@jimhoyd/urlcode 0.3.0 → 0.4.0-alpha.1

package/dist/types/explain-cli.d.ts

@@ -0,0 +1,11 @@
+import type { RuntimeExtension } from './extensions.ts';
+interface Options {
+    project: string;
+    target?: string | undefined;
+    origin?: string | undefined;
+    json?: boolean | undefined;
+    extensions?: RuntimeExtension[] | undefined;
+}
+/** Returns the process exit code: 1 when a requested route does not exist. */
+export declare function runExplainCommand(command: 'explain' | 'manifest', route: string | undefined, options: Options, print: (value: unknown) => unknown): Promise<number>;
+export {};

package/dist/types/explain.d.ts

@@ -0,0 +1,95 @@
+import type { CapabilityName, CapabilityTarget } from './capabilities.ts';
+import type { RuntimeExtension } from './extensions.ts';
+import type { CompiledRoute, LoadedDocument, PolicyChain, PolicyInventory, RouteState } from './types.ts';
+import type { HandlerName } from './readiness.ts';
+import type { ParameterSchema, ParameterLocation } from './match.ts';
+import type { RequestBodyPolicy } from './http-policy.ts';
+export interface ExplainedHandler {
+    kind: HandlerName | 'none';
+    [detail: string]: unknown;
+}
+export interface ExplainedParameter {
+    name: string;
+    in: ParameterLocation;
+    required: boolean;
+    schema: ParameterSchema;
+}
+export interface ExtensionProvider {
+    registered: boolean;
+    version?: string;
+    targets?: string[];
+    revisionMatch?: boolean;
+    requirementValid?: boolean | null;
+}
+export interface ExplainedExtensionRequirement {
+    requirement: Record<string, unknown>;
+    provider?: ExtensionProvider;
+}
+export interface ExplainedCache {
+    /** What a response from this route carries: the policy strategy, the header source or `none`. */
+    outcome: string;
+    cacheControl?: string;
+    forcedNoStore: boolean;
+    reason?: string;
+}
+export interface TargetSupport {
+    compatible: boolean;
+    issues: {
+        capability: CapabilityName;
+        support: string;
+        reason: string;
+    }[];
+}
+export interface RouteExplanation {
+    matched: true;
+    path: string;
+    description?: string;
+    generated?: string;
+    state: RouteState;
+    enabled: boolean;
+    expires?: string;
+    methods: string[];
+    conditional: boolean;
+    handler: ExplainedHandler;
+    middleware: {
+        source: string;
+        export: string;
+    }[];
+    inputs: {
+        parameters: ExplainedParameter[];
+        body?: RequestBodyPolicy;
+    };
+    policies: {
+        names: string[];
+        inventory: PolicyInventory;
+        extensions: Record<string, ExplainedExtensionRequirement>;
+    };
+    cache: ExplainedCache;
+    bindings: {
+        env: Record<string, {
+            env: string;
+        } | {
+            literal: true;
+        }>;
+        secrets: Record<string, {
+            secret: string;
+        }>;
+    };
+    egress: {
+        proxy?: string;
+        signals?: string[];
+    };
+    responseHeaders: [string, string][];
+    capabilities: CapabilityName[];
+    targets: Record<CapabilityTarget, TargetSupport>;
+    note: string;
+}
+export interface ExplainOptions {
+    extensions?: RuntimeExtension[] | undefined;
+    projectSha256?: string | undefined;
+    now?: number | undefined;
+}
+export declare function routeState(route: CompiledRoute, now: number): RouteState;
+/** Describe one compiled route. `chain` is the policy chain compiled for it, when the project declares policies. */
+export declare function explainCompiledRoute(loaded: LoadedDocument, route: CompiledRoute, chain: PolicyChain | undefined, options?: ExplainOptions): RouteExplanation;
+export declare function nearestRoutes(target: string, patterns: Iterable<string>, limit?: number): string[];

