@jwilleke/ngdpbase-types 5.20.0 → 5.21.0

package/lib/src/utils/configPaths.js

@@ -0,0 +1,133 @@
+/**
+ * Paths inside a configuration value (#1889).
+ *
+ * A configuration key names a value; when the value is a map or a list, each
+ * thing inside it has a path below the key: its map keys and list indices, in
+ * order. `ngdpbase.addons.accounting.accounts` → `checking` → `account-number`
+ * is written `ngdpbase.addons.accounting.accounts.checking.account-number`.
+ *
+ * Two readers walk these paths, and they walk them here, the same way:
+ *
+ *   - `ConfigurationManager` resolves a bare `$NAME` environment reference
+ *     wherever it sits in a value, naming the full path when the variable is
+ *     unset;
+ *   - `sensitiveValues` hides what `ngdpbase.config.sensitive-values` names by
+ *     a path, where `*` stands for any one map key (or list index).
+ *
+ * @module utils/configPaths
+ */
+/** A bare, whole-string environment reference: `$NAME`, upper case, digits and `_`. */
+export const ENV_REF_PATTERN = /^\$([A-Z_][A-Z0-9_]*)$/;
+/** The variable a bare `$NAME` reference names, or null when the value is not one. */
+export function envRefName(value) {
+    return typeof value === 'string' ? (ENV_REF_PATTERN.exec(value)?.[1] ?? null) : null;
+}
+/** One path segment that stands for any map key or list index. */
+export const WILDCARD = '*';
+/** A key and the path below it, written as configuration keys are: dot-joined. */
+export function pathString(key, below) {
+    return below.length === 0 ? key : `${key}.${below.join('.')}`;
+}
+/**
+ * Visit a value and everything inside it, top first. `visit` returns a
+ * replacement for the node, or `undefined` to keep it and go inside. Copy on
+ * write: a map or list nothing inside changed is returned as itself, so a read
+ * of a value with nothing to replace allocates nothing.
+ */
+export function mapConfigValue(value, visit, below = []) {
+    const replaced = visit(value, below);
+    if (replaced !== undefined)
+        return replaced;
+    if (Array.isArray(value)) {
+        let out = null;
+        for (let i = 0; i < value.length; i++) {
+            below.push(String(i));
+            const next = mapConfigValue(value[i], visit, below);
+            below.pop();
+            if (next !== value[i]) {
+                out ??= value.slice();
+                out[i] = next;
+            }
+        }
+        return out ?? value;
+    }
+    if (value !== null && typeof value === 'object') {
+        let out = null;
+        for (const [k, v] of Object.entries(value)) {
+            below.push(k);
+            const next = mapConfigValue(v, visit, below);
+            below.pop();
+            if (next !== v) {
+                out ??= { ...value };
+                out[k] = next;
+            }
+        }
+        return out ?? value;
+    }
+    return value;
+}
+/**
+ * The segments of a path entry, or null when it is not a well-formed one: no
+ * empty segment, and `*` only as a whole segment with at least two written-out
+ * segments before the first one (`ngdpbase.<category>`), since a key is never
+ * a wildcard.
+ */
+export function parsePathEntry(entry) {
+    if (typeof entry !== 'string' || entry === '')
+        return null;
+    const segments = entry.split('.');
+    if (segments.some((s) => s === '' || (s.includes(WILDCARD) && s !== WILDCARD)))
+        return null;
+    const wild = segments.indexOf(WILDCARD);
+    if (wild !== -1 && wild < 2)
+        return null;
+    return segments;
+}
+/**
+ * Whether `entry` names something inside `key`'s value, and the path pattern
+ * below the key if so. The key is matched literally: a `*` stands only for a
+ * segment below it.
+ */
+export function patternBelow(entry, key) {
+    if (!entry.startsWith(`${key}.`))
+        return null;
+    const segments = parsePathEntry(entry);
+    return segments ? segments.slice(key.split('.').length) : null;
+}
+/** Whether a path below a key matches a pattern below it: same length, `*` any one segment. */
+export function pathMatches(pattern, below) {
+    if (pattern.length !== below.length)
+        return false;
+    for (let i = 0; i < pattern.length; i++) {
+        if (pattern[i] !== WILDCARD && pattern[i] !== below[i])
+            return false;
+    }
+    return true;
+}
+/** What sits at a path below a value, or undefined. */
+export function valueAt(value, below) {
+    let node = value;
+    for (const segment of below) {
+        if (node === null || typeof node !== 'object')
+            return undefined;
+        node = node[segment];
+    }
+    return node;
+}
+/**
+ * The configuration key a path entry lies inside: the longest prefix, ending
+ * before the first `*`, for which `has` is true. Null when none is set.
+ */
+export function keyOfEntry(entry, has) {
+    const segments = parsePathEntry(entry);
+    if (!segments)
+        return null;
+    const wild = segments.indexOf(WILDCARD);
+    const longest = wild === -1 ? segments.length - 1 : wild;
+    for (let n = longest; n >= 2; n--) {
+        const key = segments.slice(0, n).join('.');
+        if (has(key))
+            return key;
+    }
+    return null;
+}

