@abot-ai/runtime 1.3.1 → 1.5.0

package/dist/src/web-ui/notifications/store.js

@@ -0,0 +1,185 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { defaultNotificationPreferences, NotificationInputError, } from "./contracts.js";
+import { parseNotificationReadChange } from "./request-input.js";
+import { compareNotificationsNewestFirst, decodeNotificationCursor, encodeNotificationCursor, isNotificationBeforeCursor, notificationPageLimit, } from "./query.js";
+import { decodeNotificationState, isNotificationDelivery, isNotificationIdentifier, isNotificationPreferences, isNotificationTimestamp, isWebNotification, } from "./storage-schema.js";
+const pendingTransactions = new Map();
+export function notificationStorePath(input) {
+    const identity = JSON.stringify([
+        input.environmentId,
+        resolve(input.sessionsDir),
+    ]);
+    const filename = createHash("sha256").update(identity).digest("hex") + ".json";
+    return join(input.runtimeDir, "web-ui", "notifications", filename);
+}
+function isMissingNotificationFile(error) {
+    if (!(error instanceof Error))
+        return false;
+    if (!("code" in error))
+        return false;
+    return error.code === "ENOENT";
+}
+function countUnreadNotifications(state) {
+    return state.items.filter((item) => item.readAt === null).length;
+}
+function hasPendingNotificationDelivery(item) {
+    return item.delivery.status === "pending";
+}
+function needsNotificationReadChange(item, change) {
+    if ("ids" in change && !change.ids.includes(item.id))
+        return false;
+    return (item.readAt !== null) !== change.read;
+}
+/** Web UI history only: no writes to Runtime sessions or model-visible context. */
+export class WebNotificationStore {
+    environmentId;
+    path;
+    constructor(path, environmentId) {
+        this.environmentId = environmentId;
+        if (!isNotificationIdentifier(environmentId))
+            throw new NotificationInputError("Invalid notification environment.");
+        this.path = resolve(path);
+    }
+    async load() {
+        try {
+            return decodeNotificationState(await readFile(this.path, "utf8"), this.environmentId);
+        }
+        catch (error) {
+            if (isMissingNotificationFile(error))
+                return null;
+            throw error;
+        }
+    }
+    async save(state) {
+        await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+        const temporary = `${this.path}.${process.pid}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(temporary, JSON.stringify(state), {
+                encoding: "utf8",
+                mode: 0o600,
+                flag: "wx",
+            });
+            await rename(temporary, this.path);
+        }
+        catch (error) {
+            await rm(temporary, { force: true }).catch(() => undefined);
+            throw error;
+        }
+    }
+    async transaction(operation) {
+        const prior = pendingTransactions.get(this.path) ?? Promise.resolve();
+        const pending = prior
+            .catch(() => undefined)
+            .then(async () => {
+            const existing = await this.load();
+            const state = existing ?? {
+                version: 1,
+                environmentId: this.environmentId,
+                items: [],
+                preferences: defaultNotificationPreferences(),
+            };
+            const before = JSON.stringify(state);
+            const result = operation(state);
+            if (!existing || before !== JSON.stringify(state))
+                await this.save(state);
+            return structuredClone(result);
+        });
+        pendingTransactions.set(this.path, pending);
+        try {
+            return await pending;
+        }
+        finally {
+            if (pendingTransactions.get(this.path) === pending)
+                pendingTransactions.delete(this.path);
+        }
+    }
+    initialize() {
+        return this.transaction(() => undefined);
+    }
+    reconcilePendingDeliveries() {
+        return this.transaction((state) => {
+            for (const item of state.items) {
+                if (!hasPendingNotificationDelivery(item))
+                    continue;
+                item.delivery = {
+                    status: "unknown",
+                    error: "ABot restarted before delivery was confirmed. This notification was not sent again.",
+                };
+            }
+        });
+    }
+    upsert(item) {
+        if (!isWebNotification(item, this.environmentId))
+            throw new NotificationInputError("Invalid notification.");
+        const inserted = structuredClone(item);
+        return this.transaction((state) => {
+            const existing = state.items.find((candidate) => candidate.id === inserted.id);
+            if (existing)
+                return { item: existing, created: false };
+            state.items.push(inserted);
+            return { item: inserted, created: true };
+        });
+    }
+    list(query = {}) {
+        const limit = notificationPageLimit(query);
+        const cursor = decodeNotificationCursor(query.before, this.environmentId);
+        return this.transaction((state) => {
+            const ordered = state.items
+                .filter((item) => isNotificationBeforeCursor(item, cursor))
+                .sort(compareNotificationsNewestFirst);
+            const items = ordered.slice(0, limit);
+            const hasOlderItems = ordered.length > limit;
+            return {
+                items,
+                unreadCount: countUnreadNotifications(state),
+                nextCursor: hasOlderItems
+                    ? encodeNotificationCursor(items[items.length - 1])
+                    : null,
+                preferences: state.preferences,
+            };
+        });
+    }
+    updateDelivery(id, delivery) {
+        if (!isNotificationIdentifier(id))
+            throw new NotificationInputError("Invalid notification identity.");
+        if (!isNotificationDelivery(delivery))
+            throw new NotificationInputError("Invalid notification delivery.");
+        const receipt = structuredClone(delivery);
+        return this.transaction((state) => {
+            const item = state.items.find((candidate) => candidate.id === id);
+            if (!item)
+                return false;
+            item.delivery = receipt;
+            return true;
+        });
+    }
+    markRead(change, now = Date.now()) {
+        const selection = parseNotificationReadChange(change);
+        if (!isNotificationTimestamp(now))
+            throw new NotificationInputError("Invalid notification read time.");
+        return this.transaction((state) => {
+            let updated = 0;
+            for (const item of state.items) {
+                if (!needsNotificationReadChange(item, selection))
+                    continue;
+                item.readAt = selection.read ? now : null;
+                updated += 1;
+            }
+            return { updated, unreadCount: countUnreadNotifications(state) };
+        });
+    }
+    getPreferences() {
+        return this.transaction((state) => state.preferences);
+    }
+    setPreferences(preferences) {
+        if (!isNotificationPreferences(preferences))
+            throw new NotificationInputError("Invalid notification preferences.");
+        const saved = structuredClone(preferences);
+        return this.transaction((state) => {
+            state.preferences = saved;
+            return saved;
+        });
+    }
+}

