@miragon/pulse-widget-shell 0.0.0-bootstrap.0 → 0.21.0

package/dist/host-boot.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Boot helpers shared by composed-server hosts (the stock server and the
+ * composed-server template). Server path only — extracted so host apps carry
+ * composition, not mcp-use workarounds, and a toolkit/mcp-use migration
+ * lands here once instead of in every host fork.
+ */
+/**
+ * The narrow structural surface needed for tool-call middleware
+ * (`server.use("mcp:tools/call", …)`, the metrics counter) — callers pass an
+ * `MCPServer` without this module importing mcp-use (same pattern as
+ * `McpMiddlewareHost`).
+ */
+export interface ToolCallMiddlewareHost {
+    use(pattern: "mcp:tools/call", fn: (ctx: unknown, next: () => Promise<unknown>) => Promise<unknown>): unknown;
+}
+/** The tool name from mcp-use's tools/call middleware ctx (`unknown` when the shape is off). */
+export declare function toolNameOf(ctx: unknown): string;
+/**
+ * `error` for an `isError` result (the toolkit's `withToolErrors` shape —
+ * handlers report failures as results, not throws), `ok` otherwise — what the
+ * metrics counter calls an error.
+ */
+export declare function toolCallOutcome(result: unknown): "ok" | "error";
+/**
+ * mcp-use logs every request itself (one line per call: method, tool name,
+ * status, duration, an error's text), at `info` without any payload. Its
+ * `MCP_USE_LOG_LEVEL` raises that to `debug` (truncated tool inputs and
+ * outputs) or `trace` (full request and response dumps, headers included):
+ * process variables, business keys and bearer tokens then reach the log. The
+ * boot says so; `undefined` at `info` or unset.
+ */
+export declare function requestLogLevelWarning(env: NodeJS.ProcessEnv): string | undefined;
+/**
+ * `mcp-use dev` imports the host entry, takes the default export, and owns
+ * the socket itself. It also primes its own (empty — hosts bundle views via
+ * `app.bundle`) views manifest onto the export, which mcp-use rejects as a
+ * double prime. Swallow the CLI's prime; scoped to the dev CLI (the env var
+ * it sets before loading the entry) so a genuine double-prime still fails
+ * loudly.
+ */
+export declare function swallowDevCliViewsPrime(server: object, env?: NodeJS.ProcessEnv): void;
+export interface ResolvePortOptions {
+    /** Defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    /** Port to bind when `PORT` is unset or empty (default 8400). */
+    fallback?: number;
+    /** Host label, prefixed onto the error so it reads like the host's other boot lines. */
+    label?: string;
+}
+/**
+ * `PORT` from the environment, validated. `||` (not `??`) on purpose: an
+ * empty `PORT=` assignment from an env_file must fall back to the default —
+ * `Number("")` is 0, which would bind a random OS-assigned port.
+ */
+export declare function resolvePort({ env, fallback, label, }?: ResolvePortOptions): number;
+//# sourceMappingURL=host-boot.d.ts.map

package/dist/host-boot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-boot.d.ts","sourceRoot":"","sources":["../src/host-boot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,GAAG,CACD,OAAO,EAAE,gBAAgB,EACzB,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GACnE,OAAO,CAAA;CACX;AAED,gGAAgG;AAChG,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAE/C;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAM/D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAMjF;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,IAAI,CAGN;AAED,MAAM,WAAW,kBAAkB;IACjC,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,EAC1B,GAAiB,EACjB,QAAe,EACf,KAAK,GACN,GAAE,kBAAuB,GAAG,MAAM,CAOlC"}