package/lib/src/utils/pluginFormatters.d.ts

@@ -416,10 +416,15 @@ export declare function resolveManagerFetch(spec: string | undefined, context: {
     };
     userContext?: unknown;
 }): Promise<ManagerFetchResult>;
-/** One choice in a form's dropdown: the value submitted, and the text shown. */
+/**
+ * One choice in a form's dropdown or checklist: the value submitted, the text
+ * shown, and optionally what it is worth in whole minor units (cents), which a
+ * checklist adds up as boxes are ticked (#1904).
+ */
 export interface FormOption {
     value: string;
     label: string;
+    amount?: number;
 }
 /** Outcome of resolveManagerOptions; the statuses mean what they mean for resolveManagerFetch. */
 export type ManagerOptionsResult = {

package/lib/src/utils/pluginFormatters.js

@@ -676,9 +676,12 @@ function toFormOptionList(value) {
             options.push({ value: item, label: item });
         }
         else if (item && typeof item === 'object') {
-            const { value: v, label } = item;
+            const { value: v, label, amount } = item;
             if ((typeof v === 'string' || typeof v === 'number') && String(v) !== '') {
-                options.push({ value: String(v), label: typeof label === 'string' && label !== '' ? label : String(v) });
+                const option = { value: String(v), label: typeof label === 'string' && label !== '' ? label : String(v) };
+                if (typeof amount === 'number' && Number.isSafeInteger(amount))
+                    option.amount = amount;
+                options.push(option);
             }
         }
     }

package/lib/src/utils/redactSecrets.js

@@ -37,7 +37,8 @@
  * {@link refreshRedactedSecrets} and log them themselves.
  */
 import { format } from 'winston';
-import { secretKeys } from './sensitiveValues.js';
+import { secretKeys, secretValuesBelow, valueLevels } from './sensitiveValues.js';
+import { keyOfEntry } from './configPaths.js';
 /**
  * Values shorter than this are never redacted.
  *
@@ -88,27 +89,46 @@ export function refreshRedactedSecrets(configManager) {
         redactions = [];
         return { active: 0, skipped };
     }
-    const keys = secretKeys((k, d) => configManager.getProperty(k, d));
+    const read = (k, d) => configManager.getProperty(k, d);
+    const keys = secretKeys(read);
     const seen = new Set();
     const next = [];
-    for (const rawKey of keys) {
-        if (typeof rawKey !== 'string')
-            continue;
-        const key = rawKey.trim();
-        if (key === '')
-            continue;
-        const value = configManager.getProperty(key, undefined);
+    const take = (key, value) => {
         const reason = rejectionReason(value);
         if (reason) {
             skipped.push({ key, reason });
-            continue;
+            return;
         }
         const literal = value.trim();
         // Two keys holding the same value redact once; the first key names it.
         if (seen.has(literal))
-            continue;
+            return;
         seen.add(literal);
         next.push({ key, value: literal });
+    };
+    // #1889: an entry that names a path inside a key's value (with or without
+    // a `*`) is redacted by each value it finds there, named by its full path.
+    const inside = new Set();
+    for (const rawKey of keys) {
+        if (typeof rawKey !== 'string')
+            continue;
+        const key = rawKey.trim();
+        if (key === '')
+            continue;
+        const value = configManager.getProperty(key, undefined);
+        if (value === undefined) {
+            const parent = keyOfEntry(key, (k) => configManager.getProperty(k, undefined) !== undefined);
+            if (parent) {
+                inside.add(parent);
+                continue;
+            }
+        }
+        take(key, value);
+    }
+    const levels = valueLevels(read);
+    for (const parent of inside) {
+        for (const { path, value } of secretValuesBelow(parent, configManager.getProperty(parent, undefined), levels))
+            take(path, value);
     }
     // Longest first: where one secret contains another, the longer must be
     // struck first or the shorter leaves a mangled remainder of the longer.

