veryfront 0.1.755 → 0.1.756

package/esm/src/security/sandbox/worker-egress-guard.js

@@ -0,0 +1,201 @@
+/**
+ * Worker network egress guard.
+ *
+ * Project workers need outbound network access for public API calls, but user
+ * code must not reach host-internal networks or cloud metadata endpoints.
+ *
+ * @module security/sandbox/worker-egress-guard
+ */
+import * as dntShim from "../../../_dnt.shims.js";
+export const WORKER_INTERNAL_EGRESS_OVERRIDE_ENV = "VERYFRONT_WORKER_ALLOW_INTERNAL_EGRESS";
+export class WorkerEgressBlockedError extends Error {
+    name = "WorkerEgressBlockedError";
+}
+const guardInstalled = Symbol.for("veryfront.workerEgressGuardInstalled");
+const guardedFetch = Symbol.for("veryfront.workerEgressGuard.fetch");
+const guardedConnect = Symbol.for("veryfront.workerEgressGuard.connect");
+const guardedConnectTls = Symbol.for("veryfront.workerEgressGuard.connectTls");
+function isObject(value) {
+    return typeof value === "object" && value !== null;
+}
+export function isInternalEgressOverrideEnabled(value) {
+    if (value === undefined)
+        return false;
+    switch (value.trim().toLowerCase()) {
+        case "1":
+        case "true":
+        case "yes":
+        case "on":
+            return true;
+        default:
+            return false;
+    }
+}
+function stripIpv6Brackets(value) {
+    return value.startsWith("[") && value.endsWith("]") ? value.slice(1, -1) : value;
+}
+function stripIpv6Zone(value) {
+    const zoneIndex = value.indexOf("%");
+    return zoneIndex === -1 ? value : value.slice(0, zoneIndex);
+}
+function parseIpv4(value) {
+    const parts = value.split(".");
+    if (parts.length !== 4)
+        return null;
+    const octets = [];
+    for (const part of parts) {
+        if (!/^\d{1,3}$/.test(part))
+            return null;
+        const octet = Number(part);
+        if (!Number.isInteger(octet) || octet < 0 || octet > 255)
+            return null;
+        octets.push(octet);
+    }
+    return octets;
+}
+function isPrivateIpv4(octets) {
+    const [a = -1, b = -1] = octets;
+    return (a === 10 ||
+        a === 127 ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 168) ||
+        a === 0);
+}
+function isInternalIpv6(value) {
+    const normalized = stripIpv6Zone(stripIpv6Brackets(value)).toLowerCase();
+    if (normalized === "::" || normalized === "::1")
+        return true;
+    const mappedIpv4 = normalized.match(/(?:::ffff:)(\d{1,3}(?:\.\d{1,3}){3})$/);
+    if (mappedIpv4?.[1]) {
+        const octets = parseIpv4(mappedIpv4[1]);
+        return octets !== null && isPrivateIpv4(octets);
+    }
+    const firstHextetText = normalized.split(":", 1)[0] ?? "";
+    if (!/^[0-9a-f]{1,4}$/.test(firstHextetText))
+        return false;
+    const firstHextet = Number.parseInt(firstHextetText, 16);
+    // fe80::/10 link-local, fc00::/7 unique local.
+    return (firstHextet & 0xffc0) === 0xfe80 || (firstHextet & 0xfe00) === 0xfc00;
+}
+export function isInternalEgressIp(address) {
+    const host = stripIpv6Zone(stripIpv6Brackets(address.trim().toLowerCase()));
+    const ipv4 = parseIpv4(host);
+    if (ipv4)
+        return isPrivateIpv4(ipv4);
+    return host.includes(":") && isInternalIpv6(host);
+}
+function isIpLiteral(address) {
+    const host = stripIpv6Zone(stripIpv6Brackets(address.trim().toLowerCase()));
+    return parseIpv4(host) !== null || host.includes(":");
+}
+function isLocalhostName(hostname) {
+    const normalized = hostname.trim().toLowerCase();
+    return normalized === "localhost" || normalized.endsWith(".localhost");
+}
+async function defaultResolveHost(hostname) {
+    const results = [];
+    const resolver = dntShim.Deno.resolveDns;
+    for (const recordType of ["A", "AAAA"]) {
+        try {
+            results.push(...await resolver(hostname, recordType));
+        }
+        catch {
+            // A host may legitimately have only one address family.
