTypeRegistries=[be,x];var rr=[0,p,Mt,8,0],sr=[0,p,ft,8,0],or=[0,p,jt,8,0];De.GetRoleCredentialsRequest$=[3,p,Ct,0,[Yt,kt,Kt],[[0,{[Ie]:Jt}],[0,{[Ie]:Lt}],[()=>rr,{[Wt]:er}]],3];De.GetRoleCredentialsResponse$=[3,p,Gt,0,[Qt],[[()=>De.RoleCredentials$,0]]];De.RoleCredentials$=[3,p,gt,0,[Ht,Xt,Zt,Vt],[0,[()=>sr,0],[()=>or,0],1]];De.GetRoleCredentials$=[9,p,Ut,{[Bt]:["GET","/federation/credentials",200]},()=>De.GetRoleCredentialsRequest$,()=>De.GetRoleCredentialsResponse$]});var ke=u((me)=>{Object.defineProperty(me,"__esModule",{value:!0});me.getRuntimeConfig=void 0;var cr=C(),dr=ur(),lr=je(),_r=q(),Er=ar(),we=pr(),fe=ir(),Rr=G(),yr=Se(),Sr=L(),xr=(e)=>{return{apiVersion:"2019-06-10",base64Decoder:e?.base64Decoder??we.fromBase64,base64Encoder:e?.base64Encoder??we.toBase64,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??yr.defaultEndpointResolver,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??Rr.defaultSSOHttpAuthSchemeProvider,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(t)=>t.getIdentityProvider("aws.auth#sigv4"),signer:new cr.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(t)=>t.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new lr.NoAuthSigner}],logger:e?.logger??new _r.NoOpLogger,protocol:e?.protocol??dr.AwsRestJsonProtocol,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.sso",errorTypeRegistries:Sr.errorTypeRegistries,version:"2019-06-10",serviceTarget:"SWBPortalService"},serviceId:e?.serviceId??"SSO",urlParser:e?.urlParser??Er.parseUrl,utf8Decoder:e?.utf8Decoder??fe.fromUtf8,utf8Encoder:e?.utf8Encoder??fe.toUtf8}};me.getRuntimeConfig=xr});var Xe=u((Ye)=>{Object.defineProperty(Ye,"__esModule",{value:!0});Ye.getRuntimeConfig=void 0;var $r=Or(),Fr=$r.__importDefault(Tr()),He=C(),Ke=Pr(),F=We(),hr=Nr(),Le=Qe(),l=Ir(),Ve=vr(),Be=q(),Mr=br(),Ur=Dr(),Cr=qr(),Gr=ke(),Ar=(e)=>{(0,Be.emitWarningIfUnsupportedVersion)(process.version);let t=(0,Ur.resolveDefaultsModeConfig)(e),r=()=>t().then(Be.loadConfigsForDefaultMode),a=(0,Gr.getRuntimeConfig)(e);(0,He.emitWarningIfUnsupportedVersion)(process.version);let s={profile:e?.profile,logger:a.logger};return{...a,...e,runtime:"node",defaultsMode:t,authSchemePreference:e?.authSchemePreference??(0,l.loadConfig)(He.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,s),bodyLengthChecker:e?.bodyLengthChecker??Mr.calculateBodyLength,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,Ke.createDefaultUserAgentProvider)({serviceId:a.serviceId,clientVersion:Fr.default.version}),maxAttempts:e?.maxAttempts??(0,l.loadConfig)(Le.NODE_MAX_ATTEMPT_CONFIG_OPTIONS,e),region:e?.region??(0,l.loadConfig)(F.NODE_REGION_CONFIG_OPTIONS,{...F.NODE_REGION_CONFIG_FILE_OPTIONS,...s}),requestHandler:Ve.NodeHttpHandler.create(e?.requestHandler??r),retryMode:e?.retryMode??(0,l.loadConfig)({...Le.NODE_RETRY_MODE_CONFIG_OPTIONS,default:async()=>(await r()).retryMode||Cr.DEFAULT_RETRY_MODE},e),sha256:e?.sha256??hr.Hash.bind(null,"sha256"),streamCollector:e?.streamCollector??Ve.streamCollector,useDualstackEndpoint:e?.useDualstackEndpoint??(0,l.loadConfig)(F.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS,s),useFipsEndpoint:e?.useFipsEndpoint??(0,l.loadConfig)(F.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS,s),userAgentAppId:e?.userAgentAppId??(0,l.loadConfig)(Ke.NODE_APP_ID_CONFIG_OPTIONS,s)}};Ye.getRuntimeConfig=Ar});var it=u((d)=>{var Ze=wr(),Kr=fr(),Lr=jr(),et=mr(),Vr=We(),V=je(),Br=Te(),Wr=zr(),nt=kr(),tt=Qe(),_=q(),rt=G(),Qr=Xe(),st=Hr(),ot=gr(),v=L(),h=K(),Yr=I(),Jr=(e)=>{return Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,defaultSigningName:"awsssoportal"})},Xr={UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},Zr=(e)=>{let{httpAuthSchemes:t,httpAuthSchemeProvider:r,credentials:a}=e;return{setHttpAuthScheme(s){let O=t.findIndex((M)=>M.schemeId===s.schemeId);if(O===-1)t.push(s);else t.splice(O,1,s)},httpAuthSchemes(){return t},setHttpAuthSchemeProvider(s){r=s},httpAuthSchemeProvider(){return r},setCredentials(s){a=s},credentials(){return a}}},es=(e)=>{return{httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}},ts=(e,t)=>{let r=Object.assign(st.getAwsRegionExtensionConfiguration(e),_.getDefaultExtensionConfiguration(e),ot.getHttpHandlerExtensionConfiguration(e),Zr(e));return t.forEach((a)=>a.configure(r)),Object.assign(e,st.resolveAwsRegionExtensionConfiguration(r),_.resolveDefaultRuntimeConfig(r),ot.resolveHttpHandlerRuntimeConfig(r),es(r))};class B extends _.Client{config;constructor(...[e]){let t=Qr.getRuntimeConfig(e||{});super(t);this.initConfig=t;let r=Jr(t),a=et.resolveUserAgentConfig(r),s=tt.resolveRetryConfig(a),O=Vr.resolveRegionConfig(s),M=Ze.resolveHostHeaderConfig(O),at=nt.resolveEndpointConfig(M),ut=rt.resolveHttpAuthSchemeConfig(at),ct=ts(ut,e?.extensions||[]);this.config=ct,this.middlewareStack.use(Br.getSchemaSerdePlugin(this.config)),this.middlewareStack.use(et.getUserAgentPlugin(this.config)),this.middlewareStack.use(tt.getRetryPlugin(this.config)),this.middlewareStack.use(Wr.getContentLengthPlugin(this.config)),this.middlewareStack.use(Ze.getHostHeaderPlugin(this.config)),this.middlewareStack.use(Kr.getLoggerPlugin(this.config)),this.middlewareStack.use(Lr.getRecursionDetectionPlugin(this.config)),this.middlewareStack.use(V.getHttpAuthSchemeEndpointRuleSetPlugin(this.config,{httpAuthSchemeParametersProvider:rt.defaultSSOHttpAuthSchemeParametersProvider,identityProviderConfigProvider:async(dt)=>new V.DefaultIdentityProviderConfig({"aws.auth#sigv4":dt.credentials})})),this.middlewareStack.use(V.getHttpSigningPlugin(this.config))}destroy(){super.destroy()}}class W extends _.Command.classBuilder().ep(Xr).m(function(e,t,r,a){return[nt.getEndpointPlugin(r,e.getEndpointParameterInstructions())]}).s("SWBPortalService","GetRoleCredentials",{}).n("SSOClient","GetRoleCredentialsCommand").sc(v.GetRoleCredentials$).build(){}var rs={GetRoleCredentialsCommand:W};class Q extends B{}_.createAggregatedClient(rs,Q);d.$Command=_.Command;d.__Client=_.Client;d.SSOServiceException=Yr.SSOServiceException;d.GetRoleCredentialsCommand=W;d.SSO=Q;d.SSOClient=B;Object.prototype.hasOwnProperty.call(v,"__proto__")&&!Object.prototype.hasOwnProperty.call(d,"__proto__")&&Object.defineProperty(d,"__proto__",{enumerable:!0,value:v.__proto__});Object.keys(v).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(d,e))d[e]=v[e]});Object.prototype.hasOwnProperty.call(h,"__proto__")&&!Object.prototype.hasOwnProperty.call(d,"__proto__")&&Object.defineProperty(d,"__proto__",{enumerable:!0,value:h.__proto__});Object.keys(h).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(d,e))d[e]=h[e]})});var pt=us(it(),1);var export_SSOClient=pt.SSOClient;var export_GetRoleCredentialsCommand=pt.GetRoleCredentialsCommand;export{export_SSOClient as SSOClient,export_GetRoleCredentialsCommand as GetRoleCredentialsCommand};
+import{h as Tr}from"./chunk-xb0k1br9.js";import{A as Dr,B as ur,C as Hr,i as je,k as C,l as wr,m as fr,n as jr,p as It,q as Tt,r as qr,s as mr,t as We,u as zr,v as kr,w as Qe,x as Pr,y as Nr,z as br}from"./chunk-w09wtxr6.js";import{D as Ir}from"./chunk-6ftdsrkq.js";import{E as lt,F as pr,H as vr,L as Te,P as q}from"./chunk-50nex9wg.js";import{Q as gr}from"./chunk-nnaz5djg.js";import{R as ar}from"./chunk-bdbg2dt6.js";import"./chunk-wxb2pqqz.js";import"./chunk-6nr97atn.js";import"./chunk-v2pt8h42.js";import"./chunk-42b6zzg2.js";import{ba as ir}from"./chunk-n9k29mrs.js";import{ma as Or}from"./chunk-ct1vh28z.js";import{Yl as us,Zl as u}from"./chunk-zpqcawmq.js";var G=u((Y)=>{Object.defineProperty(Y,"__esModule",{value:!0});Y.resolveHttpAuthSchemeConfig=Y.defaultSSOHttpAuthSchemeProvider=Y.defaultSSOHttpAuthSchemeParametersProvider=void 0;var _t=C(),U=lt(),Et=async(e,t,r)=>{return{operation:(0,U.getSmithyContext)(t).operation,region:await(0,U.normalizeProvider)(e.region)()||(()=>{throw Error("expected `region` to be configured for `aws.auth#sigv4`")})()}};Y.defaultSSOHttpAuthSchemeParametersProvider=Et;function Rt(e){return{schemeId:"aws.auth#sigv4",signingProperties:{name:"awsssoportal",region:e.region},propertiesExtractor:(t,r)=>({signingProperties:{config:t,context:r}})}}function yt(e){return{schemeId:"smithy.api#noAuth"}}var St=(e)=>{let t=[];switch(e.operation){case"GetRoleCredentials":{t.push(yt(e));break}default:t.push(Rt(e))}return t};Y.defaultSSOHttpAuthSchemeProvider=St;var xt=(e)=>{let t=(0,_t.resolveAwsSdkSigV4Config)(e);return Object.assign(t,{authSchemePreference:(0,U.normalizeProvider)(e.authSchemePreference??[])})};Y.resolveHttpAuthSchemeConfig=xt});var Ee=u((le)=>{Object.defineProperty(le,"__esModule",{value:!0});le.ruleSet=void 0;var ae="required",n="fn",i="argv",y="ref",X=!0,Z="isSet",S="booleanEquals",E="error",R="endpoint",c="tree",A="PartitionResult",g="getAttr",ee={[ae]:!1,type:"string"},te={[ae]:!0,default:!1,type:"boolean"},re={[y]:"Endpoint"},ue={[n]:S,[i]:[{[y]:"UseFIPS"},!0]},ce={[n]:S,[i]:[{[y]:"UseDualStack"},!0]},o={},se={[n]:g,[i]:[{[y]:A},"supportsFIPS"]},de={[y]:A},oe={[n]:S,[i]:[!0,{[n]:g,[i]:[de,"supportsDualStack"]}]},ne=[ue],ie=[ce],pe=[{[y]:"Region"}],qt={version:"1.0",parameters:{Region:ee,UseDualStack:te,UseFIPS:te,Endpoint:ee},rules:[{conditions:[{[n]:Z,[i]:[re]}],rules:[{conditions:ne,error:"Invalid Configuration: FIPS and custom endpoint are not supported",type:E},{conditions:ie,error:"Invalid Configuration: Dualstack and custom endpoint are not supported",type:E},{endpoint:{url:re,properties:o,headers:o},type:R}],type:c},{conditions:[{[n]:Z,[i]:pe}],rules:[{conditions:[{[n]:"aws.partition",[i]:pe,assign:A}],rules:[{conditions:[ue,ce],rules:[{conditions:[{[n]:S,[i]:[X,se]},oe],rules:[{endpoint:{url:"https://portal.sso-fips.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"FIPS and DualStack are enabled, but this partition does not support one or both",type:E}],type:c},{conditions:ne,rules:[{conditions:[{[n]:S,[i]:[se,X]}],rules:[{conditions:[{[n]:"stringEquals",[i]:[{[n]:g,[i]:[de,"name"]},"aws-us-gov"]}],endpoint:{url:"https://portal.sso.{Region}.amazonaws.com",properties:o,headers:o},type:R},{endpoint:{url:"https://portal.sso-fips.{Region}.{PartitionResult#dnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"FIPS is enabled but this partition does not support FIPS",type:E}],type:c},{conditions:ie,rules:[{conditions:[oe],rules:[{endpoint:{url:"https://portal.sso.{Region}.{PartitionResult#dualStackDnsSuffix}",properties:o,headers:o},type:R}],type:c},{error:"DualStack is enabled but this partition does not support DualStack",type:E}],type:c},{endpoint:{url:"https://portal.sso.{Region}.{PartitionResult#dnsSuffix}",properties:o,headers:o},type:R}],type:c}],type:c},{error:"Invalid Configuration: Missing Region",type:E}]};le.ruleSet=qt});var Se=u((Re)=>{Object.defineProperty(Re,"__esModule",{value:!0});Re.defaultEndpointResolver=void 0;var Pt=Tt(),w=It(),Nt=Ee(),bt=new w.EndpointCache({size:50,params:["Endpoint","Region","UseDualStack","UseFIPS"]}),Dt=(e,t={})=>{return bt.get(e,()=>(0,w.resolveEndpoint)(Nt.ruleSet,{endpointParams:e,logger:t.logger}))};Re.defaultEndpointResolver=Dt;w.customEndpointFunctions.aws=Pt.awsEndpointFunctions});var I=u((j)=>{Object.defineProperty(j,"__esModule",{value:!0});j.SSOServiceException=j.__ServiceException=void 0;var xe=q();Object.defineProperty(j,"__ServiceException",{enumerable:!0,get:function(){return xe.ServiceException}});class f extends xe.ServiceException{constructor(e){super(e);Object.setPrototypeOf(this,f.prototype)}}j.SSOServiceException=f});var K=u((Oe)=>{Object.defineProperty(Oe,"__esModule",{value:!0});Oe.UnauthorizedException=Oe.TooManyRequestsException=Oe.ResourceNotFoundException=Oe.InvalidRequestException=void 0;var T=I();class m extends T.SSOServiceException{name="InvalidRequestException";$fault="client";constructor(e){super({name:"InvalidRequestException",$fault:"client",...e});Object.setPrototypeOf(this,m.prototype)}}Oe.InvalidRequestException=m;class z extends T.SSOServiceException{name="ResourceNotFoundException";$fault="client";constructor(e){super({name:"ResourceNotFoundException",$fault:"client",...e});Object.setPrototypeOf(this,z.prototype)}}Oe.ResourceNotFoundException=z;class k extends T.SSOServiceException{name="TooManyRequestsException";$fault="client";constructor(e){super({name:"TooManyRequestsException",$fault:"client",...e});Object.setPrototypeOf(this,k.prototype)}}Oe.TooManyRequestsException=k;class H extends T.SSOServiceException{name="UnauthorizedException";$fault="client";constructor(e){super({name:"UnauthorizedException",$fault:"client",...e});Object.setPrototypeOf(this,H.prototype)}}Oe.UnauthorizedException=H});var L=u((De)=>{Object.defineProperty(De,"__esModule",{value:!0});De.GetRoleCredentials$=De.RoleCredentials$=De.GetRoleCredentialsResponse$=De.GetRoleCredentialsRequest$=De.errorTypeRegistries=De.UnauthorizedException$=De.TooManyRequestsException$=De.ResourceNotFoundException$=De.InvalidRequestException$=De.SSOServiceException$=void 0;var Mt="AccessTokenType",Ut="GetRoleCredentials",Ct="GetRoleCredentialsRequest",Gt="GetRoleCredentialsResponse",At="InvalidRequestException",gt="RoleCredentials",wt="ResourceNotFoundException",ft="SecretAccessKeyType",jt="SessionTokenType",mt="TooManyRequestsException",zt="UnauthorizedException",kt="accountId",Ht="accessKeyId",Kt="accessToken",Lt="account_id",P="client",N="error",Vt="expiration",Bt="http",b="httpError",Wt="httpHeader",Ie="httpQuery",D="message",Qt="roleCredentials",Yt="roleName",Jt="role_name",Pe="smithy.ts.sdk.synthetic.com.amazonaws.sso",Xt="secretAccessKey",Zt="sessionToken",er="x-amz-sso_bearer_token",p="com.amazonaws.sso",Ne=Te(),$=K(),tr=I(),be=Ne.TypeRegistry.for(Pe);De.SSOServiceException$=[-3,Pe,"SSOServiceException",0,[],[]];be.registerError(De.SSOServiceException$,tr.SSOServiceException);var x=Ne.TypeRegistry.for(p);De.InvalidRequestException$=[-3,p,At,{[N]:P,[b]:400},[D],[0]];x.registerError(De.InvalidRequestException$,$.InvalidRequestException);De.ResourceNotFoundException$=[-3,p,wt,{[N]:P,[b]:404},[D],[0]];x.registerError(De.ResourceNotFoundException$,$.ResourceNotFoundException);De.TooManyRequestsException$=[-3,p,mt,{[N]:P,[b]:429},[D],[0]];x.registerError(De.TooManyRequestsException$,$.TooManyRequestsException);De.UnauthorizedException$=[-3,p,zt,{[N]:P,[b]:401},[D],[0]];x.registerError(De.UnauthorizedException$,$.UnauthorizedException);De.errorTypeRegistries=[be,x];var rr=[0,p,Mt,8,0],sr=[0,p,ft,8,0],or=[0,p,jt,8,0];De.GetRoleCredentialsRequest$=[3,p,Ct,0,[Yt,kt,Kt],[[0,{[Ie]:Jt}],[0,{[Ie]:Lt}],[()=>rr,{[Wt]:er}]],3];De.GetRoleCredentialsResponse$=[3,p,Gt,0,[Qt],[[()=>De.RoleCredentials$,0]]];De.RoleCredentials$=[3,p,gt,0,[Ht,Xt,Zt,Vt],[0,[()=>sr,0],[()=>or,0],1]];De.GetRoleCredentials$=[9,p,Ut,{[Bt]:["GET","/federation/credentials",200]},()=>De.GetRoleCredentialsRequest$,()=>De.GetRoleCredentialsResponse$]});var ke=u((me)=>{Object.defineProperty(me,"__esModule",{value:!0});me.getRuntimeConfig=void 0;var cr=C(),dr=ur(),lr=je(),_r=q(),Er=ar(),we=pr(),fe=ir(),Rr=G(),yr=Se(),Sr=L(),xr=(e)=>{return{apiVersion:"2019-06-10",base64Decoder:e?.base64Decoder??we.fromBase64,base64Encoder:e?.base64Encoder??we.toBase64,disableHostPrefix:e?.disableHostPrefix??!1,endpointProvider:e?.endpointProvider??yr.defaultEndpointResolver,extensions:e?.extensions??[],httpAuthSchemeProvider:e?.httpAuthSchemeProvider??Rr.defaultSSOHttpAuthSchemeProvider,httpAuthSchemes:e?.httpAuthSchemes??[{schemeId:"aws.auth#sigv4",identityProvider:(t)=>t.getIdentityProvider("aws.auth#sigv4"),signer:new cr.AwsSdkSigV4Signer},{schemeId:"smithy.api#noAuth",identityProvider:(t)=>t.getIdentityProvider("smithy.api#noAuth")||(async()=>({})),signer:new lr.NoAuthSigner}],logger:e?.logger??new _r.NoOpLogger,protocol:e?.protocol??dr.AwsRestJsonProtocol,protocolSettings:e?.protocolSettings??{defaultNamespace:"com.amazonaws.sso",errorTypeRegistries:Sr.errorTypeRegistries,version:"2019-06-10",serviceTarget:"SWBPortalService"},serviceId:e?.serviceId??"SSO",urlParser:e?.urlParser??Er.parseUrl,utf8Decoder:e?.utf8Decoder??fe.fromUtf8,utf8Encoder:e?.utf8Encoder??fe.toUtf8}};me.getRuntimeConfig=xr});var Xe=u((Ye)=>{Object.defineProperty(Ye,"__esModule",{value:!0});Ye.getRuntimeConfig=void 0;var $r=Or(),Fr=$r.__importDefault(Tr()),He=C(),Ke=Pr(),F=We(),hr=Nr(),Le=Qe(),l=Ir(),Ve=vr(),Be=q(),Mr=br(),Ur=Dr(),Cr=qr(),Gr=ke(),Ar=(e)=>{(0,Be.emitWarningIfUnsupportedVersion)(process.version);let t=(0,Ur.resolveDefaultsModeConfig)(e),r=()=>t().then(Be.loadConfigsForDefaultMode),a=(0,Gr.getRuntimeConfig)(e);(0,He.emitWarningIfUnsupportedVersion)(process.version);let s={profile:e?.profile,logger:a.logger};return{...a,...e,runtime:"node",defaultsMode:t,authSchemePreference:e?.authSchemePreference??(0,l.loadConfig)(He.NODE_AUTH_SCHEME_PREFERENCE_OPTIONS,s),bodyLengthChecker:e?.bodyLengthChecker??Mr.calculateBodyLength,defaultUserAgentProvider:e?.defaultUserAgentProvider??(0,Ke.createDefaultUserAgentProvider)({serviceId:a.serviceId,clientVersion:Fr.default.version}),maxAttempts:e?.maxAttempts??(0,l.loadConfig)(Le.NODE_MAX_ATTEMPT_CONFIG_OPTIONS,e),region:e?.region??(0,l.loadConfig)(F.NODE_REGION_CONFIG_OPTIONS,{...F.NODE_REGION_CONFIG_FILE_OPTIONS,...s}),requestHandler:Ve.NodeHttpHandler.create(e?.requestHandler??r),retryMode:e?.retryMode??