package/lib/src/utils/sensitiveValues.d.ts

@@ -15,6 +15,13 @@
  * hides secret-looking fields nested inside an object value (an OIDC client's
  * `client_secret` inside `oidc-auth-server.clients`).
  *
+ * An entry may also name something inside a key's value by its path (#1889):
+ * `ngdpbase.addons.accounting.accounts.*.account-number`, where `*` stands for
+ * any one map key (or list index). It hides what sits there, at the entry's
+ * level, wherever a value is shown, except a bare `$NAME` reference, which is
+ * a pointer to the environment, not the secret. The paths are walked by
+ * `utils/configPaths.ts`, the same walk that resolves `$NAME` inside a value.
+ *
  * Hidden values are replaced on the server, before any HTML is built: they
  * never reach a page, its source or the parse cache.
  *
@@ -31,15 +38,31 @@ export interface ValueViewer {
 }
 /** Whether a key or field name looks like a secret (the backstop's test; also `npm run lint:sensitive`). */
 export declare function looksSecret(name: string): boolean;
+/**
+ * What an administrator's screen, a log line and an audit record may hold:
+ * sensitive values, never secrets. Secrets there are revealed one key at a
+ * time, on demand (`secret-reveal`).
+ */
+export declare const NO_SECRETS: ValueViewer;
 /** What a hidden value is shown as. */
 export declare const HIDDEN = "(hidden)";
 type Read = (key: string, fallback: unknown) => unknown;
 /**
  * The declared levels: the legacy list's keys as `secret`, then the new map
  * (`"secret"`, `"sensitive"`, `true` = secret; `false` / `null` removes an
- * entry, so an instance can override a shipped one).
+ * entry, so an instance can override a shipped one). An entry that is not a
+ * well-formed key or path (#1889: an empty segment, a `*` inside a segment, or
+ * a `*` before `ngdpbase.<category>`) is no entry, as a level that is none of
+ * these is no entry; {@link sensitiveValueProblems} names both.
  */
 export declare function valueLevels(read: Read): Map<string, ValueLevel>;
+/**
+ * What is wrong with the declared entries, one line each (#1889): an entry
+ * that is not a well-formed key or path, or a level that is none of
+ * `"secret"`, `"sensitive"`, `true`, `false`, `null`. {@link valueLevels}
+ * drops each such entry; the engine warns at boot.
+ */
+export declare function sensitiveValueProblems(read: Read): string[];
 /** The keys declared `secret`: what logs, the audit log and the admin screen never print. */
 export declare function secretKeys(read: Read): string[];
 /**
@@ -52,8 +75,31 @@ export declare function levelOf(key: string, levels: Map<string, ValueLevel>, va
 /** Whether the legacy list is still set (to warn at boot). */
 export declare function usesLegacyName(read: Read): boolean;
 /**
- * The value a viewer may see for a key: itself, or `HIDDEN`. An empty value
- * is shown as it is — "not set" reveals nothing.
+ * A key's value with what its path entries name hidden from this viewer
+ * (#1889). An empty value, and a bare `$NAME` reference, are kept: neither is
+ * the secret. The key's own level is {@link shownValue}'s business.
+ */
+export declare function hideDeclaredPaths(key: string, value: unknown, levels: Map<string, ValueLevel>, viewer: ValueViewer): unknown;
+/**
+ * The strings (and numbers, as text) a key's secret path entries name inside
+ * its value, each with its full path (#1889): what log redaction strikes.
+ * Everything under a named map or list counts.
+ */
+export declare function secretValuesBelow(key: string, value: unknown, levels: Map<string, ValueLevel>): Array<{
+    path: string;
+    value: string;
+}>;
+/**
+ * A value submitted from a screen that showed it with paths hidden, with each
+ * `HIDDEN` placeholder at a declared path put back to the stored value there
+ * (#1889). Without this, saving an edit to an accounts map would write the
+ * placeholder over every account number.
+ */
+export declare function keepHiddenValues(key: string, submitted: unknown, stored: unknown, levels: Map<string, ValueLevel>): unknown;
+/**
+ * The value a viewer may see for a key: itself, or `HIDDEN`; inside it, what
+ * its path entries name is hidden as well (#1889). An empty value is shown as
+ * it is: "not set" reveals nothing.
  */
 export declare function shownValue(key: string, value: unknown, levels: Map<string, ValueLevel>, viewer: ValueViewer): unknown;
 export {};