package/dist/types/extensions.d.ts

@@ -0,0 +1,122 @@
+import type { HandlerResult } from './http-response.ts';
+import type { ProjectDocument, RouteConfig, TargetName } from './types.ts';
+export type { HandlerResult } from './http-response.ts';
+export interface ExtensionDeclaration {
+    version: '1';
+    config: Record<string, unknown>;
+}
+export type ExtensionPolicies = Record<string, Record<string, unknown> | false>;
+export interface ExtensionActivation {
+    origin: string;
+    target: TargetName;
+    projectSha256: string;
+    mounts: readonly string[];
+}
+export interface ExtensionRequest {
+    method: string;
+    target: string;
+    path: string;
+    query: URLSearchParams;
+    headers: Headers;
+    headerCounts: Record<string, number>;
+    body: Uint8Array;
+    origin: string;
+    route: string;
+    mount: string | null;
+    client: string | null;
+}
+export interface ExtensionInstance {
+    handle(request: ExtensionRequest): HandlerResult | Promise<HandlerResult>;
+    authorize?(requirement: Readonly<Record<string, unknown>>, request: ExtensionRequest): HandlerResult | undefined | Promise<HandlerResult | undefined>;
+    close?(): void | Promise<void>;
+}
+/** Trusted operator code only. YAML declares names/configuration, never modules. */
+/**
+ * Content-hashed assets under `<mount><prefix>/` may be cached publicly. The
+ * extension owns the hashed filename; the runtime only relaxes its no-store floor
+ * for a GET/HEAD 200/304 that carries a strong ETag, sets no cookie and does not
+ * vary on credentials. Everything else under the mount stays no-store.
+ */
+export interface ExtensionImmutableAssets {
+    prefix: string;
+}
+export interface RuntimeExtension {
+    name: string;
+    version: '1';
+    projectSha256: string;
+    targets: TargetName[];
+    schema: object;
+    policySchema?: object;
+    credentialHeaders?: string[];
+    immutableAssets?: ExtensionImmutableAssets;
+    activate(config: Readonly<Record<string, unknown>>, context: ExtensionActivation): ExtensionInstance | Promise<ExtensionInstance>;
+}
+/** `urlcode init --with <name>` contract: what core hands `@jimhoyd/urlcode-<name>`'s `scaffold` export. Nothing is written by `scaffold`. */
+export interface ScaffoldRequest {
+    /** Absolute site directory core creates; `files` paths in the result are relative to it. */
+    directory: string;
+    /** Absolute route project directory (holds urlcode.yaml), `<directory>/app`. */
+    project: string;
+    /** Absolute path of the combined host module core writes, `<directory>/host.mjs`. */
+    hostFile: string;
+    /** Every extension name being scaffolded together, in `--with` order, including this one. */
+    names: readonly string[];
+}
+export interface ScaffoldFile {
+    path: string;
+    content: string | Uint8Array;
+    mode?: number;
+}
+export interface ScaffoldResult {
+    /** Must equal the requested name. */
+    name: string;
+    /** Fragments merged into the project's top-level `extensions` and `routes`; duplicate keys are refused. */
+    extensions: Record<string, unknown>;
+    routes: Record<string, unknown>;
+    /** Host module lines: imports, then setup statements, then entries of the `extensions` array, then `close` statements. */
+    hostImports: string[];
+    hostSetup: string[];
+    hostEntries: string[];
+    hostClose?: string[];
+    /** Files written relative to `directory` with their modes; never inside the project, never overwriting. */
+    files: ScaffoldFile[];
+    /** Markdown appended to README.md under a heading core adds; the numbered steps merged in `--with` order. */
+    readme: string;
+    nextSteps: string[];
+    /** Environment variables the host reads, with one-line descriptions. */
+    env?: Record<string, string>;
+}
+export interface ActiveExtension {
+    instance: ExtensionInstance;
+    policies: Map<string, Readonly<Record<string, unknown>>>;
+    assetPrefixes: readonly string[];
+}
+/** What the runtime knows about the request when it applies the privacy floor. */
+export interface ExtensionAssetContext {
+    method: string;
+    path: string;
+    prefixes: readonly string[];
+}
+export interface ExtensionRegistry {
+    entries: Map<string, ActiveExtension>;
+    credentialHeaders: string[];
+    close(): Promise<void>;
+}
+export declare const immutableCacheControl = "public, max-age=31536000, immutable";
+/** Inspection alone grants nothing; operators must explicitly pin the returned revision. */
+export declare function inspectExtensionRevision(project: string): Promise<string>;
+export declare function effectiveExtensionPolicies(document: ProjectDocument, route: Pick<RouteConfig, 'policies'>): Record<string, Record<string, unknown>>;
+export declare function hasExtensionPolicy(document: ProjectDocument, route: Pick<RouteConfig, 'policies'>): boolean;
+export declare function prepareExtensions(document: ProjectDocument, routes: Record<string, RouteConfig>, registrations: RuntimeExtension[] | undefined, context: Omit<ExtensionActivation, 'mounts'>): {
+    activate(): Promise<ExtensionRegistry>;
+};
+/**
+ * The runtime decides; the extension cannot opt in from a response alone. The
+ * declared prefix, the GET/HEAD method, a 200/304 status, one strong ETag, no
+ * Set-Cookie and no Vary on Cookie/Authorization are all required. A stricter
+ * Cache-Control the extension set (no-store, no-cache, private or a shorter
+ * max-age) is preserved.
+ */
+export declare function immutableAssetResponse(result: HandlerResult, asset: ExtensionAssetContext | undefined): boolean;
+/** Mandatory privacy floor after trusted response hooks, with bounded output. */
+export declare function extensionResponse(result: HandlerResult, asset?: ExtensionAssetContext): HandlerResult;