(0,l.loadConfig)({...Le.NODE_RETRY_MODE_CONFIG_OPTIONS,default:async()=>(await r()).retryMode||Cr.DEFAULT_RETRY_MODE},e),sha256:e?.sha256??hr.Hash.bind(null,"sha256"),streamCollector:e?.streamCollector??Ve.streamCollector,useDualstackEndpoint:e?.useDualstackEndpoint??(0,l.loadConfig)(F.NODE_USE_DUALSTACK_ENDPOINT_CONFIG_OPTIONS,s),useFipsEndpoint:e?.useFipsEndpoint??(0,l.loadConfig)(F.NODE_USE_FIPS_ENDPOINT_CONFIG_OPTIONS,s),userAgentAppId:e?.userAgentAppId??(0,l.loadConfig)(Ke.NODE_APP_ID_CONFIG_OPTIONS,s)}};Ye.getRuntimeConfig=Ar});var it=u((d)=>{var Ze=wr(),Kr=fr(),Lr=jr(),et=mr(),Vr=We(),V=je(),Br=Te(),Wr=zr(),nt=kr(),tt=Qe(),_=q(),rt=G(),Qr=Xe(),st=Hr(),ot=gr(),v=L(),h=K(),Yr=I(),Jr=(e)=>{return Object.assign(e,{useDualstackEndpoint:e.useDualstackEndpoint??!1,useFipsEndpoint:e.useFipsEndpoint??!1,defaultSigningName:"awsssoportal"})},Xr={UseFIPS:{type:"builtInParams",name:"useFipsEndpoint"},Endpoint:{type:"builtInParams",name:"endpoint"},Region:{type:"builtInParams",name:"region"},UseDualStack:{type:"builtInParams",name:"useDualstackEndpoint"}},Zr=(e)=>{let{httpAuthSchemes:t,httpAuthSchemeProvider:r,credentials:a}=e;return{setHttpAuthScheme(s){let O=t.findIndex((M)=>M.schemeId===s.schemeId);if(O===-1)t.push(s);else t.splice(O,1,s)},httpAuthSchemes(){return t},setHttpAuthSchemeProvider(s){r=s},httpAuthSchemeProvider(){return r},setCredentials(s){a=s},credentials(){return a}}},es=(e)=>{return{httpAuthSchemes:e.httpAuthSchemes(),httpAuthSchemeProvider:e.httpAuthSchemeProvider(),credentials:e.credentials()}},ts=(e,t)=>{let r=Object.assign(st.getAwsRegionExtensionConfiguration(e),_.getDefaultExtensionConfiguration(e),ot.getHttpHandlerExtensionConfiguration(e),Zr(e));return t.forEach((a)=>a.configure(r)),Object.assign(e,st.resolveAwsRegionExtensionConfiguration(r),_.resolveDefaultRuntimeConfig(r),ot.resolveHttpHandlerRuntimeConfig(r),es(r))};class B extends _.Client{config;constructor(...[e]){let t=Qr.getRuntimeConfig(e||{});super(t);this.initConfig=t;let r=Jr(t),a=et.resolveUserAgentConfig(r),s=tt.resolveRetryConfig(a),O=Vr.resolveRegionConfig(s),M=Ze.resolveHostHeaderConfig(O),at=nt.resolveEndpointConfig(M),ut=rt.resolveHttpAuthSchemeConfig(at),ct=ts(ut,e?.extensions||[]);this.config=ct,this.middlewareStack.use(Br.getSchemaSerdePlugin(this.config)),this.middlewareStack.use(et.getUserAgentPlugin(this.config)),this.middlewareStack.use(tt.getRetryPlugin(this.config)),this.middlewareStack.use(Wr.getContentLengthPlugin(this.config)),this.middlewareStack.use(Ze.getHostHeaderPlugin(this.config)),this.middlewareStack.use(Kr.getLoggerPlugin(this.config)),this.middlewareStack.use(Lr.getRecursionDetectionPlugin(this.config)),this.middlewareStack.use(V.getHttpAuthSchemeEndpointRuleSetPlugin(this.config,{httpAuthSchemeParametersProvider:rt.defaultSSOHttpAuthSchemeParametersProvider,identityProviderConfigProvider:async(dt)=>new V.DefaultIdentityProviderConfig({"aws.auth#sigv4":dt.credentials})})),this.middlewareStack.use(V.getHttpSigningPlugin(this.config))}destroy(){super.destroy()}}class W extends _.Command.classBuilder().ep(Xr).m(function(e,t,r,a){return[nt.getEndpointPlugin(r,e.getEndpointParameterInstructions())]}).s("SWBPortalService","GetRoleCredentials",{}).n("SSOClient","GetRoleCredentialsCommand").sc(v.GetRoleCredentials$).build(){}var rs={GetRoleCredentialsCommand:W};class Q extends B{}_.createAggregatedClient(rs,Q);d.$Command=_.Command;d.__Client=_.Client;d.SSOServiceException=Yr.SSOServiceException;d.GetRoleCredentialsCommand=W;d.SSO=Q;d.SSOClient=B;Object.prototype.hasOwnProperty.call(v,"__proto__")&&!Object.prototype.hasOwnProperty.call(d,"__proto__")&&Object.defineProperty(d,"__proto__",{enumerable:!0,value:v.__proto__});Object.keys(v).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(d,e))d[e]=v[e]});Object.prototype.hasOwnProperty.call(h,"__proto__")&&!Object.prototype.hasOwnProperty.call(d,"__proto__")&&Object.defineProperty(d,"__proto__",{enumerable:!0,value:h.__proto__});Object.keys(h).forEach(function(e){if(e!=="default"&&!Object.prototype.hasOwnProperty.call(d,e))d[e]=h[e]})});var pt=us(it(),1);var export_SSOClient=pt.SSOClient;var export_GetRoleCredentialsCommand=pt.GetRoleCredentialsCommand;export{export_SSOClient as SSOClient,export_GetRoleCredentialsCommand as GetRoleCredentialsCommand};
 
-//# debugId=29AA37E62791531664756E2164756E21
+//# debugId=EE0C6F50B27B546764756E2164756E21

package/dist/{chunk-2yzv5v3m.js.map → chunk-tyvc46ns.js.map}

@@ -14,6 +14,6 @@
     "import { GetRoleCredentialsCommand, SSOClient } from \"@aws-sdk/nested-clients/sso\";\nexport { GetRoleCredentialsCommand, SSOClient };\n"
   ],
   "mappings": ";gvBACA,CAAO,SAAe,JAAS,OAAc,LAAE,AAAO,JAAK,LAAC,JACpD,wBAAsC,6BAA2C,uCAAkD,OAC3I,IAAM,OACA,OACA,GAA6C,MAAO,EAAQ,EAAS,IAAU,CACjF,MAAO,CACH,WAAY,EAAG,EAAkB,kBAAkB,CAAO,EAAE,UAC5D,OAAS,MAAO,EAAG,EAAkB,mBAAmB,EAAO,MAAM,EAAE,IAClE,IAAM,CACH,MAAU,MAAM,yDAAyD,IAC1E,CACX,GAEI,6CAA6C,GACrD,SAAS,EAAgC,CAAC,EAAgB,CACtD,MAAO,CACH,SAAU,iBACV,kBAAmB,CACf,KAAM,eACN,OAAQ,EAAe,MAC3B,EACA,oBAAqB,CAAC,EAAQ,KAAa,CACvC,kBAAmB,CACf,SACA,SACJ,CACJ,EACJ,EAEJ,SAAS,EAAmC,CAAC,EAAgB,CACzD,MAAO,CACH,SAAU,mBACd,EAEJ,IAAM,GAAmC,CAAC,IAAmB,CACzD,IAAM,EAAU,CAAC,EACjB,OAAQ,EAAe,eACd,qBAAsB,CACvB,EAAQ,KAAK,GAAoC,CAAc,CAAC,EAChE,KACJ,SAEI,EAAQ,KAAK,GAAiC,CAAc,CAAC,EAGrE,OAAO,GAEH,mCAAmC,GAC3C,IAAM,GAA8B,CAAC,IAAW,CAC5C,IAAM,GAAY,EAAG,GAAO,0BAA0B,CAAM,EAC5D,OAAO,OAAO,OAAO,EAAU,CAC3B,sBAAuB,EAAG,EAAkB,mBAAmB,EAAO,sBAAwB,CAAC,CAAC,CACpG,CAAC,GAEG,8BAA8B,qBCtDtC,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,WAAe,OACvB,IAAM,GAAI,WAAY,EAAI,KAAM,EAAI,OAAQ,EAAI,MAC1C,EAAI,GAAM,EAAI,QAAS,EAAI,gBAAiB,EAAI,QAAS,EAAI,WAAY,EAAI,OAAQ,EAAI,kBAAmB,EAAI,UAAW,GAAI,EAAG,IAAI,GAAO,KAAM,QAAS,EAAG,GAAI,EAAG,IAAI,GAAM,QAAS,GAAO,KAAM,SAAU,EAAG,GAAI,EAAG,GAAI,UAAW,EAAG,GAAI,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,GAAI,SAAU,EAAG,EAAI,CAAE,EAAG,GAAI,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,GAAI,cAAe,EAAG,EAAI,CAAE,EAAG,EAAI,CAAC,EAAG,GAAI,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,GAAI,CAAE,EAAG,cAAc,CAAE,EAAG,GAAI,EAAG,GAAI,CAAE,EAAG,GAAI,EAAG,GAAI,GAAI,GAAI,CAAC,GAAM,EAAG,GAAI,GAAI,GAAI,CAAC,GAAG,mBAAmB,CAAE,CAAC,CAAE,EAAG,GAAI,CAAC,EAAC,EAAG,GAAI,CAAC,EAAC,EAAG,GAAI,CAAC,EAAG,GAAI,QAAS,CAAC,EAC9gB,GAAQ,CACV,QAAS,MACT,WAAY,CAAE,OAAQ,GAAG,aAAc,GAAG,QAAS,GAAG,SAAU,EAAE,EAClE,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,EAAC,CAAE,CAAC,EACjC,MAAO,CACH,CAAE,WAAY,GAAG,MAAO,oEAAqE,KAAM,CAAE,EACrG,CAAE,WAAY,GAAG,MAAO,yEAA0E,KAAM,CAAE,EAC1G,CAAE,SAAU,CAAE,IAAK,GAAG,WAAY,EAAG,QAAS,CAAE,EAAG,KAAM,CAAE,CAC/D,EACA,KAAM,CACV,EACA,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,EAAE,CAAC,EAC/B,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,iBAAkB,GAAI,GAAG,OAAQ,CAAE,CAAC,EACxD,MAAO,CACH,CACI,WAAY,CAAC,GAAG,EAAC,EACjB,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,EAAG,EAAC,CAAE,EAAG,EAAC,EACvC,MAAO,CACH,CACI,SAAU,CACN,IAAK,wEACL,WAAY,EACZ,QAAS,CACb,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,kFAAmF,KAAM,CAAE,CACxG,EACA,KAAM,CACV,EACA,CACI,WAAY,GACZ,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,GAAG,CAAC,CAAE,CAAC,EACpC,MAAO,CACH,CACI,WAAY,CAAC,EAAG,GAAI,gBAAiB,GAAI,CAAC,EAAG,GAAI,GAAI,GAAI,CAAC,GAAG,MAAM,CAAE,EAAG,YAAY,CAAE,CAAC,EACvF,SAAU,CAAE,IAAK,4CAA6C,WAAY,EAAG,QAAS,CAAE,EACxF,KAAM,CACV,EACA,CACI,SAAU,CACN,IAAK,+DACL,WAAY,EACZ,QAAS,CACb,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,2DAA4D,KAAM,CAAE,CACjF,EACA,KAAM,CACV,EACA,CACI,WAAY,GACZ,MAAO,CACH,CACI,WAAY,CAAC,EAAC,EACd,MAAO,CACH,CACI,SAAU,CACN,IAAK,mEACL,WAAY,EACZ,QAAS,CACb,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,qEAAsE,KAAM,CAAE,CAC3F,EACA,KAAM,CACV,EACA,CACI,SAAU,CAAE,IAAK,0DAA2D,WAAY,EAAG,QAAS,CAAE,EACtG,KAAM,CACV,CACJ,EACA,KAAM,CACV,CACJ,EACA,KAAM,CACV,EACA,CAAE,MAAO,wCAAyC,KAAM,CAAE,CAC9D,CACJ,EACQ,WAAU,qBCxGlB,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,2BAA+B,OACvC,IAAM,QACA,OACA,QACA,GAAQ,IAAI,EAAiB,cAAc,CAC7C,KAAM,GACN,OAAQ,CAAC,WAAY,SAAU,eAAgB,SAAS,CAC5D,CAAC,EACK,GAA0B,CAAC,EAAgB,EAAU,CAAC,IAAM,CAC9D,OAAO,GAAM,IAAI,EAAgB,KAAO,EAAG,EAAiB,iBAAiB,GAAU,QAAS,CAC5F,eAAgB,EAChB,OAAQ,EAAQ,MACpB,CAAC,CAAC,GAEE,2BAA0B,GAClC,EAAiB,wBAAwB,IAAM,GAAiB,qCChBhE,OAAO,eAAe,EAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,sBAA8B,qBAA0B,OAChE,IAAM,OACN,OAAO,eAAe,EAAS,qBAAsB,CAAE,WAAY,GAAM,IAAK,QAAS,EAAG,CAAE,OAAO,GAAgB,iBAAoB,CAAC,EACxI,MAAM,UAA4B,GAAgB,gBAAiB,CAC/D,WAAW,CAAC,EAAS,CACjB,MAAM,CAAO,EACb,OAAO,eAAe,KAAM,EAAoB,SAAS,EAEjE,CACQ,sBAAsB,mBCV9B,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,yBAAgC,4BAAmC,6BAAoC,2BAA+B,OAC9I,IAAM,MACN,MAAM,UAAgC,EAAsB,mBAAoB,CAC5E,KAAO,0BACP,OAAS,SACT,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,0BACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAAwB,SAAS,EAErE,CACQ,2BAA0B,EAClC,MAAM,UAAkC,EAAsB,mBAAoB,CAC9E,KAAO,4BACP,OAAS,SACT,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,4BACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAA0B,SAAS,EAEvE,CACQ,6BAA4B,EACpC,MAAM,UAAiC,EAAsB,mBAAoB,CAC7E,KAAO,2BACP,OAAS,SACT,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,2BACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAAyB,SAAS,EAEtE,CACQ,4BAA2B,EACnC,MAAM,UAA8B,EAAsB,mBAAoB,CAC1E,KAAO,wBACP,OAAS,SACT,WAAW,CAAC,EAAM,CACd,MAAM,CACF,KAAM,wBACN,OAAQ,YACL,CACP,CAAC,EACD,OAAO,eAAe,KAAM,EAAsB,SAAS,EAEnE,CACQ,yBAAwB,mBCtDhC,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,uBAA8B,oBAA2B,+BAAsC,8BAAqC,uBAA8B,0BAAiC,6BAAoC,8BAAqC,4BAAmC,wBAA4B,OACnV,IAAM,GAAO,kBACP,GAAO,qBACP,GAAQ,4BACR,GAAS,6BACT,GAAO,0BACP,GAAM,kBACN,GAAQ,4BACR,GAAQ,sBACR,GAAO,mBACP,GAAQ,2BACR,GAAM,wBACN,GAAM,YACN,GAAO,cACP,GAAM,cACN,GAAM,aACN,EAAK,SACL,EAAK,QACL,GAAM,aACN,GAAK,OACL,EAAM,YACN,GAAM,aACN,GAAM,YACN,EAAK,UACL,GAAM,kBACN,GAAM,WACN,GAAM,YACN,GAAK,4CACL,GAAO,kBACP,GAAM,eACN,GAAS,yBACT,EAAK,oBACL,QACA,MACA,OACA,GAAc,GAAS,aAAa,IAAI,EAAE,EACxC,wBAAuB,CAAC,GAAI,GAAI,sBAAuB,EAAG,CAAC,EAAG,CAAC,CAAC,EACxE,GAAY,cAAsB,wBAAsB,GAAsB,mBAAmB,EACjG,IAAM,EAAc,GAAS,aAAa,IAAI,CAAE,EACxC,4BAA2B,CAAC,GAAI,EAAI,GAAM,EAAG,GAAK,GAAK,GAAM,GAAI,EAAG,CAAC,CAAE,EAAG,CAAC,CAAC,CAAC,EACrF,EAAY,cAAsB,4BAA0B,EAAS,uBAAuB,EACpF,8BAA6B,CAAC,GAAI,EAAI,GAAO,EAAG,GAAK,GAAK,GAAM,GAAI,EAAG,CAAC,CAAE,EAAG,CAAC,CAAC,CAAC,EACxF,EAAY,cAAsB,8BAA4B,EAAS,yBAAyB,EACxF,6BAA4B,CAAC,GAAI,EAAI,GAAO,EAAG,GAAK,GAAK,GAAM,GAAI,EAAG,CAAC,CAAE,EAAG,CAAC,CAAC,CAAC,EACvF,EAAY,cAAsB,6BAA2B,EAAS,wBAAwB,EACtF,0BAAyB,CAAC,GAAI,EAAI,GAAK,EAAG,GAAK,GAAK,GAAM,GAAI,EAAG,CAAC,CAAE,EAAG,CAAC,CAAC,CAAC,EAClF,EAAY,cAAsB,0BAAwB,EAAS,qBAAqB,EAChF,uBAAsB,CAAC,GAAa,CAAW,EACvD,IAAI,GAAkB,CAAC,EAAG,EAAI,GAAM,EAAG,CAAC,EACpC,GAAsB,CAAC,EAAG,EAAI,GAAO,EAAG,CAAC,EACzC,GAAmB,CAAC,EAAG,EAAI,GAAM,EAAG,CAAC,EACjC,8BAA6B,CACjC,EACA,EACA,GACA,EACA,CAAC,GAAK,GAAK,EAAG,EACd,CACI,CAAC,EAAG,EAAG,IAAM,EAAI,CAAC,EAClB,CAAC,EAAG,EAAG,IAAM,EAAI,CAAC,EAClB,CAAC,IAAM,GAAiB,EAAG,IAAM,EAAO,CAAC,CAC7C,EACA,CACJ,EACQ,+BAA8B,CAClC,EACA,EACA,GACA,EACA,CAAC,EAAG,EACJ,CAAC,CAAC,IAAc,oBAAkB,CAAC,CAAC,CACxC,EACQ,oBAAmB,CACvB,EACA,EACA,GACA,EACA,CAAC,GAAM,GAAM,GAAK,EAAG,EACrB,CAAC,EAAG,CAAC,IAAM,GAAqB,CAAC,EAAG,CAAC,IAAM,GAAkB,CAAC,EAAG,CAAC,CACtE,EACQ,uBAAsB,CAC1B,EACA,EACA,GACA,EAAG,IAAK,CAAC,MAAO,0BAA2B,GAAG,CAAE,EAChD,IAAc,8BACd,IAAc,8BAClB,oBCxFA,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,oBAAwB,OAChC,IAAM,OACA,QACA,QACA,OACA,QACA,QACA,QACA,OACA,QACA,OACA,GAAmB,CAAC,IAAW,CACjC,MAAO,CACH,WAAY,aACZ,cAAe,GAAQ,eAAiB,GAAc,WACtD,cAAe,GAAQ,eAAiB,GAAc,SACtD,kBAAmB,GAAQ,mBAAqB,GAChD,iBAAkB,GAAQ,kBAAoB,GAAmB,wBACjE,WAAY,GAAQ,YAAc,CAAC,EACnC,uBAAwB,GAAQ,wBAA0B,GAAyB,iCACnF,gBAAiB,GAAQ,iBAAmB,CACxC,CACI,SAAU,iBACV,iBAAkB,CAAC,IAAQ,EAAI,oBAAoB,gBAAgB,EACnE,OAAQ,IAAI,GAAO,iBACvB,EACA,CACI,SAAU,oBACV,iBAAkB,CAAC,IAAQ,EAAI,oBAAoB,mBAAmB,IAAM,UAAa,CAAC,IAC1F,OAAQ,IAAI,GAAO,YACvB,CACJ,EACA,OAAQ,GAAQ,QAAU,IAAI,GAAgB,WAC9C,SAAU,GAAQ,UAAY,GAAY,oBAC1C,iBAAkB,GAAQ,kBAAoB,CAC1C,iBAAkB,oBAClB,oBAAqB,GAAY,oBACjC,QAAS,aACT,cAAe,kBACnB,EACA,UAAW,GAAQ,WAAa,MAChC,UAAW,GAAQ,WAAa,GAAa,SAC7C,YAAa,GAAQ,aAAe,GAAY,SAChD,YAAa,GAAQ,aAAe,GAAY,MACpD,GAEI,oBAAmB,qBC/C3B,OAAO,eAAe,GAAS,aAAc,CAAE,MAAO,EAAK,CAAC,EACpD,oBAAwB,OAChC,IAAM,QACA,GAAiB,GAAQ,oBAAgD,EACzE,OACA,QACA,OACA,QACA,QACA,OACA,QACA,OACA,QACA,QACA,QACA,QACA,GAAmB,CAAC,IAAW,EAChC,EAAG,GAAgB,iCAAiC,QAAQ,OAAO,EACpE,IAAM,GAAgB,EAAG,GAA0B,2BAA2B,CAAM,EAC9E,EAAwB,IAAM,EAAa,EAAE,KAAK,GAAgB,yBAAyB,EAC3F,GAAsB,EAAG,GAAuB,kBAAkB,CAAM,GAC7E,EAAG,GAAO,iCAAiC,QAAQ,OAAO,EAC3D,IAAM,EAAe,CACjB,QAAS,GAAQ,QACjB,OAAQ,EAAmB,MAC/B,EACA,MAAO,IACA,KACA,EACH,QAAS,OACT,eACA,qBAAsB,GAAQ,uBAAyB,EAAG,EAAuB,YAAY,GAAO,oCAAqC,CAAY,EACrJ,kBAAmB,GAAQ,mBAAqB,GAAwB,oBACxE,yBAA0B,GAAQ,2BAC7B,EAAG,GAAuB,gCAAgC,CAAE,UAAW,EAAmB,UAAW,cAAe,GAAe,QAAQ,OAAQ,CAAC,EACzJ,YAAa,GAAQ,cAAgB,EAAG,EAAuB,YAAY,GAAmB,gCAAiC,CAAM,EACrI,OAAQ,GAAQ,SACX,EAAG,EAAuB,YAAY,EAAkB,2BAA4B,IAAK,EAAkB,mCAAoC,CAAa,CAAC,EAClK,eAAgB,GAAoB,gBAAgB,OAAO,GAAQ,gBAAkB,CAAqB,EAC1G,UAAW,GAAQ,YACd,EAAG,EAAuB,YAAY,IAChC,GAAmB,+BACtB,QAAS,UAAa,MAAM,EAAsB,GAAG,WAAa,GAAa,kBACnF,EAAG,CAAM,EACb,OAAQ,GAAQ,QAAU,GAAY,KAAK,KAAK,KAAM,QAAQ,EAC9D,gBAAiB,GAAQ,iBAAmB,GAAoB,gBAChE,qBAAsB,GAAQ,uBAAyB,EAAG,EAAuB,YAAY,EAAkB,2CAA4C,CAAY,EACvK,gBAAiB,GAAQ,kBAAoB,EAAG,EAAuB,YAAY,EAAkB,sCAAuC,CAAY,EACxJ,eAAgB,GAAQ,iBAAmB,EAAG,EAAuB,YAAY,GAAuB,2BAA4B,CAAY,CACpJ,GAEI,oBAAmB,oBClD3B,IAAI,QACA,QACA,QACA,QACA,QACA,OACA,QACA,QACA,QACA,QACA,MACA,OACA,QACA,QACA,QACA,MACA,MACA,OAEE,GAAkC,CAAC,IAAY,CACjD,OAAO,OAAO,OAAO,EAAS,CAC1B,qBAAsB,EAAQ,sBAAwB,GACtD,gBAAiB,EAAQ,iBAAmB,GAC5C,mBAAoB,cACxB,CAAC,GAEC,GAAe,CACjB,QAAS,CAAE,KAAM,gBAAiB,KAAM,iBAAkB,EAC1D,SAAU,CAAE,KAAM,gBAAiB,KAAM,UAAW,EACpD,OAAQ,CAAE,KAAM,gBAAiB,KAAM,QAAS,EAChD,aAAc,CAAE,KAAM,gBAAiB,KAAM,sBAAuB,CACxE,EAEM,GAAoC,CAAC,IAAkB,CACzD,IAAuC,gBAAjC,EACsC,uBAAxC,EAC6B,YAA7B,GAD0B,EAE9B,MAAO,CACH,iBAAiB,CAAC,EAAgB,CAC9B,IAAM,EAAQ,EAAiB,UAAU,CAAC,IAAW,EAAO,WAAa,EAAe,QAAQ,EAChG,GAAI,IAAU,GACV,EAAiB,KAAK,CAAc,EAGpC,OAAiB,OAAO,EAAO,EAAG,CAAc,GAGxD,eAAe,EAAG,CACd,OAAO,GAEX,yBAAyB,CAAC,EAAwB,CAC9C,EAA0B,GAE9B,sBAAsB,EAAG,CACrB,OAAO,GAEX,cAAc,CAAC,EAAa,CACxB,EAAe,GAEnB,WAAW,EAAG,CACV,OAAO,EAEf,GAEE,GAA+B,CAAC,IAAW,CAC7C,MAAO,CACH,gBAAiB,EAAO,gBAAgB,EACxC,uBAAwB,EAAO,uBAAuB,EACtD,YAAa,EAAO,YAAY,CACpC,GAGE,GAA2B,CAAC,EAAe,IAAe,CAC5D,IAAM,EAAyB,OAAO,OAAO,GAAqB,mCAAmC,CAAa,EAAG,EAAa,iCAAiC,CAAa,EAAG,GAAa,qCAAqC,CAAa,EAAG,GAAkC,CAAa,CAAC,EAErS,OADA,EAAW,QAAQ,CAAC,IAAc,EAAU,UAAU,CAAsB,CAAC,EACtE,OAAO,OAAO,EAAe,GAAqB,uCAAuC,CAAsB,EAAG,EAAa,4BAA4B,CAAsB,EAAG,GAAa,gCAAgC,CAAsB,EAAG,GAA6B,CAAsB,CAAC,GAGzT,MAAM,UAAkB,EAAa,MAAO,CACxC,OACA,WAAW,KAAK,GAAgB,CAC5B,IAAM,EAAY,GAAc,iBAAiB,GAAiB,CAAC,CAAC,EACpE,MAAM,CAAS,EACf,KAAK,WAAa,EAClB,IAAM,EAAY,GAAgC,CAAS,EACrD,EAAY,GAAoB,uBAAuB,CAAS,EAChE,EAAY,GAAgB,mBAAmB,CAAS,EACxD,EAAY,GAAe,oBAAoB,CAAS,EACxD,EAAY,GAAqB,wBAAwB,CAAS,EAClE,GAAY,GAAmB,sBAAsB,CAAS,EAC9D,GAAY,GAAuB,4BAA4B,EAAS,EACxE,GAAY,GAAyB,GAAW,GAAe,YAAc,CAAC,CAAC,EACrF,KAAK,OAAS,GACd,KAAK,gBAAgB,IAAI,GAAO,qBAAqB,KAAK,MAAM,CAAC,EACjE,KAAK,gBAAgB,IAAI,GAAoB,mBAAmB,KAAK,MAAM,CAAC,EAC5E,KAAK,gBAAgB,IAAI,GAAgB,eAAe,KAAK,MAAM,CAAC,EACpE,KAAK,gBAAgB,IAAI,GAAwB,uBAAuB,KAAK,MAAM,CAAC,EACpF,KAAK,gBAAgB,IAAI,GAAqB,oBAAoB,KAAK,MAAM,CAAC,EAC9E,KAAK,gBAAgB,IAAI,GAAiB,gBAAgB,KAAK,MAAM,CAAC,EACtE,KAAK,gBAAgB,IAAI,GAA6B,4BAA4B,KAAK,MAAM,CAAC,EAC9F,KAAK,gBAAgB,IAAI,EAAK,uCAAuC,KAAK,OAAQ,CAC9E,iCAAkC,GAAuB,2CACzD,+BAAgC,MAAO,KAAW,IAAI,EAAK,8BAA8B,CACrF,iBAAkB,GAAO,WAC7B,CAAC,CACL,CAAC,CAAC,EACF,KAAK,gBAAgB,IAAI,EAAK,qBAAqB,KAAK,MAAM,CAAC,EAEnE,OAAO,EAAG,CACN,MAAM,QAAQ,EAEtB,CAEA,MAAM,UAAkC,EAAa,QAChD,aAAa,EACb,GAAG,EAAY,EACf,EAAE,QAAS,CAAC,EAAS,EAAI,EAAQ,EAAG,CACrC,MAAO,CAAC,GAAmB,kBAAkB,EAAQ,EAAQ,iCAAiC,CAAC,CAAC,EACnG,EACI,EAAE,mBAAoB,qBAAsB,CAAC,CAAC,EAC9C,EAAE,YAAa,2BAA2B,EAC1C,GAAG,EAAU,mBAAmB,EAChC,MAAM,CAAE,CACb,CAEA,IAAM,GAAW,CACb,2BACJ,EACA,MAAM,UAAY,CAAU,CAC5B,CACA,EAAa,uBAAuB,GAAU,CAAG,EAEzC,WAAW,EAAa,QACxB,WAAW,EAAa,OACxB,sBAAsB,GAAoB,oBAC1C,4BAA4B,EAC5B,MAAM,EACN,YAAY,EACpB,OAAO,UAAU,eAAe,KAAK,EAAW,WAAW,GACvD,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,WAAW,GAC1D,OAAO,eAAe,EAAS,YAAa,CACxC,WAAY,GACZ,MAAO,EAAU,SACrB,CAAC,EAEL,OAAO,KAAK,CAAS,EAAE,QAAQ,QAAS,CAAC,EAAG,CACxC,GAAI,IAAM,WAAa,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,CAAC,EAAG,EAAQ,GAAK,EAAU,GACpG,EACD,OAAO,UAAU,eAAe,KAAK,EAAQ,WAAW,GACpD,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,WAAW,GAC1D,OAAO,eAAe,EAAS,YAAa,CACxC,WAAY,GACZ,MAAO,EAAO,SAClB,CAAC,EAEL,OAAO,KAAK,CAAM,EAAE,QAAQ,QAAS,CAAC,EAAG,CACrC,GAAI,IAAM,WAAa,CAAC,OAAO,UAAU,eAAe,KAAK,EAAS,CAAC,EAAG,EAAQ,GAAK,EAAO,GACjG,IC/JD",
-  "debugId": "29AA37E62791531664756E2164756E21",
+  "debugId": "EE0C6F50B27B546764756E2164756E21",
   "names": []
 }

package/dist/{chunk-pqr01waj.js → chunk-v2pt8h42.js}

@@ -1,5 +1,5 @@
 // @bun
-import{Rl as n}from"./chunk-vgxkt9vd.js";var w=n((p)=>{var r={warningEmitted:!1},a=(e)=>{if(e&&!r.warningEmitted&&parseInt(e.substring(1,e.indexOf(".")))<20)r.warningEmitted=!0,process.emitWarning(`NodeDeprecationWarning: The AWS SDK for JavaScript (v3) will
+import{Zl as n}from"./chunk-zpqcawmq.js";var w=n((p)=>{var r={warningEmitted:!1},a=(e)=>{if(e&&!r.warningEmitted&&parseInt(e.substring(1,e.indexOf(".")))<20)r.warningEmitted=!0,process.emitWarning(`NodeDeprecationWarning: The AWS SDK for JavaScript (v3) will
 no longer support Node.js ${e} in January 2026.
