@babylonjs-toolkit/server 0.0.0-stage → 9.35.1

package/lib/admin/AdminPermissions.js

@@ -0,0 +1,74 @@
+// Permissions and roles of the admin console (game-server-admin-console D17, DR §5, §13 R1 and R24). Every API route
+// names one permission; no code checks a role name.
+/** Every action the console and API can check (D17), in the order of the AdminPermission union. */
+export const ADMIN_PERMISSIONS = [
+    "fleet.view", "fleet.manage", // overview/instances read; maintenance, drain, rollouts, schedules
+    "sessions.view", "sessions.manage", // list/detail; close, lock, notice
+    "sessions.inspect", // session inspector
+    "players.view", "players.viewAddresses", "players.manage", // search/detail; addresses; kick, notice, lobby kick
+    "bans.view", "bans.manage",
+    "dedicated.view", "dedicated.manage",
+    "metrics.view",
+    "logs.view", "logs.manage", // read; change level
+    "config.view", "config.manage",
+    "auth.view", "auth.manage", // auth status/tester; JWKS reload
+    "alerts.view", "alerts.manage",
+    "audit.view", "audit.retention",
+    "users.view", "users.manage",
+    "apiKeys.manage",
+    "players.notes", // read and write player notes; see notes and kicks on player pages (R24)
+    "extensions.run", "extensions.runDeveloper",
+    "cloud.view", "cloud.billing", // Colyseus Cloud page; its billing figures (colyseus-cloud-console D7)
+    // Leaderboards (game-server-leaderboards D22)
+    "leaderboards.view", "leaderboards.manage", "leaderboards.submit"
+];
+/** Compile-time check that ADMIN_PERMISSIONS' source union has exactly these names (R1): a missing or extra key fails tsc. */
+const permissionListIsComplete = {
+    "fleet.view": true, "fleet.manage": true, "sessions.view": true, "sessions.manage": true, "sessions.inspect": true,
+    "players.view": true, "players.viewAddresses": true, "players.manage": true, "bans.view": true, "bans.manage": true,
+    "dedicated.view": true, "dedicated.manage": true, "metrics.view": true, "logs.view": true, "logs.manage": true,
+    "config.view": true, "config.manage": true, "auth.view": true, "auth.manage": true, "alerts.view": true,
+    "alerts.manage": true, "audit.view": true, "audit.retention": true, "users.view": true, "users.manage": true,
+    "apiKeys.manage": true, "players.notes": true, "extensions.run": true, "extensions.runDeveloper": true,
+    "cloud.view": true, "cloud.billing": true, "leaderboards.view": true, "leaderboards.manage": true, "leaderboards.submit": true
+};
+/** The fixed roles (D17), highest first. */
+export const ADMIN_ROLES = ["owner", "admin", "operator", "moderator", "developer", "viewer"];
+/** Read-only permissions every role has. */
+const READ_PERMISSIONS = ["fleet.view", "sessions.view", "players.view", "dedicated.view", "metrics.view", "config.view", "alerts.view", "cloud.view", "leaderboards.view"];
+/** What each role may do (spec 1 role table, R24). */
+export const ROLE_PERMISSIONS = {
+    owner: new Set(ADMIN_PERMISSIONS),
+    admin: new Set(ADMIN_PERMISSIONS.filter((permission) => permission !== "audit.retention")),
+    operator: new Set([...READ_PERMISSIONS, "fleet.manage", "sessions.manage", "dedicated.manage", "config.manage", "alerts.manage", "logs.view", "logs.manage", "auth.view", "audit.view", "users.view", "players.notes", "extensions.run", "leaderboards.manage"]),
+    moderator: new Set([...READ_PERMISSIONS, "sessions.manage", "players.viewAddresses", "players.manage", "players.notes", "bans.view", "bans.manage", "audit.view", "logs.view", "auth.view", "users.view", "extensions.run", "leaderboards.manage"]),
+    developer: new Set([...READ_PERMISSIONS, "sessions.inspect", "dedicated.manage", "logs.view", "auth.view", "audit.view", "bans.view", "users.view", "players.viewAddresses", "extensions.runDeveloper", "leaderboards.submit"]),
+    viewer: new Set(READ_PERMISSIONS)
+};
+/** What the configured admin.token may do as an API key: everything except users.manage and audit.retention (D18). */
+export const LEGACY_TOKEN_PERMISSIONS = new Set(ADMIN_PERMISSIONS.filter((permission) => permission !== "users.manage" && permission !== "audit.retention"));
+/**
+ * True when a role or key with these permissions may perform the action.
+ * @param granted The permissions the caller holds.
+ * @param required The permission the route needs.
+ * @returns Whether it is allowed.
+ */
+export function hasPermission(granted, required) {
+    return granted.has(required);
+}
+/**
+ * Whether a text names a permission (API key requests and the CLI pass names as text).
+ * @param name The text.
+ * @returns True for one of ADMIN_PERMISSIONS.
+ */
+export function isAdminPermission(name) {
+    return name in permissionListIsComplete;
+}
+/**
+ * Whether a text names a role.
+ * @param name The text.
+ * @returns True for one of ADMIN_ROLES.
+ */
+export function isAdminRole(name) {
+    return ADMIN_ROLES.includes(name);
+}

