@zhin.js/host-http 1.1.17 → 1.2.0

package/README.md

@@ -4,8 +4,23 @@ Minimal HTTP and WebSocket host for Plugin Runtime. Provides `httpHostToken` so
 Console can register path-scoped WebSocket / HTTP routes without importing Koa or the legacy
 `@zhin.js/host-router`.
 
-Root installs the host via `installResources` (see `packages/im/runtime/src/host/http-host-installer.ts`
-and `basic/cli/src/plugin-runtime/console-host-installer.ts`).
+Root installs the host via `installResources` (see `packages/host/http/src/host-installer.ts`
+and `packages/im/zhin/src/instance/console/host.ts`).
+
+The route contract is transport independent (ADR 0054 §2): HTTP routes take a Web standard
+`Request` and return a `Response`; WebSocket routes receive a `WsConnection`. The main entry never
+loads `node:http` or `ws`. The in-process Node listener (`createHttpHost`, `createHttpHostGroup`)
+the Node ↔ Web conversion (`createNodeRequest`, `writeNodeResponse`, `wrapNodeWebSocket`) and the
+bare listener both of them and the gateway run on (`createNodeHttpListener`) live in
+`@zhin.js/host-http/node`.
+
+`@zhin.js/host-http/bridge` carries the same contract across the gateway ↔ instance IPC channel
+(ADR 0054 §3): `createBridgedHttpHost` is the instance's `HttpHost` (it announces a route table,
+serves forwarded requests with chunked, credit-based streaming bodies and bridged WebSocket
+frames, and never loads `node:http` / `ws`); `IpcInstanceTransport` implements the gateway-facing
+`InstanceTransport` (`routes()`, `onRoutes()`, `fetch(request, { principal })`,
+`openWebSocket(info, peer)`). The gateway authenticates; the bridged router runs in `forwarded`
+authentication mode and still authorizes every `{apiBase}` route against the Console permission map.
 
 The composition root owns the process listener through `ProcessHttpHost`. Generation scopes receive
 only the `HttpHost` routing port: they may register HTTP/WS routes but cannot listen or close the
@@ -18,38 +33,62 @@ calls share one operation; calling `listen()` after close rejects.
 
 ## Capabilities (this slice)
 
-- Path-scoped WebSocket upgrades (`ws(path)`)
-- HTTP `route(method, path, handler, meta?)` (exact + `/*` prefix)
+- Path-scoped WebSocket upgrades (`ws(path)`), delivered as `WsConnection`
+  (`url`, `headers`, `principal?`, `remoteAddress?`, `send`, `close`, `onMessage`, `onClose`,
+  `bufferedAmount`); the Node transport answers protocol pings and drops peers that miss a pong
+- HTTP `route(method, path, handler, meta?)` (exact + `/*` prefix); `handler(request, context)`
+  returns a `Response`; `context` carries `url`, `params` (`'*'` = prefix remainder), the
+  authenticated `principal` and `remoteAddress`
+- Streaming responses (SSE, large files) use `ReadableStream` bodies; `createResponseStream()`
+  gives a writer with backpressure (`write()` → false, `onDrain`) and disconnect (`signal`, `onClose`)
 - Built-in `GET /pub/health` and `GET /pub/openapi.json`
-- CLI-composed runtimes additionally expose `GET /pub/ready` and full-scope `GET /api/system/readiness`; see [production probes](../../../docs/operations/production.md).
+- CLI-composed runtimes additionally expose `GET /pub/ready` and `GET /api/system/readiness` (requires `status.view`); see [production probes](../../../docs/operations/production.md).