 
 To continue receiving updates to AWS services, bug fixes, and security
@@ -8,4 +8,4 @@ updates please upgrade to a supported Node.js LTS version.
 More information can be found at: https://a.co/c895JFp`)};function o(e,t,s){if(!e.$source)e.$source={};return e.$source[t]=s,e}function u(e,t,s){if(!e.__aws_sdk_context)e.__aws_sdk_context={features:{}};else if(!e.__aws_sdk_context.features)e.__aws_sdk_context.features={};e.__aws_sdk_context.features[t]=s}function i(e,t,s){if(!e.$source)e.$source={};return e.$source[t]=s,e}p.emitWarningIfUnsupportedVersion=a;p.setCredentialFeature=o;p.setFeature=u;p.setTokenFeature=i;p.state=r});
 export{w as U};
 
-//# debugId=53488BFD5674614364756E2164756E21
+//# debugId=C63E7E15AE92A77C64756E2164756E21

package/dist/{chunk-pqr01waj.js.map → chunk-v2pt8h42.js.map}

@@ -5,6 +5,6 @@
     "'use strict';\n\nconst state = {\n    warningEmitted: false,\n};\nconst emitWarningIfUnsupportedVersion = (version) => {\n    if (version && !state.warningEmitted && parseInt(version.substring(1, version.indexOf(\".\"))) < 20) {\n        state.warningEmitted = true;\n        process.emitWarning(`NodeDeprecationWarning: The AWS SDK for JavaScript (v3) will\nno longer support Node.js ${version} in January 2026.\n\nTo continue receiving updates to AWS services, bug fixes, and security\nupdates please upgrade to a supported Node.js LTS version.\n\nMore information can be found at: https://a.co/c895JFp`);\n    }\n};\n\nfunction setCredentialFeature(credentials, feature, value) {\n    if (!credentials.$source) {\n        credentials.$source = {};\n    }\n    credentials.$source[feature] = value;\n    return credentials;\n}\n\nfunction setFeature(context, feature, value) {\n    if (!context.__aws_sdk_context) {\n        context.__aws_sdk_context = {\n            features: {},\n        };\n    }\n    else if (!context.__aws_sdk_context.features) {\n        context.__aws_sdk_context.features = {};\n    }\n    context.__aws_sdk_context.features[feature] = value;\n}\n\nfunction setTokenFeature(token, feature, value) {\n    if (!token.$source) {\n        token.$source = {};\n    }\n    token.$source[feature] = value;\n    return token;\n}\n\nexports.emitWarningIfUnsupportedVersion = emitWarningIfUnsupportedVersion;\nexports.setCredentialFeature = setCredentialFeature;\nexports.setFeature = setFeature;\nexports.setTokenFeature = setTokenFeature;\nexports.state = state;\n"
   ],
   "mappings": ";uDAEA,IAAM,EAAQ,CACV,eAAgB,EACpB,EACM,EAAkC,CAAC,IAAY,CACjD,GAAI,GAAW,CAAC,EAAM,gBAAkB,SAAS,EAAQ,UAAU,EAAG,EAAQ,QAAQ,GAAG,CAAC,CAAC,EAAI,GAC3F,EAAM,eAAiB,GACvB,QAAQ,YAAY;AAAA,4BACA;AAAA;AAAA;AAAA;AAAA;AAAA,uDAK2B,GAIvD,SAAS,CAAoB,CAAC,EAAa,EAAS,EAAO,CACvD,GAAI,CAAC,EAAY,QACb,EAAY,QAAU,CAAC,EAG3B,OADA,EAAY,QAAQ,GAAW,EACxB,EAGX,SAAS,CAAU,CAAC,EAAS,EAAS,EAAO,CACzC,GAAI,CAAC,EAAQ,kBACT,EAAQ,kBAAoB,CACxB,SAAU,CAAC,CACf,EAEC,QAAI,CAAC,EAAQ,kBAAkB,SAChC,EAAQ,kBAAkB,SAAW,CAAC,EAE1C,EAAQ,kBAAkB,SAAS,GAAW,EAGlD,SAAS,CAAe,CAAC,EAAO,EAAS,EAAO,CAC5C,GAAI,CAAC,EAAM,QACP,EAAM,QAAU,CAAC,EAGrB,OADA,EAAM,QAAQ,GAAW,EAClB,EAGH,kCAAkC,EAClC,uBAAuB,EACvB,aAAa,EACb,kBAAkB,EAClB,QAAQ",
-  "debugId": "53488BFD5674614364756E2164756E21",
+  "debugId": "C63E7E15AE92A77C64756E2164756E21",
   "names": []
 }

package/dist/{chunk-xhkga697.js → chunk-vn84xe2p.js}

@@ -1,5 +1,5 @@
 // @bun
-import{$b as b3,Bc as B3,Oc as P3,Wb as E3,_b as K2,dc as N3,ic as e,vc as F3,yd as I3}from"./chunk-9dxp7t3n.js";import{Fd as i2,Hd as B2,Kd as i3,Ld as l3,Md as N$,Od as j$}from"./chunk-7zf8rnsb.js";import{Rd as h3,Wd as m3,Yd as u3,de as x,ee as d3,fe as c3,he as p3,ie as _$}from"./chunk-39w89wss.js";import{le as P}from"./chunk-vqq0z746.js";import{Ae as X$,Ag as e3,De as R3,Eg as g2,Fg as f2,He as C$,Hf as Z2,Ig as w2,Jg as $$,Ke as U$,Kg as G2,Lg as Z$,Mg as z$,Ne as J$,Nf as H2,Ng as v2,Of as u2,Og as a,Pf as M,Rg as T$,Sf as V$,Sg as L2,Tf as Y$,Tg as p2,Uf as K$,Wf as w,Xe as F$,Ye as l2,Yg as Q$,Zg as H$,af as J2,bf as X2,dh as x$,hg as e2,sg as a2,tf as d2,ug as n,yg as r2,ze as l,zg as r3}from"./chunk-5w3kcn4a.js";import{Ai as o2,Qi as J3,Vi as A$,Wi as P2,Xi as N2,Yi as z2,ii as p,ki as m}from"./chunk-nphb176s.js";import{dj as t3}from"./chunk-228w21t6.js";import{oj as g}from"./chunk-dfmxvp8p.js";import{uj as c2}from"./chunk-n914rs58.js";import{Bj as F2,Cj as s2,Fj as I$,xj as B$,yj as n2}from"./chunk-g02gqhq0.js";import{Tj as s3,Yj as o3}from"./chunk-1705yamg.js";import{mk as g3,ok as u}from"./chunk-gmcttf0f.js";import{pk as A}from"./chunk-beckfwe9.js";import{vk as O$}from"./chunk-wvq3c25z.js";import{jl as t2}from"./chunk-reaty2mv.js";import{ql as U2,tl as y}from"./chunk-ermvtpy9.js";import{Cl as m2}from"./chunk-5bfrr8x5.js";import{Ol as a3}from"./chunk-2g2fsr71.js";var M$="mcp",k$=/^[\x21\x23-\x5B\x5D-\x7E]+$/;class O extends e{status;constructor($,Z){super($);this.status=Z;this.name="McpToolError"}}class v extends Error{reason;constructor($,Z){super($);this.reason=Z;this.name="McpCallRefusedError"}}var $3=/^[A-Za-z0-9_-]{1,64}$/,R$=/:([A-Za-z_][A-Za-z0-9_]*)([?*+]?)/g,Z3=4000,k=1e5,E$=/^(text\/|application\/([\w.+-]*\+)?(json|xml))/i,L3=new WeakMap;function H8($){return L3.get($)}class i{router;dispatcher;static token="router.mcp";plans=new Map;scopeTools=new Map;files;featureOn;constructor($,Z,z={}){this.router=$;this.dispatcher=Z;this.files=v$(z.files),this.featureOn=z.featureOn??X2;for(let[G,W]of Object.entries($.routes??{}))this.plans.set(G,b$(W)?this.planNative(G,W):this.plan(G,W));this.resolveScopes()}list($,Z){if(D2($),$.kind==="local")return this.descriptors(Z);let z=[];for(let[G,W]of this.plans){if(!W.remote||!this.grants($.principal,G))continue;if(Y3(W.remote,Z))z.push(W.remote)}return z}async available($,Z){let z=[];for(let G of this.list($,Z))if(await this.isOn(G))z.push(G);return z}descriptors($){let Z=[];for(let{descriptor:z}of this.plans.values())if(Y3(z,$))Z.push(z);return Z}get maxFileBytes(){return this.files.maxBytes}scopes(){return[...this.scopeTools].map(([$,{description:Z}])=>({name:$,description:Z}))}scopesFor($){return[...this.scopeTools].filter(([,{tools:Z}])=>Z.has($)).map(([Z])=>Z)}async execute($,Z,z,G,W={}){D2($);let X=this.plans.get(Z);if(X&&!await this.isOn(X.descriptor)){if($.kind==="remote")throw new v(`There is no tool named "${Z}".`,"unknown-tool");throw new O(`There is no tool named "${Z}".`,404)}if($.kind==="remote"){if(!X?.remote||!this.grants($.principal,Z))throw new v(`There is no tool named "${Z}".`,"unknown-tool");if(X.descriptor.requiresApproval&&W.approved!==!0&&!W2(X))throw new v(`"${Z}" needs the user's approval, and this call does not have it.`,"approval-required");G=void 0}if(!X)throw Error(`McpRegistry: there is no tool named "${Z}".`);if(X.kind==="tool")return await this.executeNative(X,$,z,G,W);let Y=X,K=$.kind==="remote"?Y.remote:Y.descriptor,Q=K.inputSchema.safeParse(z);if(Q.ok===!1)throw new O(`Invalid arguments for "${Z}": ${Q.errors.join(", ")}`);let V=Q.value,H={caller:$,req:$.req,tool:K,input:V,ctx:G},U=await this.fillPath(Y,H),{path:I}=this.dispatcher.getRouteHandlerAndParams(new Request(`http://gemi.internal/api${U}`));if(I!==K.url)throw new O(`"${Z}" has nothing at ${U}.`,404);let J={};for(let _ of Y.jsonKeys)if(V[_]!==void 0)J[_]=V[_];let N,B="";if(Y.fileFields.length>0)N=await this.formData(Y,J,H);else if(K.method==="GET")B=n$(J);else if(Y.jsonKeys.length>0)N=J;let T=this.router.credentials?await this.bind(Y,"the credentials",()=>this.router.credentials(H)):void 0,j={...T?{credentials:T}:{},...W.signal?{signal:W.signal}:{},...W.progress?{progress:W.progress}:{},...$.kind==="remote"?{identity:{user:$.principal.user,grant:{via:$.principal.via,id:$.principal.id,scopes:$.principal.scopes,...$.principal.clientId?{clientId:$.principal.clientId}:{}}}}:{}},C;try{let _=B?`${U}?${B}`:U;C=Object.keys(j).length>0?await this.dispatcher.dispatchAs($.req,K.method,_,N,j):await this.dispatcher.dispatchAs($.req,K.method,_,N)}catch(_){throw console.error(`[gemi/mcp] Dispatching "${Z}" failed:`,_),new O(`"${Z}" failed on the server.`,500)}if(!Y.result&&!K.outputSchema)return await U3(Z,C);return await this.project(Y,H,C)}async isOn($){return $.feature===void 0||await this.featureOn($.feature)===!0}plan($,Z){if(!$3.test($))throw Error(`McpRouter: "${$}" is not a valid tool name. A routes key is the tool's name as a model and an MCP client see it, used verbatim \u2014 letters, digits, "_" and "-", at most 64.`);let z=`McpRouter: "${$}" (${Z?.method} ${Z?.url})`;if(!(Z instanceof Object)||Z.__internal_brand!=="McpRoute")throw Error(`McpRouter: "${$}" is not a route or a tool. Declare it with this.fromApiRoute(...) or this.fromTool(...).`);let{method:G,url:W,meta:X}=Z;if(X.feature!==void 0&&(typeof X.feature!=="string"||X.feature===""))throw Error(`${z}: feature must be a feature key from app/features.`);if(W.startsWith("/__gemi__"))throw Error(`${z} is a framework route, not an app route.`);let Y=this.dispatcher.flatRoutes[W]?.[G];if(!Y)throw Error(`${z} names no route of this app. Expose a route by the path and verb it is mounted at.`);let K=[...W.matchAll(R$)].map(([,F,S])=>({name:F,modifier:S})),Q=X.params??{};for(let F of K)if(!(F.name in Q))throw Error(`${z}: the path param "${F.name}" must be bound or declared "input".`);for(let[F,S]of Object.entries(Q)){if(!K.some((h)=>h.name===F))throw Error(`${z}: "${F}" in params is not a param of the url.`);if(Q3(S))d$(z,`params.${F}`,S);else K3(z,`params.${F}`,S)}let V=[],H;if(X.input){if(H=X.input.toJSONSchema(),H.type!=="object"||!H.properties)throw Error(`${z}: input must be an s.object(...), the fields of the request body.`);V=Object.keys(H.properties)}let U=Object.entries(X.files??{}).map(([F,S])=>({name:F,binder:S}));for(let F of U)K3(z,`files.${F.name}`,F.binder);if(X.result!==void 0&&typeof X.result!=="function")throw Error(`${z}: result must be a function.`);if(X.output!==void 0&&typeof X.output?.safeParse!=="function")throw Error(`${z}: output must be a schema, built with s.`);if(X.title!==void 0&&(typeof X.title!=="string"||X.title===""))throw Error(`${z}: title must be a non-empty string.`);let I=V3(z,G,X.annotations);if(U.length>0&&G==="GET")throw Error(`${z}: a GET has no body to carry a file.`);let J={},N=(F,S)=>{if(F in J)throw Error(`${z}: "${F}" is the input key of two params or files, and the model can only send one.`);J[F]=S},B=new Map,T=new Map;for(let F of K){let S=Q[F.name];if(S==="input"){let h=p.string().describe(`The ":${F.name}" segment of the url.`);N(F.name,F.modifier==="?"||F.modifier==="*"?h.optional():h)}else if(Q3(S)){let h=S.as??F.name;N(h,S.input),T.set(F.name,{key:h,param:S})}else B.set(F.name,S)}let j={};for(let F of U)if(F.binder==="input")N(F.name,p.string().describe("The id of an attachment the user uploaded or a tool produced (gemi_att_\u2026), whose file is sent as this field.")),j[F.name]=this.remoteFileSchema();let C=[...Object.keys(J),...U.map((F)=>F.name)];for(let F of new Set(C))if(V.includes(F))throw Error(`${z}: "${F}" is both an input field and a param or file, and the model can only send one.`);let _=Object.freeze({kind:"route",name:$,description:X.description,method:G,url:W,inputSchema:H3(X.input,H,p.object(J)),...X.output?{outputSchema:X.output}:{},...X.title?{title:X.title}:{},annotations:I,tags:Object.freeze([...X.tags??[]]),requiresApproval:X.requiresApproval===!0,...X.feature!==void 0?{feature:X.feature}:{},...Y.source?{source:Y.source}:{}}),r=!U.every((F)=>F.binder==="input")?null:U.length===0?_:Object.freeze({..._,inputSchema:H3(X.input,H,p.object(i$(J,Object.keys(j))),j)});return{kind:"route",descriptor:_,remote:r,params:K,paramBinders:B,modelParams:T,fileFields:U,jsonKeys:V,...X.result?{result:X.result}:{}}}remoteFileSchema(){let{maxBytes:$,fetch:Z}=this.files,z={name:{type:"string",description:"The file's name, like report.pdf."},mimeType:{type:"string",description:"The file's media type, like application/pdf."},data:{type:"string",contentEncoding:"base64",description:`The file's bytes, base64-encoded (RFC 4648, standard alphabet). At most ${$} bytes decoded.`}};if(Z)z.url={type:"string",format:"uri",description:"An https URL the server downloads the file from, instead of data."};let G={type:"object",description:Z?"A file, sent as base64 in data or fetched from url: exactly one of the two.":"A file, sent as base64 in data.",properties:z,required:["name","mimeType"],additionalProperties:!1},W=Object.keys(z),X=(Y)=>{if(typeof Y!=="object"||Y===null||Array.isArray(Y))return{ok:!1,errors:["a file must be an object"]};let K=[],Q={};for(let V of Object.keys(Y))if(!W.includes(V))K.push(`a file has no field "${V}"`);for(let V of W){let H=Y[V];if(H===void 0||H===null){if(V==="name"||V==="mimeType")K.push(`a file needs "${V}"`);continue}if(typeof H!=="string")K.push(`a file's "${V}" must be a string`);else Q[V]=H}return K.length>0?{ok:!1,errors:K}:{ok:!0,value:Q}};return{toJSONSchema:()=>G,safeParse:X,parse(Y){let K=X(Y);if(K.ok===!1)throw Error(K.errors.join(", "));return K.value}}}planNative($,Z){if(!$3.test($))throw Error(`McpRouter: "${$}" is not a valid tool name. A routes key is the tool's name as a model and an MCP client see it, used verbatim \u2014 letters, digits, "_" and "-", at most 64.`);let z=`McpRouter: "${$}" (a native tool)`,{tool:G,meta:W={}}=Z;if(!(G instanceof Object)||typeof G.name!=="string")throw Error(`${z} is not an AgentTool. Pass one built with AgentTool.create(...).`);if(G.answeredBy==="client"||typeof G.execute!=="function")throw Error(`${z}: "${G.name}" is answered by the client, and only a tool the server runs can be called through the registry.`);if(typeof G.inputSchema==="function")throw Error(`${z}: "${G.name}" resolves its input schema per run, and the registry lists one schema to every caller. Give it a fixed inputSchema.`);if(typeof G.inputSchema?.safeParse!=="function")throw Error(`${z}: its inputSchema must be a schema, built with s.`);if(typeof W!=="object"||W===null)throw Error(`${z}: the meta must be an object.`);if(W.description!==void 0&&(typeof W.description!=="string"||W.description.trim()===""))throw Error(`${z}: description must be a non-empty string.`);if(W.title!==void 0&&(typeof W.title!=="string"||W.title===""))throw Error(`${z}: title must be a non-empty string.`);if(W.tags!==void 0&&(!Array.isArray(W.tags)||W.tags.some((Q)=>typeof Q!=="string")))throw Error(`${z}: tags must be an array of strings.`);if(W.requiresApproval===!1&&G.requiresApproval)throw Error(`${z}: "${G.name}" requires approval, and requiresApproval: false would run it without asking. Leave it out, or register a tool that does not ask.`);let X=W.remote;if(X!==void 0){if(typeof X!=="object"||X===null||typeof X.context!=="function")throw Error(`${z}: remote must be { context(call) }, building the AgentContext a remote call runs with.`);if(X.progress!==void 0&&typeof X.progress!=="function")throw Error(`${z}: remote.progress must be a function.`)}let Y=W.description??G.description;if(typeof Y!=="string"||Y.trim()==="")throw Error(`${z} needs a description: the tool's own, or the meta's.`);let K=Object.freeze({kind:"tool",name:$,description:Y,inputSchema:G.inputSchema,...G.outputSchema?{outputSchema:G.outputSchema}:{},...W.title?{title:W.title}:{},annotations:V3(z,void 0,W.annotations),tags:Object.freeze([...W.tags??[]]),requiresApproval:G.requiresApproval||W.requiresApproval===!0});return{kind:"tool",descriptor:K,remote:X?K:null,tool:G,meta:W}}async approvalRequired($,Z,z,G={}){let W=this.plans.get(Z);if(!W)return!0;if(!W2(W))return W.descriptor.requiresApproval;let X=W;if($.kind!=="remote"||!X.meta.remote)return!0;let Y=X.descriptor.inputSchema.safeParse(z);if(Y.ok===!1)return!0;let K={caller:$,req:$.req,tool:X.descriptor,input:Y.value},Q;try{Q=await this.bind(X,"the remote context",()=>X.meta.remote.context(K))}catch{return!0}if(typeof Q!=="object"||Q===null)return!0;let V=G.signal??new AbortController().signal;return X3(X,Y.value,W3(G3(X,Q,V)))}nativeApproval($){let Z=this.plans.get($);if(Z?.kind!=="tool")throw Error(`McpRegistry: there is no native tool named "${$}".`);return W2(Z)??Z.descriptor.requiresApproval}nativeTool($){let Z=this.plans.get($);if(Z?.kind!=="tool")throw Error(`McpRegistry: there is no native tool named "${$}".`);return Z.tool}startNative($,Z,z,G){let W=this.plans.get(Z);if(W?.kind!=="tool")throw Error(`McpRegistry: there is no native tool named "${Z}".`);if($===void 0)return W.tool.execute(z,G);if(D2($),$.kind!=="local")throw Error("McpRegistry: startNative is for a local caller. A remote call goes through execute().");let X=W.descriptor.inputSchema.safeParse(z);if(X.ok===!1)throw new O(`Invalid arguments for "${Z}": ${X.errors.join(", ")}`);return this.runNative(W,{caller:$,req:$.req,tool:W.descriptor,input:X.value},G)}runNative($,Z,z){let G={...z};return L3.set(G,{...Z,ctx:G}),$.tool.execute(Z.input,G)}async executeNative($,Z,z,G,W){let{name:X}=$.descriptor,Y=$.descriptor.inputSchema.safeParse(z);if(Y.ok===!1)throw new O(`Invalid arguments for "${X}": ${Y.errors.join(", ")}`);let K={caller:Z,req:Z.req,tool:$.descriptor,input:Y.value},Q=(_,_2)=>{if(!W.progress)return;let r;try{r=$.meta.remote?.progress?$.meta.remote.progress(_,_2):f$(_,_2)}catch(F){console.error(`[gemi/mcp] The progress mapping of "${X}" failed:`,F);return}if(r)W.progress(r)};if(Z.kind==="local"){if(!G)throw Error(`McpRegistry: "${X}" is a native tool, which runs with the tool context of an agent call, and none was passed to execute().`);return await z3(this.runNative($,{...K,ctx:G},G),Q)}let V=$.meta.remote,H=await this.bind($,"the remote context",()=>V.context(K));if(typeof H!=="object"||H===null)throw console.error(`[gemi/mcp] The remote context of "${X}" is not an object:`,H),new O(`"${X}" failed on the server.`,500);let U=$.tool.timeoutMs,I=[...W.signal?[W.signal]:[],...U!==void 0?[AbortSignal.timeout(U)]:[]],J=I.length===0?new AbortController().signal:I.length===1?I[0]:AbortSignal.any(I),N=G3($,H,J);if(!W.approved&&W2($)&&await X3($,K.input,W3(N)))throw new v(`"${X}" needs the user's approval, and this call does not have it.`,"approval-required");let B;try{B=await z3(this.runNative($,{...K,ctx:N},N),Q,J)}catch(_){if(J.aborted&&_===J.reason){if(W.signal?.aborted)throw new O(`"${X}" was cancelled.`,499);throw new O(`"${X}" did not finish within ${U} ms.`,504)}if(_ instanceof O)throw _;if(_ instanceof e||_ instanceof v)throw new O(_.message);throw console.error(`[gemi/mcp] "${X}" failed for a remote caller:`,_),new O(`"${X}" failed on the server.`,500)}let T=(_)=>{return console.error(`[gemi/mcp] "${X}" ${_}`),new O(`"${X}" failed on the server.`,500)};if(F3(B))throw T("answered a job handle, and a remote call has no background jobs.");let j=B;if($.descriptor.outputSchema){let _=$.descriptor.outputSchema.safeParse(j);if(_.ok===!1)throw T(`answered what its output schema refuses: ${_.errors.join(", ")}`);j=_.value}if(j===void 0)return null;if(typeof j==="string")return j.length>k?`${j.slice(0,k)}\u2026 [cut at ${k} of ${j.length} characters]`:j;let C=JSON.stringify(j);if(C!==void 0&&C.length>k)return`${C.slice(0,k)}\u2026 [cut at ${k} of ${C.length} characters]`;return j}async fillPath($,Z){let{input:z,req:G}=Z,W=$.descriptor.url;for(let X of $.params){let Y=$.paramBinders.get(X.name),K=$.modelParams.get(X.name),Q;if(Y||K){if(Q=K?await this.bind($,`the param "${X.name}"`,()=>K.param.bind(z[K.key],G,Z),{refusals:!0}):await this.bind($,`the param "${X.name}"`,()=>Y(G,Z)),Q===void 0||Q===null||Q==="")throw console.error(`[gemi/mcp] The ${K?"resolver":"binder"} for "${X.name}" of "${$.descriptor.name}" returned ${JSON.stringify(Q)}.`),new O(`"${$.descriptor.name}" failed on the server.`,500)}else Q=z[X.name];let V=`:${X.name}${X.modifier}`;if(Q===void 0||Q===null||Q===""){if(X.modifier!=="?"&&X.modifier!=="*")throw new O(`"${X.name}" of "${$.descriptor.name}" must not be empty.`);W=W.replace(`/${V}`,"");continue}W=W.replace(V,l$($.descriptor.name,X,String(Q)))}return W}async formData($,Z,z){let{input:G,ctx:W}=z,X=$.descriptor.name;if(z.caller.kind==="remote"){let K=new FormData;for(let[Q,V]of Object.entries(Z))O2(K,Q,V);for(let Q of $.fileFields)K.append(Q.name,await this.remoteFile(X,Q.name,G[Q.name]));return K}if(!W)throw Error(`McpRegistry: "${X}" sends a file, which is resolved through the tool context's attachments, and none was passed to execute().`);let Y=new FormData;for(let[K,Q]of Object.entries(Z))O2(Y,K,Q);for(let K of $.fileFields){let Q=K.binder==="input"?G[K.name]:await this.bind($,`the file "${K.name}"`,()=>K.binder(W,z));if(typeof Q!=="string"||Q==="")throw new O(`"${X}" needs a file for "${K.name}", and this turn has none. Ask the user to attach one.`);Y.append(K.name,await W.attachments.file(Q))}return Y}async remoteFile($,Z,z){let G=(H)=>new O(`"${Z}" of "${$}" ${H}`,400),W=z,{maxBytes:X,fetch:Y}=this.files;if(!g$(W.name))throw G("needs a name of 1 to 255 characters, without control characters or slashes.");if(!h$.test(W.mimeType))throw G(`has a mimeType that is not a media type: "${W.mimeType.slice(0,100)}".`);let K=typeof W.data==="string",Q=typeof W.url==="string";if(K===Q)throw G(Y?"needs exactly one of data or url.":"needs its bytes, base64, in data.");if(K){let H=W.data.replace(/\s+/g,"");if(Math.floor(H.length*3/4)-u$(H)>X)throw G(`is larger than the ${X} bytes a file may be.`);if(H.length%4!==0||!m$.test(H))throw G("has data that is not base64 (RFC 4648, standard alphabet, padded).");return new File([Buffer.from(H,"base64")],W.name,{type:W.mimeType})}if(!Y)throw G("cannot be fetched from a URL here. Send its bytes, base64, in data.");let V;try{V=new URL(W.url)}catch{throw G("has a url that is not a URL.")}if(V.protocol!=="https:")throw G("can only be fetched from an https URL.");try{let H=await J3(V.href,{...Y,maxSize:Math.min(Y.maxSize??X,X),redirect:"follow"});if(!H.ok)throw G(`could not be fetched: ${V.host} answered ${H.status}.