package/dist/host-boot.js

@@ -0,0 +1,64 @@
+/**
+ * Boot helpers shared by composed-server hosts (the stock server and the
+ * composed-server template). Server path only — extracted so host apps carry
+ * composition, not mcp-use workarounds, and a toolkit/mcp-use migration
+ * lands here once instead of in every host fork.
+ */
+/** The tool name from mcp-use's tools/call middleware ctx (`unknown` when the shape is off). */
+export function toolNameOf(ctx) {
+    return ctx?.params?.name ?? "unknown";
+}
+/**
+ * `error` for an `isError` result (the toolkit's `withToolErrors` shape —
+ * handlers report failures as results, not throws), `ok` otherwise — what the
+ * metrics counter calls an error.
+ */
+export function toolCallOutcome(result) {
+    const isError = typeof result === "object" &&
+        result !== null &&
+        result.isError === true;
+    return isError ? "error" : "ok";
+}
+/**
+ * mcp-use logs every request itself (one line per call: method, tool name,
+ * status, duration, an error's text), at `info` without any payload. Its
+ * `MCP_USE_LOG_LEVEL` raises that to `debug` (truncated tool inputs and
+ * outputs) or `trace` (full request and response dumps, headers included):
+ * process variables, business keys and bearer tokens then reach the log. The
+ * boot says so; `undefined` at `info` or unset.
+ */
+export function requestLogLevelWarning(env) {
+    const level = env.MCP_USE_LOG_LEVEL?.trim().toLowerCase();
+    if (level !== "debug" && level !== "trace")
+        return undefined;
+    return level === "trace"
+        ? "MCP_USE_LOG_LEVEL=trace — mcp-use logs every request and response in full, headers (bearer tokens) included. For debugging only."
+        : "MCP_USE_LOG_LEVEL=debug — mcp-use logs tool inputs and outputs (process variables, business keys) on every call. For debugging only.";
+}
+/**
+ * `mcp-use dev` imports the host entry, takes the default export, and owns
+ * the socket itself. It also primes its own (empty — hosts bundle views via
+ * `app.bundle`) views manifest onto the export, which mcp-use rejects as a
+ * double prime. Swallow the CLI's prime; scoped to the dev CLI (the env var
+ * it sets before loading the entry) so a genuine double-prime still fails
+ * loudly.
+ */
+export function swallowDevCliViewsPrime(server, env = process.env) {
+    if (!env.MCP_USE_DEV_CLI)
+        return;
+    server.__primeViews = () => { };
+}
+/**
+ * `PORT` from the environment, validated. `||` (not `??`) on purpose: an
+ * empty `PORT=` assignment from an env_file must fall back to the default —
+ * `Number("")` is 0, which would bind a random OS-assigned port.
+ */
+export function resolvePort({ env = process.env, fallback = 8400, label, } = {}) {
+    const port = Number(env.PORT?.trim() || fallback);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        const prefix = label ? `[${label}] ` : "";
+        throw new Error(`${prefix}invalid PORT "${env.PORT}" — expected an integer 1-65535`);
+    }
+    return port;
+}
+//# sourceMappingURL=host-boot.js.map

package/dist/host-boot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-boot.js","sourceRoot":"","sources":["../src/host-boot.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,OAAQ,GAAkD,EAAE,MAAM,EAAE,IAAI,IAAI,SAAS,CAAA;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAe;IAC7C,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACd,MAAgC,CAAC,OAAO,KAAK,IAAI,CAAA;IACpD,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AACjC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAsB;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACzD,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IAC5D,OAAO,KAAK,KAAK,OAAO;QACtB,CAAC,CAAC,kIAAkI;QACpI,CAAC,CAAC,sIAAsI,CAAA;AAC5I,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,GAAG,CAAC,eAAe;QAAE,OACzB;IAAC,MAAuC,CAAC,YAAY,GAAG,GAAG,EAAE,GAAE,CAAC,CAAA;AACnE,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,EAC1B,GAAG,GAAG,OAAO,CAAC,GAAG,EACjB,QAAQ,GAAG,IAAI,EACf,KAAK,MACiB,EAAE;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QACzC,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,iBAAiB,GAAG,CAAC,IAAI,iCAAiC,CAAC,CAAA;IACtF,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/host-boot.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=host-boot.test.d.ts.map

package/dist/host-boot.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-boot.test.d.ts","sourceRoot":"","sources":["../src/host-boot.test.ts"],"names":[],"mappings":""}

