@botiverse/porthole 0.1.7 → 0.2.0

package/dist/index.js

@@ -22,6 +22,7 @@ export { CHART_PALETTE, DEFAULT_THEME, DEFAULT_THEME_EVENT, DEFAULT_THEME_VARIAB
 export { COPY_TEXT_METHOD, MCP_APPS_METHODS, MCP_APPS_PROTOCOL_VERSION, MCP_APPS_STYLE_VARIABLES, PORTHOLE_STYLES, } from "./protocol/mcp-apps.js";
 export { createHost } from "./host/create-host.js";
 export { writeClipboard } from "./host/clipboard.js";
+export { httpLocator, LocateError, servedOrOpaque, } from "./host/locator.js";
 // Annotations (P053): anchors, what a frame reports, and the host's checks on both.
 export { ANNOTATE_METHODS, ANNOTATION_LIMITS, } from "./annotate/types.js";
 export { parseAnchor, parseRect, parseReport } from "./annotate/validate.js";

package/dist/node/index.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `@botiverse/porthole/node`: the host kit on Node's own HTTP server (P066). Every request and
+ * WebSocket whose Host is under the content domain is Porthole's; the app's reserved labels
+ * (previews) and its own hosts go to the app's listeners.
+ *
+ *   const content = createContentHost({ …, health: { probe: nodeProbe() } });
+ *   const porthole = nodeHost(content, { request: appListener, upgrade: appUpgrade });
+ *   const server = http.createServer(porthole.request);
+ *   server.on("upgrade", porthole.upgrade);
+ *   server.listen(8080, () => content.start());
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { Duplex } from "node:stream";
+import type { ContentHost, HealthProbe } from "../server/host.ts";
+import type { Access } from "../server/types.ts";
+type RequestListener = (request: IncomingMessage, response: ServerResponse) => void;
+type UpgradeListener = (request: IncomingMessage, socket: Duplex, head: Buffer) => void;
+export interface NodeHostOptions {
+    /** The app's own request listener (Express, Hono's `getRequestListener`, a router). */
+    readonly request: RequestListener;
+    /** The app's own upgrade listener (its WebSockets, and its reserved labels' sockets). */
+    readonly upgrade?: UpgradeListener;
+    /** A url-mode app's WebSocket, once its cookie checks out (`ContentHost.access`). */
+    readonly appSocket?: (access: Access, request: IncomingMessage, socket: Duplex, head: Buffer) => void;
+}
+export interface NodeHost {
+    readonly request: RequestListener;
+    readonly upgrade: UpgradeListener;
+}
+/** The Node request as a fetch `Request`: an absolute-form target kept as it came (P056). */
+export declare function toRequest(request: IncomingMessage, scheme: "https" | "http"): Request;
+/** Writes a fetch `Response` to a Node response, cookies one header each. */
+export declare function sendResponse(response: ServerResponse, answer: Response): Promise<void>;
+export declare function nodeHost<V>(content: ContentHost<V>, app: NodeHostOptions): NodeHost;
+/**
+ * The health gate's probe on Node: a GET over the real network (DNS, the edge, TLS with Node's
+ * own certificate checks), `*.localhost` resolved to loopback, redirects not followed, at most 4 KB
+ * of the answer read.
+ */
+export declare function nodeProbe(): HealthProbe;
+export {};

