@jini-ai/core 0.3.1 → 0.4.0

package/dist/gated-mutations/token.d.ts

@@ -0,0 +1,95 @@
+/** Opaque, single-use approval tokens. Clock, generation and TTL are host policy. */
+export interface ConfirmationTokenRecord {
+    confirmationToken: string;
+    planHash: string;
+    scopeId: string;
+    confirmerPrincipalId: string;
+    status: 'minted' | 'redeemed' | 'expired';
+    createdAt: string;
+    expiresAt: string;
+}
+export interface TokenStorePort {
+    /** Insert only: never overwrite a previously issued token, including terminal states. */
+    save(required: {
+        record: ConfirmationTokenRecord;
+    }): Promise<void>;
+    findByToken(required: {
+        token: string;
+    }): Promise<ConfirmationTokenRecord | null>;
+    /** Atomically check TTL/status and transition minted -> redeemed. */
+    tryRedeem(required: {
+        token: string;
+        now: string;
+    }): Promise<{
+        redeemed: boolean;
+        record: ConfirmationTokenRecord | null;
+    }>;
+    /** Atomically transition minted -> expired without overwriting concurrent redemption. */
+    expire(required: {
+        token: string;
+    }): Promise<void>;
+}
+export declare class TokenExpiredError extends Error {
+    constructor(required: {
+        message: string;
+    }, optional?: ErrorOptions);
+}
+export declare class TokenAlreadyRedeemedError extends Error {
+    constructor(required: {
+        message: string;
+    }, optional?: ErrorOptions);
+}
+/** O(1). The complete token string comes from the injected cryptographically secure generator. */
+export declare function mintToken(required: {
+    planId: string;
+    planHash: string;
+    scopeId: string;
+    confirmerPrincipalId: string;
+    now: string;
+    ttlSeconds: number;
+    generateToken: (required: Record<string, never>) => string;
+}): ConfirmationTokenRecord;
+/** O(1). The exact expiry instant is inclusive, preserving the approval lifecycle contract. */
+export declare function isRedeemable(required: {
+    record: ConfirmationTokenRecord;
+    now: string;
+}): boolean;
+/** O(1) local work plus one atomic store operation. */
+export declare function redeemToken(required: {
+    store: TokenStorePort;
+    token: string;
+    now: string;
+}): Promise<ConfirmationTokenRecord>;
+/** Explicit revocation; now is retained for compatibility with lifecycle caller records. */
+export declare function expireToken(required: {
+    store: TokenStorePort;
+    token: string;
+    now: string;
+}): Promise<void>;
+/**
+ * Instance-owned test adapter. Operations are O(1); space O(n) issued tokens.
+ * No await splits conditional transitions. Records are returned as detached values.
+ * Hosts must supply retention/cleanup for a long-lived store.
+ */
+export declare class InMemoryTokenStore implements TokenStorePort {
+    constructor(_required: Record<string, never>);
+    private readonly recordsByToken;
+    save(required: {
+        record: ConfirmationTokenRecord;
+    }): Promise<void>;
+    findByToken(required: {
+        token: string;
+    }): Promise<ConfirmationTokenRecord | null>;
+    tryRedeem(required: {
+        token: string;
+        now: string;
+    }): Promise<{
+        redeemed: boolean;
+        record: ConfirmationTokenRecord | null;
+    }>;
+    expire(required: {
+        token: string;
+    }): Promise<void>;
+    count(_required: Record<string, never>): Promise<number>;
+}
+//# sourceMappingURL=token.d.ts.map