 - CORS allowlist (always includes `https://console.zhin.dev`)
-- Optional Bearer auth for `/api/*` when `http.token` / `http.tokens` are set (ADR 0016 scopes)
-- WebSocket upgrade auth (Authorization or `?token=`); demo scope limited to `/sandbox`
-- `readJsonBody()` helper for JSON POST/PUT bodies (no Koa)
+- Bearer auth for `/api/*` (ADR 0049): `http.token` is a bootstrap token that only reaches
+  `/auth/setup*` until the first owner exists; afterwards only Console user sessions and API tokens
+  (supplied by a pluggable `ConsoleAccessProvider` on `tokenRegistry`) are accepted, and every
+  route / RPC is checked against the permission map in `@zhin.js/console-protocol`
+- WebSocket upgrade auth (Authorization or `?token=`), checked per path permission
+- `readJsonBody()` / `readTextBody()` / `readBodyBytes()` (bounded, default 1 MiB, 413 after
+  draining) and `jsonResponse()` helpers (no Koa)
 
 ```ts
-import { httpHostToken, type HttpHost } from '@zhin.js/host-http';
+import {
+  createResponseStream, httpHostToken, jsonResponse, readJsonBody, SSE_HEADERS,
+  verifyProtocolAccessToken,
+} from '@zhin.js/host-http';
 
-const http = context.use(httpHostToken);
-const handle = http.ws('/sandbox');
-handle.onConnection(({ socket, authScope }) => { /* ... */ });
+const http = context.resources.use(httpHostToken);
 
-http.route('GET', '/api/secure', (_req, res, _url, scope) => {
-  res.writeHead(200, { 'content-type': 'application/json' });
-  res.end(JSON.stringify({ scope }));
+http.route('POST', '/api/echo', async (request, { principal }) => {
+  const body = await readJsonBody<{ text?: string }>(request);
+  return jsonResponse(200, { success: true, data: { text: body?.text, kind: principal?.kind } });
+});
+
+http.route('GET', '/api/ticks', () => {
+  const stream = createResponseStream();
+  const timer = setInterval(() => stream.write('data: tick\n\n'), 1000);
+  stream.onClose(() => clearInterval(timer));     // client disconnected
+  return new Response(stream.stream, { headers: SSE_HEADERS });
+});
+
+// A plugin socket authenticates itself (Console credentials are not accepted here).
+http.ws('/my-protocol', { auth: 'protocol' }).onConnection((connection) => {
+  if (!verifyProtocolAccessToken(config.accessToken, connection)) return connection.close(4003, 'Unauthorized');
+  connection.onMessage((data) => connection.send(typeof data === 'string' ? `echo:${data}` : data));
 });
 ```
 
+Webhook routes check their own credential with `verifyProtocolAccessToken(token, { headers:
+request.headers, url: context.url, remoteAddress: context.remoteAddress })`.
+
 ## Config (`http` in Root YAML)
 
 ```yaml
 http:
   host: 127.0.0.1
   port: 8086
-  token: ${HTTP_TOKEN}          # full scope
-  tokens:
-    - token: ${DEMO_TOKEN}
-      scope: demo
+  token: ${HTTP_TOKEN}          # bootstrap: creates the first owner, rejected afterwards
   corsOrigins:
     - https://example.test
   base: /api                    # auth prefix
@@ -74,8 +113,8 @@ not provide an OS sandbox against a local process concurrently replacing directo
 
 ### Saved configuration explanations
 
-The full-scope `config:explain` Console RPC reuses the composition root's
+The `config:explain` Console RPC (requires `ops.config.read`) reuses the composition root's
 `PluginManagementPort.explainConfiguration(instanceKey, expectedRevision)` authority.
-The route returns metadata only, rejects demo before reading configuration, and normalizes
+The route returns metadata only, checks the caller's permission before reading configuration, and normalizes
 errors without forwarding validator details or causes. It does not apply/restart the Runtime,
 expand values for clients, execute plugin code, or perform platform/network actions.

package/lib/access-control.d.ts

@@ -0,0 +1,127 @@
+import { type ConsoleGrant, type ConsolePermission, type ConsolePluginPermissionInfo, type ConsolePluginPermissionLevelResolver, type ConsoleRpcPermissionRule, type ConsoleScopeTarget } from '@zhin.js/console-protocol';
+/**
+ * Console principals (ADR 0049 §1):
+ * - `bootstrap`: the `http.token` before the first owner exists (`open: false`), or a Host
+ *   without any credential before setup (`open: true`, today's local behaviour).
+ * - `user`: a session from `/auth/login`; `api-token`: a user-issued long-lived token.