+        }
+    }
+    return results;
+}
+function getUrlHostname(input) {
+    const url = input instanceof URL
+        ? input
+        : input instanceof Request
+            ? new URL(input.url)
+            : new URL(String(input));
+    if (url.protocol !== "http:" && url.protocol !== "https:" && url.protocol !== "ws:" &&
+        url.protocol !== "wss:") {
+        return null;
+    }
+    return stripIpv6Brackets(url.hostname);
+}
+export async function assertWorkerEgressAllowed(target, options = {}) {
+    if (options.allowInternalEgress)
+        return;
+    const hostname = getUrlHostname(target);
+    if (!hostname)
+        return;
+    await assertWorkerHostEgressAllowed(hostname, options);
+}
+export async function assertWorkerHostEgressAllowed(hostname, options = {}) {
+    if (options.allowInternalEgress)
+        return;
+    const host = stripIpv6Brackets(hostname.trim().toLowerCase());
+    if (isLocalhostName(host) || isInternalEgressIp(host)) {
+        throw new WorkerEgressBlockedError(`Worker network egress blocked for internal host: ${hostname}`);
+    }
+    if (isIpLiteral(host))
+        return;
+    const resolveHost = options.resolveHost ?? defaultResolveHost;
+    const addresses = await resolveHost(host);
+    if (addresses.length === 0) {
+        throw new WorkerEgressBlockedError(`Worker network egress blocked: unable to resolve host ${hostname}`);
+    }
+    for (const address of addresses) {
+        if (isInternalEgressIp(address)) {
+            throw new WorkerEgressBlockedError(`Worker network egress blocked for host ${hostname} resolved to internal address ${address}`);
+        }
+    }
+}
+function getConnectHostname(options) {
+    if (!isObject(options))
+        return null;
+    const hostname = options.hostname;
+    return typeof hostname === "string" ? hostname : null;
+}
+function getAllowInternalEgress() {
+    try {
+        return isInternalEgressOverrideEnabled(dntShim.Deno.env.get(WORKER_INTERNAL_EGRESS_OVERRIDE_ENV));
+    }
+    catch {
+        return false;
+    }
+}
+export function installWorkerEgressGuard(options = {}) {
+    const globalRecord = dntShim.dntGlobalThis;
+    if (globalRecord[guardInstalled])
+        return;
+    const baseOptions = {
+        ...options,
+        allowInternalEgress: options.allowInternalEgress ?? getAllowInternalEgress(),
+    };
+    const originalFetch = globalThis.fetch.bind(dntShim.dntGlobalThis);
+    const fetchWrapper = async (input, init) => {
+        await assertWorkerEgressAllowed(input, baseOptions);
+        return await originalFetch(input, init);
+    };
+    Object.defineProperty(fetchWrapper, guardedFetch, { value: true });
+    globalThis.fetch = fetchWrapper;
+    if (typeof dntShim.Deno.connect === "function") {
+        const originalConnect = dntShim.Deno.connect.bind(dntShim.Deno);
+        const connectWrapper = async (options) => {
+            const hostname = getConnectHostname(options);
+            if (hostname)
+                await assertWorkerHostEgressAllowed(hostname, baseOptions);
+            return await originalConnect(options);
+        };
+        Object.defineProperty(connectWrapper, guardedConnect, { value: true });
+        dntShim.Deno.connect = connectWrapper;
+    }
+    if (typeof dntShim.Deno.connectTls === "function") {
+        const originalConnectTls = dntShim.Deno.connectTls.bind(dntShim.Deno);
+        const connectTlsWrapper = async (options) => {
+            const hostname = getConnectHostname(options);
+            if (hostname)
+                await assertWorkerHostEgressAllowed(hostname, baseOptions);
+            return await originalConnectTls(options);
+        };
+        Object.defineProperty(connectTlsWrapper, guardedConnectTls, { value: true });
+        dntShim.Deno.connectTls = connectTlsWrapper;
+    }
+    globalRecord[guardInstalled] = true;
+}

