alepha 0.13.0 → 0.13.2

package/dist/server-links/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["user: UserAccountToken | undefined","ownership: boolean | string | undefined","$: VirtualAction<T>","WebStream","envSchema","remote: ServerRemote","name","url","permissions: Permission[] | undefined","permissionMap: Map<string, Permission> | undefined","userLinks: ApiLink[]"],"sources":["../../src/server-security/providers/ServerBasicAuthProvider.ts","../../src/server-security/descriptors/$basicAuth.ts","../../src/server-security/providers/ServerSecurityProvider.ts","../../src/server-security/index.ts","../../src/server-links/schemas/apiLinksResponseSchema.ts","../../src/server-links/providers/LinkProvider.ts","../../src/server-links/descriptors/$client.ts","../../src/server-links/descriptors/$remote.ts","../../src/server-proxy/descriptors/$proxy.ts","../../src/server-proxy/providers/ServerProxyProvider.ts","../../src/server-proxy/index.ts","../../src/server-links/providers/RemoteDescriptorProvider.ts","../../src/server-links/providers/ServerLinksProvider.ts","../../src/server-links/index.ts"],"sourcesContent":["import { timingSafeEqual } from \"node:crypto\";\nimport { $hook, $inject, Alepha } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport {\n  HttpError,\n  type ServerRequest,\n  ServerRouterProvider,\n} from \"alepha/server\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface BasicAuthOptions {\n  username: string;\n  password: string;\n}\n\nexport interface BasicAuthDescriptorConfig extends BasicAuthOptions {\n  /** Name identifier for this basic auth (default: property key) */\n  name?: string;\n  /** Path patterns to match (supports wildcards like /devtools/*) */\n  paths?: string[];\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class ServerBasicAuthProvider {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly log = $logger();\n  protected readonly routerProvider = $inject(ServerRouterProvider);\n  protected readonly realm = \"Secure Area\";\n\n  /**\n   * Registered basic auth descriptors with their configurations\n   */\n  public readonly registeredAuths: BasicAuthDescriptorConfig[] = [];\n\n  /**\n   * Register a basic auth configuration (called by descriptors)\n   */\n  public registerAuth(config: BasicAuthDescriptorConfig): void {\n    this.registeredAuths.push(config);\n  }\n\n  public readonly onStart = $hook({\n    on: \"start\",\n    handler: async () => {\n      for (const auth of this.registeredAuths) {\n        if (auth.paths) {\n          for (const pattern of auth.paths) {\n            const matchedRoutes = this.routerProvider.getRoutes(pattern);\n            for (const route of matchedRoutes) {\n              route.secure = {\n                basic: {\n                  username: auth.username,\n                  password: auth.password,\n                },\n              };\n            }\n          }\n        }\n      }\n\n      if (this.registeredAuths.length > 0) {\n        this.log.info(\n          `Initialized with ${this.registeredAuths.length} registered basic-auth configurations.`,\n        );\n      }\n    },\n  });\n\n  /**\n   * Hook into server:onRequest to check basic auth\n   */\n  public readonly onRequest = $hook({\n    on: \"server:onRequest\",\n    handler: async ({ route, request }) => {\n      const routeAuth = route.secure;\n      if (\n        typeof routeAuth === \"object\" &&\n        \"basic\" in routeAuth &&\n        routeAuth.basic\n      ) {\n        this.checkAuth(request, routeAuth.basic);\n      }\n    },\n  });\n\n  /**\n   * Hook into action:onRequest to check basic auth for actions\n   */\n  public readonly onActionRequest = $hook({\n    on: \"action:onRequest\",\n    handler: async ({ action, request }) => {\n      const routeAuth = action.route.secure;\n      if (isBasicAuth(routeAuth)) {\n        this.checkAuth(request, routeAuth.basic);\n      }\n    },\n  });\n\n  /**\n   * Check basic authentication\n   */\n  public checkAuth(request: ServerRequest, options: BasicAuthOptions): void {\n    const authHeader = request.headers?.authorization;\n\n    if (!authHeader || !authHeader.startsWith(\"Basic \")) {\n      this.sendAuthRequired(request);\n      throw new HttpError({\n        status: 401,\n        message: \"Authentication required\",\n      });\n    }\n\n    // decode base64 credentials\n    const base64Credentials = authHeader.slice(6); // Remove \"Basic \"\n    const credentials = Buffer.from(base64Credentials, \"base64\").toString(\n      \"utf-8\",\n    );\n\n    // split only on the first colon to handle passwords with colons\n    const colonIndex = credentials.indexOf(\":\");\n    const username =\n      colonIndex !== -1 ? credentials.slice(0, colonIndex) : credentials;\n    const password = colonIndex !== -1 ? credentials.slice(colonIndex + 1) : \"\";\n\n    // verify credentials using timing-safe comparison to prevent timing attacks\n    const isValid = this.timingSafeCredentialCheck(\n      username,\n      password,\n      options.username,\n      options.password,\n    );\n\n    if (!isValid) {\n      this.sendAuthRequired(request);\n      this.log.warn(`Failed basic auth attempt for user`, {\n        username,\n      });\n      throw new HttpError({\n        status: 401,\n        message: \"Invalid credentials\",\n      });\n    }\n  }\n\n  /**\n   * Performs a timing-safe comparison of credentials to prevent timing attacks.