package/dist/node/index.js

@@ -0,0 +1,160 @@
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { Readable } from "node:stream";
+/** The Node request as a fetch `Request`: an absolute-form target kept as it came (P056). */
+export function toRequest(request, scheme) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(request.headers)) {
+        for (const each of Array.isArray(value) ? value : value === undefined ? [] : [value]) {
+            headers.append(name, each);
+        }
+    }
+    const target = request.url ?? "/";
+    const url = target.startsWith("/")
+        ? `${scheme}://${request.headers.host ?? "localhost"}${target}`
+        : target;
+    const method = request.method ?? "GET";
+    const body = method === "GET" || method === "HEAD" ? null : Readable.toWeb(request);
+    return new Request(url, { method, headers, body, duplex: "half" });
+}
+/** Writes a fetch `Response` to a Node response, cookies one header each. */
+export async function sendResponse(response, answer) {
+    const headers = {};
+    for (const [name, value] of answer.headers) {
+        if (name !== "set-cookie") {
+            headers[name] = value;
+        }
+    }
+    const cookies = answer.headers.getSetCookie();
+    if (cookies.length > 0) {
+        headers["set-cookie"] = cookies;
+    }
+    response.writeHead(answer.status, headers);
+    if (answer.body === null) {
+        response.end();
+        return;
+    }
+    for await (const chunk of answer.body) {
+        response.write(chunk);
+    }
+    response.end();
+}
+/** Whether a Node request's Host (or absolute-form target) is under the content domain. */
+function forContent(content, request) {
+    const domain = content.domain;
+    if (domain === null) {
+        return false;
+    }
+    const host = request.headers.host ?? "";
+    let target = "";
+    try {
+        target = (request.url ?? "/").startsWith("/") ? "" : new URL(request.url ?? "").hostname;
+    }
+    catch {
+        target = "";
+    }
+    return domain.isContentHost(host) || (target !== "" && domain.isContentHost(target));
+}
+/** Refuses a WebSocket on the content domain with a plain 404, and closes it. */
+function refuseSocket(socket) {
+    socket.end("HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
+}
+export function nodeHost(content, app) {
+    const scheme = () => content.domain?.scheme ?? "http";
+    return {
+        request(request, response) {
+            if (!forContent(content, request)) {
+                app.request(request, response);
+                return;
+            }
+            content.fetch(toRequest(request, scheme())).then((answer) => {
+                if (answer === null) {
+                    // A label the app routes itself.
+                    app.request(request, response);
+                    return;
+                }
+                return sendResponse(response, answer);
+            }, () => {
+                if (!response.headersSent) {
+                    response.writeHead(500, { "content-type": "text/plain; charset=utf-8" });
+                }
+                response.end("Content couldn't be served.");
+            });
+        },
+        upgrade(request, socket, head) {
+            if (!forContent(content, request)) {
+                if (app.upgrade === undefined) {
+                    refuseSocket(socket);
+                }
+                else {
+                    app.upgrade(request, socket, head);
+                }
+                return;
+            }
+            const asked = toRequest(request, scheme());
+            // A reserved label's socket is the app's.
+            if (!content.owns(asked)) {
+                if (app.upgrade === undefined) {
+                    refuseSocket(socket);
+                }
+                else {
+                    app.upgrade(request, socket, head);
+                }
+                return;
+            }
+            const appSocket = app.appSocket;
+            if (appSocket === undefined) {
+                refuseSocket(socket);
+                return;
+            }
+            content.access(asked).then((access) => {
+                if (access === null) {
+                    refuseSocket(socket);
+                }
+                else {
+                    appSocket(access, request, socket, head);
+                }
+            }, () => refuseSocket(socket));
+        },
+    };
+}
+/** Resolves every `*.localhost` name to loopback, as browsers do (Node's resolver may not). */
+const loopbackLookup = (hostname, options, callback) => {
+    const all = typeof options === "object" && options !== null && options.all === true;
+    if (all) {
+        callback(null, [{ address: "127.0.0.1", family: 4 }]);
+        return;
+    }
+    callback(null, "127.0.0.1", 4);
+};
+/**
+ * The health gate's probe on Node: a GET over the real network (DNS, the edge, TLS with Node's
+ * own certificate checks), `*.localhost` resolved to loopback, redirects not followed, at most 4 KB
+ * of the answer read.
+ */
+export function nodeProbe() {
+    return (url, timeoutMs) => new Promise((resolve, reject) => {
+        const target = new URL(url);
+        const local = target.hostname === "localhost" || target.hostname.endsWith(".localhost");
+        const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+        const asked = send(target, {
+            method: "GET",
+            headers: { accept: "application/json" },
+            timeout: timeoutMs,
+            ...(local ? { lookup: loopbackLookup } : {}),
+        }, (response) => {
+            let body = "";
+            response.setEncoding("utf8");
+            response.on("data", (chunk) => {
+                if (body.length < 4_096) {
+                    body += chunk;
+                }
+            });
+            response.on("end", () => resolve({ status: response.statusCode ?? 0, body: body.slice(0, 4_096) }));
+            response.on("error", reject);
+        });
+        asked.on("timeout", () => asked.destroy(new Error(`no answer within ${timeoutMs / 1000} s`)));
+        asked.on("error", (error) => reject(new Error(error.code === undefined ? error.message : `${error.code} ${error.message}`)));
+        asked.end();
+    });
+}