package/esm/src/security/sandbox/worker-permissions.d.ts

@@ -6,7 +6,7 @@ export interface WorkerPermissions {
     read: string[] | boolean;
     write: boolean;
     net: boolean;
-    env: boolean;
+    env: string[] | boolean;
     run: boolean;
     ffi: boolean;
     sys: boolean;
@@ -16,14 +16,18 @@ interface WorkerPermissionOptions {
     isCompiledBinary?: boolean;
     /** Override for tests that need deterministic compiled-binary support paths. */
     compiledReadPaths?: string[];
+    /** Project-configured env keys that route code may read inside the worker. */
+    projectEnvKeys?: Iterable<string | undefined>;
 }
+export declare const FRAMEWORK_WORKER_ENV_ALLOWLIST: readonly ["NODE_ENV", "DENO_ENV", "VERYFRONT_ENV", "LOG_LEVEL", "LOG_FORMAT", "NO_COLOR", "FORCE_COLOR", "CI", "VERYFRONT_WORKER_ALLOW_INTERNAL_EGRESS"];
+export declare function buildWorkerEnvAllowlist(projectEnvKeys?: Iterable<string | undefined>): string[];
 /**
  * Build scoped permissions for a project worker.
  *
  * - read: restricted to the project temp dir (transformed modules) and cache dirs
  * - write: denied (workers produce output via postMessage, not filesystem)
  * - net: allowed (data fetchers and API routes may call external APIs)
- * - env: allowed (user code reads API keys and config from environment)
+ * - env: restricted to framework keys and the project's configured env keys
  * - run: denied (no subprocess spawning from user code)
  * - ffi: denied (no native code from user code)
  * - sys: denied (no system info access from user code)

package/esm/src/security/sandbox/worker-permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-permissions.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-permissions.ts"],"names":[],"mappings":"AAmBA;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;CACd;AAED,UAAU,uBAAuB;IAC/B,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAmCD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,GAAE,uBAA4B,GACpC,iBAAiB,CA2BnB"}
+{"version":3,"file":"worker-permissions.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-permissions.ts"],"names":[],"mappings":"AAoBA;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACxB,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;CACd;AAED,UAAU,uBAAuB;IAC/B,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC/C;AAED,eAAO,MAAM,8BAA8B,0JAUjC,CAAC;AAoCX,wBAAgB,uBAAuB,CACrC,cAAc,GAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAM,GAChD,MAAM,EAAE,CAKV;AAYD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,GAAE,uBAA4B,GACpC,iBAAiB,CA4BnB"}

package/esm/src/security/sandbox/worker-permissions.js

@@ -10,6 +10,18 @@ import * as dntShim from "../../../_dnt.shims.js";
 import { getFrameworkRootFromMeta } from "../../platform/compat/vfs-paths.js";
 import { getHostEnv } from "../../platform/compat/process.js";
 import { getCacheBaseDir, getHttpBundleCacheDir, getMdxEsmCacheDir, } from "../../utils/cache-dir.js";
+import { WORKER_INTERNAL_EGRESS_OVERRIDE_ENV } from "./worker-egress-guard.js";
+export const FRAMEWORK_WORKER_ENV_ALLOWLIST = [
+    "NODE_ENV",
+    "DENO_ENV",
+    "VERYFRONT_ENV",
+    "LOG_LEVEL",
+    "LOG_FORMAT",
+    "NO_COLOR",
+    "FORCE_COLOR",
+    "CI",
+    WORKER_INTERNAL_EGRESS_OVERRIDE_ENV,
+];
 // Cache compiled binary check — Deno.execPath() is a syscall that never changes at runtime
 const _isCompiledBinary = (() => {
     try {
@@ -35,6 +47,24 @@ function normalizeReadPaths(paths) {
     }
     return [...unique];
 }
+function normalizeEnvKeys(keys) {
+    const unique = new Set();
+    for (const key of keys) {
+        if (!key)
+            continue;
+        const trimmed = key.trim();
+        if (!trimmed)
+            continue;
+        unique.add(trimmed);
+    }
+    return [...unique];
+}
+export function buildWorkerEnvAllowlist(projectEnvKeys = []) {
+    return normalizeEnvKeys([
+        ...FRAMEWORK_WORKER_ENV_ALLOWLIST,
+        ...projectEnvKeys,
+    ]);
+}
 function getDefaultCompiledReadPaths() {
     return normalizeReadPaths([
         getFrameworkRootFromMeta(globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url),
@@ -50,7 +80,7 @@ function getDefaultCompiledReadPaths() {
  * - read: restricted to the project temp dir (transformed modules) and cache dirs
  * - write: denied (workers produce output via postMessage, not filesystem)
  * - net: allowed (data fetchers and API routes may call external APIs)
- * - env: allowed (user code reads API keys and config from environment)
+ * - env: restricted to framework keys and the project's configured env keys
  * - run: denied (no subprocess spawning from user code)
  * - ffi: denied (no native code from user code)
  * - sys: denied (no system info access from user code)
@@ -58,6 +88,7 @@ function getDefaultCompiledReadPaths() {
 export function buildWorkerPermissions(readPaths, options = {}) {
     const isCompiledBinary = options.isCompiledBinary ?? _isCompiledBinary;
     const normalizedReadPaths = normalizeReadPaths(readPaths);
+    const env = buildWorkerEnvAllowlist(options.projectEnvKeys);
     if (isCompiledBinary) {
         const compiledReadPaths = options.compiledReadPaths ?? getDefaultCompiledReadPaths();
         const scopedReadPaths = normalizeReadPaths([...normalizedReadPaths, ...compiledReadPaths]);
@@ -65,7 +96,7 @@ export function buildWorkerPermissions(readPaths, options = {}) {
             read: scopedReadPaths.length > 0 ? scopedReadPaths : false,
             write: false,
             net: true,
-            env: true,
+            env,
             run: false,
             ffi: false,
             sys: false,
@@ -75,7 +106,7 @@ export function buildWorkerPermissions(readPaths, options = {}) {
         read: normalizedReadPaths.length > 0 ? normalizedReadPaths : false,
         write: false,
         net: true,
-        env: true,
+        env,
         run: false,
         ffi: false,
         sys: false,

