veryfront 0.1.1190 → 0.1.1192

package/esm/src/server/utils/proxy-trust.d.ts

@@ -6,28 +6,21 @@
  * Any other treatment lets an attacker reaching the runtime directly spoof the
  * origin host or point project discovery at arbitrary filesystem paths.
  *
- * A request is considered proxy-trusted when either:
- *   1. The operator has opted in via `VERYFRONT_TRUST_FORWARDED_HEADERS=1`
- *      (strict "1" match — "true", "yes", whitespace-padded values do NOT count
- *      so misconfiguration fails closed); or
- *   2. The request carries a valid `x-veryfront-dispatch-jws` header that
- *      cryptographically verifies against the configured control-plane public
- *      key and whose `iat`/`exp` claims are within the allowed freshness
- *      window. Presence alone is NOT trusted because the proxy does not strip
- *      this header from untrusted inbound requests (it has to pass through to
- *      the channel-invoke handler unchanged), so a
- *      direct-access attacker could otherwise set any value and promote
- *      forwarded-header spoofing.
+ * Trust is an operator-owned deployment property, not a property of an
+ * arbitrary application request. In particular, a channel-dispatch JWS is
+ * intentionally not accepted here: that token is not bound to this request's
+ * method, path, body, or routing identity and can therefore be replayed as an
+ * unrelated proxy credential while it is fresh.
  *
  * @module server/utils/proxy-trust
  */
 export interface ProxyTrustOptions {
     /**
-     * PEM-encoded Ed25519 public key used to verify `x-veryfront-dispatch-jws`.
-     * When absent, the dispatch-JWS trust signal is disabled (fails closed) and
-     * only the operator opt-in env var can unlock proxy trust.
+     * Retained for call-site compatibility. Control-plane signing keys authorize
+     * only the exact operation verified by the control-plane handler and never
+     * promote a general HTTP request to proxy-trusted.
      */
     publicKeyPem?: string;
 }
-export declare function isProxyTrusted(req: Request, options?: ProxyTrustOptions): Promise<boolean>;
+export declare function isProxyTrusted(_req: Request, _options?: ProxyTrustOptions): Promise<boolean>;
 //# sourceMappingURL=proxy-trust.d.ts.map

package/esm/src/server/utils/proxy-trust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-trust.d.ts","sourceRoot":"","sources":["../../../../src/src/server/utils/proxy-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,OAAO,CAAC,CAalB"}
+{"version":3,"file":"proxy-trust.d.ts","sourceRoot":"","sources":["../../../../src/src/server/utils/proxy-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,OAAO,EACb,QAAQ,GAAE,iBAAsB,GAC/B,OAAO,CAAC,OAAO,CAAC,CAElB"}

package/esm/src/server/utils/proxy-trust.js

@@ -6,36 +6,15 @@
  * Any other treatment lets an attacker reaching the runtime directly spoof the
  * origin host or point project discovery at arbitrary filesystem paths.
  *
- * A request is considered proxy-trusted when either:
- *   1. The operator has opted in via `VERYFRONT_TRUST_FORWARDED_HEADERS=1`
- *      (strict "1" match — "true", "yes", whitespace-padded values do NOT count
- *      so misconfiguration fails closed); or
- *   2. The request carries a valid `x-veryfront-dispatch-jws` header that
- *      cryptographically verifies against the configured control-plane public
- *      key and whose `iat`/`exp` claims are within the allowed freshness
- *      window. Presence alone is NOT trusted because the proxy does not strip
- *      this header from untrusted inbound requests (it has to pass through to
- *      the channel-invoke handler unchanged), so a
- *      direct-access attacker could otherwise set any value and promote
- *      forwarded-header spoofing.
+ * Trust is an operator-owned deployment property, not a property of an
+ * arbitrary application request. In particular, a channel-dispatch JWS is
+ * intentionally not accepted here: that token is not bound to this request's
+ * method, path, body, or routing identity and can therefore be replayed as an
+ * unrelated proxy credential while it is fresh.
  *
  * @module server/utils/proxy-trust
  */
-import { verifyDispatchJwsSignature } from "../../channels/control-plane.js";
-import { getHostEnv } from "../../platform/compat/process.js";
-const DISPATCH_JWS_HEADER = "x-veryfront-dispatch-jws";
-const MAX_DISPATCH_SIGNATURE_AGE_SECONDS = 60;
-export async function isProxyTrusted(req, options = {}) {
-    if (getHostEnv("VERYFRONT_TRUST_FORWARDED_HEADERS") === "1")
-        return true;
-    const jws = req.headers.get(DISPATCH_JWS_HEADER);
-    if (!jws)
-        return false;
-    const { publicKeyPem } = options;
-    if (!publicKeyPem)
-        return false;
-    return verifyDispatchJwsSignature(jws, {
-        publicKeyPem,
-        maxAgeSeconds: MAX_DISPATCH_SIGNATURE_AGE_SECONDS,
-    });
+import { isProxyTopologyTrusted } from "../../platform/compat/proxy-topology.js";
+export async function isProxyTrusted(_req, _options = {}) {
+    return isProxyTopologyTrusted();
 }