package/lib/admin/AdminRecords.d.ts

@@ -0,0 +1,196 @@
+import type { AdminAlertSeverity, AdminLogLevel, AdminPermission, AdminPreferences, AdminRole, AlertChannelKind, AlertRuleId, BanHistoryEntry, BanKind, MaintenanceWindowView, PasskeyAlgorithm, RolloutStepView, RolloutView } from "./AdminApiTypes.js";
+/** An admin account (collection "users", id = userId). */
+export interface AdminUserRecord {
+    /** 16 random bytes, base64url. */
+    userId: string;
+    /** Lower case, /^[a-z0-9._-]{3,32}$/. */
+    username: string;
+    displayName: string;
+    email: string | null;
+    role: AdminRole;
+    /** scrypt hash (D8); null for SSO-only accounts. */
+    passwordHash: string | null;
+    /** Base32 TOTP secret; null until enrolled. */
+    totpSecret: string | null;
+    /** The last TOTP step used; a code at or below it is refused (D8). */
+    lastUsedTotpStep: number;
+    /** SHA-256 hex of each unused recovery code. */
+    recoveryCodeHashes: string[];
+    disabled: boolean;
+    /** ISO time the lockout ends, or null. */
+    lockedUntil: string | null;
+    oidcSubject: string | null;
+    preferences: AdminPreferences;
+    createdAt: string;
+    passwordChangedAt: string;
+    lastSignInAt: string | null;
+}
+/** A console session (collection "consoleSessions", id = sha256 hex of the cookie value). */
+export interface ConsoleSessionRecord {
+    /** Public id shown in "your sessions" (8 random bytes, base64url). */
+    sessionId: string;
+    userId: string;
+    csrfToken: string;
+    createdAt: string;
+    lastSeenAt: string;
+    /** When the second factor was last checked (sign-in or step-up). */
+    secondFactorAt: string;
+    clientAddress: string;
+    userAgent: string;
+}
+/** A sign-in waiting for its second factor or enrolment (collection "pendingSignIns", id = sha256 hex of pendingToken). */
+export interface PendingSignInRecord {
+    userId: string;
+    stage: "secondFactor" | "enrolSecondFactor";
+    /** The secret offered by auth/enrol, until it is confirmed. */
+    pendingTotpSecret: string | null;
+    expiresAt: string;
+    viaSingleSignOn: boolean;
+}
+/** An API key (collection "apiKeys", id = keyId). */
+export interface ApiKeyRecord {
+    keyId: string;
+    name: string;
+    /** SHA-256 hex of the secret. */
+    secretHash: string;
+    permissions: AdminPermission[];
+    expiresAt: string | null;
+    allowedNetworks: string[];
+    /** The creating user's id, or "cli". */
+    createdBy: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+    revoked: boolean;
+}
+/** A ban (collection "bans", id = banId). */
+export interface BanRecord {
+    banId: string;
+    kind: BanKind;
+    /** User id, address, or CIDR range. */
+    value: string;
+    reason: string;
+    note: string;
+    /** Null = permanent. */
+    expiresAt: string | null;
+    createdBy: string;
+    createdAt: string;
+    history: BanHistoryEntry[];
+}
+/** One sign-in failure counter (collection "signInFailures", id = "account:<userId>" or "address:<address>"). */
+export interface SignInFailureRecord {
+    /** ISO times within ACCOUNT_LOCKOUT_WINDOW_MS. */
+    failures: string[];
+}
+/** An alert rule's stored settings (collection "alertRules", id = ruleId). */
+export interface AlertRuleRecord {
+    ruleId: AlertRuleId;
+    enabled: boolean;
+    threshold: number | null;
+    forMinutes: number;
+    severity: AdminAlertSeverity;
+    channelIds: string[];
+    silencedUntil: string | null;
+}
+/** An alert channel (collection "alertChannels", id = channelId); url and routingKey are secrets. */
+export interface AlertChannelRecord {