package/dist/gated-mutations/token.js

@@ -0,0 +1,87 @@
+export class TokenExpiredError extends Error {
+    constructor(required, optional = {}) {
+        super(required.message, optional);
+    }
+}
+export class TokenAlreadyRedeemedError extends Error {
+    constructor(required, optional = {}) {
+        super(required.message, optional);
+    }
+}
+/** O(1). The complete token string comes from the injected cryptographically secure generator. */
+export function mintToken(required) {
+    const timestamp = Date.parse(required.now);
+    if (!Number.isFinite(timestamp) || !Number.isFinite(required.ttlSeconds) || required.ttlSeconds <= 0) {
+        throw new RangeError('token timestamp must be valid and TTL must be positive and finite');
+    }
+    const expiresAt = new Date(timestamp + required.ttlSeconds * 1000).toISOString();
+    // Exact host-selected TTL, without jitter: approval expiration is a user-visible boundary.
+    const confirmationToken = required.generateToken({});
+    if (typeof confirmationToken !== 'string' || confirmationToken.length === 0) {
+        throw new Error('token generator must return a non-empty string');
+    }
+    return {
+        confirmationToken, planHash: required.planHash, scopeId: required.scopeId,
+        confirmerPrincipalId: required.confirmerPrincipalId, status: 'minted',
+        createdAt: required.now, expiresAt,
+    };
+}
+/** O(1). The exact expiry instant is inclusive, preserving the approval lifecycle contract. */
+export function isRedeemable(required) {
+    return required.record.status === 'minted' && Date.parse(required.now) <= Date.parse(required.record.expiresAt);
+}
+/** O(1) local work plus one atomic store operation. */
+export async function redeemToken(required) {
+    // Gateways may use the port directly to interleave actor/authorization/hash checks in their own
+    // required order; this wrapper owns the standalone lifecycle error contract. Missing and expired
+    // approvals share an error type, while a spent approval reports its distinct terminal state.
+    const { redeemed, record } = await required.store.tryRedeem({ token: required.token, now: required.now });
+    if (redeemed && record)
+        return record;
+    if (!record)
+        throw new TokenExpiredError({ message: 'confirmation token was not found' });
+    if (record.status === 'redeemed')
+        throw new TokenAlreadyRedeemedError({ message: 'confirmation token has already been redeemed' });
+    throw new TokenExpiredError({ message: 'confirmation token has expired' });
+}
+/** Explicit revocation; now is retained for compatibility with lifecycle caller records. */
+export async function expireToken(required) {
+    // Revocation can only advance minted -> expired; it must never un-redeem a spent approval.
+    await required.store.expire({ token: required.token });
+}
+/**
+ * Instance-owned test adapter. Operations are O(1); space O(n) issued tokens.
+ * No await splits conditional transitions. Records are returned as detached values.
+ * Hosts must supply retention/cleanup for a long-lived store.
+ */
+export class InMemoryTokenStore {
+    constructor(_required) { }
+    recordsByToken = new Map();
+    async save(required) {
+        const record = required.record;
+        if (this.recordsByToken.has(record.confirmationToken))
+            throw new Error('confirmation token already exists');
+        this.recordsByToken.set(record.confirmationToken, { ...record });
+    }
+    async findByToken(required) {
+        const record = this.recordsByToken.get(required.token);
+        return record ? { ...record } : null;
+    }
+    async tryRedeem(required) {
+        const record = this.recordsByToken.get(required.token);
+        if (!record)
+            return { redeemed: false, record: null };
+        if (!isRedeemable({ record, now: required.now }))
+            return { redeemed: false, record: { ...record } };
+        const updated = { ...record, status: 'redeemed' };
+        this.recordsByToken.set(required.token, updated);
+        return { redeemed: true, record: { ...updated } };
+    }
+    async expire(required) {
+        const record = this.recordsByToken.get(required.token);
+        if (record?.status === 'minted')
+            this.recordsByToken.set(required.token, { ...record, status: 'expired' });
+    }
+    async count(_required) { return this.recordsByToken.size; }
+}
+//# sourceMappingURL=token.js.map

package/dist/gated-mutations.d.ts

@@ -0,0 +1,5 @@
+export * from './gated-mutations/gateway.js';
+export * from './gated-mutations/token.js';
+export * from './gated-mutations/ports.js';
+export * from './gated-mutations/actor-identity.js';
+//# sourceMappingURL=gated-mutations.d.ts.map

package/dist/gated-mutations.js

@@ -0,0 +1,5 @@
+export * from './gated-mutations/gateway.js';
+export * from './gated-mutations/token.js';
+export * from './gated-mutations/ports.js';
+export * from './gated-mutations/actor-identity.js';
+//# sourceMappingURL=gated-mutations.js.map