+ */
+export type ConsolePrincipal = ConsoleBootstrapPrincipal | ConsoleUserPrincipal;
+export interface ConsoleBootstrapPrincipal {
+    readonly kind: 'bootstrap';
+    /** No credential configured at all: the Host is open (local) until setup. */
+    readonly open: boolean;
+}
+export interface ConsoleUserPrincipal {
+    readonly kind: 'user' | 'api-token';
+    readonly userId: string;
+    readonly username: string;
+    readonly displayName: string;
+    /** Session id (token hash) or API token id; never the bearer itself. */
+    readonly credentialId: string;
+    readonly grants: readonly ConsoleGrant[];
+    /** Role names across all bindings (matched against Page `requiredRoles`). */
+    readonly roles: readonly string[];
+}
+export interface ConsoleRequestMeta {
+    readonly ip?: string;
+    readonly userAgent?: string;
+    /**
+     * The request carried proxy forwarding headers (`X-Forwarded-For` / `Forwarded`). Such a
+     * request never counts as local: an open Host (no bootstrap token, no owner) refuses it.
+     */
+    readonly forwarded?: boolean;
+    /**
+     * An in-process caller with no network peer (tests, embedding), set explicitly by the caller.
+     * An open Host admits it like a loopback peer; a request without `ip` and without this marker
+     * is never local.
+     */
+    readonly inProcess?: boolean;
+}
+export interface ConsoleAuditEntry {
+    readonly actor: string;
+    readonly action: string;
+    readonly target?: string;
+    readonly outcome: 'ok' | 'denied' | 'error';
+    /** Never values: RPC type, target, parameter key names. */
+    readonly detail?: Readonly<Record<string, unknown>>;
+    readonly ip?: string;
+}
+/**
+ * Pluggable user/session backend supplied by the composition root (`basic/cli`), so this
+ * package never imports the database layer.
+ */
+export interface ConsoleAccessProvider {
+    /** True once an enabled user with a global `owner` binding exists. */
+    initialized(): boolean;
+    /** Resolves a session or API token. Unknown, expired or revoked → null. */
+    authenticate(token: string, meta: ConsoleRequestMeta): Promise<ConsoleUserPrincipal | null>;
+    audit?(entry: ConsoleAuditEntry): void;
+}
+export declare function isUserPrincipal(principal: ConsolePrincipal | undefined): principal is ConsoleUserPrincipal;
+/**
+ * Whether the request carried an explicit credential: a user session / API token, or the
+ * still-valid bootstrap token (`{ kind: 'bootstrap', open: false }`). An open Host is not explicit.
+ */
+export declare function isExplicitConsolePrincipal(principal: ConsolePrincipal | undefined): boolean;
+export declare function auditActor(principal: ConsolePrincipal | undefined): string;
+/** Audit/session metadata of a request: peer address and a bounded user agent. */
+export declare function requestMeta(request: {
+    readonly headers: Headers;
+}, remoteAddress?: string, options?: {
+    readonly inProcess?: boolean;
+}): ConsoleRequestMeta;
+/**
+ * Whether the principal holds `permission` at `target` (bootstrap: only an open Host). Plugin
+ * permissions also match by level; `levelOf` supplies declared levels (default: inferred).
+ */
+export declare function principalAllows(principal: ConsolePrincipal | undefined, permission: string, target?: ConsoleScopeTarget, levelOf?: ConsolePluginPermissionLevelResolver): boolean;
+/**
+ * Permissions held through global bindings, sorted (what `/auth/me` and page gating use).
+ * With a plugin permission catalog, `plugin.perms.<level>` expands to the catalog ids of that level.
+ */
+export declare function globalPermissions(principal: ConsolePrincipal | undefined, pluginPermissions?: Iterable<Pick<ConsolePluginPermissionInfo, 'id' | 'level'>>): readonly string[];
+export type ConsoleRpcDecision = Readonly<{
+    allowed: true;
+    rule: ConsoleRpcPermissionRule | null;
+    permission: ConsolePermission | null;
+    write: boolean;
+    /**
+     * Plugin Console RPC for a signed-in principal: admitted here only so the plugin RPC
+     * dispatcher can check the method's own (or page / fallback) permissions. The caller must
+     * deny when no plugin dispatcher answers.
+     */
+    delegated?: true;
+}> | Readonly<{
+    allowed: false;
+    code: 'setup_required' | 'unmapped' | 'forbidden';
+    error: string;
+    permission: ConsolePermission | null;
+}>;
+/** RPC authorization for one principal and message (deny by default). */
+export declare function authorizeConsoleRpc(principal: ConsolePrincipal, message: Readonly<Record<string, unknown>>): ConsoleRpcDecision;
+/**
+ * For plugin RPC: whether the principal holds the rule's write permission (`feature.configure`,
+ * or `endpoint.manage` for adapter account methods) at its target. The plugin RPC dispatcher
+ * authorizes each method itself; this is only the catalog fallback.