\n   * Always compares both username and password to avoid leaking which one is wrong.\n   */\n  protected timingSafeCredentialCheck(\n    inputUsername: string,\n    inputPassword: string,\n    expectedUsername: string,\n    expectedPassword: string,\n  ): boolean {\n    // Convert to buffers for timing-safe comparison\n    const inputUserBuf = Buffer.from(inputUsername, \"utf-8\");\n    const expectedUserBuf = Buffer.from(expectedUsername, \"utf-8\");\n    const inputPassBuf = Buffer.from(inputPassword, \"utf-8\");\n    const expectedPassBuf = Buffer.from(expectedPassword, \"utf-8\");\n\n    // timingSafeEqual requires same-length buffers\n    // When lengths differ, we compare against a dummy buffer to maintain constant time\n    const userMatch = this.safeCompare(inputUserBuf, expectedUserBuf);\n    const passMatch = this.safeCompare(inputPassBuf, expectedPassBuf);\n\n    // Both must match - bitwise AND avoids short-circuit evaluation\n    // eslint-disable-next-line no-bitwise\n    return (userMatch & passMatch) === 1;\n  }\n\n  /**\n   * Compares two buffers in constant time, handling different lengths safely.\n   * Returns 1 if equal, 0 if not equal.\n   */\n  protected safeCompare(input: Buffer, expected: Buffer): number {\n    // If lengths differ, compare input against itself to maintain timing\n    // but return 0 (not equal)\n    if (input.length !== expected.length) {\n      // Still perform a comparison to keep timing consistent\n      timingSafeEqual(input, input);\n      return 0;\n    }\n\n    return timingSafeEqual(input, expected) ? 1 : 0;\n  }\n\n  /**\n   * Send WWW-Authenticate header\n   */\n  protected sendAuthRequired(request: ServerRequest): void {\n    request.reply.setHeader(\"WWW-Authenticate\", `Basic realm=\"${this.realm}\"`);\n  }\n}\n\nexport const isBasicAuth = (\n  value: unknown,\n): value is { basic: BasicAuthOptions } => {\n  return (\n    typeof value === \"object\" && !!value && \"basic\" in value && !!value.basic\n  );\n};\n","import { $inject, createDescriptor, Descriptor, KIND } from \"alepha\";\nimport type { ServerRequest } from \"alepha/server\";\nimport type {\n  BasicAuthDescriptorConfig,\n  BasicAuthOptions,\n} from \"../providers/ServerBasicAuthProvider.ts\";\nimport { ServerBasicAuthProvider } from \"../providers/ServerBasicAuthProvider.ts\";\n\n/**\n * Declares HTTP Basic Authentication for server routes.\n * This descriptor provides methods to protect routes with username/password authentication.\n */\nexport const $basicAuth = (\n  options: BasicAuthDescriptorConfig,\n): AbstractBasicAuthDescriptor => {\n  return createDescriptor(BasicAuthDescriptor, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface AbstractBasicAuthDescriptor {\n  readonly name: string;\n  readonly options: BasicAuthDescriptorConfig;\n  check(request: ServerRequest, options?: BasicAuthOptions): void;\n}\n\nexport class BasicAuthDescriptor\n  extends Descriptor<BasicAuthDescriptorConfig>\n  implements AbstractBasicAuthDescriptor\n{\n  protected readonly serverBasicAuthProvider = $inject(ServerBasicAuthProvider);\n\n  public get name(): string {\n    return this.options.name ?? `${this.config.propertyKey}`;\n  }\n\n  protected onInit() {\n    // Register this auth configuration with the provider\n    this.serverBasicAuthProvider.registerAuth(this.options);\n  }\n\n  /**\n   * Checks basic auth for the given request using this descriptor's configuration.\n   */\n  public check(request: ServerRequest, options?: BasicAuthOptions): void {\n    const mergedOptions = { ...this.options, ...options };\n    this.serverBasicAuthProvider.checkAuth(request, mergedOptions);\n  }\n}\n\n$basicAuth[KIND] = BasicAuthDescriptor;\n","import { randomUUID } from \"node:crypto\";\nimport { $hook, $inject, Alepha } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport {\n  JwtProvider,\n  type Permission,\n  SecurityProvider,\n  type UserAccountToken,\n  userAccountInfoSchema,\n} from \"alepha/security\";\nimport {\n  $action,\n  ForbiddenError,\n  type ServerRequest,\n  UnauthorizedError,\n} from \"alepha/server\";\nimport {\n  type BasicAuthOptions,\n  isBasicAuth,\n} from \"./ServerBasicAuthProvider.ts\";\n\nexport class ServerSecurityProvider {\n  protected readonly log = $logger();\n  protected readonly securityProvider = $inject(SecurityProvider);\n  protected readonly jwtProvider = $inject(JwtProvider);\n  protected readonly alepha = $inject(Alepha);\n\n  protected readonly onConfigure = $hook({\n    on: \"configure\",\n    handler: async () => {\n      for (const action of this.alepha.descriptors($action)) {\n        // -------------------------------------------------------------------------------------------------------------\n        // if the action is disabled or not secure, we do NOT create a permission for it\n        // -------------------------------------------------------------------------------------------------------------\n        if (\n          action.options.disabled ||\n          action.options.secure === false ||\n          this.securityProvider.getRealms().length === 0\n        ) {\n          continue;\n        }\n\n        const secure = action.options.secure;\n        if (typeof secure !