@mistriwork/engine 0.0.0-stage → 1.0.0-rc.10

package/dist/server/cli/args.js

@@ -0,0 +1,342 @@
+/**
+ * The command line, read: every flag `tablewalk` takes, into one Options
+ * value, with the environment variables that stand in for flags in a
+ * container. `USAGE` in cli/usage.ts says the same list in words, and
+ * test/prose.test.ts holds the two and the README to each other.
+ */
+import { parseHostList } from '../http/trust.js';
+import { isReaderCount, MAX_READERS } from '../../adapters/postgresPool.js';
+import { isLockTimeout, isWriterCount, MAX_LOCK_TIMEOUT_MS, MAX_WRITERS, MIN_LOCK_TIMEOUT_MS } from '../../adapters/writeLanes.js';
+import { envName, productEnv } from '../product.js';
+/**
+ * The variable `mistri check` and a build set on the child that validates (build.ts `checkApp`): the real
+ * validation, run as CI runs it, and not a spelling of the command line.
+ */
+export const CHECK_VALIDATION = 'MISTRI_CHECK_VALIDATION';
+export function parseArgs(argv) {
+    /* Loopback by default. A database browser listening on every interface is
+       one shared wifi away from being someone else's database browser, and the
+       old `listen(port)` did exactly that. Binding elsewhere is possible but
+       has to be asked for. */
+    const opts = {
+        target: '',
+        port: 4111,
+        host: '127.0.0.1',
+        schemas: [],
+        open: false,
+        noConfig: false,
+        allowedHosts: [],
+        trustProxy: [],
+        authProxyFrom: [],
+        trustProxyCloudflare: false,
+        mcp: false,
+        outputSchema: false,
+        tools: '',
+        help: false,
+        version: false,
+        demo: false,
+        portGiven: false,
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--db' || arg === '-d')
+            opts.target = argv[++i] ?? '';
+        else if (arg === '--port' || arg === '-p') {
+            opts.port = Number(argv[++i] ?? 4111);
+            opts.portGiven = true;
+        }
+        else if (arg === '--demo')
+            opts.demo = true;
+        else if (arg === '--host')
+            opts.host = argv[++i] ?? '127.0.0.1';
+        else if (arg === '--allowed-host')
+            opts.allowedHosts.push(argv[++i] ?? '');
+        else if (arg === '--trust-proxy')
+            opts.trustProxy.push(argv[++i] ?? '');
+        else if (arg === '--auth-proxy-from')
+            opts.authProxyFrom.push(argv[++i] ?? '');
+        else if (arg === '--trust-proxy-hops')
+            opts.trustProxyHops = argv[++i] ?? '';
+        else if (arg === '--trust-proxy-cloudflare')
+            opts.trustProxyCloudflare = true;
+        else if (arg === '--insecure-http-sign-in')
+            opts.insecureHttpSignIn = true;
+        else if (arg === '--auth-proxy-header')
+            opts.authProxyHeader = (argv[++i] ?? '').trim() || undefined;
+        /* Renamed before 1.0, and refused rather than ignored: beside three flags
+           that name the visitor's address it read as one of them, and a server
+           that silently dropped it would stop requiring the identity header. */
+        else if (arg === '--trust-proxy-header') {
+            i++;
+            opts.retired ??= '--trust-proxy-header is now --auth-proxy-header (the header a signing-in proxy sets with the user).';
+        }
+        else if (arg === '--schema')
+            opts.schemas.push(argv[++i] ?? '');
+        else if (arg === '--read-pool')
+            opts.readPool = argv[++i] ?? '';
+        else if (arg === '--write-pool')
+            opts.writePool = argv[++i] ?? '';
+        else if (arg === '--lock-timeout')
+            opts.lockTimeout = argv[++i] ?? '';
+        else if (arg === '--pooler')
+            opts.pooler = argv[++i] ?? '';
+        else if (arg === '--drain-delay')
+            opts.drainDelay = argv[++i] ?? '';
+        else if (arg === '--shutdown-grace')
+            opts.shutdownGrace = argv[++i] ?? '';