package/dist/platform/web.js

@@ -1,4 +1,10 @@
+import { FRAME_STATUS_METHOD } from "../isolation/types.js";
 import { postMessageTransport } from "../transport/post-message.js";
+/** A frame-status message (`porthole/notifications/frame-status`), by its method alone. */
+const isFrameStatus = (data) => data !== null &&
+    typeof data === "object" &&
+    data.jsonrpc === "2.0" &&
+    data.method === FRAME_STATUS_METHOD;
 /**
  * The web platform: an `<iframe>` whose policy attributes are set before its document is given,
  * talking over `postMessage`. Its first load is the document it was given; any later load is the
@@ -50,7 +56,12 @@ export const webPlatform = {
         });
         container.append(frame);
         const view = container.ownerDocument.defaultView ?? window;
-        const transport = postMessageTransport(() => frame.contentWindow, origin, view);
+        // A served frame may pass through the host's own pages (a redirect entry's, P068): what they
+        // say of the frame's status is heard too, and nothing else from there.
+        const own = view.origin;
+        const transport = postMessageTransport(() => frame.contentWindow, origin, view, origin === "null" || own === "null" || own === origin
+            ? undefined
+            : { origin: own, accept: isFrameStatus });
         return {
             transport,
             element: frame,

package/dist/server/domain.d.ts

@@ -0,0 +1,43 @@
+import type { ContentDomain } from "./types.ts";
+/**
+ * A content domain from deployment settings (P066): `content.example.com`, `content.localhost:8790`
+ * or `https://content.example.com`, parsed, and checked against the app's own origins. Porthole
+ * never serves a content domain that holds an app origin or may share its site: the host kit
+ * either throws at startup or (with its opaque fallback) reports it as permanently unhealthy.
+ */
+export interface ContentDomainInfo {
+    /** The registrable domain content is served under (`content.example.com`). */
+    readonly domain: string;
+    /** `http` only on loopback (`localhost`, `*.localhost`). */
+    readonly scheme: "https" | "http";
+    /** A port other than the scheme's default. */
+    readonly port?: number;
+    /** The frame source every content origin matches (`https://*.content.example.com`). */
+    readonly source: string;
+    /** The origin a label is served on. */
+    originOf(label: string): string;
+    /** Whether a host (or hostname) is under the content domain (the apex included). */
+    isContentHost(host: string): boolean;
+    /** The part of a hostname under the content domain (`a-1`, `x.f`), or null. */
+    labelOf(host: string): string | null;
+}
+export type ContentDomainProblem = "invalid" | "clash" | "same-site";
+/** Why a content domain can't be served; `code` says which rule (P066). */
+export declare class ContentDomainError extends Error {
+    readonly code: ContentDomainProblem;
+    constructor(code: ContentDomainProblem, message: string);
+}
+/** A hostname as it compares: lowercase, no port, no trailing dot. */
+export declare function hostnameOf(host: string): string;
+/**
+ * Parses a content domain. `null` for an empty setting (content off). Throws a
+ * `ContentDomainError` for one that isn't a domain, or that holds or may share a site with one of
+ * `appOrigins` (the clash rules, named in the message).
+ */
+export declare function contentDomain(input: string | null | undefined, options: {
+    readonly appOrigins: readonly string[];
+}): ContentDomainInfo | null;
+/** The first clash between a content domain and the app's origins, as an error; null if none. */
+export declare function clashOf(info: ContentDomainInfo, appOrigins: readonly string[]): ContentDomainError | null;
+/** The `ContentDomain` `createServer` takes, from parsed settings. */
+export declare function serverDomain(info: ContentDomainInfo, naming: Pick<ContentDomain, "name" | "reserved">): ContentDomain;