package/dist/host-boot.test.js

@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest";
+import { requestLogLevelWarning, resolvePort, swallowDevCliViewsPrime, toolCallOutcome, toolNameOf, } from "./host-boot.js";
+describe("resolvePort", () => {
+    it("falls back to the default when PORT is unset", () => {
+        expect(resolvePort({ env: {} })).toBe(8400);
+    });
+    it("falls back on an empty or whitespace-only assignment (env_file `PORT=`)", () => {
+        expect(resolvePort({ env: { PORT: "" } })).toBe(8400);
+        expect(resolvePort({ env: { PORT: "   " } })).toBe(8400);
+    });
+    it("parses an explicit port and honors a custom fallback", () => {
+        expect(resolvePort({ env: { PORT: "9000" } })).toBe(9000);
+        expect(resolvePort({ env: {}, fallback: 1234 })).toBe(1234);
+    });
+    it.each(["abc", "0", "65536", "-1", "80.5"])("rejects %j", (value) => {
+        expect(() => resolvePort({ env: { PORT: value } })).toThrow(`invalid PORT "${value}" — expected an integer 1-65535`);
+    });
+    it("prefixes the host label onto the error", () => {
+        expect(() => resolvePort({ env: { PORT: "abc" }, label: "test-app" })).toThrow(`[test-app] invalid PORT "abc" — expected an integer 1-65535`);
+    });
+});
+describe("swallowDevCliViewsPrime", () => {
+    it("does nothing outside the dev CLI", () => {
+        const server = {};
+        swallowDevCliViewsPrime(server, {});
+        expect("__primeViews" in server).toBe(false);
+    });
+    it("replaces __primeViews with a no-op under the dev CLI", () => {
+        const server = {
+            __primeViews: () => {
+                throw new Error("double prime");
+            },
+        };
+        swallowDevCliViewsPrime(server, { MCP_USE_DEV_CLI: "1" });
+        expect(() => server.__primeViews?.()).not.toThrow();
+    });
+});
+describe("requestLogLevelWarning", () => {
+    it("stays silent at mcp-use's default level or when unset", () => {
+        expect(requestLogLevelWarning({})).toBeUndefined();
+        expect(requestLogLevelWarning({ MCP_USE_LOG_LEVEL: "info" })).toBeUndefined();
+    });
+    it("warns that debug logs tool inputs and outputs", () => {
+        expect(requestLogLevelWarning({ MCP_USE_LOG_LEVEL: " DEBUG " })).toMatch(/^MCP_USE_LOG_LEVEL=debug — mcp-use logs tool inputs and outputs/);
+    });
+    it("warns that trace logs full requests, bearer tokens included", () => {
+        expect(requestLogLevelWarning({ MCP_USE_LOG_LEVEL: "trace" })).toContain("bearer tokens");
+    });
+});
+describe("toolCallOutcome / toolNameOf", () => {
+    it("reads an isError result as error and a missing tool name as unknown", () => {
+        expect(toolCallOutcome({ isError: true })).toBe("error");
+        expect(toolCallOutcome({ content: [] })).toBe("ok");
+        expect(toolCallOutcome(undefined)).toBe("ok");
+        expect(toolNameOf({ params: { name: "notes_list_notes" } })).toBe("notes_list_notes");
+        expect(toolNameOf({})).toBe("unknown");
+    });
+});
+//# sourceMappingURL=host-boot.test.js.map

package/dist/host-boot.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-boot.test.js","sourceRoot":"","sources":["../src/host-boot.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,uBAAuB,EACvB,eAAe,EACf,UAAU,GACX,MAAM,gBAAgB,CAAA;AAEvB,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrD,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzD,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE;QACnE,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CACzD,iBAAiB,KAAK,iCAAiC,CACxD,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAC5E,6DAA6D,CAC9D,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,MAAM,GAAG,EAAE,CAAA;QACjB,uBAAuB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QACnC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,MAAM,GAAkC;YAC5C,YAAY,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAA;YACjC,CAAC;SACF,CAAA;QACD,uBAAuB,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,CAAA;QACzD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAA;IACrD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QAClD,MAAM,CAAC,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CACtE,iEAAiE,CAClE,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,CAAC,sBAAsB,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACxD,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7C,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QACrF,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/http-edge.d.ts