`);let U=await H.arrayBuffer();return new File([U],W.name,{type:W.mimeType})}catch(H){if(H instanceof O)throw H;throw G(`could not be fetched from ${V.host}: ${H instanceof Error?H.message:"failed"}.`)}}grants($,Z){for(let z of $.scopes??[])if(this.scopeTools.get(z)?.tools.has(Z))return!0;return!1}resolveScopes(){let $=this.router.scopes;if($===void 0){this.scopeTools.set(M$,{description:"Use this app's tools as you",tools:new Set(this.plans.keys())});return}if(typeof $!=="object"||$===null)throw Error("McpRouter: scopes must be an object of scope names.");let Z=new Set([...this.plans.values()].flatMap(({descriptor:z})=>z.tags));for(let[z,G]of Object.entries($)){let W=`McpRouter: scope "${z}"`;if(!k$.test(z))throw Error(`${W} is not a valid OAuth scope: printable ASCII, no spaces or quotes.`);if(typeof G?.description!=="string"||G.description==="")throw Error(`${W} needs a description: it is what a consent screen shows.`);let X=new Set;for(let Y of G.tags??[]){if(!Z.has(Y))throw Error(`${W} names the tag "${Y}", which no tool has.`);for(let[K,{descriptor:Q}]of this.plans)if(Q.tags.includes(Y))X.add(K)}for(let Y of G.names??[]){if(!this.plans.has(Y))throw Error(`${W} names "${Y}", which is no tool.`);X.add(Y)}if(X.size===0)throw Error(`${W} reaches no tool. Give it tags or names.`);this.scopeTools.set(z,{description:G.description,tools:X})}}async project($,Z,z){let{name:G,outputSchema:W}=$.descriptor;if(z.status<200||z.status>=300)return await U3(G,z);let X=(U,I)=>{if(I===void 0)console.error(`[gemi/mcp] "${G}" ${U}`);else console.error(`[gemi/mcp] "${G}" ${U}`,I);return new O(`"${G}" failed on the server.`,500)},Y=z.headers.get("Content-Type"),K=await z.text(),Q=null;if(K!=="")try{Q=JSON.parse(K)}catch{throw X(`answered ${Y??"a body with no content-type"} that is not JSON, and its result or output needs JSON.`)}let V=Q;if($.result)try{V=await $.result(Q,Z)}catch(U){throw X("failed in its result projection:",U)}if(W){let U=W.safeParse(V);if(U.ok===!1)throw X(`answered what its output schema refuses: ${U.errors.join(", ")}`);V=U.value}if(V===void 0)return null;let H=JSON.stringify(V);if(H!==void 0&&H.length>k)return`${H.slice(0,k)}\u2026 [cut at ${k} of ${H.length} characters]`;return V}async bind($,Z,z,G={}){try{return await z()}catch(W){if(G.refusals&&W instanceof e)throw W;throw console.error(`[gemi/mcp] Binding ${Z} of "${$.descriptor.name}" failed:`,W),new O(`"${$.descriptor.name}" failed on the server.`,500)}}}function b$($){return $ instanceof Object&&$.__internal_brand==="McpTool"}function y$($){return typeof $==="object"&&$!==null&&typeof $.next==="function"&&Symbol.asyncIterator in $}async function z3($,Z,z){let G;if(z)G=new Promise((X,Y)=>{if(z.aborted)Y(z.reason);else z.addEventListener("abort",()=>Y(z.reason),{once:!0})}),G.catch(()=>{});let W=(X)=>G?Promise.race([X,G]):X;if(!y$($))return await W(Promise.resolve($));try{let X=0,Y=await W($.next());while(!Y.done)Z(Y.value,++X),Y=await W($.next());return Y.value}catch(X){throw $.return(void 0).catch(()=>{}),X}}function f$($,Z){if(typeof $==="string")return{progress:Z,message:$};if(typeof $==="object"&&$!==null){let{progress:z,total:G,message:W}=$;if(typeof z==="number"&&Number.isFinite(z))return{progress:z,...typeof G==="number"?{total:G}:{},...typeof W==="string"?{message:W}:{}};if(typeof W==="string")return{progress:Z,message:W}}return{progress:Z}}function G3($,Z,z){let G=$.descriptor.name,W=`mcp_${crypto.randomUUID()}`,X=`mcp_call_${crypto.randomUUID()}`,Y=(Q)=>async()=>{throw new e(`"${G}" was called by a remote MCP client, which has no ${Q}.`,{retryable:!1})},K={put:Y("attachment store"),get:Y("attachment store"),read:Y("attachment store"),file:Y("attachment store")};return{context:Z,body:{},runId:W,toolCallId:X,signal:z,step:1,depth:0,resumed:!1,attachments:K,turn:Object.freeze({attachments:Object.freeze([])}),runAgent:Y("agent run to nest a sub-agent in"),generateImage:Y("attachment store to put an image in"),editImage:Y("attachment store to put an image in"),generate:(Q)=>I3({...Q,signal:Q.signal?AbortSignal.any([z,Q.signal]):z},{origin:{mcp:G,runId:W,toolCallId:X}}),jobs:B3({jobs:void 0,threadId:void 0,runId:W,toolCallId:X,toolName:G,depth:0,async:$.tool.async,attachments:null}),memory:P3(),meter:N3().meter}}function W2($){if($.kind!=="tool"||$.meta.requiresApproval===!0)return;return $.tool.approvalPredicate}function W3($){return{context:$.context,body:$.body,runId:$.runId,threadId:$.threadId,toolCallId:$.toolCallId,step:$.step,depth:$.depth,signal:$.signal}}async function X3($,Z,z){try{return await $.tool.approvalPredicate(Z,z)!==!1}catch(G){return console.error(`[gemi/mcp] The requiresApproval of "${$.descriptor.name}" threw, so the call asks the user:`,G),!0}}function D2($){if($?.kind==="local"&&$.req)return;if($?.kind==="remote"&&$.req&&$.principal?.user&&typeof $.principal.id==="string"&&Array.isArray($.principal.scopes))return;throw Error('McpRegistry: a caller is { kind: "local", req } or { kind: "remote", req, principal }, with the principal a caller resolver verified.')}function Y3($,Z){if(Z?.names&&!Z.names.includes($.name))return!1;if(Z?.tags&&!$.tags.some((z)=>Z.tags.includes(z)))return!1;return!0}var w$=10485760;function v$($){let Z=$?.maxBytes??w$;if(!Number.isSafeInteger(Z)||Z<=0)throw Error("McpRegistry: files.maxBytes must be a positive whole number of bytes.");let z=$?.fetchUrls===!0?{}:typeof $?.fetchUrls==="object"&&$.fetchUrls!==null?$.fetchUrls:null;return{maxBytes:Z,fetch:z}}function g$($){if($.length===0||$.length>255)return!1;for(let Z of $){let z=Z.codePointAt(0);if(z<32||z===127||Z==="/"||Z==="\\")return!1}return!0}var h$=/^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}(\s*;.{0,200})?$/,m$=/^[A-Za-z0-9+/]*={0,2}$/;function u$($){return $.endsWith("==")?2:$.endsWith("=")?1:0}function K3($,Z,z){if(z!=="input"&&typeof z!=="function")throw Error(`${$}: ${Z} must be a function or "input".`)}function Q3($){return $ instanceof Object&&$.__internal_brand==="McpModelParam"}function d$($,Z,z){if(z.as!==void 0&&(typeof z.as!=="string"||z.as===""))throw Error(`${$}: ${Z}.as must be a non-empty string.`);let G=z.input;if(typeof G?.safeParse!=="function"||typeof G.toJSONSchema!=="function")throw Error(`${$}: ${Z}.input must be a schema, built with s.`);if(typeof z.bind!=="function")throw Error(`${$}: ${Z}.bind must be a function.`)}var c$=new Set(["readOnlyHint","destructiveHint","idempotentHint","openWorldHint"]);function p$($){switch($){case"GET":return{readOnlyHint:!0};case"DELETE":return{destructiveHint:!0};case"PUT":return{idempotentHint:!0};default:return{}}}function V3($,Z,z){if(z!==void 0&&(typeof z!=="object"||z===null))throw Error(`${$}: annotations must be an object of hints.`);let G=Z?p$(Z):{};for(let[W,X]of Object.entries(z??{})){if(!c$.has(W))throw Error(`${$}: "${W}" is not a tool annotation. Use readOnlyHint, destructiveHint, idempotentHint or openWorldHint.`);if(X===void 0)continue;if(typeof X!=="boolean")throw Error(`${$}: annotations.${W} must be true or false.`);G[W]=X}if(G.readOnlyHint===!0&&(G.destructiveHint||G.idempotentHint))throw Error(`${$} is read-only${z?.readOnlyHint?"":` (a ${Z})`} and also ${G.destructiveHint?"destructive":"idempotent"}, which only a tool that is not read-only can be. Set readOnlyHint: false if it changes something.`);return Object.freeze(G)}function H3($,Z,z,G={}){let W=z.toJSONSchema(),X=Object.fromEntries(Object.entries(G).map(([Q,V])=>[Q,V.toJSONSchema()])),Y={...Z??{},type:"object",properties:{...Z?.properties??{},...W.properties,...X},required:[...Z?.required??[],...W.required??[],...Object.keys(G)],additionalProperties:!1},K=(Q)=>{if(typeof Q!=="object"||Q===null||Array.isArray(Q))return{ok:!1,errors:["expected an object"]};let V=[],H={};if($){let I=$.safeParse(Q);if(I.ok===!1)V.push(...I.errors);else H={...I.value}}let U=z.safeParse(Q);if(U.ok===!1)V.push(...U.errors);else H={...H,...U.value};for(let[I,J]of Object.entries(G)){let N=Q[I];if(N===void 0){V.push(`"${I}" is required`);continue}let B=J.safeParse(N);if(B.ok===!1)V.push(...B.errors.map((T)=>`${I}: ${T}`));else H[I]=B.value}return V.length>0?{ok:!1,errors:V}:{ok:!0,value:H}};return{toJSONSchema:()=>Y,safeParse:K,parse(Q){let V=K(Q);if(V.ok===!1)throw Error(V.errors.join(", "));return V.value}}}function i$($,Z){return Object.fromEntries(Object.entries($).filter(([z])=>!Z.includes(z)))}function l$($,Z,z){let G=Z.modifier==="*"||Z.modifier==="+"?z.split("/"):[z];if(G.some((W)=>W==="."||W===".."))throw new O(`"${z}" is not a valid value for "${Z.name}" of "${$}".`);return G.map(encodeURIComponent).join("/")}function O2($,Z,z){if(z===void 0||z===null)return;if(Array.isArray(z)){for(let G of z)O2($,Z,G);return}$.append(Z,typeof z==="object"?JSON.stringify(z):String(z))}function n$($){let Z=new URLSearchParams,z=(G,W)=>{if(W===void 0||W===null)return;if(Array.isArray(W)){for(let X of W)z(G,X);return}Z.append(G,typeof W==="object"?JSON.stringify(W):String(W))};for(let[G,W]of Object.entries($))z(G,W);return Z.toString()}async function U3($,Z){if(Z.status>=200&&Z.status<300){let G=Z.headers.get("Content-Type");if(G&&!E$.test(G)){let X=(await Z.arrayBuffer()).byteLength;return`"${$}" answered with ${X} bytes of ${G}, which is not shown.`}let W=await Z.text();if(W==="")return null;if(W.length>k)return`${W.slice(0,k)}\u2026 [cut at ${k} of ${W.length} characters]`;try{return JSON.parse(W)}catch{return W}}let z=await Z.text();if(Z.status>=400&&Z.status<500){let G=z.length>Z3?`${z.slice(0,Z3)}\u2026`:z;throw new O(`"${$}" was refused with ${Z.status}${G?`: ${G}`:"."}`,Z.status)}if(Z.status<500)console.error(`[gemi/mcp] "${$}" answered ${Z.status}${Z.headers.get("Location")?` to ${Z.headers.get("Location")}`:""}, which a tool call cannot follow.`);throw new O(`"${$}" failed on the server.`,Z.status)}import{createHash as t$,randomBytes as s$,timingSafeEqual as o$}from"crypto";function j2($){let Z=$.headers.get("authorization");if(!Z)return null;let z=/^Bearer[ ]+([\x21-\x7e]+)$/i.exec(Z.trim());return z?z[1]:null}class a${options;name="api-key";constructor($){this.options=$;if(typeof $?.prefix!=="string"||!/^[A-Za-z0-9_-]{3,32}$/.test($.prefix))throw Error('McpApiKeyResolver: prefix is required: 3 to 32 letters, digits, _ or -, like "myapp_mcp_".');if(typeof $.verify!=="function")throw Error("McpApiKeyResolver: verify must be a function that looks a key up.")}static generate($){return`${$}${s$(32).toString("base64url")}`}static hash($){return t$("sha256").update($).digest("hex")}static hashesMatch($,Z){let z=Buffer.from($),G=Buffer.from(Z);return z.length===G.length&&o$(z,G)}async resolve($){let Z=j2($);if(!Z?.startsWith(this.options.prefix))return null;let z=await this.options.verify(Z,$);if(!z)return{ok:!1,error:"invalid_token",description:"The API key is not valid."};if(!z.user||typeof z.id!=="string"||z.id===""||!Array.isArray(z.scopes))throw Error("McpApiKeyResolver: verify must answer { user, id, scopes } for a key it knows, or null.");return{ok:!0,principal:{user:z.user,via:this.name,id:z.id,scopes:[...z.scopes]}}}}import{createHash as y3,randomBytes as j3}from"crypto";async function A2($,Z){let z=r$();if(!z)return null;let G=await z.consume($,Z);return G.allowed?null:Math.max(1,Math.ceil(G.retryAfter/1000))}function r$(){try{let $=y();return $.bound(l)?$.make(l):null}catch{return null}}var x2=["2026-07-28"],Y2=["2025-11-25","2025-06-18","2025-03-26"],C2=[...x2,...Y2],S2="io.modelcontextprotocol/protocolVersion",q2="io.modelcontextprotocol/clientCapabilities";var T2="io.modelcontextprotocol/serverInfo",D={ParseError:-32700,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602,InternalError:-32603,HeaderMismatch:-32020,MissingRequiredClientCapability:-32021,UnsupportedProtocolVersion:-32022};class L extends Error{code;data;status;constructor($,Z,z,G=200){super(Z);this.code=$;this.data=z;this.status=G;this.name="JsonRpcError"}}function R($,Z){return{jsonrpc:"2.0",id:$,error:{code:Z.code,message:Z.message,...Z.data!==void 0?{data:Z.data}:{}}}}function _3($){if(Array.isArray($))throw new L(D.InvalidRequest,"Batched requests are not supported.",void 0,400);if(typeof $!=="object"||$===null||$.jsonrpc!=="2.0")throw new L(D.InvalidRequest,"Not a JSON-RPC 2.0 message.",void 0,400);let Z=$,z=Z.id,G=typeof z==="string"||typeof z==="number"&&Number.isFinite(z);if(typeof Z.method==="string"){if(Z.params!==void 0&&(typeof Z.params!=="object"||Z.params===null||Array.isArray(Z.params)))throw new L(D.InvalidRequest,"params must be an object.",void 0,400);if(z===void 0)return{kind:"notification",message:Z};if(!G)throw new L(D.InvalidRequest,"id must be a string or a number.",void 0,400);return{kind:"request",message:Z}}if(G&&(("result"in Z)||("error"in Z)))return{kind:"response",message:Z};throw new L(D.InvalidRequest,"Not a JSON-RPC request, notification or response.",void 0,400)}function M2($,Z){let z=$.outputSchema?.toJSONSchema(),G={...$.annotations,...$.title&&!Z?{title:$.title}:{}};return{name:$.name,...$.title?{title:$.title}:{},description:$.description,inputSchema:$.inputSchema.toJSONSchema(),...z&&(Z||z.type==="object")?{outputSchema:z}:{},...Object.keys(G).length>0?{annotations:G}:{}}}function q($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function D3($){let Z=/^=\?base64\?([A-Za-z0-9+/]*={0,2})\?=$/.exec($);if(!Z)return $;try{let z=Buffer.from(Z[1],"base64");return new TextDecoder("utf-8",{fatal:!0}).decode(z)}catch{return null}}import{createHmac as e$,timingSafeEqual as $6}from"crypto";function k2($,Z,z){let G=Buffer.from(JSON.stringify(z)).toString("base64url");return`${Z}.${G}.${O3($,Z,G).toString("base64url")}`}function R2($,Z,z,G=Date.now()){if(typeof z!=="string"||z.length>8192)return null;let W=z.split(".");if(W.length!==3||W[0]!==Z)return null;let[,X,Y]=W,K=Buffer.from(Y,"base64url"),Q=O3($,Z,X);if(K.length!==Q.length||!$6(K,Q))return null;let V;try{V=JSON.parse(Buffer.from(X,"base64url").toString("utf8"))}catch{return null}if(typeof V!=="object"||V===null)return null;if(typeof V.exp!=="number"||V.exp<=G)return null;return V}function O3($,Z,z){return e$("sha256",K2($)).update(`${Z}.${z}`).digest()}var E2="gemi.mcp.request-state.v1",A3="gemi.mcp.session.v1",Z6=86400000,x3=600000,C3="gemi_approval",b2=2000,z6={limit:600,window:60},G6={limit:30,window:60};class $2{registry;static token="router.mcp.http";endpoint;resolvers;context;allowedOrigins;rateLimit;maxBodyBytes;serverInfo;instructions;nonces;approvalTimeoutMs;onCall;feature;featureOn;pending=new Map;inflight=new Map;constructor($,Z,z={}){this.registry=$;if(typeof Z.url!=="string")throw Error(`route.mcp.remote.url is required: the endpoint's canonical URL, like "https://example.com/mcp".`);this.endpoint=Y6(Z.url);let G=Z.resolvers??[];if(!Array.isArray(G)||G.length===0)throw Error("route.mcp.remote is enabled without a caller resolver. Configure route.mcp.remote.resolvers \u2014 an McpOAuthServer, an McpApiKeyResolver, or your own \u2014 or leave the endpoint off. Without one every request would be refused, or answered as nobody.");for(let W of G)if(typeof W?.resolve!=="function"||typeof W.name!=="string"||W.name==="")throw Error("route.mcp.remote.resolvers: each resolver needs a name and a resolve().");if(this.resolvers=G,K2(E2),this.context={resource:this.resource,registry:$},this.allowedOrigins=new Set((Z.allowedOrigins??[]).map((W)=>{if(new URL(W).origin!==W)throw Error(`route.mcp.remote.allowedOrigins: "${W}" is not an origin (scheme://host[:port]).`);return W})),this.allowedOrigins.add(this.endpoint.origin),this.rateLimit=Z.rateLimit===!1?!1:Z.rateLimit??z6,this.maxBodyBytes=Z.maxBodyBytes??Math.ceil($.maxFileBytes*1.4)+1048576,this.serverInfo={name:Z.server?.name??"gemi",version:Z.server?.version??"1.0.0"},this.instructions=Z.server?.instructions,this.nonces=Z.nonces??new E3,this.approvalTimeoutMs=Z.approvalTimeoutMs??x3,Z.onCall!==void 0&&typeof Z.onCall!=="function")throw Error("route.mcp.remote.onCall must be a function.");if(this.onCall=Z.onCall,Z.feature!==void 0){if(typeof Z.feature!=="string"||Z.feature==="")throw Error("route.mcp.remote.feature must be a feature key from app/features.");this.feature=Z.feature}this.featureOn=z.featureOn??X2;for(let W of G)W.boot?.(this.context)}get resource(){return this.endpoint.href.replace(/\/$/,"")}async handle($){let Z=new URL($.url);if(Z.host!==this.endpoint.host)return null;if(this.feature!==void 0){if(!this.ownsPath(Z.pathname))return null;if(await this.featureOn(this.feature)!==!0)return null}for(let W of this.resolvers){let X=await W.handle?.($,this.context);if(X)return X}if(Z.pathname!==this.endpoint.pathname)return null;let z=$.headers.get("origin");if(z!==null&&!this.allowedOrigins.has(z))return f(R(null,new L(D.InvalidRequest,"Origin not allowed.")),403);let G=z?X6(z):{};if($.method==="OPTIONS")return new Response(null,{status:204,headers:{...G,"Access-Control-Allow-Methods":"POST","Access-Control-Allow-Headers":"Authorization, Content-Type, Accept, MCP-Protocol-Version, Mcp-Session-Id, Mcp-Method, Mcp-Name, Last-Event-ID","Access-Control-Max-Age":"600"}});if($.method!=="POST")return S3(new Response(null,{status:405,headers:{Allow:"POST, OPTIONS"}}),G);return S3(await this.post($),G)}ownsPath($){let Z=this.endpoint.pathname.replace(/\/$/,"");return $===this.endpoint.pathname||$===Z||$.startsWith(`${Z}/`)||$.startsWith("/.well-known/")}async post($){let Z=null;for(let Y of this.resolvers){let K=await Y.resolve($,this.context);if(K===null)continue;if(K.ok===!1)return await this.failedAttempt($)??this.unauthorized(K.description);Z={...K.principal,via:Y.name};break}if(!Z)return(j2($)!==null?await this.failedAttempt($):null)??this.unauthorized();let z=await this.spend(Z);if(z)return z;let G=$.headers.get("content-type")??"";if(!/^application\/json\s*(;|$)/i.test(G))return new Response("Content-Type must be application/json.",{status:415});let W;try{W=JSON.parse(await W6($,this.maxBodyBytes))}catch(Y){if(Y instanceof V2)return f(R(null,new L(D.InvalidRequest,`The request is larger than ${this.maxBodyBytes} bytes.`)),413);return f(R(null,new L(D.ParseError,"Parse error.")),400)}let X=new m($,{},"api",this.endpoint.pathname);return await g.run(X,async()=>{try{return await this.dispatch($,X,Z,W)}catch(Y){if(Y instanceof L){let K=q(W)&&(typeof W.id==="string"||typeof W.id==="number")?W.id:null;return f(R(K,Y),Y.status)}return console.error("[gemi/mcp] The MCP endpoint failed:",Y),f(R(null,new L(D.InternalError,"Internal error.")),500)}},{user:Z.user})}async dispatch($,Z,z,G){let W=_3(G),X={kind:"remote",req:Z,principal:z};if(W.kind==="response"){let N=this.session($,z),B=this.pending.get(String(W.message.id));if(B&&B.session===N.id)this.pending.delete(String(W.message.id)),B.resolve(W.message);return new Response(null,{status:202})}let{message:Y}=W,K=Y.params??{},Q=q(K._meta)?K._meta:{};if(typeof Q[S2]==="string"){if(this.checkModernHeaders($,Y,Q[S2]),W.kind==="notification")return new Response(null,{status:202});return await this.respond(Y,async(N,B)=>this.modern({principal:z,caller:X,message:Y,params:K,era:{modern:!0},stream:N,signal:B}),T3(K),$.signal)}if(Y.method==="initialize"){if(W.kind!=="request")throw new L(D.InvalidRequest,"initialize is a request.",void 0,400);return this.initialize(W.message,K,z)}let V=this.session($,z),H=$.headers.get("mcp-protocol-version");if(H!==null&&H!==V.state.v)throw new L(D.InvalidRequest,`MCP-Protocol-Version ${H} is not the session's ${V.state.v}.`,void 0,400);if(W.kind==="notification"){if(Y.method==="notifications/cancelled"){let N=K.requestId;this.inflight.get(`${V.id}:${String(N)}`)?.abort()}return new Response(null,{status:202})}let U=`${V.id}:${String(Y.id)}`,I=new AbortController;this.inflight.set(U,I);let J=AbortSignal.any([I.signal,$.signal]);try{return await this.respond(Y,async(N,B)=>this.legacy({principal:z,caller:X,message:Y,params:K,era:{modern:!1,session:V.state,sessionId:V.id},stream:N,signal:B}),T3(K)||Q6(this.registry,Y,V.state),J,()=>this.inflight.delete(U))}catch(N){throw this.inflight.delete(U),N}}async modern($){switch($.message.method){case"server/discover":return this.complete({supportedVersions:C2,capabilities:{tools:{}},...this.instructions?{instructions:this.instructions}:{},ttlMs:60000,cacheScope:"private"});case"tools/list":return this.complete({tools:(await this.registry.available($.caller)).map((Z)=>M2(Z,!0)),ttlMs:60000,cacheScope:"private"});case"tools/call":return await this.callTool($);default:throw new L(D.MethodNotFound,`Method not found: ${$.message.method}`,void 0,404)}}async legacy($){switch($.message.method){case"ping":return{};case"tools/list":return{tools:(await this.registry.available($.caller)).map((Z)=>M2(Z,!1))};case"tools/call":return await this.callTool($);default:throw new L(D.MethodNotFound,`Method not found: ${$.message.method}`)}}complete($){return{resultType:"complete",...$,_meta:{[T2]:this.serverInfo}}}initialize($,Z,z){let G=Z.protocolVersion,W=Y2.includes(G)?G:Y2[0],X=q(Z.capabilities)?Z.capabilities:{},Y={v:W,e:q3(X.elicitation),p:Q2(z),exp:Date.now()+Z6},K=k2(A3,"gms1",Y);return f({jsonrpc:"2.0",id:$.id,result:{protocolVersion:W,capabilities:{tools:{listChanged:!1}},serverInfo:this.serverInfo,...this.instructions?{instructions:this.instructions}:{}}},200,{"Mcp-Session-Id":K})}session($,Z){let z=$.headers.get("mcp-session-id");if(!z)throw new L(D.InvalidRequest,"Missing Mcp-Session-Id. Send initialize first, or a request carrying io.modelcontextprotocol/protocolVersion in _meta.",void 0,400);let G=R2(A3,"gms1",z);if(!G||G.p!==Q2(Z))throw new L(D.InvalidRequest,"Session not found.",void 0,404);return{id:z,state:G}}checkModernHeaders($,Z,z){if(!x2.includes(z))throw new L(D.UnsupportedProtocolVersion,"Unsupported protocol version",{supported:C2,requested:z},400);let G=(Y)=>new L(D.HeaderMismatch,`Header mismatch: ${Y}`,void 0,400);if($.headers.get("mcp-protocol-version")!==z)throw G("MCP-Protocol-Version does not match the protocol version in _meta.");if($.headers.get("mcp-method")!==Z.method)throw G("Mcp-Method does not match the method.");let W=Z.params??