package/dist/server/domain.js

@@ -0,0 +1,100 @@
+import { maybeSameSite, parseOrigin } from "../isolation/served.js";
+/** Why a content domain can't be served; `code` says which rule (P066). */
+export class ContentDomainError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "ContentDomainError";
+        this.code = code;
+    }
+}
+const HOST = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/u;
+const LOOPBACK = (host) => host === "localhost" || host.endsWith(".localhost");
+const IPV4 = /^\d{1,3}(\.\d{1,3}){3}$/u;
+/** A hostname as it compares: lowercase, no port, no trailing dot. */
+export function hostnameOf(host) {
+    const lower = host.trim().toLowerCase();
+    const bare = lower.startsWith("[")
+        ? lower.replace(/(\])(:\d+)?$/u, "$1")
+        : lower.replace(/:\d+$/u, "");
+    return bare.replace(/\.$/u, "");
+}
+/**
+ * Parses a content domain. `null` for an empty setting (content off). Throws a
+ * `ContentDomainError` for one that isn't a domain, or that holds or may share a site with one of
+ * `appOrigins` (the clash rules, named in the message).
+ */
+export function contentDomain(input, options) {
+    const raw = (input ?? "").trim().toLowerCase().replace(/\/+$/u, "");
+    if (raw === "") {
+        return null;
+    }
+    const match = /^(?:(https?):\/\/)?([^/:]+)(?::(\d{1,5}))?$/u.exec(raw);
+    const host = match?.[2]?.replace(/^\.+|\.+$/gu, "") ?? "";
+    if (match === null ||
+        !HOST.test(host) ||
+        IPV4.test(host) ||
+        (!host.includes(".") && host !== "localhost")) {
+        throw new ContentDomainError("invalid", `The content domain ${JSON.stringify(input)} isn't a domain: give host[:port] (content.example.com, content.localhost:8790)`);
+    }
+    const loopback = LOOPBACK(host);
+    const scheme = match[1] === undefined ? (loopback ? "http" : "https") : match[1];
+    if (scheme === "http" && !loopback) {
+        throw new ContentDomainError("invalid", `The content domain ${host} is served over http, which only loopback may use: serve it over https`);
+    }
+    const portNumber = match[3] === undefined ? undefined : Number(match[3]);
+    if (portNumber !== undefined && (portNumber < 1 || portNumber > 65_535)) {
+        throw new ContentDomainError("invalid", `The content domain's port ${match[3]} isn't a port`);
+    }
+    const port = portNumber === (scheme === "https" ? 443 : 80) ? undefined : portNumber;
+    const portPart = port === undefined ? "" : `:${port}`;
+    const info = {
+        domain: host,
+        scheme,
+        ...(port === undefined ? {} : { port }),
+        source: `${scheme}://*.${host}${portPart}`,
+        originOf: (label) => `${scheme}://${label}.${host}${portPart}`,
+        isContentHost: (each) => {
+            const name = hostnameOf(each);
+            return name === host || name.endsWith(`.${host}`);
+        },
+        labelOf: (each) => {
+            const name = hostnameOf(each);
+            return name.endsWith(`.${host}`) ? name.slice(0, -host.length - 1) : null;
+        },
+    };
+    const problem = clashOf(info, options.appOrigins);
+    if (problem !== null) {
+        throw problem;
+    }
+    return info;
+}
+/** The first clash between a content domain and the app's origins, as an error; null if none. */
+export function clashOf(info, appOrigins) {
+    // A label of the content domain, as a scope's would be: what "same site" is judged against.
+    const sample = `a1b2c3d4e5f6g7h8i9j0k1l2.${info.domain}`;
+    for (const origin of appOrigins) {
+        // A desktop app's own scheme (ferry://app) is never the same site as web content.
+        const parsed = parseOrigin(origin);
+        if (parsed === null) {
+            continue;
+        }
+        if (info.isContentHost(parsed.host)) {
+            return new ContentDomainError("clash", `The content domain ${info.domain} holds the app's own origin ${origin}: content there could read the app's cookies and storage. Serve content from a domain the app uses for nothing else`);
+        }
+        if (maybeSameSite(parsed.host, sample)) {
+            return new ContentDomainError("same-site", `The content domain ${info.domain} may be the same site as the app's origin ${origin}: serve content from a registrable domain the app uses for nothing else`);
+        }
+    }
+    return null;
+}
+/** The `ContentDomain` `createServer` takes, from parsed settings. */
+export function serverDomain(info, naming) {
+    return {
+        domain: info.domain,
+        scheme: info.scheme,
+        ...(info.port === undefined ? {} : { port: info.port }),
+        ...(naming.name === undefined ? {} : { name: naming.name }),
+        ...(naming.reserved === undefined ? {} : { reserved: naming.reserved }),
+    };
+}

