shokupan 0.11.0 → 0.13.0

package/dist/index.js

@@ -1,12 +1,11 @@
 import { nanoid } from "nanoid";
 import { readFile } from "node:fs/promises";
 import { inspect } from "node:util";
+import { RecordId, Surreal } from "surrealdb";
 import { Eta } from "eta";
 import { stat, readdir, readFile as readFile$1 } from "fs/promises";
 import { resolve, join, sep, basename } from "path";
-import { trace, SpanKind, SpanStatusCode, context } from "@opentelemetry/api";
-import { RecordId, Surreal } from "surrealdb";
-import { dump } from "js-yaml";
+import { retry, handleAll, ExponentialBackoff, ConstantBackoff, circuitBreaker, ConsecutiveBreaker, timeout, TimeoutStrategy, bulkhead, fallback, wrap } from "cockatiel";
 import * as http$1 from "node:http";
 import "node:https";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -20,13 +19,124 @@ import * as os from "node:os";
 import os__default from "node:os";
 import { createRequire } from "node:module";
 import { monitorEventLoopDelay } from "node:perf_hooks";
+import { file } from "bun";
+import { OpenAPIAnalyzer } from "./analyzer.impl-DmHe92Oi.js";
 import { readFileSync } from "node:fs";
-import { OpenAPIAnalyzer } from "./analyzer-CnKnQ5KV.js";
+import { OpenAPIAnalyzer as OpenAPIAnalyzer$1 } from "./analyzer-B0fMzeIo.js";
+import { Readable } from "node:stream";
 import * as zlib from "node:zlib";
 import Ajv from "ajv";
 import addFormats from "ajv-formats";
 import { randomUUID, createHmac } from "crypto";
 import { EventEmitter } from "events";
+class BodyParser {
+  /**
+   * Parses the body of a request based on Content-Type header.
+   * @param req The ShokupanRequest object
+   * @param config Application configuration for limits and parser options
+   * @returns The parsed body or throws an error
+   */
+  static async parse(req, config = {}) {
+    const contentType = req.headers.get("content-type") || "";
+    const maxBodySize = config.maxBodySize ?? 10 * 1024 * 1024;
+    if (contentType.includes("application/json") || contentType.includes("+json")) {
+      return {
+        type: "json",
+        body: await BodyParser.parseJson(req, config.jsonParser || "native", maxBodySize)
+      };
+    } else if (contentType.includes("multipart/form-data") || contentType.includes("application/x-www-form-urlencoded")) {
+      return {
+        type: "formData",
+        body: await BodyParser.parseFormData(req, maxBodySize)
+      };
+    } else {
+      return {
+        type: "text",
+        body: await BodyParser.readRawBody(req, maxBodySize)
+      };
+    }
+  }
+  /**
+   * Parsing helper for JSON
+   */
+  static async parseJson(req, parserType, maxBodySize) {
+    const rawText = await BodyParser.readRawBody(req, maxBodySize);
+    if (parserType === "native") {
+      if (!rawText) return {};
+      return JSON.parse(rawText);
+    } else {
+      const { getJSONParser } = await import("./json-parser-B3dnQmCC.js");
+      const parser = getJSONParser(parserType);
+      return parser(rawText);
+    }
+  }
+  /**
+   * Parsing helper for FormData
+   */
+  static async parseFormData(req, maxBodySize) {
+    const clHeader = req.headers.get("content-length");
+    if (!clHeader) {
+      const err = new Error("Length Required");
+      err.status = 411;
+      throw err;
+    }
+    const cl = parseInt(clHeader, 10);
+    if (isNaN(cl)) {
+      const err = new Error("Bad Request");
+      err.status = 400;
+      throw err;
+    }
+    if (cl > maxBodySize) {
+      const err = new Error("Payload Too Large");
+      err.status = 413;
+      throw err;
+    }
+    return req.formData();
+  }
+  /**
+   * Reads raw body as string with size enforcement
+   */
+  static async readRawBody(req, maxBodySize) {
+    if (typeof req.body === "string") {
+      const body = req.body;
+      if (body.length > maxBodySize) {
+        const err = new Error("Payload Too Large");
+        err.status = 413;
+        throw err;
+      }
+      return body;
+    }
+    const reader = req.body?.getReader();
+    if (!reader) {
+      return "";
+    }
+    const chunks = [];
+    let totalSize = 0;
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        totalSize += value.length;
+        if (totalSize > maxBodySize) {
+          const err = new Error("Payload Too Large");
+          err.status = 413;
+          throw err;
+        }
+        chunks.push(value);
+      }
+    } finally {
+      reader.releaseLock();
+    }
+    const result = new Uint8Array(totalSize);
+    let offset = 0;
+    for (let i = 0; i < chunks.length; i++) {
+      const chunk = chunks[i];
+      result.set(chunk, offset);
+      offset += chunk.length;
+    }
+    return new TextDecoder().decode(result);
+  }
+}
 const HTTP_STATUS = {
   // 2xx Success
   OK: 200,
@@ -217,9 +327,14 @@ const $cachedProtocol = /* @__PURE__ */ Symbol.for("Shokupan.ctx.cachedProtocol"
 const $cachedHost = /* @__PURE__ */ Symbol.for("Shokupan.ctx.cachedHost");
 const $cachedOrigin = /* @__PURE__ */ Symbol.for("Shokupan.ctx.cachedOrigin");
 const $cachedQuery = /* @__PURE__ */ Symbol.for("Shokupan.ctx.cachedQuery");
+const $cachedCookies = /* @__PURE__ */ Symbol.for("Shokupan.ctx.cachedCookies");
 const $ws = /* @__PURE__ */ Symbol.for("Shokupan.ctx.ws");
 const $socket = /* @__PURE__ */ Symbol.for("Shokupan.ctx.socket");
 const $io = /* @__PURE__ */ Symbol.for("Shokupan.ctx.io");
+const $mcpTools = /* @__PURE__ */ Symbol.for("Shokupan.mcp.tools");
+const $mcpPrompts = /* @__PURE__ */ Symbol.for("Shokupan.mcp.prompts");
+const $mcpResources = /* @__PURE__ */ Symbol.for("Shokupan.mcp.resources");
+const $resilienceConfig = /* @__PURE__ */ Symbol.for("Shokupan.resilience.config");
 function isValidCookieDomain(domain, currentHost) {
   const hostWithoutPort = currentHost.split(":")[0];
   if (domain === hostWithoutPort) return true;
@@ -275,6 +390,7 @@ class ShokupanContext {
   [$cachedHost];
   [$cachedOrigin];
   [$cachedQuery];
+  [$cachedCookies];
   disconnectCallbacks = [];
   /**
    * Registers a callback to be executed when the associated WebSocket disconnects.
@@ -372,13 +488,20 @@ class ShokupanContext {
     if (this[$cachedQuery]) return this[$cachedQuery];
     const q = /* @__PURE__ */ Object.create(null);
     const blocklist = ["__proto__", "constructor", "prototype"];
+    const mode = this.app?.applicationConfig?.queryParserMode || "extended";
     this.url.searchParams.forEach((value, key) => {
       if (blocklist.includes(key)) return;
       if (Object.prototype.hasOwnProperty.call(q, key)) {
-        if (Array.isArray(q[key])) {
-          q[key].push(value);
+        if (mode === "strict") {
+          throw new Error(`Duplicate query parameter '${key}' is not allowed in strict mode.`);
+        } else if (mode === "simple") {
+          q[key] = value;
         } else {
-          q[key] = [q[key], value];
+          if (Array.isArray(q[key])) {
+            q[key].push(value);
+          } else {
+            q[key] = [q[key], value];
+          }
         }
       } else {
         q[key] = value;
@@ -387,6 +510,28 @@ class ShokupanContext {
     this[$cachedQuery] = q;
     return q;
   }
+  /**
+   * Request cookies
+   */
+  get cookies() {
+    if (this[$cachedCookies]) return this[$cachedCookies];
+    const c = /* @__PURE__ */ Object.create(null);
+    const cookieHeader = this.request.headers.get("cookie");
+    if (cookieHeader) {
+      const pairs = cookieHeader.split(";");
+      for (let i = 0; i < pairs.length; i++) {
+        const pair = pairs[i];
+        const index = pair.indexOf("=");
+        if (index > 0) {
+          const key = pair.slice(0, index).trim();
+          const value = pair.slice(index + 1).trim();
+          c[key] = decodeURIComponent(value);
+        }
+      }
+    }
+    this[$cachedCookies] = c;
+    return c;
+  }
   /**
    * Client IP address
    */
@@ -561,6 +706,10 @@ class ShokupanContext {
     }
     return h;
   }
+  /**
+   * Read request body with caching to avoid double parsing.
+   * The body is only parsed once and cached for subsequent reads.
+   */
   /**
    * Read request body with caching to avoid double parsing.
    * The body is only parsed once and cached for subsequent reads.
@@ -572,29 +721,10 @@ class ShokupanContext {
     if (this[$bodyParsed] === true) {
       return this[$cachedBody];
     }
-    const contentType = this.request.headers.get("content-type") || "";
-    if (contentType.includes("application/json") || contentType.includes("+json")) {
-      const parserType = this.app?.applicationConfig?.jsonParser || "native";
-      if (parserType === "native") {
-        try {
-          this[$cachedBody] = await this.request.json();
-        } catch (e) {
-          throw e;
-        }
-      } else {
-        const rawText = await this.request.text();
-        const { getJSONParser } = await import("./json-parser-B3dnQmCC.js");
-        const parser = getJSONParser(parserType);
-        this[$cachedBody] = parser(rawText);
-      }
-      this[$bodyType] = "json";
-    } else if (contentType.includes("multipart/form-data") || contentType.includes("application/x-www-form-urlencoded")) {
-      this[$cachedBody] = await this.request.formData();
-      this[$bodyType] = "formData";
-    } else {
-      this[$cachedBody] = await this.request.text();
-      this[$bodyType] = "text";
-    }
+    const config = this.app?.applicationConfig || {};
+    const { type, body } = await BodyParser.parse(this.request, config);
+    this[$bodyType] = type;
+    this[$cachedBody] = body;
     this[$bodyParsed] = true;
     return this[$cachedBody];
   }
@@ -610,45 +740,22 @@ class ShokupanContext {
     if (this.request.method === "GET" || this.request.method === "HEAD") {
       return;
     }
+    const maxBodySize = this.app?.applicationConfig?.maxBodySize ?? 10 * 1024 * 1024;
+    const contentLength = parseInt(this.request.headers.get("content-length") || "0", 10);
+    if (contentLength > maxBodySize) {
+      this[$bodyParseError] = new Error("Payload Too Large");
+      this[$bodyParseError].status = 413;
+      return;
+    }
     try {
       await this.body();
     } catch (error) {
-      this[$bodyParseError] = error;
-    }
-  }
-  /**
-   * Read raw body from ReadableStream efficiently.
-   * This is much faster than request.text() for large payloads.
-   * Also handles the case where body is already a string (e.g., in tests).
-   */
-  async readRawBody() {
-    if (typeof this.request.body === "string") {
-      return this.request.body;
-    }
-    const reader = this.request.body?.getReader();
-    if (!reader) {
-      return "";
-    }
-    const chunks = [];
-    let totalSize = 0;
-    try {
-      while (true) {
-        const { done, value } = await reader.read();
-        if (done) break;
-        chunks.push(value);
-        totalSize += value.length;
+      if (error.status === 413 || error.message === "Payload Too Large") {
+        this[$bodyParseError] = error;
+      } else {
+        this[$bodyParseError] = error;
       }
-    } finally {
-      reader.releaseLock();
     }
-    const result = new Uint8Array(totalSize);
-    let offset = 0;
-    for (let i = 0; i < chunks.length; i++) {
-      const chunk = chunks[i];
-      result.set(chunk, offset);
-      offset += chunk.length;
-    }
-    return new TextDecoder().decode(result);
   }
   /**
    * Send a response
@@ -748,7 +855,15 @@ class ShokupanContext {
     }
     this.response.status = status;
     const finalHeaders = this.mergeHeaders();
-    finalHeaders.set("Location", url instanceof Promise ? await url : url);
+    const targetUrl = url instanceof Promise ? await url : url;
+    if (targetUrl.startsWith("//")) {
+      throw new Error("Invalid redirect: Protocol-relative URLs are not allowed.");
+    }
+    const lowerUrl = targetUrl.toLowerCase();
+    if (lowerUrl.startsWith("javascript:") || lowerUrl.startsWith("data:") || lowerUrl.startsWith("vbscript:")) {
+      throw new Error(`Invalid redirect: Unsafe protocol '${targetUrl.split(":")[0]}'`);
+    }
+    finalHeaders.set("Location", targetUrl);
     this[$finalResponse] = new Response(null, { status, headers: finalHeaders });
     return this[$finalResponse];
   }
@@ -806,14 +921,193 @@ class ShokupanContext {
     const html = await this.renderer(element, args);
     return this.html(html, status, headers);
   }
+  /**
+   * Pipe a ReadableStream to the response
+   * @param stream ReadableStream to pipe
+   * @param options Response options (status, headers)
+   */
+  pipe(stream, options) {
+    const headers = this.mergeHeaders(options?.headers);
+    const status = options?.status ?? this.response.status ?? 200;
+    if (this.app?.applicationConfig?.validateStatusCodes && !VALID_HTTP_STATUSES.has(status)) {
+      throw new Error(`Invalid HTTP status code: ${status}`);
+    }
+    this[$finalResponse] = new Response(stream, { status, headers });
+    return this[$finalResponse];
+  }
+  /**
+   * Internal helper to create a streaming response with common infrastructure
+   * @private
+   */
+  createStreamHelper(helperFactory, callback, onError, headers) {
+    let controller;
+    const aborted = { value: false };
+    const abortCallbacks = [];
+    const encoder = new TextEncoder();
+    let helper;
+    const stream = new ReadableStream({
+      start(ctrl) {
+        controller = ctrl;
+        helper = helperFactory(controller, aborted, abortCallbacks, encoder);
+        (async () => {
+          try {
+            await callback(helper);
+            controller.close();
+          } catch (err) {
+            if (onError) {
+              try {
+                await onError(err, helper);
+              } catch (handlerErr) {
+                console.error("Error in stream error handler:", handlerErr);
+              }
+            } else {
+              console.error("Stream error:", err);
+            }
+            if (!aborted.value) {
+              controller.close();
+            }
+          }
+        })();
+      },
+      async pull() {
+      },
+      cancel() {
+        aborted.value = true;
+        abortCallbacks.forEach((cb) => {
+          try {
+            cb();
+          } catch (err) {
+            console.error("Error in abort callback:", err);
+          }
+        });
+      }
+    });
+    return this.pipe(stream, { headers });
+  }
+  /**
+   * Generic streaming helper for binary/text data
+   * @param callback Callback function that receives a StreamHelper
+   * @param onError Optional error handler
+   */
+  stream(callback, onError) {
+    return this.createStreamHelper(
+      (controller, aborted, abortCallbacks, encoder) => ({
+        async write(data) {
+          if (aborted.value) return;
+          const chunk = typeof data === "string" ? encoder.encode(data) : data;
+          controller.enqueue(chunk);
+        },
+        async pipe(stream) {
+          if (aborted.value) return;
+          const reader = stream.getReader();
+          try {
+            while (true) {
+              const { done, value } = await reader.read();
+              if (done || aborted.value) break;
+              controller.enqueue(value);
+            }
+          } finally {
+            reader.releaseLock();
+          }
+        },
+        sleep(ms) {
+          return new Promise((resolve2) => setTimeout(resolve2, ms));
+        },
+        onAbort(callback2) {
+          abortCallbacks.push(callback2);
+        }
+      }),
+      callback,
+      onError
+    );
+  }
+  /**
+   * Text streaming helper with proper headers
+   * @param callback Callback function that receives a TextStreamHelper
+   * @param onError Optional error handler
+   */
+  streamText(callback, onError) {
+    const headers = new Headers(this.response.headers);
+    headers.set("Content-Type", "text/plain; charset=utf-8");
+    headers.set("Transfer-Encoding", "chunked");
+    headers.set("X-Content-Type-Options", "nosniff");
+    return this.createStreamHelper(
+      (controller, aborted, abortCallbacks, encoder) => ({
+        async write(text) {
+          if (aborted.value) return;
+          controller.enqueue(encoder.encode(text));
+        },
+        async writeln(text) {
+          if (aborted.value) return;
+          controller.enqueue(encoder.encode(text + "\n"));
+        },
+        sleep(ms) {
+          return new Promise((resolve2) => setTimeout(resolve2, ms));
+        },
+        onAbort(callback2) {
+          abortCallbacks.push(callback2);
+        }
+      }),
+      callback,
+      onError,
+      headers
+    );
+  }
+  /**
+   * Server-Sent Events (SSE) streaming helper
+   * @param callback Callback function that receives an SSEStreamHelper
+   * @param onError Optional error handler
+   */
+  streamSSE(callback, onError) {
+    const headers = new Headers(this.response.headers);
+    headers.set("Content-Type", "text/event-stream");
+    headers.set("Cache-Control", "no-cache");
+    headers.set("Connection", "keep-alive");
+    return this.createStreamHelper(
+      (controller, aborted, abortCallbacks, encoder) => ({
+        async writeSSE(message) {
+          if (aborted.value) return;
+          let sseMessage = "";
+          if (message.event) {
+            sseMessage += `event: ${message.event}
+`;
+          }
+          if (message.id !== void 0) {
+            sseMessage += `id: ${message.id}
+`;
+          }
+          if (message.retry !== void 0) {
+            sseMessage += `retry: ${message.retry}
+`;
+          }
+          const dataLines = message.data.split("\n");
+          for (const line of dataLines) {
+            sseMessage += `data: ${line}
+`;
+          }
+          sseMessage += "\n";
+          controller.enqueue(encoder.encode(sseMessage));
+        },
+        sleep(ms) {
+          return new Promise((resolve2) => setTimeout(resolve2, ms));
+        },
+        onAbort(callback2) {
+          abortCallbacks.push(callback2);
+        }
+      }),
+      callback,
+      onError,
+      headers
+    );
+  }
 }
 const compose = (middleware) => {
   if (!middleware.length) {
-    return (context2, next) => {
+    return (context, next) => {
       return next ? next() : Promise.resolve();
     };
   }
-  return function dispatch(context2, next) {
+  return function dispatch(context, next) {
     let index = -1;
     async function runner(i) {
       if (i <= index) return Promise.reject(new Error("next() called multiple times"));
@@ -822,31 +1116,114 @@ const compose = (middleware) => {
         return next ? next() : Promise.resolve();
       }
       const fn = middleware[i];
-      if (!context2[$debug]) {
-        return fn(context2, () => runner(i + 1));
-      }
-      const debug = context2[$debug];
-      const debugId = fn._debugId || fn.name || "anonymous";
-      const previousNode = debug.getCurrentNode();
-      debug.trackEdge(previousNode, debugId);
-      debug.setNode(debugId);
-      const start = performance.now();
+      if (typeof fn !== "function") {
+        const name = fn?.constructor?.name;
+        console.error(`[Middleware Error] Item at index ${i} is not a function! It is: ${typeof fn} (${name})`, fn);
+        throw new TypeError(`Middleware at index ${i} must be a function, got ${name}`);
+      }
+      const trackingEnabled = context.app?.applicationConfig?.enableMiddlewareTracking;
+      const meta = fn.metadata;
+      let trackingStartTime = 0;
+      if (trackingEnabled && meta) {
+        trackingStartTime = performance.now();
+        context.handlerStack.push({
+          name: meta.name || fn.name || "anonymous",
+          file: meta.file,
+          line: meta.line,
+          isBuiltin: meta.isBuiltin,
+          startTime: trackingStartTime,
+          duration: -1
+        });
+      }
+      const debug = context[$debug];
+      let debugId;
+      let previousNode;
+      let debugStart = 0;
+      if (debug) {
+        debugId = fn._debugId || fn.name || "anonymous";
+        previousNode = debug.getCurrentNode();
+        debug.trackEdge(previousNode, debugId);
+        debug.setNode(debugId);
+        debugStart = performance.now();
+      }
       try {
-        const res = await Promise.resolve(fn(context2, () => runner(i + 1)));
-        debug.trackStep(debugId, "middleware", performance.now() - start, "success");
+        const res = await fn(context, () => runner(i + 1));
+        if (trackingEnabled && meta) {
+          const duration = performance.now() - trackingStartTime;
+          const stackItem = context.handlerStack[context.handlerStack.length - 1];
+          if (stackItem) stackItem.duration = duration;
+          Promise.resolve().then(async () => {
+            try {
+              const db = context.app?.db;
+              if (!db) return;
+              const timestamp = Date.now();
+              await db.upsert(new RecordId("middleware_tracking", {
+                timestamp,
+                name: meta.name
+              }), {
+                name: meta.name,
+                path: context.path,
+                timestamp,
+                duration,
+                file: meta.file,
+                line: meta.line,
+                error: void 0,
+                metadata: {
+                  isBuiltin: meta.isBuiltin,
+                  pluginName: meta.pluginName
+                }
+              });
+            } catch (e) {
+            }
+          });
+        }
+        if (debug) {
