zitejs 0.10.0-start.10 → 0.10.0-start.13

package/dist/esm/start/outbound.js

@@ -0,0 +1,417 @@
+/**
+ * Every fetch an app makes on the server, wrapped as classic's runtime wraps
+ * it: logged, every secret it knows redacted, with the connection whose token
+ * it carries and what an org's own AI key used; a 401 on a connection's token
+ * refreshed and sent once more; and a call on Zite's own AI key sent to the
+ * host over the app's platform binding.
+ */
+import { AI_USAGE_HOSTS, meterAiResponse, withStreamUsage } from "./aiUsage.js";
+import { sessionCredentials } from "./credentials.js";
+import { REDACTED, redactKnown, secretForms } from "./redactSecrets.js";
+import { getHost } from "./scope.js";
+const MAX_FETCHES = 500;
+// Shorter values (a region, a flag) aren't tokens, and could match by chance.
+const MIN_TOKEN_LENGTH = 8;
+// As classic: Workers send no User-Agent, and some APIs (GitHub) refuse a request without one.
+const DEFAULT_USER_AGENT = "zite";
+// The backend's stand-in for Zite's own AI key, which only the host answers.
+const AI_MARKER = /^zite_ai_gateway:[a-z]+:(.+)$/;
+// Where a provider SDK given the connection's `baseUrl` sends it; it never resolves.
+const AI_HOST = "zite-ai.invalid";
+// A provider's own base URL at the host: `/v1` is OpenAI's, Anthropic's SDK sends it in the path.
+const AI_PROVIDER_HOSTS = {
+    "api.openai.com": { provider: "openai", strip: "/v1" },
+    "api.anthropic.com": { provider: "anthropic", strip: "" },
+};
+// As classic's run log: a body up to 50 KB, a request's fetch bodies up to 200 KB in all.
+const MAX_BODY_CHARS = 50 * 1024;
+const MAX_LOGGED_CHARS = 200 * 1024;
+const MAX_URL_CHARS = 2_000;
+const MAX_ERROR_CHARS = 1_000;
+const SECRET_HEADER = /auth|key|token|secret|signature|password|cookie|session/i;
+// Usage still being read when the request's log is flushed isn't waited on for longer.
+const USAGE_WAIT_MS = 10_000;
+// Tokens refreshed in this isolate, which a later request's props may not name yet.
+const MAX_REFRESHED = 50;
+const refreshedTokens = new Map();
+const replacements = new Map();
+// Moves with each refresh, so a request's list of secrets takes in a token another one refreshed.
+let refreshes = 0;
+const remember = (map, key, value) => {
+    map.delete(key);
+    map.set(key, value);
+    if (map.size > MAX_REFRESHED)
+        map.delete(map.keys().next().value);
+};
+const tokensOf = (host) => {
+    if (host.connectionTokens)
+        return host.connectionTokens;
+    const tokens = new Map(refreshedTokens);
+    for (const [key, name] of Object.entries(host.envConnections ?? {})) {
+        const value = host.env?.[key];
+        if (value && value.length >= MIN_TOKEN_LENGTH)
+            tokens.set(value, name);
+    }
+    host.connectionTokens = tokens;
+    return tokens;
+};
+/** An `integrations.get` answer, whose values name the calls that carry them. */
+export const rememberConnection = (host, name, connection) => {
+    (host.connectionAnswers ??= new Map()).set(name, connection);
+    host.secretValues = undefined;
+    const tokens = tokensOf(host);
+    for (const [field, value] of Object.entries((connection ?? {}))) {
+        if (field !== "status" && field !== "baseUrl" && typeof value === "string" && value.length >= MIN_TOKEN_LENGTH) {
+            tokens.set(value, name);
+        }
+    }
+};
+const bare = (value) => value.replace(/^(?:Bearer|Token)\s+/i, "");
+const isUrl = (value) => /^https?:\/\//i.test(value);
+/** Every value this request knows is secret, longest first. */
+const secretsOf = (host) => {
+    if (host.secretValues && host.secretsAt === refreshes)
+        return host.secretValues;
+    const values = new Set([...refreshedTokens.keys(), ...replacements.values()]);
+    // A connection's own URL (an instance, an account) says which call failed; a user's secret may be a URL.
+    const add = (value, urls) => {
+        if (typeof value !== "string" || value.length < MIN_TOKEN_LENGTH || AI_MARKER.test(value))
+            return;
+        if (urls || !isUrl(value))
+            values.add(value);
+    };
+    for (const answer of host.connectionAnswers?.values() ?? []) {
+        for (const [field, value] of Object.entries((answer ?? {}))) {
+            if (field !== "status" && field !== "baseUrl")
+                add(value, false);
+        }
+    }
+    for (const [key, value] of Object.entries(host.env ?? {}))
+        add(value, !host.envConnections?.[key]);
