@redocly/redoc-reef 0.138.0-next.13 → 0.138.0-next.15

package/dist/server/plugins/mcp/codemode/capabilities/fetch/index.js

@@ -1,5 +0,0 @@
-import{getCallableApis as n,isFetchCapable as o}from"../../../gateway-mcp/callable-apis.js";import{FETCH_TOOL_NAME as i}from"../../constants.js";const l=["```ts","/**"," * Call a documented API. Only the callable APIs' documented hosts are reachable."," * Responses cap at 1 MiB and redirects are not followed."," */","declare function fetch(url: string | URL, init?: {","  method?: string;","  /** `content-type` is set automatically for URLSearchParams/FormData unless you set one. */","  headers?: Record<string, string>;","  /** string \xB7 URLSearchParams (\u2192 application/x-www-form-urlencoded) \xB7 FormData (\u2192 multipart/form-data) */","  body?: string | URLSearchParams | FormData;","  /** Security scheme name (from the operation's `security` or `getSecuritySchemes`) whose credential to send. Omit to let the server choose. */","  securityScheme?: string;","}): Promise<{","  status: number;","  statusText: string;","  ok: boolean;","  headers: { get(name: string): string | null };","  json(): Promise<unknown>;","  text(): Promise<string>;","}>;","```"].join(`
-`),c=["listApis","getEndpoints","getEndpointInfo"],p=["Example - list the paid invoices of a billing API:","","```ts","const { items } = await tools.listApis({ filter: 'billing' });","const [api] = items;",`if (!api) return { error: 'no API matches "billing"' };`,"const { endpoints } = await tools.getEndpoints({ name: api.name });","const ep = endpoints.find((e) => e.method === 'GET' && e.path.includes('invoices'));","const info = await tools.getEndpointInfo({ name: api.name, path: ep.path, method: ep.method });","// Replace every `{placeholder}` first.","const url = new URL((info.servers?.[0]?.url ?? '') + ep.path);","// Every name below comes from `info.endpoint.parameters` - read them first, never guess them.","url.searchParams.set('filter', 'status:paid');","url.searchParams.set('sort', '-createdTime');","url.searchParams.set('limit', '100');","try {","  const res = await fetch(url, { method: ep.method });","  return res.ok ? await res.json() : { status: res.status, error: await res.text() };","} catch (error) {","  return { error: error instanceof Error ? error.message : String(error), endpointId: info };","}","```"].join(`
-`),d=["Example - call an endpoint you already read:","","```ts","// Call `getEndpointInfo` first for the server URL, the path, and the parameter names.","// Replace every `{placeholder}` first.","const url = new URL('https://api.example.com/invoices');","url.searchParams.set('filter', 'status:paid');","try {","  const res = await fetch(url, { method: 'GET' });","  return res.ok ? await res.json() : { status: res.status, error: await res.text() };","} catch (error) {","  return { error: error instanceof Error ? error.message : String(error) };","}","```"].join(`
-`);function h(r){return c.every(t=>r.includes(t))?p:d}function m(r){const t=new Map;for(const{name:e,version:a}of r){if(!e)continue;const s=t.get(e)??[];a&&s.push(a),t.set(e,s)}return[...t.entries()].map(([e,a])=>a.length>1?`${e} (${a.map(s=>`v${s}`).join(", ")})`:e).join(", ")}const g={id:i,purpose:"Call the documented APIs over HTTP",isActive:o,annotations:{readOnlyHint:!1,destructiveHint:!0,openWorldHint:!0},renderSection(r,t){const e=m(n(r));return["## `fetch` \u2014 call the documented APIs","",l,"","Always call `getEndpointInfo` before `fetch` for the exact URL, required parameters, and body shape. Put filtering, sorting, and paging in the query parameters, and keep sandbox JS for what the endpoint cannot express. Never guess.","","A `servers[].url` or an endpoint path can hold `{placeholders}`. Replace every one before you call `fetch`. Use the server variable `default`. Ask the user when the `default` only repeats the variable name, such as `{organizationId}`.","",`Callable APIs (their documented hosts are reachable via \`fetch\`): ${e}`,"",h(t)].join(`
-`)}};export{l as FETCH_DECLARATION,g as fetchCapability};

package/dist/server/plugins/mcp/codemode/capabilities/index.d.ts

@@ -1,3 +0,0 @@
-export type { SandboxCapability } from './types.js';
-export { composeExecuteAnnotations, getActiveCapabilities, renderDescribeToolsOutput, } from './utils.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/plugins/mcp/codemode/capabilities/index.js

@@ -1 +0,0 @@
-import{composeExecuteAnnotations as o,getActiveCapabilities as i,renderDescribeToolsOutput as r}from"./utils.js";export{o as composeExecuteAnnotations,i as getActiveCapabilities,r as renderDescribeToolsOutput};

package/dist/server/plugins/mcp/codemode/capabilities/registry.d.ts

@@ -1,4 +0,0 @@
-import type { SandboxCapability } from './types.js';
-/** Every sandbox capability, in the order their sections appear in describe-tools output. */
-export declare const ALL_CAPABILITIES: readonly SandboxCapability[];
-//# sourceMappingURL=registry.d.ts.map

package/dist/server/plugins/mcp/codemode/capabilities/registry.js

@@ -1 +0,0 @@
-import{fetchCapability as t}from"./fetch/index.js";const i=[t];export{i as ALL_CAPABILITIES};

package/dist/server/plugins/mcp/codemode/capabilities/types.d.ts

@@ -1,16 +0,0 @@
-import type { ToolAnnotations } from '@modelcontextprotocol/server';
-import type { McpToolContext } from '../../types.js';
-/** A capability is a per-request-gated global the code-mode sandbox exposes beyond the schema-driven `tools.*` surface. */
-export type SandboxCapability = {
-    id: string;
-    purpose: string;
-    /** Whether this capability is live for THIS request (RBAC/config/flag-dependent). */
-    isActive(context: McpToolContext): boolean;
-    annotations: Partial<ToolAnnotations>;
-    /**
-     * The self-contained `describe-tools` section for this capability: heading, TS declaration,
-     * guidance, and an example built only from `describedToolNames`.
-     */
-    renderSection(context: McpToolContext, describedToolNames: string[]): string;
-};
-//# sourceMappingURL=types.d.ts.map

