@robodev-ai/tenant-host 0.0.0-stage → 0.1.0

package/package.json

@@ -1,6 +1,37 @@
 {
   "name": "@robodev-ai/tenant-host",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Robodev tenant host — the framework-free request core (Fetch Request/Response) that serves a project's routes, Auth, storage, MCP, docs and web files, shared by hosted Starbase and `robodev dev`.",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/robodev-com/robodev-starbase.git",
+    "directory": "packages/tenant-host"
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "import": "./src/index.ts",
+      "default": "./src/index.ts"
+    }
+  },
+  "files": [
+    "src"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "test": "bun test --timeout=60000",
+    "typecheck": "bun check --no-pretty"
+  },
+  "dependencies": {
+    "@robodev-ai/runtime": "0.32.0"
+  },
+  "devDependencies": {
+    "@types/bun": "1.4.4",
+    "@types/node": "^24.3.0",
+    "typescript": "^5.9.2"
+  }
+}

package/src/host.test.ts

@@ -0,0 +1,258 @@
+import assert from "node:assert/strict";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { after, before, test } from "node:test";
+import { handleTenantRequest, type TenantHost, type TenantRuntime } from "./host.js";
+import { fromFetchRequest, TenantRequestError, type TenantRequest } from "./request.js";
+import { json, TenantReply } from "./response.js";
+
+let webRoot = "";
+
+before(async () => {
+  webRoot = await mkdtemp(join(tmpdir(), "tenant-host-"));
+  await writeFile(join(webRoot, "index.html"), "<html>app</html>");
+  await writeFile(join(webRoot, "logo.svg"), "<svg/>");
+});
+
+after(() => rm(webRoot, { recursive: true, force: true }));
+
+const runtime: TenantRuntime = {
+  routes: [
+    { method: "get", path: "/api/notes" },
+    { method: "post", path: "/api/notes" },
+  ],
+  frontendKind: "react",
+  openapi: { openapi: "3.0.3" },
+};
+
+function host(overrides: Partial<TenantHost<TenantRuntime>> = {}): TenantHost<TenantRuntime> {
+  return {
+    storage: async () => json({ storage: true }),
+    runtime: async () => runtime,
+    unavailable: () => json({ error: "project_not_deployed" }, 404),
+    ready: async () => json({ ok: true }),
+    auth: async () => json({ auth: true }),
+    mcp: async () => json({ mcp: true }),
+    oauth: async () => null,
+    invoke: async (request) => ({
+      kind: "ok",
+      encoded: {
+        status: 200,
+        headers: { "x-route": "1" },
+        contentType: "application/json; charset=utf-8",
+        payload: { method: request.method, body: request.body ?? null },
+      },
+    }),
+    webRoot: () => webRoot,
+    frameAncestors: "frame-ancestors 'self'",
+    ...overrides,
+  };
+}
+
+function req(method: string, url: string, init: RequestInit = {}): Promise<TenantRequest> {
+  return fromFetchRequest(new Request(`http://prj-x.localhost${url}`, { method, ...init }), {
+    ip: "127.0.0.1",
+    id: "req_1",
+  });
+}
+
+async function body(response: Response) {
+  const text = await response.text();
+  return response.headers.get("content-type")?.includes("json") ? JSON.parse(text) : text;
+}
+
+test("routes reach the invoker with the parsed body; misses list the deployed routes", async () => {
+  const ok = await handleTenantRequest(
+    await req("POST", "/api/notes", {
+      body: JSON.stringify({ text: "a" }),
+      headers: { "content-type": "application/json" },
+    }),
+    host(),
+  );
+  assert.equal(ok.kind, "api");
+  assert.equal(ok.route, "/api/notes");
+  assert.equal(ok.response.headers.get("x-route"), "1");
+  assert.deepEqual(await body(ok.response), { method: "POST", body: { text: "a" } });
+
+  const miss = await handleTenantRequest(await req("PUT", "/api/notes"), host());
+  assert.equal(miss.response.status, 404);
+  assert.equal(miss.error, "not_found");
+  assert.deepEqual(await body(miss.response), {
+    error: "not_found",
+    message: "PUT /api/notes is not deployed",
+    routes: ["GET /api/notes", "POST /api/notes"],
+  });
+});
+
+test("a handler error keeps its status and body and is logged", async () => {
+  const result = await handleTenantRequest(