package/dist/src/web-ui/plugin-capability-selection.d.ts

@@ -0,0 +1,14 @@
+import type { RuntimePluginConfig } from "../runtime/ports.js";
+import { type PluginSelection } from "../runtime/plugins/selection.js";
+export declare function pluginParentBlockReason(pluginId: string, selection: PluginSelection): string | undefined;
+export declare function capabilityPolicyBlockReason(params: {
+    pluginId: string;
+    capabilityId: string;
+    selection: PluginSelection;
+}): string | undefined;
+export declare function updatePluginCapabilitySelection(params: {
+    current: RuntimePluginConfig;
+    pluginId: string;
+    capabilityId: string;
+    enabled: boolean;
+}): RuntimePluginConfig;

package/dist/src/web-ui/plugin-capability-selection.js

@@ -0,0 +1,48 @@
+import { isPluginToolSelected, normalizePluginSelection, } from "../runtime/plugins/selection.js";
+export function pluginParentBlockReason(pluginId, selection) {
+    if (!selection.enabled)
+        return "Plugins are disabled globally.";
+    if (selection.deny.includes("*"))
+        return "The global deny rule blocks all plugins.";
+    if (selection.deny.includes(pluginId))
+        return "Enable this plugin before changing its capabilities.";
+    return undefined;
+}
+export function capabilityPolicyBlockReason(params) {
+    const parentBlock = pluginParentBlockReason(params.pluginId, params.selection);
+    if (parentBlock)
+        return parentBlock;
+    if (params.selection.deny.includes(params.capabilityId)) {
+        return "A shared capability deny rule blocks this capability. Review the rule in Advanced settings.";
+    }
+    return undefined;
+}
+function isCapabilityAllowed(params) {
+    return isPluginToolSelected({
+        pluginId: params.pluginId,
+        toolName: params.capabilityId,
+        selection: normalizePluginSelection({
+            ...params.current,
+            enabled: true,
+            deny: [],
+        }),
+    });
+}
+function addQualifiedCapabilityDeny(current, qualifiedId) {
+    const deny = [...(current.deny ?? [])];
+    const hasQualifiedDeny = deny.some((entry) => entry.trim() === qualifiedId);
+    if (hasQualifiedDeny)
+        return { ...current, deny };
+    return { ...current, deny: [...deny, qualifiedId] };
+}
+export function updatePluginCapabilitySelection(params) {
+    const qualifiedId = `${params.pluginId}.${params.capabilityId}`;
+    if (!params.enabled) {
+        return addQualifiedCapabilityDeny(params.current, qualifiedId);
+    }
+    const deny = params.current.deny?.filter((entry) => entry.trim() !== qualifiedId);
+    const next = { ...params.current, ...(deny ? { deny } : {}) };
+    if (isCapabilityAllowed(params))
+        return next;
+    return { ...next, allow: [...(params.current.allow ?? []), qualifiedId] };
+}