package/dist/types/function-sources.d.ts

@@ -17,5 +17,10 @@ export interface FunctionSources {
     /** Absolute source path to module name. */
     names: Map<string, string>;
 }
+/** Snapshot budgets: what one set of guest modules may cost. Deliberate bounds
+ * of the sandbox contract (docs/FUNCTION-SECURITY.md), not tuning knobs. */
+export declare const MODULE_LIMIT = 128;
+export declare const MODULE_BYTE_LIMIT = 1048576;
+export declare const TOTAL_BYTE_LIMIT = 4194304;
 export declare function routeFunctions<D>(route: FunctionRoute<D>): D[];
 export declare function collectFunctionSources(routes: FunctionRoute[], root: string): Promise<FunctionSources>;

package/dist/types/index.d.ts

@@ -9,3 +9,36 @@ export { startLinkApi } from './link-api.ts';
 export type { LinkApi, LinkApiOptions } from './link-api.ts';
 export type { LinkEvent, LinkObserverOptions, LinkObserverStats } from './link-events.ts';
 export { events as observabilityEvents, validateObservers, createObserverSink, createMetrics, renderPrometheus } from './observability.ts';
+export { getCapabilities, routeCapabilities, analyzeProjectCapabilities, analyzeCompiledCapabilities, assertTargetCompatibility, normalizeCapabilityTarget } from './capabilities.ts';
+export { capabilityDetails } from './capabilities.ts';
+export type { CapabilityTarget, CapabilityName, CapabilityKind, CapabilityDetail, CapabilitySupport, CapabilityDecision, CapabilityRequirement, CapabilityCatalog, CompatibilityReport } from './capabilities.ts';
+export { importRoutes, exportRoutes } from './interchange.ts';
+export type { InterchangeFormat, ConversionDiagnostic, ConversionCounts, ConversionReport, ImportRoutesOptions, ExportRoutesOptions } from './interchange.ts';
+export { listRecipes, searchRecipes, showRecipe, addRecipe } from './recipes.ts';
+export type { RecipeSummary, Recipe, RecipeAddReport, RecipeSearchResult } from './recipes.ts';
+export { listExamples, searchExamples } from './examples.ts';
+export type { ExampleSummary, ExampleSearchResult, RouteIndex, RouteIndexEntry } from './examples.ts';
+export type { CatalogMetadata, TargetVerdict, Complexity } from './catalog.ts';
+export { buildTypeScriptProject } from './typescript-authoring.ts';
+export type { TypeScriptBuildReport } from './typescript-authoring.ts';
+export { importBulkProject } from './bulk.ts';
+export type { BulkFormat, BulkFilePlan, BulkImportReport } from './bulk.ts';
+export { inspectProject, validateProject, explainRoute, explainProject, previewImport, previewExport, getCapability, getSchemaFragment, schemaPathNames, inspectExtensions, describeExtensions, buildContext, renderContext, estimateTokens, documentationTokens } from './tooling.ts';
+export type { InspectOptions, RouteExplanation, RouteMiss, ExplainedHandler, ExplainedCache, ExplainedExtensionRequirement, ExtensionProvider, TargetSupport, CapabilityEntry, CapabilityUsage, SchemaFragment, ExtensionInspection, ContextOptions, ProjectContext, ContextSection } from './tooling.ts';
+export { buildManifest, renderManifest, MANIFEST_SCHEMA_VERSION } from './manifest.ts';
+export type { Manifest, ManifestRoute, ManifestModule, RecipeProvenance } from './manifest.ts';