+        else if (arg === '--api-integers') {
+            if (opts.apiIntegers !== undefined)
+                opts.unknown = '--api-integers (may be supplied only once)';
+            else
+                opts.apiIntegers = argv[++i] ?? '';
+        }
+        else if (arg === '--api-reads') {
+            if (opts.apiReads !== undefined)
+                opts.unknown = '--api-reads (may be supplied only once)';
+            else
+                opts.apiReads = true;
+        }
+        else if (arg === '--app-mcp') {
+            if (opts.appMcp !== undefined)
+                opts.unknown = '--app-mcp (may be supplied only once)';
+            else
+                opts.appMcp = true;
+        }
+        else if (arg === '--api-requests-per-minute') {
+            if (opts.apiRequestsPerMinute !== undefined)
+                opts.unknown = '--api-requests-per-minute (may be supplied only once)';
+            else
+                opts.apiRequestsPerMinute = argv[++i] ?? '';
+        }
+        else if (arg === '--config')
+            opts.config = argv[++i] ?? '';
+        else if (arg === '--no-config')
+            opts.noConfig = true;
+        else if (arg === '--no-live')
+            opts.noLive = true;
+        else if (arg === '--db-latency')
+            opts.dbLatency = argv[++i] ?? '';
+        else if (arg === '--app')
+            (opts.apps ??= []).push(argv[++i] ?? '');
+        else if (arg === '--mount') {
+            const said = argv[++i] ?? '';
+            const eq = said.indexOf('=');
+            if (eq <= 0)
+                opts.unknown = `--mount ${said} (write it <app>=<path>, like main=/ or billing=/billing)`;
+            else if (Object.hasOwn((opts.mounts ??= {}), said.slice(0, eq)))
+                opts.unknown = `--mount ${said} (each App is mounted once)`;
+            else
+                opts.mounts[said.slice(0, eq)] = said.slice(eq + 1);
+        }
+        else if (arg === '--base-path') {
+            if (opts.basePath !== undefined)
+                opts.unknown = '--base-path (may be supplied only once)';
+            else
+                opts.basePath = argv[++i] ?? '';
+        }
+        else if (arg === '--app-entry') {
+            if (opts.appEntry !== undefined)
+                opts.unknown = '--app-entry (may be supplied only once)';
+            else
+                opts.appEntry = argv[++i] ?? '';
+        }
+        else if (arg === '--commands') {
+            if (opts.commands !== undefined)
+                opts.unknown = '--commands (may be supplied only once)';
+            else
+                opts.commands = argv[++i] ?? '';
+        }
+        else if (arg === '--jobs') {
+            if (opts.jobs !== undefined)
+                opts.unknown = '--jobs (may be supplied only once)';
+            else
+                opts.jobs = argv[++i] ?? '';
+        }
+        else if (arg === '--policy') {
+            if (opts.policy !== undefined)
+                opts.unknown = '--policy (may be supplied only once)';
+            else
+                opts.policy = argv[++i] ?? '';
+        }
+        else if (arg === '--scaffold-app')
+            opts.scaffoldApp = argv[++i] ?? '';
+        else if (arg === '--name')
+            opts.name = argv[++i] ?? '';
+        else if (arg === '--from-openapi')
+            opts.fromOpenapi = argv[++i] ?? '';
+        else if (arg === '--openapi')
+            opts.openapi = argv[++i] ?? '';
+        else if (arg === '--api-url')
+            opts.apiUrl = argv[++i] ?? '';
+        else if (arg === '--api-token-env')
+            opts.apiTokenEnv = argv[++i] ?? '';
+        else if (arg === '--write-authority')
+            opts.writeAuthority = true;
+        else if (arg === '--bump')
+            (opts.bump ??= []).push(argv[++i] ?? '');
+        else if (arg === '--reindex') {
+            // The resource is optional: `--reindex` alone indexes every searched resource.