+    host.secretValues = [...values].sort((a, b) => b.length - a.length);
+    host.secretsAt = refreshes;
+    return host.secretValues;
+};
+/** The values a request's own credential headers carry, which the log redacts too. */
+const headerSecrets = (headers) => [...headers].flatMap(([name, value]) => {
+    const secret = bare(value);
+    return SECRET_HEADER.test(name) && secret.length >= MIN_TOKEN_LENGTH && !AI_MARKER.test(secret) ? [secret] : [];
+});
+/** `text` cut to `max`, every secret in it redacted, none cut in half first, however it was written. */
+const loggable = (text, secrets, max) => {
+    const reach = secrets.reduce((longest, secret) => Math.max(longest, secretForms(secret)[0].length), 0);
+    return redactKnown(text.slice(0, max + reach), secrets).slice(0, max);
+};
+const decodings = (raw) => {
+    const decoded = [raw];
+    for (const text of [raw, raw.replace(/\+/g, " ")]) {
+        try {
+            decoded.push(decodeURIComponent(text));
+        }
+        catch {
+            // Not encoded as a whole; matched as written.
+        }
+    }
+    return decoded;
+};
+/** A URL with each path segment or query value that holds a secret, however it was encoded, redacted whole. */
+const redactedUrl = (url, secrets) => {
+    const holds = (raw) => decodings(raw).some((text) => secrets.some((secret) => text.includes(secret)));
+    const path = url.pathname
+        .split("/")
+        .map((segment) => (holds(segment) ? REDACTED : segment))
+        .join("/");
+    const query = url.search
+        ? `?${url.search
+            .slice(1)
+            .split("&")
+            .map((pair) => {
+            const at = pair.indexOf("=");
+            if (at < 0)
+                return holds(pair) ? REDACTED : pair;
+            return holds(pair.slice(at + 1)) ? `${pair.slice(0, at)}=${REDACTED}` : pair;
+        })
+            .join("&")}`
+        : "";
+    return `${url.protocol}//${url.host}${path}${query}`;
+};
+/** A request body as classic's run log shows it. */
+const bodyText = (body) => {
+    if (body === undefined || body === null)
+        return undefined;
+    if (typeof body === "string")
+        return body;
+    if (body instanceof URLSearchParams)
+        return body.toString();
+    if (body instanceof ReadableStream)
+        return "[stream]";
+    if (body instanceof Blob || body instanceof ArrayBuffer || ArrayBuffer.isView(body))
+        return "[binary data]";
+    if (typeof FormData !== "undefined" && body instanceof FormData)
+        return "[binary data]";
+    try {
+        return JSON.stringify(body);
+    }
+    catch {
+        return "[non-serializable body]";
+    }
+};
+const settledWithin = (promise, ms) => new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    promise.then(() => {
+        clearTimeout(timer);
+        resolve();
+    }, () => {
+        clearTimeout(timer);
+        resolve();
+    });
+});
+/** The connection token a request carries, in a header or its query. */
+const carried = (headers, url, tokens) => {
+    for (const [, value] of headers) {
+        const connection = tokens.get(bare(value));
+        if (connection)
+            return { token: bare(value), connection };
+    }
+    for (const [, value] of url.searchParams) {
+        const connection = tokens.get(value);
+        if (connection)
+            return { token: value, connection };
+    }
+    return undefined;
+};
+/** `url` with each query value equal to `from` set to `to`, every other pair left as it was written. */
+const withQueryValue = (url, from, to) => {
+    if (!url.search)
+        return url;
+    const pairs = url.search
+        .slice(1)
+        .split("&")
+        .map((pair) => {
+        const at = pair.indexOf("=");
+        if (at < 0)
+            return pair;
+        let value;
+        try {
+            value = decodeURIComponent(pair.slice(at + 1).replace(/\+/g, " "));
+        }
+        catch {
+            return pair;
+        }
+        return value === from ? `${pair.slice(0, at)}=${encodeURIComponent(to)}` : pair;
+    });
+    const swapped = new URL(url);
+    swapped.search = `?${pairs.join("&")}`;
+    return swapped;
+};
+const swapHeaders = (headers, from, to) => {
+    for (const [name, value] of [...headers]) {
+        if (value.includes(from))
+            headers.set(name, value.split(from).join(to));
+    }
+};
+/** Where a call on Zite's AI key goes at the host, whether the app named the provider or the `baseUrl` it was given. */