package/esm/src/testing/assert.d.ts

@@ -14,7 +14,7 @@ export declare function assert(expr: unknown, msg?: string): asserts expr;
 export declare function assertExists<T>(actual: T, msg?: string): asserts actual is NonNullable<T>;
 /** Assert that a synchronous function throws. */
 export declare function assertThrows(fn: () => unknown, errorClassOrMsg?: ErrorClass | string, msgIncludesOrMsg?: string, msg?: string): unknown;
-/** Assert that an async function rejects. */
+/** Assert that an async function rejects, returning the rejection reason. */
 export declare function assertRejects(fn: () => Promise<unknown>, errorClassOrMsg?: ErrorClass | string, msgIncludesOrMsg?: string, msg?: string): Promise<unknown>;
 /** Assert that a string contains another string. */
 export declare function assertStringIncludes(actual: string, expected: string, msg?: string): void;

package/esm/src/testing/assert.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assert.d.ts","sourceRoot":"","sources":["../../../src/src/testing/assert.ts"],"names":[],"mappings":"AAAA,OAAO,yBAAyB,CAAC;AACjC,OAAO,WAAW,CAAC;AAKnB,2CAA2C;AAC3C,KAAK,UAAU,GAAG,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,KAAK,CAAC;AAqQhD,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAE1E;AAED,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAE7E;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEhF;AAED,qCAAqC;AACrC,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAEhE;AAED,oDAAoD;AACpD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAEzF;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAC1B,EAAE,EAAE,MAAM,OAAO,EACjB,eAAe,CAAC,EAAE,UAAU,GAAG,MAAM,EACrC,gBAAgB,CAAC,EAAE,MAAM,EACzB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAET;AAED,6CAA6C;AAC7C,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC1B,eAAe,CAAC,EAAE,UAAU,GAAG,MAAM,EACrC,gBAAgB,CAAC,EAAE,MAAM,EACzB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEzF;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEhF;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,MAAM,EAAE,OAAO,EAEf,YAAY,EAAE,QAAQ,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAChD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,IAAI,CAAC,CAErB;AAED,8CAA8C;AAC9C,wBAAgB,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAExC;AAED,qDAAqD;AACrD,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEnF;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,GAAG,CAAC,EAAE,MAAM,GACX,IAAI,CAEN;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAElF;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEzF;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAE/E;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEtF"}
+{"version":3,"file":"assert.d.ts","sourceRoot":"","sources":["../../../src/src/testing/assert.ts"],"names":[],"mappings":"AAAA,OAAO,yBAAyB,CAAC;AACjC,OAAO,WAAW,CAAC;AAKnB,2CAA2C;AAC3C,KAAK,UAAU,GAAG,KAAK,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,KAAK,CAAC;AAuQhD,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAE1E;AAED,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAE7E;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEhF;AAED,qCAAqC;AACrC,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAEhE;AAED,oDAAoD;AACpD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,CAEzF;AAED,iDAAiD;AACjD,wBAAgB,YAAY,CAC1B,EAAE,EAAE,MAAM,OAAO,EACjB,eAAe,CAAC,EAAE,UAAU,GAAG,MAAM,EACrC,gBAAgB,CAAC,EAAE,MAAM,EACzB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAET;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC1B,eAAe,CAAC,EAAE,UAAU,GAAG,MAAM,EACrC,gBAAgB,CAAC,EAAE,MAAM,EACzB,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,oDAAoD;AACpD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEzF;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEhF;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAAC,CAAC,EAChC,MAAM,EAAE,OAAO,EAEf,YAAY,EAAE,QAAQ,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAChD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,IAAI,CAAC,CAErB;AAED,8CAA8C;AAC9C,wBAAgB,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,KAAK,CAExC;AAED,qDAAqD;AACrD,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEnF;AAED,0DAA0D;AAC1D,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,GAAG,CAAC,EAAE,MAAM,GACX,IAAI,CAEN;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAElF;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEzF;AAED,wDAAwD;AACxD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAE/E;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAEtF"}