{},X=Z.method==="tools/call"||Z.method==="prompts/get"?W.name:Z.method==="resources/read"?W.uri:void 0;if(X!==void 0){let Y=$.headers.get("mcp-name");if(Y===null||D3(Y)!==X)throw G("Mcp-Name does not match the request's name.")}}async callTool($){let Z=$.params.name;if(typeof Z!=="string")throw new L(D.InvalidParams,"tools/call needs a tool name.");let z=$.params.arguments??{};if(!this.onCall)return await this.runTool($,Z,z,{approved:!1});let G=performance.now(),W={approved:!1};try{let X=await this.runTool($,Z,z,W);if(!W.pending)await this.report($,Z,z,W,G);return X}catch(X){if(!W.outcome){if(W.outcome="error",W.message=X instanceof L?X.message:"Internal error.",!(X instanceof L))W.error=X}throw await this.report($,Z,z,W,G),X}}async report($,Z,z,G,W){let{principal:X}=$;try{await this.onCall({user:X.user,via:X.via,credentialId:X.id,clientId:X.clientId??null,scopes:X.scopes,tool:Z,arguments:z,outcome:G.outcome??"ok",...G.reason!==void 0?{reason:G.reason}:{},...G.message!==void 0?{message:G.message}:{},...G.status!==void 0?{status:G.status}:{},...G.error!==void 0?{error:G.error}:{},approved:G.approved,durationMs:Math.round((performance.now()-W)*1000)/1000,req:$.caller.req})}catch(Y){console.error(`[gemi/mcp] route.mcp.remote.onCall failed for "${Z}":`,Y)}}async runTool($,Z,z,G){let{caller:W,principal:X}=$,Y=(J,N)=>{G.outcome="denied",G.reason=J,G.message=N},K=(J,N,B)=>{if(G.outcome="error",G.message=J,N!==void 0)G.status=N;if(B!==void 0)G.error=B},Q=(await this.registry.available(W,{names:[Z]}))[0];if(!Q)throw Y("unknown-tool",`Unknown tool: ${Z}`),new L(D.InvalidParams,`Unknown tool: ${Z}`);if(Q.requiresApproval){let J=Q.inputSchema.safeParse(z);if(J.ok===!1){let B=`Invalid arguments for "${Z}": ${J.errors.join(", ")}`;return K(B),this.toolResult($,{content:[{type:"text",text:B}],isError:!0})}if($.era.modern&&q($.params.inputResponses)&&$.params.requestState!==void 0||await this.registry.approvalRequired(W,Z,z,{signal:$.signal})){let B=await this.approval($,Q,z,Y,G);if(B.kind==="answer")return B.result;G.approved=!0}}let V=V6($),H;try{H=await this.registry.execute(W,Z,z,void 0,{approved:G.approved,signal:$.signal,...V?{progress:V}:{}})}catch(J){if(J instanceof O){if(J.status===401||J.status===403)Y("forbidden",J.message),G.status=J.status;else K(J.message,J.status);return this.toolResult($,{content:[{type:"text",text:J.message}],isError:!0})}if(J instanceof v){let B=J.reason==="unknown-tool"?`Unknown tool: ${Z}`:J.message;throw Y(J.reason,B),new L(D.InvalidParams,B)}console.error(`[gemi/mcp] "${Z}" failed for ${X.via}:${X.id}:`,J);let N=`"${Z}" failed on the server.`;return K(N,void 0,J),this.toolResult($,{content:[{type:"text",text:N}],isError:!0})}let U=typeof H==="string"?H:JSON.stringify(H??null),I=Q.outputSchema&&($.era.modern||q(H))?{structuredContent:H}:{};return G.outcome="ok",this.toolResult($,{content:[{type:"text",text:U}],...I,isError:!1})}toolResult($,Z){return $.era.modern?this.complete(Z):Z}async approval($,Z,z,G,W){let X=H6(Z,z),Y=(I,J="approval-declined")=>{return G(J,I),{kind:"answer",result:this.toolResult($,{content:[{type:"text",text:I}],isError:!0})}},K=(I,J)=>{return G(I,J.message),J};if($.era.modern){let I=q($.params._meta)?$.params._meta:{},J=q(I[q2])?I[q2]:{},N=q($.params.inputResponses)?$.params.inputResponses:null,B=$.params.requestState,T=K6(z);if(N&&B!==void 0){let C=R2(E2,"grs1",B);if(!C||C.p!==Q2($.principal)||C.t!==Z.name||C.a!==T)throw K("approval-invalid",new L(D.InvalidParams,"requestState is not valid for this call."));if(!await this.spendNonce(C.n,C.exp))throw K("approval-replayed",new L(D.InvalidParams,"requestState has already been used."));return M3(N[C3])?{kind:"approved"}:Y(`The user did not approve "${Z.name}", and it did not run.`)}if(!q3(J.elicitation))throw K("approval-unavailable",new L(D.MissingRequiredClientCapability,`"${Z.name}" needs the user's approval, and this client cannot ask for it (elicitation).`,{requiredCapabilities:{elicitation:{form:{}}}},400));let j={p:Q2($.principal),t:Z.name,a:T,n:j3(16).toString("base64url"),exp:Date.now()+x3};return W.pending=!0,{kind:"answer",result:{resultType:"input_required",inputRequests:{[C3]:{method:"elicitation/create",params:{mode:"form",...X}}},requestState:k2(E2,"grs1",j),_meta:{[T2]:this.serverInfo}}}}let Q=$.era;if(!Q.session.e||!$.stream)return Y(`"${Z.name}" needs the user's approval, and this client cannot ask for it (elicitation). It did not run.`,"approval-unavailable");let V=`gemi-approval-${j3(12).toString("base64url")}`,H=Q.sessionId,U=await new Promise((I)=>{let J=setTimeout(()=>{this.pending.delete(V),I(null)},this.approvalTimeoutMs),N=(B)=>{clearTimeout(J),I(B)};this.pending.set(V,{session:H,resolve:N}),$.signal.addEventListener("abort",()=>{this.pending.delete(V),N(null)}),$.stream.send({jsonrpc:"2.0",id:V,method:"elicitation/create",params:Q.session.v==="2025-11-25"?{mode:"form",...X}:X})});return U&&!U.error&&M3(U.result)?{kind:"approved"}:Y(`The user did not approve "${Z.name}", and it did not run.`)}async spendNonce($,Z){try{return await this.nonces.consume($,Z)}catch(z){return console.error("[gemi/mcp] Spending an approval failed:",z),!1}}async respond($,Z,z,G,W){if(!z)try{let Q=await Z(null,G);return f({jsonrpc:"2.0",id:$.id,result:Q},200)}finally{W?.()}let X=new AbortController,Y=AbortSignal.any([X.signal,G]),K=new f3(()=>X.abort());return(async()=>{try{let Q=await Z(K,Y);K.send({jsonrpc:"2.0",id:$.id,result:Q})}catch(Q){if(Q instanceof L)K.send(R($.id,Q));else console.error("[gemi/mcp] The MCP endpoint failed:",Q),K.send(R($.id,new L(D.InternalError,"Internal error.")))}finally{W?.(),K.close()}})(),new Response(K.readable,{status:200,headers:{"Content-Type":"text/event-stream","Cache-Control":"no-store","X-Accel-Buffering":"no"}})}unauthorized($){let Z=this.resolvers.map((G)=>G.challenge?.(this.context)).find(Boolean)??'Bearer realm="mcp"',z=$?`${Z}, error="invalid_token", error_description="${$.replace(/["\\]/g,"")}"`:Z;return f(R(null,new L(D.InvalidRequest,"Unauthorized.")),401,{"WWW-Authenticate":z})}async failedAttempt($){let Z=R3(new m($,{},"api",this.endpoint.pathname)),z=await A2(`mcp-auth-failed:${Z}`,G6);return z===null?null:k3(z)}async spend($){if(!this.rateLimit)return null;let Z=await A2(`mcp-endpoint:${$.via}:${$.id}`,this.rateLimit);return Z===null?null:k3(Z)}}class f3{readable;controller;closed=!1;encoder=new TextEncoder;constructor($){this.readable=new ReadableStream({start:(Z)=>{this.controller=Z},cancel:()=>{this.closed=!0,$()}})}send($){if(this.closed)return;this.controller.enqueue(this.encoder.encode(`event: message
+import{$b as b3,Bc as B3,Oc as P3,Wb as E3,_b as K2,dc as N3,ic as e,vc as F3,yd as I3}from"./chunk-2kkv8515.js";import{Fd as i2,Hd as B2,Kd as i3,Ld as l3,Md as N$,Od as j$}from"./chunk-pab6ye4d.js";import{Rd as h3,Wd as m3,Yd as u3,de as x,ee as d3,fe as c3,he as p3,ie as _$}from"./chunk-zwbpcch0.js";import{le as P}from"./chunk-vqq0z746.js";import{$e as X2,Be as R3,Cg as g2,Dg as f2,Fe as C$,Ff as Z2,Hg as w2,Ie as U$,Ig as $$,Jg as G2,Kg as Z$,Le as J$,Lf as H2,Lg as z$,Mf as u2,Mg as v2,Nf as M,Ng as a,Qf as V$,Qg as T$,Rf as Y$,Rg as L2,Sf as K$,Sg as p2,Uf as w,Ve as F$,We as l2,Xg as Q$,Yg as H$,_e as J2,ch as x$,fg as e2,qg as a2,rf as d2,sg as n,wg as r2,xe as l,xg as r3,ye as X$,yg as e3}from"./chunk-ff22412e.js";import{Ii as o2,Yi as J3,bj as A$,cj as P2,dj as N2,ej as z2,qi as p,si as m}from"./chunk-dqgn4wgf.js";import{lj as t3}from"./chunk-vpqzzrkn.js";import{wj as g}from"./chunk-b2n74m40.js";import{Cj as c2}from"./chunk-xhc16pv1.js";import{Fj as B$,Gj as n2,Jj as F2,Kj as s2,Nj as I$}from"./chunk-kz15j07h.js";import{$j as s3,ek as o3}from"./chunk-sg78cmd1.js";import{uk as g3,wk as u}from"./chunk-mddazdpt.js";import{xk as A}from"./chunk-bcfcwbp4.js";import{Dk as O$}from"./chunk-64hxqsqx.js";import{rl as t2}from"./chunk-xwcv0b4b.js";import{Bl as y,yl as U2}from"./chunk-jkf5kjaz.js";import{Kl as m2}from"./chunk-1yq2b55s.js";import{Wl as a3}from"./chunk-y167pt0p.js";var M$="mcp",k$=/^[\x21\x23-\x5B\x5D-\x7E]+$/;class O extends e{status;constructor($,Z){super($);this.status=Z;this.name="McpToolError"}}class v extends Error{reason;constructor($,Z){super($);this.reason=Z;this.name="McpCallRefusedError"}}var $3=/^[A-Za-z0-9_-]{1,64}$/,R$=/:([A-Za-z_][A-Za-z0-9_]*)([?*+]?)/g,Z3=4000,k=1e5,E$=/^(text\/|application\/([\w.+-]*\+)?(json|xml))/i,L3=new WeakMap;function H8($){return L3.get($)}class i{router;dispatcher;static token="router.mcp";plans=new Map;scopeTools=new Map;files;featureOn;constructor($,Z,z={}){this.router=$;this.dispatcher=Z;this.files=v$(z.files),this.featureOn=z.featureOn??X2;for(let[G,W]of Object.entries($.routes??{}))this.plans.set(G,b$(W)?this.planNative(G,W):this.plan(G,W));this.resolveScopes()}list($,Z){if(D2($),$.kind==="local")return this.descriptors(Z);let z=[];for(let[G,W]of this.plans){if(!W.remote||!this.grants($.principal,G))continue;if(Y3(W.remote,Z))z.push(W.remote)}return z}async available($,Z){let z=[];for(let G of this.list($,Z))if(await this.isOn(G))z.push(G);return z}descriptors($){let Z=[];for(let{descriptor:z}of this.plans.values())if(Y3(z,$))Z.push(z);return Z}get maxFileBytes(){return this.files.maxBytes}scopes(){return[...this.scopeTools].map(([$,{description:Z}])=>({name:$,description:Z}))}scopesFor($){return[...this.scopeTools].filter(([,{tools:Z}])=>Z.has($)).map(([Z])=>Z)}async execute($,Z,z,G,W={}){D2($);let X=this.plans.get(Z);if(X&&!await this.isOn(X.descriptor)){if($.kind==="remote")throw new v(`There is no tool named "${Z}".`,"unknown-tool");throw new O(`There is no tool named "${Z}".`,404)}if($.kind==="remote"){if(!X?.remote||!this.grants($.principal,Z))throw new v(`There is no tool named "${Z}".`,"unknown-tool");if(X.descriptor.requiresApproval&&W.approved!==!0&&!W2(X))throw new v(`"${Z}" needs the user's approval, and this call does not have it.`,"approval-required");G=void 0}if(!X)throw Error(`McpRegistry: there is no tool named "${Z}".`);if(X.kind==="tool")return await this.executeNative(X,$,z,G,W);let Y=X,K=$.kind==="remote"?Y.remote:Y.descriptor,Q=K.inputSchema.safeParse(z);if(Q.ok===!1)throw new O(`Invalid arguments for "${Z}": ${Q.errors.join(", ")}`);let V=Q.value,H={caller:$,req:$.req,tool:K,input:V,ctx:G},U=await this.fillPath(Y,H),{path:I}=this.dispatcher.getRouteHandlerAndParams(new Request(`http://gemi.internal/api${U}`));if(I!==K.url)throw new O(`"${Z}" has nothing at ${U}.`,404);let J={};for(let _ of Y.jsonKeys)if(V[_]!==void 0)J[_]=V[_];let N,B="";if(Y.fileFields.length>0)N=await this.formData(Y,J,H);else if(K.method==="GET")B=n$(J);else if(Y.jsonKeys.length>0)N=J;let T=this.router.credentials?await this.bind(Y,"the credentials",()=>this.router.credentials(H)):void 0,j={...T?{credentials:T}:{},...W.signal?{signal:W.signal}:{},...W.progress?{progress:W.progress}:{},...$.kind==="remote"?{identity:{user:$.principal.user,grant:{via:$.principal.via,id:$.principal.id,scopes:$.principal.scopes,...$.principal.clientId?{clientId:$.principal.clientId}:{}}}}:{}},C;try{let _=B?`${U}?${B}`:U;C=Object.keys(j).length>0?await this.dispatcher.dispatchAs($.req,K.method,_,N,j):await this.dispatcher.dispatchAs($.req,K.method,_,N)}catch(_){throw console.error(`[gemi/mcp] Dispatching "${Z}" failed:`,_),new O(`"${Z}" failed on the server.`,500)}if(!Y.result&&!K.outputSchema)return await U3(Z,C);return await this.project(Y,H,C)}async isOn($){return $.feature===void 0||await this.featureOn($.feature)===!0}plan($,Z){if(!$3.test($))throw Error(`McpRouter: "${$}" is not a valid tool name. A routes key is the tool's name as a model and an MCP client see it, used verbatim \u2014 letters, digits, "_" and "-", at most 64.`);let z=`McpRouter: "${$}" (${Z?.method} ${Z?.url})`;if(!(Z instanceof Object)||Z.__internal_brand!=="McpRoute")throw Error(`McpRouter: "${$}" is not a route or a tool. Declare it with this.fromApiRoute(...) or this.fromTool(...).`);let{method:G,url:W,meta:X}=Z;if(X.feature!==void 0&&(typeof X.feature!=="string"||X.feature===""))throw Error(`${z}: feature must be a feature key from app/features.`);if(W.startsWith("/__gemi__"))throw Error(`${z} is a framework route, not an app route.`);let Y=this.dispatcher.flatRoutes[W]?.[G];if(!Y)throw Error(`${z} names no route of this app. Expose a route by the path and verb it is mounted at.`);let K=[...W.matchAll(R$)].map(([,F,S])=>({name:F,modifier:S})),Q=X.params??{};for(let F of K)if(!(F.name in Q))throw Error(`${z}: the path param "${F.name}" must be bound or declared "input".`);for(let[F,S]of Object.entries(Q)){if(!K.some((h)=>h.name===F))throw Error(`${z}: "${F}" in params is not a param of the url.`);if(Q3(S))d$(z,`params.${F}`,S);else K3(z,`params.${F}`,S)}let V=[],H;if(X.input){if(H=X.input.toJSONSchema(),H.type!=="object"||!H.properties)throw Error(`${z}: input must be an s.object(...), the fields of the request body.`);V=Object.keys(H.properties)}let U=Object.entries(X.files??{}).map(([F,S])=>({name:F,binder:S}));for(let F of U)K3(z,`files.${F.name}`,F.binder);if(X.result!==void 0&&typeof X.result!=="function")throw Error(`${z}: result must be a function.`);if(X.output!==void 0&&typeof X.output?.safeParse!=="function")throw Error(`${z}: output must be a schema, built with s.`);if(X.title!==void 0&&(typeof X.title!=="string"||X.title===""))throw Error(`${z}: title must be a non-empty string.`);let I=V3(z,G,X.annotations);if(U.length>0&&G==="GET")throw Error(`${z}: a GET has no body to carry a file.`);let J={},N=(F,S)=>{if(F in J)throw Error(`${z}: "${F}" is the input key of two params or files, and the model can only send one.`);J[F]=S},B=new Map,T=new Map;for(let F of K){let S=Q[F.name];if(S==="input"){let h=p.string().describe(`The ":${F.name}" segment of the url.`);N(F.name,F.modifier==="?"||F.modifier==="*"?h.optional():h)}else if(Q3(S)){let h=S.as??F.name;N(h,S.input),T.set(F.name,{key:h,param:S})}else B.set(F.name,S)}let j={};for(let F of U)if(F.binder==="input")N(F.name,p.string().describe("The id of an attachment the user uploaded or a tool produced (gemi_att_\u2026), whose file is sent as this field.")),j[F.name]=this.remoteFileSchema();let C=[...Object.keys(J),...U.map((F)=>F.name)];for(let F of new Set(C))if(V.includes(F))throw Error(`${z}: "${F}" is both an input field and a param or file, and the model can only send one.`);let _=Object.freeze({kind:"route",name:$,description:X.description,method:G,url:W,inputSchema:H3(X.input,H,p.object(J)),...X.output?{outputSchema:X.output}:{},...X.title?{title:X.title}:{},annotations:I,tags:Object.freeze([...X.tags??[]]),requiresApproval:X.requiresApproval===!0,...X.feature!==void 0?{feature:X.feature}:{},...Y.source?{source:Y.source}:{}}),r=!U.every((F)=>F.binder==="input")?null:U.length===0?_:Object.freeze({..._,inputSchema:H3(X.input,H,p.object(i$(J,Object.keys(j))),j)});return{kind:"route",descriptor:_,remote:r,params:K,paramBinders:B,modelParams:T,fileFields:U,jsonKeys:V,...X.result?{result:X.result}:{}}}remoteFileSchema(){let{maxBytes:$,fetch:Z}=this.files,z={name:{type:"string",description:"The file's name, like report.pdf."},mimeType:{type:"string",description:"The file's media type, like application/pdf."},data:{type:"string",contentEncoding:"base64",description:`The file's bytes, base64-encoded (RFC 4648, standard alphabet). At most ${$} bytes decoded.`}};if(Z)z.url={type:"string",format:"uri",description:"An https URL the server downloads the file from, instead of data."};let G={type:"object",description:Z?"A file, sent as base64 in data or fetched from url: exactly one of the two.":"A file, sent as base64 in data.",properties:z,required:["name","mimeType"],additionalProperties:!1},W=Object.keys(z),X=(Y)=>{if(typeof Y!=="object"||Y===null||Array.isArray(Y))return{ok:!1,errors:["a file must be an object"]};let K=[],Q={};for(let V of Object.keys(Y))if(!W.includes(V))K.push(`a file has no field "${V}"`);for(let V of W){let H=Y[V];if(H===void 0||H===null){if(V==="name"||V==="mimeType")K.push(`a file needs "${V}"`);continue}if(typeof H!=="string")K.push(`a file's "${V}" must be a string`);else Q[V]=H}return K.length>0?{ok:!1,errors:K}:{ok:!0,value:Q}};return{toJSONSchema:()=>G,safeParse:X,parse(Y){let K=X(Y);if(K.ok===!1)throw Error(K.errors.join(", "));return K.value}}}planNative($,Z){if(!$3.test($))throw Error(`McpRouter: "${$}" is not a valid tool name. A routes key is the tool's name as a model and an MCP client see it, used verbatim \u2014 letters, digits, "_" and "-", at most 64.`);let z=`McpRouter: "${$}" (a native tool)`,{tool:G,meta:W={}}=Z;if(!(G instanceof Object)||typeof G.name!=="string")throw Error(`${z} is not an AgentTool. Pass one built with AgentTool.create(...).`);if(G.answeredBy==="client"||typeof G.execute!=="function")throw Error(`${z}: "${G.name}" is answered by the client, and only a tool the server runs can be called through the registry.`);if(typeof G.inputSchema==="function")throw Error(`${z}: "${G.name}" resolves its input schema per run, and the registry lists one schema to every caller. Give it a fixed inputSchema.`);if(typeof G.inputSchema?.safeParse!=="function")throw Error(`${z}: its inputSchema must be a schema, built with s.`);if(typeof W!=="object"||W===null)throw Error(`${z}: the meta must be an object.`);if(W.description!==void 0&&(typeof W.description!=="string"||W.description.trim()===""))throw Error(`${z}: description must be a non-empty string.`);if(W.title!==void 0&&(typeof W.title!=="string"||W.title===""))throw Error(`${z}: title must be a non-empty string.`);if(W.tags!==void 0&&(!Array.isArray(W.tags)||W.tags.some((Q)=>typeof Q!=="string")))throw Error(`${z}: tags must be an array of strings.`);if(W.requiresApproval===!1&&G.requiresApproval)throw Error(`${z}: "${G.name}" requires approval, and requiresApproval: false would run it without asking. Leave it out, or register a tool that does not ask.`);let X=W.remote;if(X!==void 0){if(typeof X!=="object"||X===null||typeof X.context!=="function")throw Error(`${z}: remote must be { context(call) }, building the AgentContext a remote call runs with.`);if(X.progress!==void 0&&typeof X.progress!=="function")throw Error(`${z}: remote.progress must be a function.`)}let Y=W.description??G.description;if(typeof Y!=="string"||Y.trim()==="")throw Error(`${z} needs a description: the tool's own, or the meta's.`);let K=Object.freeze({kind:"tool",name:$,description:Y,inputSchema:G.inputSchema,...G.outputSchema?{outputSchema:G.outputSchema}:{},...W.title?{title:W.title}:{},annotations:V3(z,void 0,W.annotations),tags:Object.freeze([...W.tags??[]]),requiresApproval:G.requiresApproval||W.requiresApproval===!0});return{kind:"tool",descriptor:K,remote:X?K:null,tool:G,meta:W}}async approvalRequired($,Z,z,G={}){let W=this.plans.get(Z);if(!W)return!0;if(!W2(W))return W.descriptor.requiresApproval;let X=W;if($.kind!=="remote"||!X.meta.remote)return!0;let Y=X.descriptor.inputSchema.safeParse(z);if(Y.ok===!1)return!0;let K={caller:$,req:$.req,tool:X.descriptor,input:Y.value},Q;try{Q=await this.bind(X,"the remote context",()=>X.meta.remote.context(K))}catch{return!0}if(typeof Q!=="object"||Q===null)return!0;let V=G.signal??new AbortController().signal;return X3(X,Y.value,W3(G3(X,Q,V)))}nativeApproval($){let Z=this.plans.get($);if(Z?.kind!=="tool")throw Error(`McpRegistry: there is no native tool named "${$}".`);return W2(Z)??Z.descriptor.requiresApproval}nativeTool($){let Z=this.plans.get($);if(Z?.kind!=="tool")throw Error(`McpRegistry: there is no native tool named "${$}".`);return Z.tool}startNative($,Z,z,G){let W=this.plans.get(Z);if(W?.kind!=="tool")throw Error(`McpRegistry: there is no native tool named "${Z}".`);if($===void 0)return W.tool.execute(z,G);if(D2($),$.kind!=="local")throw Error("McpRegistry: startNative is for a local caller. A remote call goes through execute().");let X=W.descriptor.inputSchema.safeParse(z);if(X.ok===!1)throw new O(`Invalid arguments for "${Z}": ${X.errors.join(", ")}`);return this.runNative(W,{caller:$,req:$.req,tool:W.descriptor,input:X.value},G)}runNative($,Z,z){let G={...z};return L3.set(G,{...Z,ctx:G}),$.tool.execute(Z.input,G)}async executeNative($,Z,z,G,W){let{name:X}=$.descriptor,Y=$.descriptor.inputSchema.safeParse(z);if(Y.ok===!1)throw new O(`Invalid arguments for "${X}": ${Y.errors.join(", ")}`);let K={caller:Z,req:Z.req,tool:$.descriptor,input:Y.value},Q=(_,_2)=>{if(!W.progress)return;let r;try{r=$.meta.remote?.progress?$.meta.remote.progress(_,_2):f$(_,_2)}catch(F){console.error(`[gemi/mcp] The progress mapping of "${X}" failed:`,F);return}if(r)W.progress(r)};if(Z.kind==="local"){if(!G)throw Error(`McpRegistry: "${X}" is a native tool, which runs with the tool context of an agent call, and none was passed to execute().`);return await z3(this.runNative($,{...K,ctx:G},G),Q)}let V=$.meta.remote,H=await this.bind($,"the remote context",()=>V.context(K));if(typeof H!=="object"||H===null)throw console.error(`[gemi/mcp] The remote context of "${X}" is not an object:`,H),new O(`"${X}" failed on the server.`,500);let U=$.tool.timeoutMs,I=[...W.signal?[W.signal]:[],...U!==void 0?[AbortSignal.timeout(U)]:[]],J=I.length===0?new AbortController().signal:I.length===1?I[0]:AbortSignal.any(I),N=G3($,H,J);if(!W.approved&&W2($)&&await X3($,K.input,W3(N)))throw new v(`"${X}" needs the user's approval, and this call does not have it.`,"approval-required");let B;try{B=await z3(this.runNative($,{...K,ctx:N},N),Q,J)}catch(_){if(J.aborted&&_===J.reason){if(W.signal?.aborted)throw new O(`"${X}" was cancelled.`,499);throw new O(`"${X}" did not finish within ${U} ms.`,504)}if(_ instanceof O)throw _;if(_ instanceof e||_ instanceof v)throw new O(_.message);throw console.error(`[gemi/mcp] "${X}" failed for a remote caller:`,_),new O(`"${X}" failed on the server.`,500)}let T=(_)=>{return console.error(`[gemi/mcp] "${X}" ${_}`),new O(`"${X}" failed on the server.