@@ -0,0 +1,117 @@
+/**
+ * The HTTP edge of a composed server (server path only): WHO may talk to it.
+ *
+ * DNS-rebinding protection — Origin validation is a MUST of the MCP Streamable
+ * HTTP transport — as two allow-lists, resolved once per boot from the env:
+ *
+ * - `Host` (every request): a rebinding page reaches the server under the
+ *   ATTACKER's hostname, so only hostnames the deployment owns pass —
+ *   localhost-class always, plus `MCP_URL`'s host and `MCP_ALLOWED_HOSTS`.
+ * - `Origin` (non-GET/HEAD requests carrying one): a browser stamps every
+ *   cross-origin (and every same-origin POST) request with the page's origin;
+ *   localhost-class origins, `MCP_URL`'s origin and `MCP_ALLOWED_ORIGINS`
+ *   pass. Requests WITHOUT an `Origin` always pass — non-browser MCP clients
+ *   (Claude Code, gateways, `mcp-remote`) never send one.
+ *
+ * Deliberately app-owned instead of mcp-use's `allowedHosts`/`allowedOrigins`
+ * (which guard every path): probes and scrapers address a container by its
+ * IP (Kubernetes, Fly), so the operational routes are exempt — see
+ * {@link installHttpEdgeGuard}. The size half of the edge (the body cap and the
+ * in-flight budget) lives in `node-listener.ts`; both read the one policy
+ * resolved here.
+ */
+/** Hostnames that always pass both checks — a loopback caller is the machine itself. */
+export declare const LOCALHOST_HOSTNAMES: readonly string[];
+/**
+ * Default request-body cap (4 MiB): far above any MCP JSON-RPC message, room
+ * for a multi-resource BPMN deployment. The cap bounds ONE request, not the
+ * process — mcp-use parses a JSON body into a heap graph up to ~20× its size
+ * before the OAuth gate runs — so the in-flight budget below bounds the total.
+ */
+export declare const DEFAULT_MAX_BODY_BYTES: number;
+/**
+ * The in-flight body budget, in cap-sized bodies: the bytes held across all
+ * requests whose response is still open (16 MiB by default) — room for
+ * thousands of ordinary JSON-RPC calls but only a handful of cap-sized
+ * uploads; a request past it gets 503.
+ */
+export declare const IN_FLIGHT_BODY_MULTIPLE = 4;
+/**
+ * The env vars the shared edge reads. Composition roots spread them into
+ * their known-var list (typo warner, `.env.example` guards) instead of
+ * re-listing them.
+ */
+export declare const HTTP_EDGE_ENV_VARS: readonly ["MCP_URL", "MCP_ALLOWED_HOSTS", "MCP_ALLOWED_ORIGINS", "MCP_MAX_BODY_BYTES", "MCP_METRICS_TOKEN"];
+/** `"*"` switches the check off — an explicit opt-out for edges that validate themselves. */
+export type AllowList = readonly string[] | "*";
+export interface HttpEdgePolicy {
+    /** Allowed `Host` hostnames (port-agnostic, lower-case), localhost-class first. */
+    allowedHosts: AllowList;
+    /**
+     * Allowed `Origin`s: an entry with a scheme is an exact origin
+     * (`https://app.example.com`), a bare entry a hostname on any scheme/port —
+     * the localhost-class entries are bare.
+     */
+    allowedOrigins: AllowList;
+    /** Request-body cap in bytes (`MCP_MAX_BODY_BYTES`). */
+    maxBodyBytes: number;
+    /** Body bytes held across all in-flight requests ({@link IN_FLIGHT_BODY_MULTIPLE} × the cap). */
+    maxInFlightBodyBytes: number;
+    /** Bearer token `/metrics` requires (`MCP_METRICS_TOKEN`); unset = open. */
+    metricsToken?: string;
+}
+/**
+ * Resolve the edge policy from the env, ONCE per boot. Invalid values fail the
+ * boot instead of silently widening (or narrowing) the edge.
+ */
+export declare function resolveHttpEdgePolicy(env?: NodeJS.ProcessEnv): HttpEdgePolicy;
+/** The one boot line stating the edge, so a 403 in the field is explainable from the log. */
+export declare function describeHttpEdgePolicy(policy: HttpEdgePolicy): string;
+/** Why a `Host` header is refused, or `undefined` when it passes. */
+export declare function hostRejection(host: string | undefined, policy: HttpEdgePolicy): string | undefined;
+/** Why an `Origin` header is refused, or `undefined` when it passes. */
+export declare function originRejection(origin: string | undefined, method: string, policy: HttpEdgePolicy): string | undefined;
+/** What the guard reads from a request — in the hono middleware and the Node listener alike. */
+export interface EdgeRequest {
+    method: string;
+    /** The URL path, without the query. */
+    path: string;
+    host: string | undefined;
+    origin: string | undefined;
+}
+/**
+ * THE guard decision: why `request` is refused, or `undefined` when it passes
+ * (an exempt path always passes). Single-sourced so the Node listener — which
+ * discards a refused request's body unread — and the hono guard — which
+ * answers it — never disagree.
+ */
+export declare function edgeRejection(request: EdgeRequest, policy: HttpEdgePolicy, exemptPaths?: readonly string[]): string | undefined;
+/** A JSON-RPC-shaped error body, so MCP clients surface the reason verbatim. */
+export declare function jsonRpcErrorBody(message: string): string;
+/** The slice of hono's context the guard reads — structural, like the other host ports. */
+export interface EdgeGuardContext {
+    req: {
+        method: string;
+        path: string;
+        header(name: string): string | undefined;
+    };
+}
+/** `server.use("*", middleware)` with a middleware that may answer itself. */
+export interface EdgeGuardHost {
+    use(path: "*", handler: (ctx: EdgeGuardContext, next: () => Promise<void>) => Promise<Response | void>): unknown;
+}
+export interface EdgeGuardOptions {
+    /**
+     * Path prefixes answered regardless of `Host`/`Origin` — the read-only
+     * operational routes, which probes and scrapers reach by container IP.
+     */
+    exemptPaths?: readonly string[];
+}
+/**
+ * Register the Host/Origin guard on every route registered AFTER it (hono
+ * runs handlers in registration order) — the MCP endpoint and the view
+ * assets are mounted by mcp-use later, so they are always covered. A refused
+ * request gets 403 with the reason and the env var that would admit it.
+ */
+export declare function installHttpEdgeGuard(server: EdgeGuardHost, policy: HttpEdgePolicy, { exemptPaths }?: EdgeGuardOptions): void;
+//# sourceMappingURL=http-edge.d.ts.map