+          debug.trackStep(debugId, "middleware", performance.now() - debugStart, "success");
+        }
         return res;
       } catch (err) {
-        debug.trackStep(debugId, "middleware", performance.now() - start, "error", err);
-        return Promise.reject(err);
+        if (trackingEnabled && meta) {
+          const duration = performance.now() - trackingStartTime;
+          const stackItem = context.handlerStack[context.handlerStack.length - 1];
+          if (stackItem) stackItem.duration = duration;
+          Promise.resolve().then(async () => {
+            try {
+              const db = context.app?.db;
+              if (!db) return;
+              const timestamp = Date.now();
+              await db.upsert(new RecordId("middleware_tracking", {
+                timestamp,
+                name: meta.name
+              }), {
+                name: meta.name,
+                path: context.path,
+                timestamp,
+                duration,
+                file: meta.file,
+                line: meta.line,
+                error: String(err),
+                metadata: {
+                  isBuiltin: meta.isBuiltin,
+                  pluginName: meta.pluginName
+                }
+              });
+            } catch (e) {
+            }
+          });
+        }
+        if (debug) {
+          debug.trackStep(debugId, "middleware", performance.now() - debugStart, "error", err);
+        }
+        throw err;
       } finally {
-        if (previousNode) debug.setNode(previousNode);
+        if (debug && previousNode) debug.setNode(previousNode);
       }
     }
     return runner(0);
   };
 };
 function isObject(item) {
-  return item && typeof item === "object" && !Array.isArray(item);
+  return !!(item && typeof item === "object" && !Array.isArray(item));
 }
 function deepMerge(target, ...sources) {
   if (!sources.length) return target;
@@ -1111,7 +1488,7 @@ async function generateOpenApi(rootRouter, options = {}) {
   let astMiddlewareRegistry = {};
   let applications = [];
   try {
-    const { OpenAPIAnalyzer: OpenAPIAnalyzer2 } = await import("./analyzer-CnKnQ5KV.js");
+    const { OpenAPIAnalyzer: OpenAPIAnalyzer2 } = await import("./analyzer-B0fMzeIo.js");
     const entrypoint = rootRouter.metadata?.file;
     const analyzer = new OpenAPIAnalyzer2(process.cwd(), entrypoint);
     const analysisResult = await analyzer.analyze();
@@ -1163,7 +1540,7 @@ async function generateOpenApi(rootRouter, options = {}) {
       isBuiltinPlugin = true;
       pluginName = router.metadata.pluginName;
       tag = pluginName.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
-    } else if (router.metadata?.file && router.metadata.file.includes("plugins/application/")) {
+    } else if (router.metadata?.file && router.metadata.file.includes("plugins/application/") && !router.metadata.file.match(/\.(spec|test)\.ts$/)) {
       isBuiltinPlugin = true;
       const match = router.metadata.file.match(/plugins\/application\/([^/]+)/);
       if (match) {
@@ -1321,7 +1698,39 @@ async function generateOpenApi(rootRouter, options = {}) {
         const params = [];
         if (astMatch.requestTypes?.query) {
           for (const [name, _type] of Object.entries(astMatch.requestTypes.query)) {
-            params.push({ name, in: "query", schema: { type: "string" } });
+            let type = "string";
+            let format;
+            if (_type === "integer") {
+              type = "integer";
+              format = "int32";
+            } else if (_type === "number") {
+              type = "number";
+              format = "float";
+            } else if (_type === "boolean") type = "boolean";
+            const schema = { type };
+            if (format) schema.format = format;
+            params.push({ name, in: "query", schema });
+          }
+        }
+        if (astMatch.requestTypes?.params) {
+          for (const [name, _type] of Object.entries(astMatch.requestTypes.params)) {
+            let type = "string";
+            let format;
+            if (_type === "integer") {
+              type = "integer";
+              format = "int32";
+            } else if (_type === "number") {
+              type = "number";
+              format = "float";
+            } else if (_type === "boolean") type = "boolean";
+            const schema = { type };
+            if (format) schema.format = format;
+            params.push({ name, in: "path", required: true, schema });
+          }
+        }
+        if (astMatch.requestTypes?.headers) {
+          for (const [name, _type] of Object.entries(astMatch.requestTypes.headers)) {
+            params.push({ name, in: "header", schema: { type: "string" } });
           }
         }
         if (params.length > 0) {
@@ -1337,20 +1746,20 @@ async function generateOpenApi(rootRouter, options = {}) {
           });
         }
         const runtimeSource = (route.handler.originalHandler || route.handler).toString();
-        let file;
+        let file2;
         let line;
         if (route.metadata?.file) {
-          file = route.metadata.file;
+          file2 = route.metadata.file;
           line = route.metadata.line || 1;
         }
         operation["x-source-info"] = {
           snippet: runtimeSource,
           isRuntime: true,
-          ...file ? { file, line: line || 1 } : {}
+          ...file2 ? { file: file2, line: line || 1 } : {}
         };
-        if (file) {
+        if (file2) {
           operation["x-shokupan-source"] = {
-            file,
+            file: file2,
             line: line || 1,
             code: runtimeSource,
             pluginName: route.handler.pluginName
@@ -1379,9 +1788,7 @@ async function generateOpenApi(rootRouter, options = {}) {
         const mergedParams = [...existingParams];
         pathParams.forEach((p) => {
           const idx = mergedParams.findIndex((ep) => ep.in === "path" && ep.name === p.name);
-          if (idx >= 0) {
-            mergedParams[idx] = deepMerge(mergedParams[idx], p);
-          } else {
+          if (idx === -1) {
             mergedParams.push(p);
           }
         });
@@ -1654,8 +2061,11 @@ function serveStatic(config, prefix) {
     if (typeof Bun !== "undefined") {
       response = new Response(Bun.file(finalPath));
     } else {
-      const fileBuffer = await readFile$1(finalPath, { encoding: "binary" });
-      response = new Response(fileBuffer);
+      const { createReadStream } = await import("node:fs");
+      const { Readable: Readable2 } = await import("node:stream");
+      const fileStream = createReadStream(finalPath);
+      const webStream = Readable2.toWeb(fileStream);
+      response = new Response(webStream);
     }
     if (config.hooks?.onResponse) {
       const hooked = await config.hooks.onResponse(ctx, response);
@@ -1667,55 +2077,81 @@ function serveStatic(config, prefix) {
   serveStaticMiddleware.pluginName = "ServeStatic";
   return serveStaticMiddleware;
 }
-class Container {
-  static services = /* @__PURE__ */ new Map();
-  static register(target, instance) {
-    this.services.set(target, instance);
-  }
-  static get(target) {
-    return this.services.get(target);
-  }
-  static has(target) {
-    return this.services.has(target);
+class OpenTelemetryPlugin {
+  constructor(options = {}) {
+    this.options = options;
   }
-  static resolve(target) {
-    if (this.services.has(target)) {
-      return this.services.get(target);
+  api;
+  sdk;
+  async onInit(app) {
+    try {
+      this.api = await import("@opentelemetry/api");
+    } catch (e) {
+      console.warn("OpenTelemetry API not found. OpenTelemetryPlugin will be disabled.");
+      return;
+    }
+    if (this.options.enableAutoInstrumentation !== false) {
+      app.use(this.middleware());
     }
-    const instance = new target();
-    this.services.set(target, instance);
-    return instance;
+  }
+  middleware() {
+    return async (ctx, next) => {
+      if (!this.api) return next();
+      const tracer = this.api.trace.getTracer("shokupan");
+      return tracer.startActiveSpan(`${ctx.req.method} ${ctx.req.path}`, {
+        kind: this.api.SpanKind.SERVER,
+        attributes: {
+          "http.method": ctx.req.method,
+          "http.url": ctx.req.url,
+          "http.host": ctx.req.host,
+          "http.user_agent": ctx.req.headers.get("user-agent") || void 0
+        }
+      }, async (span) => {
+        try {
+          const res = await next();
+          span.setAttributes({
+            "http.status_code": ctx.res.status
+          });
+          if (ctx.res.status >= 500) {
+            span.setStatus({ code: this.api.SpanStatusCode.ERROR });
+          } else {
+            span.setStatus({ code: this.api.SpanStatusCode.OK });
+          }
+          return res;
+        } catch (err) {
+          span.recordException(err);
+          span.setStatus({ code: this.api.SpanStatusCode.ERROR, message: err.message });
+          throw err;
+        } finally {
+          span.end();
+        }
+      });
+    };
   }
 }
-function Injectable() {
-  return (target) => {
-  };
-}
-function Inject(token) {
-  return (target, key) => {
-    Object.defineProperty(target, key, {
-      get: () => Container.resolve(token),
-      enumerable: true,
-      configurable: true
-    });
-  };
-}
-const tracer = trace.getTracer("shokupan.middleware");
-function traceHandler(fn, name) {
-  return async function(...args) {
-    return tracer.startActiveSpan(`route handler - ${name}`, {
-      kind: SpanKind.INTERNAL,
+function traceMiddleware(fn, name) {
+  let api;
+  try {
+    api = require("@opentelemetry/api");
+  } catch {
+  }
+  if (!api) return fn;
+  const tracer = api.trace.getTracer("shokupan.middleware");
+  const middlewareName = name || fn.name || "anonymous middleware";
+  return async (ctx, next) => {
+    return tracer.startActiveSpan(`middleware - ${middlewareName}`, {
+      kind: api.SpanKind.INTERNAL,
       attributes: {
-        "http.route": name,
-        "component": "shokupan.route"
+        "code.function": middlewareName,
+        "component": "shokupan.middleware"
       }
     }, async (span) => {
       try {
-        const result = await fn.apply(this, args);
+        const result = await fn(ctx, next);
         return result;
       } catch (err) {
         span.recordException(err);
-        span.setStatus({ code: SpanStatusCode.ERROR, message: err.message });
+        span.setStatus({ code: api.SpanStatusCode.ERROR, message: err.message });
         throw err;
       } finally {
         span.end();
@@ -1723,9 +2159,183 @@ function traceHandler(fn, name) {
     });
   };
 }
-function getCallerInfo(skipFrames = 1) {
-  let file = "unknown";
-  let line = 0;
+function traceHandler(fn, name) {
+  let api;
+  try {
+    api = require("@opentelemetry/api");
+  } catch {
+  }
+  if (!api) return fn;
+  const tracer = api.trace.getTracer("shokupan.middleware");
+  return async function(...args) {
+    return tracer.startActiveSpan(`route handler - ${name}`, {
+      kind: api.SpanKind.INTERNAL,
+      attributes: {
+        "http.route": name,
+        "component": "shokupan.route"
+      }
+    }, async (span) => {
+      try {
+        const result = await fn.apply(this, args);
+        return result;
+      } catch (err) {
+        span.recordException(err);
+        span.setStatus({ code: api.SpanStatusCode.ERROR, message: err.message });
+        throw err;
+      } finally {
+        span.end();
+      }
+    });
+  };
+}
+class ResilienceFactory {
+  static createPolicy(config) {
+    const policies = [];
+    if (config.retry) {
+      const builder = handleAll;
+      let retries = (config.retry.attempts ?? 3) - 1;
+      if (retries < 0) retries = 0;
+      let retryPolicy;
+      if (config.retry.backoff === "exponential") {
+        retryPolicy = retry(builder, {
+          maxAttempts: retries,
+          backoff: new ExponentialBackoff({
+            initialDelay: config.retry.delay || 1e3,
+            maxDelay: config.retry.maxDelay || 3e4
+          })
+        });
+      } else {
+        retryPolicy = retry(builder, {
+          maxAttempts: retries,
+          backoff: new ConstantBackoff(config.retry.delay || 1e3)
+        });
+      }
+      policies.push(retryPolicy);
+    }
+    if (config.circuitBreaker) {
+      const builder = handleAll;
+      const breaker = circuitBreaker(builder, {
+        halfOpenAfter: config.circuitBreaker.resetTimeout || 1e4,
+        breaker: new ConsecutiveBreaker(config.circuitBreaker.threshold || 5)
+      });
+      policies.push(breaker);
+    }
+    if (config.timeout) {
+      policies.push(timeout(config.timeout, { strategy: TimeoutStrategy.Aggressive, abortOnReturn: true }));
+    }
+    if (config.bulkhead) {
+      policies.push(bulkhead(config.bulkhead));
+    }
+    if (config.fallback !== void 0) {
+      const builder = handleAll;
+      const fb = fallback(builder, config.fallback);
+      policies.push(fb);
+    }
+    if (policies.length === 0) {
+      return { execute: (fn) => fn() };
+    }
+    return wrap(...policies.reverse());
+  }
+}
+const metadataStore = /* @__PURE__ */ new WeakMap();
+function defineMetadata(key, value, target, propertyKey) {
+  let targetMetadata = metadataStore.get(target);
+  if (!targetMetadata) {
+    targetMetadata = /* @__PURE__ */ new Map();
+    metadataStore.set(target, targetMetadata);
+  }
+  const storageKey = propertyKey ? `${String(propertyKey)}:${String(key)}` : key;
+  targetMetadata.set(storageKey, value);
+}
+function getMetadata(key, target, propertyKey) {
+  const targetMetadata = metadataStore.get(target);
+  if (!targetMetadata) return void 0;
+  const storageKey = propertyKey ? `${String(propertyKey)}:${String(key)}` : key;
+  return targetMetadata.get(storageKey);
+}
+if (typeof Reflect === "object") {
+  if (!Reflect.defineMetadata) {
+    Reflect.defineMetadata = defineMetadata;
+  }
+  if (!Reflect.getMetadata) {
+    Reflect.getMetadata = getMetadata;
+  }
+  if (!Reflect.metadata) {
+    Reflect.metadata = function(metadataKey, metadataValue) {
+      return function decorator(target, propertyKey) {
+        defineMetadata(metadataKey, metadataValue, target, propertyKey);
+      };
+    };
+  }
+}
+class Container {
+  static services = /* @__PURE__ */ new Map();
+  static register(target, instance) {
+    this.services.set(target, instance);
+  }
+  static get(target) {
+    return this.services.get(target);
+  }
+  static has(target) {
+    return this.services.has(target);
+  }
+  static cache = /* @__PURE__ */ new Map();
+  static resolvingStack = /* @__PURE__ */ new Set();
+  static resolve(target) {
+    if (this.services.has(target)) {
+      return this.services.get(target);
+    }
+    if (this.resolvingStack.has(target)) {
+      const cycle = Array.from(this.resolvingStack);
+      cycle.push(target);
+      throw new Error(`Circular dependency detected: ${cycle.map((t) => t.name || t).join(" -> ")}`);
+    }
+    this.resolvingStack.add(target);
+    try {
+      let meta = this.cache.get(target);
+      if (!meta) {
+        const scope = Reflect.getMetadata("di:scope", target) || "singleton";
+        const paramTypes = Reflect.getMetadata("design:paramtypes", target) || [];
+        const manualTokens = Reflect.getMetadata("di:constructor:params", target) || [];
+        const dependencies = paramTypes.map((param, index) => {
+          const manual = manualTokens.find((t) => t.index === index);
+          if (manual && manual.token) return manual.token;
+          if (param === String || param === Number || param === Boolean || param === Object || param === void 0) return void 0;
+          return param;
+        });
+        meta = { scope, dependencies };
+        this.cache.set(target, meta);
+      }
+      const args = meta.dependencies.map((dep) => dep ? Container.resolve(dep) : void 0);
+      const instance = new target(...args);
+      if (typeof instance.onInit === "function") {
+        instance.onInit();
+      }
+      if (meta.scope === "singleton") {
+        this.services.set(target, instance);
+      }
+      return instance;
+    } finally {
+      this.resolvingStack.delete(target);
+    }
+  }
+  static async teardown() {
+    for (const [target, instance] of this.services.entries()) {
+      if (typeof instance.onDestroy === "function") {
+        await instance.onDestroy();
+      }
+    }
+    this.services.clear();
+    this.cache.clear();
+  }
+}
+const di = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  Container
+}, Symbol.toStringTag, { value: "Module" }));
+function getCallerInfo(skipFrames = 1) {
+  let file2 = "unknown";
+  let line = 0;
   try {
     const err = new Error();
     const stack = err.stack?.split("\n") || [];
@@ -1740,19 +2350,20 @@ function getCallerInfo(skipFrames = 1) {
       if (l.includes("src/router.ts")) continue;
       if (l.includes("src/util/decorators.ts")) continue;
       if (l.includes("src/shokupan.ts")) continue;
+      if (l.includes("src/plugins/application/openapi/openapi.ts")) continue;
       found++;
       if (found >= skipFrames) {
         const match = l.match(/\((.*):(\d+):(\d+)\)/) || l.match(/at (.*):(\d+):(\d+)/);
         if (match) {
-          file = match[1];
+          file2 = match[1];
           line = parseInt(match[2], 10);
-          return { file, line };
+          return { file: file2, line };
         }
       }
     }
   } catch (e) {
   }
-  return { file, line };
+  return { file: file2, line };
 }
 const HTTPMethods = ["GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "OPTIONS", "ALL"];
 var RouteParamType = /* @__PURE__ */ ((RouteParamType2) => {
@@ -1762,6 +2373,7 @@ var RouteParamType = /* @__PURE__ */ ((RouteParamType2) => {
   RouteParamType2["HEADER"] = "HEADER";
   RouteParamType2["REQUEST"] = "REQUEST";
   RouteParamType2["CONTEXT"] = "CONTEXT";
+  RouteParamType2["SERVICE"] = "SERVICE";
   return RouteParamType2;
 })(RouteParamType || {});
 class ControllerScanner {
@@ -1793,7 +2405,7 @@ class ControllerScanner {
       line: info.line,
       name: instance.constructor.name
     };
-    router.registerControllerInstance(instance);
+    router.bindController(instance);
     const controllerMiddleware = (typeof controller === "function" ? controller[$middleware] : instance[$middleware]) || [];
     const proto = Object.getPrototypeOf(instance);
     const methods = /* @__PURE__ */ new Set();
@@ -1807,6 +2419,10 @@ class ControllerScanner {
     const decoratedArgs = instance[$routeArgs] || proto && proto[$routeArgs];
     const methodMiddlewareMap = instance[$middleware] || proto && proto[$middleware];
     const decoratedEvents = instance[$eventMethods] || proto && proto[$eventMethods];
+    const mcpTools = instance[$mcpTools] || proto && proto[$mcpTools];
+    const mcpPrompts = instance[$mcpPrompts] || proto && proto[$mcpPrompts];
+    const mcpResources = instance[$mcpResources] || proto && proto[$mcpResources];
+    const resilienceConfigMap = instance[$resilienceConfig] || proto && proto[$resilienceConfig];
     let routesAttached = 0;
     for (let i = 0; i < Array.from(methods).length; i++) {
       const name = Array.from(methods)[i];
@@ -1915,6 +2531,9 @@ class ControllerScanner {
                 case RouteParamType.CONTEXT:
                   args[arg.index] = ctx;
                   break;
+                case RouteParamType.SERVICE:
+                  args[arg.index] = Container.resolve(arg.token);
+                  break;
               }
             }
           }
@@ -1928,6 +2547,14 @@ class ControllerScanner {
             return composed(ctx, () => wrappedHandler(ctx));
           };
         }
+        const config = resilienceConfigMap?.get(name);
+        if (config) {
+          const policy = ResilienceFactory.createPolicy(config);
+          const baseHandler = finalHandler;
+          finalHandler = async (ctx) => {
+            return policy.execute(() => baseHandler(ctx));
+          };
+        }
         finalHandler.originalHandler = originalHandler;
         if (finalHandler !== wrappedHandler) {
           wrappedHandler.originalHandler = originalHandler;
@@ -1984,6 +2611,25 @@ class ControllerScanner {
         wrappedHandler.originalHandler = originalHandler;
         router.event(eventConfig.eventName, wrappedHandler);
       }
+      const toolConfig = mcpTools?.get(name);
+      if (toolConfig) {
+        const handler = originalHandler.bind(instance);
+        router.tool(toolConfig.name || name, toolConfig.inputSchema, handler);
+      }
+      const promptConfig = mcpPrompts?.get(name);
+      if (promptConfig) {
+        const handler = originalHandler.bind(instance);
+        router.prompt(promptConfig.name || name, promptConfig.arguments, handler);
+      }
+      const resourceConfig = mcpResources?.get(name);
+      if (resourceConfig) {
+        const handler = originalHandler.bind(instance);
+        router.resource(resourceConfig.uri, {
+          name: resourceConfig.name || name,
+          description: resourceConfig.description,
+          mimeType: resourceConfig.mimeType
+        }, handler);
+      }
     }
     if (routesAttached === 0) {
       console.warn(`No routes attached to controller ${instance.constructor.name}`);
@@ -2014,71 +2660,177 @@ function getErrorStatus(err) {
   }
   return 500;
 }
+class NotFoundError extends HttpError {