+            const next = argv[i + 1];
+            opts.reindex = next !== undefined && !next.startsWith('-') ? argv[++i] : '';
+        }
+        else if (arg === '--open')
+            opts.open = true;
+        else if (arg === '--dev')
+            opts.dev = true;
+        else if (arg === '--mcp')
+            opts.mcp = true;
+        else if (arg === '--output-schema')
+            opts.outputSchema = true;
+        else if (arg === '--tools')
+            opts.tools = argv[++i] ?? '';
+        else if (arg === '--export')
+            opts.export = argv[++i] ?? '';
+        /* `--lint` takes no argument by default, so `tablewalk --lint --db x`
+           must not eat the next flag as a format. */
+        else if (arg === '--lint') {
+            opts.lint = argv[i + 1] && !argv[i + 1].startsWith('-') ? argv[++i] : 'text';
+        }
+        else if (arg === '--fail-on')
+            opts.failOn = argv[++i] ?? '';
+        else if (arg === '--diff')
+            opts.diff = argv[++i] ?? '';
+        else if (arg === '--help' || arg === '-h')
+            opts.help = true;
+        else if (arg === '--version' || arg === '-v' || arg === '-V')
+            opts.version = true;
+        else if (!arg.startsWith('-') && !opts.target)
+            opts.target = arg;
+        /* An unknown flag is a mistake, and saying so is cheap.
+    
+           It used to be ignored. That was survivable only by accident: with no
+           target, the "nothing to open" gate printed the usage and exited, so
+           `tablewalk --prot 4111` looked like it had told you something. Now that
+           a server starts with nothing, the same typo silently starts one on the
+           default port and waits — the least useful thing it could do with a
+           command it did not understand. */
+        else if (arg.startsWith('-') && !opts.unknown)
+            opts.unknown = arg;
+    }
+    if (!opts.target && process.env.DATABASE_URL) {
+        opts.target = process.env.DATABASE_URL;
+        opts.targetFromEnvironment = true;
+    }
+    /* The env var exists for containers, where the name someone reaches tablewalk
+       by is a property of the deployment rather than of the command line — a
+       compose file sets it once, and the image's own CMD stays untouched. */
+    opts.allowedHosts.push(...parseHostList(productEnv('ALLOWED_HOSTS')));
+    if (!opts.authProxyHeader && productEnv('AUTH_PROXY_HEADER')?.trim()) {
+        opts.authProxyHeader = productEnv('AUTH_PROXY_HEADER').trim();
+    }
+    if (productEnv('TRUST_PROXY_HEADER')?.trim())
+        opts.retired ??= `${envName('TRUST_PROXY_HEADER')} is now ${envName('AUTH_PROXY_HEADER')} (the header a signing-in proxy sets with the user).`;
+    opts.allowedHosts = opts.allowedHosts.filter(Boolean);
+    // Added to the flags, like MISTRI_ALLOWED_HOSTS: a compose file names
+    // its network's proxy once and the image's CMD stays untouched.