package/lib/src/utils/sensitiveValues.js

@@ -15,12 +15,20 @@
  * hides secret-looking fields nested inside an object value (an OIDC client's
  * `client_secret` inside `oidc-auth-server.clients`).
  *
+ * An entry may also name something inside a key's value by its path (#1889):
+ * `ngdpbase.addons.accounting.accounts.*.account-number`, where `*` stands for
+ * any one map key (or list index). It hides what sits there, at the entry's
+ * level, wherever a value is shown, except a bare `$NAME` reference, which is
+ * a pointer to the environment, not the secret. The paths are walked by
+ * `utils/configPaths.ts`, the same walk that resolves `$NAME` inside a value.
+ *
  * Hidden values are replaced on the server, before any HTML is built: they
  * never reach a page, its source or the parse cache.
  *
  * @module utils/sensitiveValues
  */
 import { enabledEntries } from './configFiles.js';
+import { envRefName, mapConfigValue, parsePathEntry, pathMatches, pathString, patternBelow, valueAt } from './configPaths.js';
 export const SENSITIVE_VALUES_KEY = 'ngdpbase.config.sensitive-values';
 /** The list's name before #1750; still read, with a boot warning to rename it. */
 export const LEGACY_SECRET_KEYS_KEY = 'ngdpbase.config.secret-keys';
@@ -30,34 +38,83 @@ const SECRET_NAME_PATTERN = /secret|passw(or)?d|token|credential|api[-_]?key|pri
 export function looksSecret(name) {
     return SECRET_NAME_PATTERN.test(name);
 }
+/**
+ * What an administrator's screen, a log line and an audit record may hold:
+ * sensitive values, never secrets. Secrets there are revealed one key at a
+ * time, on demand (`secret-reveal`).
+ */
+export const NO_SECRETS = Object.freeze({ sensitive: true, secret: false });
 /** What a hidden value is shown as. */
 export const HIDDEN = '(hidden)';
 /**
  * The declared levels: the legacy list's keys as `secret`, then the new map
  * (`"secret"`, `"sensitive"`, `true` = secret; `false` / `null` removes an
- * entry, so an instance can override a shipped one).
+ * entry, so an instance can override a shipped one). An entry that is not a
+ * well-formed key or path (#1889: an empty segment, a `*` inside a segment, or
+ * a `*` before `ngdpbase.<category>`) is no entry, as a level that is none of
+ * these is no entry; {@link sensitiveValueProblems} names both.
  */
 export function valueLevels(read) {
     const levels = new Map();
-    for (const key of enabledEntries(read(LEGACY_SECRET_KEYS_KEY, {})))
-        levels.set(key, 'secret');
+    const entry = (key) => (parsePathEntry(key.trim()) ? key.trim() : null);
+    for (const key of enabledEntries(read(LEGACY_SECRET_KEYS_KEY, {}))) {
+        const k = entry(key);
+        if (k)
+            levels.set(k, 'secret');
+    }
     const declared = read(SENSITIVE_VALUES_KEY, {});
     if (declared && typeof declared === 'object' && !Array.isArray(declared)) {
         for (const [key, level] of Object.entries(declared)) {
+            const k = entry(key);
+            if (!k)
+                continue;
             if (level === 'secret' || level === true)
-                levels.set(key, 'secret');
+                levels.set(k, 'secret');
             else if (level === 'sensitive')
-                levels.set(key, 'sensitive');
+                levels.set(k, 'sensitive');
             else
-                levels.delete(key);
+                levels.delete(k);
         }
     }
     else {
-        for (const key of enabledEntries(declared))
-            levels.set(key, 'secret');
+        for (const key of enabledEntries(declared)) {
+            const k = entry(key);
+            if (k)
+                levels.set(k, 'secret');
+        }
     }
     return levels;
 }
+/**
+ * What is wrong with the declared entries, one line each (#1889): an entry
+ * that is not a well-formed key or path, or a level that is none of
+ * `"secret"`, `"sensitive"`, `true`, `false`, `null`. {@link valueLevels}
+ * drops each such entry; the engine warns at boot.
+ */
+export function sensitiveValueProblems(read) {
+    const problems = [];
+    const named = (list, key) => {
+        if (!parsePathEntry(key.trim())) {
+            problems.push(`${list}: '${key}' is not a configuration key or path (an empty segment, or a * that is not a whole segment after ngdpbase.<category>); it is ignored`);
+        }
+    };
+    for (const key of enabledEntries(read(LEGACY_SECRET_KEYS_KEY, {})))
+        named(LEGACY_SECRET_KEYS_KEY, key);
+    const declared = read(SENSITIVE_VALUES_KEY, {});
+    if (declared && typeof declared === 'object' && !Array.isArray(declared)) {
+        for (const [key, level] of Object.entries(declared)) {
+            named(SENSITIVE_VALUES_KEY, key);