+const aiTarget = (url, headers) => {
+    const marker = [...headers].map(([, value]) => AI_MARKER.exec(bare(value))).find(Boolean);
+    if (url.hostname === AI_HOST)
+        return { target: url, connection: marker?.[1] };
+    const route = AI_PROVIDER_HOSTS[url.hostname];
+    if (!route || !marker)
+        return undefined;
+    const path = url.pathname.startsWith(route.strip) ? url.pathname.slice(route.strip.length) : url.pathname;
+    return { target: new URL(`https://${AI_HOST}/${route.provider}${path}${url.search}`), connection: marker[1] };
+};
+const sessionOf = async (host) => {
+    if (!host.platform)
+        return undefined;
+    host.session ??= Promise.resolve(host.watch ? host.platform.session(host.watch) : host.platform.session());
+    return host.session;
+};
+const credentialsOf = async (host) => {
+    if (host.credentials)
+        return host.credentials;
+    const session = await sessionOf(host);
+    return session && sessionCredentials(session, "anyone");
+};
+/** The token to send instead of `token`, refreshed once per connection per request. */
+const freshToken = async (host, token, connection) => {
+    const known = replacements.get(token);
+    if (known)
+        return known;
+    const refreshing = (host.refreshing ??= new Map());
+    let pending = refreshing.get(connection);
+    if (!pending) {
+        pending = (async () => {
+            const source = await credentialsOf(host);
+            const result = source?.refresh ? await source.refresh(connection) : undefined;
+            if (!result || !("value" in result))
+                return undefined;
+            const fresh = result.value;
+            const previous = (host.connectionAnswers?.get(connection) ?? {});
+            const field = Object.keys(previous).find((key) => previous[key] === token) ?? "accessToken";
+            const value = fresh[field];
+            rememberConnection(host, connection, fresh);
+            return typeof value === "string" ? value : undefined;
+        })();
+        refreshing.set(connection, pending);
+    }
+    const value = await pending;
+    if (!value || value === token)
+        return undefined;
+    remember(replacements, token, value);
+    remember(refreshedTokens, value, connection);
+    refreshes += 1;
+    // As classic: the env vars that held the old token hold the new one.
+    const env = globalThis.process?.env;
+    for (const [key, held] of Object.entries(env ?? {})) {
+        if (held === token)
+            env[key] = value;
+    }
+    return value;
+};
+const hostOf = (input) => {
+    try {
+        return new URL(input instanceof Request ? input.url : input).host;
+    }
+    catch {
+        return "?";
+    }
+};
+const aiUnavailable = () => Response.json({ error: { type: "unavailable", message: "Zite's AI key works only in an app Zite hosts" } }, { status: 503 });
+const cfOf = (request) => request.cf;
+export const createOutboundFetch = (nativeFetch) => async (input, init) => {
+    const host = getHost();
+    if (!host)
+        return nativeFetch(input, init);
+    // A page that fetched depends on more than the reads the host saw, so the
+    // host must hear of it before the fetch goes out.
+    if (host.watch)
+        await host.watch.uncacheable(`fetch ${hostOf(input)}`);
+    let url;
+    try {
+        url = new URL(input instanceof Request ? input.url : input);
+    }
+    catch {
+        return nativeFetch(input, init);
+    }
+    const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+    if (!headers.has("user-agent"))
+        headers.set("user-agent", DEFAULT_USER_AGENT);
+    const method = (init?.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+    const ai = aiTarget(url, headers);
+    const found = ai ? undefined : carried(headers, url, tokensOf(host));
+    const startedAt = Date.now();
+    const sentBody = bodyText(init?.body);
+    const sentHeaderSecrets = headerSecrets(headers);
+    const record = (outcome) => {
+        const fetches = (host.fetches ??= []);
+        if (fetches.length >= MAX_FETCHES)
+            return undefined;
+        const connection = ai?.connection ?? found?.connection;
+        const secrets = [...sentHeaderSecrets, ...secretsOf(host)].sort((a, b) => b.length - a.length);
+        const bodyRoom = Math.min(MAX_BODY_CHARS, MAX_LOGGED_CHARS - (host.fetchLogChars ?? 0));
+        const requestBody = sentBody !== undefined && bodyRoom > 0 ? loggable(sentBody, secrets, bodyRoom) : undefined;