== \"object\") {\n          this.securityProvider.createPermission({\n            name: action.name,\n            group: action.group,\n            method: action.route.method,\n            path: action.route.path,\n          });\n        }\n      }\n    },\n  });\n\n  // -------------------------------------------------------------------------------------------------------------------\n\n  protected readonly onActionRequest = $hook({\n    on: \"action:onRequest\",\n    handler: async ({ action, request, options }) => {\n      // if you set explicitly secure: false, we assume you don't want any security check\n      // but only if no user is provided in options\n      if (action.options.secure === false && !options.user) {\n        this.log.trace(\"Skipping security check for route\");\n        return;\n      }\n\n      if (isBasicAuth(action.route.secure)) {\n        return;\n      }\n\n      const permission = this.securityProvider\n        .getPermissions()\n        .find(\n          (it) =>\n            it.path === action.route.path && it.method === action.route.method,\n        );\n\n      try {\n        request.user = this.createUserFromLocalFunctionContext(\n          options,\n          permission,\n        );\n\n        const route = action.route;\n        if (typeof route.secure === \"object\") {\n          this.check(request.user, route.secure);\n        }\n\n        this.alepha.state.set(\n          \"alepha.server.request.user\",\n          this.alepha.codec.decode(userAccountInfoSchema, request.user),\n        );\n      } catch (error) {\n        if (action.options.secure || permission) {\n          throw error;\n        }\n        // else, we skip the security check\n        this.log.trace(\"Skipping security check for action\");\n      }\n    },\n  });\n\n  protected readonly onRequest = $hook({\n    on: \"server:onRequest\",\n    priority: \"last\",\n    handler: async ({ request, route }) => {\n      // if you set explicitly secure: false, we assume you don't want any security check\n      if (route.secure === false) {\n        this.log.trace(\n          \"Skipping security check for route - explicitly disabled\",\n        );\n        return;\n      }\n\n      if (isBasicAuth(route.secure)) {\n        return;\n      }\n\n      const permission = this.securityProvider\n        .getPermissions()\n        .find((it) => it.path === route.path && it.method === route.method);\n\n      if (!request.headers.authorization && !route.secure && !permission) {\n        this.log.trace(\n          \"Skipping security check for route - no authorization header and not secure\",\n        );\n        return;\n      }\n\n      try {\n        // set user to request\n        request.user = await this.securityProvider.createUserFromToken(\n          request.headers.authorization,\n          { permission },\n        );\n\n        if (typeof route.secure === \"object\") {\n          this.check(request.user, route.secure);\n        }\n\n        this.alepha.state.set(\n          \"alepha.server.request.user\",\n          // remove sensitive info\n          this.alepha.codec.decode(userAccountInfoSchema, request.user),\n        );\n\n        this.log.trace(\"User set from request token\", {\n          user: request.user,\n          permission,\n        });\n      } catch (error) {\n        if (route.secure || permission) {\n          throw error;\n        }\n\n        // else, we skip the security check\n        this.log.trace(\n          \"Skipping security check for route - error occurred\",\n          error,\n        );\n      }\n    },\n  });\n\n  // -------------------------------------------------------------------------------------------------------------------\n\n  protected check(user: UserAccountToken, secure: ServerRouteSecure) {\n    if (secure.realm) {\n      if (user.realm !== secure.realm) {\n        throw new ForbiddenError(\n          `User must belong to realm '${secure.realm}' to access this route`,\n        );\n      }\n    }\n  }\n\n  /**\n   * Get the user account token for a local action call.\n   * There are three possible sources for the user:\n   * - `options.user`: the user passed in the options\n   * - `\"system\"`: the system user from the state (you MUST set state `server.security.system.user`)\n   * - `\"context\"`: the user from the request context (you MUST be in an HTTP request context)\n   *\n   * Priority order: `options.user` > `\"system\"` > `\"context\"`.\n   *\n   * In testing environment, if no user is provided, a test user is created based on the SecurityProvider's roles.\n   */\n  protected createUserFromLocalFunctionContext(\n    options: { user?: UserAccountToken | \"system\" | \"context\" },\n    permission?: Permission,\n  ): UserAccountToken {\n    const fromOptions =\n      typeof options.user === \"object\" ? options.user : undefined;\n\n    const type = typeof options.user === \"string\" ? options.user : undefined;\n\n    let user: UserAccountToken | undefined;\n\n    const fromContext = this.alepha.context.get<ServerRequest>(\"request\")?.user;\n    const fromSystem = this.alepha.state.get(\n      \"alepha.server.security.system.user\",\n    );\n\n    if (type === \"system\") {\n      user = fromSystem;\n    } else if (type === \"context\") {\n      user = fromContext;\n    } else {\n      user = fromOptions ?? fromContext ?? fromSystem;\n    }\n\n    if (!user) {\n      // in testing mode, we create a test user\n      if (this.alepha.isTest() && !