@b00dea/cockpit 0.0.0-bootstrap.0 → 0.1.0

package/dist/browser/commands.js

@@ -0,0 +1,349 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { lstatSync, mkdirSync, realpathSync } from 'node:fs';
+import { readBoundedFile } from '../bounded-read.js';
+import { isIP } from 'node:net';
+import { dirname, isAbsolute, relative, resolve } from 'node:path';
+import { errorCause, snapshotJson, RefusalError, hasErrorCode } from '../environment/contract.js';
+import {} from '../environment/state.js';
+import { cockpitCommand } from '../fix-catalogue.js';
+import { assertBrowserStorageStateCurrent, browserRuntimeControlAuthorities, browserRuntimeControlPorts } from './runtime.js';
+import { authenticateBrowserProjectClient, executeBrowserProjectOperation, withBrowserProjectOperationAdmission } from './surfaces.js';
+const issuedPolicies = new WeakMap();
+const issuedReceipts = new WeakSet();
+const kinds = new Set(['drive', 'screenshot']);
+const sha256 = /^[a-f0-9]{64}$/;
+const MAX_SCREENSHOT_BYTES = 8_388_608;
+const COMMAND_TIMEOUT_MS = 30_000;
+const browserFailureCategories = Object.freeze({
+    connect: 'availability', context: 'setup', navigation: 'navigation',
+    screenshot: 'observation', artifact: 'artifact', cleanup: 'cleanup',
+});
+function refusal(reason) {
+    return { kind: 'refusal', reason };
+}
+// The reason vocabulary the operation program may report: identifiers only, never page text.
+const FAILURE_REASON = /^(?:ERR_[A-Z0-9_]{1,64}|HTTP_[1-5][0-9]{2}|TIMEOUT)$/;
+const UNANSWERED = new Set(['ERR_CONNECTION_REFUSED', 'ERR_SOCKS_CONNECTION_FAILED', 'ERR_CONNECTION_RESET',
+    'ERR_CONNECTION_CLOSED', 'ERR_EMPTY_RESPONSE', 'ERR_ADDRESS_UNREACHABLE']);
+function parseBrowserFailure(value) {
+    if (value.byteLength === 0 || value.byteLength > 1_024)
+        return undefined;
+    let parsed;
+    // The bytes come from the child's stderr and a parse error can quote them; the caller reports
+    // the failure from its own fixed text when this returns undefined.
+    try {
+        parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(value));
+    }
+    catch {
+        return undefined;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return undefined;
+    const row = parsed;
+    const keys = Object.keys(row).sort().join(',');
+    if (keys !== 'category,cleanup,phase,schema' && keys !== 'category,cleanup,phase,reason,schema'
+        || row.schema !== 'cockpit-browser-failure/v1' || typeof row.phase !== 'string'
+        || !(row.phase in browserFailureCategories) || typeof row.cleanup !== 'boolean'
+        || row.reason !== undefined && (typeof row.reason !== 'string' || !FAILURE_REASON.test(row.reason)))
+        return undefined;
+    const phase = row.phase;
+    const category = browserFailureCategories[phase];
+    return row.category === category
+        ? { phase, category, cleanup: row.cleanup, ...(typeof row.reason === 'string' ? { reason: row.reason } : {}) }
+        : undefined;
+}
+// What a person can do about a failed navigation, keyed by the reason the browser reported.
+function failureHint(reason, url, runtime) {
+    if (reason === undefined)
+        return '';
+    if (UNANSWERED.has(reason)) {
+        return `: nothing answered at ${url} (${reason}); check that the application is up with ${cockpitCommand('doctor', { config: runtime.configurationPath })}`;
+    }
+    if (reason === 'ERR_NAME_NOT_RESOLVED')
+        return `: ${new URL(url).hostname} did not resolve (${reason}); use the declared .localhost hostname or 127.0.0.1`;
+    if (reason.startsWith('ERR_CERT_')) {
+        return `: the browser does not trust the certificate at ${url} (${reason}); add the issuing CA to the ${runtime.connection.kind === 'remote' ? 'remote browser\'s image' : 'host trust store'}`;
+    }
+    if (reason.startsWith('HTTP_'))
+        return `: ${url} answered HTTP ${reason.slice(5)}, and a surface must answer 2xx`;
+    if (reason === 'TIMEOUT')
+        return `: ${url} did not finish loading within the 30-second command deadline`;
+    return ` (${reason})`;
+}
+// Mirrors Playwright's exposeNetwork matching: a remote browser reaches an address through the
+// connecting client only when a rule covers it, and goes to its own network for everything else.
+// Chromium hands the tunnel an IPv6 literal without brackets, which no rule matches (its
+// <loopback> names only the bracketed form), so an IPv6 origin is never covered.
+function networkExposureCovers(exposure, origin) {
+    const hostname = origin.hostname.toLowerCase();
+    if (hostname.startsWith('['))
+        return false;
+    const port = Number(origin.port || (origin.protocol === 'http:' ? '80' : '443'));
+    const ip = isIP(hostname) !== 0;
+    return exposure.split(',').some(rule => {
+        const match = /^(.*?)(?::(\d+))?$/.exec(rule);