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export * from './token.js';
 export * from './pack.js';
 export * from './bindings.js';
-export type { Daemon, DaemonConfig } from './daemon.js';
+export type { Daemon, DaemonConfig, DaemonOptions } from './daemon.js';
 export { createDaemon } from './daemon.js';
 export type { PackDisposalFailure } from './pack-lifecycle.js';
 export { disposePacks, registerPackTools } from './pack-lifecycle.js';
@@ -9,7 +9,13 @@ export * from './redact.js';
 export * from './api-token-auth.js';
 export * from './origin-validation.js';
 export * from './principal.js';
-export type { AuthorizationDecision, RunRef, SurfaceEmission, SurfaceEmitter, ToolAuthorizationContext, ToolDescriptor, ToolExecutionContext, ToolHandler, ToolPolicy, ToolRegistration, ToolRegistry, } from './tool-registry.js';
+export type { AuthorizationDecision, RunRef, SurfaceEmission, SurfaceEmitter, ToolAuthorizationContext, ToolDescriptor, ToolExecutionContext, ToolExecutionOptions, ToolHandler, ToolPolicy, ToolRegistration, ToolRegistry, } from './tool-registry.js';
 export { createToolRegistry, isReadOnlyTool, ToolInputError } from './tool-registry.js';
 export * from './tool-tokens.js';
+export * from './gated-mutations.js';
+export * from './model-facing-tool-errors.js';
+export * from './contribution-registry.js';
+export * from './naming.js';
+export type { AgentToolSideEffect, AgentToolActorClassRule, AgentToolDefinition } from './agent-tools.js';
+export * from "./registration-kit.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -9,4 +9,9 @@ export * from './origin-validation.js';
 export * from './principal.js';
 export { createToolRegistry, isReadOnlyTool, ToolInputError } from './tool-registry.js';
 export * from './tool-tokens.js';
+export * from './gated-mutations.js';
+export * from './model-facing-tool-errors.js';
+export * from './contribution-registry.js';
+export * from './naming.js';
+export * from "./registration-kit.js";
 //# sourceMappingURL=index.js.map

package/dist/model-facing-tool-errors.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Ordered domain-owned allowlists for safe model-facing failures. Unknown throws are unchanged.
+ * Rule evaluation is O(r); container wrapping O(n), with no I/O or reporting dependencies.
+ */
+import { type ToolHandler, type ToolRegistration } from "./tool-registry.js";
+export interface ModelFacingErrorRule {
+    readonly error: abstract new (...args: never[]) => Error;
+    readonly code: string;
+    readonly message?: string;
+    readonly guidance?: string;
+}
+export declare function forbiddenRule(required: {
+    domainPrefix: string;
+    error: ModelFacingErrorRule["error"];
+}): ModelFacingErrorRule;
+export declare function reclassifyToolError(required: {
+    err: unknown;
+    rules: readonly ModelFacingErrorRule[];
+}): unknown;
+export declare function withModelFacingErrors(required: {
+    handlers: Readonly<Record<string, ToolHandler>>;
+    rules: readonly ModelFacingErrorRule[];
+}): Record<string, ToolHandler>;
+export declare function withModelFacingRegistrationErrors(required: {
+    registrations: readonly ToolRegistration[];
+    rules: readonly ModelFacingErrorRule[];
+}): ToolRegistration[];
+export interface CallerSafeErrorRule {
+    readonly error: abstract new (...args: never[]) => Error;
+    readonly message?: string;
+}
+export declare function callerSafeErrorMessage(required: {
+    err: unknown;
+    rules: readonly CallerSafeErrorRule[];
+    fallback: string;
+}): string;
+//# sourceMappingURL=model-facing-tool-errors.d.ts.map