(\"user\" in options)) {\n        return this.createTestUser();\n      }\n\n      throw new UnauthorizedError(\"User is required for calling this action\");\n    }\n\n    const roles =\n      user.roles ??\n      (this.alepha.isTest()\n        ? this.securityProvider.getRoles().map((role) => role.name)\n        : []);\n    let ownership: boolean | string | undefined;\n\n    if (permission) {\n      const result = this.securityProvider.checkPermission(\n        permission,\n        ...roles,\n      );\n      if (!result.isAuthorized) {\n        throw new ForbiddenError(\n          `Permission '${this.securityProvider.permissionToString(permission)}' is required for this route`,\n        );\n      }\n      ownership = result.ownership;\n    }\n\n    // create a new user object with ownership if needed\n    return {\n      ...user,\n      ownership,\n    };\n  }\n\n  // ---------------------------------------------------------------------------------------------------------------\n  // TESTING ONLY\n  // ---------------------------------------------------------------------------------------------------------------\n\n  protected createTestUser(): UserAccountToken {\n    return {\n      id: randomUUID(),\n      name: \"Test\",\n      roles: this.securityProvider.getRoles().map((role) => role.name),\n    };\n  }\n\n  protected readonly onClientRequest = $hook({\n    on: \"client:onRequest\",\n    handler: async ({ request, options }) => {\n      if (!this.alepha.isTest()) {\n        return;\n      }\n\n      // skip helper if user is explicitly set to undefined\n      if (\"user\" in options && options.user === undefined) {\n        return;\n      }\n\n      request.headers = new Headers(request.headers);\n\n      if (!request.headers.has(\"authorization\")) {\n        const test = this.createTestUser();\n        const user =\n          typeof options?.user === \"object\" ? options.user : undefined;\n        const sub = user?.id ?? test.id;\n        const roles = user?.roles ?? test.roles;\n\n        const token = await this.jwtProvider.create(\n          {\n            sub,\n            roles,\n          },\n          user?.realm ?? this.securityProvider.getRealms()[0]?.name,\n        );\n\n        request.headers.set(\"authorization\", `Bearer ${token}`);\n      }\n    },\n  });\n}\n\nexport type ServerRouteSecure = {\n  realm?: string;\n  basic?: BasicAuthOptions;\n};\n","import { $module } from \"alepha\";\nimport {\n  $permission,\n  $realm,\n  $role,\n  AlephaSecurity,\n  type UserAccount,\n  type UserAccountToken,\n} from \"alepha/security\";\nimport { AlephaServer, type FetchOptions } from \"alepha/server\";\nimport { $basicAuth } from \"./descriptors/$basicAuth.ts\";\nimport { ServerBasicAuthProvider } from \"./providers/ServerBasicAuthProvider.ts\";\nimport {\n  type ServerRouteSecure,\n  ServerSecurityProvider,\n} from \"./providers/ServerSecurityProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./descriptors/$basicAuth.ts\";\nexport * from \"./providers/ServerBasicAuthProvider.ts\";\nexport * from \"./providers/ServerSecurityProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\ndeclare module \"alepha\" {\n  interface State {\n    /**\n     * Real (or fake) user account, used for internal actions.\n     *\n     * If you define this, you assume that all actions are executed by this user by default.\n     * > To force a different user, you need to pass it explicitly in the options.\n     */\n\n    \"alepha.server.security.system.user\"?: UserAccountToken;\n\n    /**\n     * The authenticated user account attached to the server request state.\n     *\n     * @internal\n     */\n    \"alepha.server.request.user\"?: UserAccount;\n  }\n}\n\ndeclare module \"alepha/server\" {\n  interface ServerRequest<TConfig> {\n    user?: UserAccountToken; // for all routes, user is maybe present\n  }\n\n  interface ServerActionRequest<TConfig> {\n    user: UserAccountToken; // for actions, user is always present\n  }\n\n  interface ServerRoute {\n    /**\n     * If true, the route will be protected by the security provider.\n     * All actions are secure by default, but you can disable it for specific actions.\n     */\n    secure?: boolean | ServerRouteSecure;\n  }\n\n  interface ClientRequestOptions extends FetchOptions {\n    /**\n     * Forward user from the previous request.\n     * If \"system\", use system user. @see {ServerSecurityProvider.localSystemUser}\n     * If \"context\", use the user from the current context (e.g. request).\n     *\n     * @default \"system\" if provided, else \"context\" if available.\n     */\n    user?: UserAccountToken | \"system\" | \"context\";\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Plugin for Alepha Server that provides security features. Based on the Alepha Security module.\n *\n * By default, all $action will be guarded by a permission check.