+        if (!match || match[2] !== undefined && Number(match[2]) !== port)
+            return false;
+        const host = match[1].toLowerCase();
+        if (host === '<loopback>')
+            return ['localhost', '127.0.0.1'].includes(hostname) || hostname.endsWith('.localhost');
+        if (host === '*')
+            return true;
+        if (isIP(host) !== 0)
+            return host === hostname;
+        if (ip)
+            return false;
+        const pattern = host.startsWith('.') ? `*${host}` : host;
+        return pattern.startsWith('*.') ? hostname.endsWith(pattern.slice(1)) : hostname === pattern;
+    });
+}
+export function issueBrowserRoutePolicy(runtime, input) {
+    assertBrowserStorageStateCurrent(runtime);
+    const captured = snapshotJson(input);
+    if (!captured || Object.keys(captured).sort().join(',') !== 'origin,routes') {
+        throw new RefusalError('browser route policy requires closed origin and route declarations');
+    }
+    if (typeof captured.origin !== 'string' || !Array.isArray(captured.routes)
+        || captured.routes.length === 0 || captured.routes.length > 64)
+        throw new RefusalError('browser route policy requires bounded declared routes');
+    let origin;
+    try {
+        origin = new URL(captured.origin);
+    }
+    catch {
+        throw new RefusalError('browser application origin must be an absolute HTTP(S) origin');
+    }
+    if (!['http:', 'https:'].includes(origin.protocol) || origin.username || origin.password || origin.pathname !== '/'
+        || origin.search || origin.hash || origin.origin !== captured.origin.replace(/\/$/, '')) {
+        throw new RefusalError('browser application origin must be an absolute HTTP(S) origin without credentials, path, query or fragment');
+    }
+    const controlAuthorities = browserRuntimeControlAuthorities(runtime);
+    const controlPorts = browserRuntimeControlPorts(runtime);
+    const originPort = Number(origin.port || (origin.protocol === 'http:' ? '80' : '443'));
+    const originAuthority = `${origin.hostname}:${originPort}`;
+    if (!controlAuthorities || !controlPorts || controlAuthorities.includes(originAuthority) || controlPorts.includes(originPort)) {
+        throw new RefusalError('browser application origin must be distinct from the browser-control proxy authority');
+    }
+    const names = new Set();
+    const urls = new Set();
+    const surfaces = [];
+    for (const candidate of captured.routes) {
+        if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate))
+            throw new RefusalError('browser routes must be declared relative paths');
+        const row = candidate;
+        if (Object.keys(row).sort().join(',') !== 'name,path')
+            throw new RefusalError('browser route policy requires closed route declarations');
+        if (typeof row.name !== 'string' || !/^[a-z0-9][a-z0-9_-]{0,63}$/.test(row.name)
+            || typeof row.path !== 'string' || !row.path.startsWith('/') || row.path.startsWith('//') || row.path.includes('#')) {
+            throw new RefusalError('browser routes must use unique names and declared relative HTTP paths without fragments');
+        }
+        const url = new URL(row.path, origin);
+        if (url.origin !== origin.origin || url.username || url.password || url.hash || names.has(row.name) || urls.has(url.href)) {
+            throw new RefusalError('browser routes must remain unique and relative to the application origin');
+        }
+        names.add(row.name);
+        urls.add(url.href);
+        surfaces.push({ name: row.name, url: url.href });
+    }
+    const policy = { origin: origin.origin, surfaces };
+    issuedPolicies.set(policy, runtime);
+    return policy;
+}
+function authentication(input) {
+    const auth = input.runtime.authentication;
+    if (auth.posture !== 'real')
+        return input.role === undefined && input.state === undefined ? { posture: auth.posture } : undefined;
+    if (typeof input.role !== 'string' || auth.policy === 'none')
+        return undefined;
+    const state = auth.states.find(candidate => candidate.worker === input.role);
+    if (!state)
+        return undefined;
+    return { posture: 'real', role: input.role, policy: auth.policy, statePath: resolve(input.client.cwd, state.path) };
+}
+function publicAuthentication(value) {
+    return value.posture !== 'real' ? { posture: value.posture }
+        : { posture: 'real', role: value.role, policy: value.policy };
+}
+function parseObservation(value, kind, origin) {
+    let parsed;
+    // Child stdout can be quoted by a parse error; the caller refuses with its own fixed message.
+    try {
+        parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(value));
+    }
+    catch {
+        return undefined;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        return undefined;
