@elysiumjs/core 0.8.0 → 0.11.0

package/dist/rate-limit.d.ts

@@ -0,0 +1,194 @@
+/**
+ * What a store answers for a hit: the count of the key in its current window, or, for stores that
+ * only decide (such as the Cloudflare rate limiting binding), whether the hit is over the limit.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type RateLimitHit = {
+    /** The number of hits in the window, this one included. */
+    count: number;
+    /** When the window ends, in milliseconds since the epoch. */
+    resetAt: number;
+} | {
+    /** Whether the hit is over the limit. */
+    limited: boolean;
+};
+/**
+ * Where rate limits keep their counts. Counts use fixed windows: the first hit of a key opens a
+ * window of `windowMs`, and the count starts again once it has ended. Implement it to keep the
+ * counts anywhere; `MemoryRateLimitStore` keeps them in the process, `RedisRateLimitStore`
+ * (`@elysiumjs/redis`) in Redis, and `WorkersRateLimitStore` (`@elysiumjs/runtime-workers`) uses
+ * a Cloudflare rate limiting binding.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export interface RateLimitStore {
+    /**
+     * Counts a hit of a key.
+     * @param key The key, such as the client address and the route.
+     * @param windowMs The length of the window, in milliseconds.
+     */
+    hit(key: string, windowMs: number): Promise<RateLimitHit>;
+}
+/**
+ * Keeps rate limit counts in the memory of the process. Counts are not shared between
+ * processes or Worker isolates: use another store when the app runs on several.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export declare class MemoryRateLimitStore implements RateLimitStore {
+    #private;
+    hit(key: string, windowMs: number): Promise<{
+        count: number;
+        resetAt: number;
+    }>;
+}
+/**
+ * What a rate limit key is built from.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type RateLimitKeyContext = {
+    request: Request;
+    /** The client address (`ctx.ip`), when the runtime knows it. */
+    ip?: string;
+    /** The route, such as `GET /posts/:id`. */
+    route: string;
+    /** The whole request context, for keys built from the current user or tenant. */
+    context: Record<string, unknown>;
+};
+/**
+ * A rate limit of a route, a controller or the app.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type RateLimitOptions = {
+    /** The length of a window, in milliseconds. */
+    window: number;
+    /** The hits a key may make in a window. */
+    max: number;
+    /**
+     * Builds the key the limit counts. Defaults to the client address and the route, so that each
+     * client has its own count on each route.
+     */
+    key?: (context: RateLimitKeyContext) => string | Promise<string>;
+    /** Where the counts are kept. Defaults to the app's store, or one in memory. */
+    store?: RateLimitStore;
+    /** A name for the limit, in the `RateLimit-Policy` header and the keys. */
+    name?: string;
+};
+/**
+ * The rate limit options of an application: the store of every limit, and a limit for every
+ * route that sets none.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type AppRateLimitOptions = Partial<RateLimitOptions>;
+declare const TooManyRequestsError_base: {
+    new (detail?: string, options?: import("./problem").DomainErrorOptions): {
+        name: string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        value?(): import("elysia/types").MaybePromise<unknown>;
+        readonly code: "RATE_LIMITED";
+        readonly status: 429;
+        readonly detail: string | undefined;
+        readonly title: string;
+        readonly errors: readonly import("./problem").ProblemValidationError[] | undefined;
+        readonly retryAfterSeconds: number | undefined;
+        readonly extensions: Readonly<Record<string, unknown>>;
+        readonly headers: Record<string, string> | undefined;
+        get type(): string;
+        extension(): Record<string, unknown>;
+    };
+    isError(error: unknown): error is Error;
+    isError(value: unknown): value is Error;
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+    id<const Type extends string>(code: Type): import("elysia").TaggedHTTPError<Type>;
+    id<const Type extends string, const S extends number | keyof import("elysia").StatusMap>(code: Type, status: S): import("elysia").TaggedHTTPError<Type, {
+        readonly status: S extends keyof import("elysia").StatusMap ? import("elysia").StatusMap[S] : S;
+    }>;
+    typeBase?: string;
+    for<const C extends import("./problem").ProblemCode, const S extends number>(code: C, status: S): {
+        new (detail?: string, options?: import("./problem").DomainErrorOptions): {
+            name: string;
+            message: string;
+            stack?: string;
+            cause?: unknown;
+            value?(): import("elysia/types").MaybePromise<unknown>;
+            readonly code: C;
+            readonly status: S;
+            readonly detail: string | undefined;
+            readonly title: string;