\n *\n * @see {@link ServerSecurityProvider}\n * @module alepha.server.security\n */\nexport const AlephaServerSecurity = $module({\n  name: \"alepha.server.security\",\n  descriptors: [$realm, $role, $permission, $basicAuth],\n  services: [\n    AlephaServer,\n    AlephaSecurity,\n    ServerSecurityProvider,\n    ServerBasicAuthProvider,\n  ],\n});\n","import type { Static } from \"alepha\";\nimport { t } from \"alepha\";\n\nexport const apiLinkSchema = t.object({\n  name: t.text({\n    description: \"Name of the API link, used for identification.\",\n  }),\n\n  group: t.optional(\n    t.text({\n      description:\n        \"Group to which the API link belongs, used for categorization.\",\n    }),\n  ),\n\n  path: t.text({\n    description: \"Pathname used to access the API link.\",\n  }),\n\n  method: t.optional(\n    t.text({\n      description:\n        \"HTTP method used for the API link, e.g., GET, POST, etc. If not specified, defaults to GET.\",\n    }),\n  ),\n\n  requestBodyType: t.optional(\n    t.text({\n      description:\n        \"Type of the request body for the API link. Default is application/json for POST/PUT/PATCH, null for others.\",\n    }),\n  ),\n\n  service: t.optional(\n    t.text({\n      description:\n        \"Service name associated with the API link, used for service discovery.\",\n    }),\n  ),\n});\n\nexport const apiLinksResponseSchema = t.object({\n  prefix: t.optional(t.text()),\n  links: t.array(apiLinkSchema),\n});\n\nexport type ApiLinksResponse = Static<typeof apiLinksResponseSchema>;\nexport type ApiLink = Static<typeof apiLinkSchema>;\n","import { $inject, Alepha, AlephaError, type Async, t } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport {\n  type ActionDescriptor,\n  type ClientRequestEntry,\n  type ClientRequestOptions,\n  type ClientRequestResponse,\n  type FetchResponse,\n  HttpClient,\n  type RequestConfigSchema,\n  ServerReply,\n  type ServerRequest,\n  type ServerRequestConfigEntry,\n  type ServerResponseBody,\n  UnauthorizedError,\n} from \"alepha/server\";\nimport type { ServerRouteSecure } from \"alepha/server/security\";\nimport {\n  type ApiLink,\n  apiLinksResponseSchema,\n} from \"../schemas/apiLinksResponseSchema.ts\";\n\n/**\n * Browser, SSR friendly, service to handle links.\n */\nexport class LinkProvider {\n  static path = {\n    apiLinks: \"/api/_links\",\n    apiSchema: \"/api/_links/:name/schema\",\n  };\n\n  protected readonly log = $logger();\n  protected readonly alepha = $inject(Alepha);\n  protected readonly httpClient = $inject(HttpClient);\n\n  // all server links (local + remote)\n  // THIS IS NOT USER LINKS! (which are filtered by permissions)\n  protected serverLinks: Array<HttpClientLink> = [];\n\n  /**\n   * Get applicative links registered on the server.\n   * This does not include lazy-loaded remote links.\n   */\n  public getServerLinks(): HttpClientLink[] {\n    if (this.alepha.isBrowser()) {\n      this.log.warn(\n        \"Getting server links in the browser is not supported. Use `fetchLinks` to get links from the server.\",\n      );\n      return [];\n    }\n\n    return this.serverLinks;\n  }\n\n  /**\n   * Register a new link for the application.\n   */\n  public registerLink(link: HttpClientLink): void {\n    if (this.alepha.isBrowser()) {\n      this.log.warn(\n        \"Registering links in the browser is not supported. Use `fetchLinks` to get links from the server.\",\n      );\n      return;\n    }\n\n    if (!link.handler && !link.host) {\n      throw new AlephaError(\n        \"Can't create link - 'handler' or 'host' is required\",\n      );\n    }\n\n    if (this.serverLinks.some((l) => l.name === link.name)) {\n      // remove existing link with the same name\n      this.serverLinks = this.serverLinks.filter((l) => l.name !== link.name);\n    }\n\n    this.serverLinks.push(link);\n  }\n\n  public get links(): HttpClientLink[] {\n    // TODO: not performant at all, use a map instead for ServerLinks\n    const apiLinks = this.alepha.state.get(\n      \"alepha.server.request.apiLinks\",\n    )?.links;\n    if (apiLinks) {\n      if (this.alepha.isBrowser()) {\n        return apiLinks;\n      }\n\n      const links = [];\n      for (const link of apiLinks) {\n        const originalLink = this.serverLinks.find((l) => l.name === link.name);\n        if (originalLink) {\n          links.push(originalLink);\n        }\n      }\n      return links;\n    }\n\n    return this.serverLinks ?? [];\n  }\n\n  /**\n   * Force browser to refresh links from the server.\n   */\n  public async fetchLinks(): Promise<HttpClientLink[]> {\n    const { data } = await this.httpClient.fetch(\n      `${LinkProvider.path.apiLinks}`,\n      {\n        method: \"GET\",\n        schema: {\n          response: apiLinksResponseSchema,\n        },\n      },\n    );\n\n    this.alepha.state.set(\"alepha.server.request.apiLinks\", data);\n\n    return data.links;\n  }\n\n  /**\n   * Create a virtual client that can be used to call actions.\n   *\n   * Use js Proxy under the hood.\n   */\n  public client<T extends object>(\n    scope: ClientScope = {},\n  ): HttpVirtualClient<T> {\n    return new Proxy<HttpVirtualClient<T>>({} as HttpVirtualClient<T>, {\n      get: (_, prop) => {\n        if (typeof prop !== \"string\") {\n          return;\n        }\n\n        return this.createVirtualAction<RequestConfigSchema>(prop, scope);\n      },\n    });\n  }\n\n  /**\n   * Check if a link with the given name exists.