+    const row = parsed;
+    const expected = kind === 'drive' ? ['finalUrl', 'operation', 'schema'] : ['evidence', 'finalUrl', 'operation', 'schema'];
+    if (Object.keys(row).sort().join(',') !== expected.sort().join(',') || row.schema !== 'cockpit-browser-observation/v1' || row.operation !== kind || typeof row.finalUrl !== 'string')
+        return undefined;
+    let final;
+    // A URL error quotes the child-reported address; the caller refuses with its own fixed message.
+    try {
+        final = new URL(row.finalUrl);
+    }
+    catch {
+        return undefined;
+    }
+    if (final.origin !== origin || final.username || final.password || final.hash)
+        return undefined;
+    if (kind === 'drive')
+        return { finalUrl: final.href };
+    if (!row.evidence || typeof row.evidence !== 'object' || Array.isArray(row.evidence))
+        return undefined;
+    const evidence = row.evidence;
+    if (Object.keys(evidence).sort().join(',') !== 'byteLength,sha256' || typeof evidence.sha256 !== 'string' || !sha256.test(evidence.sha256)
+        || !Number.isSafeInteger(evidence.byteLength) || evidence.byteLength < 0
+        || evidence.byteLength > MAX_SCREENSHOT_BYTES)
+        return undefined;
+    return { finalUrl: final.href, evidence: { sha256: evidence.sha256, byteLength: evidence.byteLength } };
+}
+// Returns undefined when the file fails a check; a filesystem error is thrown for the caller to name.
+function postcheckScreenshot(root, cockpitRoot, path, expected) {
+    const rootStat = lstatSync(root);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink() || realpathSync(root) !== root)
+        return undefined;
+    const rel = relative(root, path);
+    if (!rel || rel.startsWith('..') || isAbsolute(rel) || resolve(root, rel) !== path || realpathSync(path) !== path)
+        return undefined;
+    const read = readBoundedFile(path, expected.byteLength);
+    const linked = lstatSync(path);
+    if (read.kind !== 'complete' || read.bytes.byteLength !== expected.byteLength || linked.nlink !== 1 || (linked.mode & 0o7777) !== 0o600
+        || createHash('sha256').update(read.bytes).digest('hex') !== expected.sha256)
+        return undefined;
+    const receiptPath = relative(cockpitRoot, path);
+    return receiptPath && !receiptPath.startsWith('..') && !isAbsolute(receiptPath) ? receiptPath : undefined;
+}
+export function isIssuedBrowserCommandReceipt(value) {
+    return value !== null && typeof value === 'object' && issuedReceipts.has(value);
+}
+// The artifact root is declared, not shipped, so the first screenshot meets a missing directory.
+// Create it here, at the one place that writes into it, from the nearest existing ancestor, which
+// must be a real directory: the operation re-authenticates the root's identity before it writes.
+function ensureArtifactRoot(root) {
+    let ancestor = root;
+    for (;;) {
+        try {
+            const status = lstatSync(ancestor);
+            if (!status.isDirectory() || status.isSymbolicLink() || realpathSync(ancestor) !== ancestor) {
+                return `Browser screenshot artifact root ${root} lies behind ${ancestor}, which is not a real directory`;
+            }
+            break;
+        }
+        catch (error) {
+            if (!hasErrorCode(error, 'ENOENT'))
+                return `Browser screenshot artifact root ${root} could not be inspected at ${ancestor}: ${errorCause(error)}`;
+            const parent = dirname(ancestor);
+            if (parent === ancestor)
+                return `Browser screenshot artifact root ${root} has no existing ancestor`;
+            ancestor = parent;
+        }
+    }
+    try {
+        mkdirSync(root, { recursive: true, mode: 0o700 });
+    }
+    catch (error) {
+        return `Browser screenshot artifact root ${root} could not be created: ${errorCause(error)}`;
+    }
+    return undefined;
+}
+async function run(input, client, policy, auth, deadline, authorization) {
+    const receipts = [];
+    if (input.kind === 'screenshot') {
+        const unavailable = ensureArtifactRoot(client.artifactRoot);
+        if (unavailable)
+            return refusal(unavailable);
+    }
+    for (const surface of policy.surfaces) {
+        // Only the runtime's own fixed-text TypeError escapes the revalidation (it replaces filesystem
+        // errors with that text), so the refusal names the condition instead.
+        try {
+            assertBrowserStorageStateCurrent(input.runtime);
+        }
+        catch {
+            return refusal('Browser seeded state changed before application driving');
+        }
+        const output = input.kind === 'screenshot' ? resolve(client.artifactRoot, `screenshot-${randomUUID()}.png`) : undefined;
+        if (deadline <= Date.now())