package/dist/model-facing-tool-errors.js

@@ -0,0 +1,71 @@
+/**
+ * Ordered domain-owned allowlists for safe model-facing failures. Unknown throws are unchanged.
+ * Rule evaluation is O(r); container wrapping O(n), with no I/O or reporting dependencies.
+ */
+// Tool transports redact unknown throws as internal failures. Leaving known domain refusals there
+// made validation/not-found/permission errors look like identical crashes, preventing recovery.
+// Domains explicitly own which classes/messages are safe to expose, including anonymous callers:
+// stacks, internal paths, SQL, credentials, and another tenant's data must remain unlisted/redacted.
+import { ToolInputError } from "./tool-registry.js";
+export function forbiddenRule(required) {
+    return { error: required.error, code: `${required.domainPrefix}_FORBIDDEN` };
+}
+// First match wins: list subclasses before superclasses. Unmatched values must retain identity so
+// the transport's redaction remains the default; already-classified ToolInputError also stays intact
+// to avoid doubling a prefix attached by schema/recovery wrapping.
+export function reclassifyToolError(required) {
+    const { err, rules } = required;
+    if (err instanceof ToolInputError)
+        return err;
+    for (const rule of rules) {
+        if (err instanceof rule.error) {
+            const message = `${rule.code}: ${rule.message ?? err.message}`;
+            return new ToolInputError({ message: rule.guidance ? `${message}. ${rule.guidance}` : message });
+        }
+    }
+    return err;
+}
+// Wrap the whole map once: a correct per-handler converter previously reached only one handler
+// while sibling operations still leaked into the internal-error redactor. Central wrapping has no
+// omitted call-site arm, and successful results pass through untouched.
+export function withModelFacingErrors(required) {
+    const { handlers, rules } = required;
+    return Object.fromEntries(Object.entries(handlers).map(([toolId, handler]) => [
+        toolId,
+        async (ctx, optional = {}) => {
+            try {
+                return await handler(ctx, optional);
+            }
+            catch (err) {
+                throw reclassifyToolError({ err, rules });
+            }
+        },
+    ]));
+}
+// Registration-array builders need the same blanket coverage as handler maps. Preserve descriptor,
+// policy, ordering, and successful results; only the rejection path is reclassified.
+export function withModelFacingRegistrationErrors(required) {
+    const { registrations, rules } = required;
+    return registrations.map((registration) => ({
+        ...registration,
+        handler: (async (ctx, optional = {}) => {
+            try {
+                return await registration.handler(ctx, optional);
+            }
+            catch (err) {
+                throw reclassifyToolError({ err, rules });
+            }
+        }),
+    }));
+}
+// Unknown classes, raw driver errors, and non-Error throws get fixed fallback text, never raw error
+// content. The fallback itself must not be derived from err; first matching rule still wins.
+export function callerSafeErrorMessage(required) {
+    const { err, rules, fallback } = required;
+    for (const rule of rules) {
+        if (err instanceof rule.error)
+            return rule.message ?? err.message;
+    }
+    return fallback;
+}
+//# sourceMappingURL=model-facing-tool-errors.js.map

package/dist/naming.d.ts

@@ -0,0 +1,31 @@
+/** Bounded asynchronous collision search; naming and copy wording are required host policy. */
+export declare const MAX_SUFFIX_ATTEMPTS = 1000;
+export interface NamingPolicy {
+    isTaken: (required: {
+        candidate: string;
+    }) => Promise<boolean>;
+    withSuffix: (required: {
+        base: string;
+        suffix: number;
+    }) => string;
+    exhaustionMessage: (required: {
+        base: string;
+        maxAttempts: number;
+    }) => string;
+}
+export interface AvailableNameOptions {
+    maxAttempts?: number;
+    onExhausted?: (required: {
+        base: string;
+        maxAttempts: number;
+    }) => never;
+}
+/** O(k) sequential predicate calls, O(1) local space, k <= maxAttempts. */
+export declare function deriveAvailableName(required: NamingPolicy & {
+    base: string;
+}, optional?: AvailableNameOptions): Promise<string>;
+/** O(k) plus at most one base lookup. A trailing integer is a counter only if its base exists. */
+export declare function deriveDuplicateName(required: NamingPolicy & {
+    sourceName: string;
+}, optional?: AvailableNameOptions): Promise<string>;
+//# sourceMappingURL=naming.d.ts.map