+    channelId: string;
+    kind: AlertChannelKind;
+    name: string;
+    url: string | null;
+    routingKey: string | null;
+    createdBy: string;
+    createdAt: string;
+}
+/** A scheduled maintenance window (collection "maintenanceWindows", id = windowId). */
+export interface MaintenanceWindowRecord {
+    windowId: string;
+    startsAt: string;
+    endsAt: string;
+    message: string;
+    warningMinutes: number | null;
+    allowUserIds: string[];
+    allowAddresses: string[];
+    leaveReadiness: boolean;
+    state: MaintenanceWindowView["state"];
+    createdBy: string;
+}
+/** A rolling update (collection "rollouts", id = rolloutId). */
+export interface RolloutRecord {
+    rolloutId: string;
+    state: RolloutView["state"];
+    startedAt: string;
+    startedBy: string;
+    startingProcessIds: string[];
+    startingVersion: string;
+    noticeText: string | null;
+    noticeLeadSeconds: number;
+    perInstanceTimeoutMinutes: number;
+    steps: RolloutStepView[];
+    stepStartedAt: string | null;
+    message: string | null;
+}
+/** A note on a player (collection "playerNotes", id = noteId). */
+export interface PlayerNoteRecord {
+    noteId: string;
+    /** A user id or an address. */
+    subject: string;
+    text: string;
+    by: string;
+    at: string;
+}
+/** A registered passkey (collection "passkeys", id = passkeyId). */
+export interface PasskeyRecord {
+    passkeyId: string;
+    userId: string;
+    name: string;
+    /** base64url credential id. */
+    credentialId: string;
+    publicKeyJwk: JsonWebKey;
+    algorithm: PasskeyAlgorithm;
+    signCount: number;
+    createdAt: string;
+    lastUsedAt: string | null;
+}
+/** A temporary log level (settings/logLevel). */
+export interface TemporaryLogLevel {
+    level: AdminLogLevel;
+    until: string;
+    setBy: string;
+}
+/** Console config overrides (settings/configOverrides). */
+export interface ConfigOverrideSettings {
+    /** Dotted path → value, for every instance. */
+    fleet: Record<string, unknown>;
+    /** Process id → dotted path → value. */
+    instances: Record<string, Record<string, unknown>>;
+}
+/** A player joined or left a session (stream playerHistory). */
+export interface PlayerSessionEvent {
+    kind: "joined" | "left";
+    roomId: string;
+    sessionName: string;
+    processId: string;
+    playerId: number;
+    userId: string | null;
+    clientAddress: string;
+    at: string;
+}
+/** A passkey challenge (collection "pendingSignIns", id = "passkey:" + sha256 hex of the challenge, DR §7.11). */
+export interface PasskeyChallengeRecord {
+    /** Registration (navigator.credentials.create) or sign-in (navigator.credentials.get). */
+    kind: "passkeyRegistration" | "passkeyAssertion";
+    /** The account a registration is for, or the account named at sign-in (null: any account's passkey). */
+    userId: string | null;
+    expiresAt: string;
+}
+/** A started OpenID Connect sign-in (collection "pendingSignIns", id = "oidc:" + sha256 hex of the state, DR §7.10). */
+export interface OpenIdChallengeRecord {
+    kind: "oidc";
+    /** The nonce the ID token must carry. */
+    nonce: string;
+    /** The PKCE code verifier (S256). */
+    codeVerifier: string;
+    /** The redirect URI the authorization request named. */
+    redirectUri: string;
+    expiresAt: string;
+}

package/lib/admin/AdminRecords.js

@@ -0,0 +1,3 @@
+// The stored record shapes of the admin data store (game-server-admin-console DR §6.2 and §13 R16). These never leave
+// the server as they are: routes turn them into the view types of AdminApiTypes.ts first.
+export {};