package/dist/server/plugins/mcp/codemode/capabilities/utils.d.ts

@@ -1,12 +0,0 @@
-import type { ToolAnnotations } from '@modelcontextprotocol/server';
-import type { McpToolSchema } from '../../../../types';
-import type { McpToolContext } from '../../types.js';
-import type { SandboxCapability } from './types.js';
-export declare function getActiveCapabilities(context: McpToolContext): SandboxCapability[];
-export declare function composeExecuteAnnotations(tools: McpToolSchema[], capabilities: SandboxCapability[]): ToolAnnotations;
-/**
- * The describe-tools output: the tool signatures, the always-present
- * `execute` args note, then one self-contained section per selected capability.
- */
-export declare function renderDescribeToolsOutput(tools: McpToolSchema[], capabilities: SandboxCapability[], context: McpToolContext): string;
-//# sourceMappingURL=utils.d.ts.map

package/dist/server/plugins/mcp/codemode/capabilities/utils.js

@@ -1,7 +0,0 @@
-import{buildToolTypeDeclarations as p,sanitizeToolName as c}from"../build-tool-type-declarations.js";import{buildExecuteExample as u,EXECUTE_ARGS_NOTE as l,USAGE_NOTES as m}from"../prompts.js";import{FETCH_TOOL_NAME as a}from"../constants.js";import{ALL_CAPABILITIES as d}from"./registry.js";function H(t){return d.filter(o=>o.isActive(t))}function h(t,o){const r=[...t,...o].map(({annotations:e})=>e??{}),i=r.filter(e=>e.readOnlyHint!==!0);return{readOnlyHint:i.length===0,destructiveHint:i.some(e=>e.destructiveHint!==!1),idempotentHint:i.every(e=>e.idempotentHint===!0),openWorldHint:r.some(e=>e.openWorldHint!==!1)}}function O(t,o,r){const i=t.map(n=>c(n.name)),e=[];if(t.length>0){const n=p(t),s=n.includes("OpenApi")?`
-
-${m}`:"";e.push(`## Sandbox tools
-
-${n}${s}`)}e.push(l),t.length>0&&!o.some(n=>n.id===a)&&e.push(u(i));for(const n of o)e.push(n.renderSection(r,i));return e.join(`
-
-`)}export{h as composeExecuteAnnotations,H as getActiveCapabilities,O as renderDescribeToolsOutput};

package/dist/server/plugins/mcp/codemode/code-audit.d.ts

@@ -1,12 +0,0 @@
-export type CodeAudit = {
-    sha256: string;
-    length: number;
-    flags: string;
-};
-/**
- * Fingerprint model-supplied code for the audit trail. The body itself is never reported — it can
- * contain data the model already pulled from a customer API — so callers get a hash plus flags for
- * patterns worth reviewing. The sandbox blocks all of the flagged targets; a flag is an attempt.
- */
-export declare function auditCode(code: string): CodeAudit;
-//# sourceMappingURL=code-audit.d.ts.map

package/dist/server/plugins/mcp/codemode/code-audit.js

@@ -1 +0,0 @@
-import{createHash as e}from"node:crypto";const n=/(169\.254\.169\.254|metadata\.google\.internal|\.consul\b|\.internal\b|localhost|127\.0\.0\.1|\b10\.\d{1,3}\.\d{1,3}\.\d{1,3}\b|\b192\.168\.\d{1,3}\.\d{1,3}\b|\b172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}\b)/i,a=/(process\s*(?:\.\s*env\b|\[)|globalThis|require\s*\(|__proto__)/;function r(t){const s=[];return a.test(t)&&s.push("env_probe"),n.test(t)&&s.push("internal_target"),{sha256:e("sha256").update(t,"utf8").digest("hex"),length:t.length,flags:s.sort().join(",")}}export{r as auditCode};

package/dist/server/plugins/mcp/codemode/code-execution-audit.d.ts

@@ -1,18 +0,0 @@
-import type { CodeAudit } from './code-audit.js';
-import type { McpCallAttribution } from '../types.js';
-type CodeExecutionAuditRecord = Pick<McpCallAttribution, 'requestId' | 'messageId'> & {
-    audit: CodeAudit;
-    code: string;
-    description: string;
-    sessionHandle?: string;
-    toolNames: readonly string[];
-    fetchBudget?: number;
-    fetchCapable: boolean;
-};
-/**
- * Full sandbox input for one code mode `execute`, keyed by the same `code_sha256` the
- * `mcpServer.codeExecuted` telemetry event carries, so a Grafana row resolves to this line.
- */
-export declare function logCodeExecutionAudit({ audit, code, description, sessionHandle, toolNames, fetchBudget, fetchCapable, requestId, messageId, }: CodeExecutionAuditRecord): void;
-export {};
-//# sourceMappingURL=code-execution-audit.d.ts.map

package/dist/server/plugins/mcp/codemode/code-execution-audit.js

@@ -1 +0,0 @@
-import{auditInput as t,auditSha256 as g,logAuditRecord as h}from"../audit/audit-log.js";function f({audit:e,code:c,description:d,sessionHandle:o,toolNames:i,fetchBudget:u,fetchCapable:n,requestId:s,messageId:a}){h("Record code execution input",{code_sha256:e.sha256,code_length:e.length,request_id:s,message_id:a,flags:e.flags,subject_sha256:o?g(o):void 0,description:t(d),tools:[...i].sort().join(","),fetch_capable:n,fetch_budget:u,code:t(c)})}export{f as logCodeExecutionAudit};

package/dist/server/plugins/mcp/codemode/code-execution-telemetry.d.ts

@@ -1,17 +0,0 @@
-import { telemetry } from '../../../telemetry/index.js';
-import type { CodeAudit } from './code-audit.js';
-import type { McpCallAttribution } from '../types.js';
-type CodeExecutedData = Parameters<typeof telemetry.sendMcpCodeExecutedMessage>[0][number];
-export type McpCodeFailureReason = NonNullable<CodeExecutedData['failure_reason']>;
-type CodeExecutedEvent = McpCallAttribution & {
-    audit: CodeAudit;
-    fetchCount: number;
-    outcome: CodeExecutedData['outcome'];
-    durationMs: number;
-    failureReason?: McpCodeFailureReason;
-    failedTool?: string;
-};
-/** Audit record for one sandbox run. Carries the code fingerprint, never the code. */
-export declare function reportCodeExecuted({ audit, fetchCount, outcome, durationMs, failureReason, failedTool, client, clientVersion, requestId, messageId, }: CodeExecutedEvent): void;
-export {};
-//# sourceMappingURL=code-execution-telemetry.d.ts.map