\n   * @param name\n   */\n  public can(name: string): boolean {\n    return this.links.some((link) => link.name === name);\n  }\n\n  /**\n   * Resolve a link by its name and call it.\n   * - If link is local, it will call the local handler.\n   * - If link is remote, it will make a fetch request to the remote server.\n   */\n  public async follow(\n    name: string,\n    config: Partial<ServerRequestConfigEntry> = {},\n    options: ClientRequestOptions & ClientScope = {},\n  ): Promise<any> {\n    this.log.trace(\"Following link\", { name, config, options });\n    const link = await this.getLinkByName(name, options);\n\n    // if a handler is defined, use it (ssr)\n    if (link.handler && !options.request) {\n      this.log.trace(\"Local link found\", { name });\n      return link.handler(\n        {\n          method: link.method,\n          url: new URL(`http://localhost${link.path}`),\n          query: config.query ?? {},\n          body: config.body ?? {},\n          params: config.params ?? {},\n          headers: config.headers ?? {},\n          metadata: {},\n          reply: new ServerReply(),\n        } as Partial<ServerRequest> as ServerRequest,\n        options,\n      );\n    }\n\n    this.log.trace(\"Remote link found\", {\n      name,\n      host: link.host,\n      service: link.service,\n    });\n\n    return this.followRemote(link, config, options).then(\n      (response) => response.data,\n    );\n  }\n\n  protected createVirtualAction<T extends RequestConfigSchema>(\n    name: string,\n    scope: ClientScope = {},\n  ): VirtualAction<T> {\n    const $: VirtualAction<T> = async (\n      config: any = {},\n      options: ClientRequestOptions = {},\n    ) => {\n      return this.follow(name, config, {\n        ...scope,\n        ...options,\n      });\n    };\n\n    Object.defineProperty($, \"name\", {\n      value: name,\n      writable: false,\n    });\n\n    $.run = async (config: any = {}, options: ClientRequestOptions = {}) => {\n      return this.follow(name, config, {\n        ...scope,\n        ...options,\n      });\n    };\n\n    $.fetch = async (config: any = {}, options: ClientRequestOptions = {}) => {\n      const link = await this.getLinkByName(name, scope);\n      return this.followRemote(link, config, options);\n    };\n\n    $.can = () => {\n      return this.can(name);\n    };\n\n    return $;\n  }\n\n  protected async followRemote(\n    link: HttpClientLink,\n    config: Partial<ServerRequestConfigEntry> = {},\n    options: ClientRequestOptions = {},\n  ): Promise<FetchResponse> {\n    options.request ??= {};\n    options.request.headers = new Headers(options.request.headers);\n\n    const als = this.alepha.context.get<ServerRequest>(\"request\");\n    if (als?.headers.authorization) {\n      options.request.headers.set(\"authorization\", als.headers.authorization);\n    }\n\n    const context = this.alepha.context.get(\"context\");\n    if (typeof context === \"string\") {\n      options.request.headers.set(\"x-request-id\", context);\n    }\n\n    const action = {\n      ...link,\n      // schema is not used in the client,\n      // we assume that typescript will check\n      schema: {\n        body: t.any(),\n        response: t.any(),\n      },\n    };\n\n    // prefix with service when host is not defined (e.g. browser)\n    if (!link.host && link.service) {\n      action.path = `/${link.service}${action.path}`;\n    }\n\n    action.path = `${action.prefix ?? \"/api\"}${action.path}`;\n    action.prefix = undefined; // prefix is not used in the client\n\n    // else, make a request\n    return this.httpClient.fetchAction({\n      host: link.host,\n      config,\n      options,\n      action: action as any, // schema.body TAny is not accepted\n    });\n  }\n\n  protected async getLinkByName(\n    name: string,\n    options: ClientScope = {},\n  ): Promise<HttpClientLink> {\n    if (\n      this.alepha.isBrowser() &&\n      !this.alepha.state.get(\"alepha.server.request.apiLinks\")\n    ) {\n      await this.fetchLinks();\n    }\n\n    const link = this.links.find(\n      (a) =>\n        a.name === name &&\n        (!options.group || a.group === options.group) &&\n        (!options.service || options.service === a.service),\n    );\n\n    if (!link) {\n      const error = new UnauthorizedError(`Action ${name} not found.`);\n      // mimic http error handling\n      await this.alepha.events.emit(\"client:onError\", {\n        route: link,\n        error,\n      });\n      throw error;\n    }\n\n    if (options.hostname) {\n      return {\n        ...link,\n        host: options.hostname,\n      };\n    }\n\n    return link;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface HttpClientLink extends ApiLink {\n  secured?: boolean | ServerRouteSecure;\n  prefix?: string;\n  // -- server only --\n  // only for remote actions\n  host?: string;\n  service?: string;\n  // used only for local actions, not for remote actions\n  schema?: RequestConfigSchema;\n  handler?: (\n    request: ServerRequest,\n    options: ClientRequestOptions,\n  ) => Async<ServerResponseBody>;\n}\n\nexport interface ClientScope {\n  group?: string;\n  service?: string;\n  hostname?: string;\n}\n\nexport type HttpVirtualClient<T> = {\n  [K in keyof T as T[K] extends ActionDescriptor<RequestConfigSchema>\n    ? K\n    : never]: T[K] extends ActionDescriptor<infer Schema>\n    ? VirtualAction<Schema>\n    : never;\n};\n\nexport interface VirtualAction<T extends RequestConfigSchema>\n  extends Pick<ActionDescriptor<T>, \"name\" | \"run\" | \"fetch\"> {\n  (\n    config?: ClientRequestEntry<T>,\n    opts?: ClientRequestOptions,\n  ): Promise<ClientRequestResponse<T>>;\n  can: () => boolean;\n}\n","import { $inject, KIND } from \"alepha\";\nimport {\n  type ClientScope,\n  type HttpVirtualClient,\n  LinkProvider,\n} from \"../providers/LinkProvider.ts\";\n\n/**\n * Create a new client.