package/esm/src/testing/assert.js

@@ -90,6 +90,8 @@ function createNodeAssertImpl() {
                 error = e;
             }
             assertThrowsOrRejects(threw, error, errorClassOrMsg, msgIncludesOrMsg, "Expected function to reject");
+            // Returning the rejection reason is a stable public testing helper contract.
+            return error;
         },
         assertStringIncludes(actual, expected, msg) {
             if (actual.includes(expected))
@@ -187,7 +189,7 @@ export function assertExists(actual, msg) {
 export function assertThrows(fn, errorClassOrMsg, msgIncludesOrMsg, msg) {
     return impl.assertThrows(fn, errorClassOrMsg, msgIncludesOrMsg, msg);
 }
-/** Assert that an async function rejects. */
+/** Assert that an async function rejects, returning the rejection reason. */
 export function assertRejects(fn, errorClassOrMsg, msgIncludesOrMsg, msg) {
     return impl.assertRejects(fn, errorClassOrMsg, msgIncludesOrMsg, msg);
 }

package/esm/src/tool/factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../src/src/tool/factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAU,MAAM,+BAA+B,CAAC;AAqQxE,sCAAsC;AACtC,wBAAgB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,EACtD,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CA4DvB;AAED,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACxF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;IAC7C,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACzB;AAED,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CA2C7E"}
+{"version":3,"file":"factory.d.ts","sourceRoot":"","sources":["../../../src/src/tool/factory.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAU,MAAM,+BAA+B,CAAC;AAuSxE,sCAAsC;AACtC,wBAAgB,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,EACtD,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CA4DvB;AAED,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IACxF,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;IAC7C,GAAG,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;CACzB;AAED,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CA2C7E"}