+            readonly errors: readonly import("./problem").ProblemValidationError[] | undefined;
+            readonly retryAfterSeconds: number | undefined;
+            readonly extensions: Readonly<Record<string, unknown>>;
+            readonly headers: Record<string, string> | undefined;
+            get type(): string;
+            extension(): Record<string, unknown>;
+        };
+        isError(error: unknown): error is Error;
+        isError(value: unknown): value is Error;
+        captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+        captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+        prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+        stackTraceLimit: number;
+        id<const Type extends string>(code: Type): import("elysia").TaggedHTTPError<Type>;
+        id<const Type extends string, const S_1 extends number | keyof import("elysia").StatusMap>(code: Type, status: S_1): import("elysia").TaggedHTTPError<Type, {
+            readonly status: S_1 extends keyof import("elysia").StatusMap ? import("elysia").StatusMap[S_1] : S_1;
+        }>;
+        typeBase?: string;
+        for<const C extends import("./problem").ProblemCode, const S extends number>(code: C, status: S): /*elided*/ any;
+    };
+};
+/**
+ * Raised when a client goes over a rate limit. Rendered as a 429 problem, with `Retry-After`.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export declare class TooManyRequestsError extends TooManyRequestsError_base {
+    readonly retryAfter: number;
+    constructor(retryAfter: number);
+}
+/**
+ * Sets the rate limit of a route, or of every route of a controller. A limit on a route wins over
+ * the one of its controller, which wins over the app's default (`rateLimit` of
+ * `@Application.register()`). Pass `false` to turn the limit off. Each route counts on its own.
+ *
+ * The limit is counted in the route's `beforeHandle`, after the body is parsed and validated and
+ * after the `onBeforeHandle` middlewares of the application ran. A middleware that is costly for a
+ * client over the limit (a database lookup, say) runs on the routes that need it, not on the
+ * application.
+ * @author Axel Nana <axel.nana@workbud.com>
+ * @param limit The limit, or `false` for none.
+ * @example
+ * ```ts
+ * @Http.controller('/auth')
+ * @RateLimit({ window: 60_000, max: 10 })
+ * class AuthController {
+ * 	@Http.post('/otp')
+ * 	@RateLimit({ window: 60_000, max: 3, name: 'otp' })
+ * 	public sendOtp() {}
+ * }
+ * ```
+ */
+export declare const RateLimit: (limit: RateLimitOptions | false) => (target: object, propertyKey?: string | symbol, _descriptor?: PropertyDescriptor) => void;
+/**
+ * The limit `@RateLimit()` sets on a route, else on its controller.
+ * @author Axel Nana <axel.nana@workbud.com>
+ * @param controller The controller class.
+ * @param method The name of the route method.
+ */
+export declare const rateLimitOf: (controller: Function, method: string | symbol) => RateLimitOptions | false | undefined;
+/**
+ * Counts a hit against a limit, sets the `RateLimit-*` headers, and throws once the limit is
+ * exceeded.
+ * @author Axel Nana <axel.nana@workbud.com>
+ * @param limit The limit.
+ * @param appStore The store of the application, used when the limit sets none.
+ * @param context The request: its context, client address and route.
+ * @throws {TooManyRequestsError} When the key went over the limit in the current window.
+ */
+export declare const enforceRateLimit: (limit: RateLimitOptions, appStore: RateLimitStore | undefined, context: RateLimitKeyContext & {
+    set: {
+        headers: Record<string, string | number>;
+    };
+}) => Promise<void>;
+export {};

package/dist/resource.d.ts

@@ -0,0 +1,77 @@
+import type { TSchema } from 'typebox';
+/**
+ * The response schemas of a route: one schema, or one per status code.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type ResponseSchemas = TSchema | Record<number, TSchema>;
+export declare namespace Resource {
+    /**
+     * Marks a field of a response schema as hidden: it is dropped from responses and from the
+     * OpenAPI document, even when the handler returns it.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param schema The schema of the field.
+     * @example
+     * ```ts
+     * const UserResource = t.Object({ id: t.String(), passwordHash: Resource.hidden(t.String()) });
+     * ```
+     */
+    const hidden: <S extends TSchema>(schema: S) => S;
+    /** Whether a schema was marked with {@link hidden}. */
+    const isHidden: (schema: unknown) => boolean;
+    /**
+     * The schema clients see: hidden fields removed, and codecs replaced by the schema of their
+     * encoded value, since responses are serialized before they are validated.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param schema The response schema.
+     */
+    const project: <S extends TSchema>(schema: S) => S;
+    /**
+     * Projects every schema of a route's `response` option.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param response The `response` option: one schema, or one per status code.