`,500)};if(F3(B))throw T("answered a job handle, and a remote call has no background jobs.");let j=B;if($.descriptor.outputSchema){let _=$.descriptor.outputSchema.safeParse(j);if(_.ok===!1)throw T(`answered what its output schema refuses: ${_.errors.join(", ")}`);j=_.value}if(j===void 0)return null;if(typeof j==="string")return j.length>k?`${j.slice(0,k)}\u2026 [cut at ${k} of ${j.length} characters]`:j;let C=JSON.stringify(j);if(C!==void 0&&C.length>k)return`${C.slice(0,k)}\u2026 [cut at ${k} of ${C.length} characters]`;return j}async fillPath($,Z){let{input:z,req:G}=Z,W=$.descriptor.url;for(let X of $.params){let Y=$.paramBinders.get(X.name),K=$.modelParams.get(X.name),Q;if(Y||K){if(Q=K?await this.bind($,`the param "${X.name}"`,()=>K.param.bind(z[K.key],G,Z),{refusals:!0}):await this.bind($,`the param "${X.name}"`,()=>Y(G,Z)),Q===void 0||Q===null||Q==="")throw console.error(`[gemi/mcp] The ${K?"resolver":"binder"} for "${X.name}" of "${$.descriptor.name}" returned ${JSON.stringify(Q)}.`),new O(`"${$.descriptor.name}" failed on the server.`,500)}else Q=z[X.name];let V=`:${X.name}${X.modifier}`;if(Q===void 0||Q===null||Q===""){if(X.modifier!=="?"&&X.modifier!=="*")throw new O(`"${X.name}" of "${$.descriptor.name}" must not be empty.`);W=W.replace(`/${V}`,"");continue}W=W.replace(V,l$($.descriptor.name,X,String(Q)))}return W}async formData($,Z,z){let{input:G,ctx:W}=z,X=$.descriptor.name;if(z.caller.kind==="remote"){let K=new FormData;for(let[Q,V]of Object.entries(Z))O2(K,Q,V);for(let Q of $.fileFields)K.append(Q.name,await this.remoteFile(X,Q.name,G[Q.name]));return K}if(!W)throw Error(`McpRegistry: "${X}" sends a file, which is resolved through the tool context's attachments, and none was passed to execute().`);let Y=new FormData;for(let[K,Q]of Object.entries(Z))O2(Y,K,Q);for(let K of $.fileFields){let Q=K.binder==="input"?G[K.name]:await this.bind($,`the file "${K.name}"`,()=>K.binder(W,z));if(typeof Q!=="string"||Q==="")throw new O(`"${X}" needs a file for "${K.name}", and this turn has none. Ask the user to attach one.`);Y.append(K.name,await W.attachments.file(Q))}return Y}async remoteFile($,Z,z){let G=(H)=>new O(`"${Z}" of "${$}" ${H}`,400),W=z,{maxBytes:X,fetch:Y}=this.files;if(!g$(W.name))throw G("needs a name of 1 to 255 characters, without control characters or slashes.");if(!h$.test(W.mimeType))throw G(`has a mimeType that is not a media type: "${W.mimeType.slice(0,100)}".`);let K=typeof W.data==="string",Q=typeof W.url==="string";if(K===Q)throw G(Y?"needs exactly one of data or url.":"needs its bytes, base64, in data.");if(K){let H=W.data.replace(/\s+/g,"");if(Math.floor(H.length*3/4)-u$(H)>X)throw G(`is larger than the ${X} bytes a file may be.`);if(H.length%4!==0||!m$.test(H))throw G("has data that is not base64 (RFC 4648, standard alphabet, padded).");return new File([Buffer.from(H,"base64")],W.name,{type:W.mimeType})}if(!Y)throw G("cannot be fetched from a URL here. Send its bytes, base64, in data.");let V;try{V=new URL(W.url)}catch{throw G("has a url that is not a URL.")}if(V.protocol!=="https:")throw G("can only be fetched from an https URL.");try{let H=await J3(V.href,{...Y,maxSize:Math.min(Y.maxSize??X,X),redirect:"follow"});if(!H.ok)throw G(`could not be fetched: ${V.host} answered ${H.status}.`);let U=await H.arrayBuffer();return new File([U],W.name,{type:W.mimeType})}catch(H){if(H instanceof O)throw H;throw G(`could not be fetched from ${V.host}: ${H instanceof Error?H.message:"failed"}.`)}}grants($,Z){for(let z of $.scopes??[])if(this.scopeTools.get(z)?.tools.has(Z))return!0;return!1}resolveScopes(){let $=this.router.scopes;if($===void 0){this.scopeTools.set(M$,{description:"Use this app's tools as you",tools:new Set(this.plans.keys())});return}if(typeof $!=="object"||$===null)throw Error("McpRouter: scopes must be an object of scope names.");let Z=new Set([...this.plans.values()].flatMap(({descriptor:z})=>z.tags));for(let[z,G]of Object.entries($)){let W=`McpRouter: scope "${z}"`;if(!k$.test(z))throw Error(`${W} is not a valid OAuth scope: printable ASCII, no spaces or quotes.`);if(typeof G?.description!=="string"||G.description==="")throw Error(`${W} needs a description: it is what a consent screen shows.`);let X=new Set;for(let Y of G.tags??[]){if(!Z.has(Y))throw Error(`${W} names the tag "${Y}", which no tool has.`);for(let[K,{descriptor:Q}]of this.plans)if(Q.tags.includes(Y))X.add(K)}for(let Y of G.names??[]){if(!this.plans.has(Y))throw Error(`${W} names "${Y}", which is no tool.`);X.add(Y)}if(X.size===0)throw Error(`${W} reaches no tool. Give it tags or names.`);this.scopeTools.set(z,{description:G.description,tools:X})}}async project($,Z,z){let{name:G,outputSchema:W}=$.descriptor;if(z.status<200||z.status>=300)return await U3(G,z);let X=(U,I)=>{if(I===void 0)console.error(`[gemi/mcp] "${G}" ${U}`);else console.error(`[gemi/mcp] "${G}" ${U}`,I);return new O(`"${G}" failed on the server.`,500)},Y=z.headers.get("Content-Type"),K=await z.text(),Q=null;if(K!=="")try{Q=JSON.parse(K)}catch{throw X(`answered ${Y??"a body with no content-type"} that is not JSON, and its result or output needs JSON.`)}let V=Q;if($.result)try{V=await $.result(Q,Z)}catch(U){throw X("failed in its result projection:",U)}if(W){let U=W.safeParse(V);if(U.ok===!1)throw X(`answered what its output schema refuses: ${U.errors.join(", ")}`);V=U.value}if(V===void 0)return null;let H=JSON.stringify(V);if(H!==void 0&&H.length>k)return`${H.slice(0,k)}\u2026 [cut at ${k} of ${H.length} characters]`;return V}async bind($,Z,z,G={}){try{return await z()}catch(W){if(G.refusals&&W instanceof e)throw W;throw console.error(`[gemi/mcp] Binding ${Z} of "${$.descriptor.name}" failed:`,W),new O(`"${$.descriptor.name}" failed on the server.`,500)}}}function b$($){return $ instanceof Object&&$.__internal_brand==="McpTool"}function y$($){return typeof $==="object"&&$!==null&&typeof $.next==="function"&&Symbol.asyncIterator in $}async function z3($,Z,z){let G;if(z)G=new Promise((X,Y)=>{if(z.aborted)Y(z.reason);else z.addEventListener("abort",()=>Y(z.reason),{once:!0})}),G.catch(()=>{});let W=(X)=>G?Promise.race([X,G]):X;if(!y$($))return await W(Promise.resolve($));try{let X=0,Y=await W($.next());while(!Y.done)Z(Y.value,++X),Y=await W($.next());return Y.value}catch(X){throw $.return(void 0).catch(()=>{}),X}}function f$($,Z){if(typeof $==="string")return{progress:Z,message:$};if(typeof $==="object"&&$!==null){let{progress:z,total:G,message:W}=$;if(typeof z==="number"&&Number.isFinite(z))return{progress:z,...typeof G==="number"?{total:G}:{},...typeof W==="string"?{message:W}:{}};if(typeof W==="string")return{progress:Z,message:W}}return{progress:Z}}function G3($,Z,z){let G=$.descriptor.name,W=`mcp_${crypto.randomUUID()}`,X=`mcp_call_${crypto.randomUUID()}`,Y=(Q)=>async()=>{throw new e(`"${G}" was called by a remote MCP client, which has no ${Q}.`,{retryable:!1})},K={put:Y("attachment store"),get:Y("attachment store"),read:Y("attachment store"),file:Y("attachment store")};return{context:Z,body:{},runId:W,toolCallId:X,signal:z,step:1,depth:0,resumed:!1,attachments:K,turn:Object.freeze({attachments:Object.freeze([])}),runAgent:Y("agent run to nest a sub-agent in"),generateImage:Y("attachment store to put an image in"),editImage:Y("attachment store to put an image in"),generate:(Q)=>I3({...Q,signal:Q.signal?AbortSignal.any([z,Q.signal]):z},{origin:{mcp:G,runId:W,toolCallId:X}}),jobs:B3({jobs:void 0,threadId:void 0,runId:W,toolCallId:X,toolName:G,depth:0,async:$.tool.async,attachments:null}),memory:P3(),meter:N3().meter}}function W2($){if($.kind!=="tool"||$.meta.requiresApproval===!0)return;return $.tool.approvalPredicate}function W3($){return{context:$.context,body:$.body,runId:$.runId,threadId:$.threadId,toolCallId:$.toolCallId,step:$.step,depth:$.depth,signal:$.signal}}async function X3($,Z,z){try{return await $.tool.approvalPredicate(Z,z)!==!1}catch(G){return console.error(`[gemi/mcp] The requiresApproval of "${$.descriptor.name}" threw, so the call asks the user:`,G),!0}}function D2($){if($?.kind==="local"&&$.req)return;if($?.kind==="remote"&&$.req&&$.principal?.user&&typeof $.principal.id==="string"&&Array.isArray($.principal.scopes))return;throw Error('McpRegistry: a caller is { kind: "local", req } or { kind: "remote", req, principal }, with the principal a caller resolver verified.')}function Y3($,Z){if(Z?.names&&!Z.names.includes($.name))return!1;if(Z?.tags&&!$.tags.some((z)=>Z.tags.includes(z)))return!1;return!0}var w$=10485760;function v$($){let Z=$?.maxBytes??w$;if(!Number.isSafeInteger(Z)||Z<=0)throw Error("McpRegistry: files.maxBytes must be a positive whole number of bytes.");let z=$?.fetchUrls===!0?{}:typeof $?.fetchUrls==="object"&&$.fetchUrls!==null?$.fetchUrls:null;return{maxBytes:Z,fetch:z}}function g$($){if($.length===0||$.length>255)return!1;for(let Z of $){let z=Z.codePointAt(0);if(z<32||z===127||Z==="/"||Z==="\\")return!1}return!0}var h$=/^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]{0,126}(\s*;.{0,200})?$/,m$=/^[A-Za-z0-9+/]*={0,2}$/;function u$($){return $.endsWith("==")?2:$.endsWith("=")?1:0}function K3($,Z,z){if(z!=="input"&&typeof z!=="function")throw Error(`${$}: ${Z} must be a function or "input".`)}function Q3($){return $ instanceof Object&&$.__internal_brand==="McpModelParam"}function d$($,Z,z){if(z.as!==void 0&&(typeof z.as!=="string"||z.as===""))throw Error(`${$}: ${Z}.as must be a non-empty string.`);let G=z.input;if(typeof G?.safeParse!=="function"||typeof G.toJSONSchema!=="function")throw Error(`${$}: ${Z}.input must be a schema, built with s.`);if(typeof z.bind!=="function")throw Error(`${$}: ${Z}.bind must be a function.`)}var c$=new Set(["readOnlyHint","destructiveHint","idempotentHint","openWorldHint"]);function p$($){switch($){case"GET":return{readOnlyHint:!0};case"DELETE":return{destructiveHint:!0};case"PUT":return{idempotentHint:!0};default:return{}}}function V3($,Z,z){if(z!==void 0&&(typeof z!=="object"||z===null))throw Error(`${$}: annotations must be an object of hints.`);let G=Z?p$(Z):{};for(let[W,X]of Object.entries(z??{})){if(!c$.has(W))throw Error(`${$}: "${W}" is not a tool annotation. Use readOnlyHint, destructiveHint, idempotentHint or openWorldHint.`);if(X===void 0)continue;if(typeof X!=="boolean")throw Error(`${$}: annotations.${W} must be true or false.`);G[W]=X}if(G.readOnlyHint===!0&&(G.destructiveHint||G.idempotentHint))throw Error(`${$} is read-only${z?.readOnlyHint?"":` (a ${Z})`} and also ${G.destructiveHint?"destructive":"idempotent"}, which only a tool that is not read-only can be. Set readOnlyHint: false if it changes something.`);return Object.freeze(G)}function H3($,Z,z,G={}){let W=z.toJSONSchema(),X=Object.fromEntries(Object.entries(G).map(([Q,V])=>[Q,V.toJSONSchema()])),Y={...Z??{},type:"object",properties:{...Z?.properties??{},...W.properties,...X},required:[...Z?.required??[],...W.required??[],...Object.keys(G)],additionalProperties:!1},K=(Q)=>{if(typeof Q!=="object"||Q===null||Array.isArray(Q))return{ok:!1,errors:["expected an object"]};let V=[],H={};if($){let I=$.safeParse(Q);if(I.ok===!1)V.push(...I.errors);else H={...I.value}}let U=z.safeParse(Q);if(U.ok===!1)V.push(...U.errors);else H={...H,...U.value};for(let[I,J]of Object.entries(G)){let N=Q[I];if(N===void 0){V.push(`"${I}" is required`);continue}let B=J.safeParse(N);if(B.ok===!1)V.push(...B.errors.map((T)=>`${I}: ${T}`));else H[I]=B.value}return V.length>0?{ok:!1,errors:V}:{ok:!0,value:H}};return{toJSONSchema:()=>Y,safeParse:K,parse(Q){let V=K(Q);if(V.ok===!1)throw Error(V.errors.join(", "));return V.value}}}function i$($,Z){return Object.fromEntries(Object.entries($).filter(([z])=>!Z.includes(z)))}function l$($,Z,z){let G=Z.modifier==="*"||Z.modifier==="+"?z.split("/"):[z];if(G.some((W)=>W==="."||W===".."))throw new O(`"${z}" is not a valid value for "${Z.name}" of "${$}".`);return G.map(encodeURIComponent).join("/")}function O2($,Z,z){if(z===void 0||z===null)return;if(Array.isArray(z)){for(let G of z)O2($,Z,G);return}$.append(Z,typeof z==="object"?JSON.stringify(z):String(z))}function n$($){let Z=new URLSearchParams,z=(G,W)=>{if(W===void 0||W===null)return;if(Array.isArray(W)){for(let X of W)z(G,X);return}Z.append(G,typeof W==="object"?JSON.stringify(W):String(W))};for(let[G,W]of Object.entries($))z(G,W);return Z.toString()}async function U3($,Z){if(Z.status>=200&&Z.status<300){let G=Z.headers.get("Content-Type");if(G&&!E$.test(G)){let X=(await Z.arrayBuffer()).byteLength;return`"${$}" answered with ${X} bytes of ${G}, which is not shown.`}let W=await Z.text();if(W==="")return null;if(W.length>k)return`${W.slice(0,k)}\u2026 [cut at ${k} of ${W.length} characters]`;try{return JSON.parse(W)}catch{return W}}let z=await Z.text();if(Z.status>=400&&Z.status<500){let G=z.length>Z3?`${z.slice(0,Z3)}\u2026`:z;throw new O(`"${$}" was refused with ${Z.status}${G?`: ${G}`:"."}`,Z.status)}if(Z.status<500)console.error(`[gemi/mcp] "${$}" answered ${Z.status}${Z.headers.get("Location")?` to ${Z.headers.get("Location")}`:""}, which a tool call cannot follow.`);throw new O(`"${$}" failed on the server.`,Z.status)}import{createHash as t$,randomBytes as s$,timingSafeEqual as o$}from"crypto";function j2($){let Z=$.headers.get("authorization");if(!Z)return null;let z=/^Bearer[ ]+([\x21-\x7e]+)$/i.exec(Z.trim());return z?z[1]:null}class a${options;name="api-key";constructor($){this.options=$;if(typeof $?.prefix!=="string"||!/^[A-Za-z0-9_-]{3,32}$/.test($.prefix))throw Error('McpApiKeyResolver: prefix is required: 3 to 32 letters, digits, _ or -, like "myapp_mcp_".');if(typeof $.verify!=="function")throw Error("McpApiKeyResolver: verify must be a function that looks a key up.")}static generate($){return`${$}${s$(32).toString("base64url")}`}static hash($){return t$("sha256").update($).digest("hex")}static hashesMatch($,Z){let z=Buffer.from($),G=Buffer.from(Z);return z.length===G.length&&o$(z,G)}async resolve($){let Z=j2($);if(!Z?.startsWith(this.options.prefix))return null;let z=await this.options.verify(Z,$);if(!z)return{ok:!1,error:"invalid_token",description:"The API key is not valid."};if(!z.user||typeof z.id!=="string"||z.id===""||!Array.isArray(z.scopes))throw Error("McpApiKeyResolver: verify must answer { user, id, scopes } for a key it knows, or null.");return{ok:!0,principal:{user:z.user,via:this.name,id:z.id,scopes:[...z.scopes]}}}}import{createHash as y3,randomBytes as j3}from"crypto";async function A2($,Z){let z=r$();if(!z)return null;let G=await z.consume($,Z);return G.allowed?null:Math.max(1,Math.ceil(G.retryAfter/1000))}function r$(){try{let $=y();return $.bound(l)?$.make(l):null}catch{return null}}var x2=["2026-07-28"],Y2=["2025-11-25","2025-06-18","2025-03-26"],C2=[...x2,...Y2],S2="io.modelcontextprotocol/protocolVersion",q2="io.modelcontextprotocol/clientCapabilities";var T2="io.modelcontextprotocol/serverInfo",D={ParseError:-32700,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602,InternalError:-32603,HeaderMismatch:-32020,MissingRequiredClientCapability:-32021,UnsupportedProtocolVersion:-32022};class L extends Error{code;data;status;constructor($,Z,z,G=200){super(Z);this.code=$;this.data=z;this.status=G;this.name="JsonRpcError"}}function R($,Z){return{jsonrpc:"2.0",id:$,error:{code:Z.code,message:Z.message,...Z.data!==void 0?{data:Z.data}:{}}}}function _3($){if(Array.isArray($))throw new L(D.InvalidRequest,"Batched requests are not supported.",void 0,400);if(typeof $!=="object"||$===null||$.jsonrpc!=="2.0")throw new L(D.InvalidRequest,"Not a JSON-RPC 2.0 message.",void 0,400);let Z=$,z=Z.id,G=typeof z==="string"||typeof z==="number"&&Number.isFinite(z);if(typeof Z.method==="string"){if(Z.params!==void 0&&(typeof Z.params!=="object"||Z.params===null||Array.isArray(Z.params)))throw new L(D.InvalidRequest,"params must be an object.",void 0,400);if(z===void 0)return{kind:"notification",message:Z};if(!G)throw new L(D.InvalidRequest,"id must be a string or a number.",void 0,400);return{kind:"request",message:Z}}if(G&&(("result"in Z)||("error"in Z)))return{kind:"response",message:Z};throw new L(D.InvalidRequest,"Not a JSON-RPC request, notification or response.",void 0,400)}function M2($,Z){let z=$.outputSchema?.toJSONSchema(),G={...$.annotations,...$.title&&!Z?{title:$.title}:{}};return{name:$.name,...$.title?{title:$.title}:{},description:$.description,inputSchema:$.inputSchema.toJSONSchema(),...z&&(Z||z.type==="object")?{outputSchema:z}:{},...Object.keys(G).length>0?{annotations:G}:{}}}function q($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function D3($){let Z=/^=\?base64\?([A-Za-z0-9+/]*={0,2})\?=$/.exec($);if(!Z)return $;try{let z=Buffer.from(Z[1],"base64");return new TextDecoder("utf-8",{fatal:!0}).decode(z)}catch{return null}}import{createHmac as e$,timingSafeEqual as $6}from"crypto";function k2($,Z,z){let G=Buffer.from(JSON.stringify(z)).toString("base64url");return`${Z}.${G}.${O3($,Z,G).toString("base64url")}`}function R2($,Z,z,G=Date.now()){if(typeof z!=="string"||z.length>8192)return null;let W=z.split(".");if(W.length!==3||W[0]!==Z)return null;let[,X,Y]=W,K=Buffer.from(Y,"base64url"),Q=O3($,Z,X);if(K.length!==Q.length||!$6(K,Q))return null;let V;try{V=JSON.parse(Buffer.from(X,"base64url").toString("utf8"))}catch{return null}if(typeof V!=="object"||V===null)return null;if(typeof V.exp!=="number"||V.exp<=G)return null;return V}function O3($,Z,z){return e$("sha256",K2($)).update(`${Z}.${z}`).digest()}var E2="gemi.mcp.request-state.v1",A3="gemi.mcp.session.v1",Z6=86400000,x3=600000,C3="gemi_approval",b2=2000,z6={limit:600,window:60},G6={limit:30,window:60};class $2{registry;static token="router.mcp.http";endpoint;resolvers;context;allowedOrigins;rateLimit;maxBodyBytes;serverInfo;instructions;nonces;approvalTimeoutMs;onCall;feature;featureOn;pending=new Map;inflight=new Map;constructor($,Z,z={}){this.registry=$;if(typeof Z.url!=="string")throw Error(`route.mcp.remote.url is required: the endpoint's canonical URL, like "https://example.com/mcp".`);this.endpoint=Y6(Z.url);let G=Z.resolvers??[];if(!Array.isArray(G)||G.length===0)throw Error("route.mcp.remote is enabled without a caller resolver. Configure route.mcp.remote.resolvers \u2014 an McpOAuthServer, an McpApiKeyResolver, or your own \u2014 or leave the endpoint off. Without one every request would be refused, or answered as nobody.");for(let W of G)if(typeof W?.resolve!=="function"||typeof W.name!=="string"||W.name==="")throw Error("route.mcp.remote.resolvers: each resolver needs a name and a resolve().");if(this.resolvers=G,K2(E2),this.context={resource:this.resource,registry:$},this.allowedOrigins=new Set((Z.allowedOrigins??[]).map((W)=>{if(new URL(W).origin!==W)throw Error(`route.mcp.remote.allowedOrigins: "${W}" is not an origin (scheme://host[:port]).`);return W})),this.allowedOrigins.add(this.endpoint.origin),this.rateLimit=Z.rateLimit===!1?!1:Z.rateLimit??z6,this.maxBodyBytes=Z.maxBodyBytes??Math.ceil($.maxFileBytes*1.4)+1048576,this.serverInfo={name:Z.server?.name??"gemi",version:Z.server?.version??"1.0.0"},this.instructions=Z.server?.instructions,this.nonces=Z.nonces??new E3,this.approvalTimeoutMs=Z.approvalTimeoutMs??x3,Z.onCall!==void 0&&typeof Z.onCall!=="function")throw Error("route.mcp.remote.onCall must be a function.");if(this.onCall=Z.onCall,Z.feature!==void 0){if(typeof Z.feature!=="string"||Z.feature==="")throw Error("route.mcp.remote.feature must be a feature key from app/features.");this.feature=Z.feature}this.featureOn=z.featureOn??X2;for(let W of G)W.boot?.(this.context)}get resource(){return this.endpoint.href.replace(/\/$/,"")}async handle($){let Z=new URL($.url);if(Z.host!==this.endpoint.host)return null;if(this.feature!==void 0){if(!this.ownsPath(Z.pathname))return null;if(await this.featureOn(this.feature)!==!0)return null}for(let W of this.resolvers){let X=await W.handle?.($,this.context);if(X)return X}if(Z.pathname!==this.endpoint.pathname)return null;let z=$.headers.get("origin");if(z!==null&&!this.allowedOrigins.has(z))return f(R(null,new L(D.InvalidRequest,"Origin not allowed.")),403);let G=z?X6(z):{};if($.method==="OPTIONS")return new Response(null,{status:204,headers:{...G,"Access-Control-Allow-Methods":"POST","Access-Control-Allow-Headers":"Authorization, Content-Type, Accept, MCP-Protocol-Version, Mcp-Session-Id, Mcp-Method, Mcp-Name, Last-Event-ID","Access-Control-Max-Age":"600"}});if($.method!=="POST")return S3(new Response(null,{status:405,headers:{Allow:"POST, OPTIONS"}}),G);return S3(await this.post($),G)}ownsPath($){let Z=this.endpoint.pathname.replace(/\/$/,"");return $===this.endpoint.pathname||$===Z||$.startsWith(`${Z}/`)||$.startsWith("/.well-known/")}async post($){let Z=null;for(let Y of this.resolvers){let K=await Y.resolve($,this.context);if(K===null)continue;if(K.ok===!1)return await this.failedAttempt($)??this.unauthorized(K.description);Z={...K.principal,via:Y.name};break}if(!Z)return(j2($)!==null?await this.failedAttempt($):null)??this.unauthorized();let z=await this.spend(Z);if(z)return z;let G=$.headers.get("content-type")??"";if(!/^application\/json\s*(;|$)/i.test(G))return new Response("Content-Type must be application/json.",{status:415});let W;try{W=JSON.parse(await W6($,this.maxBodyBytes))}catch(Y){if(Y instanceof V2)return f(R(null,new L(D.InvalidRequest,`The request is larger than ${this.maxBodyBytes} bytes.`)),413);return f(R(null,new L(D.ParseError,"Parse error.")),400)}let X=new m($,{},"api",this.endpoint.pathname);return await g.run(X,async()=>{try{return await this.dispatch($,X,Z,W)}catch(Y){if(Y instanceof L){let K=q(W)&&(typeof W.id==="string"||typeof W.id==="number")?W.id:null;return f(R(K,Y),Y.status)}return console.error("[gemi/mcp] The MCP endpoint failed:",Y),f(R(null,new L(D.InternalError,"Internal error.")),500)}},{user:Z.user})}async dispatch($,Z,z,G){let W=_3(G),X={kind:"remote",req:Z,principal:z};if(W.kind==="response"){let N=this.session($,z),B=this.pending.get(String(W.message.id));if(B&&B.session===N.id)this.pending.delete(String(W.message.id)),B.resolve(W.message);return new Response(null,{status:202})}let{message:Y}=W,K=Y.params??