+  constructor(message = "Not Found") {
+    super(message, 404);
+    this.name = "NotFoundError";
+  }
+}
 class EventError extends HttpError {
   constructor(message = "Event Error") {
     super(message, 500);
     this.name = "EventError";
   }
 }
-class MiddlewareTracker {
-  static wrap(handler, context2) {
-    const { file, line, name, isBuiltin, pluginName } = context2;
-    const handlerName = name || handler.name || "anonymous";
-    const trackedHandler = async (ctx, next) => {
-      if (!ctx.app?.applicationConfig.enableMiddlewareTracking) {
-        return handler(ctx, next);
-      }
-      const startTime = performance.now();
-      let error = void 0;
-      try {
-        ctx.handlerStack.push({
-          name: handlerName,
-          file,
-          line,
-          isBuiltin,
-          startTime,
-          duration: -1
-        });
-        return await handler(ctx, next);
-      } catch (e) {
-        error = e;
-        throw e;
-      } finally {
-        const duration = performance.now() - startTime;
-        const stackItem = ctx.handlerStack[ctx.handlerStack.length - 1];
-        if (stackItem && stackItem.name === handlerName) {
-          stackItem.duration = duration;
-        }
-        Promise.resolve().then(async () => {
+class McpProtocol {
+  tools = /* @__PURE__ */ new Map();
+  prompts = /* @__PURE__ */ new Map();
+  resources = /* @__PURE__ */ new Map();
+  constructor(tools = [], prompts = [], resources = []) {
+    tools.forEach((t) => this.tools.set(t.name, t));
+    prompts.forEach((p) => this.prompts.set(p.name, p));
+    resources.forEach((r) => this.resources.set(r.uri, r));
+  }
+  addTool(tool) {
+    this.tools.set(tool.name, tool);
+  }
+  addPrompt(prompt) {
+    this.prompts.set(prompt.name, prompt);
+  }
+  addResource(resource) {
+    this.resources.set(resource.uri, resource);
+  }
+  merge(other) {
+    other.tools.forEach((t) => this.tools.set(t.name, t));
+    other.prompts.forEach((p) => this.prompts.set(p.name, p));
+    other.resources.forEach((r) => this.resources.set(r.uri, r));
+  }
+  async handleMessage(message) {
+    if (message.jsonrpc !== "2.0") {
+      return this.error(message.id, -32600, "Invalid Request");
+    }
+    try {
+      switch (message.method) {
+        case "initialize":
+          return this.success(message.id, {
+            protocolVersion: "2024-11-05",
+            serverInfo: {
+              name: "Shokupan MCP",
+              version: "1.0.0"
+            },
+            capabilities: {
+              tools: this.tools.size > 0 ? {} : void 0,
+              prompts: this.prompts.size > 0 ? {} : void 0,
+              resources: this.resources.size > 0 ? {} : void 0
+            }
+          });
+        case "ping":
+          return this.success(message.id, {});
+        case "tools/list":
+          if (this.tools.size === 0) return this.success(message.id, { tools: [] });
+          return this.success(message.id, {
+            tools: Array.from(this.tools.values()).map((t) => ({
+              name: t.name,
+              description: t.description,
+              inputSchema: t.inputSchema || { type: "object", properties: {} }
+            }))
+          });
+        case "tools/call": {
+          if (!message.params || !message.params.name) {
+            return this.error(message.id, -32602, "Invalid params: name required");
+          }
+          const tool = this.tools.get(message.params.name);
+          if (!tool) {
+            return this.error(message.id, -32601, `Tool not found: ${message.params.name}`);
+          }
           try {
-            const db = ctx.app?.db;
-            if (!db) return;
-            const timestamp = Date.now();
-            await db.upsert(new RecordId("middleware_tracking", {
-              timestamp,
-              name: handlerName
-            }), {
-              name: handlerName,
-              path: ctx.path,
-              timestamp,
-              duration,
-              file,
-              line,
-              error: error ? String(error) : void 0,
-              metadata: {
-                isBuiltin,
-                pluginName
+            const result = await tool.handler(message.params.arguments || {});
+            return this.success(message.id, result);
+          } catch (e) {
+            return {
+              jsonrpc: "2.0",
+              id: message.id ?? null,
+              result: {
+                isError: true,
+                content: [{ type: "text", text: e.message || String(e) }]
               }
-            });
-          } catch (err) {
+            };
           }
-        });
+        }
+        case "prompts/list":
+          if (this.prompts.size === 0) return this.success(message.id, { prompts: [] });
+          return this.success(message.id, {
+            prompts: Array.from(this.prompts.values()).map((p) => ({
+              name: p.name,
+              description: p.description,
+              arguments: p.arguments
+            }))
+          });
+        case "prompts/get": {
+          if (!message.params || !message.params.name) {
+            return this.error(message.id, -32602, "Invalid params: name required");
+          }
+          const prompt = this.prompts.get(message.params.name);
+          if (!prompt) {
+            return this.error(message.id, -32601, `Prompt not found: ${message.params.name}`);
+          }
+          const result = await prompt.handler(message.params.arguments || {});
+          return this.success(message.id, result);
+        }
+        case "resources/list":
+          if (this.resources.size === 0) return this.success(message.id, { resources: [] });
+          return this.success(message.id, {
+            resources: Array.from(this.resources.values()).map((r) => ({
+              uri: r.uri,
+              name: r.name,
+              description: r.description,
+              mimeType: r.mimeType
+            }))
+          });
+        case "resources/read": {
+          if (!message.params || !message.params.uri) {
+            return this.error(message.id, -32602, "Invalid params: uri required");
+          }
+          let resource = this.resources.get(message.params.uri);
+          if (!resource) {
+            return this.error(message.id, -32601, `Resource not found: ${message.params.uri}`);
+          }
+          const result = await resource.handler(message.params.uri);
+          return this.success(message.id, result);
+        }
+        default:
+          if (message.id === void 0) return null;
+          return this.error(message.id, -32601, "Method not found");
       }
+    } catch (err) {
+      return this.error(message.id, -32603, "Internal Error", err.message);
+    }
+  }
+  success(id, result) {
+    return {
+      jsonrpc: "2.0",
+      id: id ?? null,
+      result
+    };
+  }
+  error(id, code, message, data) {
+    return {
+      jsonrpc: "2.0",
+      id: id ?? null,
+      error: { code, message, data }
     };
-    trackedHandler.metadata = handler.metadata || context2;
-    Object.defineProperty(trackedHandler, "name", { value: handlerName });
-    trackedHandler.originalHandler = handler.originalHandler || handler;
-    return trackedHandler;
+  }
+}
+class MiddlewareTracker {
+  static wrap(handler, context) {
+    const { file: file2, line, name, isBuiltin, pluginName } = context;
+    const handlerName = name || handler.name || "anonymous";
+    try {
+      handler.metadata = context;
+      if (!handler.name || handler.name === "anonymous") {
+        try {
+          Object.defineProperty(handler, "name", { value: handlerName, configurable: true });
+        } catch (e) {
+        }
+      }
+    } catch (e) {
+      const wrapped = handler.bind(null);
+      wrapped.metadata = context;
+      Object.defineProperty(wrapped, "name", { value: handlerName });
+      wrapped.originalHandler = handler.originalHandler || handler;
+      return wrapped;
+    }
+    return handler;
   }
 }
 class ShokupanRequestBase {
@@ -2104,6 +2856,15 @@ class ShokupanRequestBase {
       this.headers = new Headers(this.headers);
     }
   }
+  clone() {
+    return new ShokupanRequest({
+      method: this.method,
+      url: this.url,
+      headers: new Headers(this.headers),
+      body: this.body
+      // Shallow copy of body, might need deep copy if object
+    });
+  }
 }
 const ShokupanRequest = ShokupanRequestBase;
 class RouterTrie {
@@ -2269,9 +3030,6 @@ class ShokupanRouter {
     return this._hasAfterValidateHook;
   }
   requestTimeout;
-  get db() {
-    return this.root?.db;
-  }
   hookCache = /* @__PURE__ */ new Map();
   hooksInitialized = false;
   middleware = [];
@@ -2286,6 +3044,7 @@ class ShokupanRouter {
   trie = new RouterTrie();
   metadata;
   // Metadata for the router itself
+  mcpProtocol = new McpProtocol();
   currentGuards = [];
   eventHandlers = /* @__PURE__ */ new Map();
   /**
@@ -2297,7 +3056,7 @@ class ShokupanRouter {
     return this;
   }
   // Registry Accessor
-  getComponentRegistry() {
+  get registry() {
     const controllerRoutesMap = /* @__PURE__ */ new Map();
     const localRoutes = [];
     for (let i = 0; i < this[$routes].length; i++) {
@@ -2333,7 +3092,7 @@ class ShokupanRouter {
       type: "router",
       path: r[$mountPath].startsWith("/") ? r[$mountPath] : "/" + r[$mountPath],
       metadata: r.metadata,
-      children: r.getComponentRegistry()
+      children: r.registry
     }));
     const controllers = this[$childControllers].map((c) => {
       const routes = controllerRoutesMap.get(c) || [];
@@ -2411,6 +3170,39 @@ class ShokupanRouter {
     handlers.push(handler);
     return this;
   }
+  /**
+   * Registers an MCP Tool.
+   */
+  tool(name, schema, handler) {
+    this.mcpProtocol.addTool({
+      name,
+      inputSchema: schema,
+      handler
+    });
+    return this;
+  }
+  /**
+   * Registers an MCP Prompt.
+   */
+  prompt(name, args, handler) {
+    this.mcpProtocol.addPrompt({
+      name,
+      arguments: args,
+      handler
+    });
+    return this;
+  }
+  /**
+   * Registers an MCP Resource.
+   */
+  resource(uri, options, handler) {
+    this.mcpProtocol.addResource({
+      uri,
+      handler,
+      ...options
+    });
+    return this;
+  }
   /**
    * Finds an event handler(s) by name.
    */
@@ -2428,7 +3220,7 @@ class ShokupanRouter {
   /**
    * Registers a controller instance to the router.
    */
-  registerControllerInstance(controller) {
+  bindController(controller) {
     this[$childControllers].push(controller);
   }
   /**
@@ -2709,63 +3501,52 @@ class ShokupanRouter {
         }
       }
     }
-    let wrappedHandler = async (ctx) => {
-      return handler(ctx);
-    };
-    wrappedHandler.originalHandler = handler.originalHandler || handler;
-    const routeGuards = [...this.currentGuards];
     const effectiveTimeout = requestTimeout ?? this.requestTimeout ?? this.rootConfig?.requestTimeout;
-    if (effectiveTimeout !== void 0 && effectiveTimeout > 0) {
-      const originalHandler = wrappedHandler;
+    const effectiveRenderer = renderer ?? this.config?.renderer ?? this.rootConfig?.renderer;
+    const routeGuards = [...this.currentGuards];
+    let wrappedHandler = handler;
+    if (effectiveTimeout && effectiveTimeout > 0 || effectiveRenderer || routeGuards.length > 0) {
+      const originalHandler = handler;
       wrappedHandler = async (ctx) => {
-        if (ctx.server) {
+        if (effectiveTimeout && effectiveTimeout > 0 && ctx.server) {
           ctx.server.timeout(ctx.req, effectiveTimeout / 1e3);
         }
-        return originalHandler(ctx);
-      };
-      wrappedHandler.originalHandler = originalHandler.originalHandler || originalHandler;
-    }
-    if (routeGuards.length > 0) {
-      const innerHandler = wrappedHandler;
-      wrappedHandler = async (ctx) => {
-        for (let i = 0; i < routeGuards.length; i++) {
-          const guard = routeGuards[i];
-          let guardPassed = false;
-          let nextCalled = false;
-          const next = () => {
-            nextCalled = true;
-            return Promise.resolve();
-          };
-          try {
-            const result = await guard.handler(ctx, next);
-            if (result === true || nextCalled) {
-              guardPassed = true;
-            } else if (result !== void 0 && result !== null && result !== false) {
-              return result;
-            } else {
+        if (effectiveRenderer) {
+          ctx.setRenderer(effectiveRenderer);
+        }
+        if (routeGuards.length > 0) {
+          for (let i = 0; i < routeGuards.length; i++) {
+            const guard = routeGuards[i];
+            let guardPassed = false;
+            let nextCalled = false;
+            const next = () => {
+              nextCalled = true;
+              return Promise.resolve();
+            };
+            try {
+              const result = await guard.handler(ctx, next);
+              if (result === true || nextCalled) {
+                guardPassed = true;
+              } else if (result !== void 0 && result !== null && result !== false) {
+                return result;
+              } else {
+                return ctx.json({ error: "Forbidden" }, 403);
+              }
+            } catch (error) {
+              throw error;
+            }
+            if (!guardPassed) {
               return ctx.json({ error: "Forbidden" }, 403);
             }
-          } catch (error) {
-            throw error;
-          }
-          if (!guardPassed) {
-            return ctx.json({ error: "Forbidden" }, 403);
           }
         }
-        return innerHandler(ctx);
-      };
-    }
-    const effectiveRenderer = renderer ?? this.config?.renderer ?? this.rootConfig?.renderer;
-    if (effectiveRenderer) {
-      const innerHandler = wrappedHandler;
-      wrappedHandler = async (ctx) => {
-        ctx.setRenderer(effectiveRenderer);
-        return innerHandler(ctx);
+        return originalHandler(ctx);
       };
+      wrappedHandler.originalHandler = handler.originalHandler || handler;
     }
-    const { file, line } = metadata || getCallerInfo();
+    const { file: file2, line } = metadata || getCallerInfo();
     wrappedHandler = MiddlewareTracker.wrap(wrappedHandler, {
-      file,
+      file: file2,
       line,
       name: handler.name || "anonymous",
       isBuiltin: handler.isBuiltin,
@@ -2788,7 +3569,7 @@ class ShokupanRouter {
       requestTimeout,
       renderer,
       metadata: {
-        file,
+        file: file2,
         line
       },
       controller,
@@ -2828,7 +3609,7 @@ class ShokupanRouter {
   guard(specOrHandler, handler) {
     const spec = typeof specOrHandler === "function" ? void 0 : specOrHandler;
     const guardHandler = typeof specOrHandler === "function" ? specOrHandler : handler;
-    let file = "unknown";
+    let file2 = "unknown";
     let line = 0;
     try {
       const err = new Error();
@@ -2839,14 +3620,14 @@ class ShokupanRouter {
       if (callerLine) {
         const match = callerLine.match(/\((.{0,1000}):(\d{1,10}):(?:\d{1,10})\)/) || callerLine.match(/at (.{0,1000}):(\d{1,10}):(?:\d{1,10})/);
         if (match) {
-          file = match[1];
+          file2 = match[1];
           line = parseInt(match[2], 10);
         }
       }
     } catch (e) {
     }
     const trackedGuard = MiddlewareTracker.wrap(guardHandler, {
-      file,
+      file: file2,
       line,
       name: guardHandler.name || "guard"
     });
@@ -3005,68 +3786,6 @@ class ShokupanRouter {
     }
   }
 }
-function createHttpServer() {
-  return async (options) => {
-    const server = http$1.createServer(async (req, res) => {
-      const url = new URL(req.url, `http://${req.headers.host}`);
-      const request = new Request(url.toString(), {
-        method: req.method,
-        headers: req.headers,
-        body: ["GET", "HEAD"].includes(req.method) ? void 0 : new ReadableStream({
-          start(controller) {
-            req.on("data", (chunk) => controller.enqueue(chunk));
-            req.on("end", () => controller.close());
-            req.on("error", (err) => controller.error(err));
-          }
-        }),
-        // Required for Node.js undici when sending a body
-        duplex: "half"
-      });
-      const response = await options.fetch(request, fauxServer);
-      res.statusCode = response.status;
-      response.headers.forEach((v, k) => res.setHeader(k, v));
-      if (response.body) {
-        const buffer = await response.arrayBuffer();
-        res.end(Buffer.from(buffer));
-      } else {
-        res.end();
-      }
-    });
-    const fauxServer = {
-      stop: () => {
-        server.close();
-        return Promise.resolve();
-      },
-      upgrade(req, options2) {
-        return false;
-      },
-      reload(options2) {
-        return fauxServer;
-      },
-      get port() {
-        const addr = server.address();
-        if (typeof addr === "object" && addr !== null) {
-          return addr.port;
-        }
-        return options.port;
-      },
-      hostname: options.hostname,
-      development: options.development,
-      pendingRequests: 0,
-      requestIP: (req) => null,
-      publish: () => 0,
-      subscriberCount: () => 0,
-      url: new URL(`http://${options.hostname}:${options.port}`),
-      // Expose the raw Node.js server for generic socket/websocket support (e.g. Socket.IO)
-      nodeServer: server
-    };
-    return new Promise((resolve2) => {
-      server.listen(options.port, options.hostname, () => {
-        resolve2(fauxServer);
-      });
-    });
-  };
-}
 class BunAdapter {
   server;
   async listen(port, app) {
@@ -3203,43 +3922,161 @@ class BunAdapter {
 class NodeAdapter {
   server;
   async listen(port, app) {
-    let factory = app.applicationConfig.serverFactory;
-    if (!factory) {
-      factory = createHttpServer();
-    }
-    const serveOptions = {
-      port,
-      hostname: app.applicationConfig.hostname,
-      development: app.applicationConfig.development,
-      fetch: app.fetch.bind(app),
-      reusePort: app.applicationConfig.reusePort
-      // Node adapter might not support all options exactly the same
-    };
-    this.server = await factory(serveOptions);
-    return this.server;
-  }
-  async stop() {
-    if (this.server?.stop) {
-      await this.server.stop();
-    }
-  }
-}
-let fs;
-class DefaultFileSystemAdapter {
-  async readFile(path) {
-    if (typeof Bun !== "undefined") {
-      return Bun.file(path);
-    } else {
-      fs ??= await import("node:fs/promises");
-      return fs.readFile(path);
+    const factory = app.applicationConfig.serverFactory;
+    let nodeServer;
+    if (factory) {
+      const serveOptions = {
+        port,
+        hostname: app.applicationConfig.hostname,
+        development: app.applicationConfig.development,
+        fetch: app.fetch.bind(app),
+        reusePort: app.applicationConfig.reusePort
+      };
+      this.server = await factory(serveOptions);
+      return this.server;
     }
-  }
+    nodeServer = http$1.createServer(async (req, res) => {
+      const url = new URL(req.url, `http://${req.headers.host}`);
+      const request = new Request(url.toString(), {
+        method: req.method,
+        headers: req.headers,
+        body: ["GET", "HEAD"].includes(req.method) ? void 0 : new ReadableStream({
+          start(controller) {
+            req.on("data", (chunk) => controller.enqueue(chunk));
+            req.on("end", () => controller.close());
+            req.on("error", (err) => controller.error(err));
+          }
+        }),
+        // Required for Node.js undici when sending a body
+        // @ts-ignore
+        duplex: "half"
+      });
+      const response = await app.fetch(request, fauxServer);
+      res.statusCode = response.status;
+      response.headers.forEach((v, k) => res.setHeader(k, v));
+      if (response.body) {
+        const buffer = await response.arrayBuffer();
+        res.end(Buffer.from(buffer));
+      } else {
+        res.end();
+      }
+    });
+    this.server = nodeServer;
+    const fauxServer = {
+      stop: () => {
+        nodeServer.close();
+        return Promise.resolve();
+      },
+      upgrade(req, options) {
+        return false;
+      },
+      reload(options) {
+        return fauxServer;
+      },
+      get port() {
+        const addr = nodeServer.address();
+        if (typeof addr === "object" && addr !== null) {
+          return addr.port;
+        }
+        return port;
+      },
+      hostname: app.applicationConfig.hostname || "localhost",
+      development: app.applicationConfig.development || false,
+      pendingRequests: 0,
+      requestIP: (req) => null,
+      publish: () => 0,
+      subscriberCount: () => 0,
+      url: new URL(`http://${app.applicationConfig.hostname || "localhost"}:${port}`),
+      // Expose the raw Node.js server
+      // @ts-ignore
+      nodeServer
+    };
+    return new Promise((resolve2) => {
+      nodeServer.listen(port, app.applicationConfig.hostname, () => {
+        resolve2(fauxServer);
+      });
+    });
+  }
+  async stop() {
+    if (this.server?.stop) {
+      await this.server.stop();
+    } else if (this.server?.close) {
+      this.server.close();
+    }
+  }
+}
+class ShokupanServer {
+  constructor(app) {
+    this.app = app;
+  }
+  server;
+  adapter;
+  /**
+   * Starts the application server.