+     */
+    const projectResponse: (response: ResponseSchemas) => ResponseSchemas;
+    /**
+     * The schema of the successful response: the schema itself, or the 200 (else the first 2xx)
+     * one of a status map.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param response The `response` option of a route.
+     */
+    const successSchema: (response: ResponseSchemas) => TSchema | undefined;
+    /**
+     * Options of {@link serialize}.
+     * @author Axel Nana <axel.nana@workbud.com>
+     */
+    type SerializeOptions = {
+        /**
+         * The fields to keep, from a sparse fieldset (`?fields=id,title`). Applies to a top-level
+         * object, to each item of a top-level array, and to the items of a `data` array.
+         */
+        fields?: string[];
+    };
+    /**
+     * Turns a handler result into the body its response schema describes:
+     *
+     * - fields the schema does not declare are stripped, and hidden fields are dropped;
+     * - a `Date` becomes an ISO string (`YYYY-MM-DD` when the schema's format is `date`), and an
+     *   object with a `toJSON()` method, such as a luxon `DateTime`, becomes what it returns;
+     * - `fields` keeps only the selected fields.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param schema The response schema.
+     * @param value The handler result.
+     * @param options The sparse fieldset.
+     * @throws {BadRequestError} A 400 problem when `fields` names a field the schema does not have.
+     */
+    const serialize: (schema: TSchema, value: unknown, options?: SerializeOptions) => unknown;
+}
+/**
+ * Whether a handler result is a body to serialize, rather than a response the handler built
+ * itself (a `Response`, a thrown or returned status, a stream).
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export declare const isSerializable: (value: unknown) => boolean;
+/**
+ * Reads a sparse fieldset from a query: `fields=id,title` (or repeated `fields`).
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export declare const readFields: (query: Record<string, unknown> | undefined) => string[] | undefined;

package/dist/runtime.d.ts

@@ -0,0 +1,148 @@
+import type { AnyElysia } from 'elysia';
+import { ElysiumError } from './errors';
+/**
+ * The process signals the application shuts down on.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type ShutdownSignal = 'SIGINT' | 'SIGTERM';
+/**
+ * A server started by {@link Runtime.serve}, closed when the application shuts down.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type ServeHandle = {
+    /** Stops accepting connections and resolves once the server is closed. */
+    close(): Promise<void> | void;
+};
+/**
+ * The host-specific operations the framework needs. Core never calls a host API directly
+ * (`Bun.*`, `process.exit`, a server's `listen`): it asks the current runtime.
+ *
+ * Implementations ship as packages: `@elysiumjs/runtime-bun`, `@elysiumjs/runtime-node` and
+ * `@elysiumjs/runtime-workers`. Set one with the `runtime` option of `@Application.register()`
+ * or with {@link Runtime.use}.
+ *
+ * The runtime is process-wide: the last application constructed wins.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+/**
+ * The level of a line written to the console.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type OutputLevel = 'trace' | 'debug' | 'info' | 'warn' | 'error' | 'fatal';
+export interface Runtime {
+    /** A short name for the runtime, used in error messages. */
+    readonly name: string;
+    /** The raw environment variables, before validation. */
+    env(): Record<string, string | undefined>;
+    /**
+     * Waits for the given duration.
+     * @param ms The duration, in milliseconds.
+     */
+    sleep(ms: number): Promise<void>;
+    /**
+     * Starts serving the app on the given port.
+     * @param app The root Elysia app.
+     * @param port The port to listen on.
+     * @returns A handle that closes the server, when stopping the Elysia app does not.
+     * @throws {RuntimeNotSupportedError} On runtimes where the host owns the server.
+     */
+    serve(app: AnyElysia, port: number): ServeHandle | void;
+    /**
+     * Ends the process with the given exit code. A no-op on runtimes without a process.
+     * @param code The exit code.
+     */
+    exit(code: number): void;
+    /**
+     * Calls `handler` when the process is asked to stop.
+     * @param handler The handler to call.
+     * @returns A function that removes the handler.
+     */
+    onShutdown(handler: () => void): () => void;
+    /**
+     * The command line arguments after the script. Empty on runtimes without a command line.
+     */
+    argv(): readonly string[];
+    /**
+     * Writes text to the standard output or error stream. Runtimes without streams write to
+     * the console instead.
+     * @param stream The stream to write to.
+     * @param text The text to write, as is.
+     * @param level The level of the text, for runtimes whose console keeps one per line, such as
+     * Cloudflare Workers.
+     */
+    write(stream: 'stdout' | 'stderr', text: string, level?: OutputLevel): void;
+    /**
+     * The interactive terminal, or `undefined` on runtimes without one.