+        if (requestBody)
+            host.fetchLogChars = (host.fetchLogChars ?? 0) + requestBody.length;
+        const entry = {
+            at: startedAt,
+            method,
+            url: loggable(redactedUrl(url, secrets), secrets, MAX_URL_CHARS),
+            durationMs: Date.now() - startedAt,
+            ...(requestBody !== undefined && { requestBody }),
+            ...(outcome.status !== undefined && { status: outcome.status }),
+            ...(outcome.error !== undefined && {
+                error: loggable(outcome.error instanceof Error ? outcome.error.message : String(outcome.error), secrets, MAX_ERROR_CHARS),
+            }),
+            ...(connection && { connection }),
+            ...(ai && { ziteAi: true }),
+            ...(outcome.retried && { retried: true }),
+        };
+        fetches.push(entry);
+        return entry;
+    };
+    if (!ai && !found) {
+        try {
+            // The app's own call, `cf` and all; only the headers are ours.
+            const response = await nativeFetch(input, { ...init, headers });
+            record({ status: response.status });
+            return response;
+        }
+        catch (error) {
+            record({ error });
+            throw error;
+        }
+    }
+    // An org's own AI key, which classic reads usage from for analytics.
+    const usageProvider = found ? AI_USAGE_HOSTS[url.hostname] : undefined;
+    const usageBody = usageProvider ? withStreamUsage(url, method, init?.body) : undefined;
+    if (usageBody !== undefined)
+        headers.delete("content-length");
+    const base = new Request(input, usageBody === undefined ? init : { ...init, body: usageBody });
+    if (ai) {
+        try {
+            const session = await sessionOf(host);
+            if (!session?.aiFetch) {
+                const refused = aiUnavailable();
+                record({ status: refused.status });
+                return refused;
+            }
+            // Whole, so it crosses RPC as bytes whatever stream the app built it from.
+            const body = base.body ? await base.arrayBuffer() : undefined;
+            const response = await session.aiFetch(new Request(ai.target, { method: base.method, headers, body, redirect: "manual" }));
+            record({ status: response.status });
+            return response;
+        }
+        catch (error) {
+            record({ error });
+            throw error;
+        }
+    }
+    // As classic: Node SDKs ask for gzip and inflate it themselves, which fails on the body Workers already inflated.
+    if (found)
+        headers.delete("accept-encoding");
+    const outgoing = new Request(base, { headers });
+    const retry = found ? outgoing.clone() : undefined;
+    try {
+        let response = await nativeFetch(outgoing);
+        let retried = false;
+        if (response.status === 401 && retry && found) {
+            const fresh = await freshToken(host, found.token, found.connection);
+            if (fresh) {
+                const retryHeaders = new Headers(retry.headers);
+                swapHeaders(retryHeaders, found.token, fresh);
+                await response.body?.cancel();
+                response = await nativeFetch(new Request(withQueryValue(url, found.token, fresh), {
+                    method: retry.method,
+                    headers: retryHeaders,
+                    body: retry.body,
+                    redirect: retry.redirect,
+                    signal: retry.signal,
+                    ...(retry.body && { duplex: "half" }),
+                    ...(cfOf(retry) !== undefined && { cf: cfOf(retry) }),
+                }));
+                retried = true;
+            }
+        }
+        if (!retried)
+            await retry?.body?.cancel();
+        if (usageProvider) {
+            const metered = meterAiResponse(usageProvider, response);
+            response = metered.response;
+            const entry = record({ status: response.status, retried });
+            const used = metered.usage.then((usage) => {
+                if (usage && entry)
+                    entry.ai = usage;
+            });
+            (host.pending ??= []).push(settledWithin(used, USAGE_WAIT_MS));
+            return response;
+        }
+        record({ status: response.status, retried });
+        return response;
+    }
+    catch (error) {
+        await retry?.body?.cancel().catch(() => { });
+        record({ error });
+        throw error;
+    }
+};