+ */
+export declare function pluginRpcWriteAllowed(principal: ConsolePrincipal, rule: ConsoleRpcPermissionRule | null): boolean;
+export type ConsoleHttpDecision = Readonly<{
+    allowed: true;
+    permission: string | null;
+}> | Readonly<{
+    allowed: false;
+    status: 401 | 403;
+    code: 'unauthorized' | 'forbidden' | 'setup_required';
+    error: string;
+    permission: string | null;
+}>;
+/**
+ * HTTP authorization of a route under the API base. `principal` is undefined when no valid
+ * credential was presented.
+ */
+export declare function authorizeConsoleHttp(principal: ConsolePrincipal | undefined, method: string, relativePath: string): ConsoleHttpDecision;
+/** WebSocket upgrade authorization for non-bootstrap principals. */
+export declare function authorizeConsoleWebSocket(principal: ConsolePrincipal, pathname: string): boolean;
+/** Audit detail for an RPC: type, target and parameter key names only. */
+export declare function rpcAuditDetail(message: Readonly<Record<string, unknown>>): Readonly<Record<string, unknown>>;
+export declare function rpcAuditTarget(rule: ConsoleRpcPermissionRule | null): string | undefined;

package/lib/access-control.js

@@ -0,0 +1,148 @@
+import { CONSOLE_PERMISSION_LIST, CONSOLE_WRITE_PERMISSIONS, expandPluginPermissions, grantsAllow, isPluginConsoleRpcType, resolveConsoleHttpPermission, resolveConsoleRpcPermission, resolveConsoleWsPermission, } from '@zhin.js/console-protocol';
+import { hasForwardingHeaders } from './trust-proxy.js';
+export function isUserPrincipal(principal) {
+    return principal?.kind === 'user' || principal?.kind === 'api-token';
+}
+/**
+ * Whether the request carried an explicit credential: a user session / API token, or the
+ * still-valid bootstrap token (`{ kind: 'bootstrap', open: false }`). An open Host is not explicit.
+ */
+export function isExplicitConsolePrincipal(principal) {
+    return isUserPrincipal(principal) || (principal?.kind === 'bootstrap' && !principal.open);
+}
+export function auditActor(principal) {
+    if (!principal)
+        return 'anonymous';
+    if (principal.kind === 'bootstrap')
+        return 'bootstrap';
+    return principal.kind === 'user' ? `user:${principal.userId}` : `api-token:${principal.credentialId}`;
+}
+/** Audit/session metadata of a request: peer address and a bounded user agent. */
+export function requestMeta(request, remoteAddress, options = {}) {
+    const agent = request.headers.get('user-agent');
+    return Object.freeze({
+        ...(remoteAddress ? { ip: remoteAddress } : {}),
+        ...(options.inProcess === true && !remoteAddress ? { inProcess: true } : {}),
+        ...(typeof agent === 'string' ? { userAgent: agent.slice(0, 256) } : {}),
+        ...(hasForwardingHeaders(request.headers) ? { forwarded: true } : {}),
+    });
+}
+/**
+ * Whether the principal holds `permission` at `target` (bootstrap: only an open Host). Plugin
+ * permissions also match by level; `levelOf` supplies declared levels (default: inferred).
+ */
+export function principalAllows(principal, permission, target, levelOf) {
+    if (!principal)
+        return false;
+    if (principal.kind === 'bootstrap')
+        return principal.open;
+    return grantsAllow(principal.grants, permission, target, levelOf);
+}
+/**
+ * Permissions held through global bindings, sorted (what `/auth/me` and page gating use).
+ * With a plugin permission catalog, `plugin.perms.<level>` expands to the catalog ids of that level.