package/dist/naming.js

@@ -0,0 +1,33 @@
+/** Bounded asynchronous collision search; naming and copy wording are required host policy. */
+export const MAX_SUFFIX_ATTEMPTS = 1000;
+/** O(k) sequential predicate calls, O(1) local space, k <= maxAttempts. */
+export async function deriveAvailableName(required, optional = {}) {
+    // isTaken may also reject reserved/invalid candidates. withSuffix owns formatting and length caps;
+    // shorten the base to make room rather than truncating the counter and repeating a taken candidate.
+    const maxAttempts = optional.maxAttempts ?? MAX_SUFFIX_ATTEMPTS;
+    if (!Number.isSafeInteger(maxAttempts) || maxAttempts < 1)
+        throw new RangeError('maxAttempts must be a positive safe integer');
+    for (let suffix = 1; suffix <= maxAttempts; suffix += 1) {
+        const candidate = suffix === 1 ? required.base : required.withSuffix({ base: required.base, suffix });
+        if (!(await required.isTaken({ candidate })))
+            return candidate;
+    }
+    if (optional.onExhausted)
+        optional.onExhausted({ base: required.base, maxAttempts });
+    throw new Error(required.exhaustionMessage({ base: required.base, maxAttempts }));
+}
+const TRAILING_NUMBER_PATTERN = /^(.*\S) \d+$/;
+// Require a non-space base: a bare number has nothing meaningful to strip. Existing-base evidence
+// distinguishes a copy counter ("Landing 2") from a real title ("Blog 2024" with no "Blog" row).
+/** O(k) plus at most one base lookup. A trailing integer is a counter only if its base exists. */
+export async function deriveDuplicateName(required, optional = {}) {
+    const strippedBase = TRAILING_NUMBER_PATTERN.exec(required.sourceName)?.[1];
+    const base = strippedBase !== undefined && await required.isTaken({ candidate: strippedBase })
+        ? strippedBase : required.sourceName;
+    return deriveAvailableName({
+        // A copy must never reuse the source's name, even if the external predicate overlooks its row.
+        ...required, base,
+        isTaken: ({ candidate }) => candidate === required.sourceName ? Promise.resolve(true) : required.isTaken({ candidate }),
+    }, optional);
+}
+//# sourceMappingURL=naming.js.map