+export { serveMcp } from './mcp.ts';
+export type { McpOptions } from './mcp.ts';
+export { providerConformanceCases, runProviderConformance, verifyProviderDeployment } from './provider-verification.ts';
+export type { VerificationTarget, ProviderProbe, ProviderAnswer, ProviderTransport, ProviderVerificationOptions, ProviderFinding, ProviderVerificationReport } from './provider-verification.ts';
+export { normalizeMatch, assertDisjointMatches, matchesRoute } from './conditions.ts';
+export type { RouteMatch, ConditionRequest } from './conditions.ts';
+export { buildCloudflare } from './build-cloudflare.ts';
+export type { BuildOptions as CloudflareBuildOptions, BuildReport as CloudflareBuildReport } from './build-cloudflare.ts';
+export { runProjectTests } from './project-tests.ts';
+export type { ProjectTestOptions, ProjectTestResult } from './project-tests.ts';
+export { scaffoldProject } from './scaffold.ts';
+export type { ScaffoldReport, Unresolved as ScaffoldUnresolved } from './scaffold.ts';
+export { initProject, addRedirect } from './authoring.ts';
+export { initProjectWith } from './init-with.ts';
+export type { ScaffoldRequest, ScaffoldResult, ScaffoldFile } from './extensions.ts';

package/dist/types/init-with.d.ts

@@ -0,0 +1,30 @@
+import type { ScaffoldRequest, ScaffoldResult } from './extensions.ts';
+/** Directory names inside the generated site. The route project lives under `app/`; everything else is operator-owned. */
+export declare const PROJECT_DIRECTORY = "app", HOST_FILE = "host.mjs", ROUTES_FILE = "routes/extensions.yaml";
+export interface InitWithOptions {
+    cwd?: string | undefined;
+}
+export interface InitWithResult {
+    directory: string;
+    project: string;
+    hostFile: string;
+    extensions: string[];
+    projectSha256: string;
+    nextSteps: string[];
+}
+export declare function parseWithNames(value: string): string[];
+export declare const packageName: (name: string) => string;
+/**
+ * Resolves the extension package from the invoking directory (Node's package resolution with the default
+ * conditions), imports it, and calls its `scaffold` export. Nothing is bundled; core never imports these packages
+ * at build time. Refuses a missing package or a package without `scaffold` before anything is written.
+ */
+export declare function loadScaffold(name: string, request: ScaffoldRequest, cwd: string): Promise<ScaffoldResult>;
+export declare function renderHost(names: readonly string[], results: readonly ScaffoldResult[]): string;
+export declare function renderReadme(directory: string, names: readonly string[], results: readonly ScaffoldResult[], starter: string, env: Record<string, string>, projectSha256: string): string;
+/**
+ * `urlcode init <directory> --with a,b`: the starter under `app/`, every extension's fragments merged into one
+ * `urlcode.yaml`, one `host.mjs`, one `README.md` and the extensions' own files. All packages are resolved and
+ * their scaffolds computed before anything is written, so a refusal leaves no directory behind.
+ */
+export declare function initProjectWith(destination: string, names: readonly string[], { cwd }?: InitWithOptions): Promise<InitWithResult>;