package/dist/server/host.d.ts

@@ -0,0 +1,158 @@
+import type { PortholeConfig } from "../config/schema.ts";
+import type { InstanceRef } from "../isolation/types.ts";
+import { type ContentDomainInfo } from "./domain.ts";
+import { type Naming } from "./naming.ts";
+import type { Access, ArtifactStore, AuthorizeAnswer, AuthorizeRequest, Grant, PortholeServer, TicketStore, Upstream } from "./types.ts";
+/**
+ * The host kit (P066): everything around `/server` that every host wrote, so an app writes only
+ * its policy (four callbacks) and its settings. Web-standard and runtime-agnostic: Node (through
+ * `@botiverse/porthole/node`), Cloudflare Workers, Deno, Bun.
+ */
+/** Where Porthole answers its health check, on the health label. */
+export declare const HEALTH_PATH = "/__porthole/health";
+/** What the health check's answer is fetched with: Node's needs `*.localhost` on loopback. */
+export type HealthProbe = (url: string, timeoutMs: number) => Promise<{
+    readonly status: number;
+    readonly body: string;
+}>;
+export interface HealthOptions {
+    /** The label Porthole answers its health check on (reserved from naming). */
+    readonly label?: string;
+    /** How the check is fetched (default: `fetch`; on Node, `nodeProbe()`). */
+    readonly probe?: HealthProbe;
+    readonly timeoutMs?: number;
+}
+/** Where content stands, for the app's own meta and logs. */
+export interface ContentHealthView {
+    /** `off`: no content domain. `checking`: the first check hasn't answered yet. */
+    readonly state: "off" | "checking" | "healthy" | "unhealthy";
+    readonly reason?: string;
+    /** Set when the settings can't be served at all: it never changes until they do. */
+    readonly misconfigured?: true;
+    readonly checkedAt?: number;
+}
+/** What the kit tells the app's log, by a stable `evt` name. */
+export type ContentHostEvent = {
+    readonly evt: "porthole.content.misconfigured";
+    readonly code: string;
+    readonly reason: string;
+} | {
+    readonly evt: "porthole.content.healthy";
+} | {
+    readonly evt: "porthole.content.unhealthy";
+    readonly reason: string;
+};
+/** What the app's page needs: whether frames are served, from where, and the gate's state. */
+export interface ContentMeta {
+    readonly served: boolean;
+    readonly contentSource: string | null;
+    readonly health: ContentHealthView | null;
+}
+type Awaitable<T> = T | Promise<T>;
+export interface ContentHostOptions<V> {
+    /** `content.example.com`, `content.localhost:8790`; empty: content off. Or parsed settings. */
+    readonly domain: string | null | undefined | ContentDomainInfo;
+    /** The app's own origins: they frame content (`frame-ancestors`) and are checked for clashes. */
+    readonly appOrigins: readonly string[];
+    /** At least 32 random bytes (or a string of at least 32 bytes). */
+    readonly secret: Uint8Array | string;
+    readonly tickets?: TicketStore;
+    /** The configs content is served under, given the content source (`https://*.<domain>`). */
+    readonly configs: Readonly<Record<string, PortholeConfig>> | ((source: string) => Readonly<Record<string, PortholeConfig>>);
+    /**
+     * How a scope is named (`prefixedName("a-")`); default: keyed labels. Redirect entry needs one
+     * that says which scope a label names (`prefixedName` does).
+     */
+    readonly name?: Naming;
+    /** Labels the app routes itself (`p-*` previews): `fetch` hands them back. */
+    readonly reserved?: readonly string[] | ((label: string) => boolean);
+    /**
+     * Policy 1, mapping: the instance a request proposes (`{ instance }`), as the app means it,
+     * or null (404). A proposal, never trusted: derive the scope from what it names (a session, a
+     * version), check its fields, refuse the rest. The client never chooses an origin.
+     */
+    readonly instance: (proposal: InstanceRef, viewer: V | null, request: Request) => Awaitable<InstanceRef | null>;
+    /** Policy 2, access at issue: may this viewer see it, and with what grant (null: 401/403). */
+    readonly access: (instance: InstanceRef, viewer: V | null, request: Request) => Awaitable<Grant | null>;
+    /** Policy 3, on every request after (P050): may this cookie still see it. */
+    readonly authorize?: (request: AuthorizeRequest) => Awaitable<AuthorizeAnswer>;
+    readonly authorizeTtlSeconds?: number;