+            return refusal('Browser command exceeded its total 30-second deadline');
+        const authenticated = await executeBrowserProjectOperation(client, input.runtime, {
+            kind: input.kind, surface, deadline, ...(auth.posture === 'real' ? { role: auth.role } : {}), ...(output ? { output } : {}),
+        }, authorization);
+        if (!authenticated || authenticated.kind === 'unadmitted') {
+            return refusal(`Browser ${input.kind} operation was not admitted to the bounded executor for ${surface.name}${authenticated ? ` (${authenticated.cause})` : ''}`);
+        }
+        const failure = authenticated.execution.exitCode === 0 ? undefined : parseBrowserFailure(authenticated.stderr);
+        if (failure) {
+            return refusal(`Browser ${input.kind} operation failed during ${failure.phase} (${failure.category})${failure.cleanup && failure.phase !== 'cleanup'
+                ? ' and cleanup also failed' : ''} for ${surface.name}${failureHint(failure.reason, surface.url, input.runtime)}`);
+        }
+        if (authenticated.kind !== 'complete') {
+            return refusal(`Browser ${input.kind} operation was refused by the bounded executor for ${surface.name}`);
+        }
+        if (authenticated.execution.exitCode !== 0) {
+            return refusal(`Browser ${input.kind} operation failed without a valid bounded diagnostic for ${surface.name}`);
+        }
+        const observation = parseObservation(authenticated.stdout, input.kind, policy.origin);
+        if (!observation)
+            return refusal(`Browser ${input.kind} returned no bound application-driving observation for ${surface.name}`);
+        try {
+            assertBrowserStorageStateCurrent(input.runtime);
+        }
+        catch {
+            return refusal('Browser seeded state changed while the application was being driven');
+        }
+        const base = { name: surface.name, url: observation.finalUrl };
+        if (input.kind === 'screenshot') {
+            let path;
+            let cause = '';
+            try {
+                path = postcheckScreenshot(client.artifactRoot, client.cwd, output, observation.evidence);
+            }
+            catch (error) {
+                cause = ` (${errorCause(error)})`;
+            }
+            if (!path)
+                return refusal(`Browser screenshot output failed its contained mode-600 postcheck for ${surface.name}${cause}`);
+            receipts.push({ ...base, screenshot: { path, ...observation.evidence } });
+        }
+        else
+            receipts.push(base);
+    }
+    const receipt = { kind: input.kind, activation: 'application',
+        authentication: publicAuthentication(auth), surfaces: receipts };
+    issuedReceipts.add(receipt);
+    return { kind: 'complete', receipt };
+}
+export async function executeBrowserCommand(value) {
+    const deadline = Date.now() + COMMAND_TIMEOUT_MS;
+    const input = value;
+    if (!kinds.has(input.kind))
+        return refusal('Browser command kind is unsupported');
+    let client;
+    let clientCause = '';
+    try {
+        client = authenticateBrowserProjectClient(input.client, input.runtime);
+    }
+    catch (error) {
+        clientCause = ` (${errorCause(error)})`;
+    }
+    if (!client)
+        return refusal(`Browser command requires an issued project module client${clientCause}`);
+    if (issuedPolicies.get(input.policy) !== input.runtime)
+        return refusal('Browser command requires an issued route policy for the current runtime');
+    if (input.runtime.connection.kind === 'remote' && !networkExposureCovers(input.runtime.networkExposure, new URL(input.policy.origin))) {
+        return refusal(`Browser application origin ${input.policy.origin} is outside browser.network_exposure (${input.runtime.networkExposure}): `
+            + 'a remote browser reaches host addresses only through that exposure, so it would look for the application inside its own container. '
+            + 'Use a 127.0.0.1, localhost or .localhost origin (an IPv6 literal is never tunnelled), or widen network_exposure with a network_exposure_reason');
+    }
+    const auth = authentication(input);
+    if (!auth)
+        return refusal(input.runtime.authentication.posture === 'real'
+            ? 'Browser command requires a declared seeded role and matching coordination authority' : 'Bypassed browser authentication cannot accept role or state input');
+    const admitted = await withBrowserProjectOperationAdmission(client, input.runtime, {
+        origin: input.policy.origin, ...(auth.posture === 'real' ? { role: auth.role } : {}), ...(input.state ? { state: input.state } : {}),
+    }, authorization => run(input, client, input.policy, auth, deadline, authorization));
+    return admitted.kind === 'admitted' ? admitted.value : refusal(admitted.reason);
+}