+     */
+    terminal(): RuntimeTerminal | undefined;
+    /**
+     * The address of the client that sent a request, as the host sees it (before any proxy
+     * headers), or `undefined` when unknown.
+     * @param request The request.
+     */
+    clientAddress?(request: Request): string | undefined;
+}
+/**
+ * An interactive terminal, as exposed by a runtime.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export interface RuntimeTerminal {
+    /** The stream user input is read from. */
+    input: NodeJS.ReadableStream;
+    /** The stream output is written to. */
+    output: NodeJS.WritableStream;
+    /**
+     * Turns raw mode on or off on the input, when supported.
+     * @param on Whether raw mode is on.
+     */
+    setRawMode?(on: boolean): void;
+    /** Clears the screen. */
+    clear(): void;
+    /**
+     * Moves the cursor relative to its current position.
+     * @param x The columns to move by.
+     * @param y The rows to move by.
+     */
+    moveCursor(x: number, y: number): void;
+    /** Clears the current line and moves the cursor to its start. */
+    clearLine(): void;
+}
+/**
+ * Thrown when a feature needs a host API the current runtime does not have.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export declare class RuntimeNotSupportedError extends ElysiumError {
+    constructor(feature: string, runtime: string, hint?: string);
+}
+/**
+ * Thrown when the framework needs the runtime before one was set.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export declare class RuntimeNotConfiguredError extends ElysiumError {
+    constructor();
+}
+export declare namespace Runtime {
+    /**
+     * Gets the runtime in use.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @throws {RuntimeNotConfiguredError} When no runtime was set.
+     */
+    const get: () => Runtime;
+    /**
+     * Gets the runtime in use, or `undefined` when none was set.
+     * @author Axel Nana <axel.nana@workbud.com>
+     */
+    const find: () => Runtime | undefined;
+    /**
+     * Sets the runtime to use. The runtime is process-wide: when several applications are
+     * constructed, the last one to set a runtime wins.
+     * @author Axel Nana <axel.nana@workbud.com>
+     * @param runtime The runtime to use.
+     */
+    const use: (runtime: Runtime) => void;
+    /**
+     * Forgets the runtime in use.
+     * @author Axel Nana <axel.nana@workbud.com>
+     */
+    const reset: () => void;
+}

package/dist/security.d.ts

@@ -0,0 +1,159 @@
+import type { AnyElysia } from 'elysia';
+import { ElysiumError } from './errors';
+/**
+ * Cross-origin resource sharing options.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type CorsOptions = {
+    /**
+     * The allowed origins: `*`, one origin, a list, a pattern, or a function of the origin and the
+     * request.
+     */
+    origin: string | string[] | RegExp | ((origin: string, request: Request) => boolean);
+    /** The allowed methods. Defaults to GET, HEAD, PUT, PATCH, POST and DELETE. */
+    methods?: string[];
+    /** The allowed request headers. Defaults to the headers the preflight asks for. */
+    allowedHeaders?: string[];
+    /** The response headers the browser may read. */
+    exposedHeaders?: string[];
+    /** Whether to allow cookies and authorization headers. Not allowed with `origin: '*'`. */
+    credentials?: boolean;
+    /** How long the browser may cache a preflight answer, in seconds. */
+    maxAge?: number;
+};
+/**
+ * Security response headers. `true` sends the default of a header, `false` or omitting it sends
+ * nothing, and a string sends that value.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type SecurityHeadersOptions = {
+    /** No default: an API serving JSON rarely needs one. */
+    contentSecurityPolicy?: string | false;
+    /** `max-age=15552000; includeSubDomains`, only sent on HTTPS requests. */
+    strictTransportSecurity?: string | boolean;
+    /** `nosniff`. */
+    xContentTypeOptions?: boolean;
+    /** `no-referrer`. */
+    referrerPolicy?: string | boolean;
+    /** `same-origin`. */
+    crossOriginOpenerPolicy?: string | boolean;
+    /** `same-origin`. */
+    crossOriginResourcePolicy?: string | boolean;
+    /** `DENY`. */
+    xFrameOptions?: string | boolean;
+};
+/**
+ * The HTTP options of an application, set with `http` on `@Application.register()`.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export type HttpOptions = {
+    /** Cross-origin resource sharing. Off unless set. */
+    cors?: CorsOptions | false;
+    /** Security headers: `true` for the defaults, or per header. */
+    headers?: SecurityHeadersOptions | boolean;
+    /**
+     * The largest request body the app parses, in bytes. Defaults to 1 MiB. Counted while reading,
+     * so it holds for chunked bodies and on every runtime. `false` turns it off.