+    opts.trustProxy.push(...parseHostList(productEnv('TRUST_PROXY')));
+    opts.authProxyFrom.push(...parseHostList(productEnv('AUTH_PROXY_FROM')));
+    if (opts.trustProxyHops === undefined && productEnv('TRUST_PROXY_HOPS')?.trim()) {
+        opts.trustProxyHops = productEnv('TRUST_PROXY_HOPS').trim();
+    }
+    if (/^(1|true)$/i.test(productEnv('TRUST_PROXY_CLOUDFLARE')?.trim() ?? ''))
+        opts.trustProxyCloudflare = true;
+    if (/^(1|true)$/i.test(productEnv('INSECURE_HTTP_SIGN_IN')?.trim() ?? ''))
+        opts.insecureHttpSignIn = true;
+    /* Cloud Run, Heroku and most platforms hand the port in as PORT. A flag
+       wins; it is the platform's word, so a busy port is not rolled past. */
+    if (!opts.portGiven &&
+        /^\d{1,5}$/.test(process.env.PORT?.trim() ?? '') &&
+        Number(process.env.PORT) >= 1 &&
+        Number(process.env.PORT) <= 65535) {
+        opts.port = Number(process.env.PORT);
+        opts.portGiven = true;
+    }
+    /* The pool's shape is a fact about the deployment — the pod's share of the
+       database's connections, the pooler in its path — so a container sets it
+       once, as with the variables above. A flag says it for one run and wins. */
+    if (opts.readPool === undefined && productEnv('READ_POOL')?.trim())
+        opts.readPool = productEnv('READ_POOL').trim();
+    if (opts.writePool === undefined && productEnv('WRITE_POOL')?.trim())
+        opts.writePool = productEnv('WRITE_POOL').trim();
+    if (opts.lockTimeout === undefined && productEnv('LOCK_TIMEOUT')?.trim())
+        opts.lockTimeout = productEnv('LOCK_TIMEOUT').trim();
+    if (opts.pooler === undefined && productEnv('POOLER')?.trim())
+        opts.pooler = productEnv('POOLER').trim();
+    // How long a platform lets a stopping container drain is the deployment's too.
+    if (opts.drainDelay === undefined && productEnv('DRAIN_DELAY')?.trim())
+        opts.drainDelay = productEnv('DRAIN_DELAY').trim();
+    if (opts.shutdownGrace === undefined && productEnv('SHUTDOWN_GRACE')?.trim())
+        opts.shutdownGrace = productEnv('SHUTDOWN_GRACE').trim();
+    // Where the proxy serves it is the deployment's, as the host names are.
+    if (opts.basePath === undefined && productEnv('BASE_PATH')?.trim())
+        opts.basePath = productEnv('BASE_PATH').trim();
+    return opts;
+}
+/** Cloud Run gives a stopping instance 10 seconds in all, so the default drains nothing and cuts a stuck response at 10. */
+export const DEFAULT_SHUTDOWN_TIMINGS = { drainMs: 0, graceMs: 10_000 };
+const MAX_DRAIN_DELAY_S = 120;
+const MAX_SHUTDOWN_GRACE_S = 300;
+/**
+ * What `--drain-delay` and `--shutdown-grace` (or MISTRI_DRAIN_DELAY and
+ * MISTRI_SHUTDOWN_GRACE) name, in milliseconds, or the sentence saying why
+ * they cannot be used. The delay is the beat a balancer that probes /readyz
+ * needs between the first 503 and the listener closing; the grace bounds a
+ * response that never finishes once the rest has drained. They come one after
+ * the other, so a platform's stop timeout must hold both plus the drain.
+ */
+export function shutdownTimings(opts) {
+    const seconds = (value, flag, variable, low, high) => {
+        if (value === undefined)
+            return undefined;
+        const given = /^\d+(\.\d+)?$/.test(value) ? Number(value) : Number.NaN;
+        if (!(given >= low && given <= high))
+            return `${flag} takes seconds from ${low} to ${high}; "${value}" is not one. It comes from the flag or ${variable}.`;
+        return Math.round(given * 1000);
+    };
+    const drainMs = seconds(opts.drainDelay, '--drain-delay', envName('DRAIN_DELAY'), 0, MAX_DRAIN_DELAY_S);
+    if (typeof drainMs === 'string')
+        return drainMs;
+    const graceMs = seconds(opts.shutdownGrace, '--shutdown-grace', envName('SHUTDOWN_GRACE'), 1, MAX_SHUTDOWN_GRACE_S);
+    if (typeof graceMs === 'string')
+        return graceMs;
+    return { drainMs: drainMs ?? DEFAULT_SHUTDOWN_TIMINGS.drainMs, graceMs: graceMs ?? DEFAULT_SHUTDOWN_TIMINGS.graceMs };
+}
+/**
+ * The process-wide pool defaults `--read-pool`, `--write-pool`, `--pooler`
+ * and `--lock-timeout` (or their variables) name, or the sentence saying why
+ * they cannot be used. Refused rather than clamped: a pod sized for 16
+ * readers that quietly got 4 is a capacity plan nobody can see failing.