+    await req("GET", "/api/notes"),
+    host({
+      invoke: async () => ({ kind: "error", status: 400, body: { error: "bad", message: "no" } }),
+    }),
+  );
+  assert.equal(result.response.status, 400);
+  assert.equal(result.error, "bad");
+  assert.equal(result.errorMessage, "no");
+});
+
+test("the guard runs first and its cookie goes before the endpoint's", async () => {
+  let woke = false;
+  const refused = await handleTenantRequest(
+    await req("GET", "/api/notes"),
+    host({
+      guard: async () => ({
+        ok: false,
+        response: new TenantReply().code(401).send("Authentication required").response(),
+        error: "gate_unauthorized",
+      }),
+      runtime: async () => {
+        woke = true;
+        return runtime;
+      },
+    }),
+  );
+  assert.equal(refused.response.status, 401);
+  assert.equal(refused.error, "gate_unauthorized");
+  assert.equal(woke, false, "a refused request never loads the runtime");
+
+  const passed = await handleTenantRequest(
+    await req("GET", "/api/user/me"),
+    host({
+      guard: async () => ({ ok: true, headers: { "Set-Cookie": "gate=1; Path=/" } }),
+      auth: async () => new TenantReply().header("Set-Cookie", "tenant=1").send({}).response(),
+    }),
+  );
+  assert.deepEqual(passed.response.headers.getSetCookie(), ["gate=1; Path=/", "tenant=1"]);
+});
+
+test("storage reads skip the runtime; a missing runtime answers unavailable", async () => {
+  const storage = await handleTenantRequest(
+    await req("GET", "/storage/objects/a.png"),
+    host({ runtime: async () => assert.fail("storage must not load the runtime") }),
+  );
+  assert.deepEqual(await body(storage.response), { storage: true });
+
+  const none = await handleTenantRequest(
+    await req("GET", "/api/notes"),
+    host({ runtime: async () => null }),
+  );
+  assert.equal(none.response.status, 404);
+  assert.equal(none.error, "project_not_deployed");
+});
+
+test("reserved endpoints: ready, OpenAPI, Auth, MCP, OAuth miss, docs", async () => {
+  const ready = await handleTenantRequest(await req("GET", "/_robodev/ready"), host());
+  assert.deepEqual(await body(ready.response), { ok: true });
+  const openapi = await handleTenantRequest(await req("GET", "/openapi.json"), host());
+  assert.deepEqual(await body(openapi.response), { openapi: "3.0.3" });
+  const auth = await handleTenantRequest(await req("POST", "/api/user/auth/login"), host());
+  assert.deepEqual(await body(auth.response), { auth: true });
+  const mcp = await handleTenantRequest(
+    await req("POST", "/mcp", {
+      body: "{}",
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream",
+      },
+    }),
+    host(),
+  );
+  assert.equal(mcp.kind, "mcp");
+  const oauth = await handleTenantRequest(
+    await req("GET", "/.well-known/oauth-authorization-server"),
+    host(),
+  );
+  assert.equal(oauth.response.status, 404);
+  const docs = await handleTenantRequest(await req("GET", "/_robodev/docs"), host());
+  assert.equal(docs.response.headers.get("content-type"), "text/html; charset=utf-8");
+  assert.equal(docs.response.headers.get("content-security-policy"), "frame-ancestors 'self'");
+  const other = await handleTenantRequest(await req("GET", "/_robodev/nope"), host());
+  assert.equal(other.response.status, 404);
+});
+
+test("web files, the SPA fallback, HEAD, and no web root", async () => {
+  const file = await handleTenantRequest(await req("GET", "/logo.svg"), host());
+  assert.equal(file.kind, "static");
+  assert.equal(file.response.headers.get("content-type"), "image/svg+xml");
+  assert.equal(await file.response.text(), "<svg/>");
+
+  const spa = await handleTenantRequest(await req("GET", "/settings/profile"), host());
+  assert.equal(spa.kind, "spa");
+  assert.equal(spa.response.headers.get("cache-control"), "no-store");
+  assert.equal(await spa.response.text(), "<html>app</html>");
+
+  const head = await handleTenantRequest(await req("HEAD", "/logo.svg"), host());
+  assert.equal(head.response.headers.get("content-length"), "6");
+  assert.equal(head.response.body, null);
+