+   * @param port The port to listen on.
+   */
+  async listen(port) {
+    const config = this.app.applicationConfig;
+    const finalPort = port ?? config.port ?? 3e3;
+    if (finalPort < 0 || finalPort > 65535 || finalPort % 1 !== 0) {
+      throw new Error("Invalid port number");
+    }
+    await this.app.start();
+    let adapterName = config.adapter;
+    let adapter;
+    if (!adapterName) {
+      if (typeof Bun !== "undefined") {
+        config.adapter = "bun";
+        adapter = new BunAdapter();
+      } else {
+        config.adapter = "node";
+        adapter = new NodeAdapter();
+      }
+    } else if (adapterName === "bun") {
+      adapter = new BunAdapter();
+    } else if (adapterName === "node") {
+      adapter = new NodeAdapter();
+    } else if (adapterName === "wintercg") {
+      throw new Error("WinterCG adapter does not support listen(). Use fetch directly.");
+    } else {
+      adapter = new NodeAdapter();
+    }
+    this.adapter = adapter;
+    this.app.compile();
+    this.server = await adapter.listen(finalPort, this.app);
+    if (finalPort === 0 && this.server?.port) {
+      config.port = this.server.port;
+    }
+    return this.server;
+  }
+  /**
+   * Stops the server.
+   */
+  async stop(closeActiveConnections) {
+    if (this.adapter?.stop) {
+      await this.adapter.stop();
+    } else if (this.server?.stop) {
+      await this.server.stop(closeActiveConnections);
+    }
+    this.server = void 0;
+  }
+}
+let fs;
+class DefaultFileSystemAdapter {
+  async readFile(path) {
+    if (typeof Bun !== "undefined") {
+      return Bun.file(path);
+    } else {
+      fs ??= await import("node:fs/promises");
+      return fs.readFile(path);
+    }
+  }
   async stat(path) {
     if (typeof Bun !== "undefined") {
-      const file = Bun.file(path);
+      const file2 = Bun.file(path);
       return {
-        size: file.size,
-        mtime: new Date(file.lastModified)
+        size: file2.size,
+        mtime: new Date(file2.lastModified)
       };
     } else {
       fs ??= await import("node:fs/promises");
@@ -3406,12 +4243,39 @@ class SurrealDatastore {
     return this.db.close();
   }
 }
+const kContext = /* @__PURE__ */ Symbol("kContext");
+let patched = false;
+function enablePromisePatch() {
+  if (patched) return;
+  patched = true;
+  const OriginalPromise = global.Promise;
+  global.Promise = class PatchedPromise extends OriginalPromise {
+    [kContext];
+    constructor(executor) {
+      const store = asyncContext.getStore();
+      const stack = new Error().stack || "No parent stack";
+      super(executor);
+      this[kContext] = {
+        store,
+        stack
+      };
+    }
+  };
+  for (const prop of Object.getOwnPropertyNames(OriginalPromise)) {
+    if (prop !== "prototype" && prop !== "length" && prop !== "name") {
+      if (typeof OriginalPromise[prop] === "function") {
+        global.Promise[prop] = OriginalPromise[prop];
+      }
+    }
+  }
+}
 const defaults = {
   port: 3e3,
   hostname: "localhost",
   development: process.env.NODE_ENV !== "production",
   enableAsyncLocalStorage: false,
   enableHttpBridge: false,
+  enableOpenApiGen: true,
   reusePort: false
 };
 class Shokupan extends ShokupanRouter {
@@ -3423,8 +4287,11 @@ class Shokupan extends ShokupanRouter {
   composedMiddleware;
   cpuMonitor;
   server;
+  httpServer;
   datastore;
   dbPromise;
+  // Performance: Flattened Router Trie
+  rootTrie;
   get db() {
     return this.datastore;
   }
@@ -3439,17 +4306,38 @@ class Shokupan extends ShokupanRouter {
     this[$isApplication] = true;
     this[$appRoot] = this;
     this.applicationConfig = config;
-    const { file, line } = getCallerInfo();
+    const { file: file2, line } = getCallerInfo();
     this.metadata = {
-      file,
+      file: file2,
       line,
       name: "ShokupanApplication"
     };
+    if (this.applicationConfig.defaultSecurityHeaders) {
+      const { SecurityHeaders: SecurityHeaders2 } = require("./plugins/middleware/security-headers");
+      this.use(SecurityHeaders2(this.applicationConfig.defaultSecurityHeaders === true ? {} : this.applicationConfig.defaultSecurityHeaders));
+    }
     if (this.applicationConfig.adapter !== "wintercg") {
       this.dbPromise = this.initDatastore().catch((err) => {
         this.logger?.debug("Failed to initialize default datastore", { error: err });
       });
     }
+    if (this.applicationConfig.enablePromiseMonkeypatch) {
+      enablePromisePatch();
+      const processRef = typeof process !== "undefined" ? process : void 0;
+      if (processRef && processRef.on) {
+        processRef.on("unhandledRejection", (reason, promise) => {
+          const ctx = promise?.[kContext];
+          if (ctx && ctx.store && ctx.store.app === this) {
+            const { requestId } = ctx.store;
+            this.logger.error("Unhandled Rejection in Shokupan Request", {
+              error: reason,
+              requestId,
+              creationStack: ctx.stack
+            });
+          }
+        });
+      }
+    }
   }
   async initDatastore() {
     let engines = this.applicationConfig.surreal?.engines;
@@ -3479,9 +4367,9 @@ class Shokupan extends ShokupanRouter {
    * Adds middleware to the application.
    */
   use(middleware) {
-    const { file, line } = getCallerInfo();
+    const { file: file2, line } = getCallerInfo();
     const wrapped = MiddlewareTracker.wrap(middleware, {
-      file,
+      file: file2,
       line,
       name: middleware.name || "middleware",
       isBuiltin: middleware.isBuiltin,
@@ -3525,16 +4413,17 @@ class Shokupan extends ShokupanRouter {
    * @param port - The port to listen on. If not specified, the port from the configuration is used. If that is not specified, port 3000 is used.
    * @returns The server instance.
    */
-  async listen(port) {
-    const finalPort = port ?? this.applicationConfig.port ?? 3e3;
-    if (finalPort < 0 || finalPort > 65535 || finalPort % 1 !== 0) {
-      throw new Error("Invalid port number");
-    }
+  /**
+   * Prepare the application for listening.
+   * Use this if you want to initialize the app without starting the server immediately.
+   */
+  async start() {
     await Promise.all(this.startupHooks.map((hook) => hook()));
     if (this.applicationConfig.enableOpenApiGen) {
       this.get("/.well-known/openapi.yaml", async (ctx) => {
         try {
           await this.openApiSpecPromise;
+          const { dump } = await import("js-yaml");
           const yaml = dump(this.openApiSpec);
           return ctx.send(yaml, { status: 200, headers: { "content-type": "application/yaml" } });
         } catch (e) {
@@ -3560,13 +4449,13 @@ class Shokupan extends ShokupanRouter {
             auth: config.auth || { type: "none" },
             api: config.api || {
               type: "openapi",
-              url: `${this.applicationConfig.hostname === "localhost" ? "http" : "https"}://${this.applicationConfig.hostname}:${finalPort}/.well-known/openapi.yaml`,
+              url: `${this.applicationConfig.hostname === "localhost" ? "http" : "https"}://${this.applicationConfig.hostname}:${this.applicationConfig.port}/.well-known/openapi.yaml`,
               is_user_authenticated: false
             },
-            logo_url: config.logo_url || `${this.applicationConfig.hostname === "localhost" ? "http" : "https"}://${this.applicationConfig.hostname}:${finalPort}/logo.png`,
+            logo_url: config.logo_url || `${this.applicationConfig.hostname === "localhost" ? "http" : "https"}://${this.applicationConfig.hostname}:${this.applicationConfig.port}/logo.png`,
             // Placeholder default
             contact_email: config.contact_email || pkg.author?.email || "support@example.com",
-            legal_info_url: config.legal_info_url || `${this.applicationConfig.hostname === "localhost" ? "http" : "https"}://${this.applicationConfig.hostname}:${finalPort}/legal`
+            legal_info_url: config.legal_info_url || `${this.applicationConfig.hostname === "localhost" ? "http" : "https"}://${this.applicationConfig.hostname}:${this.applicationConfig.port}/legal`
           };
           return ctx.json(manifest);
         });
@@ -3579,8 +4468,8 @@ class Shokupan extends ShokupanRouter {
             versions: config.versions || [
               {
                 name: this.openApiSpec.info.version || "v1",
-                url: `${this.applicationConfig.hostname === "localhost" ? "http" : "https"}://${this.applicationConfig.hostname}:${finalPort}/`,
-                spec_url: `${this.applicationConfig.hostname === "localhost" ? "http" : "https"}://${this.applicationConfig.hostname}:${finalPort}/.well-known/openapi.yaml`
+                url: `${this.applicationConfig.hostname === "localhost" ? "http" : "https"}://${this.applicationConfig.hostname}:${this.applicationConfig.port}/`,
+                spec_url: `${this.applicationConfig.hostname === "localhost" ? "http" : "https"}://${this.applicationConfig.hostname}:${this.applicationConfig.port}/.well-known/openapi.yaml`
               }
             ]
           };
@@ -3616,28 +4505,20 @@ class Shokupan extends ShokupanRouter {
         await this.asyncApiSpecPromise;
       }
     }
-    if (port === 0 && process.platform === "linux") ;
     if (this.applicationConfig.autoBackpressureFeedback === true) {
       this.cpuMonitor = new SystemCpuMonitor();
       this.cpuMonitor.start();
     }
-    let adapter = this.applicationConfig.adapter;
-    if (!adapter) {
-      if (typeof Bun !== "undefined") {
-        this.applicationConfig.adapter = "bun";
-        adapter = new BunAdapter();
-      } else {
-        this.applicationConfig.adapter = "node";
-        adapter = new NodeAdapter();
-      }
-    } else if (adapter === "bun") {
-      adapter = new BunAdapter();
-    } else if (adapter === "node") {
-      adapter = new NodeAdapter();
-    } else if (adapter === "wintercg") {
-      throw new Error("WinterCG adapter does not support listen(). Use fetch directly.");
-    }
-    this.server = await adapter.listen(finalPort, this);
+  }
+  /**
+   * Starts the application server.
+   * 
+   * @param port - The port to listen on. If not specified, the port from the configuration is used. If that is not specified, port 3000 is used.
+   * @returns The server instance.
+   */
+  async listen(port) {
+    this.httpServer = new ShokupanServer(this);
+    this.server = await this.httpServer.listen(port);
     return this.server;
   }
   /**
@@ -3663,10 +4544,14 @@ class Shokupan extends ShokupanRouter {
       this.cpuMonitor.stop();
       this.cpuMonitor = void 0;
     }
-    if (this.server) {
+    if (this.httpServer !== void 0) {
+      await this.httpServer.stop(closeActiveConnections);
+    } else if (this.server?.stop) {
       await this.server.stop(closeActiveConnections);
-      this.server = void 0;
     }
+    this.server = void 0;
+    const { Container: Container2 } = await Promise.resolve().then(() => di);
+    await Container2.teardown();
   }
   [$dispatch](req) {
     return this.fetch(req);
@@ -3675,6 +4560,9 @@ class Shokupan extends ShokupanRouter {
    * Processes a request by wrapping the standard fetch method.
    */
   async testRequest(options) {
+    if (!this.rootTrie) {
+      this.compile();
+    }
     let url = options.url || options.path || "/";
     if (!url.startsWith("http")) {
       const base = `http://${this.applicationConfig.hostname || "localhost"}:${this.applicationConfig.port || 3e3}`;
@@ -3727,7 +4615,8 @@ class Shokupan extends ShokupanRouter {
    */
   async fetch(req, server) {
     if (this.applicationConfig.enableTracing) {
-      const tracer2 = trace.getTracer("shokupan.application");
+      const { trace, context } = await import("@opentelemetry/api");
+      const tracer = trace.getTracer("shokupan.application");
       const store = asyncContext.getStore();
       const attrs = {
         attributes: {
@@ -3737,7 +4626,7 @@ class Shokupan extends ShokupanRouter {
       };
       const parent = store?.span;
       const ctx = parent ? trace.setSpan(context.active(), parent) : void 0;
-      return tracer2.startActiveSpan(`${req.method} ${new URL(req.url).pathname}`, attrs, ctx, (span) => {
+      return tracer.startActiveSpan(`${req.method} ${new URL(req.url).pathname}`, attrs, ctx, (span) => {
         const ctxStore = new RequestContextStore();
         ctxStore.span = span;
         ctxStore.request = req;
@@ -3745,16 +4634,19 @@ class Shokupan extends ShokupanRouter {
       });
     }
     if (this.applicationConfig.enableAsyncLocalStorage) {
+      const requestId = this.applicationConfig.idGenerator?.() ?? nanoid();
       const ctxStore = new RequestContextStore();
       ctxStore.request = req;
-      return asyncContext.run(ctxStore, () => this.handleRequest(req, server));
+      ctxStore["requestId"] = requestId;
+      ctxStore["app"] = this;
+      return asyncContext.run(ctxStore, () => this.handleRequest(req, server, requestId));
     }
     return this.handleRequest(req, server);
   }
-  async handleRequest(req, server) {
+  async handleRequest(req, server, requestId) {
     const request = req;
     const controller = new AbortController();
-    const ctx = new ShokupanContext(request, server, void 0, this, controller.signal, this.applicationConfig.enableMiddlewareTracking);
+    const ctx = new ShokupanContext(request, server, void 0, this, controller.signal, this.applicationConfig.enableMiddlewareTracking, requestId);
     const handle = async () => {
       if (this.cpuMonitor && this.cpuMonitor.getUsage() > (this.applicationConfig.autoBackpressureLevel ?? 60)) {
         const msg = "Too Many Requests (CPU Backpressure)";
@@ -3775,9 +4667,91 @@ class Shokupan extends ShokupanRouter {
             ctx[$routeMatched] = true;
             ctx.params = match.params;
             if (bodyParsing) await bodyParsing;
+            if (this.applicationConfig.enableMiddlewareTracking) {
+              const handler = match.handler;
+              const meta = handler.metadata;
+              if (meta) {
+                const trackingStartTime = performance.now();
+                const handlerName = meta.name || handler.name || "anonymous";
+                ctx.handlerStack.push({
+                  name: handlerName,
+                  file: meta.file,
+                  line: meta.line,
+                  isBuiltin: meta.isBuiltin,
+                  startTime: trackingStartTime,
+                  duration: -1
+                });
+                try {
+                  const res = await handler(ctx);
+                  const duration = performance.now() - trackingStartTime;
+                  const stackItem = ctx.handlerStack[ctx.handlerStack.length - 1];
+                  if (stackItem) stackItem.duration = duration;
+                  Promise.resolve().then(async () => {
+                    try {
+                      const db = this.db;
+                      if (!db) return;
+                      const timestamp = Date.now();
+                      await db.upsert(new RecordId("middleware_tracking", {
+                        timestamp,
+                        name: handlerName
+                      }), {
+                        name: handlerName,
+                        path: ctx.path,
+                        timestamp,
+                        duration,
+                        file: meta.file,
+                        line: meta.line,
+                        error: void 0,
+                        metadata: {
+                          isBuiltin: meta.isBuiltin,
+                          pluginName: meta.pluginName
+                        }
+                      });
+                    } catch (e) {
+                    }
+                  });
+                  return res;
+                } catch (err) {
+                  const duration = performance.now() - trackingStartTime;
+                  const stackItem = ctx.handlerStack[ctx.handlerStack.length - 1];
+                  if (stackItem) stackItem.duration = duration;
+                  Promise.resolve().then(async () => {
+                    try {
+                      const db = this.db;
+                      if (!db) return;
+                      const timestamp = Date.now();
+                      await db.upsert(new RecordId("middleware_tracking", {
+                        timestamp,
+                        name: handlerName
+                      }), {
+                        name: handlerName,
+                        path: ctx.path,
+                        timestamp,
+                        duration,
+                        file: meta.file,
+                        line: meta.line,
+                        error: String(err),
+                        metadata: {
+                          isBuiltin: meta.isBuiltin,
+                          pluginName: meta.pluginName
+                        }
+                      });
+                    } catch (e) {
+                    }
+                  });
+                  throw err;
+                }
+              }
+            }
             return match.handler(ctx);
           }
-          return null;
+          if (ctx.upgrade()) {
+            return void 0;
+          }
+          if (ctx.response.status !== HTTP_STATUS.OK) {
+            return ctx.send(null, { status: ctx.response.status, headers: ctx.response.headers });
+          }
+          throw new NotFoundError();
         });
         let response;
         if (result instanceof Response) {
@@ -3790,16 +4764,13 @@ class Shokupan extends ShokupanRouter {
           } else if (ctx.isUpgraded) {
             return void 0;
           } else if (ctx[$routeMatched]) {
-            response = ctx.send(null, { status: ctx.response.status, headers: ctx.response.headers });
-          } else {
-            if (ctx.upgrade()) {
-              return void 0;
-            }
-            if (ctx.response.status !== HTTP_STATUS.OK) {
-              response = ctx.send(null, { status: ctx.response.status, headers: ctx.response.headers });
-            } else {
-              response = ctx.text("Not Found", HTTP_STATUS.NOT_FOUND);
+            let status = ctx.response.status;
+            if (status === HTTP_STATUS.OK) {
+              status = HTTP_STATUS.NO_CONTENT;
             }
+            response = ctx.send(null, { status, headers: ctx.response.headers });
+          } else {
+            throw new NotFoundError();
           }
         } else if (typeof result === "object") {
           response = ctx.json(result);
@@ -3819,8 +4790,11 @@ class Shokupan extends ShokupanRouter {
         if (err instanceof SyntaxError && err.message.includes("JSON")) {
           status = 400;
         }
-        const body = { error: err.message || "Internal Server Error" };
-        if (err.errors) body.errors = err.errors;
+        const isDev = this.applicationConfig.development !== false;
+        const message = isDev ? err.message || "Internal Server Error" : "Internal Server Error";
+        const body = { error: message };
+        if (isDev && err.errors) body.errors = err.errors;
+        if (isDev && err.stack) body.stack = err.stack;
         if (this.hasOnErrorHook) await this.runHooks("onError", ctx, err);
         return ctx.json(body, status);
       }
@@ -3849,6 +4823,72 @@ class Shokupan extends ShokupanRouter {
       return res;
     });
   }
+  /**
+   * Compiles all routes into a master Trie for O(1) router lookup.