+ */
+export function postgresPoolFlags(opts) {
+    let readers;
+    if (opts.readPool !== undefined) {
+        readers = /^\d+$/.test(opts.readPool) ? Number(opts.readPool) : Number.NaN;
+        if (!isReaderCount(readers)) {
+            return `--read-pool takes a whole number from 1 to ${MAX_READERS}; "${opts.readPool}" is not one. It comes from the flag or ${envName('READ_POOL')}.`;
+        }
+    }
+    let writers;
+    if (opts.writePool !== undefined) {
+        writers = /^\d+$/.test(opts.writePool) ? Number(opts.writePool) : Number.NaN;
+        if (!isWriterCount(writers)) {
+            return `--write-pool takes a whole number from 1 to ${MAX_WRITERS}; "${opts.writePool}" is not one. It comes from the flag or ${envName('WRITE_POOL')}.`;
+        }
+    }
+    let lockTimeoutMs;
+    if (opts.lockTimeout !== undefined) {
+        lockTimeoutMs = /^\d+(\.\d+)?$/.test(opts.lockTimeout) ? Math.round(Number(opts.lockTimeout) * 1000) : Number.NaN;
+        if (!isLockTimeout(lockTimeoutMs)) {
+            return `--lock-timeout takes seconds from ${MIN_LOCK_TIMEOUT_MS / 1000} to ${MAX_LOCK_TIMEOUT_MS / 1000}; "${opts.lockTimeout}" is not one. It comes from the flag or ${envName('LOCK_TIMEOUT')}.`;
+        }
+    }
+    const pooler = opts.pooler;
+    if (pooler !== undefined && pooler !== 'session' && pooler !== 'transaction') {
+        return `--pooler takes "session" or "transaction"; "${pooler}" is neither. It comes from the flag or ${envName('POOLER')}.`;
+    }
+    return {
+        ...(readers !== undefined ? { readers } : {}),
+        ...(writers !== undefined ? { writers } : {}),
+        ...(pooler !== undefined ? { pooler } : {}),
+        ...(lockTimeoutMs !== undefined ? { lockTimeoutMs } : {}),
+    };
+}

package/dist/server/cli/bin.d.ts

@@ -0,0 +1,5 @@
+import type { Main } from './startup.js';
+/** Runs the binary whose entry is `entry`: its main, loaded on demand, when the process was started with it. */
+export declare function runBin(entry: string, load: () => Promise<{
+    main: Main;
+}>): void;

package/dist/server/cli/bin.js

@@ -0,0 +1,66 @@
+/**
+ * What each binary's entry does before its main, the one way: `tablewalk` (packages/tablewalk/src/server/index.ts)
+ * and `mistri` (packages/mistri/src/server/index.ts) each call `runBin` with their own main, and nothing else.
+ *
+ * Two binaries, not one bin that hands a start across: a person types `npx tablewalk <db>` for the database browser
+ * and `npx @mistriwork/mistri dev` for an App, and each refuses the other's start by the other's name. Neither entry imports the
+ * other product, so installing one never loads, or installs, the other.
+ *
+ * An entry re-exports nothing. One used to re-export `createApp` and the trust checks for the tests, and an ES
+ * module's re-exports are loaded whether or not anyone reads them: every start — `--help`, `--mcp` — paid for the whole
+ * HTTP server before `main` could look at a flag. The tests import those from where they live.