+  const none = await handleTenantRequest(
+    await req("GET", "/logo.svg"),
+    host({ webRoot: () => null }),
+  );
+  assert.equal(none.response.status, 404);
+});
+
+test("opening an HTML page reports a page view; assets, files and API calls do not", async () => {
+  const views: string[] = [];
+  const watching = host({ onPageView: (request) => views.push(request.pathname) });
+  await handleTenantRequest(await req("GET", "/"), watching);
+  await handleTenantRequest(await req("GET", "/settings/profile"), watching);
+  await handleTenantRequest(await req("HEAD", "/"), watching);
+  await handleTenantRequest(await req("GET", "/logo.svg"), watching);
+  await handleTenantRequest(await req("GET", "/api/notes"), watching);
+  assert.deepEqual(views, ["/", "/settings/profile"]);
+});
+
+test("a cold project serves its built frontend at once; API calls still wait for the runtime", async () => {
+  let runtimeCalls = 0;
+  const cold = host({
+    coldWeb: async () => ({ webRoot, frontendKind: "react" }),
+    runtime: async () => {
+      runtimeCalls += 1;
+      return runtime;
+    },
+  });
+  const html = { headers: { accept: "text/html,application/xhtml+xml" } };
+
+  const page = await handleTenantRequest(await req("GET", "/settings", html), cold);
+  assert.equal(page.kind, "spa");
+  assert.equal(await page.response.text(), "<html>app</html>");
+  const file = await handleTenantRequest(await req("GET", "/logo.svg"), cold);
+  assert.equal(file.kind, "static");
+  assert.equal(runtimeCalls, 0);
+
+  // Routes are not known yet: a fetch that is not a navigation goes to the runtime.
+  const api = await handleTenantRequest(await req("GET", "/api/notes"), cold);
+  assert.equal(api.kind, "api");
+  assert.equal(runtimeCalls, 1);
+
+  // No built frontend: the normal path.
+  const none = host({ coldWeb: async () => null });
+  const loaded = await handleTenantRequest(await req("GET", "/", html), none);
+  assert.equal(loaded.kind, "static");
+});
+
+test("fromFetchRequest parses JSON, forms and bytes, and rejects bad JSON", async () => {
+  const form = await req("POST", "/x?a=1&a=2&b=3", {
+    body: "k=v",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+  });
+  assert.deepEqual(form.body, { k: "v" });
+  assert.deepEqual(form.query, { a: ["1", "2"], b: "3" });
+  assert.equal(form.pathname, "/x");
+  assert.equal(form.search, "?a=1&a=2&b=3");
+
+  const bytes = await req("POST", "/x", {
+    body: new Uint8Array([1, 2, 3]),
+    headers: { "content-type": "application/octet-stream" },
+  });
+  assert.deepEqual(bytes.body, Buffer.from([1, 2, 3]));
+  assert.deepEqual(bytes.rawBody, Buffer.from([1, 2, 3]));
+
+  await assert.rejects(
+    req("POST", "/x", { body: "{", headers: { "content-type": "application/json" } }),
+    (error) => error instanceof TenantRequestError && error.code === "invalid_json",
+  );
+});

package/src/host.ts

@@ -0,0 +1,316 @@
+import { join } from "node:path";
+import {
+  buildEnterpriseSpec,
+  isReservedStoragePath,
+  isReservedStorageUploadPath,
+  matchProjectRoute,
+  scalarHtml,
+  swaggerHtml,
+  type RouteOutcome,
+} from "@robodev-ai/runtime";
+import type { TenantRequest } from "./request.js";
+import { headerValue } from "./request.js";
+import { builtBodyOf, encodedResponse, json, makeResponse } from "./response.js";
+import { resolveProjectResource, type FrontendKind, type ResourceKind } from "./resolve.js";
+import { safeFileIn, webFileResponse } from "./web.js";
+
+/** What the core needs from one deployed generation of a project. */
+export type TenantRuntime = {
+  routes: { method: string; path: string }[];
+  frontendKind: FrontendKind;
+  openapi: Record<string, unknown>;
+};
+
+export type GuardResult =
+  | { ok: true; headers?: Record<string, string> }
+  | { ok: false; response: Response; error: string; message?: string };
+
+/**
+ * Everything that differs between hosted Starbase and `robodev dev`. The core decides which
+ * endpoint a request is for and how errors look; the host supplies the runtime and the
+ * endpoints that need its own clients (Auth, storage, MCP, the handler invoker).