package/dist/http-edge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-edge.d.ts","sourceRoot":"","sources":["../src/http-edge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAwC,CAAA;AAEzF;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,QAAkB,CAAA;AAErD;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,IAAI,CAAA;AAExC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,6GAMrB,CAAA;AAEV,6FAA6F;AAC7F,MAAM,MAAM,SAAS,GAAG,SAAS,MAAM,EAAE,GAAG,GAAG,CAAA;AAE/C,MAAM,WAAW,cAAc;IAC7B,mFAAmF;IACnF,YAAY,EAAE,SAAS,CAAA;IACvB;;;;OAIG;IACH,cAAc,EAAE,SAAS,CAAA;IACzB,wDAAwD;IACxD,YAAY,EAAE,MAAM,CAAA;IACpB,iGAAiG;IACjG,oBAAoB,EAAE,MAAM,CAAA;IAC5B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAiED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,CAe1F;AAQD,6FAA6F;AAC7F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAQrE;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,cAAc,GACrB,MAAM,GAAG,SAAS,CAcpB;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,cAAc,GACrB,MAAM,GAAG,SAAS,CAsBpB;AAED,gGAAgG;AAChG,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,GAAG,SAAS,CAAA;IACxB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3B;AAKD;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,cAAc,EACtB,WAAW,GAAE,SAAS,MAAM,EAAO,GAClC,MAAM,GAAG,SAAS,CAKpB;AAED,gFAAgF;AAChF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AASD,2FAA2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;KAAE,CAAA;CAChF;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,GAAG,CACD,IAAI,EAAE,GAAG,EACT,OAAO,EAAE,CAAC,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GACtF,OAAO,CAAA;CACX;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,cAAc,EACtB,EAAE,WAAgB,EAAE,GAAE,gBAAqB,GAC1C,IAAI,CAWN"}