+ */
+/* A namespace, not a named import: on a Node without enableCompileCache a named import fails as the module links,
+   before the version check below could say why. */
+import * as nodeModule from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { realpathSync } from 'node:fs';
+import { compileCacheDirectory } from '../compileCache.js';
+import { oldNodeRefusal, quietSqliteExperimentalWarning } from '../startupWarnings.js';
+/**
+ * Whether `entry` (the entry's `import.meta.url`) is the script this process was started with.
+ *
+ * Matched by identity, not by name. The old test — does argv[1] *look like* server/index — held until npm ran it
+ * through a bin shim, which is a symlink called `tablewalk`: the module loaded, matched nothing, and `npx tablewalk`
+ * exited 0 having done exactly that. Resolving the symlink and comparing against the entry's own URL is the question
+ * actually being asked, and it keeps the property the guard exists for: a test that imports an entry boots nothing.
+ * The tests once imported one, and a module that starts a server as a side effect of being read cannot be tested —
+ * it printed its usage and listened on 4111 in the middle of the suite.
+ */
+function invokedAs(entry) {
+    const arg = process.argv[1];
+    if (!arg)
+        return false;
+    try {
+        return pathToFileURL(realpathSync(arg)).href === entry;
+    }
+    catch {
+        return false;
+    }
+}
+/** Runs the binary whose entry is `entry`: its main, loaded on demand, when the process was started with it. */
+export function runBin(entry, load) {
+    if (!invokedAs(entry))
+        return;
+    const refusal = oldNodeRefusal();
+    if (refusal) {
+        process.stderr.write(`${refusal}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    /* Before the first import of the server, which is what the cache is for: V8's compiled code for every module
+       `main` loads is kept on disk, so the second start of the same version skips compiling them. An agent's client
+       spawns `--mcp` every session, and that start is mostly compiling. From source (tsx) the cache would hold tsx's
+       transforms, which are keyed by content anyway, so it is only enabled for the built package. */
+    const directory = entry.endsWith('.js') ? compileCacheDirectory(process.env) : undefined;
+    if (directory) {
+        try {
+            nodeModule.enableCompileCache(directory);
+        }
+        catch {
+            /* a cache is an optimisation, never a reason not to start */
+        }
+    }
+    quietSqliteExperimentalWarning();
+    void load().then(({ main }) => main());
+}

package/dist/server/cli/browser.d.ts

@@ -0,0 +1,15 @@
+/**
+ * The command that opens `url` on `platform`. Windows has no `start` executable — it is a `cmd.exe` builtin, so
+ * spawning it by name fails with ENOENT, which the caller swallows: `--open` and `--demo` did nothing there. The
+ * URL handler `start` itself ends in is a real program, and with no shell between, an `&` in a URL is not a command
+ * separator.
+ */
+export declare function openerFor(platform: NodeJS.Platform, url: string): {
+    cmd: string;
+    args: string[];
+};
+/**
+ * Opening the served page in the reader's browser, best effort: a machine
+ * with no opener keeps serving, and the URL is already on screen.
+ */
+export declare function openBrowser(url: string): Promise<void>;

package/dist/server/cli/browser.js

@@ -0,0 +1,37 @@
+/**
+ * The command that opens `url` on `platform`. Windows has no `start` executable — it is a `cmd.exe` builtin, so
+ * spawning it by name fails with ENOENT, which the caller swallows: `--open` and `--demo` did nothing there. The
+ * URL handler `start` itself ends in is a real program, and with no shell between, an `&` in a URL is not a command
+ * separator.
+ */
+export function openerFor(platform, url) {
+    if (platform === 'darwin')
+        return { cmd: 'open', args: [url] };
+    if (platform === 'win32')
+        return { cmd: 'rundll32', args: ['url.dll,FileProtocolHandler', url] };
+    return { cmd: 'xdg-open', args: [url] };
+}
+/**
+ * Opening the served page in the reader's browser, best effort: a machine
+ * with no opener keeps serving, and the URL is already on screen.