package/esm/src/tool/factory.js

@@ -1,8 +1,19 @@
+import * as dntShim from "../../_dnt.shims.js";
 import { zodToJsonSchema } from "./schema/zod-json-schema.js";
 import { agentLogger } from "../utils/index.js";
 import { createError, getErrorMessage, INVALID_ARGUMENT, toError } from "../errors/index.js";
 import { snapshotBoundedJsonValue } from "../schemas/json-value.js";
-import { isProxyWithoutHooks } from "../platform/compat/error-introspection.js";
+import { canIdentifyProxyWithoutHooks, isProxyWithoutHooks, } from "../platform/compat/error-introspection.js";
+const apply = Reflect.apply;
+const arrayIsArray = Array.isArray;
+const objectCreate = Object.create;
+const objectGetOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
+const objectHasOwnProperty = Object.prototype.hasOwnProperty;
+const ownKeys = Reflect.ownKeys;
+const structuredCloneValue = globalThis.structuredClone;
+function hasOwn(object, key) {
+    return apply(objectHasOwnProperty, object, [key]);
+}
 function snapshotJsonSchemaObject(value) {
     const snapshot = snapshotBoundedJsonValue(value);
     return snapshot.success &&
@@ -151,35 +162,56 @@ function snapshotMcpConfig(value, toolId) {
     if (typeof value !== "object" || value === null) {
         schemaError(toolId, "MCP configuration must be a bounded JSON object");
     }
-    if (isProxyWithoutHooks(value)) {
-        schemaError(toolId, "MCP configuration must contain only data properties");
+    let inspectedValue = value;
+    if (canIdentifyProxyWithoutHooks) {
+        if (isProxyWithoutHooks(value)) {
+            schemaError(toolId, "MCP configuration must contain only data properties");
+        }
+    }
+    else {
+        if (typeof structuredCloneValue !== "function") {
+            schemaError(toolId, "MCP configuration must contain only data properties");
+        }
+        // Local MCP metadata crosses the same edge-runtime trust boundary as
+        // provider-bound JSON: hosts without no-hook Proxy detection use the
+        // captured structured clone primitive to reject Proxies before reflection
+        // and then validate the owned clone.
+        try {
+            inspectedValue = apply(structuredCloneValue, dntShim.dntGlobalThis, [value]);
+        }
+        catch {
+            schemaError(toolId, "MCP configuration must contain only data properties");
+        }
     }
-    if (Array.isArray(value)) {
+    if (arrayIsArray(inspectedValue)) {
         schemaError(toolId, "MCP configuration must be a bounded JSON object");
     }
-    const canonicalInput = {};
+    const canonicalInput = objectCreate(null);
     let keys;
     try {
-        keys = Reflect.ownKeys(value);
+        keys = ownKeys(inspectedValue);
     }
     catch {
         schemaError(toolId, "MCP configuration must be a bounded JSON object");
     }
-    for (const key of keys) {
+    for (let index = 0; index < keys.length; index++) {
+        const key = keys[index];
         if (typeof key !== "string") {
             schemaError(toolId, "MCP configuration must be a bounded JSON object");
         }
         let descriptor;
         try {
-            descriptor = Object.getOwnPropertyDescriptor(value, key);
+            descriptor = objectGetOwnPropertyDescriptor(inspectedValue, key);
         }
         catch {
             schemaError(toolId, "MCP configuration must contain only data properties");
         }
-        if (!descriptor || !("value" in descriptor)) {
+        if (!descriptor || !hasOwn(descriptor, "value")) {
             schemaError(toolId, "MCP configuration must contain only data properties");
         }
         if (descriptor.enumerable && descriptor.value !== undefined) {
+            // A null prototype makes assignment safe even for `__proto__` and other
+            // special names without consulting inherited setters.
             canonicalInput[key] = descriptor.value;
         }
     }
@@ -187,7 +219,7 @@ function snapshotMcpConfig(value, toolId) {
     if (!snapshot.success ||
         typeof snapshot.value !== "object" ||
         snapshot.value === null ||
-        Array.isArray(snapshot.value)) {
+        arrayIsArray(snapshot.value)) {
         schemaError(toolId, "MCP configuration must be a bounded JSON object");
     }
     return snapshot.value;

package/esm/src/tool/index.d.ts

@@ -81,7 +81,7 @@ export { dynamicTool, tool } from "./factory.js";
 export type { DynamicToolConfig } from "./factory.js";
 export { createSleepTool, DEFAULT_SLEEP_TOOL_MAX_SECONDS, sleepTool } from "./sleep.js";
 export type { CreateSleepToolOptions, SleepToolInput, SleepToolOutput, SleepToolWait, } from "./sleep.js";
-export { createRemoteMCPToolSource } from "./remote-mcp.js";
+export { createRemoteMCPToolSource, createRemoteMCPToolSourceFactoryWithTransport, type RemoteMCPToolSourceTransportOptions, } from "./remote-mcp.js";
 export { hasToolExecutionErrorMarker, isErroredToolExecutionResult } from "./result.js";
 export type { RemoteMCPToolSourceConfig } from "./remote-mcp.js";
 export { createContext7ToolSource } from "./context7.js";

package/esm/src/tool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/tool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AACH,OAAO,yBAAyB,CAAC;AAGjC,YAAY,EACV,gBAAgB,EAChB,IAAI,EACJ,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,OAAO,GACR,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,8BAA8B,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACxF,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,YAAY,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,YAAY,EACV,kBAAkB,EAClB,8BAA8B,EAC9B,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EACV,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oCAAoC,EACpC,wCAAwC,EACxC,mCAAmC,EACnC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACV,sCAAsC,EACtC,8BAA8B,EAC9B,qCAAqC,EACrC,uCAAuC,EACvC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,EACrC,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE7D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/src/tool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AACH,OAAO,yBAAyB,CAAC;AAGjC,YAAY,EACV,gBAAgB,EAChB,IAAI,EACJ,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,sBAAsB,EACtB,OAAO,GACR,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACjD,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,8BAA8B,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACxF,YAAY,EACV,sBAAsB,EACtB,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,6CAA6C,EAC7C,KAAK,mCAAmC,GACzC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACzD,YAAY,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,YAAY,EACV,kBAAkB,EAClB,8BAA8B,EAC9B,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,YAAY,EACV,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oCAAoC,EACpC,wCAAwC,EACxC,mCAAmC,EACnC,6BAA6B,EAC7B,uBAAuB,EACvB,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,kCAAkC,CAAC;AAC1C,YAAY,EACV,sCAAsC,EACtC,8BAA8B,EAC9B,qCAAqC,EACrC,uCAAuC,EACvC,kCAAkC,EAClC,gCAAgC,EAChC,qCAAqC,EACrC,8BAA8B,GAC/B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE7D,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}