+   * Use this if adding routes dynamically after start (not recommended but possible).
+   */
+  compile() {
+    this.rootTrie = new RouterTrie();
+    this.flattenRoutes(this.rootTrie, this, "", []);
+  }
+  flattenRoutes(trie, router, prefix, middlewareStack) {
+    let effectiveStack = middlewareStack;
+    if (router !== this) {
+      effectiveStack = [...middlewareStack, ...router.middleware];
+    }
+    const joinPath = (base, segment) => {
+      let b = base;
+      if (b !== "/" && b.endsWith("/")) {
+        b = b.slice(0, -1);
+      }
+      let s = segment;
+      if (s === "/") {
+        return b;
+      }
+      if (s === "") {
+        return b;
+      }
+      if (!s.startsWith("/")) {
+        s = "/" + s;
+      }
+      if (b === "/") {
+        return s;
+      }
+      return b + s;
+    };
+    for (const route of router[$routes]) {
+      const fullPath = joinPath(prefix, route.path);
+      let handler = route.bakedHandler || route.handler;
+      if (effectiveStack.length > 0) {
+        const fn = compose(effectiveStack);
+        const originalHandler = handler;
+        handler = async (ctx) => {
+          return fn(ctx, () => originalHandler(ctx));
+        };
+        handler.originalHandler = originalHandler.originalHandler || originalHandler;
+      }
+      trie.insert(route.method, fullPath, handler);
+      if ((route.path === "/" || route.path === "") && fullPath !== "/") {
+        trie.insert(route.method, fullPath + "/", handler);
+      }
+    }
+    for (const child of router[$childRouters]) {
+      const mountPath = child[$mountPath];
+      const childPrefix = joinPath(prefix, mountPath);
+      this.flattenRoutes(trie, child, childPrefix, effectiveStack);
+    }
+  }
+  find(method, path) {
+    if (this.rootTrie) {
+      const result = this.rootTrie.search(method, path);
+      if (result) return result;
+      if (method === "HEAD") {
+        return this.rootTrie.search("GET", path);
+      }
+      return null;
+    }
+    return super.find(method, path);
+  }
 }
 function RateLimitMiddleware(options = {}) {
   const windowMs = options.windowMs || 60 * 1e3;
@@ -3858,6 +4898,7 @@ function RateLimitMiddleware(options = {}) {
   const headers = options.headers !== false;
   const mode = options.mode || "user";
   const trustedProxies = options.trustedProxies || [];
+  const cleanupInterval = options.cleanupInterval || windowMs;
   const keyGenerator = options.keyGenerator || ((ctx) => {
     if (mode === "absolute") {
       return "global";
@@ -3887,7 +4928,7 @@ function RateLimitMiddleware(options = {}) {
         hits.delete(key);
       }
     }
-  }, windowMs);
+  }, cleanupInterval);
   if (interval.unref) interval.unref();
   const rateLimitMiddleware = async function RateLimitMiddleware2(ctx, next) {
     if (skip(ctx)) return next();
@@ -3944,8 +4985,79 @@ function Controller(path = "/") {
     target[$controllerPath] = path;
   };
 }
-function Use(...middleware) {
-  return (target, propertyKey, descriptor) => {
+function Injectable(scope = "singleton") {
+  return (target) => {
+    Reflect.defineMetadata("di:scope", scope, target);
+  };
+}
+function Inject(token) {
+  return (target, propertyKey, indexOrDescriptor) => {
+    if (typeof indexOrDescriptor === "undefined" || typeof indexOrDescriptor === "object" && indexOrDescriptor !== null) {
+      const key = String(propertyKey);
+      Object.defineProperty(target, key, {
+        get: () => Container.resolve(token),
+        enumerable: true,
+        configurable: true
+      });
+      return;
+    }
+    if (typeof indexOrDescriptor === "number") {
+      const index = indexOrDescriptor;
+      const existing = Reflect.getMetadata("di:constructor:params", target) || [];
+      existing.push({ index, token });
+      Reflect.defineMetadata("di:constructor:params", existing, target);
+    }
+  };
+}
+function Use(tokenOrMiddleware, ...moreMiddleware) {
+  return (target, propertyKey, indexOrDescriptor) => {
+    if (typeof indexOrDescriptor === "number") {
+      const index = indexOrDescriptor;
+      if (!propertyKey) {
+        let token2 = tokenOrMiddleware;
+        if (!token2) {
+          const paramTypes = Reflect.getMetadata("design:paramtypes", target);
+          if (paramTypes && paramTypes[index]) {
+            token2 = paramTypes[index];
+          }
+        }
+        const existing = Reflect.getMetadata("di:constructor:params", target) || [];
+        existing.push({ index, token: token2 });
+        Reflect.defineMetadata("di:constructor:params", existing, target);
+        return;
+      }
+      if (!target[$routeArgs]) target[$routeArgs] = /* @__PURE__ */ new Map();
+      if (!target[$routeArgs].has(propertyKey)) target[$routeArgs].set(propertyKey, []);
+      let token = tokenOrMiddleware;
+      if (!token) {
+        const paramTypes = Reflect.getMetadata("design:paramtypes", target, propertyKey);
+        if (paramTypes && paramTypes[index]) {
+          token = paramTypes[index];
+        }
+      }
+      target[$routeArgs].get(propertyKey).push({
+        index,
+        type: RouteParamType.SERVICE,
+        token
+      });
+      return;
+    }
+    if (typeof propertyKey === "string" && indexOrDescriptor === void 0) {
+      let token = tokenOrMiddleware;
+      if (!token) {
+        token = Reflect.getMetadata("design:type", target, propertyKey);
+      }
+      Object.defineProperty(target, propertyKey, {
+        get: () => {
+          if (!token) throw new Error(`Cannot resolve dependency for ${target.constructor.name}.${propertyKey} - no token provided and types unavailable.`);
+          return Container.resolve(token);
+        },
+        enumerable: true,
+        configurable: true
+      });
+      return;
+    }
+    const middleware = [tokenOrMiddleware, ...moreMiddleware];
     if (!propertyKey) {
       const existing = target[$middleware] || [];
       target[$middleware] = [...existing, ...middleware];
@@ -4025,7 +5137,38 @@ function Event(eventName) {
 function RateLimit(options) {
   return Use(RateLimitMiddleware(options));
 }
-function ApiExplorerApp({ spec, asyncSpec, config }) {
+function Tool(options) {
+  return (target, propertyKey, descriptor) => {
+    target[$mcpTools] ??= /* @__PURE__ */ new Map();
+    target[$mcpTools].set(propertyKey, {
+      name: options?.name,
+      description: options?.description,
+      inputSchema: options?.inputSchema
+    });
+  };
+}
+function Prompt(options) {
+  return (target, propertyKey, descriptor) => {
+    target[$mcpPrompts] ??= /* @__PURE__ */ new Map();
+    target[$mcpPrompts].set(propertyKey, {
+      name: options?.name,
+      description: options?.description,
+      arguments: options?.arguments
+    });
+  };
+}
+function Resource(uri, options) {
+  return (target, propertyKey, descriptor) => {
+    target[$mcpResources] ??= /* @__PURE__ */ new Map();
+    target[$mcpResources].set(propertyKey, {
+      uri,
+      name: options?.name,
+      description: options?.description,
+      mimeType: options?.mimeType
+    });
+  };
+}
+function ApiExplorerApp({ spec, base, asyncSpec, config }) {
   const hierarchy = /* @__PURE__ */ new Map();
   const addRoute = (groupKey, route) => {
     if (!hierarchy.has(groupKey)) {
@@ -4211,8 +5354,8 @@ function ApiExplorerApp({ spec, asyncSpec, config }) {
       /* @__PURE__ */ jsx("link", { rel: "preconnect", href: "https://fonts.googleapis.com" }),
       /* @__PURE__ */ jsx("link", { rel: "preconnect", href: "https://fonts.gstatic.com", crossorigin: "anonymous" }),
       /* @__PURE__ */ jsx("link", { href: "https://fonts.googleapis.com/css2?family=Google+Sans+Code:ital,wght@0,300..800;1,300..800&family=Vend+Sans:ital,wght@0,300..700;1,300..700&display=swap", rel: "stylesheet" }),
-      /* @__PURE__ */ jsx("link", { rel: "stylesheet", href: "style.css" }),
-      /* @__PURE__ */ jsx("link", { rel: "stylesheet", href: "theme.css" }),
+      /* @__PURE__ */ jsx("link", { rel: "stylesheet", href: `${base}/style.css` }),
+      /* @__PURE__ */ jsx("link", { rel: "stylesheet", href: `${base}/theme.css` }),
       /* @__PURE__ */ jsx("script", { src: "https://cdn.jsdelivr.net/npm/marked@4.3.0/marked.min.js" }),
       /* @__PURE__ */ jsx("script", { src: "https://cdn.jsdelivr.net/npm/monaco-editor@0.45.0/min/vs/loader.js" }),
       /* @__PURE__ */ jsx("script", { dangerouslySetInnerHTML: {
@@ -4232,7 +5375,7 @@ function ApiExplorerApp({ spec, asyncSpec, config }) {
         /* @__PURE__ */ jsx(Sidebar$1, { spec, hierarchicalGroups }),
         /* @__PURE__ */ jsx(MainContent$1, { allRoutes, config, spec })
       ] }),
-      /* @__PURE__ */ jsx("script", { src: "explorer-client.mjs", type: "module" })
+      /* @__PURE__ */ jsx("script", { src: `${base}/explorer-client.mjs`, type: "module" })
     ] })
   ] });
 }
@@ -4392,8 +5535,8 @@ class ApiExplorerPlugin extends ShokupanRouter {
     return dir;
   }
   init() {
-    const serveFile = async (ctx, file, type) => {
-      const content = await readFile$1(join$1(ApiExplorerPlugin.getBasePath(), "static", file), "utf-8");
+    const serveFile = async (ctx, file2, type) => {
+      const content = await readFile$1(join$1(ApiExplorerPlugin.getBasePath(), "static", file2), "utf-8");
       ctx.set("Content-Type", type);
       return ctx.send(content);
     };
@@ -4416,10 +5559,16 @@ class ApiExplorerPlugin extends ShokupanRouter {
     this.get("/theme.css", (ctx) => serveFile(ctx, "theme.css", "text/css"));
     this.get("/explorer-client.mjs", (ctx) => serveFile(ctx, "explorer-client.mjs", "application/javascript"));
     this.get("/_source", async (ctx) => {
-      const file = ctx.query["file"];
-      if (!file) return ctx.text("Missing file parameter", 400);
+      const file2 = ctx.query["file"];
+      if (!file2) return ctx.text("Missing file parameter", 400);
+      const { resolve: resolve2, normalize, isAbsolute } = await import("node:path");
+      const cwd = process.cwd();
+      const resolvedPath = resolve2(cwd, file2);
+      if (!resolvedPath.startsWith(cwd)) {
+        return ctx.text("Forbidden: File must be within project root", 403);
+      }
       try {
-        const content = await readFile$1(file, "utf-8");
+        const content = await readFile$1(resolvedPath, "utf-8");
         return ctx.text(content);
       } catch (err) {
         return ctx.text("File not found", 404);
@@ -4432,7 +5581,8 @@ class ApiExplorerPlugin extends ShokupanRouter {
     this.get("/", async (ctx) => {
       const spec = this.root.openApiSpec ? structuredClone(this.root.openApiSpec) : await (this.root || this).generateApiSpec();
       const asyncSpec = ctx.app.asyncApiSpec;
-      const element = ApiExplorerApp({ spec: stripSourceCode(spec), asyncSpec });
+      const base = this.pluginOptions.path;
+      const element = ApiExplorerApp({ spec: stripSourceCode(spec), base, asyncSpec });
       const html = renderToString(element);
       if (html.length === 0) throw new Error("ApiExplorerPlugin: rendered page is blank.");
       return ctx.html(html);
@@ -4474,12 +5624,12 @@ function AsyncApiApp({ spec, serverUrl, base, disableSourceView, navTree }) {
   ] });
 }
 function Sidebar({ navTree, disableSourceView }) {
-  return /* @__PURE__ */ jsxs("div", { class: "sidebar scroller", id: "sidebar", children: [
+  return /* @__PURE__ */ jsxs("div", { class: "sidebar", id: "sidebar", children: [
     /* @__PURE__ */ jsxs("div", { class: "sidebar-header", style: "display:flex; justify-content:space-between; align-items:center;", children: [
       /* @__PURE__ */ jsx("h2", { children: "AsyncAPI" }),
       /* @__PURE__ */ jsx("button", { id: "btn-collapse-nav", class: "btn-icon", title: "Collapse Sidebar", children: /* @__PURE__ */ jsx("svg", { width: "18", height: "18", viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", "stroke-width": "2", children: /* @__PURE__ */ jsx("polyline", { points: "15 18 9 12 15 6" }) }) })
     ] }),
-    /* @__PURE__ */ jsx("div", { class: "nav-list", id: "nav-list", children: /* @__PURE__ */ jsx(NavNode, { node: navTree, level: 0, disableSourceView }) })
+    /* @__PURE__ */ jsx("div", { class: "nav-list scroller", id: "nav-list", children: /* @__PURE__ */ jsx(NavNode, { node: navTree, level: 0, disableSourceView }) })
   ] });
 }
 function NavNode({ node, level, disableSourceView }) {
@@ -4649,7 +5799,7 @@ async function generateAsyncApi(rootRouter, options = {}) {
   let astMiddlewareRegistry = {};
   let applications = [];
   try {
-    const { OpenAPIAnalyzer: OpenAPIAnalyzer2 } = await import("./analyzer-CnKnQ5KV.js");
+    const { OpenAPIAnalyzer: OpenAPIAnalyzer2 } = await import("./analyzer-B0fMzeIo.js");
     const entrypoint = globalThis.Bun?.main || require.main?.filename || process.argv[1];
     const analyzer = new OpenAPIAnalyzer2(process.cwd(), entrypoint);
     const analysisResult = await analyzer.analyze();
@@ -5022,8 +6172,8 @@ class AsyncApiPlugin extends ShokupanRouter {
     }
   }
   init() {
-    const serveFile = async (ctx, file, type) => {
-      const content = await readFile(join$1(AsyncApiPlugin.getBasePath(), "static", file), "utf-8");
+    const serveFile = async (ctx, file2, type) => {
+      const content = await readFile(join$1(AsyncApiPlugin.getBasePath(), "static", file2), "utf-8");
       ctx.set("Content-Type", type);
       return ctx.send(content);
     };
@@ -5055,12 +6205,18 @@ class AsyncApiPlugin extends ShokupanRouter {
       return ctx.json(spec);
     });
     this.get("/_code", async (ctx) => {
-      const file = ctx.query["file"];
-      if (!file || typeof file !== "string") {
+      const file2 = ctx.query["file"];
+      if (!file2 || typeof file2 !== "string") {
         return ctx.text("Missing file parameter", 400);
       }
+      const { resolve: resolve2 } = await import("node:path");
+      const cwd = process.cwd();
+      const resolvedPath = resolve2(cwd, file2);
+      if (!resolvedPath.startsWith(cwd)) {
+        return ctx.text("Forbidden: File must be within project root", 403);
+      }
       try {
-        const content = await readFile(file, "utf8");
+        const content = await readFile(resolvedPath, "utf8");
         return ctx.text(content);
       } catch (e) {
         return ctx.text("File not found: " + e.message, 404);
@@ -5115,7 +6271,7 @@ class AuthPlugin extends ShokupanRouter {
     }
   }
   async createSession(user, ctx) {
-    const alg = "HS256";
+    const alg = this.authConfig.jwtAlgorithm || "HS256";
     const jwt = await new this.jose.SignJWT({ ...user }).setProtectedHeader({ alg }).setIssuedAt().setExpirationTime(this.authConfig.jwtExpiration || "24h").sign(this.secret);
     const opts = this.authConfig.cookieOptions || {};
     let cookie = `auth_token=${jwt}; Path=${opts.path || "/"}; HttpOnly`;
@@ -5417,7 +6573,7 @@ class ClusterPlugin {
     }
   }
 }
-function DashboardApp({ metrics, uptime, integrations, base, getRequestHeadersSource, rootPath, linkPattern }) {
+function DashboardApp({ metrics, uptime, integrations, base, getRequestHeadersSource, rootPath, linkPattern, ignorePaths }) {
   return /* @__PURE__ */ jsxs("html", { lang: "en", children: [
     /* @__PURE__ */ jsxs("head", { children: [
       /* @__PURE__ */ jsx("meta", { charSet: "UTF-8" }),
@@ -5527,22 +6683,22 @@ function DashboardApp({ metrics, uptime, integrations, base, getRequestHeadersSo
                 /* @__PURE__ */ jsx("option", { value: "ws", children: "WS" }),
                 /* @__PURE__ */ jsx("option", { value: "other", children: "Other" })
               ] }),
+              /* @__PURE__ */ jsxs("div", { style: "display: flex; align-items: center; gap: 4px; background: var(--bg-primary); padding: 0 8px; border: 1px solid var(--card-border); border-radius: 4px; color: var(--text-primary);", children: [
+                /* @__PURE__ */ jsx("input", { type: "checkbox", id: "network-filter-ignore", checked: true }),
+                /* @__PURE__ */ jsx("label", { for: "network-filter-ignore", style: "cursor: pointer; font-size: 0.9em; user-select: none;", children: "Excl. Ignored" })
+              ] }),
               /* @__PURE__ */ jsx("button", { onclick: "fetchRequests()", style: "background: var(--bg-primary); color: var(--text-primary); border: 1px solid var(--card-border); padding: 4px 8px; border-radius: 4px; cursor: pointer;", children: "Refresh" }),
               /* @__PURE__ */ jsx("button", { onclick: "purgeRequests()", style: "background: var(--bg-primary); color: var(--color-error, #ef4444); border: 1px solid var(--card-border); padding: 4px 8px; border-radius: 4px; cursor: pointer;", children: "Purge" })
             ] }) }),
-            /* @__PURE__ */ jsx("div", { id: "network-view", class: "active", style: "display: block; height: calc(100vh - 170px);", children: /* @__PURE__ */ jsxs("div", { style: "margin: 0 2rem; display: flex; gap: 1rem; height: 100%;", children: [
+            /* @__PURE__ */ jsx("div", { id: "network-view", class: "active", style: "display: block; height: 100%; margin-bottom: 2rem; overflow: hidden;", children: /* @__PURE__ */ jsxs("div", { style: "margin: 0 2rem; display: flex; gap: 1rem; height: 100%;", children: [
               /* @__PURE__ */ jsx("div", { id: "requests-list-container", style: "flex: 1; height: 100%; border-radius: 6px; overflow: hidden; border: 1px solid var(--card-border);" }),
-              /* @__PURE__ */ jsxs("div", { id: "request-details-container", class: "card", style: "display: none; width: 500px; height: 100%; overflow-y: auto; flex-shrink: 0; background: var(--bg-secondary); border: 1px solid var(--card-border); position: relative;", children: [
+              /* @__PURE__ */ jsxs("div", { id: "request-details-container", class: "card", style: "display: none; width: 500px; height: 100%; overflow: hidden; flex-shrink: 0; background: var(--bg-secondary); border: 1px solid var(--card-border); position: relative;", children: [
                 /* @__PURE__ */ jsx("div", { id: "details-drag-handle", style: "position: absolute; left: 0; top: 0; bottom: 0; width: 5px; cursor: col-resize; z-index: 11; background: transparent;" }),
                 /* @__PURE__ */ jsxs("div", { style: "display: flex; justify-content: space-between; align-items: center; position: sticky; top: 0; background: var(--bg-secondary); padding: 0.5rem 1rem; border-bottom: 1px solid var(--border-color); z-index: 10;", children: [
-                  /* @__PURE__ */ jsx("div", { class: "card-title", style: "margin: 0;", children: "Request Details" }),
+                  /* @__PURE__ */ jsx("div", { class: "card-title", style: "margin: 0; padding: 0", children: "Request Details" }),
                   /* @__PURE__ */ jsx("button", { onclick: "closeRequestDetails()", style: "background: transparent; border: none; color: var(--text-secondary); cursor: pointer; font-size: 1.2rem;", children: "×" })
                 ] }),
-                /* @__PURE__ */ jsxs("div", { style: "padding: 1rem;", children: [
-                  /* @__PURE__ */ jsx("div", { id: "request-details-content" }),
-                  /* @__PURE__ */ jsx("div", { class: "card-title", style: "margin-top: 1rem;", children: "Middleware Trace" }),
-                  /* @__PURE__ */ jsx("div", { id: "middleware-trace-container" })
-                ] })
+                /* @__PURE__ */ jsx("div", { style: "display: flex; flex-direction: column; overflow: hidden; height: 100%", children: /* @__PURE__ */ jsx("div", { id: "request-details-content", style: "flex: 1; display: flex; flex-direction: column; height: 100%; overflow: hidden" }) })
               ] })
             ] }) })
           ] }),
@@ -5557,7 +6713,8 @@ function DashboardApp({ metrics, uptime, integrations, base, getRequestHeadersSo
                     const getRequestHeaders = ${getRequestHeadersSource};
                     window.SHOKUPAN_CONFIG = {
                         rootPath: "${rootPath || ""}",
-                        linkPattern: "${linkPattern || ""}"
+                        linkPattern: "${linkPattern || ""}",
+                        ignorePaths: ${JSON.stringify(ignorePaths || [])}
                     };
                 `
       } }),
@@ -5566,7 +6723,6 @@ function DashboardApp({ metrics, uptime, integrations, base, getRequestHeadersSo
       /* @__PURE__ */ jsx("script", { src: `${base}/charts.js` }),
       /* @__PURE__ */ jsx("script", { src: `${base}/tables.js` }),
       /* @__PURE__ */ jsx("script", { src: `${base}/registry.js` }),
-      /* @__PURE__ */ jsx("script", { src: `${base}/failures.js` }),
       /* @__PURE__ */ jsx("script", { src: `${base}/requests.js` }),
       /* @__PURE__ */ jsx("script", { src: `${base}/tabs.js` })
     ] })
@@ -5635,15 +6791,51 @@ const require$1 = createRequire(import.meta.url);
 const http = require$1("node:http");
 const https = require$1("node:https");
 class FetchInterceptor {
+  static originalFetch;
+  static originalHttpRequest;
+  static originalHttpsRequest;
   originalFetch;
   originalHttpRequest;
   originalHttpsRequest;
   callbacks = [];
   isPatched = false;
   constructor() {
-    this.originalFetch = global.fetch;
-    this.originalHttpRequest = http.request;
-    this.originalHttpsRequest = https.request;
+    if (!FetchInterceptor.originalFetch) {
+      if (global.fetch.__isPatched) {
+        console.warn("[FetchInterceptor] Global fetch is already patched! Cannot capture original.");
+      } else {
+        FetchInterceptor.originalFetch = global.fetch;
+        FetchInterceptor.originalHttpRequest = http.request;
+        FetchInterceptor.originalHttpsRequest = https.request;
+      }
+    }
+    this.originalFetch = FetchInterceptor.originalFetch || global.fetch;
+    this.originalHttpRequest = FetchInterceptor.originalHttpRequest || http.request;
+    this.originalHttpsRequest = FetchInterceptor.originalHttpsRequest || https.request;
+  }
+  /**
+   * Statically restore the original network methods.