package/esm/src/security/sandbox/worker-pool.d.ts

@@ -10,7 +10,7 @@ export declare class WorkerPool {
     /**
      * Get or create a worker for the given project.
      */
-    getOrCreateWorker(projectId: string, readPaths: string[]): ProjectWorker;
+    getOrCreateWorker(projectId: string, readPaths: string[], projectEnvKeys?: Iterable<string | undefined>): ProjectWorker;
     /**
      * Execute a request in a project worker. Convenience method that
      * combines getOrCreateWorker + execute.

package/esm/src/security/sandbox/worker-pool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worker-pool.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-pool.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAWzF,qBAAa,UAAU;IACrB,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,MAAM,CAAmB;IAEjC,OAAO,CAAC,eAAe,CAAqD;IAC5E,OAAO,CAAC,mBAAmB,CAAqD;gBAEpE,MAAM,GAAE,OAAO,CAAC,gBAAgB,CAAM;IAMlD;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,aAAa;IA0CxE;;;OAGG;IACH,OAAO,CACL,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,cAAc,CAAC;IAiE1B;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAUpC;;OAEG;IACH,QAAQ,IAAI;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;YACtB,MAAM,EAAE,MAAM,CAAC;YACf,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,EAAE,OAAO,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,EAAE,MAAM,CAAC;SACf,CAAC,CAAC;KACJ;IA4BD;;OAEG;IACH,UAAU,IAAI;QACZ,uCAAuC;QACvC,cAAc,EAAE,MAAM,CAAC;QACvB,oDAAoD;QACpD,kBAAkB,EAAE,MAAM,CAAC;QAC3B,kDAAkD;QAClD,sBAAsB,EAAE,MAAM,CAAC;QAC/B,qDAAqD;QACrD,WAAW,EAAE,MAAM,CAAC;QACpB,kEAAkE;QAClE,cAAc,EAAE,MAAM,CAAC;KACxB;IAoBD;;OAEG;IACH,QAAQ,IAAI,IAAI;IAgBhB,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,gBAAgB;IAmBxB,OAAO,CAAC,aAAa;YA4BP,WAAW;IAmBzB;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;CA8BjC;AAqBD;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAGlD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAKD,wBAAgB,aAAa,IAAI,UAAU,CAiB1C;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,IAAI,IAAI,CAO1C"}
+{"version":3,"file":"worker-pool.d.ts","sourceRoot":"","sources":["../../../../src/src/security/sandbox/worker-pool.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA4BzF,qBAAa,UAAU;IACrB,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,MAAM,CAAmB;IAEjC,OAAO,CAAC,eAAe,CAAqD;IAC5E,OAAO,CAAC,mBAAmB,CAAqD;gBAEpE,MAAM,GAAE,OAAO,CAAC,gBAAgB,CAAM;IAMlD;;OAEG;IACH,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EAAE,EACnB,cAAc,GAAE,QAAQ,CAAC,MAAM,GAAG,SAAS,CAAM,GAChD,aAAa;IAmDhB;;;OAGG;IACH,OAAO,CACL,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,cAAc,CAAC;IAkE1B;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAUpC;;OAEG;IACH,QAAQ,IAAI;QACV,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;YACtB,MAAM,EAAE,MAAM,CAAC;YACf,YAAY,EAAE,MAAM,CAAC;YACrB,UAAU,EAAE,OAAO,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC;YACf,KAAK,EAAE,MAAM,CAAC;SACf,CAAC,CAAC;KACJ;IA4BD;;OAEG;IACH,UAAU,IAAI;QACZ,uCAAuC;QACvC,cAAc,EAAE,MAAM,CAAC;QACvB,oDAAoD;QACpD,kBAAkB,EAAE,MAAM,CAAC;QAC3B,kDAAkD;QAClD,sBAAsB,EAAE,MAAM,CAAC;QAC/B,qDAAqD;QACrD,WAAW,EAAE,MAAM,CAAC;QACpB,kEAAkE;QAClE,cAAc,EAAE,MAAM,CAAC;KACxB;IAoBD;;OAEG;IACH,QAAQ,IAAI,IAAI;IAgBhB,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,iBAAiB;IAQzB,OAAO,CAAC,gBAAgB;IAmBxB,OAAO,CAAC,aAAa;YA4BP,WAAW;IAmBzB;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;CA8BjC;AAqBD;;;GAGG;AACH,wBAAgB,wBAAwB,IAAI,OAAO,CAGlD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,OAAO,CAGhD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAG/C;AAKD,wBAAgB,aAAa,IAAI,UAAU,CAiB1C;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,IAAI,IAAI,CAO1C"}