package/esm/src/tool/index.js

@@ -78,7 +78,7 @@
 import "../../_dnt.polyfills.js";
 export { dynamicTool, tool } from "./factory.js";
 export { createSleepTool, DEFAULT_SLEEP_TOOL_MAX_SECONDS, sleepTool } from "./sleep.js";
-export { createRemoteMCPToolSource } from "./remote-mcp.js";
+export { createRemoteMCPToolSource, createRemoteMCPToolSourceFactoryWithTransport, } from "./remote-mcp.js";
 export { hasToolExecutionErrorMarker, isErroredToolExecutionResult } from "./result.js";
 export { createContext7ToolSource } from "./context7.js";
 export { createToolsFromHostDefinitions } from "./host-tools.js";

package/esm/src/tool/remote-mcp.d.ts

@@ -16,7 +16,22 @@ export interface RemoteMCPToolSourceConfig {
     listMethod?: string;
     callMethod?: string;
 }
-/** Create remote MCP tool source. */
+/** Create a remote MCP source with the framework's guarded outbound transport. */
 export declare function createRemoteMCPToolSource(config: RemoteMCPToolSourceConfig): RemoteToolSource;
+/** Deployment-owned transport policy for exact, immutable MCP endpoints. */
+export interface RemoteMCPToolSourceTransportOptions {
+    /** Complete endpoint URLs allowed to use {@link requestFetch}. */
+    trustedEndpoints: readonly string[];
+    /** Host transport captured by the trusted deployment at startup. */
+    requestFetch: typeof fetch;
+}
+/**
+ * Create a remote MCP source factory with narrowly scoped host transport.
+ *
+ * Only static endpoint strings that exactly match a normalized deployment
+ * allowlist use the supplied transport. Invalid, unmatched, or resolver-based
+ * endpoints retain {@link createRemoteMCPToolSource}'s guarded outbound path.
+ */
+export declare function createRemoteMCPToolSourceFactoryWithTransport(options: RemoteMCPToolSourceTransportOptions): (config: RemoteMCPToolSourceConfig) => RemoteToolSource;
 export {};
 //# sourceMappingURL=remote-mcp.d.ts.map

package/esm/src/tool/remote-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../../src/src/tool/remote-mcp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQzF,mDAAmD;AACnD,eAAO,MAAM,uCAAuC,QAAmB,CAAC;AACxE,mDAAmD;AACnD,eAAO,MAAM,kCAAkC,QAAkB,CAAC;AAIlE,8EAA8E;AAC9E,eAAO,MAAM,8BAA8B,KAAK,CAAC;AACjD,gEAAgE;AAChE,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAwBrD,KAAK,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,oBAAoB,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnF,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,eAAe,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA0vBD,qCAAqC;AACrC,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,yBAAyB,GAChC,gBAAgB,CAsHlB"}
+{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../../src/src/tool/remote-mcp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAkB,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQzF,mDAAmD;AACnD,eAAO,MAAM,uCAAuC,QAAmB,CAAC;AACxE,mDAAmD;AACnD,eAAO,MAAM,kCAAkC,QAAkB,CAAC;AAIlE,8EAA8E;AAC9E,eAAO,MAAM,8BAA8B,KAAK,CAAC;AACjD,gEAAgE;AAChE,eAAO,MAAM,+BAA+B,OAAQ,CAAC;AAwBrD,KAAK,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,oBAAoB,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnF,oDAAoD;AACpD,MAAM,WAAW,yBAAyB;IACxC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,eAAe,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACnD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAw3BD,kFAAkF;AAClF,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,yBAAyB,GAChC,gBAAgB,CAElB;AAED,4EAA4E;AAC5E,MAAM,WAAW,mCAAmC;IAClD,kEAAkE;IAClE,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,oEAAoE;IACpE,YAAY,EAAE,OAAO,KAAK,CAAC;CAC5B;AAaD;;;;;;GAMG;AACH,wBAAgB,6CAA6C,CAC3D,OAAO,EAAE,mCAAmC,GAC3C,CAAC,MAAM,EAAE,yBAAyB,KAAK,gBAAgB,CAsBzD"}