package/dist/browser/package-paths.d.ts

@@ -0,0 +1 @@
+export declare function isPackageDescendant(root: string, candidate: string): boolean;

package/dist/browser/package-paths.js

@@ -0,0 +1,6 @@
+import { isAbsolute, relative, sep } from 'node:path';
+// Lexical confinement complements the caller's canonical filesystem and byte-identity checks.
+export function isPackageDescendant(root, candidate) {
+    const offset = relative(root, candidate);
+    return candidate.startsWith(`${root}${sep}`) && offset.length > 0 && offset !== '..' && !offset.startsWith(`..${sep}`) && !isAbsolute(offset);
+}

package/dist/browser/proxy.d.ts

@@ -0,0 +1,22 @@
+export interface BrowserProxyInput {
+    readonly serverPort: number;
+    readonly proxyPort: number;
+    readonly allowedHosts: readonly string[];
+    readonly bind?: '127.0.0.1' | '::1';
+}
+export declare function browserProxyAuthorityMatches(value: string, expectedPort: number): boolean;
+export declare function resolveBrowserProxy(input: BrowserProxyInput): {
+    server: {
+        bind: '127.0.0.1';
+        port: number;
+        publish: false;
+    };
+    proxy: {
+        bind: "127.0.0.1" | "::1";
+        port: number;
+        allowedHosts: any[];
+        checkHost: true;
+    };
+};
+export type BrowserProxyProjection = ReturnType<typeof resolveBrowserProxy>;
+export declare function browserHostAllowed(policy: BrowserProxyProjection, host: unknown): boolean;

package/dist/browser/proxy.js

@@ -0,0 +1,37 @@
+import { RefusalError } from '../environment/contract.js';
+function port(value) {
+    return Number.isSafeInteger(value) && value > 0 && value <= 65535;
+}
+export function browserProxyAuthorityMatches(value, expectedPort) {
+    if (!port(expectedPort) || typeof value !== 'string' || value.length > 260 || !/^[a-z0-9.[\]:-]+$/.test(value))
+        return false;
+    try {
+        const parsed = new URL(`http://${value}`);
+        return value === `${parsed.hostname}:${expectedPort}`
+            && parsed.hostname !== 'undefined' && parsed.hostname !== 'null';
+    }
+    catch {
+        // A URL parse error quotes the authority; a boolean answer is the whole contract.
+        return false;
+    }
+}
+export function resolveBrowserProxy(input) {
+    if (!port(input.serverPort) || !port(input.proxyPort) || input.serverPort === input.proxyPort) {
+        throw new RefusalError('browser proxy needs distinct valid server and proxy ports');
+    }
+    const bind = input.bind ?? '127.0.0.1';
+    if (bind !== '127.0.0.1' && bind !== '::1')
+        throw new RefusalError('browser proxy control publication must remain on loopback until authenticated transport is available');
+    if (!Array.isArray(input.allowedHosts) || input.allowedHosts.length === 0 || input.allowedHosts.length > 64
+        || new Set(input.allowedHosts).size !== input.allowedHosts.length
+        || !input.allowedHosts.every((host) => browserProxyAuthorityMatches(host, input.proxyPort))) {
+        throw new RefusalError('browser proxy Host allowlist must contain exact hostname:port authorities');
+    }
+    return {
+        server: { bind: '127.0.0.1', port: input.serverPort, publish: false },
+        proxy: { bind, port: input.proxyPort, allowedHosts: [...input.allowedHosts], checkHost: true },
+    };
+}
+export function browserHostAllowed(policy, host) {
+    return typeof host === 'string' && browserProxyAuthorityMatches(host, policy.proxy.port) && policy.proxy.allowedHosts.includes(host);
+}