package/dist/http-edge.js

@@ -0,0 +1,219 @@
+/**
+ * The HTTP edge of a composed server (server path only): WHO may talk to it.
+ *
+ * DNS-rebinding protection — Origin validation is a MUST of the MCP Streamable
+ * HTTP transport — as two allow-lists, resolved once per boot from the env:
+ *
+ * - `Host` (every request): a rebinding page reaches the server under the
+ *   ATTACKER's hostname, so only hostnames the deployment owns pass —
+ *   localhost-class always, plus `MCP_URL`'s host and `MCP_ALLOWED_HOSTS`.
+ * - `Origin` (non-GET/HEAD requests carrying one): a browser stamps every
+ *   cross-origin (and every same-origin POST) request with the page's origin;
+ *   localhost-class origins, `MCP_URL`'s origin and `MCP_ALLOWED_ORIGINS`
+ *   pass. Requests WITHOUT an `Origin` always pass — non-browser MCP clients
+ *   (Claude Code, gateways, `mcp-remote`) never send one.
+ *
+ * Deliberately app-owned instead of mcp-use's `allowedHosts`/`allowedOrigins`
+ * (which guard every path): probes and scrapers address a container by its
+ * IP (Kubernetes, Fly), so the operational routes are exempt — see
+ * {@link installHttpEdgeGuard}. The size half of the edge (the body cap and the
+ * in-flight budget) lives in `node-listener.ts`; both read the one policy
+ * resolved here.
+ */
+/** Hostnames that always pass both checks — a loopback caller is the machine itself. */
+export const LOCALHOST_HOSTNAMES = ["localhost", "127.0.0.1", "[::1]"];
+/**
+ * Default request-body cap (4 MiB): far above any MCP JSON-RPC message, room
+ * for a multi-resource BPMN deployment. The cap bounds ONE request, not the
+ * process — mcp-use parses a JSON body into a heap graph up to ~20× its size
+ * before the OAuth gate runs — so the in-flight budget below bounds the total.
+ */
+export const DEFAULT_MAX_BODY_BYTES = 4 * 1024 * 1024;
+/**
+ * The in-flight body budget, in cap-sized bodies: the bytes held across all
+ * requests whose response is still open (16 MiB by default) — room for
+ * thousands of ordinary JSON-RPC calls but only a handful of cap-sized
+ * uploads; a request past it gets 503.
+ */
+export const IN_FLIGHT_BODY_MULTIPLE = 4;
+/**
+ * The env vars the shared edge reads. Composition roots spread them into
+ * their known-var list (typo warner, `.env.example` guards) instead of
+ * re-listing them.
+ */
+export const HTTP_EDGE_ENV_VARS = [
+    "MCP_URL",
+    "MCP_ALLOWED_HOSTS",
+    "MCP_ALLOWED_ORIGINS",
+    "MCP_MAX_BODY_BYTES",
+    "MCP_METRICS_TOKEN",
+];
+function listFrom(raw) {
+    const entries = (raw ?? "")
+        .split(",")
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    return entries.includes("*") ? "*" : entries;
+}
+function hostnameOf(entry, variable) {
+    try {
+        return new URL(entry.includes("://") ? entry : `http://${entry}`).hostname;
+    }
+    catch {
+        throw new Error(`${variable}: "${entry}" is not a hostname`);
+    }
+}
+function originEntryOf(entry, variable) {
+    if (!entry.includes("://"))
+        return hostnameOf(entry, variable);
+    let origin;
+    try {
+        origin = new URL(entry).origin;
+    }
+    catch {
+        origin = "null";
+    }
+    if (origin === "null")
+        throw new Error(`${variable}: "${entry}" is not an origin`);
+    return origin;
+}
+function publicUrl(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return undefined;
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`MCP_URL "${value}" is not an absolute URL`);
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+        throw new Error(`MCP_URL "${value}" must be an http(s) URL`);
+    }
+    return url;
+}
+function maxBodyBytesFrom(raw) {
+    const value = raw?.trim();
+    if (!value)
+        return DEFAULT_MAX_BODY_BYTES;
+    const bytes = Number(value);
+    if (!Number.isSafeInteger(bytes) || bytes < 1) {
+        throw new Error(`MCP_MAX_BODY_BYTES "${value}" must be a positive integer (bytes)`);
+    }
+    return bytes;
+}
+function withDerived(list, derived, normalize) {
+    if (list === "*")
+        return "*";
+    const entries = [...LOCALHOST_HOSTNAMES, ...(derived ? [derived] : []), ...list.map(normalize)];
+    return [...new Set(entries)];
+}
+/**
+ * Resolve the edge policy from the env, ONCE per boot. Invalid values fail the
+ * boot instead of silently widening (or narrowing) the edge.
+ */
+export function resolveHttpEdgePolicy(env = process.env) {
+    const url = publicUrl(env.MCP_URL);
+    const metricsToken = env.MCP_METRICS_TOKEN?.trim();
+    const maxBodyBytes = maxBodyBytesFrom(env.MCP_MAX_BODY_BYTES);
+    return {