\n */\nexport const $client = <T extends object>(\n  scope?: ClientScope,\n): HttpVirtualClient<T> => {\n  return $inject(LinkProvider).client<T>(scope);\n};\n\n$client[KIND] = \"$client\";\n","import { createDescriptor, Descriptor, KIND } from \"alepha\";\nimport type { ServiceAccountDescriptor } from \"alepha/security\";\nimport type { ProxyDescriptorOptions } from \"alepha/server/proxy\";\n\n/**\n * $remote is a descriptor that allows you to define remote service access.\n *\n * Use it only when you have 2 or more services that need to communicate with each other.\n *\n * All remote services can be exposed as actions, ... or not.\n *\n * You can add a service account if you want to use a security layer.\n */\nexport const $remote = (options: RemoteDescriptorOptions) => {\n  return createDescriptor(RemoteDescriptor, options);\n};\n\nexport interface RemoteDescriptorOptions {\n  /**\n   * The URL of the remote service.\n   * You can use a function to generate the URL dynamically.\n   * You probably should use $env(env) to get the URL from the environment.\n   *\n   * @example\n   * ```ts\n   * import { $remote } from \"alepha/server\";\n   * import { $inject, t } from \"alepha\";\n   *\n   * class App {\n   *   env = $env(t.object({\n   *     REMOTE_URL: t.text({default: \"http://localhost:3000\"}),\n   *   }));\n   *   remote = $remote({\n   *     url: this.env.REMOTE_URL,\n   *   });\n   * }\n   * ```\n   */\n  url: string | (() => string);\n\n  /**\n   * The name of the remote service.\n   *\n   * @default Member of the class containing the remote service.\n   */\n  name?: string;\n\n  /**\n   * If true, all methods of the remote service will be exposed as actions in this context.\n   * > Note: Proxy will never use the service account, it just... proxies the request.\n   */\n  proxy?:\n    | boolean\n    | Partial<\n        ProxyDescriptorOptions & {\n          /**\n           * If true, the remote service won't be available internally, only through the proxy.\n           */\n          noInternal: boolean;\n        }\n      >;\n\n  /**\n   * For communication between the server and the remote service with a security layer.\n   * This will be used for internal communication and will not be exposed to the client.\n   */\n  serviceAccount?: ServiceAccountDescriptor;\n}\n\nexport class RemoteDescriptor extends Descriptor<RemoteDescriptorOptions> {\n  public get name(): string {\n    return this.options.name ?? this.config.propertyKey;\n  }\n}\n\n$remote[KIND] = RemoteDescriptor;\n","import { type Async, createDescriptor, Descriptor, KIND } from \"alepha\";\nimport type { ServerRequest } from \"alepha/server\";\n\n/**\n * Creates a proxy descriptor to forward requests to another server.\n *\n * This descriptor enables you to create reverse proxy functionality, allowing your Alepha server\n * to forward requests to other services while maintaining a unified API surface. It's particularly\n * useful for microservice architectures, API gateways, or when you need to aggregate multiple\n * services behind a single endpoint.\n *\n * **Key Features**\n *\n * - **Path-based routing**: Match specific paths or patterns to proxy\n * - **Dynamic targets**: Support both static and dynamic target resolution\n * - **Request/Response hooks**: Modify requests before forwarding and responses after receiving\n * - **URL rewriting**: Transform URLs before forwarding to the target\n * - **Conditional proxying**: Enable/disable proxies based on environment or conditions\n *\n * @example\n * **Basic proxy setup:**\n * ```ts\n * import { $proxy } from \"alepha/server/proxy\";\n *\n * class ApiGateway {\n *   // Forward all /api/* requests to external service\n *   api = $proxy({\n *     path: \"/api/*\",\n *     target: \"https://api.example.com\"\n *   });\n * }\n * ```\n *\n * @example\n * **Dynamic target with environment-based routing:**\n * ```ts\n * class ApiGateway {\n *   // Route to different environments based on configuration\n *   api = $proxy({\n *     path: \"/api/*\",\n *     target: () => process.env.NODE_ENV === \"production\"\n *       ? \"https://api.prod.example.com\"\n *       : \"https://api.dev.example.com\"\n *   });\n * }\n * ```\n *\n * @example\n * **Advanced proxy with request/response modification:**\n * ```ts\n * class SecureProxy {\n *   secure = $proxy({\n *     path: \"/secure/*\",\n *     target: \"https://secure-api.example.com\",\n *     beforeRequest: async (request, proxyRequest) => {\n *       // Add authentication headers\n *       proxyRequest.headers = {\n *         ...proxyRequest.headers,\n *         'Authorization': `Bearer ${await getServiceToken()}`,\n *         