package/dist/src/web-ui/plugin-management-catalog.d.ts

@@ -0,0 +1,26 @@
+import type { RuntimePluginConfig } from "../runtime/ports.js";
+import type { DiscoveredAgentPluginManifest } from "../runtime/plugins/discovered-manifest.js";
+import { type PluginSelection } from "../runtime/plugins/selection.js";
+export type RuntimePluginCapabilitySnapshot = {
+    id: string;
+    description: string;
+    enabled: boolean;
+    blockedByPolicy: boolean;
+    blockedReason?: string;
+};
+export type RuntimePluginSnapshot = {
+    selection: PluginSelection;
+    plugins: Array<{
+        id: string;
+        description?: string;
+        version?: string;
+        pluginEnabled: boolean;
+        capabilities: RuntimePluginCapabilitySnapshot[];
+        capabilityCount: number;
+        selectedCapabilityCount: number;
+        state: "enabled" | "partial" | "disabled";
+        blockedByGlobalPolicy: boolean;
+    }>;
+    application: "restart_required";
+};
+export declare function projectPluginSnapshot(manifests: readonly DiscoveredAgentPluginManifest[], config: RuntimePluginConfig): RuntimePluginSnapshot;

package/dist/src/web-ui/plugin-management-catalog.js

@@ -0,0 +1,56 @@
+import { ABOT_RUNTIME_EXTENSION } from "../plugin-contract/manifest.js";
+import { isPluginToolSelected, normalizePluginSelection, } from "../runtime/plugins/selection.js";
+import { capabilityPolicyBlockReason, pluginParentBlockReason, } from "./plugin-capability-selection.js";
+function pluginState(selectedCount, capabilityCount) {
+    if (selectedCount === 0)
+        return "disabled";
+    if (selectedCount < capabilityCount)
+        return "partial";
+    return "enabled";
+}
+function isPluginSelectionGloballyBlocked(selection) {
+    if (!selection.enabled)
+        return true;
+    return selection.deny.includes("*");
+}
+function projectPluginCapabilities(plugin, selection) {
+    const pluginId = plugin.manifest.name;
+    return Object.entries(plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION].capabilities).map(([id, capability]) => {
+        const blockedReason = capabilityPolicyBlockReason({
+            pluginId,
+            capabilityId: id,
+            selection,
+        });
+        return {
+            id,
+            description: capability.description,
+            enabled: isPluginToolSelected({ pluginId, toolName: id, selection }),
+            blockedByPolicy: blockedReason !== undefined,
+            ...(blockedReason ? { blockedReason } : {}),
+        };
+    });
+}
+export function projectPluginSnapshot(manifests, config) {
+    const selection = normalizePluginSelection(config);
+    return {
+        selection,
+        plugins: manifests.map((plugin) => {
+            const manifest = plugin.manifest;
+            const capabilities = projectPluginCapabilities(plugin, selection);
+            const capabilityCount = capabilities.length;
+            const selectedCapabilityCount = capabilities.filter((capability) => capability.enabled).length;
+            return {
+                id: manifest.name,
+                ...(manifest.description ? { description: manifest.description } : {}),
+                ...(manifest.version ? { version: manifest.version } : {}),
+                pluginEnabled: pluginParentBlockReason(manifest.name, selection) === undefined,
+                capabilities,
+                capabilityCount,
+                selectedCapabilityCount,
+                state: pluginState(selectedCapabilityCount, capabilityCount),
+                blockedByGlobalPolicy: isPluginSelectionGloballyBlocked(selection),
+            };
+        }),
+        application: "restart_required",
+    };
+}