+            if (!(level === 'secret' || level === 'sensitive' || level === true || level === false || level === null)) {
+                problems.push(`${SENSITIVE_VALUES_KEY}: '${key}' has level ${JSON.stringify(level)}, which is not "secret" or "sensitive"; the entry is ignored`);
+            }
+        }
+    }
+    else {
+        for (const key of enabledEntries(declared))
+            named(SENSITIVE_VALUES_KEY, key);
+    }
+    return problems;
+}
 /** The keys declared `secret`: what logs, the audit log and the admin screen never print. */
 export function secretKeys(read) {
     return [...valueLevels(read)].filter(([, level]) => level === 'secret').map(([key]) => key);
@@ -91,9 +148,79 @@ function hideNestedSecrets(value) {
     }
     return value;
 }
+/** The path entries inside a key's value, as patterns below the key, with their levels. */
+function entriesBelow(key, levels) {
+    const out = [];
+    for (const [entry, level] of levels) {
+        const pattern = patternBelow(entry, key);
+        if (pattern && pattern.length > 0)
+            out.push([pattern, level]);
+    }
+    return out;
+}
+/** Whether a viewer may see a value at this level. */
+function maySee(level, viewer) {
+    return level === 'secret' ? viewer.secret : viewer.sensitive;
+}
+/**
+ * A key's value with what its path entries name hidden from this viewer
+ * (#1889). An empty value, and a bare `$NAME` reference, are kept: neither is
+ * the secret. The key's own level is {@link shownValue}'s business.
+ */
+export function hideDeclaredPaths(key, value, levels, viewer) {
+    const hidden = entriesBelow(key, levels).filter(([, level]) => !maySee(level, viewer)).map(([pattern]) => pattern);
+    if (hidden.length === 0)
+        return value;
+    return mapConfigValue(value, (node, below) => {
+        if (below.length === 0 || !hidden.some((pattern) => pathMatches(pattern, below)))
+            return undefined;
+        return node === undefined || node === null || node === '' || envRefName(node) ? node : HIDDEN;
+    });
+}
+/**
+ * The strings (and numbers, as text) a key's secret path entries name inside
+ * its value, each with its full path (#1889): what log redaction strikes.
+ * Everything under a named map or list counts.
+ */
+export function secretValuesBelow(key, value, levels) {
+    const secret = entriesBelow(key, levels).filter(([, level]) => level === 'secret').map(([pattern]) => pattern);
+    const found = [];
+    if (secret.length === 0)
+        return found;
+    mapConfigValue(value, (node, below) => {
+        if (below.length === 0 || !secret.some((pattern) => pathMatches(pattern, below)))
+            return undefined;
+        const at = [...below];
+        mapConfigValue(node, (leaf, under) => {
+            if (typeof leaf === 'string' || typeof leaf === 'number')
+                found.push({ path: pathString(key, [...at, ...under]), value: String(leaf) });
+            return undefined;
+        });
+        return node;
+    });
+    return found;
+}
+/**
+ * A value submitted from a screen that showed it with paths hidden, with each
+ * `HIDDEN` placeholder at a declared path put back to the stored value there
+ * (#1889). Without this, saving an edit to an accounts map would write the
+ * placeholder over every account number.
+ */
+export function keepHiddenValues(key, submitted, stored, levels) {
+    const patterns = entriesBelow(key, levels).map(([pattern]) => pattern);
+    if (patterns.length === 0)
+        return submitted;
+    return mapConfigValue(submitted, (node, below) => {
+        if (node !== HIDDEN || !patterns.some((pattern) => pathMatches(pattern, below)))
+            return undefined;
+        const kept = valueAt(stored, below);
+        return kept === undefined ? node : kept;
+    });
+}
 /**
- * The value a viewer may see for a key: itself, or `HIDDEN`. An empty value
- * is shown as it is — "not set" reveals nothing.
+ * The value a viewer may see for a key: itself, or `HIDDEN`; inside it, what
+ * its path entries name is hidden as well (#1889). An empty value is shown as
+ * it is: "not set" reveals nothing.
  */
 export function shownValue(key, value, levels, viewer) {
     const empty = value === undefined || value === null || value === '';
@@ -102,5 +229,6 @@ export function shownValue(key, value, levels, viewer) {
         return empty ? value : HIDDEN;
     if (level === 'sensitive' && !viewer.sensitive)
         return empty ? value : HIDDEN;
-    return viewer.secret ? value : hideNestedSecrets(value);
+    const shown = hideDeclaredPaths(key, value, levels, viewer);
+    return viewer.secret ? shown : hideNestedSecrets(shown);
 }