package/dist/server/plugins/mcp/codemode/code-execution-telemetry.js

@@ -1 +0,0 @@
-import{telemetry as m}from"../../../telemetry/index.js";import{logger as h}from"../../../tools/notifiers/logger.js";import{McpServerType as p}from"../constants.js";import{serverAttributes as a}from"../utils/telemetry-attributes.js";function x({audit:e,fetchCount:t,outcome:s,durationMs:c,failureReason:o,failedTool:r,client:g,clientVersion:f,requestId:l,messageId:n}){try{m.sendMcpCodeExecutedMessage([{...a(p.Docs),code_sha256:e.sha256,code_length:e.length,fetch_count:t,outcome:s,flags:e.flags,duration_ms:c,failure_reason:o,failed_tool:r,client:g,client_version:f,message_id:n}],{requestId:l})}catch{}h.info(`Gateway MCP code executed [${e.sha256.slice(0,12)}] outcome=${s} codeLength=${e.length} fetchCount=${t}`+(e.flags?` flags=${e.flags}`:"")+` durationMs=${c}`+(o?` failureReason=${o}`:"")+(r?` failedTool=${r}`:""))}export{x as reportCodeExecuted};

package/dist/server/plugins/mcp/codemode/constants.d.ts

@@ -1,8 +0,0 @@
-export declare const EXECUTE_TOOL_NAME = "execute";
-export declare const DESCRIBE_TOOLS_TOOL_NAME = "describe-tools";
-export declare const FETCH_TOOL_NAME = "fetch";
-export declare const CODE_MODE_TOOL_NAMES: ReadonlySet<string>;
-export declare const TOOLS_BRIDGE_GLOBAL_NAME = "tools";
-export declare const FETCH_BRIDGE_GLOBAL_NAME = "__fetchBridge";
-export declare const FETCH_BRIDGE_FUNCTION_NAME = "fetch";
-//# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/codemode/constants.js

@@ -1 +0,0 @@
-import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as _,MANAGE_API_CREDENTIALS_TOOL_NAME as E}from"../constants.js";const O="execute",t="describe-tools",e="fetch",A=new Set([O,t,_,E]),N="tools",T="__fetchBridge",L="fetch";export{A as CODE_MODE_TOOL_NAMES,t as DESCRIBE_TOOLS_TOOL_NAME,O as EXECUTE_TOOL_NAME,L as FETCH_BRIDGE_FUNCTION_NAME,T as FETCH_BRIDGE_GLOBAL_NAME,e as FETCH_TOOL_NAME,N as TOOLS_BRIDGE_GLOBAL_NAME};

package/dist/server/plugins/mcp/codemode/invoke-tool.d.ts

@@ -1,4 +0,0 @@
-import type { McpToolContext, McpToolExtra } from '../types.js';
-/** Call a registered MCP tool from inside the sandbox and return its parsed result. */
-export declare function invokeTool(toolName: string, input: unknown, context: McpToolContext, extra: McpToolExtra): Promise<unknown>;
-//# sourceMappingURL=invoke-tool.d.ts.map

package/dist/server/plugins/mcp/codemode/invoke-tool.js

@@ -1 +0,0 @@
-import{executeMcpTool as i}from"../workers/execute-mcp-tool.js";import{ToolResultError as c}from"./tools/tool-errors.js";async function p(t,r,o,u){const e=await i({toolName:t,args:r,context:o,extra:u});if(e.isError)throw new c(n(e));return e.structuredContent!==void 0?e.structuredContent:s(n(e))}function n(t){return t.content.filter(r=>r.type==="text").map(r=>r.text).join("")}function s(t){try{return JSON.parse(t)}catch{return t}}export{p as invokeTool};

package/dist/server/plugins/mcp/codemode/prompts.d.ts

@@ -1,9 +0,0 @@
-import { type ToolListEntry } from './build-tool-list.js';
-export declare const DESCRIPTION_CHAR_LIMIT = 2048;
-export declare const EXECUTE_ARGS_NOTE = "Both `execute` arguments are required: `code` (the JavaScript to run; return a value to receive it) and `description` (a short human-readable summary of what the code does).";
-export declare function buildExecuteDescription(hasFetch: boolean, toolList?: ToolListEntry[]): string;
-export declare const DESCRIBE_TOOLS_DESCRIPTION: string;
-export declare function buildCodeModeInstructions(hasFetch: boolean, toolList?: ToolListEntry[]): string;
-export declare function buildExecuteExample(toolNames: string[]): string;
-export declare const USAGE_NOTES: string;
-//# sourceMappingURL=prompts.d.ts.map