package/esm/src/tool/remote-mcp.js

@@ -473,7 +473,7 @@ function validateEndpoint(endpoint) {
     }
     return url.toString();
 }
-async function postJsonRpc(endpoint, headers, body, callerSignal, maxResponseBytes) {
+async function postJsonRpc(endpoint, headers, body, requestFetch, callerSignal, maxResponseBytes) {
     const expectedId = body.id;
     if (typeof expectedId !== "string" || expectedId.length === 0) {
         throw new TypeError("Remote MCP JSON-RPC request id must be a non-empty string");
@@ -481,7 +481,7 @@ async function postJsonRpc(endpoint, headers, body, callerSignal, maxResponseByt
     const serializedBody = serializeJsonRpcRequest(body);
     const requestScope = createRequestSignalScope(callerSignal);
     try {
-        const response = await guardedOutboundFetch(endpoint, {
+        const response = await requestFetch(endpoint, {
             method: "POST",
             headers,
             body: serializedBody,
@@ -580,8 +580,7 @@ function buildRunContextMeta(context) {
     }
     return Object.keys(meta).length > 0 ? meta : undefined;
 }
-/** Create remote MCP tool source. */
-export function createRemoteMCPToolSource(config) {
+function createRemoteMCPToolSourceWithFetch(config, requestFetch) {
     const id = config.id ?? "remote-mcp";
     const listMethod = config.listMethod ?? "tools/list";
     const callMethod = config.callMethod ?? "tools/call";
@@ -601,7 +600,7 @@ export function createRemoteMCPToolSource(config) {
                     id: requestId,
                     method: listMethod,
                     ...(cursor !== undefined ? { params: { cursor } } : {}),
-                }, context?.abortSignal, MAX_REMOTE_MCP_TOOL_LIST_RESPONSE_BYTES);
+                }, requestFetch, context?.abortSignal, MAX_REMOTE_MCP_TOOL_LIST_RESPONSE_BYTES);
                 const result = getJsonRpcResult(payload, requestId);
                 const { definitions: pageDefinitions, nextCursor } = normalizeToolListPage(result);
                 if (definitions.length + pageDefinitions.length >
@@ -644,7 +643,7 @@ export function createRemoteMCPToolSource(config) {
                         arguments: args,
                         ...(meta ? { _meta: meta } : {}),
                     },
-                }, context?.abortSignal, MAX_REMOTE_MCP_CALL_RESPONSE_BYTES);
+                }, requestFetch, context?.abortSignal, MAX_REMOTE_MCP_CALL_RESPONSE_BYTES);
                 const result = getJsonRpcResult(payload, requestId);
                 const resultSnapshot = snapshotBoundedJsonValue(result);
                 if (!resultSnapshot.success) {
@@ -667,3 +666,46 @@ export function createRemoteMCPToolSource(config) {
         },
     };
 }
+/** Create a remote MCP source with the framework's guarded outbound transport. */
+export function createRemoteMCPToolSource(config) {
+    return createRemoteMCPToolSourceWithFetch(config, guardedOutboundFetch);
+}
+function normalizeTrustedEndpoint(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "http:" && url.protocol !== "https:")
+            return undefined;
+        if (url.username || url.password || url.search || url.hash)
+            return undefined;
+        return url.toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Create a remote MCP source factory with narrowly scoped host transport.
+ *
+ * Only static endpoint strings that exactly match a normalized deployment
+ * allowlist use the supplied transport. Invalid, unmatched, or resolver-based
+ * endpoints retain {@link createRemoteMCPToolSource}'s guarded outbound path.
+ */
+export function createRemoteMCPToolSourceFactoryWithTransport(options) {
+    const trustedEndpoints = new Set();
+    for (const value of options.trustedEndpoints) {
+        const endpoint = normalizeTrustedEndpoint(value);
+        if (!endpoint) {
+            throw new TypeError("Invalid trusted endpoint");
+        }
+        trustedEndpoints.add(endpoint);
+    }
+    return (config) => {
+        const endpoint = typeof config.endpoint === "string"
+            ? normalizeTrustedEndpoint(config.endpoint)
+            : undefined;
+        if (!endpoint || !trustedEndpoints.has(endpoint)) {
+            return createRemoteMCPToolSource(config);
+        }
+        return createRemoteMCPToolSourceWithFetch({ ...config, endpoint }, options.requestFetch);
+    };
+}