package/dist/src/web-ui/plugin-management-selection.d.ts

@@ -0,0 +1,16 @@
+import type { DiscoveredAgentPluginManifest } from "../runtime/plugins/discovered-manifest.js";
+import type { RuntimePluginConfig } from "../runtime/ports.js";
+export declare function updatePluginSelection(params: {
+    current: RuntimePluginConfig;
+    pluginId: string;
+    capabilityIds: readonly string[];
+    capabilityId?: string;
+    enabled: boolean;
+}): RuntimePluginConfig;
+export declare function pluginSelectionEscapesRequestedScope(params: {
+    manifests: readonly DiscoveredAgentPluginManifest[];
+    pluginId: string;
+    capabilityId?: string;
+    before: RuntimePluginConfig;
+    after: RuntimePluginConfig;
+}): boolean;

package/dist/src/web-ui/plugin-management-selection.js

@@ -0,0 +1,71 @@
+import { ABOT_RUNTIME_EXTENSION } from "../plugin-contract/manifest.js";
+import { updatePluginCapabilitySelection } from "./plugin-capability-selection.js";
+import { isPluginToolSelected, normalizePluginSelection, } from "../runtime/plugins/selection.js";
+export function updatePluginSelection(params) {
+    if (params.capabilityId !== undefined) {
+        return updatePluginCapabilitySelection({
+            ...params,
+            capabilityId: params.capabilityId,
+        });
+    }
+    const { current, pluginId } = params;
+    if (!params.enabled) {
+        const deny = [...(current.deny ?? [])];
+        if (!deny.some((id) => id.trim() === pluginId))
+            deny.push(pluginId);
+        return { ...current, deny };
+    }
+    const deny = current.deny?.filter((id) => id.trim() !== pluginId);
+    const next = { ...current, ...(deny ? { deny } : {}) };
+    if (hasAllowedPluginCapability(params))
+        return next;
+    return { ...next, allow: [...(current.allow ?? []), pluginId] };
+}
+function hasAllowedPluginCapability(params) {
+    const selection = normalizePluginSelection({
+        ...params.current,
+        enabled: true,
+        deny: [],
+    });
+    return params.capabilityIds.some((toolName) => isPluginToolSelected({ pluginId: params.pluginId, toolName, selection }));
+}
+function isRequestedSelectionTarget(params, pluginId, capabilityId) {
+    if (params.pluginId !== pluginId)
+        return false;
+    if (params.capabilityId === undefined)
+        return true;
+    return params.capabilityId === capabilityId;
+}
+function changedSelectionEntries(before, after) {
+    return ["allow", "deny"].flatMap((key) => {
+        const policy = key;
+        const removed = before[policy].filter((entry) => !after[policy].includes(entry));
+        const added = after[policy].filter((entry) => !before[policy].includes(entry));
+        return [...removed, ...added];
+    });
+}
+function selectorMatchesOtherCapability(params) {
+    return params.changedEntries.some((entry) => isPluginToolSelected({
+        pluginId: params.pluginId,
+        toolName: params.toolName,
+        selection: { enabled: true, allow: [entry], deny: [] },
+    }));
+}
+export function pluginSelectionEscapesRequestedScope(params) {
+    const before = normalizePluginSelection(params.before);
+    const after = normalizePluginSelection(params.after);
+    const changedEntries = changedSelectionEntries(before, after);
+    return params.manifests.some((plugin) => {
+        const pluginId = plugin.manifest.name;
+        const capabilityIds = Object.keys(plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION].capabilities);
+        return capabilityIds.some((toolName) => {
+            if (isRequestedSelectionTarget(params, pluginId, toolName))
+                return false;
+            if (selectorMatchesOtherCapability({ changedEntries, pluginId, toolName })) {
+                return true;
+            }
+            return (isPluginToolSelected({ pluginId, toolName, selection: before }) !==
+                isPluginToolSelected({ pluginId, toolName, selection: after }));
+        });
+    });
+}