package/lib/admin/AdminRequestBodies.d.ts

@@ -0,0 +1,47 @@
+/**
+ * The body as an object.
+ * @param body The parsed JSON body.
+ * @returns The object (an empty one for a missing body).
+ * @throws AdminRequestError 400 when the body is not an object.
+ */
+export declare function bodyObject(body: unknown): Record<string, unknown>;
+/**
+ * A required text field.
+ * @param body The body object.
+ * @param name The field name.
+ * @returns The text.
+ * @throws AdminRequestError 400 when it is missing or not text.
+ */
+export declare function stringField(body: Record<string, unknown>, name: string): string;
+/**
+ * An optional text field.
+ * @param body The body object.
+ * @param name The field name.
+ * @returns The text, or null when absent or null.
+ * @throws AdminRequestError 400 when present but not text.
+ */
+export declare function optionalStringField(body: Record<string, unknown>, name: string): string | null;
+/**
+ * A required true/false field.
+ * @param body The body object.
+ * @param name The field name.
+ * @returns The value.
+ * @throws AdminRequestError 400 when it is missing or not a boolean.
+ */
+export declare function booleanField(body: Record<string, unknown>, name: string): boolean;
+/**
+ * A required number field.
+ * @param body The body object.
+ * @param name The field name.
+ * @returns The number.
+ * @throws AdminRequestError 400 when it is missing or not a finite number.
+ */
+export declare function numberField(body: Record<string, unknown>, name: string): number;
+/**
+ * A required list-of-text field.
+ * @param body The body object.
+ * @param name The field name.
+ * @returns The texts.
+ * @throws AdminRequestError 400 when it is missing or not a list of text.
+ */
+export declare function stringListField(body: Record<string, unknown>, name: string): string[];

package/lib/admin/AdminRequestBodies.js

@@ -0,0 +1,84 @@
+// Reading request bodies of the admin API: each helper returns a typed field or throws a 400 that names the field.
+import { AdminRequestError } from "./AdminApiRouter.js";
+/** HTTP status of a malformed body. */
+const HTTP_BAD_REQUEST = 400;
+/**
+ * The body as an object.
+ * @param body The parsed JSON body.
+ * @returns The object (an empty one for a missing body).
+ * @throws AdminRequestError 400 when the body is not an object.
+ */
+export function bodyObject(body) {
+    if (body == null)
+        return {};
+    if (typeof body !== "object" || Array.isArray(body))
+        throw new AdminRequestError(HTTP_BAD_REQUEST, "the body must be a JSON object");
+    return body;
+}
+/**
+ * A required text field.
+ * @param body The body object.
+ * @param name The field name.
+ * @returns The text.
+ * @throws AdminRequestError 400 when it is missing or not text.
+ */
+export function stringField(body, name) {
+    const value = body[name];
+    if (typeof value !== "string")
+        throw new AdminRequestError(HTTP_BAD_REQUEST, name + " must be text");
+    return value;
+}
+/**
+ * An optional text field.
+ * @param body The body object.
+ * @param name The field name.
+ * @returns The text, or null when absent or null.
+ * @throws AdminRequestError 400 when present but not text.
+ */
+export function optionalStringField(body, name) {
+    const value = body[name];
+    if (value == null)
+        return null;
+    if (typeof value !== "string")
+        throw new AdminRequestError(HTTP_BAD_REQUEST, name + " must be text");
+    return value;
+}
+/**
+ * A required true/false field.
+ * @param body The body object.
+ * @param name The field name.
+ * @returns The value.
+ * @throws AdminRequestError 400 when it is missing or not a boolean.
+ */
+export function booleanField(body, name) {
+    const value = body[name];
+    if (typeof value !== "boolean")
+        throw new AdminRequestError(HTTP_BAD_REQUEST, name + " must be true or false");
+    return value;
+}
+/**
+ * A required number field.
+ * @param body The body object.
+ * @param name The field name.
+ * @returns The number.
+ * @throws AdminRequestError 400 when it is missing or not a finite number.
+ */
+export function numberField(body, name) {
+    const value = body[name];
+    if (typeof value !== "number" || !Number.isFinite(value))
+        throw new AdminRequestError(HTTP_BAD_REQUEST, name + " must be a number");
+    return value;
+}
+/**
+ * A required list-of-text field.
+ * @param body The body object.
+ * @param name The field name.
+ * @returns The texts.
+ * @throws AdminRequestError 400 when it is missing or not a list of text.
+ */
+export function stringListField(body, name) {
+    const value = body[name];
+    if (!Array.isArray(value) || !value.every((item) => typeof item === "string"))
+        throw new AdminRequestError(HTTP_BAD_REQUEST, name + " must be a list of text");
+    return value;
+}