package/dist/types/interchange-cli.d.ts

@@ -0,0 +1,16 @@
+import type { ConversionReport } from './interchange.ts';
+interface InterchangeCliOptions {
+    project: string;
+    target?: string | undefined;
+    format?: string | undefined;
+    out?: string | undefined;
+    report?: string | undefined;
+    dryRun?: boolean | undefined;
+    acceptProviderDifferences?: boolean | undefined;
+}
+export declare function readConversionInput(file: string): Promise<string>;
+export declare function runInterchange(command: 'import' | 'export', args: string[], options: InterchangeCliOptions): Promise<{
+    report: ConversionReport;
+    text: string;
+}>;
+export {};

package/dist/types/interchange.d.ts

@@ -0,0 +1,42 @@
+import type { ProjectDocument } from './types.ts';
+export type InterchangeFormat = 'csv' | 'json' | 'yaml' | 'netlify' | 'cloudflare' | 'vercel' | 'netlify-toml';
+export interface ConversionDiagnostic {
+    severity: 'error' | 'warning';
+    code: string;
+    source: string;
+    row?: number;
+    path?: string;
+    message: string;
+}
+export interface ConversionCounts {
+    convertedRoutes: number;
+    nativeEquivalentRoutes: number;
+    runtimeRequiredRoutes: number;
+    unsupportedRows: number;
+    providerDifferenceRoutes: number;
+    fullyScanned: boolean;
+}
+export interface ConversionReport {
+    counts: ConversionCounts;
+    ok: boolean;
+    lossless: boolean;
+    routeCount: number;
+    diagnostics: ConversionDiagnostic[];
+    document?: ProjectDocument;
+    output?: string;
+}
+export interface ImportRoutesOptions {
+    format: InterchangeFormat;
+    text: string;
+    source?: string;
+    acceptProviderDifferences?: boolean;
+}
+export interface ExportRoutesOptions {
+    format: InterchangeFormat;
+    document: ProjectDocument;
+    source?: string;
+    acceptProviderDifferences?: boolean;
+}
+/** Pure conversion: does not read projects, resolve bindings, execute guests or write files. */
+export declare function importRoutes(options: ImportRoutesOptions): Promise<ConversionReport>;
+export declare function exportRoutes(options: ExportRoutesOptions): Promise<ConversionReport>;

package/dist/types/link-cli.d.ts

@@ -1,5 +1,5 @@
 /** The parsed command-line values the links commands read; every flag is a string or absent. */
-export interface LinkCommandValues {
+interface LinkCommandValues {
     project?: string | undefined;
     store?: string | undefined;
     collection?: string | undefined;
@@ -34,3 +34,4 @@ export interface LinkBinding extends LinkPoolOptions {
 export declare function linkPoolOptions(values: LinkCommandValues): LinkPoolOptions;
 export declare function parseLinkBinding(value: string | undefined, options?: LinkPoolOptions): LinkBinding | undefined;
 export declare function runLinkCommand(action: string | undefined, values: LinkCommandValues, print: Print): Promise<void>;
+export {};

package/dist/types/management-policy.d.ts

@@ -1,4 +1,3 @@
-export type ManagementAction = 'get' | 'list' | 'create' | 'update' | 'delete';
 /** A credential from the operator's management policy file, once it authenticated a request. */
 export interface ManagementPrincipal {
     id: string;