package/esm/src/security/sandbox/worker-pool.js

@@ -13,9 +13,24 @@ import { getEnvBoolean, getEnvNumber, unrefTimer } from "../../platform/compat/p
 import { withSpan } from "../../observability/tracing/otlp-setup.js";
 import { SECURITY_VIOLATION } from "../../errors/index.js";
 import { ProjectWorker } from "./project-worker.js";
-import { buildWorkerPermissions } from "./worker-permissions.js";
+import { buildWorkerEnvAllowlist, buildWorkerPermissions } from "./worker-permissions.js";
 import { DEFAULT_WORKER_POOL_CONFIG } from "./worker-types.js";
 const logger = serverLogger.component("worker-pool");
+function extractProjectEnvKeys(request) {
+    if (!("projectEnv" in request) || !request.projectEnv)
+        return [];
+    return Object.keys(request.projectEnv);
+}
+function normalizeProjectEnvKeys(keys) {
+    const frameworkEnvKeyCount = buildWorkerEnvAllowlist([]).length;
+    return buildWorkerEnvAllowlist(keys).slice(frameworkEnvKeyCount);
+}
+function sameEnvKeySet(left, right) {
+    if (left.length !== right.length)
+        return false;
+    const rightSet = new Set(right);
+    return left.every((key) => rightSet.has(key));
+}
 export class WorkerPool {
     pool = new Map();
     recycling = new Set();
@@ -30,20 +45,29 @@ export class WorkerPool {
     /**
      * Get or create a worker for the given project.
      */
-    getOrCreateWorker(projectId, readPaths) {
+    getOrCreateWorker(projectId, readPaths, projectEnvKeys = []) {
+        const normalizedProjectEnvKeys = normalizeProjectEnvKeys(projectEnvKeys);
         const existing = this.pool.get(projectId);
         if (existing && existing.worker.status !== "crashed" && existing.worker.status !== "terminated") {
-            existing.lastAccessedAt = Date.now();
-            return existing.worker;
+            if (!sameEnvKeySet(existing.projectEnvKeys, normalizedProjectEnvKeys)) {
+                existing.worker.terminate();
+                this.pool.delete(projectId);
+            }
+            else {
+                existing.lastAccessedAt = Date.now();
+                return existing.worker;
+            }
         }
         // If an existing entry is crashed/terminated, clean it up
-        if (existing) {
+        if (existing && this.pool.has(projectId)) {
             existing.worker.terminate();
             this.pool.delete(projectId);
         }
         // Evict LRU if at capacity
         this.evictIfNeeded();
-        const permissions = buildWorkerPermissions(readPaths);
+        const permissions = buildWorkerPermissions(readPaths, {
+            projectEnvKeys: normalizedProjectEnvKeys,
+        });
         const worker = new ProjectWorker({
             projectId,
             permissions,
@@ -55,6 +79,7 @@ export class WorkerPool {
             worker,
             lastAccessedAt: now,
             createdAt: now,
+            projectEnvKeys: normalizedProjectEnvKeys,
         });
         logger.debug("Worker created", {
             projectId,
@@ -78,7 +103,8 @@ export class WorkerPool {
             }
         }
         return withSpan("workerPool.execute", async () => {
-            const worker = this.getOrCreateWorker(projectId, readPaths);
+            const projectEnvKeys = extractProjectEnvKeys(request);
+            const worker = this.getOrCreateWorker(projectId, readPaths, projectEnvKeys);
             // Check if worker should be recycled (request count or age)
             const entry = this.pool.get(projectId);
             const shouldRecycle = worker.requestCount >= this.config.maxRequestsPerWorker ||
@@ -100,11 +126,11 @@ export class WorkerPool {
                 const result = worker.execute(request);
                 void result.then(() => {
                     this.evictWorker(projectId);
-                    this.getOrCreateWorker(projectId, readPaths);
+                    this.getOrCreateWorker(projectId, readPaths, projectEnvKeys);
                     this.recycling.delete(projectId);
                 }, () => {
                     this.evictWorker(projectId);
-                    this.getOrCreateWorker(projectId, readPaths);
+                    this.getOrCreateWorker(projectId, readPaths, projectEnvKeys);
                     this.recycling.delete(projectId);
                 });
                 return result;