{},Q=q(K._meta)?K._meta:{};if(typeof Q[S2]==="string"){if(this.checkModernHeaders($,Y,Q[S2]),W.kind==="notification")return new Response(null,{status:202});return await this.respond(Y,async(N,B)=>this.modern({principal:z,caller:X,message:Y,params:K,era:{modern:!0},stream:N,signal:B}),T3(K),$.signal)}if(Y.method==="initialize"){if(W.kind!=="request")throw new L(D.InvalidRequest,"initialize is a request.",void 0,400);return this.initialize(W.message,K,z)}let V=this.session($,z),H=$.headers.get("mcp-protocol-version");if(H!==null&&H!==V.state.v)throw new L(D.InvalidRequest,`MCP-Protocol-Version ${H} is not the session's ${V.state.v}.`,void 0,400);if(W.kind==="notification"){if(Y.method==="notifications/cancelled"){let N=K.requestId;this.inflight.get(`${V.id}:${String(N)}`)?.abort()}return new Response(null,{status:202})}let U=`${V.id}:${String(Y.id)}`,I=new AbortController;this.inflight.set(U,I);let J=AbortSignal.any([I.signal,$.signal]);try{return await this.respond(Y,async(N,B)=>this.legacy({principal:z,caller:X,message:Y,params:K,era:{modern:!1,session:V.state,sessionId:V.id},stream:N,signal:B}),T3(K)||Q6(this.registry,Y,V.state),J,()=>this.inflight.delete(U))}catch(N){throw this.inflight.delete(U),N}}async modern($){switch($.message.method){case"server/discover":return this.complete({supportedVersions:C2,capabilities:{tools:{}},...this.instructions?{instructions:this.instructions}:{},ttlMs:60000,cacheScope:"private"});case"tools/list":return this.complete({tools:(await this.registry.available($.caller)).map((Z)=>M2(Z,!0)),ttlMs:60000,cacheScope:"private"});case"tools/call":return await this.callTool($);default:throw new L(D.MethodNotFound,`Method not found: ${$.message.method}`,void 0,404)}}async legacy($){switch($.message.method){case"ping":return{};case"tools/list":return{tools:(await this.registry.available($.caller)).map((Z)=>M2(Z,!1))};case"tools/call":return await this.callTool($);default:throw new L(D.MethodNotFound,`Method not found: ${$.message.method}`)}}complete($){return{resultType:"complete",...$,_meta:{[T2]:this.serverInfo}}}initialize($,Z,z){let G=Z.protocolVersion,W=Y2.includes(G)?G:Y2[0],X=q(Z.capabilities)?Z.capabilities:{},Y={v:W,e:q3(X.elicitation),p:Q2(z),exp:Date.now()+Z6},K=k2(A3,"gms1",Y);return f({jsonrpc:"2.0",id:$.id,result:{protocolVersion:W,capabilities:{tools:{listChanged:!1}},serverInfo:this.serverInfo,...this.instructions?{instructions:this.instructions}:{}}},200,{"Mcp-Session-Id":K})}session($,Z){let z=$.headers.get("mcp-session-id");if(!z)throw new L(D.InvalidRequest,"Missing Mcp-Session-Id. Send initialize first, or a request carrying io.modelcontextprotocol/protocolVersion in _meta.",void 0,400);let G=R2(A3,"gms1",z);if(!G||G.p!==Q2(Z))throw new L(D.InvalidRequest,"Session not found.",void 0,404);return{id:z,state:G}}checkModernHeaders($,Z,z){if(!x2.includes(z))throw new L(D.UnsupportedProtocolVersion,"Unsupported protocol version",{supported:C2,requested:z},400);let G=(Y)=>new L(D.HeaderMismatch,`Header mismatch: ${Y}`,void 0,400);if($.headers.get("mcp-protocol-version")!==z)throw G("MCP-Protocol-Version does not match the protocol version in _meta.");if($.headers.get("mcp-method")!==Z.method)throw G("Mcp-Method does not match the method.");let W=Z.params??{},X=Z.method==="tools/call"||Z.method==="prompts/get"?W.name:Z.method==="resources/read"?W.uri:void 0;if(X!==void 0){let Y=$.headers.get("mcp-name");if(Y===null||D3(Y)!==X)throw G("Mcp-Name does not match the request's name.")}}async callTool($){let Z=$.params.name;if(typeof Z!=="string")throw new L(D.InvalidParams,"tools/call needs a tool name.");let z=$.params.arguments??{};if(!this.onCall)return await this.runTool($,Z,z,{approved:!1});let G=performance.now(),W={approved:!1};try{let X=await this.runTool($,Z,z,W);if(!W.pending)await this.report($,Z,z,W,G);return X}catch(X){if(!W.outcome){if(W.outcome="error",W.message=X instanceof L?X.message:"Internal error.",!(X instanceof L))W.error=X}throw await this.report($,Z,z,W,G),X}}async report($,Z,z,G,W){let{principal:X}=$;try{await this.onCall({user:X.user,via:X.via,credentialId:X.id,clientId:X.clientId??null,scopes:X.scopes,tool:Z,arguments:z,outcome:G.outcome??"ok",...G.reason!==void 0?{reason:G.reason}:{},...G.message!==void 0?{message:G.message}:{},...G.status!==void 0?{status:G.status}:{},...G.error!==void 0?{error:G.error}:{},approved:G.approved,durationMs:Math.round((performance.now()-W)*1000)/1000,req:$.caller.req})}catch(Y){console.error(`[gemi/mcp] route.mcp.remote.onCall failed for "${Z}":`,Y)}}async runTool($,Z,z,G){let{caller:W,principal:X}=$,Y=(J,N)=>{G.outcome="denied",G.reason=J,G.message=N},K=(J,N,B)=>{if(G.outcome="error",G.message=J,N!==void 0)G.status=N;if(B!==void 0)G.error=B},Q=(await this.registry.available(W,{names:[Z]}))[0];if(!Q)throw Y("unknown-tool",`Unknown tool: ${Z}`),new L(D.InvalidParams,`Unknown tool: ${Z}`);if(Q.requiresApproval){let J=Q.inputSchema.safeParse(z);if(J.ok===!1){let B=`Invalid arguments for "${Z}": ${J.errors.join(", ")}`;return K(B),this.toolResult($,{content:[{type:"text",text:B}],isError:!0})}if($.era.modern&&q($.params.inputResponses)&&$.params.requestState!==void 0||await this.registry.approvalRequired(W,Z,z,{signal:$.signal})){let B=await this.approval($,Q,z,Y,G);if(B.kind==="answer")return B.result;G.approved=!0}}let V=V6($),H;try{H=await this.registry.execute(W,Z,z,void 0,{approved:G.approved,signal:$.signal,...V?{progress:V}:{}})}catch(J){if(J instanceof O){if(J.status===401||J.status===403)Y("forbidden",J.message),G.status=J.status;else K(J.message,J.status);return this.toolResult($,{content:[{type:"text",text:J.message}],isError:!0})}if(J instanceof v){let B=J.reason==="unknown-tool"?`Unknown tool: ${Z}`:J.message;throw Y(J.reason,B),new L(D.InvalidParams,B)}console.error(`[gemi/mcp] "${Z}" failed for ${X.via}:${X.id}:`,J);let N=`"${Z}" failed on the server.`;return K(N,void 0,J),this.toolResult($,{content:[{type:"text",text:N}],isError:!0})}let U=typeof H==="string"?H:JSON.stringify(H??null),I=Q.outputSchema&&($.era.modern||q(H))?{structuredContent:H}:{};return G.outcome="ok",this.toolResult($,{content:[{type:"text",text:U}],...I,isError:!1})}toolResult($,Z){return $.era.modern?this.complete(Z):Z}async approval($,Z,z,G,W){let X=H6(Z,z),Y=(I,J="approval-declined")=>{return G(J,I),{kind:"answer",result:this.toolResult($,{content:[{type:"text",text:I}],isError:!0})}},K=(I,J)=>{return G(I,J.message),J};if($.era.modern){let I=q($.params._meta)?$.params._meta:{},J=q(I[q2])?I[q2]:{},N=q($.params.inputResponses)?$.params.inputResponses:null,B=$.params.requestState,T=K6(z);if(N&&B!==void 0){let C=R2(E2,"grs1",B);if(!C||C.p!==Q2($.principal)||C.t!==Z.name||C.a!==T)throw K("approval-invalid",new L(D.InvalidParams,"requestState is not valid for this call."));if(!await this.spendNonce(C.n,C.exp))throw K("approval-replayed",new L(D.InvalidParams,"requestState has already been used."));return M3(N[C3])?{kind:"approved"}:Y(`The user did not approve "${Z.name}", and it did not run.`)}if(!q3(J.elicitation))throw K("approval-unavailable",new L(D.MissingRequiredClientCapability,`"${Z.name}" needs the user's approval, and this client cannot ask for it (elicitation).`,{requiredCapabilities:{elicitation:{form:{}}}},400));let j={p:Q2($.principal),t:Z.name,a:T,n:j3(16).toString("base64url"),exp:Date.now()+x3};return W.pending=!0,{kind:"answer",result:{resultType:"input_required",inputRequests:{[C3]:{method:"elicitation/create",params:{mode:"form",...X}}},requestState:k2(E2,"grs1",j),_meta:{[T2]:this.serverInfo}}}}let Q=$.era;if(!Q.session.e||!$.stream)return Y(`"${Z.name}" needs the user's approval, and this client cannot ask for it (elicitation). It did not run.`,"approval-unavailable");let V=`gemi-approval-${j3(12).toString("base64url")}`,H=Q.sessionId,U=await new Promise((I)=>{let J=setTimeout(()=>{this.pending.delete(V),I(null)},this.approvalTimeoutMs),N=(B)=>{clearTimeout(J),I(B)};this.pending.set(V,{session:H,resolve:N}),$.signal.addEventListener("abort",()=>{this.pending.delete(V),N(null)}),$.stream.send({jsonrpc:"2.0",id:V,method:"elicitation/create",params:Q.session.v==="2025-11-25"?{mode:"form",...X}:X})});return U&&!U.error&&M3(U.result)?{kind:"approved"}:Y(`The user did not approve "${Z.name}", and it did not run.`)}async spendNonce($,Z){try{return await this.nonces.consume($,Z)}catch(z){return console.error("[gemi/mcp] Spending an approval failed:",z),!1}}async respond($,Z,z,G,W){if(!z)try{let Q=await Z(null,G);return f({jsonrpc:"2.0",id:$.id,result:Q},200)}finally{W?.()}let X=new AbortController,Y=AbortSignal.any([X.signal,G]),K=new f3(()=>X.abort());return(async()=>{try{let Q=await Z(K,Y);K.send({jsonrpc:"2.0",id:$.id,result:Q})}catch(Q){if(Q instanceof L)K.send(R($.id,Q));else console.error("[gemi/mcp] The MCP endpoint failed:",Q),K.send(R($.id,new L(D.InternalError,"Internal error.")))}finally{W?.(),K.close()}})(),new Response(K.readable,{status:200,headers:{"Content-Type":"text/event-stream","Cache-Control":"no-store","X-Accel-Buffering":"no"}})}unauthorized($){let Z=this.resolvers.map((G)=>G.challenge?.(this.context)).find(Boolean)??'Bearer realm="mcp"',z=$?`${Z}, error="invalid_token", error_description="${$.replace(/["\\]/g,"")}"`:Z;return f(R(null,new L(D.InvalidRequest,"Unauthorized.")),401,{"WWW-Authenticate":z})}async failedAttempt($){let Z=R3(new m($,{},"api",this.endpoint.pathname)),z=await A2(`mcp-auth-failed:${Z}`,G6);return z===null?null:k3(z)}async spend($){if(!this.rateLimit)return null;let Z=await A2(`mcp-endpoint:${$.via}:${$.id}`,this.rateLimit);return Z===null?null:k3(Z)}}class f3{readable;controller;closed=!1;encoder=new TextEncoder;constructor($){this.readable=new ReadableStream({start:(Z)=>{this.controller=Z},cancel:()=>{this.closed=!0,$()}})}send($){if(this.closed)return;this.controller.enqueue(this.encoder.encode(`event: message
 data: ${JSON.stringify($)}
 
 `))}close(){if(this.closed)return;this.closed=!0,this.controller.close()}}class V2 extends Error{}async function W6($,Z){let z=Number($.headers.get("content-length"));if(Number.isFinite(z)&&z>Z)throw new V2;if(!$.body)return"";let G=$.body.getReader(),W=[],X=0;for(;;){let{done:Y,value:K}=await G.read();if(Y)break;if(X+=K.byteLength,X>Z)throw await G.cancel(),new V2;W.push(K)}return Buffer.concat(W).toString("utf8")}function f($,Z,z={}){return new Response(JSON.stringify($),{status:Z,headers:{"Content-Type":"application/json","Cache-Control":"no-store",...z}})}function S3($,Z){for(let[z,G]of Object.entries(Z))$.headers.set(z,G);return $}function X6($){return{"Access-Control-Allow-Origin":$,"Access-Control-Expose-Headers":"Mcp-Session-Id, WWW-Authenticate",Vary:"Origin"}}function Y6($){let Z;try{Z=new URL($)}catch{throw Error(`route.mcp.remote.url: "${$}" is not a URL.`)}let z=Z.hostname==="localhost"||Z.hostname==="127.0.0.1"||Z.hostname==="[::1]";if(Z.protocol!=="https:"&&!(Z.protocol==="http:"&&z))throw Error("route.mcp.remote.url must be https (http only on localhost): tokens travel to it.");if(Z.search||Z.hash||Z.username||Z.password)throw Error("route.mcp.remote.url must have no query, fragment or credentials.");if(Z.pathname==="/"||Z.pathname.endsWith("/"))throw Error('route.mcp.remote.url needs a path of its own, like "/mcp", without a trailing slash.');return Z}function Q2($){return y3("sha256").update(`${$.via}\x00${$.id}\x00${$.user?.id}`).digest("base64url").slice(0,32)}function K6($){return y3("sha256").update(b3($??{})).digest("base64url")}function q3($){if(!q($))return!1;if(Object.keys($).length===0)return!0;return"form"in $}function T3($){let Z=q($._meta)?$._meta:{};return typeof Z.progressToken==="string"||typeof Z.progressToken==="number"}function Q6($,Z,z){if(Z.method!=="tools/call"||!z.e)return!1;let G=Z.params?.name;return typeof G==="string"&&$.descriptors({names:[G]})[0]?.requiresApproval===!0}function V6($){let z=(q($.params._meta)?$.params._meta:{}).progressToken;if(!$.stream||typeof z!=="string"&&typeof z!=="number")return;let G=-1/0;return(W)=>{if(typeof W?.progress!=="number"||!Number.isFinite(W.progress)||W.progress<=G)return;G=W.progress,$.stream.send({jsonrpc:"2.0",method:"notifications/progress",params:{progressToken:z,progress:W.progress,...typeof W.total==="number"?{total:W.total}:{},...typeof W.message==="string"?{message:W.message.slice(0,1000)}:{}}})}}function H6($,Z){let z=JSON.stringify(Z??{},null,1),G=z.length>b2?`${z.slice(0,b2)}\u2026 (${z.length-b2} more characters not shown)`:z;return{message:`Allow "${$.title??$.name}" to run? ${$.description}
@@ -7,4 +7,4 @@ data: ${JSON.stringify($)}
 Arguments: ${G}`,requestedSchema:{type:"object",properties:{approve:{type:"boolean",title:"Approve",description:`Run "${$.title??$.name}" with these arguments.`}},required:["approve"]}}}function M3($){return q($)&&$.action==="accept"&&q($.content)&&$.content.approve===!0}function k3($){return f(R(null,new L(D.InvalidRequest,"Rate limit exceeded.")),429,{"Retry-After":String($)})}async function U6($,Z={}){try{if(!await $.shouldRun.call($))return}catch(W){console.error(`Error evaluating shouldRun for cron job ${$.name}:`,W);return}let z=J6($.withoutOverlapping);if(!$.onOneServer&&z===void 0){await y2($);return}let G;try{if(G=Z.locks?.()??N6(),$.onOneServer){let W=Math.floor((Z.now??Date.now())/60000);if(!await G.store.advance(`gemi:cron-tick:${$.name}`,W))return}}catch(W){console.error(`Could not claim the tick of cron job ${$.name}; skipped it:`,W);return}if(z===void 0){await y2($);return}try{await G.run(`gemi:cron:${$.name}`,{ttl:z},(W)=>y2($,W))}catch(W){if(W instanceof g3)console.error(`Cron job ${$.name} lost its withoutOverlapping lock while running: another tick may have started alongside it.`,W);else console.error(`Could not take the withoutOverlapping lock of cron job ${$.name}:`,W)}}var w3=300000;function J6($){if(!$)return;if($===!0)return w3;return $.expiresAfter??w3}var v3;function N6(){return v3??=new u(new h3),v3}async function y2($,Z){try{await $.onTick.call($)}catch(z){console.error(`Error executing cron job ${$.name}:`,z)}try{await $.callback.call($,Z)}catch(z){console.error(`Error in cron job ${$.name}:`,z)}try{await $.onComplete.call($)}catch(z){console.error(`Error completing cron job ${$.name}:`,z)}}class d{static token="scheduler";handles=[];resolved;inFlight=new Map;stopped=!1;locks;constructor($){this.resolved=$.jobs}get jobs(){return[...this.resolved]}useJobs($){this.resolved=$}useLocks($){this.locks=$}start($=(Z)=>Z()){if(this.stopped=!1,this.resolved.length===0)return;let Z=globalThis.__gemiCronJobs??=new Map,z=new Map;for(let G of this.resolved){let W=new G;if(!W.name){console.error(`Cron job must have a name \u2014 ${G.name||"an anonymous class"} has none, so it is not scheduled. If this is a base class that other jobs extend, move it out of the discovered directory: \`abstract\` does not survive to runtime, so a class under app/cron is indistinguishable from a job.`);continue}if(!W.cron){console.error(`Cron job must have an expression. Job: ${W.name}`);continue}let X=z.get(W.name);if(X!==void 0){console.error(`Two cron jobs claim the name "${W.name}" \u2014 ${X} is scheduled and ${G.name||"an anonymous class"} is not. A name is the scheduler's key, so only one job can hold it. Rename one.`);continue}z.set(W.name,G.name||"an anonymous class"),Z.get(W.name)?.stop();let Y=Bun.cron(W.cron,()=>{if(this.stopped)return;let K=this.locks;return this.track(W.name,()=>$(()=>U6(W,{locks:K})))});Z.set(W.name,Y),this.handles.push(Y)}}stop(){this.stopped=!0;for(let $ of this.handles)$.stop();this.handles=[]}async drain($=1/0){this.stop();let Z,z=new Promise((G)=>{if($!==1/0)Z=setTimeout(G,$)});return await Promise.race([Promise.allSettled([...this.inFlight.values()].map((G)=>G.done)),z]),clearTimeout(Z),{unfinished:[...this.inFlight.values()].map((G)=>({...G.tick}))}}get running(){return this.inFlight.size}track($,Z){let z={},G=Promise.resolve().then(Z).finally(()=>this.inFlight.delete(z));return this.inFlight.set(z,{tick:{name:$,startedAt:new Date},done:G}),G}}import{isMainThread as F6}from"worker_threads";var B6=100,P6=($)=>Math.min(B6,Math.floor($/10));class I6 extends P{register(){this.app.singleton(x,()=>new x(this.app.config.get("queue",{}),{application:this.app})),this.app.singleton(u,()=>this.app.make(x).locks)}async boot(){let $=this.app.config.get("queue",{}),{jobsDir:Z,workflowsDir:z}=A(m3(),$);if($.jobs===void 0)this.app.make(x).useJobs(await i3(Z));if($.workflows===void 0){let G=await l3(z);if(G.length>0)this.app.make(x).useWorkflows(G)}}async shutdown($){if(!this.app.resolved(x))return;let Z=this.app.make(x);if(Z.running>0)console.log(`[gemi] Shutting down: waiting for ${Z.running} running queued job(s).`);let z=$?.timeoutMs,{unfinished:G}=await Z.drain(z===void 0?1/0:Math.max(0,z-P6(z)));if(G.length>0)return console.error("[gemi] Queued jobs still running at shutdown: "+G.map((W)=>`${W.name} (${W.id})`).join(", ")),{abandoned:!0}}}function l8($){if(_6($),Bun.env.NODE_ENV!=="production")return D6($);if(n3($))return;if(!d3())return;if(!$.bound(x))return;$.make(x).start()}function n3($){let Z=$.config.get("queue",{}).driver??"memory";return Z==="memory"||Z instanceof u3}function L6($){if(n3($))return!0;if(typeof $.config.get("queue",{}).driver!=="function"||!$.bound(x))return!1;try{return!$.make(x).durable}catch{return!1}}function _6($){let Z=process.env.GEMI_QUEUE_CLAIM;if(Z===void 0||p3())return;if(process.env.ROOT_DIR===void 0||!F6)return;if(c3()){if(!L6($))return;console.warn('[gemi] GEMI_QUEUE_CLAIM=off is ignored: the memory queue driver keeps jobs in the process that dispatched them, so no worker could run them. This server runs its own jobs. Use a driver other processes can read, such as "database", to hand jobs to `gemi queue:work`.')}else if(Z.trim().toLowerCase()!=="on")console.warn(`[gemi] GEMI_QUEUE_CLAIM="${Z}" is not "off" or "on", so this server claims jobs. Set it to "off" to leave them to \`gemi queue:work\`.`)}function D6($){let Z=globalThis.__gemiDevQueue;if(!Z)return;if(globalThis.__gemiDevQueue=void 0,Z.stop(),$.bound(x))$.make(x).start()}var O6=new Set,j6={refusal:null,apply:($)=>$,carried:null};async function G$($){let Z=y(n);if(Z.config.global.length===0)return j6;let{pathname:z}=new URL($.url),G=a3(z),W=new m($,{},G?"api":"view","");return await g.run(W,async()=>{let X=g.getStore(),{headers:Y,cookies:K}=X,Q=(V)=>{if(!g2(V)){let U=v2(V,Y,K);return G?U:A6(U,z)}let H=new Headers(Y);return H.delete("Set-Cookie"),v2(V,H,O6)};try{return await Z.runGlobalMiddleware(),{refusal:null,apply:Q,carried:{user:X.user,state:W.state}}}catch(V){let H=!G&&z.endsWith(".json");if(V?.kind===t3){let U=G?z$(V.payload.api):H?$$(V.payload.viewData??V.payload.api):w2(V.payload.view);return{refusal:Q(U),apply:Q,carried:null}}if(s3(V)&&(G||H))return{refusal:Q(Z$()),apply:Q,carried:null};if(o3(V)){console.error(V);let U=G||H?r3():w2(e3());return{refusal:Q(U),apply:Q,carried:null}}throw V}finally{X.destroy()}})}function A6($,Z){if(!g2($)||$.headers.getSetCookie().length===0)return $;try{return f2($.headers,Z),$}catch{let z=new Headers($.headers);return f2(z,Z),new Response($.body,{status:$.status,statusText:$.statusText,headers:z})}}var x6=120,C6=2000,S6=3;class s{manager;application;static token="broadcast.sockets";server=null;sockets=new Set;byTopic=new Map;topicReady=new Map;perIp=new Map;perUser=new Map;connections=0;revocationSeq=0;revokedAt=new Map;closing=!1;closed=null;onAllClosed=null;startPromise=null;constructor($,Z){this.manager=$;this.application=Z}get config(){return this.manager.config}matches($){try{return new URL($.url).pathname===this.config.path}catch{return!1}}get size(){return this.sockets.size}start($){return this.server=$,this.startPromise??=this.manager.start((Z,z)=>this.deliver(Z,z),{onGap:()=>this.onGap(),onRevoke:(Z)=>this.applyRevocation(Z)}).catch((Z)=>{this.startPromise=null,console.error("[gemi] The broadcast driver could not start; events reach no socket.",Z)}),this.startPromise}upgrade($,Z){return this.run(()=>this.tryUpgrade($,Z))}async tryUpgrade($,Z){if(this.closing||m2())return b(503,"The server is restarting.",{"Retry-After":"5"});if($.method!=="GET"||$.headers.get("upgrade")?.toLowerCase()!=="websocket")return b(426,"This endpoint only accepts WebSocket upgrades.",{Upgrade:"websocket"});if(!($.headers.get("sec-websocket-protocol")??"").split(",").map((K)=>K.trim()).includes(H2))return b(400,`Open the socket with the "${H2}" subprotocol.`);let G=this.checkOrigin($);if(G!==!0)return b(403,G);if(this.connections>=this.config.maxConnectionsPerProcess)return b(503,"Too many connections.",{"Retry-After":"10"});let W=k6($,Z);if(W&&(this.perIp.get(W)??0)>=this.config.maxConnectionsPerIp)return b(429,"Too many connections from this address.",{"Retry-After":"30"});let X=this.reserve(W),Y=!1;try{let K=await this.authenticate($,Z,X);return Y=K===void 0,K}finally{if(!Y)this.release(X)}}async authenticate($,Z,z){let G=await G$($);if(G.refusal)return G.refusal;let W=G.carried;if(this.closing||m2())return b(503,"The server is restarting.",{"Retry-After":"5"});let X;try{let H=new m($,{},"api",this.config.path);X=await g.run(H,async()=>{let U=g.getStore();try{return await Q$(H)}finally{U.destroy()}},W)}catch(H){return console.error("[gemi] Resolving the session of a socket upgrade failed.",H),b(503,"The session could not be checked.",{"Retry-After":"5"})}let Y=M6(X);if(Y&&(this.perUser.get(Y)??0)>=this.config.maxConnectionsPerUser)return b(429,"Too many connections for this user.",{"Retry-After":"30"});if(Y)z.userId=Y,this.perUser.set(Y,(this.perUser.get(Y)??0)+1);let K=K$(),Q={gemiSocket:!0,hub:this,socketId:K,tag:Y$(K),request:{url:$.url,headers:[...