package/dist/src/web-ui/plugin-management-service.d.ts

@@ -0,0 +1,29 @@
+import { type RuntimePluginSnapshot } from "./plugin-management-catalog.js";
+export type { RuntimePluginSnapshot } from "./plugin-management-catalog.js";
+export type PluginManagementOptions = {
+    rootDir: string;
+    configPath?: string;
+};
+export declare class PluginManagementError extends Error {
+    readonly code: string;
+    readonly statusCode: number;
+    constructor(code: string, message: string, statusCode?: number);
+}
+export declare function getRuntimePluginSnapshot(options: PluginManagementOptions): RuntimePluginSnapshot;
+export declare function setRuntimePluginEnabled(options: PluginManagementOptions, input: unknown): Promise<{
+    backupPath?: string | undefined;
+    restartRequired: boolean;
+    selection: import("../runtime/plugins/selection.js").PluginSelection;
+    plugins: Array<{
+        id: string;
+        description?: string;
+        version?: string;
+        pluginEnabled: boolean;
+        capabilities: import("./plugin-management-catalog.js").RuntimePluginCapabilitySnapshot[];
+        capabilityCount: number;
+        selectedCapabilityCount: number;
+        state: "enabled" | "partial" | "disabled";
+        blockedByGlobalPolicy: boolean;
+    }>;
+    application: "restart_required";
+}>;