package/dist/esm/start/quiet.d.ts

@@ -0,0 +1,2 @@
+/** Runs `fn` with this request's console dropped; the isolate's other requests log as before. */
+export declare const withoutConsole: <T>(fn: () => T) => T;

package/dist/esm/start/quiet.js

@@ -0,0 +1,27 @@
+// Server-only. A trigger registration's console stays out of the platform's
+// logs, as classic's does: the provider can answer it with the signing secret.
+import { AsyncLocalStorage } from "node:async_hooks";
+const LEVELS = ["debug", "dir", "error", "info", "log", "table", "trace", "warn"];
+// Keyed on globalThis so two copies of zitejs in one bundle wrap console once.
+const stores = globalThis;
+const QUIET_KEY = Symbol.for("zitejs:quiet-console");
+const quietStorage = () => {
+    const held = stores[QUIET_KEY];
+    if (held)
+        return held;
+    const storage = new AsyncLocalStorage();
+    stores[QUIET_KEY] = storage;
+    const methods = console;
+    for (const level of LEVELS) {
+        const original = methods[level];
+        if (typeof original !== "function")
+            continue;
+        methods[level] = (...args) => {
+            if (!storage.getStore())
+                original.apply(console, args);
+        };
+    }
+    return storage;
+};
+/** Runs `fn` with this request's console dropped; the isolate's other requests log as before. */
+export const withoutConsole = (fn) => quietStorage().run(true, fn);

package/dist/esm/start/redactSecrets.d.ts

@@ -5,3 +5,11 @@ export declare const REDACTED = "REDACTED";
  * callers that pass clean text see byte-identical output.
  */
 export declare function redactSecrets(text: string): string;
+/** The ways a secret is written into text, longest first: as it is, URL-encoded in either case, form-encoded, JSON-escaped. */
+export declare function secretForms(value: string): string[];
+/**
+ * `text` with each of `values`, however it was written, replaced, then
+ * anything the patterns above find. `values` longest first, so none is left
+ * half-done.
+ */
+export declare function redactKnown(text: string, values: readonly string[]): string;

package/dist/esm/start/redactSecrets.js

@@ -129,3 +129,26 @@ export function redactSecrets(text) {
     }
     return result;
 }
+/** The ways a secret is written into text, longest first: as it is, URL-encoded in either case, form-encoded, JSON-escaped. */
+export function secretForms(value) {
+    const lower = (text) => text.replace(/%[0-9A-F]{2}/g, (hex) => hex.toLowerCase());
+    const encoded = encodeURIComponent(value);
+    const form = new URLSearchParams({ v: value }).toString().slice(2);
+    const json = JSON.stringify(value).slice(1, -1);
+    return [...new Set([value, encoded, lower(encoded), form, lower(form), json])].sort((a, b) => b.length - a.length);
+}
+/**
+ * `text` with each of `values`, however it was written, replaced, then
+ * anything the patterns above find. `values` longest first, so none is left
+ * half-done.
+ */
+export function redactKnown(text, values) {
+    let result = text;
+    for (const value of values) {
+        for (const form of secretForms(value)) {
+            if (result.includes(form))
+                result = result.split(form).join(REDACTED);
+        }
+    }
+    return redactSecrets(result);
+}

package/dist/esm/start/router.d.ts

@@ -11,6 +11,11 @@ type Dehydrated = {
     user: User | null;
 };
 type ZiteRouterOptions<TRouteTree extends AnyRoute> = Omit<RouterConstructorOptions<TRouteTree, "never", false, RouterHistory, Dehydrated>, "context" | "dehydrate" | "hydrate">;
+/**
+ * @internal Tells the editor's preview the page crashed, as classic's runtime reports an emptied #root: a Start page
+ * has none, and an error a route's boundary catches is the crash. Being signed out isn't one.
+ */
+export declare const reportCrash: (error: unknown) => void;
 /**
  * The router for `src/router.tsx`. The signed-in user is in `context.user`: on the server from the platform, in the
  * browser from the page it rendered, so no request asks for it again. `context.queryClient` is new for each request