+     */
+    bodyLimit?: number | false;
+    /**
+     * Which proxies to trust for the client address and protocol (`ctx.ip`, HSTS): `true` trusts
+     * every hop, a number trusts that many hops, and a list trusts those addresses.
+     */
+    trustProxy?: boolean | number | string[];
+};
+/** The default body limit: 1 MiB. */
+export declare const DEFAULT_BODY_LIMIT: number;
+declare const PayloadTooLargeError_base: {
+    new (detail?: string, options?: import("./problem").DomainErrorOptions): {
+        name: string;
+        message: string;
+        stack?: string;
+        cause?: unknown;
+        value?(): import("elysia/types").MaybePromise<unknown>;
+        readonly code: "PAYLOAD_TOO_LARGE";
+        readonly status: 413;
+        readonly detail: string | undefined;
+        readonly title: string;
+        readonly errors: readonly import("./problem").ProblemValidationError[] | undefined;
+        readonly retryAfterSeconds: number | undefined;
+        readonly extensions: Readonly<Record<string, unknown>>;
+        readonly headers: Record<string, string> | undefined;
+        get type(): string;
+        extension(): Record<string, unknown>;
+    };
+    isError(error: unknown): error is Error;
+    isError(value: unknown): value is Error;
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+    prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+    stackTraceLimit: number;
+    id<const Type extends string>(code: Type): import("elysia").TaggedHTTPError<Type>;
+    id<const Type extends string, const S extends number | keyof import("elysia").StatusMap>(code: Type, status: S): import("elysia").TaggedHTTPError<Type, {
+        readonly status: S extends keyof import("elysia").StatusMap ? import("elysia").StatusMap[S] : S;
+    }>;
+    typeBase?: string;
+    for<const C extends import("./problem").ProblemCode, const S extends number>(code: C, status: S): {
+        new (detail?: string, options?: import("./problem").DomainErrorOptions): {
+            name: string;
+            message: string;
+            stack?: string;
+            cause?: unknown;
+            value?(): import("elysia/types").MaybePromise<unknown>;
+            readonly code: C;
+            readonly status: S;
+            readonly detail: string | undefined;
+            readonly title: string;
+            readonly errors: readonly import("./problem").ProblemValidationError[] | undefined;
+            readonly retryAfterSeconds: number | undefined;
+            readonly extensions: Readonly<Record<string, unknown>>;
+            readonly headers: Record<string, string> | undefined;
+            get type(): string;
+            extension(): Record<string, unknown>;
+        };
+        isError(error: unknown): error is Error;
+        isError(value: unknown): value is Error;
+        captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+        captureStackTrace(targetObject: object, constructorOpt?: Function): void;
+        prepareStackTrace(err: Error, stackTraces: NodeJS.CallSite[]): any;
+        stackTraceLimit: number;
+        id<const Type extends string>(code: Type): import("elysia").TaggedHTTPError<Type>;
+        id<const Type extends string, const S_1 extends number | keyof import("elysia").StatusMap>(code: Type, status: S_1): import("elysia").TaggedHTTPError<Type, {
+            readonly status: S_1 extends keyof import("elysia").StatusMap ? import("elysia").StatusMap[S_1] : S_1;
+        }>;
+        typeBase?: string;
+        for<const C extends import("./problem").ProblemCode, const S extends number>(code: C, status: S): /*elided*/ any;
+    };
+};
+/**
+ * Raised when a request body is larger than the body limit. Rendered as a 413 problem.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export declare class PayloadTooLargeError extends PayloadTooLargeError_base {
+    readonly limit: number;
+    constructor(limit: number);
+}
+/**
+ * Thrown at startup when CORS allows every origin with credentials, which browsers refuse.
+ * @author Axel Nana <axel.nana@workbud.com>
+ */
+export declare class InvalidCorsOptionsError extends ElysiumError {
+    constructor();
+}
+/**
+ * The client address of a request, from the trusted proxy headers or the runtime.
+ * @author Axel Nana <axel.nana@workbud.com>
+ * @param request The request.
+ * @param trustProxy Which proxies to trust.
+ */
+export declare const clientAddress: (request: Request, trustProxy: HttpOptions['trustProxy']) => string | undefined;
+/**
+ * Registers the HTTP security hooks of an application on its root Elysia app: CORS, security
+ * headers, the body limit and the client address (`ctx.ip`).
+ * @author Axel Nana <axel.nana@workbud.com>
+ * @param app The root Elysia app.
+ * @param options The `http` option of the application.
+ * @throws {InvalidCorsOptionsError} When CORS allows every origin with credentials.
+ */
+export declare const applyHttpSecurity: (app: AnyElysia, options?: HttpOptions) => void;
+export {};