package/dist/types/manifest.d.ts

@@ -0,0 +1,81 @@
+import type { CapabilityName, CapabilityTarget } from './capabilities.ts';
+import type { InspectOptions } from './tooling.ts';
+import type { RouteExplanation } from './explain.ts';
+export declare const MANIFEST_SCHEMA_VERSION = 1;
+export interface ManifestRoute {
+    path: string;
+    methods: string[];
+    handler: RouteExplanation['handler'];
+    enabled: boolean;
+    expires?: string;
+    generated?: string;
+    description?: string;
+    middleware: {
+        source: string;
+        export: string;
+    }[];
+    parameters: RouteExplanation['inputs']['parameters'];
+    body?: RouteExplanation['inputs']['body'];
+    policies: string[];
+    extensions: Record<string, Record<string, unknown>>;
+    cache: RouteExplanation['cache'];
+    bindings: {
+        env: string[];
+        secrets: string[];
+    };
+    egress: RouteExplanation['egress'];
+    capabilities: CapabilityName[];
+    targets: Record<CapabilityTarget, boolean>;
+}
+export interface ManifestModule {
+    source: string;
+    export: string;
+    routes: string[];
+}
+export interface RecipeProvenance {
+    id: string;
+    description?: string;
+    version?: string;
+    source?: string;
+}
+export interface Manifest {
+    schemaVersion: typeof MANIFEST_SCHEMA_VERSION;
+    urlcode: string;
+    entry: string;
+    files: string[];
+    revision: string;
+    configVersion: string;
+    routeCount: number;
+    routes: ManifestRoute[];
+    capabilities: CapabilityName[];
+    extensions: Record<string, {
+        version: string;
+        configKeys: string[];
+        mounts: string[];
+        protectedRoutes: string[];
+    }>;
+    recipes: RecipeProvenance[];
+    external: {
+        env: string[];
+        secrets: string[];
+        egress: {
+            proxy: string[];
+            signals: string[];
+        };
+        extensions: string[];
+        linkStores: string[];
+        dynamicLinks: boolean;
+    };
+    functions: ManifestModule[];
+    middleware: ManifestModule[];
+    targets: Record<CapabilityTarget, {
+        compatible: boolean;
+        issues: number;
+    }>;
+}
+/** Build the semantic manifest for a project from its compiled IR. Deterministic for a given project. */
+export declare function buildManifest(project: string, options?: InspectOptions): Promise<Manifest>;
+/** The manifest as `build` writes it: two-space JSON with a trailing newline. */
+export declare function renderManifest(manifest: Manifest): string;
+export declare const manifestFileName = "manifest.json";
+export declare function manifestPath(out: string): string;

package/dist/types/match.d.ts

@@ -37,6 +37,7 @@ export interface MatchableRoute {
     pattern: string;
     parts: string[];
     prefix?: string;
+    extension?: string;
     parameters: CompiledParameter[];
     env: Record<string, string>;
     secrets: Record<string, string>;

package/dist/types/mcp-authoring.d.ts

@@ -0,0 +1,92 @@
+export declare const authoringDefinitions: ({
+    name: string;
+    description: string;
+    properties: {
+        path: {
+            type: string;
+            maxLength: number;
+        };
+        handler: {
+            anyOf: ({
+                type: string;
+                maxLength: number;
+            } | {
+                type: string;
+                maxLength?: never;
+            })[];
+        };
+        middleware: {
+            type: string;
+            maxItems: number;
+            items: {
+                anyOf: ({
+                    type: string;
+                    maxLength: number;
+                } | {
+                    type: string;
+                    maxLength?: never;
+                })[];
+            };
+        };
+        file: {
+            type: string;
+            maxLength: number;
+        };
+        name?: never;
+        destination?: never;
+        dryRun?: never;
+    };
+    required: string[];
+} | {
+    name: string;
+    description: string;
+    properties: {
+        name: {
+            type: string;
+            maxLength: number;
+        };
+        destination: {
+            type: string;
+            maxLength: number;
+        };
+        dryRun: {
+            type: string;
+        };
+        path?: never;
+        handler?: never;
+        middleware?: never;
+        file?: never;
+    };
+    required: string[];
+} | {
+    name: string;
+    description: string;
+    properties: {
+        dryRun: {
+            type: string;
+        };
+        path?: never;
+        handler?: never;
+        middleware?: never;
+        file?: never;
+        name?: never;
+        destination?: never;
+    };
+    required: never[];
+} | {
+    name: string;
+    description: string;
+    properties: {
+        path?: never;
+        handler?: never;
+        middleware?: never;
+        file?: never;
+        name?: never;
+        destination?: never;
+        dryRun?: never;
+    };
+    required: never[];
+})[];
+/** A project-relative path an authoring tool may create or replace: no absolute, `..`, hidden (`.env*`, `.git`), credential or operator names, and no symlink anywhere on the walk. */
+export declare function confinedPath(root: string, path: unknown): Promise<string>;
+export declare function callAuthoringTool(root: string, name: string, args: Record<string, unknown>, origin?: string): Promise<unknown>;