package/lib/admin/AdminRequestGate.d.ts

@@ -0,0 +1,38 @@
+import type { GameServerConfig } from "../GameServerConfig.js";
+/** Network restriction and transport rule of the console (D9). */
+export declare class AdminRequestGate {
+    /** The resolved config. */
+    private readonly config;
+    /** admin.allowedNetworks as a block list, or null when every address may reach the console. */
+    private readonly allowedNetworks;
+    /**
+     * Builds the checks from the config.
+     * @param config The resolved config.
+     */
+    constructor(config: GameServerConfig);
+    /**
+     * The client address of a router request: the same source JoinGate uses (the socket address unless trustProxy).
+     * @param headers The request headers.
+     * @returns The normalized address, or "" when unknown.
+     */
+    static clientAddressOf(headers: Headers): string;
+    /**
+     * Whether an address may reach the console at all (DR §6.3 step 1).
+     * @param clientAddress The client address.
+     * @returns True when admin.allowedNetworks is empty or lists the address.
+     */
+    isNetworkAllowed(clientAddress: string): boolean;
+    /**
+     * Whether a request is secure (R9): TLS on the server, or HTTPS reported by a trusted proxy.
+     * @param headers The request headers.
+     * @returns True for a secure request.
+     */
+    isSecureRequest(headers: Headers): boolean;
+    /**
+     * The D9 transport rule: loopback, TLS, or HTTPS at a trusted proxy.
+     * @param headers The request headers.
+     * @param clientAddress The client address.
+     * @returns True when the console may answer this connection.
+     */
+    isTransportSafe(headers: Headers, clientAddress: string): boolean;
+}

package/lib/admin/AdminRequestGate.js

@@ -0,0 +1,59 @@
+// The connection checks every console page and API call passes first (game-server-admin-console D9, DR §6.3 steps 1
+// and 4, §13 R9): the admin network restriction and the HTTPS rule.
+import { createAuthContext } from "colyseus";
+import { createNetworkList, isAddressInList, isLoopbackAddress, normalizeAddress } from "../NetworkAddresses.js";
+/** The header a trusted proxy names the original scheme in. */
+const FORWARDED_PROTO_HEADER = "x-forwarded-proto";
+/** The scheme a secure request arrived with. */
+const SECURE_SCHEME = "https";
+/** Network restriction and transport rule of the console (D9). */
+export class AdminRequestGate {
+    /** The resolved config. */
+    config;
+    /** admin.allowedNetworks as a block list, or null when every address may reach the console. */
+    allowedNetworks;
+    /**
+     * Builds the checks from the config.
+     * @param config The resolved config.
+     */
+    constructor(config) {
+        this.config = config;
+        this.allowedNetworks = (config.admin.allowedNetworks.length > 0) ? createNetworkList(config.admin.allowedNetworks) : null;
+    }
+    /**
+     * The client address of a router request: the same source JoinGate uses (the socket address unless trustProxy).
+     * @param headers The request headers.
+     * @returns The normalized address, or "" when unknown.
+     */
+    static clientAddressOf(headers) {
+        const address = createAuthContext({ headers: headers }).ip;
+        return (address != null) ? normalizeAddress(address) : "";
+    }
+    /**
+     * Whether an address may reach the console at all (DR §6.3 step 1).
+     * @param clientAddress The client address.
+     * @returns True when admin.allowedNetworks is empty or lists the address.
+     */
+    isNetworkAllowed(clientAddress) {
+        if (this.allowedNetworks == null)
+            return true;
+        return isAddressInList(this.allowedNetworks, clientAddress);
+    }
+    /**
+     * Whether a request is secure (R9): TLS on the server, or HTTPS reported by a trusted proxy.
+     * @param headers The request headers.
+     * @returns True for a secure request.
+     */
+    isSecureRequest(headers) {
+        return this.config.tls.enabled || (this.config.trustProxy && headers.get(FORWARDED_PROTO_HEADER) === SECURE_SCHEME);
+    }
+    /**
+     * The D9 transport rule: loopback, TLS, or HTTPS at a trusted proxy.
+     * @param headers The request headers.
+     * @param clientAddress The client address.
+     * @returns True when the console may answer this connection.
+     */
+    isTransportSafe(headers, clientAddress) {
+        return isLoopbackAddress(clientAddress) || this.isSecureRequest(headers);
+    }
+}