+        allowedHosts: withDerived(listFrom(env.MCP_ALLOWED_HOSTS), url?.hostname, (entry) => hostnameOf(entry, "MCP_ALLOWED_HOSTS")),
+        allowedOrigins: withDerived(listFrom(env.MCP_ALLOWED_ORIGINS), url?.origin, (entry) => originEntryOf(entry, "MCP_ALLOWED_ORIGINS")),
+        maxBodyBytes,
+        maxInFlightBodyBytes: IN_FLIGHT_BODY_MULTIPLE * maxBodyBytes,
+        ...(metricsToken ? { metricsToken } : {}),
+    };
+}
+const formatBytes = (bytes) => {
+    const [unit, size] = bytes >= 1024 * 1024 ? ["MiB", 1024 * 1024] : ["KiB", 1024];
+    if (bytes < 1024)
+        return `${bytes} bytes`;
+    return `${Number((bytes / size).toFixed(2))} ${unit}`;
+};
+/** The one boot line stating the edge, so a 403 in the field is explainable from the log. */
+export function describeHttpEdgePolicy(policy) {
+    const list = (allowList) => allowList === "*" ? "any (validation off)" : allowList.join(", ");
+    return (`HTTP edge — hosts: ${list(policy.allowedHosts)}; origins: ${list(policy.allowedOrigins)}; ` +
+        `max body ${formatBytes(policy.maxBodyBytes)} (${formatBytes(policy.maxInFlightBodyBytes)} in flight); ` +
+        `/metrics ${policy.metricsToken ? "token-protected" : "open"}`);
+}
+/** Why a `Host` header is refused, or `undefined` when it passes. */
+export function hostRejection(host, policy) {
+    if (policy.allowedHosts === "*")
+        return undefined;
+    if (!host)
+        return "missing Host header";
+    let hostname;
+    try {
+        hostname = new URL(`http://${host}`).hostname;
+    }
+    catch {
+        return `invalid Host header "${host}"`;
+    }
+    if (policy.allowedHosts.includes(hostname))
+        return undefined;
+    return (`Host "${hostname}" is not allowed (DNS-rebinding protection). Set MCP_URL to the ` +
+        `server's public URL, or add the hostname to MCP_ALLOWED_HOSTS.`);
+}
+/** Why an `Origin` header is refused, or `undefined` when it passes. */
+export function originRejection(origin, method, policy) {
+    if (policy.allowedOrigins === "*" || !origin)
+        return undefined;
+    // Safe methods carry no side effects, and sandboxed view iframes send
+    // `Origin: null` on their asset GETs (mcp-use applies the same rule).
+    if (method === "GET" || method === "HEAD")
+        return undefined;
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        url = undefined;
+    }
+    const allowed = url !== undefined &&
+        url.origin !== "null" &&
+        policy.allowedOrigins.some((entry) => entry.includes("://") ? entry === url.origin : entry === url.hostname);
+    if (allowed)
+        return undefined;
+    return (`Origin "${origin}" is not allowed (DNS-rebinding protection). Add it to ` +
+        `MCP_ALLOWED_ORIGINS if a browser app on that origin should reach this server.`);
+}
+const isExempt = (path, prefixes) => prefixes.some((prefix) => path === prefix || path.startsWith(`${prefix}/`));
+/**
+ * THE guard decision: why `request` is refused, or `undefined` when it passes
+ * (an exempt path always passes). Single-sourced so the Node listener — which
+ * discards a refused request's body unread — and the hono guard — which
+ * answers it — never disagree.
+ */
+export function edgeRejection(request, policy, exemptPaths = []) {
+    if (isExempt(request.path, exemptPaths))
+        return undefined;
+    return (hostRejection(request.host, policy) ?? originRejection(request.origin, request.method, policy));
+}
+/** A JSON-RPC-shaped error body, so MCP clients surface the reason verbatim. */
+export function jsonRpcErrorBody(message) {
+    return JSON.stringify({ jsonrpc: "2.0", error: { code: -32000, message }, id: null });
+}
+function jsonRpcErrorResponse(status, message) {
+    return new Response(jsonRpcErrorBody(message), {
+        status,
+        headers: { "content-type": "application/json", "cache-control": "no-store" },
+    });
+}
+/**
+ * Register the Host/Origin guard on every route registered AFTER it (hono
+ * runs handlers in registration order) — the MCP endpoint and the view
+ * assets are mounted by mcp-use later, so they are always covered. A refused
+ * request gets 403 with the reason and the env var that would admit it.
+ */
+export function installHttpEdgeGuard(server, policy, { exemptPaths = [] } = {}) {
+    server.use("*", async (ctx, next) => {
+        const { method, path } = ctx.req;
+        const rejection = edgeRejection({ method, path, host: ctx.req.header("host"), origin: ctx.req.header("origin") }, policy, exemptPaths);
+        if (rejection)
+            return jsonRpcErrorResponse(403, `Forbidden: ${rejection}`);
+        await next();
+    });
+}
+//# sourceMappingURL=http-edge.js.map