+ */
+export function globalPermissions(principal, pluginPermissions = []) {
+    if (!principal)
+        return Object.freeze([]);
+    if (principal.kind === 'bootstrap')
+        return principal.open ? CONSOLE_PERMISSION_LIST : Object.freeze([]);
+    const held = new Set();
+    for (const grant of principal.grants) {
+        if (grant.scope.kind === 'global')
+            for (const permission of grant.permissions)
+                held.add(permission);
+    }
+    return expandPluginPermissions([...held], pluginPermissions);
+}
+/** RPC authorization for one principal and message (deny by default). */
+export function authorizeConsoleRpc(principal, message) {
+    const rule = resolveConsoleRpcPermission(message.type, message);
+    const permission = rule ? (rule.kind === 'exact' ? rule.permission : rule.read) : null;
+    if (principal.kind === 'bootstrap') {
+        if (principal.open) {
+            return Object.freeze({ allowed: true, rule, permission, write: rule ? isWriteRule(rule) : true });
+        }
+        return Object.freeze({ allowed: false, code: 'setup_required', error: '请先完成初始化：创建第一个所有者', permission });
+    }
+    if (!rule) {
+        return Object.freeze({ allowed: false, code: 'unmapped', error: `RPC "${String(message.type ?? '')}" 未登记权限`, permission: null });
+    }
+    if (isPluginConsoleRpcType(message.type)) {
+        return Object.freeze({ allowed: true, rule, permission, write: isWriteRule(rule), delegated: true });
+    }
+    if (!grantsAllow(principal.grants, permission, rule.target)) {
+        return Object.freeze({ allowed: false, code: 'forbidden', error: `缺少权限 ${permission}`, permission });
+    }
+    return Object.freeze({ allowed: true, rule, permission, write: isWriteRule(rule) });
+}
+function isWriteRule(rule) {
+    return rule.kind === 'exact' ? CONSOLE_WRITE_PERMISSIONS.has(rule.permission) : false;
+}
+/**
+ * For plugin RPC: whether the principal holds the rule's write permission (`feature.configure`,
+ * or `endpoint.manage` for adapter account methods) at its target. The plugin RPC dispatcher
+ * authorizes each method itself; this is only the catalog fallback.
+ */
+export function pluginRpcWriteAllowed(principal, rule) {
+    if (principal.kind === 'bootstrap')
+        return principal.open;
+    if (!rule)
+        return false;
+    const permission = rule.kind === 'exact' ? rule.permission : rule.write;
+    return grantsAllow(principal.grants, permission, rule.target);
+}
+/**
+ * HTTP authorization of a route under the API base. `principal` is undefined when no valid
+ * credential was presented.
+ */
+export function authorizeConsoleHttp(principal, method, relativePath) {
+    const rule = resolveConsoleHttpPermission(method, relativePath);
+    const permission = rule?.permission ?? null;
+    if (rule?.permission === 'public')
+        return Object.freeze({ allowed: true, permission });
+    if (!principal) {
+        return Object.freeze({ allowed: false, status: 401, code: 'unauthorized', error: 'Invalid or missing token', permission });
+    }
+    if (principal.kind === 'bootstrap') {
+        if (principal.open || rule?.permission === 'bootstrap')
+            return Object.freeze({ allowed: true, permission });
+        return Object.freeze({ allowed: false, status: 403, code: 'setup_required', error: '初始化令牌只能用于创建第一个所有者', permission });
+    }
+    if (!rule) {
+        return Object.freeze({ allowed: false, status: 403, code: 'forbidden', error: 'Route is not registered with a Console permission', permission: null });
+    }
+    if (rule.permission === 'rpc' || rule.permission === 'authenticated' || rule.permission === 'bootstrap') {
+        return Object.freeze({ allowed: true, permission });
+    }
+    // Scoped permissions over plain HTTP have no knowable target: a global binding is required.
+    if (grantsAllow(principal.grants, rule.permission))
+        return Object.freeze({ allowed: true, permission });
+    return Object.freeze({ allowed: false, status: 403, code: 'forbidden', error: `缺少权限 ${rule.permission}`, permission });
+}
+/** WebSocket upgrade authorization for non-bootstrap principals. */
+export function authorizeConsoleWebSocket(principal, pathname) {
+    // Only the Console's own sockets are host-authenticated; plugin sockets use `auth: 'protocol'`.