package/esm/src/server/handlers/preview/hmr-client-manager.d.ts

@@ -1,7 +1,8 @@
+import type { WebSocketConnection } from "../../../platform/adapters/base.js";
 /** Client metadata for observability */
 export interface HMRClientInfo {
     id: string;
-    socket: WebSocket;
+    socket: WebSocketConnection;
     connectedAt: number;
     projectSlug?: string;
     userAgent?: string;
@@ -24,7 +25,7 @@ export declare function getClientDetails(): HMRClientDetail[];
  * Get all open WebSocket connections, optionally filtered by projectSlug.
  * This replaces the old exported `clientSockets` Set that drifted out of sync.
  */
-export declare function getOpenSockets(projectSlug?: string): WebSocket[];
+export declare function getOpenSockets(projectSlug?: string): WebSocketConnection[];
 export declare function clearAll(): void;
 export {};
 //# sourceMappingURL=hmr-client-manager.d.ts.map

package/esm/src/server/handlers/preview/hmr-client-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmr-client-manager.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr-client-manager.ts"],"names":[],"mappings":"AAIA,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,yEAAyE;AACzE,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AASD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAEnD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAYnD;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErE;AAED,wBAAgB,gBAAgB,IAAI,eAAe,EAAE,CASpD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,EAAE,CAQhE;AAED,wBAAgB,QAAQ,IAAI,IAAI,CAS/B"}
+{"version":3,"file":"hmr-client-manager.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr-client-manager.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAI9E,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,mBAAmB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,yEAAyE;AACzE,UAAU,eAAe;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AASD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,aAAa,GAAG,IAAI,CAEnD;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAYnD;AAED,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAErE;AAED,wBAAgB,gBAAgB,IAAI,eAAe,EAAE,CASpD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAQ1E;AAED,wBAAgB,QAAQ,IAAI,IAAI,CAS/B"}

package/esm/src/server/handlers/preview/hmr.handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hmr.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr.handler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAuBrB,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAK7D,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAgD;IAC1E,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAS;IAEnC,QAAQ,EAAE,eAAe,CAKvB;IAEF,OAAO,CAAC,MAAM,CAAC,UAAU;IAsCnB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA4IvE;;;;;OAKG;YACW,wBAAwB;IAuCtC,MAAM,CAAC,cAAc,IAAI,MAAM;IAI/B,MAAM,CAAC,UAAU,IAAI;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAID,MAAM,CAAC,+BAA+B,IAAI,MAAM,IAAI;IAWpD,MAAM,CAAC,QAAQ,IAAI,IAAI;CAaxB"}
+{"version":3,"file":"hmr.handler.d.ts","sourceRoot":"","sources":["../../../../../src/src/server/handlers/preview/hmr.handler.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,eAAe,EAEpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAuBrB,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAS7D,qBAAa,UAAW,SAAQ,WAAW;IACzC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAgD;IAC1E,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAA6B;IAC7D,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAK;IAChD,OAAO,CAAC,MAAM,CAAC,WAAW,CAAS;IAEnC,QAAQ,EAAE,eAAe,CAKvB;IAEF,OAAO,CAAC,MAAM,CAAC,UAAU;IAsCnB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IA4IvE;;;;;OAKG;YACW,wBAAwB;IAuCtC,MAAM,CAAC,cAAc,IAAI,MAAM;IAI/B,MAAM,CAAC,UAAU,IAAI;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B;IAID,MAAM,CAAC,+BAA+B,IAAI,MAAM,IAAI;IAWpD,MAAM,CAAC,QAAQ,IAAI,IAAI;CAaxB"}