+ */
+export type TenantHost<R extends TenantRuntime> = {
+  /** Runs first (hosted: password protection), so a refused request never wakes the project. */
+  guard?: (request: TenantRequest) => Promise<GuardResult>;
+  /**
+   * `GET /storage/objects/*` and `PUT`/`POST /storage/uploads/{id}`. Answered before the runtime
+   * loads: storage needs no worker.
+   */
+  storage: (request: TenantRequest) => Promise<Response>;
+  /** The project's current runtime, or null when there is none to serve. */
+  runtime: (request: TenantRequest) => Promise<R | null>;
+  /** The answer when `runtime` is null (hosted: not deployed; dev: still compiling). */
+  unavailable: (request: TenantRequest) => Response;
+  ready: (request: TenantRequest, runtime: R) => Promise<Response>;
+  auth: (request: TenantRequest, runtime: R) => Promise<Response>;
+  mcp: (request: TenantRequest, runtime: R) => Promise<Response>;
+  /** Null when the path is not an OAuth endpoint after all. */
+  oauth: (request: TenantRequest, runtime: R) => Promise<Response | null>;
+  invoke: (request: TenantRequest, runtime: R) => Promise<RouteOutcome>;
+  /** The deployed web root, or null when this host serves no web files (dev: Vite does). */
+  webRoot?: (runtime: R) => string | null;
+  /**
+   * A browser opened one of the project's HTML pages. Not awaited: hosted uses it to start the
+   * worker in the background, so the page's first API call does not wait for a boot.
+   */
+  onPageView?: (request: TenantRequest, runtime: R) => void;
+  /**
+   * A frontend already built on disk for a project whose runtime is not loaded yet (hosted:
+   * after a restart), or null. Page loads and web files are then served from it at once,
+   * while the host loads the runtime in the background; API calls still wait for `runtime`.
+   */
+  coldWeb?: (
+    request: TenantRequest,
+  ) => Promise<{ webRoot: string; frontendKind: FrontendKind } | null>;
+  /** `frame-ancestors` CSP for HTML this host serves, or null to send none. */
+  frameAncestors?: string | null;
+};
+
+/** What happened, for the request log. */
+export type TenantResult = {
+  response: Response;
+  kind: ResourceKind | null;
+  /** The matched route pattern, for API requests. */
+  route: string | null;
+  error: string | null;
+  errorMessage: string | null;
+};
+
+function errorFields(body: unknown): { error: string | null; message: string | null } {
+  if (!body || typeof body !== "object") return { error: null, message: null };
+  const record = body as { error?: unknown; message?: unknown };
+  return {
+    error: typeof record.error === "string" ? record.error : null,
+    message: typeof record.message === "string" ? record.message : null,
+  };
+}
+
+export function notDeployedBody(request: TenantRequest, routes: TenantRuntime["routes"]) {
+  return {
+    error: "not_found",
+    message: `${request.method} ${request.pathname} is not deployed`,
+    routes: routes.map((route) => `${route.method.toUpperCase()} ${route.path}`),
+  };
+}
+
+/** A JSON body this package built, for the request log; null for anything else. */
+function jsonBodyOf(response: Response): unknown {
+  const built = builtBodyOf(response);
+  if (typeof built !== "string" || !response.headers.get("content-type")?.includes("json")) {
+    return null;
+  }
+  try {
+    return JSON.parse(built);
+  } catch {
+    return null;
+  }
+}
+
+function htmlPage(body: string, frameAncestors: string | null | undefined): Response {
+  const headers = new Headers({
+    "content-type": "text/html; charset=utf-8",
+    "cache-control": "no-store",
+  });
+  if (frameAncestors) headers.set("content-security-policy", frameAncestors);
+  return makeResponse(200, headers, body);
+}
+
+function acceptsHtml(request: TenantRequest): boolean {
+  return (headerValue(request.headers, "accept") ?? "").includes("text/html");
+}
+
+/**
+ * A web file or page from a frontend built before the runtime loaded. Routes are not known
+ * yet, so the SPA fallback answers only a browser navigation (`Accept: text/html`): a fetch to
+ * an API path must wait for the runtime rather than get the app's HTML.