package/dist/types/mcp.d.ts

@@ -0,0 +1,12 @@
+import type { Readable, Writable } from 'node:stream';
+/** `allowAuthoring` and `hostFile` are set only by the `--allow-authoring` and `--host-file` command-line flags; tool arguments and the environment never enable them. */
+export interface McpOptions {
+    project: string;
+    input?: Readable;
+    output?: Writable;
+    origin?: string;
+    allowAuthoring?: boolean;
+    hostFile?: string;
+}
+/** Operator selects the only project root. Read tools have no path, credential, write or execution authority; authoring tools write inside that root only. */
+export declare function serveMcp(options: McpOptions): Promise<void>;

package/dist/types/observability.d.ts

@@ -1,4 +1,5 @@
 export declare const events: Readonly<{
+    signal: readonly string[];
     request: readonly string[];
     reload: readonly string[];
     watch: readonly string[];
@@ -70,6 +71,7 @@ export interface MetricsSnapshot {
         agents: Counters;
         cache: Counters;
     };
+    signals: Counters;
     linkRequests: Counters;
     linkObserver: {
         failed: number;

package/dist/types/operator-host.d.ts

@@ -0,0 +1,8 @@
+import type { RuntimeOptions } from './runtime.ts';
+/** Explicitly loaded operator code. Never discovered in application directories. */
+export interface OperatorHost {
+    extensions?: RuntimeOptions['extensions'];
+    plugins?: RuntimeOptions['plugins'];
+    close?(): void | Promise<void>;
+}
+export declare function loadOperatorHost(file: string | undefined, project: string): Promise<OperatorHost>;

package/dist/types/plugins.d.ts

@@ -13,6 +13,8 @@ export interface Plugin {
     name: string;
     version: string;
     targets: TargetName[];
+    /** Operator-owned header names withheld from every guest Request and input context. */
+    credentialHeaders?: string[];
     onActivate?(runtime: PluginRuntime): void | Promise<void>;
     onRequest?(request: PolicyRequest): HandlerResult | undefined | void | Promise<HandlerResult | undefined | void>;
     onResponse?(request: PolicyRequest, result: HandlerResult): HandlerResult | undefined | void | Promise<HandlerResult | undefined | void>;

package/dist/types/policies/agents.d.ts

@@ -70,8 +70,6 @@ export interface AgentsDescription {
     };
 }
 export declare const bundledLists: readonly string[];
-export declare const MAX_PATTERN_BYTES = 256;
-export declare const MAX_REPEAT = 64;
 export declare function validatePattern(pattern: unknown): string | undefined;
 export declare function isBundled(reference: string): boolean;
 export declare function isListFile(reference: unknown): reference is string;

package/dist/types/policies/compression.d.ts

@@ -31,6 +31,8 @@ export interface CompressionDescription {
     level: number | null;
     precompressed: number;
 }
+/** The media types compressed when `types` is not declared; exported so the deployment verifier reads the same table. */
+export declare const DEFAULT_TYPES: string[];
 export declare const zstdAvailable: boolean;
 export declare function targets(): Record<TargetName, PolicySupport>;
 export declare function compile(config: CompressionConfig, { route, shared }: PolicyContext): Promise<CompressionState>;

package/dist/types/policies/security.d.ts

@@ -21,7 +21,6 @@ export interface SecurityDescription {
 }
 export declare const name = "security";
 export declare const phases: readonly string[];
-export declare const oshpRevision = "OSHP 2024 best practices";
 export declare const profiles: Readonly<Record<string, readonly (readonly [string, string])[]>>;
 export declare const reservedHeaders: Readonly<Set<string>>;
 export declare function targets(): Record<string, 'native' | 'compiled'>;