+    const permission = resolveConsoleWsPermission(pathname);
+    if (principal.kind === 'bootstrap')
+        return principal.open;
+    return permission !== null && grantsAllow(principal.grants, permission);
+}
+/** Audit detail for an RPC: type, target and parameter key names only. */
+export function rpcAuditDetail(message) {
+    const data = message.data && typeof message.data === 'object' && !Array.isArray(message.data)
+        ? Object.keys(message.data).sort()
+        : [];
+    const keys = Object.keys(message).filter(key => key !== 'type' && key !== 'requestId' && key !== 'data').sort();
+    return Object.freeze({ type: String(message.type ?? ''), keys: Object.freeze([...new Set([...keys, ...data])]) });
+}
+export function rpcAuditTarget(rule) {
+    if (!rule)
+        return undefined;
+    const target = rule.target;
+    if (target.kind === 'adapter')
+        return `adapter:${target.adapter}`;
+    if (target.kind === 'endpoint')
+        return `endpoint:${target.adapter}/${target.endpoint}`;
+    return undefined;
+}

package/lib/addresses.d.ts

@@ -0,0 +1,9 @@
+import type { HttpHost } from './http-host.js';
+import type { HttpHostAddress } from './host-options.js';
+/** @internal Listener groups expose every bound address through this key. */
+export declare const httpHostAddressProvider: unique symbol;
+export interface AddressAwareHttpHost {
+    readonly [httpHostAddressProvider]: () => readonly HttpHostAddress[];
+}
+/** Returns every bound listener, ordered primary/local first. */
+export declare function listHttpHostAddresses(host: HttpHost): readonly HttpHostAddress[];

package/lib/addresses.js

@@ -0,0 +1,9 @@
+/** @internal Listener groups expose every bound address through this key. */
+export const httpHostAddressProvider = Symbol('HttpHostAddressProvider');
+/** Returns every bound listener, ordered primary/local first. */
+export function listHttpHostAddresses(host) {
+    const provider = host[httpHostAddressProvider];
+    if (typeof provider === 'function')
+        return Object.freeze([...provider.call(host)]);
+    return Object.freeze(host.address ? [host.address] : []);
+}

package/lib/bridge/bridged-host.d.ts

@@ -0,0 +1,43 @@
+import { type GenerationAdmissionBindable } from '@zhin.js/plugin-runtime';
+import { type HttpHost, type HttpRouterOptions } from '../http-host.js';
+import type { HttpHostAddress } from '../host-options.js';
+import { type AddressAwareHttpHost } from '../addresses.js';
+import { type BridgeLimits, type BridgeRouteTable, type GatewayToInstanceMessage, type InstanceToGatewayMessage } from './protocol.js';
+/** Close code / reason used when the gateway revoked the socket's principal. */
+export declare const PRINCIPAL_REVOKED_CLOSE_CODE = 4401;
+/** What the bridged Host needs from the control channel (see `openInstanceControlChannel`). */
+export interface BridgeChannel {
+    send(message: InstanceToGatewayMessage): void;
+    onMessage(listener: (message: GatewayToInstanceMessage) => void): () => void;
+    onDisconnect(listener: () => void): () => void;
+    /** Keeps the process alive while the Host listens (see `InstanceControlChannel.hold`). */
+    hold?(): () => void;
+}
+export interface BridgedHttpHostOptions extends Omit<HttpRouterOptions, 'address' | 'authentication' | 'secure' | 'token' | 'tokenRegistry'> {
+    readonly channel: BridgeChannel;
+    readonly limits?: Partial<BridgeLimits>;
+}
+/** @public Instance HTTP Host carried by the gateway bridge. */
+export interface BridgedHttpHost extends HttpHost, GenerationAdmissionBindable<HttpHost>, AddressAwareHttpHost {
+    /**
+     * Opens the bridge: announces the route table and starts serving forwarded requests.
+     * Resolves with the gateway's primary address once the gateway announced it (else undefined).
+     */
+    listen(): Promise<HttpHostAddress | undefined>;
+    /** Ends every exchange and socket, withdraws the route table and drops all routes. */
+    close(): Promise<void>;
+    /** Route table as the gateway sees it. */
+    routeTable(): BridgeRouteTable;
+    /** Announces the table again, tagged with `generation` (call on generation commit). */
+    publishRoutes(generation?: number): void;
+    /** Open HTTP exchanges plus WebSocket connections. */
+    readonly activeStreams: number;
+    /**
+     * Called when the gateway revoked a principal (after its exchanges and sockets were closed),
+     * for state the bridge does not see (e.g. sessions keyed by user). Returns an unsubscriber.
+     */
+    onPrincipalRevoked(listener: (principalId: string) => void): () => void;
+}
+export declare function createBridgedHttpHost(options: BridgedHttpHostOptions): BridgedHttpHost;
+/** Close codes a peer may put on the wire; reserved ones (1005, 1006, 1015) become 1000. */
+export declare function sendableCloseCode(code: number): number;