+ */
+async function serveColdWeb(
+  request: TenantRequest,
+  cold: { webRoot: string; frontendKind: FrontendKind },
+  frameAncestors: string,
+): Promise<{ kind: ResourceKind; response: Response } | null> {
+  const { webRoot } = cold;
+  const resolved = resolveProjectResource(
+    request.pathname,
+    request.method,
+    {
+      routes: [],
+      frontendKind: cold.frontendKind,
+      webHas: (rel) => Boolean(safeFileIn(webRoot, rel)),
+    },
+    request.headers,
+  );
+  const options = { method: request.method, range: headerValue(request.headers, "range") };
+  if (resolved.kind === "asset") {
+    const sent = await webFileResponse(
+      webRoot,
+      join("assets", resolved.rel ?? ""),
+      "asset",
+      options,
+      frameAncestors,
+    );
+    return sent ? { kind: "asset", response: sent.response } : null;
+  }
+  const page = resolved.kind === "static" || (resolved.kind === "spa" && acceptsHtml(request));
+  if (!page) return null;
+  const sent = await webFileResponse(
+    webRoot,
+    resolved.rel ?? "index.html",
+    resolved.kind,
+    options,
+    frameAncestors,
+  );
+  return sent ? { kind: resolved.kind, response: sent.response } : null;
+}
+
+/** Serves one project request. Thrown errors are the host's to map (validation, 500s). */
+export async function handleTenantRequest<R extends TenantRuntime>(
+  request: TenantRequest,
+  host: TenantHost<R>,
+): Promise<TenantResult> {
+  const { pathname, method } = request;
+  let kind: ResourceKind | null = null;
+  let route: string | null = null;
+  let errorBody: unknown = null;
+  let extraHeaders: Record<string, string> | undefined;
+
+  const finish = (response: Response): TenantResult => {
+    for (const [name, value] of Object.entries(extraHeaders ?? {})) {
+      if (name.toLowerCase() !== "set-cookie") {
+        response.headers.set(name, value);
+        continue;
+      }
+      // The guard's cookie goes first; a cookie the endpoint set is appended after it.
+      const own = response.headers.getSetCookie();
+      response.headers.delete("set-cookie");
+      response.headers.append("set-cookie", value);
+      for (const cookie of own) response.headers.append("set-cookie", cookie);
+    }
+    const fields = errorFields(errorBody);
+    return { response, kind, route, error: fields.error, errorMessage: fields.message };
+  };
+  const fail = (status: number, body: unknown): TenantResult => {
+    errorBody = body;
+    return finish(json(body, status));
+  };
+
+  if (host.guard) {
+    const gate = await host.guard(request);
+    if (!gate.ok) {
+      kind = "reserved";
+      errorBody = { error: gate.error, message: gate.message };
+      return finish(gate.response);
+    }
+    extraHeaders = gate.headers;
+  }
+
+  // Storage objects (GET) and upload URLs (PUT, POST) run without the project runtime: they
+  // never wake the worker or call a handler.