+   * Useful for cleaning up in tests.
+   */
+  /**
+   * Statically restore the original network methods.
+   * Useful for cleaning up in tests.
+   */
+  static restore() {
+    if (FetchInterceptor.originalFetch) {
+      global.fetch = FetchInterceptor.originalFetch;
+    } else if (global.fetch?.__originalFetch) {
+      global.fetch = global.fetch.__originalFetch;
+    } else if (typeof Bun !== "undefined" && Bun.fetch) {
+      global.fetch = Bun.fetch;
+    }
+    if (FetchInterceptor.originalHttpRequest) {
+      http.request = FetchInterceptor.originalHttpRequest;
+    }
+    if (FetchInterceptor.originalHttpsRequest) {
+      https.request = FetchInterceptor.originalHttpsRequest;
+    }
+    console.log("[FetchInterceptor] Network layer restored (static).");
   }
   /**
    * Patches the global `fetch` function to intercept requests.
@@ -5658,37 +6850,33 @@ class FetchInterceptor {
   }
   patchGlobalFetch() {
     const self = this;
+    if (!this.originalFetch && global.fetch.__isPatched && global.fetch.__originalFetch) {
+      this.originalFetch = global.fetch.__originalFetch;
+    }
     const newFetch = async function(input, init) {
       const startTime = performance.now();
       const timestamp = Date.now();
-      let method = "GET";
       let url = "";
+      let method = "GET";
       let requestHeaders = {};
-      let requestBody = void 0;
       try {
-        if (input instanceof URL$1) {
-          url = input.toString();
-        } else if (typeof input === "string") {
+        if (typeof input === "string") {
           url = input;
-        } else if (typeof input === "object" && "url" in input) {
+        } else if (input instanceof URL$1) {
+          url = input.toString();
+        } else if (input instanceof Request) {
           url = input.url;
           method = input.method;
+          input.headers.forEach((v, k) => requestHeaders[k] = v);
         }
         if (init) {
-          if (init.method) method = init.method;
+          if (init.method) method = init.method.toUpperCase();
           if (init.headers) {
-            if (init.headers instanceof Headers) {
-              init.headers.forEach((v, k) => requestHeaders[k] = v);
-            } else if (Array.isArray(init.headers)) {
-              init.headers.forEach(([k, v]) => requestHeaders[k] = v);
-            } else {
-              Object.assign(requestHeaders, init.headers);
-            }
+            const h = new Headers(init.headers);
+            h.forEach((v, k) => requestHeaders[k] = v);
           }
-          if (init.body) requestBody = init.body;
         }
       } catch (e) {
-        console.warn("[FetchInterceptor] Failed to parse request arguments", e);
       }
       try {
         const response = await self.originalFetch.apply(global, [input, init]);
@@ -5698,14 +6886,11 @@ class FetchInterceptor {
           method,
           url,
           requestHeaders,
-          requestBody,
-          status: response.status,
           startTime: timestamp,
           duration,
-          ...self.extractRequestMeta(url, requestHeaders),
-          protocol: "1.1"
-          // native fetch doesn't expose this easily, assume 1.1/2
-        });
+          status: response.status,
+          ...self.extractRequestMeta(url, requestHeaders)
+        }).catch((err) => console.error("[FetchInterceptor] Error processing response:", err));
         return response;
       } catch (error) {
         const duration = performance.now() - startTime;
@@ -5713,17 +6898,18 @@ class FetchInterceptor {
           method,
           url,
           requestHeaders,
-          requestBody,
           status: 0,
           responseHeaders: {},
-          responseBody: `Network Error: ${String(error)}`,
           startTime: timestamp,
-          duration
+          duration,
+          responseBody: `Error: ${error.message}`,
+          ...self.extractRequestMeta(url, requestHeaders)
         });
         throw error;
       }
     };
-    Object.assign(newFetch, this.originalFetch);
+    newFetch.__isPatched = true;
+    newFetch.__originalFetch = this.originalFetch;
     global.fetch = newFetch;
   }
   patchNodeRequests() {
@@ -6068,6 +7254,9 @@ class Dashboard {
       this.broadcastMetricUpdate(metric);
     };
     this.metricsCollector = new MetricsCollector(this.db, onCollect);
+    if (app.applicationConfig) {
+      app.applicationConfig.enableMiddlewareTracking = true;
+    }
     const fetchInterceptor = new FetchInterceptor();
     fetchInterceptor.patch();
     fetchInterceptor.on((log) => {
@@ -6101,6 +7290,10 @@ class Dashboard {
         responseHeaders: log.responseHeaders
         // No handler stack for outbound
       };
+      const maxLogs = this.dashboardConfig.maxLogEntries ?? 1e3;
+      if (this.metrics.logs.length >= maxLogs) {
+        this.metrics.logs.shift();
+      }
       this.metrics.logs.push(requestData);
       const recordId = new RecordId("request", nanoid());
       const idString = recordId.toString();
@@ -6128,17 +7321,9 @@ class Dashboard {
     }
     this.mountPath = options?.path || this.dashboardConfig.path || "/dashboard";
     const hooks = this.getHooks();
-    if (!app.middleware) {
-      app.middleware = [];
+    if (hooks.onRequestStart) {
+      app.hook("onRequestStart", hooks.onRequestStart);
     }
-    const hooksMiddleware = async (ctx, next) => {
-      if (hooks.onRequestStart) {
-        await hooks.onRequestStart(ctx);
-      }
-      ctx._startTime = performance.now();
-      await next();
-    };
-    app.use(hooksMiddleware);
     if (hooks.onResponseEnd) {
       app.hook("onResponseEnd", hooks.onResponseEnd);
     }
@@ -6385,7 +7570,7 @@ class Dashboard {
       if (!this.instrumented && app) {
         this.instrumentApp(app);
       }
-      const registry = app?.getComponentRegistry?.();
+      const registry = app?.registry;
       if (registry) {
         this.assignIdsToRegistry(registry, "root");
       }
@@ -6422,26 +7607,51 @@ class Dashboard {
     });
     this.router.post("/replay", async (ctx) => {
       const body = await ctx.body();
-      const app = this[$appRoot];
-      if (!app) return unknownError(ctx);
-      try {
-        const result = await app.processRequest({
-          method: body.method,
-          path: body.url,
-          // or path
-          headers: body.headers,
-          body: body.body
-        });
-        return ctx.json({
-          status: result.status,
-          headers: result.headers,
-          data: result.data
-        });
-      } catch (e) {
-        return ctx.json({ error: String(e) }, 500);
-      }
-    });
-    this.router.get("/**", async (ctx) => {
+      const direction = body.direction || "inbound";
+      if (direction === "outbound") {
+        const start = performance.now();
+        try {
+          const res = await fetch(body.url, {
+            method: body.method,
+            headers: body.headers,
+            body: body.body ? typeof body.body === "object" ? JSON.stringify(body.body) : body.body : void 0
+          });
+          const text = await res.text();
+          const duration = performance.now() - start;
+          const resHeaders = {};
+          res.headers.forEach((v, k) => resHeaders[k] = v);
+          return ctx.json({
+            status: res.status,
+            statusText: res.statusText,
+            headers: resHeaders,
+            data: text,
+            duration
+          });
+        } catch (e) {
+          return ctx.json({ error: String(e) }, 500);
+        }
+      } else {
+        const app = this[$appRoot];
+        if (!app) return unknownError(ctx);
+        try {
+          const result = await app.internalRequest({
+            method: body.method,
+            path: body.url,
+            // or path
+            headers: body.headers,
+            body: body.body
+          });
+          return ctx.json({
+            status: result.status,
+            headers: result.headers,
+            data: result.body
+          });
+        } catch (e) {
+          return ctx.json({ error: String(e) }, 500);
+        }
+      }
+    });
+    this.router.get("/**", async (ctx) => {
       const mountPath = this.router[$mountPath] || this.dashboardConfig.path || "/dashboard";
       let relativePath = ctx.path;
       if (relativePath.startsWith(mountPath)) {
@@ -6476,6 +7686,14 @@ class Dashboard {
       const linkPattern = this.getLinkPattern();
       const integrations = this.detectIntegrations();
       const getRequestHeadersSource = this.dashboardConfig.getRequestHeaders ? this.dashboardConfig.getRequestHeaders.toString() : "undefined";
+      const ignorePaths = [
+        ...this.dashboardConfig.ignorePaths || [],
+        // Add default ignores for integrations
+        ...Object.values(integrations).filter((p) => !!p).flatMap((p) => {
+          const clean = p.endsWith("/") ? p.slice(0, -1) : p;
+          return [clean, `${clean}/**`];
+        })
+      ];
       const html = renderToString(DashboardApp({
         metrics: this.metrics,
         uptime,
@@ -6483,7 +7701,8 @@ class Dashboard {
         linkPattern,
         integrations,
         base: mountPath,
-        getRequestHeadersSource
+        getRequestHeadersSource,
+        ignorePaths
       }));
       return ctx.html(`<!DOCTYPE html>${html}`);
     });
@@ -6630,12 +7849,15 @@ class Dashboard {
   getHooks() {
     return {
       onRequestStart: (ctx) => {
+        if (ctx.path.startsWith(this.mountPath)) return;
         const app = this[$appRoot];
         if (!this.instrumented && app) {
           this.instrumentApp(app);
         }
         this.metrics.totalRequests++;
         this.metrics.activeRequests++;
+        ctx._startTime = performance.now();
+        ctx._reqStartTime = Date.now();
         ctx[$debug] = new Collector(this);
         if (!this.broadcastTimer) {
           this.broadcastTimer = setTimeout(() => {
@@ -6725,7 +7947,7 @@ class Dashboard {
           url: ctx.url.toString(),
           status: response.status,
           duration,
-          timestamp: Date.now(),
+          timestamp: ctx._reqStartTime || Date.now() - duration,
           handlerStack: this.serializeHandlerStack(ctx.handlerStack),
           body: this.serializeBody(ctx.responseBody),
           requestBody: ctx.bodyData || ctx.requestBody,
@@ -6746,17 +7968,12 @@ class Dashboard {
           responseHeaders: resHeaders
         };
         this.metrics.logs.push(logEntry);
-        try {
-          await this.db.query("UPSERT $id CONTENT $data", {
-            id: new RecordId("request", ctx.requestId),
-            data: {
-              ...logEntry,
-              direction: "inbound"
-            }
-          });
-        } catch (e) {
+        this.db.create(new RecordId("request", ctx.requestId), {
+          ...logEntry,
+          direction: "inbound"
+        }).catch((e) => {
           console.error("Failed to record request log", e);
-        }
+        });
         const retention = this.dashboardConfig.retentionMs ?? 72e5;
         const cutoff = Date.now() - retention;
         if (this.metrics.logs.length > 0 && this.metrics.logs[0].timestamp < cutoff) {
@@ -6854,6 +8071,463 @@ class Dashboard {
 function unknownError(ctx) {
   return ctx.json({ error: "Unknown Error" }, 500);
 }
+let isPatched = false;
+function applyMonkeyPatch() {
+  if (isPatched) return;
+  isPatched = true;
+  Error.stackTraceLimit = 50;
+}
+async function readSourceContext(filePath, line, contextLines = 5) {
+  if (!filePath || filePath.startsWith("node:") || filePath.startsWith("bun:") || filePath.includes("node_modules")) {
+    return null;
+  }
+  const path = filePath.startsWith("file://") ? filePath.slice(7) : filePath;
+  try {
+    const f = file(path);
+    if (!await f.exists()) return null;
+    const content = await f.text();
+    const allLines = content.split("\n");
+    const targetIndex = line - 1;
+    if (targetIndex < 0 || targetIndex >= allLines.length) return null;
+    const start = Math.max(0, targetIndex - contextLines);
+    const end = Math.min(allLines.length, targetIndex + contextLines + 1);
+    const subset = allLines.slice(start, end).map((code, i) => ({
+      line: start + i + 1,
+      code,
+      isTarget: start + i + 1 === line
+    }));
+    return {
+      lines: subset,
+      startLine: start + 1,
+      file: path
+    };
+  } catch (e) {
+    return null;
+  }
+}
+async function renderErrorView(ctx, error) {
+  const frames = [];
+  const cwd = process.cwd();
+  const errorName = error?.name || "Error";
+  const errorMessage = error?.message || "Unknown error occurred";
+  const errorId = error?.id || ctx.requestId || "unknown-id";
+  const errorTimestamp = error?.timestamp ? new Date(error.timestamp).toISOString() : (/* @__PURE__ */ new Date()).toISOString();
+  const errorScope = error?.scope || {};
+  const lines = (error?.stack || "").split("\n").slice(1);
+  for (const line of lines) {
+    const match = line.match(/at (?:(.+?)\s+\()?(?:(.+?):(\d+):(\d+))\)?/);
+    if (match) {
+      const [_, method, file2, lineNo, colNo] = match;
+      const fileName = file2 || "";
+      let relativeFile = fileName;
+      if (fileName.startsWith(cwd)) {
+        relativeFile = fileName.slice(cwd.length + 1);
+      }
+      let isInternal = fileName.startsWith("node:") || fileName.startsWith("bun:") || fileName === "undefined" || fileName === "";
+      if (isInternal && (method.includes("setTimeout") || method.includes("setInterval") || method.includes("setImmediate"))) {
+        isInternal = false;
+      }
+      let isShokupan = false;
+      if (fileName.includes("node_modules/@dotglitch/shokupan")) {
+        isShokupan = true;
+      } else if (relativeFile.startsWith("src/") || fileName.includes("/shokupan/dist/")) {
+        isShokupan = true;
+      }
+      const isDependency = fileName.includes("node_modules") && !isShokupan;
+      frames.push({
+        method: method || "<anonymous>",
+        file: fileName,
+        line: parseInt(lineNo),
+        column: parseInt(colNo),
+        isNative: false,
+        isInternal,
+        isShokupan,
+        isDependency,
+        shortFile: fileName.split("/").pop() || fileName,
+        relativeFile
+      });
+    }
+  }
+  let focusFrame = frames.find((f) => !f.isInternal && !f.isShokupan && !f.isDependency && !f.isNative);
+  if (!focusFrame) focusFrame = frames[0];
+  let sourceContext = null;
+  if (focusFrame && focusFrame.file && !focusFrame.isInternal) {
+    sourceContext = await readSourceContext(focusFrame.file, focusFrame.line, 8);
+  }
+  const renderFrames = frames.map((frame, index) => {
+    const classes = [
+      "stack-entry",
+      frame.isInternal ? "internal" : "",
+      frame.isShokupan ? "shokupan" : "",
+      frame.isDependency ? "dependency" : "",
+      frame === focusFrame ? "active" : ""
+    ].join(" ");
+    const fileLink = `vscode://file/${frame.file}:${frame.line}:${frame.column}`;
+    return `
+            <li class="${classes}">
+                <a href="${fileLink}" style="text-decoration:none; color:inherit; display:block">
+                    <div class="stack-method">${frame.method === "<anonymous>" ? "Anonymous" : frame.method}</div>
+                    <div class="stack-file">${frame.relativeFile}:${frame.line}</div>
+                </a>
+            </li>
+        `;
+  }).join("");
+  const highlightCode = (code) => {
+    return code.replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/(")(.*?)(")/g, '<span style="color:#a5d6ff">$1$2$3</span>').replace(/(')(.*?)(')/g, '<span style="color:#a5d6ff">$1$2$3</span>').replace(/(`)(.*?)(`)/g, '<span style="color:#a5d6ff">$1$2$3</span>').replace(/\b(const|let|var|function|class|import|export|from|return|if|else|switch|case|default|break|continue|try|catch|finally|throw|new|async|await|interface|type|extends|implements|public|private|protected|static|readonly|true|false|null|undefined)\b/g, '<span style="color:#ff7b72">$1</span>').replace(/(=>|===|==|!=|!==|\|\||&&|\+|\-|\*|\/|%|\+\+|\-\-)/g, '<span style="color:#ff7b72">$1</span>').replace(/\b([A-Z][a-zA-Z0-9_]*)\b/g, '<span style="color:#79c0ff">$1</span>').replace(/\b([a-zA-Z0-9_]+)(?=\()/g, '<span style="color:#d2a8ff">$1</span>').replace(/(\/\/.*)/g, '<span style="color:#8b949e; font-style:italic">$1</span>');
+  };
+  if (sourceContext) {
+    sourceContext.lines.map((l) => `
+            <div class="code-line ${l.isTarget ? "target" : ""}">
+                <div class="line-number">${l.line}</div>
+                <div class="line-content">${highlightCode(l.code)}</div>
+            </div>
+        `).join("");
+  }
+  const renderKV = (data) => {
+    if (!data || Object.keys(data).length === 0) return '<div style="color:var(--text-muted)">None</div>';
+    return `<table class="kv-table">
+            ${Object.entries(data).map(([k, v]) => {
+      let displayVal = String(v);
+      let valClass = "";
+      if (typeof v === "number") {
+        valClass = "kv-val-number";
+      } else if (typeof v === "boolean") {
+        valClass = "kv-val-bool";
+      } else if (typeof v === "object" && v !== null) {
+        try {
+          displayVal = JSON.stringify(v, null, 2);
+          valClass = "kv-val-json";
+        } catch (e) {
+          displayVal = "[Circular]";
+        }
+      }
+      return `
+                <tr>
+                    <td class="kv-key">${k}</td>
+                    <td class="kv-val ${valClass}">${displayVal}</td>
+                </tr>`;
+    }).join("")}
+        </table>`;
+  };
+  const ICON_COPY = `<svg class="icon" viewBox="0 0 24 24"><path d="M16 1H4C2.9 1 2 1.9 2 3V17H4V3H16V1ZM19 5H8C6.9 5 6 5.9 6 7V21C6 22.1 6.9 23 8 23H19C20.1 23 21 22.1 21 21V7C21 5.9 20.1 5 19 5ZM19 21H8V7H19V21Z"/></svg>`;
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>${errorName}: ${errorMessage}</title>
+    <link href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/line-numbers/prism-line-numbers.min.css" rel="stylesheet" />
+    <link href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/line-highlight/prism-line-highlight.min.css" rel="stylesheet" />
+    <link href="/_shokupan/error-view/prismjs.theme.css" rel="stylesheet" />
+    <link href="/_shokupan/error-view/styles.css" rel="stylesheet" />
+    <link href="/_shokupan/error-view/theme.css" rel="stylesheet" />
+
+</head>
+<body class="">
+    
+    <div class="page">
+        <!-- HEADER -->
+        <header class="chapter-header">
+            <div class="chapter-meta">
+                <div class="meta-item">
+                     <span>${ctx.method}</span>
+                </div>
+                <div class="meta-item">
+                     <span>${ctx.url.pathname}</span>
+                </div>
+                <div class="meta-item">
+                     <span>${ctx.response.status || 500}</span>
+                </div>
+                <div class="meta-item" style="margin-left:auto">
+                     <span class="id-badge" onclick="copyText('${errorId}')" title="Copy ID">ID: ${errorId}</span>
+                </div>
+            </div>
+            
+            <h1 class="error-title">${errorName}</h1>
+            
+            <div class="error-message-container">
+                <h2 class="error-message">${errorMessage}</h2>
+                <button class="action-btn" onclick="copyText('${errorMessage.replace(/'/g, "\\'")}')" title="Copy Message" style="padding:4px 8px">
+                    ${ICON_COPY}
+                </button>