package/esm/src/server/handlers/preview/hmr.handler.js

@@ -18,6 +18,9 @@ import { getHostEnv } from "../../../platform/compat/process.js";
 const logger = serverLogger.component("hmr-handler");
 // Priority between auth (0) and high (100)
 const PRIORITY_HMR = HandlerPriority.EARLY;
+function getMessageEventData(event) {
+    return "data" in event ? event.data : undefined;
+}
 export class HMRHandler extends BaseHandler {
     static rateLimiter = new RateLimiter(HMR_MAX_MESSAGES_PER_MINUTE);
     static reloadUnsubscribe = null;
@@ -149,7 +152,7 @@ export class HMRHandler extends BaseHandler {
             socket.addEventListener("message", (event) => {
                 handleHmrClientMessage({
                     socket,
-                    data: event.data,
+                    data: getMessageEventData(event),
                     rateLimiter: HMRHandler.rateLimiter,
                     onActivity: () => {
                         const client = getClient(clientId);

package/esm/src/server/handlers/request/api/api-handler-wrapper.js

@@ -55,7 +55,7 @@ export class ApiHandlerWrapper extends BaseHandler {
                 // Must run within runWithContext so VFS and registry scope are correct.
                 await ensureProjectDiscovery(ctx);
                 const api = await getApiHandler(ctx);
-                const apiRes = await api.handle(req);
+                const apiRes = await api.handle(req, ctx);
                 if (!apiRes) {
                     this.logDebug("[API-Wrapper] API handler returned null, continuing to next handler", { pathname }, ctx);
                     return this.continue();

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/http-fallback.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Unresolved module HTTP fallback phase for the MDX ESM module fetcher.
+ *
+ * @module transforms/mdx/esm-module-loader/module-fetcher/http-fallback
+ */
+import type { RuntimeAdapter } from "../../../../platform/adapters/base.js";
+import type { Logger } from "../../../../utils/logger/logger.js";
+import { fetchModuleViaHTTP } from "./http-fetcher.js";
+import { cacheModule } from "./module-cache.js";
+type FetchModuleViaHttpFn = typeof fetchModuleViaHTTP;
+type CacheLocalModuleFn = typeof cacheModule;
+export interface ResolveUnresolvedModuleViaHttpFallbackInput {
+    normalizedPath: string;
+    parentModulePath?: string;
+    adapter: RuntimeAdapter;
+    fetchAndCacheModule: (path: string, parent?: string) => Promise<string | null>;
+    log: Logger;
+    projectSlug: string;
+    isLocalProject?: boolean;
+    strictMissingModules?: boolean;
+    esmCacheDir: string;
+    pathCache: Map<string, string>;
+    reactVersion?: string;
+    fetchViaHttp?: FetchModuleViaHttpFn;
+    cacheLocalModule?: CacheLocalModuleFn;
+}
+/**
+ * Resolve an unresolved filesystem module through the local HTTP fallback.
+ */
+export declare function resolveUnresolvedModuleViaHttpFallback(input: ResolveUnresolvedModuleViaHttpFallbackInput): Promise<string | null>;
+export {};
+//# sourceMappingURL=http-fallback.d.ts.map

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/http-fallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-fallback.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/http-fallback.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,KAAK,oBAAoB,GAAG,OAAO,kBAAkB,CAAC;AACtD,KAAK,kBAAkB,GAAG,OAAO,WAAW,CAAC;AAE7C,MAAM,WAAW,2CAA2C;IAC1D,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,cAAc,CAAC;IACxB,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;CACvC;AAED;;GAEG;AACH,wBAAsB,sCAAsC,CAC1D,KAAK,EAAE,2CAA2C,GACjD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiCxB"}