package/dist/server/plugins/mcp/codemode/prompts.js

@@ -1,8 +0,0 @@
-import{buildToolList as i}from"./build-tool-list.js";const r=2048,d="Both `execute` arguments are required: `code` (the JavaScript to run; return a value to receive it) and `description` (a short human-readable summary of what the code does).",n="Available tools (exact signatures come from `describe-tools`):";function a(e,t){if(t.length===0)return e;const o=r-e.length-n.length-3,s=i(t,o);return s?[e,"",n,s].join(`
-`):e}function h(e,t=[]){const o=["Run JavaScript in a sandbox against the documentation tools on the global `tools` object.",e?"The extra globals are `tools`, `fetch`, `URL`, `URLSearchParams`, and `FormData` - there is no `console`, `setTimeout`, `require`, or Node.js API; all other I/O goes through `tools`.":"The only extra global is `tools` - there is no `fetch`, `console`, `setTimeout`, `require`, or Node.js API; all I/O goes through `tools`.","","Workflow - minimize round-trips; one `describe-tools` call plus one `execute` call covers most requests:","1. Analyze the request and decide which sandbox tools it needs.","2. Call `describe-tools` with those names to get their exact TypeScript signatures - inputs, result shapes, and a worked example. NEVER call `execute` with guessed method names, parameter names, enum values, or result field names: read fields off the declared return types, not from assumptions.","3. Batch everything into a SINGLE script: chain tool calls, pass one call's output into the next, process results in plain JavaScript, and `return` only what the request needs."].join(`
-`);return a(o,t)}const p=["Get the exact TypeScript signatures of the sandbox tools available to `execute`.","Analyze the user request first, then pass `tools` with only the tool names the request needs (every name is listed in this input schema / description); omit `tools` only when you cannot tell which tools apply.","Always call this before your first `execute` and never guess signatures. Request every tool the task may need in ONE call instead of calling this repeatedly."].join(`
-`);function m(e,t=[]){const o=["This server exposes documentation tools (API discovery, endpoint details, security schemes, full-text search) through `describe-tools` and `execute`:","- `describe-tools` returns the exact TypeScript signatures of the sandbox tools.","- `execute` runs JavaScript that calls those tools on the global `tools` object.","Workflow: analyze the request, call `describe-tools` once with `tools` set to only the names it needs, then batch everything into a single `execute` script. Minimize round-trips and never guess tool signatures.",...e?["The sandbox also has a global `fetch` that can call the documented APIs (allow-listed hosts only). Include `fetch` in your `describe-tools` call to get its contract and the list of callable APIs."]:[]].join(`
-`);return a(o,t)}const l=["listApis","getEndpoints"],c=["Example - list the write endpoints of an API:","","```ts","const { items } = await tools.listApis({ filter: 'billing' });","const [api] = items;",`if (!api) return { error: 'no API matches "billing"' };`,"const { endpoints } = await tools.getEndpoints({ name: api.name });","const writes = endpoints.filter((e) => e.method !== 'GET');","return { api: api.name, writes: writes.map((e) => `${e.method} ${e.path}`) };","```"].join(`
-`);function g(e){if(l.every(o=>e.includes(o)))return c;const[t]=e;return t?[`Example - call \`${t}\` and return what the request needs:`,"","```ts",`const result = await tools.${t}({ /* the input its signature above declares */ });`,"return result;","```"].join(`
-`):""}const b=["Types named `OpenApi\u2026` are the standard OpenAPI Specification objects.","Payload samples live on a media type object (`requestBody.content[mediaType]`, `responses[code].content[mediaType]`): `.example` holds a single value, `.examples[name].value` a named map, and some descriptions only set `.schema.example`. Read each before concluding a sample is absent."].join(`
-`);export{p as DESCRIBE_TOOLS_DESCRIPTION,r as DESCRIPTION_CHAR_LIMIT,d as EXECUTE_ARGS_NOTE,b as USAGE_NOTES,m as buildCodeModeInstructions,h as buildExecuteDescription,g as buildExecuteExample};

package/dist/server/plugins/mcp/codemode/sandbox/create-sandbox-setup.d.ts

@@ -1,10 +0,0 @@
-import type { SetupSandboxContext } from '../../../../sandbox/types.js';
-import type { SandboxFetch, SandboxTool } from '../types.js';
-/**
- * Builds the `setupContext` that shapes the shared sandbox (`~/server/sandbox`) for code
- * mode: the given tools — and, when provided, host fetch — become host-function rails, each
- * capped and bound by the run's budget, and the fetch prelude installs the guest `fetch`
- * surface over its rail.
- */
-export declare function createSandboxSetup(tools: Record<string, SandboxTool>, hostFetch?: SandboxFetch): SetupSandboxContext;
-//# sourceMappingURL=create-sandbox-setup.d.ts.map

package/dist/server/plugins/mcp/codemode/sandbox/create-sandbox-setup.js

@@ -1 +0,0 @@
-import{setupHostFunctions as l}from"../../../../sandbox/utils/setup-host-functions.js";import{evalGuestCode as r}from"../../../../sandbox/utils/eval-guest-code.js";import{CONSOLE_STUB as u,SANDBOX_FETCH_SETUP as _}from"./polyfills/index.js";import{FETCH_BRIDGE_FUNCTION_NAME as i,FETCH_BRIDGE_GLOBAL_NAME as E,TOOLS_BRIDGE_GLOBAL_NAME as L}from"../constants.js";const T=1e3,c=50,p=8*1024*1024;function A(m,t){return(o,s)=>{r(o,`(() => {${u}})();`);const a=[l(o,m,{globalName:L,budget:s,maxCalls:T,maxOutputBytes:p,messages:{outputTooLarge:e=>`Tool output is too large (${e} bytes); request narrower data instead`,callLimitExceeded:e=>`Exceeded the limit of ${e} tool calls`}})];return t&&(a.push(l(o,{[i]:e=>t(e)},{globalName:E,budget:s,maxCalls:c,messages:{outputTooLarge:e=>`Response is too large (${e} bytes); request less data`,callLimitExceeded:e=>`Exceeded the limit of ${e} fetch calls`}})),r(o,`(() => {${_}})();`)),()=>{for(const e of a)e()}}}export{A as createSandboxSetup};

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/console.d.ts

@@ -1,2 +0,0 @@
-export declare const CONSOLE_STUB = "\nglobalThis.console = Object.freeze({\n  assert() {}, clear() {}, count() {}, countReset() {}, debug() {}, dir() {}, dirxml() {},\n  error() {}, group() {}, groupCollapsed() {}, groupEnd() {}, info() {}, log() {}, table() {},\n  time() {}, timeEnd() {}, timeLog() {}, trace() {}, warn() {},\n});\n";
-//# sourceMappingURL=console.d.ts.map

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/console.js

@@ -1,7 +0,0 @@
-const e=`
-globalThis.console = Object.freeze({
-  assert() {}, clear() {}, count() {}, countReset() {}, debug() {}, dir() {}, dirxml() {},
-  error() {}, group() {}, groupCollapsed() {}, groupEnd() {}, info() {}, log() {}, table() {},
-  time() {}, timeEnd() {}, timeLog() {}, trace() {}, warn() {},
-});
-`;export{e as CONSOLE_STUB};