package/dist/http-edge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-edge.js","sourceRoot":"","sources":["../src/http-edge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;AAEzF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAA;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,SAAS;IACT,mBAAmB;IACnB,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;CACX,CAAA;AAsBV,SAAS,QAAQ,CAAC,GAAuB;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;SACxB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAA;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,QAAgB;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,MAAM,KAAK,qBAAqB,CAAC,CAAA;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,QAAgB;IACpD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC9D,IAAI,MAAc,CAAA;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,MAAM,CAAA;IACjB,CAAC;IACD,IAAI,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,MAAM,KAAK,oBAAoB,CAAC,CAAA;IAClF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,SAAS,CAAC,GAAuB;IACxC,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAA;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,0BAA0B,CAAC,CAAA;IAC9D,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,0BAA0B,CAAC,CAAA;IAC9D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAuB;IAC/C,MAAM,KAAK,GAAG,GAAG,EAAE,IAAI,EAAE,CAAA;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO,sBAAsB,CAAA;IACzC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,sCAAsC,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,WAAW,CAClB,IAAoB,EACpB,OAA2B,EAC3B,SAAoC;IAEpC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IAC5B,MAAM,OAAO,GAAG,CAAC,GAAG,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/F,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAClC,MAAM,YAAY,GAAG,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAA;IAClD,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC7D,OAAO;QACL,YAAY,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClF,UAAU,CAAC,KAAK,EAAE,mBAAmB,CAAC,CACvC;QACD,cAAc,EAAE,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CACpF,aAAa,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAC5C;QACD,YAAY;QACZ,oBAAoB,EAAE,uBAAuB,GAAG,YAAY;QAC5D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAU,EAAE;IAC5C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAChF,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,GAAG,KAAK,QAAQ,CAAA;IACzC,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;AACvD,CAAC,CAAA;AAED,6FAA6F;AAC7F,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,MAAM,IAAI,GAAG,CAAC,SAAoB,EAAE,EAAE,CACpC,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnE,OAAO,CACL,sBAAsB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI;QAC5F,YAAY,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,oBAAoB,CAAC,eAAe;QACxG,YAAY,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,EAAE,CAC/D,CAAA;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAC3B,IAAwB,EACxB,MAAsB;IAEtB,IAAI,MAAM,CAAC,YAAY,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,qBAAqB,CAAA;IACvC,IAAI,QAAgB,CAAA;IACpB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,wBAAwB,IAAI,GAAG,CAAA;IACxC,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAA;IAC5D,OAAO,CACL,SAAS,QAAQ,kEAAkE;QACnF,gEAAgE,CACjE,CAAA;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAC7B,MAA0B,EAC1B,MAAc,EACd,MAAsB;IAEtB,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC9D,sEAAsE;IACtE,sEAAsE;IACtE,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,SAAS,CAAA;IAC3D,IAAI,GAAoB,CAAA;IACxB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAA;IACjB,CAAC;IACD,MAAM,OAAO,GACX,GAAG,KAAK,SAAS;QACjB,GAAG,CAAC,MAAM,KAAK,MAAM;QACrB,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACnC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,QAAQ,CACtE,CAAA;IACH,IAAI,OAAO;QAAE,OAAO,SAAS,CAAA;IAC7B,OAAO,CACL,WAAW,MAAM,yDAAyD;QAC1E,+EAA+E,CAChF,CAAA;AACH,CAAC;AAWD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,QAA2B,EAAW,EAAE,CACtE,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAA;AAE7E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAoB,EACpB,MAAsB,EACtB,cAAiC,EAAE;IAEnC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,SAAS,CAAA;IACzD,OAAO,CACL,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAC/F,CAAA;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AACvF,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc,EAAE,OAAe;IAC3D,OAAO,IAAI,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE;QAC7C,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;KAC7E,CAAC,CAAA;AACJ,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAqB,EACrB,MAAsB,EACtB,EAAE,WAAW,GAAG,EAAE,KAAuB,EAAE;IAE3C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAClC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,GAAG,CAAA;QAChC,MAAM,SAAS,GAAG,aAAa,CAC7B,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAChF,MAAM,EACN,WAAW,CACZ,CAAA;QACD,IAAI,SAAS;YAAE,OAAO,oBAAoB,CAAC,GAAG,EAAE,cAAc,SAAS,EAAE,CAAC,CAAA;QAC1E,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/http-edge.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=http-edge.test.d.ts.map

package/dist/http-edge.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-edge.test.d.ts","sourceRoot":"","sources":["../src/http-edge.test.ts"],"names":[],"mappings":""}