+            </div>
+            
+            <div class="actions-bar">
+                <button class="action-btn" onclick="copyText()">
+                    ${ICON_COPY} Copy Error
+                </button>
+                <button class="action-btn" onclick="document.getElementById('raw-modal').style.display='flex'">
+                     View Raw Error
+                </button>
+            </div>
+        </header>
+
+        <!-- CODE FIGURE -->
+        <section class="figure">
+            <div class="figure-caption">
+                ${focusFrame ? `<a href="vscode://file${focusFrame.file}:${focusFrame.line}" style="color:var(--text-muted); text-decoration:none">${focusFrame ? focusFrame.relativeFile : sourceContext?.file || "Unknown Source"}</a>` : ""}
+            </div>
+            <div class="figure-body">
+                ${sourceContext ? `
+                <pre class="line-numbers" data-line="${sourceContext.lines.find((l) => l.isTarget)?.line}" data-start="${sourceContext.lines[0].line}"><code class="language-typescript">${sourceContext.lines.map((l) => l.code.replace(/</g, "&lt;").replace(/>/g, "&gt;")).join("\n")}</code></pre>
+                ` : `<div style="padding: 2rem; color: var(--text-muted); text-align: center;">Source code not available.</div>`}
+            </div>
+        </section>
+
+        <!-- NARRATIVE STACK -->
+        <section class="narrative">
+            <div class="section-title">
+                <span>Stack Trace</span>
+                <div class="filter-group">
+                    <span class="badge" onclick="this.classList.toggle('active'); document.body.classList.toggle('show-internals')">Internals</span>
+                    <span class="badge" onclick="this.classList.toggle('active'); document.body.classList.toggle('show-shokupan')">Framework</span>
+                    <span class="badge" onclick="this.classList.toggle('active'); document.body.classList.toggle('show-dependencies')">Dependencies</span>
+                </div>
+            </div>
+            <ul class="stack-list">
+                ${renderFrames}
+            </ul>
+        </section>
+
+        <!-- APPENDICES -->
+        <section class="appendix">
+             <div class="section-title">Context & Environment</div>
+             <div class="appendix-grid">
+                 <div class="data-block">
+                     <h3>Request</h3>
+                     ${renderKV({
+    id: errorId,
+    timestamp: errorTimestamp,
+    ...errorScope || {}
+  })}
+                 </div>
+                 <div class="data-block">
+                     <h3>Headers</h3>
+                     ${renderKV(Object.fromEntries(ctx.headers))}
+                 </div>
+                 <div class="data-block">
+                     <h3>Query & Params</h3>
+                     ${renderKV({ ...ctx.params, ...ctx.query })}
+                 </div>
+             </div>
+        </section>
+    </div>
+    
+    <!-- RAW ERROR MODAL -->
+    <div id="raw-modal" class="modal-overlay" onclick="if(event.target === this) this.style.display='none'">
+        <div class="modal-content">
+            <div class="modal-header">
+                <span>Raw Error Object</span>
+                <button class="action-btn" onclick="document.getElementById('raw-modal').style.display='none'">Close</button>
+            </div>
+            <div class="modal-body" id="raw-content"></div>
+        </div>
+    </div>
+
+    <!-- PrismJS Scripts -->
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/prism.min.js"><\/script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-typescript.min.js"><\/script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/line-numbers/prism-line-numbers.min.js"><\/script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/line-highlight/prism-line-highlight.min.js"><\/script>
+
+    <script>
+        // Prepare Raw Error
+        // circular ref safe stringify
+        const getCircularReplacer = () => {
+          const seen = new WeakSet();
+          return (key, value) => {
+            if (typeof value === "object" && value !== null) {
+              if (seen.has(value)) {
+                return "[Circular]";
+              }
+              seen.add(value);
+            }
+            return value;
+          };
+        };
+        
+        // Inject error data from SERVER side
+        const rawError = ${(() => {
+    const serializeError = (err) => {
+      const obj = {
+        name: err.name,
+        message: err.message,
+        stack: err.stack,
+        ...err
+        // Spread enumerable props
+      };
+      if (err.cause) obj.cause = err.cause;
+      if (err.code) obj.code = err.code;
+      if (err.status) obj.status = err.status;
+      if (err.statusCode) obj.statusCode = err.statusCode;
+      return JSON.stringify(obj, (key, value) => {
+        if (key === "structuredStack") return void 0;
+        return value;
+      }, 2);
+    };
+    return serializeError(error);
+  })()};
+        
+        // At this point 'rawError' is an Object in Client JS (because serializeError returned a JSON string)
+        const RAW_ERROR_JSON = JSON.stringify(rawError, getCircularReplacer(), 2);
+        // "Normally printed" usually means standard stacktrace string which includes name/message
+        const RAW_ERROR_TEXT = rawError.stack || (rawError.name + ': ' + rawError.message);
+        
+        document.getElementById('raw-content').innerText = RAW_ERROR_JSON;
+
+        function copyText(text) {
+             if (!text) text = RAW_ERROR_TEXT; // Default to text representation (Message + Stack)
+             navigator.clipboard.writeText(text).then(() => {
+                console.log('Copied');
+             });
+        }
+    <\/script>
+</body>
+</html>`;
+}
+function renderStatusView(ctx, status, error) {
+  const title = `${status} ${error.message || "Error"}`;
+  const method = ctx.method;
+  const path = ctx.url.pathname;
+  const css = `
+        body {
+            background: var(--bg-primary);
+            color: var(--text-primary);
+            font-family: var(--shokupan-font);
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            height: 100vh;
+            margin: 0;
+            overflow: hidden;
+        }
+        .container {
+            text-align: center;
+            animation: fadeIn 0.3s ease-out;
+            background: var(--bg-card);
+            padding: 3rem 4rem;
+            border-radius: 16px;
+            border: 1px solid var(--card-border);
+            box-shadow: 0 10px 30px rgba(0,0,0,0.3);
+            max-width: 600px;
+        }
+        h1 {
+            font-size: 6rem;
+            margin: 0;
+            color: var(--primary);
+            line-height: 1;
+            font-weight: 800;
+            letter-spacing: -2px;
+            text-shadow: 0 4px 20px rgba(255, 179, 128, 0.2); 
+        }
+        h2 {
+            font-size: 1.5rem;
+            margin: 1rem 0 2rem 0;
+            font-weight: 400;
+            color: var(--text-secondary);
+        }
+        .meta {
+            color: var(--text-muted);
+            font-family: var(--shokupan-font-mono);
+            font-size: 1rem;
+            background: var(--bg-primary);
+            padding: 0.75rem 1.5rem;
+            border-radius: 8px;
+            display: inline-block;
+            border: 1px solid var(--border-color);
+        }
+        .method {
+            font-weight: bold;
+            margin-right: 0.5rem;
+            padding: 0.2rem 0.5rem;
+            border-radius: 4px;
+        }
+        .path {
+            color: var(--text-primary);
+        }
+        @keyframes fadeIn {
+            from { opacity: 0; transform: translateY(20px); }
+            to { opacity: 1; transform: translateY(0); }
+        }
+    `;
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>${title}</title>
+    <link href="/_shokupan/error-view/theme.css" rel="stylesheet" />
+    <style>${css}</style>
+</head>
+<body>
+    <div class="container">
+        <h1>${status}</h1>
+        <h2>${error.message || "An error occurred"}</h2>
+        <div class="meta">
+            <span class="method badge-${method}">${method}</span>
+            <span class="path">${path}</span>
+        </div>
+    </div>
+</body>
+</html>`;
+}
+class ErrorView {
+  constructor(config = {}) {
+    this.config = config;
+  }
+  name = "error-view";
+  async onInit(app) {
+    applyMonkeyPatch();
+    const errorViewMiddleware = async (ctx, next) => {
+      try {
+        return await next();
+      } catch (err) {
+        const accept = ctx.get("accept") || "";
+        if (!accept.includes("text/html")) {
+          throw err;
+        }
+        if (!err.timestamp) {
+          Object.defineProperty(err, "timestamp", {
+            value: Date.now(),
+            enumerable: false,
+            writable: true,
+            configurable: true
+          });
+        }
+        if (!err.id) {
+          Object.defineProperty(err, "id", {
+            value: ctx.requestId,
+            enumerable: false,
+            writable: true,
+            configurable: true
+          });
+        }
+        if (!err.scope) {
+          const store = asyncContext.getStore();
+          if (store) {
+            Object.defineProperty(err, "scope", {
+              value: { ...store },
+              enumerable: false,
+              writable: true,
+              configurable: true
+            });
+          }
+        }
+        const status = getErrorStatus(err);
+        if (status === 404 || status === 401 || status === 403) {
+          const html2 = await renderStatusView(ctx, status, err);
+          return ctx.html(html2, status);
+        }
+        const html = await renderErrorView(ctx, err);
+        return ctx.html(html, status);
+      }
+    };
+    Object.defineProperty(errorViewMiddleware, "name", { value: "ErrorViewMiddleware" });
+    const { join: join2 } = await import("path");
+    const assetDir = join2(import.meta.dir, "assets");
+    app.static("/_shokupan/error-view", assetDir);
+    app.use(errorViewMiddleware);
+  }
+}
 class GraphQLApolloPlugin extends ShokupanRouter {
   // Use generic any or verify type
   constructor(pluginOptions) {
@@ -6928,6 +8602,377 @@ class GraphQLApolloPlugin extends ShokupanRouter {
     });
   }
 }
+class GraphQLYogaPlugin extends ShokupanRouter {
+  constructor(pluginOptions) {
+    super();
+    this.pluginOptions = pluginOptions;
+    this.pluginOptions.path ??= "/graphql";
+  }
+  yoga;
+  async onInit(app, options) {
+    const { createYoga } = await import("graphql-yoga");
+    const path = options?.path || this.pluginOptions.path || "/graphql";
+    this.yoga = createYoga({
+      ...this.pluginOptions.yogaConfig,
+      graphqlEndpoint: path
+    });
+    app.mount(path, this);
+    const handler = async (ctx) => {
+      let body;
+      if (ctx.req.method !== "GET" && ctx.req.method !== "HEAD") {
+        body = await ctx.body();
+        if (typeof body === "object" && body !== null) {
+          body = JSON.stringify(body);
+        }
+      }
+      const response = await this.yoga.fetch(
+        new Request(ctx.req.url, {
+          method: ctx.req.method,
+          headers: ctx.req.headers,
+          body
+        }),
+        {
+          ...ctx
+        }
+      );
+      response.headers.forEach((value, key) => {
+        ctx.set(key, value);
+      });
+      const text = await response.text();
+      return ctx.send(text, {
+        status: response.status
+      });
+    };
+    this.get("/", handler);
+    this.post("/", handler);
+    this.get("/*", handler);
+    this.post("/*", handler);
+  }
+}
+class HtmxPlugin {
+  async onInit(app) {
+    app.use(this.middleware());
+  }
+  middleware() {
+    return async (ctx, next) => {
+      Object.defineProperty(ctx, "isHtmx", {
+        get: () => ctx.req.headers.has("hx-request")
+      });
+      Object.defineProperty(ctx, "isHtmxBoosted", {
+        get: () => ctx.req.headers.has("hx-boosted")
+      });
+      ctx.trigger = (event, options) => {
+        let headerName = "HX-Trigger";
+        if (options?.after === "settle") headerName = "HX-Trigger-After-Settle";
+        if (options?.after === "swap") headerName = "HX-Trigger-After-Swap";
+        let value = JSON.stringify(event);
+        if (typeof event === "string") {
+          value = event;
+        } else {
+          value = JSON.stringify(event);
+        }
+        ctx.set(headerName, value);
+      };
+      ctx.pushUrl = (url) => {
+        ctx.set("HX-Push-Url", url === false ? "false" : url);
+      };
+      ctx.htmxRedirect = (url) => {
+        ctx.set("HX-Redirect", url);
+      };
+      ctx.refresh = () => {
+        ctx.set("HX-Refresh", "true");
+      };
+      return next();
+    };
+  }
+}
+function Idempotency(options = {}) {
+  const headerName = options.header || "Idempotency-Key";
+  options.ttl || 24 * 60 * 60 * 1e3;
+  let RecordIdClass;
+  const idempotencyMiddleware = async function IdempotencyMiddleware(ctx, next) {
+    const key = ctx.headers.get(headerName);
+    if (!key) {
+      return next();
+    }
+    try {
+      if (!RecordIdClass) {
+        const mod = await import("surrealdb");
+        RecordIdClass = mod.RecordId;
+      }
+      const stored = await ctx.app.db.select(new RecordIdClass("idempotency", key));
+      if (stored) {
+        const responseHeaders = new Headers(stored.headers);
+        responseHeaders.set("X-Idempotency-Hit", "true");
+        return new Response(stored.body, {
+          status: stored.status,
+          headers: responseHeaders
+        });
+      }
+    } catch (e) {
+      console.error("Idempotency read error:", e);
+    }
+    const result = await next();
+    let response;
+    if (result instanceof Response) {
+      response = result;
+    } else if ((result === null || result === void 0) && ctx[$finalResponse] instanceof Response) {
+      response = ctx[$finalResponse];
+    } else if (result !== null && result !== void 0) {
+      if (typeof result === "object") {
+        response = await ctx.json(result);
+      } else {
+        response = await ctx.text(String(result));
+      }
+    }
+    if (response instanceof Response) {
+      const clone = response.clone();
+      const bodyText = await clone.text();
+      const headers = {};
+      clone.headers.forEach((v, k) => {
+        headers[k] = v;
+      });
+      const toStore = {
+        status: clone.status,
+        headers,
+        body: bodyText,
+        timestamp: Date.now()
+      };
+      try {
+        await ctx.app.db.upsert(new RecordIdClass("idempotency", key), toStore);
+      } catch (e) {
+        console.error("Idempotency write error:", e);
+      }
+      return response;
+    }
+    return result;
+  };
+  idempotencyMiddleware.isBuiltin = true;
+  idempotencyMiddleware.pluginName = "Idempotency";
+  return idempotencyMiddleware;
+}
+class MCPServerPlugin {
+  constructor(options = {}) {
+    this.options = options;
+    options.allowIntrospection ??= true;
+    options.allowToolExecution ??= true;
+    options.path ??= "/mcp";
+    if (!options.path.startsWith("/")) {
+      options.path = "/" + options.path;
+    }
+    options.rootDir ??= process.cwd();
+  }
+  router = new ShokupanRouter();
+  analyzer;
+  onInit(app) {
+    this[$appRoot] = app;
+    this.analyzer = new OpenAPIAnalyzer(this.options.rootDir);
+    if (this.options.allowIntrospection) {
+      this.registerTools();
+      this.registerResources();
+      this.registerPrompts();
+    }
+    app.onStart(async () => {
+      app.mount(this.options.path, this.router);
+      this.collectAppMcpItems(app);
+      this.setupRoutes();
+      this.router.metadata = {
+        file: import.meta.file,
+        line: 1,
+        name: "MCPServerPlugin",
+        pluginName: "MCP Server"
+      };
+    });
+  }
+  collectAppMcpItems(app) {
+    const collect = (router) => {
+      if (router.mcpProtocol) {
+        this.router.mcpProtocol.merge(router.mcpProtocol);
+      }
+      router[$childRouters]?.forEach(collect);
+    };
+    collect(app);
+  }
+  setupRoutes() {
+    this.router.get("", (ctx) => {
+      const endpointUrl = `${ctx.protocol}://${ctx.host}${this.options.path}`;
+      const enc = new TextEncoder();
+      return new Response(
+        new ReadableStream({
+          start(controller) {
+            controller.enqueue(enc.encode(`event: endpoint
+data: ${JSON.stringify(endpointUrl)}
+
+`));
+          },
+          cancel() {
+          }
+        }),
+        {
+          headers: {
+            "Content-Type": "text/event-stream",
+            "Cache-Control": "no-cache",
+            "Connection": "keep-alive"
+          }
+        }
+      );
+    });
+    this.router.post("", async (ctx) => {
+      let parsedBody;
+      try {
+        parsedBody = await ctx.body();
+      } catch (e) {
+        return ctx.json({
+          jsonrpc: "2.0",
+          id: null,
+          error: { code: -32700, message: "Parse error" }
+        }, 400);
+      }
+      const response = await this.router.mcpProtocol.handleMessage(parsedBody);
+      if (response) {
+        return ctx.json(response);
+      }
+      return ctx.text("", 204);
+    });
+  }
+  registerTools() {
+    const ensureExecutionAllowed = () => {
+      if (!this.options.allowToolExecution) {
+        throw new Error("Tool execution is disabled.");
+      }
+    };
+    this.router.tool(
+      "list_endpoints",
+      {},
+      async () => {
+        ensureExecutionAllowed();
+        const { applications } = await this.analyzer.analyze();
+        const endpoints = applications.flatMap(
+          (app) => app.routes.map((r) => ({
+            method: r.method,
+            path: r.path,
+            handler: r.handlerName,
+            summary: r.summary
+          }))
+        );
+        return {
+          content: [{
+            type: "text",
+            text: JSON.stringify(endpoints, null, 2)
+          }]
+        };
+      }
+    );
+    this.router.tool(
+      "get_endpoint_details",
+      {
+        type: "object",
+        properties: {
+          method: { type: "string" },
+          path: { type: "string" }
+        },
+        required: ["method", "path"]
+      },
+      async ({ method, path }) => {
+        ensureExecutionAllowed();
+        const { applications } = await this.analyzer.analyze();
+        const route = applications.flatMap((app) => app.routes).find((r) => r.method.toUpperCase() === method.toUpperCase() && r.path === path);
+        if (!route) {
+          return {
+            content: [{ type: "text", text: `Endpoint ${method} ${path} not found.` }],
+            isError: true
+          };
+        }
+        return {
+          content: [{
+            type: "text",
+            text: JSON.stringify(route, null, 2)
+          }]
+        };
+      }
+    );
+  }
+  registerResources() {
+    this.router.resource(
+      "mcp://api/openapi.json",
+      {
+        name: "openapi-spec",
+        mimeType: "application/json"
+      },
+      async (uri) => {
+        const { applications } = await this.analyzer.analyze();
+        const endpoints = applications.flatMap(
+          (app) => app.routes.map((r) => ({
+            method: r.method,
+            path: r.path,
+            handler: r.handlerName,
+            summary: r.summary,
+            requestTypes: r.requestTypes,
+            responseType: r.responseType
+          }))
+        );