+ */
+export async function openBrowser(url) {
+    const { spawn } = await import('node:child_process');
+    const { cmd, args } = openerFor(process.platform, url);
+    try {
+        const child = spawn(cmd, args, { detached: true, stdio: 'ignore', windowsHide: true });
+        /* A headless box — a container, a server, an SSH session — has no
+           `xdg-open`, and `spawn` reports that as an `error` event, not a throw.
+           With no handler Node re-raises it as an uncaught exception and takes the
+           whole process down — so `--open`, and `--demo` which implies it, crashed
+           exactly where it was most useful: the container serving the demo. A
+           missing opener is not fatal. The server is already listening and the URL
+           is already printed; opening it is a convenience, not a requirement. */
+        child.once('error', () => { });
+        child.unref();
+    }
+    catch {
+        /* Some platforms throw synchronously instead. Same non-answer: the server
+           stays up, the URL is on screen, the reader opens it themselves. */
+    }
+}

package/dist/server/cli/config.d.ts

@@ -0,0 +1,50 @@
+import { type Registry } from '../connections.js';
+import type { ConfigSections } from '../configSections.js';
+import { type PageDef } from '../../shared/page.js';
+import { type ConfigLayout } from '../../shared/recordview.js';
+import { type ViewDef } from '../../shared/view.js';
+import { type SavedQuery } from '../../shared/sqlsaved.js';
+import type { Options } from './args.js';
+/**
+ * A variable an App's definition may read, as an "apps" entry's `env` names it. The file is read here, for every
+ * product; the App framework's own word for it (shared/appAuthority.ts `AppEnvName`) is this shape, read from here.
+ */
+interface ConfigEnvName {
+    name: string;
+    secret?: true;
+}
+/** One "apps" entry's `env`: names, or `{ "name": …, "secret": true }` for one that reads like a credential. */
+export declare function parseAppEnv(raw: unknown, where: string): ConfigEnvName[];
+/** What a session keeps from its config file. */
+export interface StartupConfig {
+    /** The file this session's connections were read from, and written back to. */
+    configPath?: string;
+    /** The file as parsed and as text, so a tenant start can see it change under it. */
+    loadedConfigSignature?: string;
+    loadedConfigText?: string;
+    /** Views predefined in the config file. Read once, at startup, like connections. */
+    views: ViewDef[];
+    /** SQL statements predefined in the config file, read from the same place. */
+    queries: SavedQuery[];
+    pages: PageDef[];
+    layouts: ConfigLayout[];
+    /** The "apps" directories, resolved against the config file's own location. */
+    apps: string[];
+    /** Said when DATABASE_URL was set and the config's own connections were used instead of it. */
+    environmentTargetNote?: string;
+    /** What each of those directories' definitions may read of the environment, by resolved directory. */
+    appEnv: Record<string, ConfigEnvName[]>;
+    /** `"mount": { "<app>": "/" | "/<segment>" }`, as written: where each App is served (shared/mount.ts). A `--mount` for the same App wins. */
+    mount?: Record<string, string>;
+    /** `"basePath": "/tools"`, as written; `--base-path` wins. */
+    basePath?: string;
+}
+/**
+ * Whether the config file a start would read names Apps: read raw, before anything is said of it, so the database
+ * browser's main can hand a start that serves Apps to the App framework's without both reading the file aloud. The
+ * file is the one `loadConfig` would read; one it cannot parse is left for that to refuse.
+ */
+export declare function configNamesApps(opts: Pick<Options, 'config' | 'noConfig'>): Promise<boolean>;
+/** `sections` may be a promise's maker, so a start that reads no config file (`--no-config`) never loads them. */
+export declare function readStartupConfig(opts: Options, registry: Registry, given: ConfigSections | (() => Promise<ConfigSections>)): Promise<StartupConfig>;
+export {};