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/fetch-shim.d.ts

@@ -1,6 +0,0 @@
-/**
- * `fetch`: not a polyfill but a bridge. It takes the host rail off the global object so guest
- * code cannot reach it directly, encodes the body, and hands the host a plain request.
- */
-export declare const FETCH_SHIM = "\n  const hostFetch = globalThis.__fetchBridge.fetch;\n  delete globalThis.__fetchBridge;\n  // RFC 7578: a field name travels with its quote and line breaks escaped, so a name cannot close its own header and open a part the caller did not write.\n  const escapeFieldName = (name) =>\n    String(name).replace(\n      /[\"\\r\\n]/g,\n      (char) => '%' + char.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'),\n    );\n  globalThis.fetch = (url, init = {}) => {\n    let body;\n    let autoContentType;\n    if (init.body instanceof URLSearchParams) {\n      body = init.body.toString();\n      autoContentType = 'application/x-www-form-urlencoded';\n    } else if (init.body instanceof FormData) {\n      const boundary = '----FormBoundary' + Math.random().toString(36).slice(2);\n      body = init.body._fields\n        .map(([k, v]) =>\n          '--' + boundary + '\\r\\nContent-Disposition: form-data; name=\"' + escapeFieldName(k) + '\"\\r\\n\\r\\n' + v,\n        )\n        .join('\\r\\n') + '\\r\\n--' + boundary + '--';\n      autoContentType = 'multipart/form-data; boundary=' + boundary;\n    } else if (init.body != null && typeof init.body !== 'string') {\n      throw new TypeError('fetch body must be a string, URLSearchParams, or FormData');\n    } else {\n      body = init.body ?? undefined;\n    }\n    const callerHeaders = init.headers;\n    const hasContentType = callerHeaders != null && Object.keys(callerHeaders).some(\n      (k) => k.toLowerCase() === 'content-type',\n    );\n    const headers = autoContentType && !hasContentType\n      ? Object.assign({ 'content-type': autoContentType }, callerHeaders)\n      : callerHeaders;\n    return hostFetch({\n      url: String(url),\n      method: init.method,\n      headers,\n      body,\n      securityScheme: init.securityScheme,\n    })\n      .then((res) => {\n        const resHeaders = res.headers || {};\n        return {\n          status: res.status,\n          statusText: res.statusText,\n          ok: res.ok,\n          headers: {\n            get: (name) => {\n              const value = resHeaders[String(name).toLowerCase()];\n              return value === undefined ? null : value;\n            },\n          },\n          json: () => Promise.resolve(JSON.parse(res.bodyText)),\n          text: () => Promise.resolve(res.bodyText),\n        };\n      });\n  };\n";
-//# sourceMappingURL=fetch-shim.d.ts.map

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/fetch-shim.js

@@ -1,60 +0,0 @@
-import{FETCH_BRIDGE_FUNCTION_NAME as t,FETCH_BRIDGE_GLOBAL_NAME as e}from"../../constants.js";const a=`
-  const hostFetch = globalThis.${e}.${t};
-  delete globalThis.${e};
-  // RFC 7578: a field name travels with its quote and line breaks escaped, so a name cannot close its own header and open a part the caller did not write.
-  const escapeFieldName = (name) =>
-    String(name).replace(
-      /["\\r\\n]/g,
-      (char) => '%' + char.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'),
-    );
-  globalThis.fetch = (url, init = {}) => {
-    let body;
-    let autoContentType;
-    if (init.body instanceof URLSearchParams) {
-      body = init.body.toString();
-      autoContentType = 'application/x-www-form-urlencoded';
-    } else if (init.body instanceof FormData) {
-      const boundary = '----FormBoundary' + Math.random().toString(36).slice(2);
-      body = init.body._fields
-        .map(([k, v]) =>
-          '--' + boundary + '\\r\\nContent-Disposition: form-data; name="' + escapeFieldName(k) + '"\\r\\n\\r\\n' + v,
-        )
-        .join('\\r\\n') + '\\r\\n--' + boundary + '--';
-      autoContentType = 'multipart/form-data; boundary=' + boundary;
-    } else if (init.body != null && typeof init.body !== 'string') {
-      throw new TypeError('fetch body must be a string, URLSearchParams, or FormData');
-    } else {
-      body = init.body ?? undefined;
-    }
-    const callerHeaders = init.headers;
-    const hasContentType = callerHeaders != null && Object.keys(callerHeaders).some(
-      (k) => k.toLowerCase() === 'content-type',
-    );
-    const headers = autoContentType && !hasContentType
-      ? Object.assign({ 'content-type': autoContentType }, callerHeaders)
-      : callerHeaders;
-    return hostFetch({
-      url: String(url),
-      method: init.method,
-      headers,
-      body,
-      securityScheme: init.securityScheme,
-    })
-      .then((res) => {
-        const resHeaders = res.headers || {};
-        return {
-          status: res.status,
-          statusText: res.statusText,
-          ok: res.ok,
-          headers: {
-            get: (name) => {
-              const value = resHeaders[String(name).toLowerCase()];
-              return value === undefined ? null : value;
-            },
-          },
-          json: () => Promise.resolve(JSON.parse(res.bodyText)),
-          text: () => Promise.resolve(res.bodyText),
-        };
-      });
-  };
-`;export{a as FETCH_SHIM};

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/form-data.d.ts

@@ -1,3 +0,0 @@
-/** `FormData`: the multipart body the fetch shim serializes. */
-export declare const FORM_DATA_POLYFILL = "\n  const FormData = class FormData {\n    constructor() { this._fields = []; }\n    append(key, value) { this._fields.push([String(key), String(value)]); }\n    set(key, value) {\n      const k = String(key), v = String(value);\n      this._fields = this._fields.filter(([fk]) => fk !== k);\n      this._fields.push([k, v]);\n    }\n    get(key) { return (this._fields.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }\n    has(key) { return this._fields.some(([k]) => k === String(key)); }\n    delete(key) { this._fields = this._fields.filter(([k]) => k !== String(key)); }\n    entries() { return this._fields.values(); }\n    [Symbol.iterator]() { return this._fields.values(); }\n  };\n  globalThis.FormData = FormData;\n";
-//# sourceMappingURL=form-data.d.ts.map

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/form-data.js

@@ -1,17 +0,0 @@
-const e=`
-  const FormData = class FormData {
-    constructor() { this._fields = []; }
-    append(key, value) { this._fields.push([String(key), String(value)]); }
-    set(key, value) {
-      const k = String(key), v = String(value);
-      this._fields = this._fields.filter(([fk]) => fk !== k);
-      this._fields.push([k, v]);
-    }
-    get(key) { return (this._fields.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }
-    has(key) { return this._fields.some(([k]) => k === String(key)); }
-    delete(key) { this._fields = this._fields.filter(([k]) => k !== String(key)); }
-    entries() { return this._fields.values(); }
-    [Symbol.iterator]() { return this._fields.values(); }
-  };
-  globalThis.FormData = FormData;
-`;export{e as FORM_DATA_POLYFILL};