+        return {
+          contents: [{
+            uri,
+            text: JSON.stringify(endpoints, null, 2)
+          }]
+        };
+      }
+    );
+    this.router.resource(
+      "mcp://api/routes/{method}/{path}/source",
+      {
+        name: "route-source",
+        mimeType: "text/typescript"
+      },
+      async (uri) => {
+        const parts = uri.replace("mcp://", "").split("/");
+        parts[2];
+        throw new Error("Dynamic resource reading not fully implemented in lightweight version yet.");
+      }
+    );
+  }
+  registerPrompts() {
+    this.router.prompt(
+      "generate-client",
+      [
+        { name: "method", required: true },
+        { name: "path", required: true }
+      ],
+      async ({ method, path }) => {
+        const { applications } = await this.analyzer.analyze();
+        const route = applications.flatMap((app) => app.routes).find((r) => r.method.toUpperCase() === method.toUpperCase() && r.path === path);
+        if (!route) {
+          return {
+            messages: [{
+              role: "user",
+              content: {
+                type: "text",
+                text: `Start a new task to create a client for ${method} ${path}. The endpoint was not found in the current analysis.`
+              }
+            }]
+          };
+        }
+        return {
+          messages: [{
+            role: "user",
+            content: {
+              type: "text",
+              text: `Please generate a TypeScript client function for the following endpoint:
+Method: ${route.method}
+Path: ${route.path}
+Summary: ${route.summary || "N/A"}
+Request Types: ${JSON.stringify(route.requestTypes, null, 2)}
+Response Type: ${route.responseType || "unknown"}
+
+Use fetch or axios. Ensure proper typing.`
+            }
+          }]
+        };
+      }
+    );
+  }
+}
 class ScalarPlugin extends ShokupanRouter {
   constructor(pluginOptions = {}) {
     pluginOptions.config ??= {};
@@ -7103,7 +9148,7 @@ class ScalarPlugin extends ShokupanRouter {
           try {
             const entrypoint = process.argv[1];
             console.log(`[ScalarPlugin] Running eager static analysis on entrypoint: ${entrypoint}`);
-            const analyzer = new OpenAPIAnalyzer(process.cwd(), entrypoint);
+            const analyzer = new OpenAPIAnalyzer$1(process.cwd(), entrypoint);
             let staticSpec = await analyzer.analyze();
             if (!this.pluginOptions.baseDocument) this.pluginOptions.baseDocument = {};
             deepMerge(this.pluginOptions.baseDocument, staticSpec);
@@ -7116,10 +9161,150 @@ class ScalarPlugin extends ShokupanRouter {
     }
   }
 }
+function attachSocketIOBridge(io, app) {
+  io.on("connection", (socket) => {
+    socket.onAny(async (event, ...args) => {
+      if (event === "shokupan:request" || event === "http") {
+        return;
+      }
+      const handler = app.findEvent(event);
+      if (handler) {
+        const data = args[0];
+        const req = new ShokupanRequest({
+          url: `socketio://${app.applicationConfig.hostname || "localhost"}/event/${event}`,
+          method: "POST",
+          headers: new Headers({ "content-type": "application/json" }),
+          body: JSON.stringify(data)
+        });
+        const ctx = new ShokupanContext(req, app.server);
+        ctx[$ws] = socket;
+        ctx.io = io;
+        try {
+          for (let i = 0; i < handler.length; i++) {
+            await handler[i](ctx);
+          }
+        } catch (e) {
+          await app.runHooks("onError", ctx, e);
+          if (app.applicationConfig["websocketErrorHandler"]) {
+            await app.applicationConfig["websocketErrorHandler"](e, ctx);
+          } else {
+            console.error(`Error in event ${event}:`, e);
+          }
+        }
+      }
+    });
+    if (app.applicationConfig["enableHttpBridge"]) {
+      socket.on("shokupan:request", async (payload, callback) => {
+        try {
+          const { method, path, headers, body } = payload;
+          const url = new URL(path, `http://${app.applicationConfig.hostname || "localhost"}:3000`);
+          const req = new Request(url.toString(), {
+            method,
+            headers,
+            body: typeof body === "object" ? JSON.stringify(body) : body
+          });
+          const res = await app.fetch(req);
+          let resBody = await res.text();
+          try {
+            resBody = JSON.parse(resBody);
+          } catch {
+          }
+          const resHeaders = {};
+          res.headers.forEach((v, k) => resHeaders[k] = v);
+          if (typeof callback === "function") {
+            await callback({
+              status: res.status,
+              headers: resHeaders,
+              body: resBody
+            });
+          } else {
+            socket.emit("shokupan:response", {
+              id: payload.id,
+              status: res.status,
+              headers: resHeaders,
+              body: resBody
+            });
+          }
+        } catch (e) {
+          if (typeof callback === "function") {
+            callback({ status: 500, body: { error: e.message } });
+          }
+        }
+      });
+    }
+  });
+}
+function createLimitStream(maxSize) {
+  let size = 0;
+  return new TransformStream({
+    transform(chunk, controller) {
+      size += chunk.byteLength || chunk.length;
+      if (size > maxSize) {
+        controller.error(new Error(`Decompressed body size exceeded limit of ${maxSize} bytes`));
+      } else {
+        controller.enqueue(chunk);
+      }
+    }
+  });
+}
 function Compression(options = {}) {
   const threshold = options.threshold ?? 512;
   const allowedAlgorithms = new Set(options.allowedAlgorithms ?? ["br", "gzip", "zstd", "deflate"]);
+  const decompress = options.decompress ?? true;
+  const maxDecompressedSize = options.maxDecompressedSize ?? 10 * 1024 * 1024;
   const compressionMiddleware = async function CompressionMiddleware(ctx, next) {
+    const requestEncoding = ctx.headers.get("content-encoding");
+    if (decompress && requestEncoding && !ctx.headers.get("content-encoding")?.includes("identity") && ctx.req.body) {
+      let stream = null;
+      if (requestEncoding.includes("br")) {
+        const decompressor = zlib.createBrotliDecompress();
+        const nodeStream = Readable.fromWeb(ctx.req.body);
+        stream = Readable.toWeb(nodeStream.pipe(decompressor));
+      } else if (requestEncoding.includes("gzip")) {
+        if (typeof DecompressionStream !== "undefined") {
+          stream = ctx.req.body.pipeThrough(new DecompressionStream("gzip"));
+        } else {
+          const decompressor = zlib.createGunzip();
+          const nodeStream = Readable.fromWeb(ctx.req.body);
+          stream = Readable.toWeb(nodeStream.pipe(decompressor));
+        }
+      } else if (requestEncoding.includes("deflate")) {
+        if (typeof DecompressionStream !== "undefined") {
+          stream = ctx.req.body.pipeThrough(new DecompressionStream("deflate"));
+        } else {
+          const decompressor = zlib.createInflate();
+          const nodeStream = Readable.fromWeb(ctx.req.body);
+          stream = Readable.toWeb(nodeStream.pipe(decompressor));
+        }
+      }
+      if (stream) {
+        const outputStream = stream.pipeThrough(createLimitStream(maxDecompressedSize));
+        const originalIp = ctx.ip;
+        const originalReq = ctx.req;
+        const newHeaders = new Headers(originalReq.headers);
+        newHeaders.delete("content-encoding");
+        newHeaders.delete("content-length");
+        const newReq = new Proxy(originalReq, {
+          get(target, prop, receiver) {
+            if (prop === "body") return outputStream;
+            if (prop === "headers") return newHeaders;
+            if (prop === "json") return async () => JSON.parse(await new Response(outputStream).text());
+            if (prop === "text") return async () => await new Response(outputStream).text();
+            if (prop === "arrayBuffer") return async () => await new Response(outputStream).arrayBuffer();
+            if (prop === "blob") return async () => await new Response(outputStream).blob();
+            if (prop === "formData") return async () => await new Response(outputStream).formData();
+            return Reflect.get(target, prop, target);
+          }
+        });
+        ctx.request = newReq;
+        if (originalIp) {
+          Object.defineProperty(ctx, "ip", {
+            configurable: true,
+            get: () => originalIp
+          });
+        }
+      }
+    }
     const acceptEncoding = ctx.headers.get("accept-encoding") || "";
     let method = null;
     if (acceptEncoding.includes("br")) method = "br";
@@ -7571,7 +9756,7 @@ function openApiValidator() {
     if (validators.body) {
       let body;
       try {
-        body = await ctx.req.json().catch(() => ({}));
+        body = await ctx.body();
       } catch {
         body = {};
       }
@@ -7691,10 +9876,171 @@ function enableOpenApiValidation(app) {
     precompileValidators(app, spec);
   });
 }
+function isPrivateIP(ip) {
+  const ipv4Patterns = [
+    /^10\./,
+    // 10.0.0.0/8
+    /^172\.(1[6-9]|2[0-9]|3[01])\./,
+    // 172.16.0.0/12
+    /^192\.168\./,
+    // 192.168.0.0/16
+    /^127\./,
+    // 127.0.0.0/8 (loopback)
+    /^169\.254\./,
+    // 169.254.0.0/16 (link-local)
+    /^0\.0\.0\.0$/
+    // 0.0.0.0
+  ];
+  const ipv6Patterns = [
+    /^::1$/,
+    // loopback
+    /^fe80:/,
+    // link-local
+    /^fc00:/,
+    // unique local
+    /^fd00:/
+    // unique local
+  ];
+  for (const pattern of ipv4Patterns) {
+    if (pattern.test(ip)) return true;
+  }
+  for (const pattern of ipv6Patterns) {
+    if (pattern.test(ip.toLowerCase())) return true;
+  }
+  return false;
+}
+function Proxy$1(options) {
+  const targetUrl = new URL(options.target);
+  if (!["http:", "https:"].includes(targetUrl.protocol)) {
+    throw new Error("Invalid proxy target protocol. Only http and https are allowed.");
+  }
+  if (options.allowedHosts && options.allowedHosts.length > 0) {
+    if (!options.allowedHosts.includes(targetUrl.hostname)) {
+      throw new Error(`Target hostname ${targetUrl.hostname} is not in the allowed hosts list.`);
+    }
+  }
+  if (!options.allowPrivateIPs && isPrivateIP(targetUrl.hostname)) {
+    throw new Error("Proxying to private IP addresses is not allowed.");
+  }
+  return async (ctx, next) => {
+    const req = ctx.request;
+    if (options.ws && req.headers.get("upgrade")?.toLowerCase() === "websocket") {
+      const success = ctx.upgrade({
+        data: {
+          handler: {
+            open: (ws) => handleWSOpen(ws, ctx, options, targetUrl),
+            message: (ws, message) => handleWSMessage(ws, message),
+            close: (ws, code, reason) => handleWSClose(ws, code, reason),
+            drain: (ws) => handleWSDrain()
+          }
+        }
+      });
+      if (success) {
+        return void 0;
+      }
+    }
+    let path = ctx.url.pathname;
+    if (options.pathRewrite) {
+      path = options.pathRewrite(path);
+    }
+    const url = new URL(path + ctx.url.search, targetUrl);
+    if (!["http:", "https:"].includes(url.protocol)) {
+      return ctx.text("Invalid protocol in proxied URL", 400);
+    }
+    const headers = new Headers(req.headers);
+    if (options.changeOrigin) {
+      headers.set("host", targetUrl.host);
+    }
+    if (options.headers) {
+      Object.entries(options.headers).forEach(([key, value]) => headers.set(key, value));
+    }
+    headers.delete("connection");
+    headers.delete("keep-alive");
+    headers.delete("proxy-authenticate");
+    headers.delete("proxy-authorization");
+    headers.delete("te");
+    headers.delete("trailer");
+    headers.delete("transfer-encoding");
+    headers.delete("upgrade");
+    const proxyReq = new Request(url.toString(), {
+      method: req.method,
+      headers,
+      body: req.body,
+      // @ts-ignore - duplex is needed for some node/bun versions for streaming bodies
+      duplex: "half"
+    });
+    const res = await fetch(proxyReq);
+    return new Response(res.body, {
+      status: res.status,
+      statusText: res.statusText,
+      headers: res.headers
+    });
+  };
+}
+const wsMap = /* @__PURE__ */ new WeakMap();
+function handleWSOpen(ws, ctx, options, targetUrl) {
+  let path = ctx.url.pathname;
+  if (options.pathRewrite) {
+    path = options.pathRewrite(path);
+  }
+  const url = new URL(path + ctx.url.search, targetUrl);
+  url.protocol = targetUrl.protocol.replace("http", "ws");
+  const headers = {};
+  if (options.changeOrigin) {
+    headers["Host"] = targetUrl.host;
+  }
+  ctx.request.headers.forEach((v, k) => {
+    if (!["upgrade", "connection", "sec-websocket-key", "sec-websocket-version", "sec-websocket-extensions"].includes(k.toLowerCase())) {
+      headers[k] = v;
+    }
+  });
+  const upstream = new WebSocket(url.toString());
+  wsMap.set(ws, upstream);
+  const pendingMessages = [];
+  let isConnected = false;
+  upstream.onopen = () => {
+    isConnected = true;
+    while (pendingMessages.length > 0) {
+      const msg = pendingMessages.shift();
+      upstream.send(msg);
+    }
+  };
+  upstream.onmessage = (event) => {
+    ws.send(event.data);
+  };
+  upstream.onclose = (event) => {
+    ws.close(event.code, event.reason);
+  };
+  upstream.onerror = (err) => {
+    console.error("Upstream WebSocket error:", err);
+    ws.close(1011, "Internal Error");
+  };
+  upstream._pendingRequestMessages = pendingMessages;
+  upstream._isConnected = () => isConnected;
+}
+function handleWSMessage(ws, message) {
+  const upstream = wsMap.get(ws);
+  if (!upstream) return;
+  if (upstream._isConnected && upstream._isConnected()) {
+    upstream.send(message);
+  } else {
+    upstream._pendingRequestMessages.push(message);
+  }
+}
+function handleWSClose(ws, code, reason) {
+  const upstream = wsMap.get(ws);
+  if (upstream) {
+    if (upstream.readyState === WebSocket.OPEN) {
+      upstream.close(code, reason);
+    }
+    wsMap.delete(ws);
+  }
+}
+function handleWSDrain(ws) {
+}
 function SecurityHeaders(options = {}) {
   const securityHeadersMiddleware = async function SecurityHeadersMiddleware(ctx, next) {
-    const headers = {};
-    const set = (k, v) => headers[k] = v;
+    const set = (k, v) => ctx.response.set(k, v);
     if (options.dnsPrefetchControl !== false) {
       const allow = options.dnsPrefetchControl?.allow;
       set("X-DNS-Prefetch-Control", allow ? "on" : "off");
@@ -7740,14 +10086,6 @@ function SecurityHeaders(options = {}) {
     }
     if (options.hidePoweredBy !== false) ;
     const response = await next();
-    if (response instanceof Response) {
-      const headerEntries = Object.entries(headers);
-      for (let i = 0; i < headerEntries.length; i++) {
-        const [k, v] = headerEntries[i];
-        response.headers.set(k, v);
-      }
-      return response;
-    }
     return response;
   };
   securityHeadersMiddleware.isBuiltin = true;
@@ -7912,43 +10250,56 @@ function Session(options) {
       }
       const sessObj = existing;
       Object.defineProperty(sessObj, "id", { value: sessionID, configurable: true });
-      sessObj.save = (cb) => {
-        store.set(sessObj.id, sessObj, cb);
+      sessObj.save = () => {
+        return new Promise((resolve2, reject) => {
+          store.set(sessObj.id, sessObj, (err) => {
+            if (err) reject(err);
+            else resolve2();
+          });
+        });
       };
-      sessObj.destroy = (cb) => {
-        store.destroy(sessObj.id, (err) => {
-          if (cb) cb(err);
+      sessObj.destroy = () => {
+        return new Promise((resolve2, reject) => {
+          store.destroy(sessObj.id, (err) => {
+            if (err) reject(err);
+            else resolve2();
+          });
         });
       };
-      sessObj.regenerate = (cb) => {
-        store.destroy(sessObj.id, (err) => {
-          sessionID = generateId(ctx);
-          const keys = Object.keys(sessObj);
-          for (let i = 0; i < keys.length; i++) {
-            const key = keys[i];
-            if (key !== "cookie" && key !== "id" && typeof sessObj[key] !== "function") {
-              delete sessObj[key];
+      sessObj.regenerate = () => {
+        return new Promise((resolve2, reject) => {
+          store.destroy(sessObj.id, (err) => {
+            if (err) return reject(err);
+            sessionID = generateId(ctx);
+            const keys = Object.keys(sessObj);
+            for (let i = 0; i < keys.length; i++) {
+              const key = keys[i];
+              if (key !== "cookie" && key !== "id" && typeof sessObj[key] !== "function") {
+                delete sessObj[key];
+              }
             }
-          }
-          Object.defineProperty(sessObj, "id", { value: sessionID, configurable: true });
-          if (cb) cb(err);
+            Object.defineProperty(sessObj, "id", { value: sessionID, configurable: true });
+            resolve2();
+          });
         });
       };
       sessObj.undefined = () => {
       };
-      sessObj.reload = (cb) => {
-        store.get(sessObj.id, (err, sess2) => {
-          if (err) return cb(err);
-          if (!sess2) return cb(new Error("Session not found"));
-          const keys = Object.keys(sessObj);
-          for (let i = 0; i < keys.length; i++) {
-            const key = keys[i];
-            if (key !== "cookie" && key !== "id" && typeof sessObj[key] !== "function") {
-              delete sessObj[key];
+      sessObj.reload = () => {
+        return new Promise((resolve2, reject) => {
+          store.get(sessObj.id, (err, sess2) => {
+            if (err) return reject(err);
+            if (!sess2) return reject(new Error("Session not found"));
+            const keys = Object.keys(sessObj);
+            for (let i = 0; i < keys.length; i++) {
+              const key = keys[i];
+              if (key !== "cookie" && key !== "id" && typeof sessObj[key] !== "function") {
+                delete sessObj[key];
+              }
             }
-          }
-          Object.assign(sessObj, sess2);
-          cb(null);
+            Object.assign(sessObj, sess2);
+            resolve2();
+          });
         });
       };
       sessObj.touch = () => {
@@ -8024,6 +10375,7 @@ export {
   $bodyParsed,
   $bodyType,
   $cachedBody,
+  $cachedCookies,
   $cachedHost,
   $cachedHostname,
   $cachedOrigin,
@@ -8040,11 +10392,15 @@ export {
   $isApplication,
   $isMounted,
   $isRouter,
+  $mcpPrompts,
+  $mcpResources,
+  $mcpTools,
   $middleware,
   $mountPath,
   $parent,
   $rawBody,
   $requestId,
+  $resilienceConfig,
   $routeArgs,
   $routeMatched,
   $routeMethods,
@@ -8066,24 +10422,33 @@ export {
   Ctx,
   Dashboard,
   Delete,
+  ErrorView,
   Event,
   Get,
   GraphQLApolloPlugin,
+  GraphQLYogaPlugin,
   HTTPMethods,
   Head,
   Headers$1 as Headers,
+  HtmxPlugin,
+  Idempotency,
   Inject,
   Injectable,
+  MCPServerPlugin,
   MemoryStore,
+  OpenTelemetryPlugin,
   Options,
   Param,
   Patch,
   Post,
+  Prompt,
+  Proxy$1 as Proxy,
   Put,
   Query,
   RateLimit,
   RateLimitMiddleware,
   Req,
+  Resource,
   RouteParamType,
   RouterRegistry,
   ScalarPlugin,
@@ -8096,13 +10461,18 @@ export {
   ShokupanResponse,
   ShokupanRouter,
   Spec,
+  Tool,
   Use,
   ValidationError,
+  attachSocketIOBridge,
   compileValidators,
   compose,
   enableOpenApiValidation,
   openApiValidator,
   precompileValidators,
+  serveStatic,
+  traceHandler,
+  traceMiddleware,
   useExpress,
   valibot,
   validate