package/dist/esm/start/router.js

@@ -9,12 +9,21 @@ import { currentHost } from "./host.js";
 export const QUERY_STALE_TIME_MS = 30_000;
 const ziteWindow = () => (typeof window === "undefined" ? undefined : window);
 const box = { maxWidth: 480, margin: "15vh auto", padding: 24, fontFamily: "system-ui, sans-serif", textAlign: "center" };
+/**
+ * @internal Tells the editor's preview the page crashed, as classic's runtime reports an emptied #root: a Start page
+ * has none, and an error a route's boundary catches is the crash. Being signed out isn't one.
+ */
+export const reportCrash = (error) => {
+    if (!isSignInError(error))
+        ziteWindow()?._ziteOnCrash?.(error);
+};
 // As classic's crash screen: the message, "Fix it for me" in the editor, and a reload. The server renders from the
 // app's own error and the browser from the one that crossed, already mapped, so both show the same text.
 function ZiteErrorComponent({ error }) {
     const router = useRouter();
     const [allowAiFix, setAllowAiFix] = useState(false);
     useEffect(() => setAllowAiFix(ziteWindow()?.__ziteAllowAiFix === true), []);
+    useEffect(() => markReady("error"), []);
     const message = typeof window === "undefined" ? toClientError(error).message : error instanceof Error ? error.message : String(error);
     const reload = () => {
         const onReload = ziteWindow()?._ziteOnReload;
@@ -27,6 +36,20 @@ function ZiteErrorComponent({ error }) {
         !isSignInError(error) &&
         h("button", { type: "button", onClick: () => ziteWindow()?._ziteOnFixError?.(error) }, "Fix it for me"), h("button", { type: "button", onClick: reload }, "Try again"));
 }
+/**
+ * `<html data-zite-ready>`: what the platform's screenshots wait for. `1` once
+ * the page has rendered with nothing loading, `error` when the error screen did.
+ */
+const markReady = (state) => {
+    if (typeof document !== "undefined")
+        document.documentElement.dataset.ziteReady = state;
+};
+const watchReady = (router) => () => {
+    const { status, isLoading, matches } = router.state;
+    if (status !== "idle" || isLoading || matches.some((match) => match.status === "pending"))
+        return;
+    markReady(matches.some((match) => match.status === "error") ? "error" : "1");
+};
 function ZiteNotFound() {
     return h("div", { style: box }, h("p", { style: { fontWeight: 600 } }, "Page not found"), h(Link, { to: "/" }, "Go home"));
 }
@@ -67,6 +90,12 @@ export function createZiteRouter(options) {
         defaultPendingComponent: ZitePending,
         ...options,
         ...(claim && { rewrite: keepPreviewClaim(claim, options.rewrite) }),
+        // Whichever screen shows it: a route may have its own.
+        defaultOnCatch: (error, info) => {
+            markReady("error");
+            reportCrash(error);
+            options.defaultOnCatch?.(error, info);
+        },
         context,
         dehydrate: () => ({ user: context.user }),
         hydrate: (dehydrated) => {
@@ -74,6 +103,9 @@ export function createZiteRouter(options) {
         },
     });
     setupRouterSsrQueryIntegration({ router, queryClient });
+    const mark = watchReady(router);
+    router.subscribe("onResolved", mark);
+    router.subscribe("onRendered", mark);
     const host = currentHost();
     if (host)
         host.router = router;

package/dist/esm/start/server.d.ts

@@ -1,3 +1,4 @@
+import { type CredentialSource } from "./credentials.js";
 import type { HostProps, PlatformBinding, RenderWatch, ZiteRequestContext } from "./types.js";
 export { runWithHost } from "./scope.js";
 export { describeApp } from "./describe.js";
@@ -35,6 +36,12 @@ export type ZiteServerOptions = {
     };
     getRouter: () => unknown;
     platform?: PlatformBinding;
+    /** The app's start instance, which a test run of a server function runs under. Entries before 0.10.0-start.11 don't pass it. */
+    startInstance?: {
+        getOptions: () => unknown;
+    };
+    /** Where `integrations.get` reads outside Zite; the host's requests always read the host. */
+    credentials?: CredentialSource;
 };
 type HostedContext = WorkerContext & {
     props?: Partial<HostProps>;