package/dist/src/web-ui/plugin-management-service.js

@@ -0,0 +1,150 @@
+import { realpathSync } from "node:fs";
+import { ConfigFileConflictError, withConfigFileTransaction, } from "../runtime/adapters/config-file-transaction.js";
+import { inspectRuntimeConfigFileWithMeta } from "../runtime/config/loader.js";
+import { isRecord } from "../runtime/config/utils.js";
+import { validatePluginConfig } from "../runtime/config/validation/runtime-root-section-validation.js";
+import { ABOT_RUNTIME_EXTENSION } from "../plugin-contract/manifest.js";
+import { discoverConfiguredRuntimePluginManifests } from "../runtime/plugins/configured-manifests.js";
+import { normalizePluginSelection } from "../runtime/plugins/selection.js";
+import { capabilityPolicyBlockReason } from "./plugin-capability-selection.js";
+import { projectPluginSnapshot, } from "./plugin-management-catalog.js";
+import { saveConfigDashboardFile } from "./config-dashboard-backend.js";
+import { pluginSelectionEscapesRequestedScope, updatePluginSelection, } from "./plugin-management-selection.js";
+export class PluginManagementError extends Error {
+    code;
+    statusCode;
+    constructor(code, message, statusCode = 400) {
+        super(message);
+        this.code = code;
+        this.statusCode = statusCode;
+    }
+}
+function readPluginSelection(value) {
+    if (value === undefined)
+        return {};
+    if (!isRecord(value)) {
+        throw new PluginManagementError("invalid_plugin_configuration", "The plugin configuration must be an object.");
+    }
+    const issues = [];
+    validatePluginConfig(issues, value);
+    if (issues.length > 0) {
+        throw new PluginManagementError("invalid_plugin_configuration", "The plugin configuration is invalid. Review it in Advanced settings.");
+    }
+    return value;
+}
+export function getRuntimePluginSnapshot(options) {
+    const source = inspectRuntimeConfigFileWithMeta(options.rootDir, options.configPath);
+    return projectPluginSnapshot(discoverConfiguredRuntimePluginManifests(options.rootDir), readPluginSelection(source.config.plugins));
+}
+function isPluginSelectionIdentifier(value) {
+    if (typeof value !== "string")
+        return false;
+    return value.trim().length > 0;
+}
+function parsePluginToggle(input) {
+    if (!isRecord(input))
+        throw new PluginManagementError("invalid_plugin_update", "Choose a plugin and whether it should be enabled.");
+    const hasUnsupportedSelectionFields = Object.keys(input).some((key) => !["pluginId", "capabilityId", "enabled"].includes(key));
+    if (hasUnsupportedSelectionFields) {
+        throw new PluginManagementError("invalid_plugin_update", "The plugin update contains unsupported fields.");
+    }
+    if (!isPluginSelectionIdentifier(input.pluginId)) {
+        throw new PluginManagementError("invalid_plugin_update", "A plugin ID is required.");
+    }
+    if (typeof input.enabled !== "boolean") {
+        throw new PluginManagementError("invalid_plugin_update", "The enabled value must be true or false.");
+    }
+    if (input.capabilityId === undefined) {
+        return { pluginId: input.pluginId.trim(), enabled: input.enabled };
+    }
+    if (!isPluginSelectionIdentifier(input.capabilityId)) {
+        throw new PluginManagementError("invalid_plugin_update", "A capability ID must be a non-empty string.");
+    }
+    return {
+        pluginId: input.pluginId.trim(),
+        capabilityId: input.capabilityId.trim(),
+        enabled: input.enabled,
+    };
+}
+function requireCapabilityUpdateAllowed(plugin, toggle, current) {
+    const capabilityId = toggle.capabilityId;
+    if (capabilityId === undefined)
+        return;
+    const capabilities = plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION].capabilities;
+    const isDeclaredCapability = Object.hasOwn(capabilities, capabilityId);
+    if (!isDeclaredCapability) {
+        throw new PluginManagementError("plugin_capability_not_found", "The selected capability does not belong to this plugin.", 404);
+    }
+    if (!toggle.enabled)
+        return;
+    const blockedReason = capabilityPolicyBlockReason({
+        pluginId: plugin.manifest.name,
+        capabilityId,
+        selection: normalizePluginSelection(current),
+    });
+    if (!blockedReason)
+        return;
+    throw new PluginManagementError("plugin_capability_blocked", blockedReason, 409);
+}
+function configuredPluginSource(options) {
+    const source = inspectRuntimeConfigFileWithMeta(options.rootDir, options.configPath);
+    if (!source.exists) {
+        throw new PluginManagementError("runtime_setup_required", "Complete Runtime setup before changing plugins.", 409);
+    }
+    return source;
+}
+export async function setRuntimePluginEnabled(options, input) {
+    const toggle = parsePluginToggle(input);
+    const source = configuredPluginSource(options);
+    const configPath = realpathSync(source.path);
+    const canonicalOptions = {
+        rootDir: realpathSync(options.rootDir),
+        configPath,
+    };
+    try {
+        return await withConfigFileTransaction(configPath, (transaction) => savePluginSelection(canonicalOptions, toggle, transaction));
+    }
+    catch (error) {
+        if (error instanceof ConfigFileConflictError)
+            throw new PluginManagementError("config_changed", error.message, 409);
+        throw error;
+    }
+}
+async function savePluginSelection(options, toggle, transaction) {
+    const source = configuredPluginSource(options);
+    const manifests = discoverConfiguredRuntimePluginManifests(options.rootDir);
+    const plugin = manifests.find((entry) => entry.manifest.name === toggle.pluginId);
+    if (!plugin)
+        throw new PluginManagementError("plugin_not_found", "The selected plugin is not installed.", 404);
+    const current = readPluginSelection(source.config.plugins);
+    const capabilityId = toggle.capabilityId;
+    requireCapabilityUpdateAllowed(plugin, toggle, current);
+    const next = updatePluginSelection({
+        current,
+        ...(capabilityId ? { capabilityId } : {}),
+        pluginId: toggle.pluginId,
+        capabilityIds: Object.keys(plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION].capabilities),
+        enabled: toggle.enabled,
+    });
+    const escapesRequestedScope = pluginSelectionEscapesRequestedScope({
+        manifests,
+        pluginId: toggle.pluginId,
+        ...(capabilityId ? { capabilityId } : {}),
+        before: current,
+        after: next,
+    });
+    if (escapesRequestedScope) {
+        throw new PluginManagementError("plugin_selection_conflict", "This selection would also change other capabilities. Review the selection in Advanced settings.", 409);
+    }
+    const result = await saveConfigDashboardFile({
+        ...options,
+        kind: "runtime",
+        config: { ...source.config, plugins: next },
+        transaction,
+    });
+    return {
+        ...projectPluginSnapshot(manifests, next),
+        restartRequired: true,
+        ...(result.backupPath ? { backupPath: result.backupPath } : {}),
+    };
+}

package/dist/src/web-ui/request-authority.d.ts

@@ -0,0 +1,8 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Duplex } from "node:stream";
+/** Trust the configured listener and local interface, never request DNS or proxy headers. */
+export declare function hasTrustedWebUiAuthority(request: IncomingMessage, listenHost: string, allowPublishedLoopback?: boolean): boolean;
+/** A native client may use a Docker-published loopback port unlike the listener port. */
+export declare function hasLoopbackRequestAuthority(request: IncomingMessage): boolean;
+export declare function acceptWebUiHttpAuthority(request: IncomingMessage, response: ServerResponse, listenHost: string, allowPublishedLoopback?: boolean): boolean;
+export declare function acceptWebUiUpgradeAuthority(request: IncomingMessage, socket: Duplex, listenHost: string, allowPublishedLoopback?: boolean): boolean;