package/lib/admin/AdminResponses.d.ts

@@ -0,0 +1,103 @@
+import type { AdminCallerKind } from "./AdminApiTypes.js";
+/** Session cookie name over TLS (D10): the __Host- prefix pins it to this host, path / and Secure. */
+export declare const SECURE_SESSION_COOKIE_NAME: string;
+/** Session cookie name on loopback HTTP (D10). */
+export declare const SESSION_COOKIE_NAME: string;
+/** Headers on every console response (D9). */
+export declare const SECURITY_HEADERS: Record<string, string>;
+/** What a handler returns; the router turns it into a response (D5). */
+export interface AdminResult {
+    /** HTTP status. */
+    status: number;
+    /** The JSON body (ignored for downloads and redirects). */
+    body: unknown;
+    /** Extra cookies, as full Set-Cookie values. */
+    setCookies?: string[];
+    /** Overrides the JSON body with raw bytes (downloads). */
+    download?: {
+        bytes: Uint8Array<ArrayBuffer>;
+        contentType: string;
+        fileName: string;
+    };
+    /** A redirect target (SSO). */
+    redirectTo?: string;
+    /**
+     * The audit detail of a successful action (target and redacted parameters). A public sign-in route names the
+     * account that signed in as its actor, since the request had no caller yet.
+     */
+    audit?: {
+        target: string;
+        parameters: Record<string, unknown>;
+        actor?: {
+            kind: AdminCallerKind;
+            id: string;
+            name: string;
+        };
+    };
+}
+/**
+ * Builds the single-buffer answer of an API call (DR §7.3): JSON, a download, or a redirect, with the D9 headers, the
+ * console origin as the only CORS origin (credentials off, overriding the router's CORS answer) and each cookie.
+ * @param result The handler's result.
+ * @param request The console origin of the request.
+ * @returns The response.
+ */
+export declare function buildAdminResponse(result: AdminResult, request: {
+    consoleOrigin: string;
+}): Response;
+/**
+ * A JSON answer outside the API pipeline (static-path refusals), with the same single-buffer headers.
+ * @param status HTTP status.
+ * @param body The JSON body.
+ * @param consoleOrigin The console origin of the request.
+ * @returns The response.
+ */
+export declare function adminJsonResponse(status: number, body: unknown, consoleOrigin: string): Response;
+/**
+ * A plain-text console answer (missing asset, console not built).
+ * @param status HTTP status.
+ * @param text The text.
+ * @returns The response.
+ */
+export declare function adminTextResponse(status: number, text: string): Response;
+/**
+ * A static file answer.
+ * @param bytes The file.
+ * @param contentType Its content type.
+ * @param cacheControl Its cache-control value.
+ * @returns The response.
+ */
+export declare function staticFileResponse(bytes: Uint8Array<ArrayBuffer>, contentType: string, cacheControl: string): Response;
+/**
+ * A permanent redirect (GET /game-server/admin → /game-server/admin/).
+ * @param location The target path.
+ * @returns The 308 response.
+ */
+export declare function redirectResponse(location: string): Response;
+/**
+ * The name of the session cookie for a request (R9).
+ * @param secure True for a secure request (TLS, or HTTPS at a trusted proxy).
+ * @returns `__Host-bgs-admin` or `bgs-admin`.
+ */
+export declare function sessionCookieName(secure: boolean): string;
+/**
+ * The Set-Cookie value of a console session (D10).
+ * @param value The cookie value (a random session id).
+ * @param secure True for a secure request: adds Secure and uses the __Host- name.
+ * @param maxAgeSeconds How long the browser keeps it, in seconds.
+ * @returns The Set-Cookie value.
+ */
+export declare function buildSessionCookie(value: string, secure: boolean, maxAgeSeconds: number): string;
+/**
+ * The Set-Cookie value that removes the session cookie (sign-out).
+ * @param secure True for a secure request.
+ * @returns The Set-Cookie value.
+ */
+export declare function buildClearingCookie(secure: boolean): string;
+/**
+ * The console's own origin, from the Host header and the D9 scheme rule.
+ * @param headers The request headers.
+ * @param secure True for a secure request.
+ * @returns scheme://host.
+ */
+export declare function consoleOriginOf(headers: Headers, secure: boolean): string;