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/index.d.ts

@@ -1,4 +0,0 @@
-/** The guest prelude installed when the gateway fetch capability is on */
-export declare const SANDBOX_FETCH_SETUP: string;
-export { CONSOLE_STUB } from './console.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/index.js

@@ -1,2 +0,0 @@
-import{FETCH_SHIM as o}from"./fetch-shim.js";import{FORM_DATA_POLYFILL as L}from"./form-data.js";import{URL_POLYFILL as r}from"./url.js";import{URL_SEARCH_PARAMS_POLYFILL as _}from"./url-search-params.js";const p=[_,r,L,o].join(`
-`);import{CONSOLE_STUB as f}from"./console.js";export{f as CONSOLE_STUB,p as SANDBOX_FETCH_SETUP};

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/url-search-params.d.ts

@@ -1,3 +0,0 @@
-/** `URLSearchParams`: query-string parsing and serialization, and the store behind `URL.searchParams`. */
-export declare const URL_SEARCH_PARAMS_POLYFILL = "\n  // application/x-www-form-urlencoded reads '+' as a space, and leaves an escape it cannot read alone.\n  // Decoding one well-formed run at a time is what keeps a stray '%' \u2014 '?discount=50%', a half-encoded cursor \u2014 from throwing URIError and ending the run.\n  const decodeFormPart = (value) =>\n    value.replace(/\\+/g, ' ').replace(/(?:%[0-9A-Fa-f]{2})+/g, (escaped) => {\n      try { return decodeURIComponent(escaped); } catch (error) { return escaped; }\n    });\n\n  // The same rules in reverse: everything but alphanumerics and * - . _ is percent-encoded, and a space is '+'. encodeURIComponent keeps !'()~ literal, so those are encoded after it runs.\n  const encodeFormPart = (value) =>\n    encodeURIComponent(String(value))\n      .replace(/%20/g, '+')\n      .replace(/[!'()~]/g, (char) => '%' + char.charCodeAt(0).toString(16).toUpperCase());\n\n  const URLSearchParams = class URLSearchParams {\n    constructor(init) {\n      this._params = [];\n      if (init == null) return;\n      if (typeof init === 'string') {\n        const str = init.startsWith('?') ? init.slice(1) : init;\n        for (const pair of (str ? str.split('&') : [])) {\n          if (pair === '') continue;\n          const eq = pair.indexOf('=');\n          const key = eq >= 0 ? pair.slice(0, eq) : pair;\n          const value = eq >= 0 ? pair.slice(eq + 1) : '';\n          this._params.push([decodeFormPart(key), decodeFormPart(value)]);\n        }\n      } else if (typeof init[Symbol.iterator] === 'function') {\n        // [['a', '1'], ['b', '2']] and another URLSearchParams both arrive here.\n        for (const [key, value] of init) this._params.push([String(key), String(value)]);\n      } else if (typeof init === 'object') {\n        for (const [key, value] of Object.entries(init)) this._params.push([key, String(value)]);\n      }\n    }\n    get size() { return this._params.length; }\n    append(key, value) { this._params.push([String(key), String(value)]); }\n    set(key, value) {\n      const k = String(key), v = String(value);\n      const at = this._params.findIndex(([pk]) => pk === k);\n      if (at === -1) { this._params.push([k, v]); return; }\n      // Overwrite where the key already sat, so an edit does not reorder the query the server sent.\n      this._params[at] = [k, v];\n      this._params = this._params.filter(([pk], index) => pk !== k || index === at);\n    }\n    get(key) { return (this._params.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }\n    getAll(key) { return this._params.filter(([k]) => k === String(key)).map(([, v]) => v); }\n    has(key) { return this._params.some(([k]) => k === String(key)); }\n    delete(key) { this._params = this._params.filter(([k]) => k !== String(key)); }\n    forEach(callback, thisArg) {\n      for (const [k, v] of [...this._params]) callback.call(thisArg, v, k, this);\n    }\n    keys() { return this._params.map(([k]) => k).values(); }\n    values() { return this._params.map(([, v]) => v).values(); }\n    entries() { return this._params.map(([k, v]) => [k, v]).values(); }\n    sort() { this._params.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)); }\n    [Symbol.iterator]() { return this.entries(); }\n    toString() {\n      return this._params\n        .map(([k, v]) => encodeFormPart(k) + '=' + encodeFormPart(v))\n        .join('&');\n    }\n  };\n  globalThis.URLSearchParams = URLSearchParams;\n";
-//# sourceMappingURL=url-search-params.d.ts.map

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/url-search-params.js

@@ -1,64 +0,0 @@
-const e=`
-  // application/x-www-form-urlencoded reads '+' as a space, and leaves an escape it cannot read alone.
-  // Decoding one well-formed run at a time is what keeps a stray '%' \u2014 '?discount=50%', a half-encoded cursor \u2014 from throwing URIError and ending the run.
-  const decodeFormPart = (value) =>
-    value.replace(/\\+/g, ' ').replace(/(?:%[0-9A-Fa-f]{2})+/g, (escaped) => {
-      try { return decodeURIComponent(escaped); } catch (error) { return escaped; }
-    });
-
-  // The same rules in reverse: everything but alphanumerics and * - . _ is percent-encoded, and a space is '+'. encodeURIComponent keeps !'()~ literal, so those are encoded after it runs.
-  const encodeFormPart = (value) =>
-    encodeURIComponent(String(value))
-      .replace(/%20/g, '+')
-      .replace(/[!'()~]/g, (char) => '%' + char.charCodeAt(0).toString(16).toUpperCase());
-
-  const URLSearchParams = class URLSearchParams {
-    constructor(init) {
-      this._params = [];
-      if (init == null) return;
-      if (typeof init === 'string') {
-        const str = init.startsWith('?') ? init.slice(1) : init;
-        for (const pair of (str ? str.split('&') : [])) {
-          if (pair === '') continue;
-          const eq = pair.indexOf('=');
-          const key = eq >= 0 ? pair.slice(0, eq) : pair;
-          const value = eq >= 0 ? pair.slice(eq + 1) : '';
-          this._params.push([decodeFormPart(key), decodeFormPart(value)]);
-        }
-      } else if (typeof init[Symbol.iterator] === 'function') {
-        // [['a', '1'], ['b', '2']] and another URLSearchParams both arrive here.
-        for (const [key, value] of init) this._params.push([String(key), String(value)]);
-      } else if (typeof init === 'object') {
-        for (const [key, value] of Object.entries(init)) this._params.push([key, String(value)]);
-      }
-    }
-    get size() { return this._params.length; }
-    append(key, value) { this._params.push([String(key), String(value)]); }
-    set(key, value) {
-      const k = String(key), v = String(value);
-      const at = this._params.findIndex(([pk]) => pk === k);
-      if (at === -1) { this._params.push([k, v]); return; }
-      // Overwrite where the key already sat, so an edit does not reorder the query the server sent.
-      this._params[at] = [k, v];
-      this._params = this._params.filter(([pk], index) => pk !== k || index === at);
-    }
-    get(key) { return (this._params.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }
-    getAll(key) { return this._params.filter(([k]) => k === String(key)).map(([, v]) => v); }
-    has(key) { return this._params.some(([k]) => k === String(key)); }
-    delete(key) { this._params = this._params.filter(([k]) => k !== String(key)); }
-    forEach(callback, thisArg) {
-      for (const [k, v] of [...this._params]) callback.call(thisArg, v, k, this);
-    }
-    keys() { return this._params.map(([k]) => k).values(); }
-    values() { return this._params.map(([, v]) => v).values(); }
-    entries() { return this._params.map(([k, v]) => [k, v]).values(); }
-    sort() { this._params.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)); }
-    [Symbol.iterator]() { return this.entries(); }
-    toString() {
-      return this._params
-        .map(([k, v]) => encodeFormPart(k) + '=' + encodeFormPart(v))
-        .join('&');
-    }
-  };
-  globalThis.URLSearchParams = URLSearchParams;
-`;export{e as URL_SEARCH_PARAMS_POLYFILL};