+    /** Policy 4, source: a stored page by id and version (artifact documents). */
+    readonly source?: ArtifactStore["get"];
+    readonly upstream?: Upstream;
+    /**
+     * The health gate, and with it the opaque fallback (P066): the kit checks the content domain
+     * over the real network; while it doesn't answer, or can't be served at all (misconfigured),
+     * frames aren't served and the app's displays run opaque. Absent: settings that can't be
+     * served throw at startup.
+     */
+    readonly health?: HealthOptions;
+    /** Issues per viewer (or address) per minute, in this process. */
+    readonly rateLimit?: {
+        readonly perMinute: number;
+        readonly key?: (request: Request, viewer: V | null) => string;
+    };
+    readonly log?: (event: ContentHostEvent) => void;
+    /**
+     * Redirect entry (P068): clean addresses (`urlOf`) that open directly, in a new tab, on a
+     * reload, from a bookmark or a link someone with access was sent. Without a cookie, the content
+     * origin sends the browser to the app's `authorizeUrl` (`ContentHost.authorize`), which asks
+     * `at` and `access` and sends it back with a one-time code.
+     */
+    readonly entry?: EntryOptions<V>;
+}
+export interface EntryOptions<V> {
+    /** The app's authorize route (`ContentHost.authorize`), an absolute URL on an app origin. */
+    readonly authorizeUrl: string;
+    /**
+     * Policy 1 for a clean address: the instance a scope's path means, or null (404). The path is
+     * the address's pathname; its query rides along but never chooses the instance.
+     */
+    readonly at: (scope: string, path: string, viewer: V | null, request: Request) => Awaitable<InstanceRef | null>;
+    /**
+     * The app's own sign-in, which comes back to `returnTo` (the authorize URL) once signed in.
+     * Only ever on a tab: in a frame, the person is asked to open a new tab instead.
+     */
+    readonly signIn: (returnTo: string, request: Request) => Awaitable<Response>;
+    /** The app's refusal page on a tab (a frame gets Porthole's plain one). Default: Porthole's. */
+    readonly refusal?: (status: 403 | 404, request: Request) => Awaitable<Response>;
+}
+export interface ContentHost<V> {
+    /** The parsed content domain, or null (off, or unusable settings under the fallback). */
+    readonly domain: ContentDomainInfo | null;
+    /** The underlying server, or null when nothing is served. */
+    readonly server: PortholeServer | null;
+    /** The frame sources the app's page CSP must allow (`frame-src`). */
+    readonly frameSources: readonly string[];
+    /**
+     * The routing middleware: an answer for every request under the content domain (the app never
+     * answers there); null for the app's own hosts and its reserved labels.
+     */
+    fetch(request: Request): Promise<Response | null>;
+    /**
+     * Whether a request is the content domain's (`fetch` answers it): false for the app's own
+     * hosts and its reserved labels. For a WebSocket upgrade, which `fetch` can't take.
+     */
+    owns(request: Request): boolean;
+    /** The issue endpoint: POST `{ instance }` → 201 `FrameLocation`, as a fetch handler. */
+    issue(viewerOf: (request: Request) => Awaitable<V | null>): (request: Request) => Promise<Response>;
+    /** Whether frames are served now, from where, and the gate's state. */
+    meta(): ContentMeta;
+    /**
+     * A scope's clean address (P068), for "open in a new tab", "copy link" and bookmarks: null while
+     * nothing is served. Opens through redirect entry (`entry`); frames take tickets (`issue`).
+     */
+    urlOf(scope: string, path?: string): string | null;
+    /** The app's authorize route for redirect entry (`entry.authorizeUrl`), as a fetch handler. */
+    authorize(viewerOf: (request: Request) => Awaitable<V | null>): (request: Request) => Promise<Response>;
+    /** A url-mode app's access for a WebSocket upgrade (`server.access`), or null. */
+    access(request: Request): Promise<Access | null>;
+    /** Starts the health gate (after the app listens). */
+    start(): void;
+    /** Runs one health check now. */
+    check(): Promise<ContentHealthView>;
+    /** Stops the health gate. */
+    close(): void;
+}
+export declare function createContentHost<V>(options: ContentHostOptions<V>): ContentHost<V>;
+export {};