package/dist/origin-validation.d.ts

@@ -9,12 +9,13 @@
  *
  * Generalized from an upstream flat daemon module: the origin hardcoded its
  * host product's env-var names, now fields on
- * {@link OriginValidationEnvConfig} — see `source-map.md` for the exact
+ * {@link OriginValidationEnvConfig} — see `archived provenance ledger` for the exact
  * mapping. One function, a bypass for a specific product's own
  * browser-extension-driven ingest route, was deliberately **not** ported —
  * it names a specific product route and product feature with no generic
- * equivalent; see `source-map.md`.
+ * equivalent; see `archived provenance ledger`.
  */
+import type { Logger } from "./primitives/index.js";
 export interface ParsedHostHeader {
     hostname: string;
     host: string;
@@ -36,44 +37,88 @@ export interface OriginValidationEnvConfig {
     /** Env var carrying the host the daemon itself is bound to (default `'127.0.0.1'`). */
     bindHostEnvVar: string;
 }
+/** Host-supplied environment snapshot, shared by origin validation helpers. */
+export interface OriginValidationArgs {
+    config: OriginValidationEnvConfig;
+    env: Readonly<Record<string, string | undefined>>;
+}
+/** Optional diagnostic sink; validation never reads an ambient logger. */
+export type OriginValidationLoggerPort = Pick<Logger, "warn">;
 /**
  * Parses {@link OriginValidationEnvConfig.allowedOriginsEnvVar} into normalized origins.
  *
  * Deliberately never throws — this is on the hot path of {@link isLocalSameOrigin}, called fresh
  * on every same-origin decision a host makes. A malformed entry is dropped and logged instead of
- * aborting the whole parse (see the twin `@jini-ai/http-kit` copy of this module for the fuller
- * incident history this mirrors: a request-time throw here used to turn one config typo into
+ * aborting the whole parse. A request-time throw used to turn one config typo into
  * either a 500 on every request, or — on a route with no enclosing catch — an unhandled
- * rejection). Call {@link assertValidAllowedOrigins} once at host startup instead, to fail loudly
+ * rejection: hand-mounted attachment routes and provider catch-all routes had no common
+ * enclosing catch. Dropping the malformed entry degrades to one fewer trusted origin,
+ * never every request breaking. Call {@link assertValidAllowedOrigins} once at host startup instead, to fail loudly
  * before any request-serving traffic exists.
  */
-export declare function configuredAllowedOrigins(config: OriginValidationEnvConfig, env?: NodeJS.ProcessEnv): string[];
+export declare function configuredAllowedOrigins({ config, env }: OriginValidationArgs, { logger }?: {
+    logger?: OriginValidationLoggerPort | undefined;
+}): string[];
 /**
  * Boot-time companion to {@link configuredAllowedOrigins}: throws, naming every malformed entry,
  * instead of silently dropping them. Call once, early in host startup, before the HTTP server
- * accepts connections.
+ * accepts connections. A misconfiguration must fail boot loudly rather than quietly serving with
+ * a smaller-than-intended allow-list, or throwing on whichever request first reaches the guard.
  */
-export declare function assertValidAllowedOrigins(config: OriginValidationEnvConfig, env?: NodeJS.ProcessEnv): void;
+export declare function assertValidAllowedOrigins({ config, env }: OriginValidationArgs): void;
 /** The `host` (hostname:port) component of each configured allowed origin. */
-export declare function configuredAllowedHosts(origins: string[]): string[];
+export declare function configuredAllowedHosts({ origins }: {
+    origins: string[];
+}): string[];
 /** The set of browser-facing ports considered "local": the daemon's own port plus an optional configured web port. */
-export declare function allowedBrowserPorts(config: OriginValidationEnvConfig, port: number | string | null | undefined, env?: NodeJS.ProcessEnv): number[];
+export declare function allowedBrowserPorts({ config, port, env }: OriginValidationArgs & {
+    port: number | string | null | undefined;
+}): number[];
 /** Parses a raw `Host` header value into hostname/host/port, or `null` when unparseable. */
-export declare function parseHostHeader(value: unknown): ParsedHostHeader | null;
-/** Whether `hostname` is an RFC 1918 private IPv4 address (10/8, 172.16/12, 192.168/16) or link-local (169.254/16). */
-export declare function isPrivateIpv4(hostname: unknown): boolean;
+export declare function parseHostHeader({ value }: {
+    value: unknown;
+}): ParsedHostHeader | null;
+/** Whether `hostname` is an RFC 1918 private IPv4 address (10/8, 172.16/12, 192.168/16) or link-local (169.254/16).
+ * Implements the dev-browser LAN allow-list, not SSRF blocking. Use @jini-ai/platform/net
+ * for SSRF address classification; private addresses are allowed here for local development. */
+export declare function isPrivateIpv4({ hostname }: {
+    hostname: unknown;
+}): boolean;
 /** Whether `hostname` is a literal IPv4 address or bracketed IPv6 literal (as opposed to a DNS name). */
-export declare function isIpLiteralHostname(hostname: unknown): boolean;
-/** Whether `hostname` is loopback, unspecified, or a private-LAN address. */
-export declare function isLoopbackOrPrivateLanHost(hostname: unknown): boolean;
+export declare function isIpLiteralHostname({ hostname }: {
+    hostname: unknown;
+}): boolean;
+/** Whether `hostname` is loopback, unspecified, or a private-LAN address.
+ * Implements the dev-browser LAN allow-list, not SSRF blocking (@jini-ai/platform/net). */
+export declare function isLoopbackOrPrivateLanHost({ hostname }: {
+    hostname: unknown;
+}): boolean;
 /** Whether a request's `Host` header names a locally-served or explicitly allow-listed host. */
-export declare function isAllowedBrowserHost(config: OriginValidationEnvConfig, hostHeader: unknown, ports: number[], bindHost: string, extraAllowedOrigins: string[]): boolean;
+export declare function isAllowedBrowserHost({ hostHeader, ports, bindHost, extraAllowedOrigins }: {
+    config: OriginValidationEnvConfig;
+    hostHeader: unknown;
+    ports: number[];
+    bindHost: string;
+    extraAllowedOrigins: string[];
+}): boolean;
 /** Whether an `Origin` header value names a locally-served or explicitly allow-listed origin. */
-export declare function isAllowedBrowserOrigin(config: OriginValidationEnvConfig, origin: unknown, hostHeader: unknown, ports: number[], bindHost: string, extraAllowedOrigins: string[]): boolean;
+export declare function isAllowedBrowserOrigin({ origin, hostHeader, ports, bindHost, extraAllowedOrigins }: {
+    config: OriginValidationEnvConfig;
+    origin: unknown;
+    hostHeader: unknown;
+    ports: number[];
+    bindHost: string;
+    extraAllowedOrigins: string[];
+}): boolean;
 /**
  * The top-level same-origin gate: is `req` a request the daemon should treat
  * as coming from one of its own locally-served (or explicitly allow-listed)
  * pages.
  */
-export declare function isLocalSameOrigin(config: OriginValidationEnvConfig, req: RequestWithOriginHeaders, port: number | string | null | undefined, env?: NodeJS.ProcessEnv): boolean;
+export declare function isLocalSameOrigin({ config, req, port, env }: OriginValidationArgs & {
+    req: RequestWithOriginHeaders;
+    port: number | string | null | undefined;
+}, { logger }?: {
+    logger?: OriginValidationLoggerPort | undefined;
+}): boolean;
 //# sourceMappingURL=origin-validation.d.ts.map