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/url.d.ts

@@ -1,3 +0,0 @@
-/** `URL`: parses and resolves a url string, and exposes its parts. */
-export declare const URL_POLYFILL = "\n  // Collapses '.' and '..'. A backslash separates path segments, the way the host parser reads\n  // one, so it is folded into '/' first \u2014 otherwise the two disagree about where the host name\n  // ends in 'https://a.example\\@b.example/', and guest code reads a host the gateway never calls.\n  const normalizePath = (rawPath) => {\n    const path = rawPath.replace(/\\\\/g, '/');\n    const out = [];\n    for (const segment of path.split('/')) {\n      if (segment === '.') continue;\n      if (segment === '..') { if (out.length > 1) out.pop(); continue; }\n      out.push(segment);\n    }\n    let joined = out.join('/');\n    if ((path.endsWith('/.') || path.endsWith('/..')) && !joined.endsWith('/')) joined += '/';\n    return joined;\n  };\n\n  const DEFAULT_PORTS = { 'http:': '80', 'https:': '443', 'ws:': '80', 'wss:': '443', 'ftp:': '21' };\n\n  // Percent-encode what cannot travel literally in a url, so a hand-assembled path or query\n  // reaches the host parser as the caller meant it. Non-ASCII goes out as UTF-8, in runs, so a\n  // surrogate pair is encoded as the one character it stands for.\n  const encodeLiterals = (value) =>\n    value.replace(/[\\s\"<>\\`{}\\\\^]|[^\\x00-\\x7F]+/g, (chunk) => {\n      try { return encodeURIComponent(chunk); } catch (error) { return chunk; }\n    });\n\n  // A non-ASCII host name is lower-cased but not punycoded \u2014 that needs an IDNA table this sandbox\n  // does not carry. The host re-parses the url before it fetches, so the request still goes to the\n  // punycoded name; only what guest code reads back differs.\n  const parseHostPort = (hostport, scheme) => {\n    let hostname = hostport;\n    let port = '';\n    if (hostport.startsWith('[')) {\n      const close = hostport.indexOf(']');\n      hostname = hostport.slice(0, close + 1);\n      const after = hostport.slice(close + 1);\n      if (after.startsWith(':')) port = after.slice(1);\n    } else {\n      const colon = hostport.lastIndexOf(':');\n      if (colon !== -1) { hostname = hostport.slice(0, colon); port = hostport.slice(colon + 1); }\n    }\n    if (port !== '' && !/^[0-9]+$/.test(port)) return null;\n    if (hostname === '') return null;\n    return {\n      hostname: hostname.toLowerCase(),\n      port: DEFAULT_PORTS[scheme] === port ? '' : port,\n      // A host written without a port leaves the port alone, rather than clearing it.\n      hasPort: port !== '',\n    };\n  };\n\n  const ABSOLUTE_RE = /^([A-Za-z][A-Za-z0-9+\\-.]*):(\\/\\/)?([\\s\\S]*)$/;\n\n  const parseAuthorityUrl = (scheme, rest) => {\n    const cut = rest.search(/[/\\\\?#]/);\n    const authority = cut === -1 ? rest : rest.slice(0, cut);\n    let tail = cut === -1 ? '' : rest.slice(cut);\n    let username = '';\n    let password = '';\n    let hostport = authority;\n    const at = authority.lastIndexOf('@');\n    if (at !== -1) {\n      const credentials = authority.slice(0, at);\n      hostport = authority.slice(at + 1);\n      const colon = credentials.indexOf(':');\n      username = colon === -1 ? credentials : credentials.slice(0, colon);\n      password = colon === -1 ? '' : credentials.slice(colon + 1);\n    }\n    const hostPort = parseHostPort(hostport, scheme);\n    if (!hostPort) return null;\n    let hash = '';\n    const hashAt = tail.indexOf('#');\n    if (hashAt !== -1) { hash = tail.slice(hashAt); tail = tail.slice(0, hashAt); }\n    let search = '';\n    const queryAt = tail.indexOf('?');\n    if (queryAt !== -1) { search = tail.slice(queryAt); tail = tail.slice(0, queryAt); }\n    let pathname = tail === '' ? '/' : tail;\n    if (!/^[/\\\\]/.test(pathname)) pathname = '/' + pathname;\n    return {\n      protocol: scheme,\n      username,\n      password,\n      hostname: hostPort.hostname,\n      port: hostPort.port,\n      pathname: encodeLiterals(normalizePath(pathname)),\n      search: encodeLiterals(search === '?' ? '' : search),\n      hash: encodeLiterals(hash === '#' ? '' : hash),\n    };\n  };\n\n  const parseUrl = (input, base) => {\n    // A tab or newline inside a url is dropped, not encoded \u2014 the host parser does the same, and\n    // a url copied out of a wrapped response body is the usual way one gets in here.\n    const str = String(input).trim().replace(/[\\t\\n\\r]/g, '');\n    const matched = ABSOLUTE_RE.exec(str);\n    // A scheme with no `//` (mailto:, data:) is not a fetch target, so it is not resolved.\n    if (matched) return matched[2] ? parseAuthorityUrl(matched[1].toLowerCase() + ':', matched[3]) : null;\n    if (base === undefined) return null;\n    const resolved = parseUrl(base, undefined);\n    if (!resolved) return null;\n    if (/^[/\\\\]{2}/.test(str)) return parseAuthorityUrl(resolved.protocol, str.slice(2));\n    const parts = { ...resolved };\n    if (str.startsWith('#')) {\n      parts.hash = encodeLiterals(str === '#' ? '' : str);\n      return parts;\n    }\n    let rest = str;\n    let hash = '';\n    const hashAt = rest.indexOf('#');\n    if (hashAt !== -1) { hash = rest.slice(hashAt); rest = rest.slice(0, hashAt); }\n    let search = '';\n    const queryAt = rest.indexOf('?');\n    if (queryAt !