package/lib/src/utils/startupState.d.ts

@@ -0,0 +1,65 @@
+/**
+ * What the initialisation gate serves, and when (#1152).
+ *
+ * `app.ts` used to treat every initialisation failure the same way:
+ * `process.exit(1)`. A mistyped CIDR and an unreadable data directory produced
+ * the identical outcome — a process that is gone, and an operator whose only
+ * route back is the filesystem. Under a supervisor it is worse than useless: a
+ * process that exits on a bad config value restarts, fails identically, and
+ * restarts again, and nothing in that loop ever reaches the admin UI.
+ *
+ * __The test is not severity.__ A malformed deny rule is serious, and the
+ * instance should stop serving because of it. The question is whether stopping
+ * the *process* helps, and it only helps when the process cannot offer a way
+ * out.
+ *
+ * See D9 to D13 of docs/security-posture.md.
+ */
+/**
+ * Paths served in every state, so the maintenance page can render itself.
+ *
+ * Assets only. Adding a route here would open it during `starting` too, when
+ * the managers behind it are not up.
+ */
+export declare const STARTUP_BYPASS_PATHS: readonly ["/css", "/js", "/images", "/themes", "/addons"];
+export type GateDecision = 'serve' | 'block';
+/**
+ * What the initialisation gate should do with a request.
+ *
+ * The server either is `engineReady` or it is not. What decides the third
+ * behaviour is not a third readiness value but a second, independent fact:
+ * whether the engine finished and a configuration value is unusable. Both are
+ * passed in, so the impossible combination — ready AND blocked — simply never
+ * arises at the call site rather than being modelled away.
+ */
+export declare function gateDecision(engineReady: boolean, blocked: boolean, path: string): GateDecision;
+/**
+ * The message shown on the maintenance page and logged at boot.
+ *
+ * Every reason at once, rather than the first: an operator who fixes one and
+ * restarts into the next has been made to do the work twice.
+ */
+export declare function describeBlocked(reasons: readonly string[]): string;
+/**
+ * What a visitor is told about a blocked instance: on the maintenance page and
+ * in `/health/readiness`, both served without sign-in (#1883).
+ *
+ * Every reason, as {@link describeBlocked} words them, unless one was recorded
+ * for administrators only (a site-critical add-on that did not load): then
+ * only `publicMessage`, and no reason at all — not even the ones that could be
+ * shown, since one detail beside a vague notice still says what failed.
+ * Administrators get the reasons in the log and the admin notification.
+ */
+export declare function blockedForVisitors(reasons: readonly string[], publicMessage: string | null): {
+    message: string;
+    detail: readonly string[];
+};
+/**
+ * #1883: what visitors see while a failure for administrators only holds the
+ * site in maintenance mode — a site-critical add-on that did not load, or an
+ * application database that cannot be opened safely (#1892). Empty leaves
+ * only the page's heading.
+ */
+export declare const SITE_CRITICAL_PUBLIC_MESSAGE_KEY = "ngdpbase.managers.addons-manager.site-critical.public-message";
+/** The configured public message ({@link SITE_CRITICAL_PUBLIC_MESSAGE_KEY}); '' when unset or not a string. */
+export declare function sitePublicMessage(getProperty: ((key: string, fallback: unknown) => unknown) | undefined): string;