package/dist/browser/runtime.d.ts

@@ -0,0 +1,117 @@
+import { type PreflightContext } from '../environment/posture-observation.js';
+import { type StateNamespace } from '../environment/state.js';
+import { type BrowserProxyInput } from './proxy.js';
+interface BrowserImage {
+    readonly reference: string;
+    readonly driverVersion: string;
+}
+interface BrowserStorageState {
+    readonly worker: string;
+    readonly path: string;
+}
+export interface BrowserRuntimeInput {
+    readonly postures: PreflightContext;
+    readonly images: Readonly<{
+        mcp: BrowserImage;
+    }>;
+    readonly project: Readonly<{
+        lockfile: string;
+        sha256: string;
+        driverVersion: string;
+        manifest?: string;
+        manifestSha256?: string;
+    }>;
+    readonly engine?: 'chromium' | 'firefox' | 'webkit';
+    readonly hostVariable?: string;
+    readonly networkExposure?: string;
+    readonly networkExposureReason?: string;
+    readonly endpoint?: string;
+    readonly maxClients: number;
+    readonly proxy: BrowserProxyInput;
+    readonly resolver: readonly Readonly<{
+        hostname: string;
+        address: string;
+    }>[];
+    readonly authentication: Readonly<{
+        policy: 'none' | 'serialized' | 'per-worker';
+        states: readonly BrowserStorageState[];
+    }>;
+    readonly data: Readonly<{
+        mode: 'empty' | 'seeded' | 'restored';
+        isolated: boolean;
+        reachesProduction: boolean;
+    }>;
+    readonly requestPreapproval: boolean;
+    readonly artifacts: Readonly<Record<'mcp' | 'cli' | 'auth', string>>;
+}
+export declare function resolveBrowserRuntime(input: BrowserRuntimeInput, coordinationNamespace?: StateNamespace): {
+    configurationPath: string;
+    connection: Readonly<{
+        kind: 'remote';
+        endpoint: string;
+        launchLocal: false;
+    }> | Readonly<{
+        kind: 'local-fallback';
+        reason: 'endpoint-absent';
+        launchLocal: true;
+    }>;
+    project: {
+        lockfile: string;
+        sha256: string;
+        driverVersion: string;
+        manifest?: string | undefined;
+        manifestSha256?: string | undefined;
+    };
+    mcp: {
+        image: string;
+        endpoint?: string | undefined;
+    };
+    server: {
+        bind: '127.0.0.1';
+        port: number;
+        publish: false;
+        maxClients: number;
+        engine: "chromium" | "firefox" | "webkit";
+        headless: true;
+    };
+    proxy: {
+        bind: "127.0.0.1" | "::1";
+        port: number;
+        allowedHosts: any[];
+        checkHost: true;
+    };
+    addressing: {
+        posture: "hostname" | "port" | null;
+        resolverRules: string[] | null;
+    };
+    requirements: readonly Readonly<{
+        requirement: string;
+        addressing?: import("../schema.js").AddressingPosture;
+        authentication?: import("../schema.js").AuthPosture;
+    }>[];
+    authentication: {
+        posture: "bypassed" | "none";
+        policy: 'none';
+        states: never[];
+        claim?: undefined;
+    } | {
+        posture: 'real';
+        policy: "none" | "per-worker" | "serialized";
+        states: any[];
+        claim: "exclusive" | "per-worker";
+    };
+    preapproval: "eligible" | "not-requested";
+    networkExposure: string;
+    networkExposureReason?: string | undefined;
+    generatedHostPaths: string[];
+    cliArtifactRoot: string;
+};
+export type BrowserRuntimeProjection = ReturnType<typeof resolveBrowserRuntime>;
+export declare function browserRuntimeControlAuthorities(runtime: BrowserRuntimeProjection): readonly string[] | undefined;
+export declare function browserRuntimeControlPorts(runtime: BrowserRuntimeProjection): readonly number[] | undefined;
+export declare function browserRuntimeCoordination(runtime: BrowserRuntimeProjection): Readonly<{
+    namespace: StateNamespace;
+    stackId: import('../environment/contract.js').StackId;
+}> | undefined;
+export declare function assertBrowserStorageStateCurrent(runtime: BrowserRuntimeProjection): void;
+export {};