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/http-fallback.js

@@ -0,0 +1,27 @@
+/**
+ * Unresolved module HTTP fallback phase for the MDX ESM module fetcher.
+ *
+ * @module transforms/mdx/esm-module-loader/module-fetcher/http-fallback
+ */
+import { buildMissingModuleError } from "../missing-module.js";
+import { fetchModuleViaHTTP } from "./http-fetcher.js";
+import { cacheModule } from "./module-cache.js";
+/**
+ * Resolve an unresolved filesystem module through the local HTTP fallback.
+ */
+export async function resolveUnresolvedModuleViaHttpFallback(input) {
+    const fetchViaHttp = input.fetchViaHttp ?? fetchModuleViaHTTP;
+    const cacheLocalModule = input.cacheLocalModule ?? cacheModule;
+    const moduleCode = await fetchViaHttp(input.normalizedPath, input.adapter, input.fetchAndCacheModule, input.log, input.projectSlug, input.isLocalProject);
+    if (moduleCode) {
+        return await cacheLocalModule(input.normalizedPath, moduleCode, input.esmCacheDir, input.pathCache, input.log, input.reactVersion);
+    }
+    if (input.strictMissingModules ?? true) {
+        throw buildMissingModuleError({
+            modulePath: input.normalizedPath,
+            importer: input.parentModulePath,
+            projectSlug: input.projectSlug,
+        });
+    }
+    return null;
+}

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/import-rewriter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"import-rewriter.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/import-rewriter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgB5D;AAwCD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0D7F"}
+{"version":3,"file":"import-rewriter.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/import-rewriter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA2CH;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgB5D;AAwCD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA0D7F"}

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/import-rewriter.js

@@ -5,23 +5,43 @@
  */
 import { dirname, join, resolve } from "../../../../platform/compat/path/index.js";
 import { FRAMEWORK_ROOT } from "../constants.js";
-import { resolveVeryfrontModuleUrl } from "../../../veryfront-module-urls.js";
+import { DEFAULT_REACT_VERSION, veryfrontStrategy, } from "../../../import-rewriter/index.js";
 import { getLocalFs } from "../cache/index.js";
 import { findStaticImportFromSpans, findStaticSideEffectImportSpans, replaceSourceSpans, } from "../utils/source-spans.js";
+const MODULE_FETCHER_VERYFRONT_CONTEXT = {
+    filePath: "",
+    projectDir: "",
+    projectId: "",
+    target: "ssr",
+    dev: false,
+    reactVersion: DEFAULT_REACT_VERSION,
+};
+function rewriteVeryfrontModuleSpecifier(specifier) {
+    const result = veryfrontStrategy.rewrite({
+        specifier,
+        isDynamic: false,
+        start: 0,
+        end: specifier.length,
+        statementStart: 0,
+        statementEnd: 0,
+        raw: {},
+    }, MODULE_FETCHER_VERYFRONT_CONTEXT);
+    return result.specifier;
+}
 /**
  * Rewrite veryfront/* imports to /_vf_modules/_veryfront/ paths for MDX module loading.
  * Uses deno.json exports/imports as the source of truth and appends ?ssr=true.
  */
 export function rewriteVeryfrontImports(code) {
     const replacements = findStaticImportFromSpans(code, (specifier) => specifier.startsWith("veryfront/") ? specifier : null).flatMap(({ original, path, start, end }) => {
-        const mapped = resolveVeryfrontModuleUrl(path);
+        const mapped = rewriteVeryfrontModuleSpecifier(path);
         if (!mapped)
             return [];
         return [{
                 start,
                 end,
                 expected: original,
-                replacement: `from "${mapped}?ssr=true"`,
+                replacement: `from "${mapped}"`,
             }];
     });
     return replaceSourceSpans(code, replacements);

package/esm/src/transforms/mdx/esm-module-loader/module-fetcher/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAG5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAexD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAS9B;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAOtD;AAED;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,SAAS,EAAE,MAAM;CAI9B;AAcD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,GAAE,GAAG,CAAC,MAAM,CAAa,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwFxB;AA8JD;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IACR,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GACA,oBAAoB,CAUtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/src/transforms/mdx/esm-module-loader/module-fetcher/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAG5E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAcxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAS9B;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAOtD;AAED;;GAEG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,SAAS,EAAE,MAAM;CAI9B;AAcD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,CAAC,EAAE,MAAM,EACzB,OAAO,GAAE,GAAG,CAAC,MAAM,CAAa,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAwFxB;AA8ID;;GAEG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE;IACR,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,GACA,oBAAoB,CAUtB"}