package/esm/src/transforms/esm/http-cache-helpers.d.ts

@@ -25,6 +25,10 @@ export type CacheOptions = {
     importMap: ImportMapConfig;
     /** React version to use for esm.sh URLs (defaults to DEFAULT_REACT_VERSION) */
     reactVersion?: string;
+    /** Absolute request origin used to identify same-origin module-server URLs. */
+    moduleServerOrigin?: string;
+    /** Request-scoped dependency-pinning state used to isolate module-server URLs. */
+    dependencyPinningCacheKey?: string;
 };
 export type HttpCacheIdentityOptions = Pick<CacheOptions, "importMap" | "reactVersion">;
 export interface HttpCacheIdentityMetadata extends HttpCacheIdentityOptions {

package/esm/src/transforms/esm/http-cache-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-cache-helpers.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/http-cache-helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAQzE;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,EAAE,CAAC;IACjC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO,CAAC,CAAC;IACxB,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;IACvB,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,eAAe,CAAC;IAC3B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,cAAc,CAAC,CAAC;AAExF,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,yBAAyB,CACxC,CAAC,SAAS,wBAAwB,GAAG,wBAAwB;IAE7D,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,CAAC;CACZ;AAqBD,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAYhF;AAuBD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,SAAS,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAGpF;AAED,wFAAwF;AACxF,wBAAgB,qCAAqC,CAAC,CAAC,SAAS,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAI3F;AAmBD,0EAA0E;AAC1E,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,2FAA2F;AAC3F,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,yBAAyB,CAAC,CAQpC;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEpD;AAoCD,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEzE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,wBAAwB,EAC7E,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,GACT,yBAAyB,CAAC,CAAC,CAAC,CAmB9B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAQzD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAqBhD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA2BpD;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,eAAe,EAC1B,YAAY,GAAE,MAA8B,GAC3C,MAAM,CA4BR;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAkBrF"}
+{"version":3,"file":"http-cache-helpers.d.ts","sourceRoot":"","sources":["../../../../src/src/transforms/esm/http-cache-helpers.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAkIzE;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,EAAE,CAAC;IACjC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;IAC3B,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,OAAO,CAAC,CAAC;IACxB,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;IACvB,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACpB,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,eAAe,CAAC;IAC3B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kFAAkF;IAClF,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,cAAc,CAAC,CAAC;AAExF,MAAM,WAAW,yBAA0B,SAAQ,wBAAwB;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,yBAAyB,CACxC,CAAC,SAAS,wBAAwB,GAAG,wBAAwB;IAE7D,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,CAAC,CAAC;CACZ;AAqBD,kFAAkF;AAClF,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAyChF;AAuBD;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,SAAS,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAGpF;AAED,wFAAwF;AACxF,wBAAgB,qCAAqC,CAAC,CAAC,SAAS,YAAY,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAI3F;AAmBD,0EAA0E;AAC1E,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,2FAA2F;AAC3F,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,yBAAyB,CAAC,CAQpC;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEvE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEpD;AAwCD,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAEzE;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,wBAAwB,EAC7E,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,GACT,yBAAyB,CAAC,CAAC,CAAC,CAmB9B;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAIrD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAEvE;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAQzD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAwBhD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA6BpD;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,eAAe,EAC1B,YAAY,GAAE,MAA8B,GAC3C,MAAM,CA4BR;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAoBrF"}