== -1) { search = rest.slice(queryAt); rest = rest.slice(0, queryAt); }\n    if (rest !== '') {\n      const absolute = /^[/\\\\]/.test(rest)\n        ? rest\n        : resolved.pathname.slice(0, resolved.pathname.lastIndexOf('/') + 1) + rest;\n      parts.pathname = encodeLiterals(normalizePath(absolute));\n    }\n    // An empty reference with no query of its own keeps the base query (RFC 3986 section 5.3).\n    parts.search = rest === '' && search === '' ? resolved.search : encodeLiterals(search === '?' ? '' : search);\n    parts.hash = encodeLiterals(hash === '#' ? '' : hash);\n    return parts;\n  };\n\n  const URL = class URL {\n    constructor(input, base) {\n      const parsed = parseUrl(input, base === undefined ? undefined : String(base));\n      if (!parsed) throw new TypeError('Invalid URL: ' + String(input));\n      this._parts = parsed;\n      this._params = undefined;\n      this._edited = false;\n    }\n    // The query stays exactly as it arrived until searchParams edits it, so reading a url apart\n    // and putting it back together does not re-encode what the server sent.\n    _applyParams() {\n      if (this._edited && this._params) {\n        const query = this._params.toString();\n        this._parts.search = query ? '?' + query : '';\n        this._edited = false;\n      }\n    }\n    // Every part a caller can read, it can also write. Guest code runs sloppy, so a missing\n    // setter would swallow `url.host = \u2026` and fetch the address the caller meant to replace.\n    get protocol() { return this._parts.protocol; }\n    set protocol(value) {\n      const next = String(value).toLowerCase().replace(/:$/, '') + ':';\n      // Only a scheme that carries an authority can replace one, the way the host parser reads it.\n      if (DEFAULT_PORTS[next] !== undefined) this._parts.protocol = next;\n    }\n    get username() { return this._parts.username; }\n    set username(value) { this._parts.username = String(value); }\n    get password() { return this._parts.password; }\n    set password(value) { this._parts.password = String(value); }\n    get hostname() { return this._parts.hostname; }\n    set hostname(value) { this._parts.hostname = String(value).toLowerCase(); }\n    get port() { return this._parts.port; }\n    set port(value) {\n      const port = String(value);\n      if (port !== '' && !/^[0-9]+$/.test(port)) return;\n      this._parts.port = DEFAULT_PORTS[this._parts.protocol] === port ? '' : port;\n    }\n    get host() {\n      return this._parts.port ? this._parts.hostname + ':' + this._parts.port : this._parts.hostname;\n    }\n    set host(value) {\n      const parsed = parseHostPort(String(value), this._parts.protocol);\n      if (!parsed) return;\n      this._parts.hostname = parsed.hostname;\n      if (parsed.hasPort) this._parts.port = parsed.port;\n    }\n    get origin() { return this._parts.protocol + '//' + this.host; }\n    get pathname() { return this._parts.pathname; }\n    set pathname(value) {\n      const path = String(value);\n      this._parts.pathname = encodeLiterals(path.startsWith('/') ? path : '/' + path);\n    }\n    get search() {\n      this._applyParams();\n      return this._parts.search;\n    }\n    set search(value) {\n      const query = String(value);\n      const body = query.startsWith('?') ? query.slice(1) : query;\n      this._parts.search = body ? encodeLiterals('?' + body) : '';\n      this._params = undefined;\n      this._edited = false;\n    }\n    get searchParams() {\n      if (!this._params) {\n        const params = new URLSearchParams(this._parts.search);\n        const url = this;\n        // Every method that can change the parameters has to mark the query for re-serialization.\n        for (const method of ['append', 'set', 'delete', 'sort']) {\n          const original = params[method];\n          params[method] = function (...args) {\n            url._edited = true;\n            return original.apply(params, args);\n          };\n        }\n        this._params = params;\n      }\n      return this._params;\n    }\n    get hash() { return this._parts.hash; }\n    set hash(value) {\n      const fragment = String(value);\n      this._parts.hash = fragment === ''\n        ? ''\n        : encodeLiterals(fragment.startsWith('#') ? fragment : '#' + fragment);\n    }\n    get href() {\n      this._applyParams();\n      const credentials = this._parts.username\n        ? this._parts.username + (this._parts.password ? ':' + this._parts.password : '') + '@'\n        : '';\n      return this._parts.protocol + '//' + credentials + this.host +\n        this._parts.pathname + this._parts.search + this._parts.hash;\n    }\n    set href(value) {\n      const parsed = parseUrl(value, undefined);\n      if (!parsed) throw new TypeError('Invalid URL: ' + String(value));\n      this._parts = parsed;\n      this._params = undefined;\n      this._edited = false;\n    }\n    toString() { return this.href; }\n    toJSON() { return this.href; }\n    static canParse(input, base) {\n      return parseUrl(input, base === undefined ? undefined : String(base)) !== null;\n    }\n    static parse(input, base) {\n      const parsed = parseUrl(input, base === undefined ? undefined : String(base));\n      return parsed ? new URL(input, base) : null;\n    }\n  };\n  globalThis.URL = URL;\n";
-//# sourceMappingURL=url.d.ts.map