$.headers]},carried:W,userId:Y,ip:z.ip,subs:new Map,topics:new Map,rate:{windowStart:Date.now(),subs:0,pings:0},reservation:z,closing:!1,closed:!1};if(!Z.upgrade($,{headers:{"Sec-WebSocket-Protocol":H2},data:Q}))return b(400,"The WebSocket upgrade failed.");return}checkOrigin($){let Z=$.headers.get("origin"),z=Boolean($.headers.get("cookie"));if(!Z)return z?"A socket that carries cookies must send an Origin header.":!0;return this.originAllowed(Z,$)?!0:"This origin may not open a socket."}originAllowed($,Z){let z;try{z=new URL($)}catch{return!1}if(z.protocol!=="https:"&&z.protocol!=="http:")return!1;let G=Z.headers.get("host");if(G&&z.host.toLowerCase()===G.toLowerCase())return!0;for(let W of[process.env.APP_URL,process.env.HOST_NAME,...this.config.allowedOrigins])if(W&&q6(W.trim(),z))return!0;return!1}reserve($){if(this.connections++,$)this.perIp.set($,(this.perIp.get($)??0)+1);return{ip:$,userId:null}}release($){this.connections--,W$(this.perIp,$.ip),W$(this.perUser,$.userId)}get websocket(){return{open:($)=>$.data.hub.onOpen($),message:($,Z)=>$.data.hub.onMessage($,Z),close:($)=>$.data.hub.onClose($),...this.socketOptions()}}socketOptions(){return{maxPayloadLength:this.config.maxInboundMessageBytes,idleTimeout:this.config.idleTimeout,backpressureLimit:this.config.backpressureLimit*2,closeOnBackpressureLimit:!0,sendPings:!0,perMessageDeflate:!1}}onOpen($){let Z=$.data;if(this.closing){this.sayBye($);return}this.sockets.add($),t($,{op:"hello",socketId:Z.socketId,tag:Z.tag,heartbeatMs:this.config.heartbeatMs})}onMessage($,Z){if(typeof Z!=="string"){$.close(M.UnsupportedData,"Frames are JSON text.");return}if(Z.length>this.config.maxInboundMessageBytes){$.close(M.PolicyViolation,"Frame too large.");return}let z;try{z=JSON.parse(Z)}catch{$.close(M.UnsupportedData,"Frames are JSON text.");return}switch(z?.op){case"ping":if(this.countPing($))t($,{op:"pong"});return;case"sub":this.subscribe($,z).catch((G)=>{if(console.error("[gemi] A socket subscription failed.",G),typeof z.id==="string"&&$.data.subs.has(z.id)){let W=$.data.subs.get(z.id);if($.data.subs.delete(z.id),W.topic&&!$.data.closed)this.leave($,W.topic);if(!$.data.closed)E($,z.id,"error")}});return;case"unsub":this.unsubscribeFrame($,z);return;default:$.close(M.UnsupportedData,"Unknown op.")}}onClose($){let Z=$.data;if(Z.closed)return;Z.closed=!0;for(let[,z]of Z.subs)if(z.topic)this.leave($,z.topic);if(Z.subs.clear(),this.sockets.delete($),Z.reservation)this.release(Z.reservation),Z.reservation=null;if(this.closing&&this.sockets.size===0)this.onAllClosed?.()}rateWindow($){let Z=$.data.rate,z=Date.now();if(z-Z.windowStart>=this.config.subscribeRate.windowMs)Z.windowStart=z,Z.subs=0,Z.pings=0;return Z}countSub($){let{limit:Z}=this.config.subscribeRate,z=this.rateWindow($);if(z.subs++,z.subs>Z*2)return console.warn("[gemi] Socket closed for sending too many subscribe frames (1008)."),$.close(M.PolicyViolation,"Too many subscribe frames."),"closed";return z.subs>Z?"limited":"ok"}countPing($){let Z=this.rateWindow($);if(Z.pings++,Z.pings<=x6)return!0;return $.close(M.PolicyViolation,"Too many pings."),!1}async subscribe($,Z){let z=$.data,G=Z.id;if(typeof G!=="string"||!u2.test(G)){$.close(M.UnsupportedData,"A sub needs an id.");return}let W=this.countSub($);if(W==="closed")return;if(W==="limited")return E($,G,"rate_limited");let X=Z.ch,Y=Z.p??{};if(typeof X!=="string"||!T6(Y))return E($,G,"invalid");if(z.subs.has(G))return E($,G,"invalid");if(z.subs.size>=this.config.maxChannelsPerSocket)return E($,G,"limit");let K={pattern:X,params:Y,topic:null};if(z.subs.set(G,K),!this.manager.channels)return z.subs.delete(G),E($,G,"unknown_channel");let Q;for(let V=1;;V++){let H=this.revocationSeq;if(Q=await this.authorize($,K),z.closed||z.subs.get(G)!==K)return;if(Q.ok!==!0)break;if((this.revokedAt.get(Q.topic)??0)<=H)break;if(V>=S6)return z.subs.delete(G),E($,G,"error")}if(Q.ok!==!0)return z.subs.delete(G),E($,G,Q.code);K.topic=Q.topic;try{await this.join($,Q.topic)}catch(V){if(console.error(`[gemi] The broadcast driver could not subscribe to "${Q.topic}".`,V),z.subs.get(G)===K){if(z.subs.delete(G),!z.closed)this.leave($,Q.topic);E($,G,"error")}return}if(z.closed||z.subs.get(G)!==K)return;t($,{op:"subscribed",id:G,t:Q.topic})}authorize($,Z){let z=$.data,G=this.manager.channels;if(!G)return Promise.resolve({ok:!1,code:"unknown_channel"});return this.run(()=>G.authorize(new Request(z.request.url,{headers:z.request.headers}),Z.pattern,Z.params,{carried:z.carried}))}unsubscribeFrame($,Z){let z=Z.id;if(typeof z!=="string"||!u2.test(z)){$.close(M.UnsupportedData,"An unsub needs an id.");return}let G=$.data.subs.get(z);if(!G)return;if($.data.subs.delete(z),G.topic)this.leave($,G.topic)}join($,Z){let z=$.data,G=z.topics.get(Z)??0;if(z.topics.set(Z,G+1),G===0){$.subscribe(Z);let W=this.byTopic.get(Z);if(!W){W=new Set,this.byTopic.set(Z,W);let X=Promise.resolve().then(()=>this.manager.topicAdded(Z));this.topicReady.set(Z,X),X.catch(()=>{if(this.topicReady.get(Z)===X)this.topicReady.delete(Z)})}W.add($)}return this.topicReady.get(Z)??Promise.resolve()}leave($,Z){let z=$.data,G=z.topics.get(Z)??0;if(G>1){z.topics.set(Z,G-1);return}if(z.topics.delete(Z),!z.closed)$.unsubscribe(Z);let W=this.byTopic.get(Z);if(!W)return;if(W.delete($),W.size>0)return;this.byTopic.delete(Z),this.topicReady.delete(Z),Promise.resolve().then(()=>this.manager.topicRemoved(Z)).catch((X)=>console.error(`[gemi] The broadcast driver could not unsubscribe from "${Z}".`,X))}deliver($,Z){let z=this.byTopic.get($);if(!z||!this.server)return;let G=this.config.backpressureLimit;for(let W of z)if(!W.data.closing&&W.getBufferedAmount()>G)console.warn(`[gemi] Socket closed for backpressure (1013) on "${$}".`),h2(W,M.TryAgainLater,"Too far behind; reconnect.");this.server.publish($,Z)}onGap(){this.sendAll({op:"gap"});for(let $ of this.byTopic.keys()){let Z=Math.floor(Math.random()*C6);setTimeout(()=>{if(!this.closing)this.applyRevocation({topic:$})},Z).unref?.()}}applyRevocation($){if("user"in $){for(let W of this.sockets)if(W.data.userId===$.user&&!W.data.closing)h2(W,M.Revoked,"Revoked.");return}let Z=$.topic,z=++this.revocationSeq;this.revokedAt.set(Z,z);let G=this.byTopic.get(Z);if(!G)return;for(let W of G)this.reauthorize(W,Z,z)}async reauthorize($,Z,z){let G=$.data,W=[...G.subs].filter(([,Y])=>Y.topic===Z);if(W.length===0)return;$.unsubscribe(Z);let X=await Promise.all(W.map(([,Y])=>this.authorize($,Y).catch((K)=>{return console.error(`[gemi] Authorizing "${Z}" again after a revoke failed.`,K),{ok:!1,code:"revoked"}})));if(G.closed)return;if(this.revokedAt.get(Z)!==z)return;if(W.forEach(([Y,K],Q)=>{let V=X[Q];if(G.subs.get(Y)!==K)return;if(V.ok===!0&&V.topic===Z)return;G.subs.delete(Y),this.leave($,Z),E($,Y,"revoked")}),!G.topics.has(Z))return;$.subscribe(Z);for(let[Y,K]of G.subs)if(K.topic===Z)t($,{op:"subscribed",id:Y,t:Z})}sendAll($){let Z=JSON.stringify($);for(let z of this.sockets)z.send(Z)}shutdown($={}){if(this.closed)return this.closed;this.closing=!0,this.closed=new Promise((G)=>{this.onAllClosed=G});let Z=[...this.sockets];if(Z.length===0)this.onAllClosed?.();if(Z.length>0)console.log(`[gemi] Closing ${Z.length} broadcast socket(s) (1012).`);for(let G of Z)this.sayBye(G);return setTimeout(()=>{for(let G of Z)try{G.terminate()}catch{}this.onAllClosed?.()},$.terminateAfterMs??2000).unref?.(),this.closed}get isClosing(){return this.closing}sayBye($){t($,{op:"bye",code:M.Restart,retryAfter:1000+Math.floor(Math.random()*4000)}),h2($,M.Restart,"Server restarting.")}run($){return U2.run(this.application,$)}}function q6($,Z){let z=/^(?:(https?):\/\/)?\*\.([^/:]+)(?::(\d+))?\/?$/i.exec($);if(z){let[,G,W,X]=z;if(G&&`${G.toLowerCase()}:`!==Z.protocol)return!1;if((X??"")!==Z.port)return!1;return Z.hostname.toLowerCase().endsWith(`.${W.toLowerCase().replace(/\.$/,"")}`)}if(/^https?:\/\//i.test($))try{return new URL($).origin===Z.origin}catch{return!1}return $.toLowerCase().replace(/\/$/,"")===Z.host.toLowerCase()}function h2($,Z,z){$.data.closing=!0,$.close(Z,z)}function t($,Z){$.send(JSON.stringify(Z))}function E($,Z,z){t($,{op:"denied",id:Z,code:z})}function b($,Z,z={}){return new Response(Z,{status:$,headers:{"Content-Type":"text/plain; charset=utf-8",...z}})}function T6($){if(typeof $!=="object"||$===null||Array.isArray($))return!1;return Object.values($).every((Z)=>typeof Z==="string"||typeof Z==="number")}function M6($){let Z=$?.id;return typeof Z==="string"||typeof Z==="number"?String(Z):null}function k6($,Z){let z=$.headers.get("x-forwarded-for")?.split(",")[0]?.trim();if(z)return X$(z)??z;try{return Z.requestIP($)?.address??null}catch{return null}}function W$($,Z){if(!Z)return;let z=($.get(Z)??0)-1;if(z<=0)$.delete(Z);else $.set(Z,z)}class R6 extends P{register(){this.app.singleton(w,()=>new w(this.app.config.get("broadcast",{}),{application:this.app,channels:this.app.config.get("route.channels")})),this.app.singleton(s,()=>new s(this.app.make(w),this.app))}boot(){let $=this.app.config.get("route.channels");if($)H$(new $);let Z=this.app.config.get("broadcast",{}),z=typeof Z.driver==="function"||typeof Z.driver==="object"?this.app.make(w).driver:void 0;E6(Z,process.env,z)}async shutdown(){if(this.app.resolved(s))this.app.make(s).shutdown();if(!this.app.resolved(w))return;await this.app.make(w).close()}}function E6($,Z=process.env,z){if(!($.driver==="redis"||z instanceof V$)||Z.SECRET)return;let W=`[gemi] The "redis" broadcast driver needs SECRET set, the same on every instance: Broadcast.toOthers tags the sender's socket with a key derived from it, and every instance must derive the same one.`;if(Z.NODE_ENV==="production")throw Error(W);console.warn(W)}class b6 extends P{register(){this.app.singleton(d2,()=>new d2(this.app.config.get("cache",{}),{application:this.app}))}}class y6 extends P{register(){this.app.singleton(Z2,()=>new Z2(this.app.config.get("changeFeed",{}),{application:this.app}))}async shutdown(){if(!this.app.resolved(Z2))return;await this.app.make(Z2).close()}}class f6 extends P{register(){this.app.singleton(p2,()=>new p2(this.app.config.get("auth",{}))),this.app.singleton(c2,()=>{let $=this.app.config.get("auth",{});return new c2({providers:$.connections??{},store:$.connectionStore??void 0})})}boot(){let $=this.app.config.get("auth",{});J$($),U$($?.emailCode?.fixedCode)}}var w6=100,v6=($)=>Math.min(w6,Math.floor($/10));class g6 extends P{register(){this.app.singleton(d,()=>new d(A(i2(),this.app.config.get("schedule",{}))))}async boot(){let $=this.app.make(d),Z=this.app.config.get("schedule",{});if(Z.jobs===void 0){let{jobsDir:G}=A(i2(),Z);$.useJobs(await N$(G))}if(process.env.GEMI_NO_SCHEDULE==="1")return;let z=this.app;if(z.bound(u))$.useLocks(()=>z.make(u));$.start((G)=>U2.run(z,G))}async shutdown($){if(!this.app.resolved(d))return;let Z=this.app.make(d);if(Z.running>0)console.log(`[gemi] Shutting down: waiting for ${Z.running} running cron tick(s).`);let z=$?.timeoutMs,{unfinished:G}=await Z.drain(z===void 0?1/0:Math.max(0,z-v6(z)));if(G.length>0)return console.error("[gemi] Cron jobs still running at shutdown: "+G.map((W)=>`${W.name} (started ${W.startedAt.toISOString()})`).join(", ")),{abandoned:!0}}}class o extends F${modelName;constructor($="FeatureFlag"){super();this.modelName=$}get available(){return B$(this.modelName)}async load(){if(!this.available)throw new l2(this.modelName);let $=n2(this.modelName);return await $.asSystem(()=>$.findMany())}async write($,Z,z){if(!this.available)throw new l2(this.modelName);let G=n2(this.modelName),W=this.hasActorColumn(G),X={active:Z};if(W)X.updatedBy=z.actor;return await G.asSystem(()=>G.upsert({where:{key:$},create:{key:$,...X},update:X})),{actorRecorded:W}}hasActorColumn($){let Z=$?.$schema?.fields?.updatedBy;return Z!==void 0&&Z.type==="String"}}function n9($){return $}function P$(){return{features:void 0,enabled:!0,source:new o,model:"FeatureFlag",ttl:30,context:void 0,onEvaluate:void 0,maxClientFlags:200}}class h6 extends P{register(){this.app.singleton(J2,()=>{let $=this.app.config.get("features",{}),Z=A(P$(),$);if($?.model!==void 0&&$?.source===void 0)Z.source=new o($.model);else if($?.model!==void 0&&$.source instanceof o&&$.source.modelName!==$.model)N2.warning(`app/config/features.ts sets \`model: "${$.model}"\` and a source reading "${$.source.modelName}". The source wins; drop \`model\` to silence this.`);return new J2(Z,(z)=>N2.warning(z))})}async boot(){let $=this.app.make(J2);if(!$.config.enabled)return;try{await $.refresh()}catch(Z){N2.error(`Could not warm the feature flag cache at boot. ${Z instanceof Error?Z.message:String(Z)}`)}}}class m6 extends P{register(){this.app.singleton(t2,()=>new t2(this.app.config.get("mail",{})))}}class u6 extends P{register(){this.app.singleton(F2,()=>new F2(this.app.config.get("encryption",{})))}boot(){if(this.app.make(F2).configured)return;let Z=this.app.config.get("auth",{}),z=Object.keys(Z?.connections??{});if(z.length>0&&!Z?.connectionStore)throw new s2(`auth.connections (${z.join(", ")}) keeps OAuth tokens encrypted, but no encryption key is configured. Add app/config/encryption.ts (defineEncryptionConfig({ keys: { k1: process.env.APP_ENCRYPTION_KEY } })) and list it as \`encryption\` in your Kernel's config. Generate a key with \`openssl rand -base64 32\`.`);let G=I$();if(G.length===0)return;throw new s2(`${G.join(", ")} ${G.length===1?"is an encrypted column":"are encrypted columns"}, but no encryption key is configured. Add app/config/encryption.ts (defineEncryptionConfig({ keys: { k1: process.env.APP_ENCRYPTION_KEY } })) and list it as \`encryption\` in your Kernel's config. Generate a key with \`openssl rand -base64 32\`.`)}}var d6=Symbol.for("gemi.broadcastEvent");function L$($){return typeof $==="object"&&$!==null&&$[d6]===!0}function c6($){return`listener:${$}`}function D$($,Z){p6($);let{maxAttempts:z,backoff:G,worker:W}=Z,X=$.event.name,Y=class extends _${maxAttempts=z;backoff=G;worker=W;async run(...K){let[Q,V]=i6(K),H=y(c).rehydrate(Q,V);await new $().handle(H)}onFail(K){console.error(`The listener ${$.name} threw while handling ${X} off the queue. The queue will retry it up to ${z} times in total; nothing the dispatcher did is waiting on it.`,K)}onDeadletter(K){console.error(`The listener ${$.name} failed every one of its ${z} attempts at ${X} and has been dead-lettered, so this side effect did not happen and will not be retried.`,K)}};return Object.defineProperty(Y,"name",{value:c6($.name),writable:!0}),Y}function p6($){if(Object.getOwnPropertyDescriptor($,"name")?.writable)return;throw Error(`The listener ${$.name} sets \`queued = true\` but does not declare \`static name\`, so it would be registered with the queue `+"under its class name \u2014 which a production build renames while the "+`payload that names it does not. Add: static name = "${$.name}";`)}function i6($){return typeof $[0]==="string"?$:$[0]}class c{static token="events";listeners={};events={};warnedFor=new Set;warnedAboutWaiting=new Set;config;constructor($={}){this.config=A(B2(),$),this.useListeners(this.config.listeners)}useListeners($){this.config.listeners=$,this.listeners={},this.events={};let Z=new Set;for(let z of $){if(!z.event){console.error(`Listener ${z.name} does not declare \`static event\`, so there is no event name to register it under and its handle will never run. Add: static event = SomeEvent;`);continue}if(Z.has(z.name)){console.error(`Two event listeners are named "${z.name}" \u2014 the first is `+"registered and this one is not. A listener's name identifies it across the framework, so only one class can hold it. Rename one.");continue}Z.add(z.name);let G=z.event.name,W=new z;this.events[G]??=z.event,(this.listeners[G]??=[]).push({listener:z,job:W.queued?D$(z,W):null})}}get queuedListenerJobs(){return Object.values(this.listeners).flat().flatMap(({job:$})=>$?[$]:[])}get registeredListeners(){return[...this.config.listeners]}dispatch($,Z){if(this.deferToCommit($,Z,!1))return;this.runListeners($,Z)}async dispatchAndWait($,Z){if(this.deferToCommit($,Z,!0))return;return this.runListeners($,Z)}deferToCommit($,Z,z){let{name:G,afterCommit:W}=$.constructor;if(!W)return!1;let X=O$(()=>this.runListeners($,Z));if(X&&z)this.warnNothingIsWaitedFor(G);return X}async runListeners($,Z){let z=$.constructor.name,G=this.listeners[z]??[],W=L$($);if(G.length===0&&!W){this.warnNothingIsListening(z);return}for(let{listener:X,job:Y}of G){if(Y){this.enqueue(Y,X,z,Z);continue}try{await new X().handle($)}catch(K){console.error(`The listener ${X.name} threw while handling ${z}. The `+"listeners after it still ran \u2014 a listener's failure is its own.",K)}}if(W)this.broadcast($,z)}broadcast($,Z){try{y(w).broadcastEvent($)}catch(z){console.error(`The event ${Z} could not be broadcast.`,z)}}rehydrate($,Z=[]){let z=this.events[$];if(!z)throw Error(`Cannot rebuild the event "${$}" that came off the queue: no registered listener binds to an event of that name, so there is no class to construct. A queued listener runs in an application that `+"discovered its own listeners \u2014 check that this process sees the "+`same app/listeners as the one that dispatched, and that the event declares \`static name = "${$}"\`.`);return new z(...Z)}enqueue($,Z,z,G){if(G===void 0){console.error(`The listener ${Z.name} is queued, but ${z} reached the dispatcher without its constructor arguments, so there is nothing for the queue to rebuild it from and the listener was skipped. Dispatch through ${z}.dispatch(...) or ${z}.dispatchAndWait(...), which carry them.`);return}let W=(X)=>console.error(`The listener ${Z.name} could not be queued for ${z}, so it did not run and will not be retried. The listeners after it still ran.`,X);try{y(x).push($,JSON.stringify([z,G]),{reportFailure:!1}).catch(W)}catch(X){W(X)}}warnNothingIsWaitedFor($){if(Bun.env.NODE_ENV==="production")return;if(this.warnedAboutWaiting.has($))return;this.warnedAboutWaiting.add($),console.warn(`[gemi] ${$}.dispatchAndWait() was called inside a transaction and ${$} declares \`static afterCommit = true\`, so it resolved `+"immediately with no listener having run \u2014 they run when the "+"transaction commits. Await the transaction instead, or drop afterCommit if the caller needs the side effects first. Development only.")}warnNothingIsListening($){if(Bun.env.NODE_ENV==="production")return;if(this.warnedFor.has($))return;this.warnedFor.add($),console.warn(`[gemi] ${$} was dispatched and nothing is listening for it. A listener registers under the name its event declares, so check that app/listeners holds a Listener with \`static event = ${$}\` and that ${$} declares \`static name = "${$}"\`. Development only.`)}}class l6 extends P{register(){this.app.singleton(c,()=>new c(this.app.config.get("events",{})))}async boot(){let $=this.app.make(c),Z=this.app.config.get("events",{});if(Z.listeners===void 0){let{listenersDir:W}=A(B2(),Z);$.useListeners(await j$(W))}let z=$.queuedListenerJobs;if(z.length===0)return;let G=this.app.make(x);for(let W of z)G.registerJob(W)}}class n6 extends P{register(){this.app.singleton(o2,()=>new o2(this.app.config.get("filesystem",{})))}}class t6 extends P{register(){this.app.singleton(a2,()=>new a2(this.app.config.get("image",{})))}}class s6 extends P{register(){this.app.instance(r2,new r2)}}class o6 extends P{register(){this.app.singleton(P2,()=>new P2(A(A$(),this.app.config.get("log",{}))))}async boot(){if(!process.env.ROOT_DIR)return;await this.app.make(P2).boot()}}class a6 extends P{register(){this.app.singleton(n,()=>new n(A(x$(),this.app.config.get("middleware",{}))))}boot(){this.app.make(n).assertGlobalMiddleware()}}function aZ($){return $}function S$(){return{driver:new C$,limit:1000,window:60}}class r6 extends P{register(){this.app.singleton(l,()=>new l(A(S$(),this.app.config.get("ratelimiter",{}))))}}function W4($){return $}function q$(){return{url:process.env.REDIS_URL,options:void 0}}class e6 extends P{register(){this.app.singleton(z2,()=>new z2(A(q$(),this.app.config.get("redis",{}))))}shutdown(){if(!this.app.resolved(z2))return;this.app.make(z2).close()}}function I2($,Z){let z=$.get(Z);if(!z)throw Error(`Missing "${Z}" configuration. Route dispatching needs a root router \u2014 declare it in "app/config/route.ts".`);return z}class $8 extends P{register(){this.app.singleton(a,()=>new a(I2(this.app.config,"route.api"))),this.app.singleton(G2,()=>new G2(I2(this.app.config,"route.view"),this.app.config.get("auth",{}))),this.app.singleton(L2,()=>new L2({api:this.app.make(a),view:this.app.make(G2)},{api:I2(this.app.config,"route.api"),view:I2(this.app.config,"route.view"),auth:this.app.config.get("auth",{}),domains:this.app.config.get("route.domains"),clientIpTrust:T$(process.env)})),this.app.singleton(i,()=>{let $=this.app.config.get("route.mcp");if(!$?.router)throw Error('No MCP router is configured. Declare one as `mcp: { router }` in "app/config/route.ts".');return new i(new $.router,this.app.make(a),{files:$.remote?.files})}),this.registerMcpHttp()}registerMcpHttp(){this.app.singleton($2,()=>{let $=this.app.config.get("route.mcp");if(!$?.remote?.enabled)throw Error("The MCP endpoint is not enabled: set route.mcp.remote.enabled.");return new $2(this.app.make(i),$.remote)})}boot(){if(this.app.make(a),this.app.make(G2),this.app.make(L2),this.app.config.get("route.mcp"))this.app.make(i);let $=this.app.config.get("route.mcp.remote");if($?.enabled===!0)this.app.make($2);else if($?.enabled!==void 0&&$.enabled!==!1)throw Error("route.mcp.remote.enabled must be true or false.")}}class Z8 extends P{register(){this.app.singleton(e2,()=>new e2(this.app.config.get("runs",{}),{application:this.app}))}}
 export{M$ as eb,O as fb,v as gb,H8 as hb,i as ib,j2 as jb,a$ as kb,A2 as lb,k2 as mb,R2 as nb,$2 as ob,d as pb,I6 as qb,l8 as rb,G$ as sb,s as tb,R6 as ub,b6 as vb,y6 as wb,f6 as xb,g6 as yb,o as zb,n9 as Ab,P$ as Bb,h6 as Cb,m6 as Db,u6 as Eb,d6 as Fb,L$ as Gb,c as Hb,l6 as Ib,n6 as Jb,t6 as Kb,s6 as Lb,o6 as Mb,a6 as Nb,aZ as Ob,S$ as Pb,r6 as Qb,W4 as Rb,q$ as Sb,e6 as Tb,$8 as Ub,Z8 as Vb};
 
-//# debugId=4BB2956F53050AA264756E2164756E21
+//# debugId=444BA09BD2D57E2164756E2164756E21