+  if (
+    (method === "GET" && isReservedStoragePath(pathname)) ||
+    ((method === "PUT" || method === "POST") && isReservedStorageUploadPath(pathname))
+  ) {
+    kind = "reserved";
+    return finish(await host.storage(request));
+  }
+
+  if (host.coldWeb && (method === "GET" || method === "HEAD")) {
+    const cold = await host.coldWeb(request);
+    const sent = cold ? await serveColdWeb(request, cold, host.frameAncestors ?? "") : null;
+    if (sent) {
+      kind = sent.kind;
+      return finish(sent.response);
+    }
+  }
+
+  const runtime = await host.runtime(request);
+  if (!runtime) {
+    const response = host.unavailable(request);
+    errorBody = jsonBodyOf(response);
+    return finish(response);
+  }
+
+  const webRoot = host.webRoot?.(runtime) ?? null;
+  const resolved = resolveProjectResource(
+    pathname,
+    method,
+    {
+      routes: runtime.routes,
+      frontendKind: runtime.frontendKind,
+      webHas: (rel) => (webRoot ? Boolean(safeFileIn(webRoot, rel)) : false),
+    },
+    request.headers,
+  );
+  kind = resolved.kind;
+
+  switch (resolved.kind) {
+    case "reserved":
+      switch (resolved.reserved) {
+        case "ready": {
+          const response = await host.ready(request, runtime);
+          errorBody = jsonBodyOf(response);
+          return finish(response);
+        }
+        case "openapi":
+          return finish(json(runtime.openapi));
+        case "enterprise_spec":
+          return finish(json(buildEnterpriseSpec(runtime.openapi)));
+        case "auth":
+          return finish(await host.auth(request, runtime));
+        default:
+          return fail(404, notDeployedBody(request, runtime.routes));
+      }
+    case "mcp":
+      return finish(await host.mcp(request, runtime));
+    case "oauth": {
+      const response = await host.oauth(request, runtime);
+      return response ? finish(response) : fail(404, { error: "not_found" });
+    }
+    case "swagger":
+      return finish(htmlPage(swaggerHtml("/openapi.json"), host.frameAncestors));
+    case "scalar":
+      return finish(htmlPage(scalarHtml("/openapi.json"), host.frameAncestors));
+    case "asset": {
+      const sent = webRoot
+        ? await webFileResponse(
+            webRoot,
+            join("assets", resolved.rel ?? ""),
+            "asset",
+            { method, range: headerValue(request.headers, "range") },
+            host.frameAncestors ?? "",
+          )
+        : null;
+      return sent ? finish(sent.response) : fail(404, { error: "not_found" });
+    }
+    case "static":
+    case "spa": {
+      const rel = resolved.rel ?? "index.html";
+      if (method === "GET" && (resolved.kind === "spa" || rel.endsWith(".html"))) {
+        host.onPageView?.(request, runtime);
+      }
+      const sent = webRoot
+        ? await webFileResponse(
+            webRoot,
+            rel,
+            resolved.kind,
+            { method, range: headerValue(request.headers, "range") },
+            host.frameAncestors ?? "",
+          )
+        : null;
+      return sent ? finish(sent.response) : fail(404, notDeployedBody(request, runtime.routes));
+    }
+    case "api":
+      break;
+    default:
+      return fail(404, notDeployedBody(request, runtime.routes));
+  }
+
+  const matched = matchProjectRoute(pathname, method.toLowerCase(), runtime.routes);
+  if (!matched) return fail(404, notDeployedBody(request, runtime.routes));
+  route = matched.route.path;
+
+  const outcome = await host.invoke(request, runtime);
+  if (outcome.kind === "error") return fail(outcome.status, outcome.body);
+  return finish(encodedResponse(outcome.encoded));
+}

package/src/index.ts

@@ -0,0 +1,38 @@
+export {
+  handleTenantRequest,
+  notDeployedBody,
+  type GuardResult,
+  type TenantHost,
+  type TenantResult,
+  type TenantRuntime,
+} from "./host.js";
+export {
+  fromFetchRequest,
+  headerValue,
+  parseQuery,
+  parseTenantBody,
+  tenantPathname,
+  TenantRequestError,
+  type TenantHeaders,
+  type TenantRequest,
+} from "./request.js";
+export {
+  encodeBody,
+  encodedResponse,
+  builtBodyOf,
+  isStreamedResponse,
+  json,
+  makeResponse,
+  runtimeResponse,
+  TenantReply,
+} from "./response.js";
+export {
+  isWellKnownLookupPath,
+  resolveProjectResource,
+  type FrontendKind,
+  type ReservedKind,
+  type ResolveResult,
+  type ResolveRuntime,
+  type ResourceKind,
+} from "./resolve.js";
+export { safeFileIn, webFileHeaders, webFileResponse } from "./web.js";