md-semantic-search 1.0.3 → 2.0.0

package/dist/serve.d.ts

@@ -5,6 +5,8 @@
  */
 import http from 'node:http';
 import { ModelDescriptor } from './core.js';
+import { createClientChannel } from './mcp.js';
+import { ChatProviderId } from './providers.js';
 declare const DEFAULT_PORT = 8747;
 declare const DEFAULT_HOST = "127.0.0.1";
 declare const WATCH_INTERVAL_MS = 3000;
@@ -29,11 +31,24 @@ export interface ServeState {
     reindexCount?: number;
     apiKey?: string;
     healthPublic?: boolean;
+    /** issue #181: live count of open SSE /mcp streams (capped by maxConcurrency). */
+    sseConnections?: number;
     /** issue #111: serve the built-in web UI at `/` (default on). */
     ui?: boolean;
+    /** issue #199: chat endpoint backing POST /ask — absent → /ask returns 400. */
+    llmEndpoint?: string;
+    llmModel?: string;
+    llmProvider?: ChatProviderId;
+    systemPrompt?: string;
     /** issue #123: mount the Streamable HTTP MCP transport at /mcp (default off). */
     mcp?: boolean;
     mcpSessionId?: string;
+    /** issue #197: reverse channel for server→client requests (MCP sampling). */
+    mcpChannel?: ReturnType<typeof createClientChannel>;
+    /** issue #197: capabilities the client declared at initialize. */
+    mcpClientCapabilities?: any;
+    /** issue #197: the open GET /mcp SSE stream doubling as the downlink (newest wins). */
+    mcpSseRes?: http.ServerResponse;
     /** Extra Host-header values accepted beyond the loopback defaults (issue #120). */
     allowedHosts?: string[];
     /** Exact origins reflected as `Access-Control-Allow-Origin`; absent → CORS off (issue #120). */
@@ -64,11 +79,19 @@ export interface CreateServeOptions {
         hash?: (absPath: string) => string;
         stat?: (absPath: string) => {
             mtimeMs: number;
+            size?: number;
         };
     };
     ui?: boolean;
     /** issue #123: mount Streamable HTTP MCP at /mcp (default off; stdio stays default). */
     mcp?: boolean;
+    /** issue #202: chunk budget in tokens; default min(adapter.maxTokens, 512), 0 = legacy chars. */
+    maxChunkTokens?: number;
+    /** issue #199: chat endpoint for POST /ask SSE answer synthesis. */
+    llmEndpoint?: string;
+    llmModel?: string;
+    llmProvider?: ChatProviderId;
+    systemPrompt?: string;
     embedFn?: any;
     rerankFn?: any;
     log?: (msg: string) => void;
@@ -172,4 +195,16 @@ export declare function loadApiKeyFile(filePath: string, log?: (msg: string) =>
  * "localhost:8747" → "localhost", "[::1]:8747" → "[::1]", "::1" → "::1" (issue #120).
  */
 export declare function splitHostHeader(hostHeader: string): string;
+/**
+ * Cross-site POST guard (issue #178). Browsers fire "simple" POSTs without
+ * preflight (Content-Type: text/plain, form encodings) from any open page;
+ * the loopback Host check alone does not stop them. A POST counts as
+ * same-site when:
+ *  - the client sent no Origin/Sec-Fetch headers (curl, MCP and other
+ *    non-browser clients), or
+ *  - Sec-Fetch-Site is not cross-site AND the Origin's host matches the
+ *    request Host, a loopback allowlist entry, or an explicit --cors-origin.
+ * `Origin: null` (sandboxed iframe, file:// page) is always rejected.
+ */
+export declare function isSameSitePost(req: http.IncomingMessage, allowedHosts: Set<string>, corsOrigins?: string[]): boolean;
 export { DEFAULT_PORT, DEFAULT_HOST, MAX_BODY_BYTES, WATCH_INTERVAL_MS };