'X-Forwarded-For': request.headers['x-forwarded-for'] || request.ip\n *       };\n *     },\n *     afterResponse: async (request, proxyResponse) => {\n *       // Log response for monitoring\n *       console.log(`Proxied ${request.url} -> ${proxyResponse.status}`);\n *     },\n *     rewrite: (url) => {\n *       // Remove /secure prefix when forwarding\n *       url.pathname = url.pathname.replace('/secure', '');\n *     }\n *   });\n * }\n * ```\n *\n * @example\n * **Conditional proxy based on feature flags:**\n * ```ts\n * class FeatureProxy {\n *   newApi = $proxy({\n *     path: \"/v2/*\",\n *     target: \"https://new-api.example.com\",\n *     disabled: !process.env.ENABLE_V2_API // Disable if feature flag is off\n *   });\n * }\n * ```\n */\nexport const $proxy = (options: ProxyDescriptorOptions): ProxyDescriptor => {\n  return createDescriptor(ProxyDescriptor, options);\n};\n\nexport type ProxyDescriptorOptions = {\n  /**\n   * Path pattern to match for proxying requests.\n   *\n   * Supports wildcards and path parameters:\n   * - `/api/*` - Matches all paths starting with `/api/`\n   * - `/api/v1/*` - Matches all paths starting with `/api/v1/`\n   * - `/users/:id` - Matches `/users/123`, `/users/abc`, etc.\n   *\n   * @example \"/api/*\"\n   * @example \"/secure/admin/*\"\n   * @example \"/users/:id/posts\"\n   */\n  path: string;\n\n  /**\n   * Target URL to which matching requests should be forwarded.\n   *\n   * Can be either:\n   * - **Static string**: A fixed URL like `\"https://api.example.com\"`\n   * - **Dynamic function**: A function that returns the URL, enabling runtime target resolution\n   *\n   * The target URL will be combined with the remaining path from the original request.\n   *\n   * @example \"https://api.example.com\"\n   * @example () => process.env.API_URL || \"http://localhost:3001\"\n   */\n  target: string | (() => string);\n\n  /**\n   * Whether this proxy is disabled.\n   *\n   * When `true`, requests matching the path will not be proxied and will be handled\n   * by other routes or return 404. Useful for feature toggles or conditional proxying.\n   *\n   * @default false\n   * @example !process.env.ENABLE_PROXY\n   */\n  disabled?: boolean;\n\n  /**\n   * Hook called before forwarding the request to the target server.\n   *\n   * Use this to:\n   * - Add authentication headers\n   * - Modify request headers or body\n   * - Add request tracking/logging\n   * - Transform the request before forwarding\n   *\n   * @param request - The original incoming server request\n   * @param proxyRequest - The request that will be sent to the target (modifiable)\n   *\n   * @example\n   * ```ts\n   * beforeRequest: async (request, proxyRequest) => {\n   *   proxyRequest.headers = {\n   *     ...proxyRequest.headers,\n   *     'Authorization': `Bearer ${await getToken()}`,\n   *     'X-Request-ID': generateRequestId()\n   *   };\n   * }\n   * ```\n   */\n  beforeRequest?: (\n    request: ServerRequest,\n    proxyRequest: RequestInit,\n  ) => Async<void>;\n\n  /**\n   * Hook called after receiving the response from the target server.\n   *\n   * Use this to:\n   * - Log response details for monitoring\n   * - Add custom headers to the response\n   * - Transform response data\n   * - Handle error responses\n   *\n   * @param request - The original incoming server request\n   * @param proxyResponse - The response received from the target server\n   *\n   * @example\n   * ```ts\n   * afterResponse: async (request, proxyResponse) => {\n   *   console.log(`Proxy ${request.method} ${request.url} -> ${proxyResponse.status}`);\n   *\n   *   if (!proxyResponse.ok) {\n   *     await logError(`Proxy error: ${proxyResponse.status}`, { request, response: proxyResponse });\n   *   }\n   * }\n   * ```\n   */\n  afterResponse?: (\n    request: ServerRequest,\n    proxyResponse: Response,\n  ) => Async<void>;\n\n  /**\n   * Function to rewrite the URL before sending to the target server.\n   *\n   * Use this to:\n   * - Remove or add path prefixes\n   * - Transform path parameters\n   * - Modify query parameters\n   * - Change the URL structure entirely\n   *\n   * The function receives a mutable URL object and should modify it in-place.\n   *\n   * @param url - The URL object to modify (mutable)\n   *\n   * @example\n   * ```ts\n   * // Remove /api prefix when forwarding\n   * rewrite: (url) => {\n   *   url.pathname = url.pathname.replace('/api', '');\n   * }\n   * ```\n   *\n   * @example\n   * ```ts\n   * // Add version prefix\n   * rewrite: (url) => {\n   *   url.pathname = `/v2${url.pathname}`;\n   * }\n   * ```\n   */\n  rewrite?: (url: URL) => void;\n\n  // TODO: Add retry functionality\n  // retry?: RetryOptions;\n};\n\nexport class ProxyDescriptor extends Descriptor<ProxyDescriptorOptions> {}\n\n$proxy[KIND] = ProxyDescriptor;\n","import { ReadableStream as WebStream } from \"node:stream/web\";\nimport { $hook, $inject, Alepha, AlephaError } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport {\n  routeMethods,\n  type ServerHandler,\n  type ServerRequest,\n  ServerRouterProvider,\n} from \"alepha/server\";\nimport { $proxy, type ProxyDescriptorOptions } from \"../descriptors/$proxy.ts\";\n\nexport class ServerProxyProvider {\n  protected readonly log = $logger();\n  protected readonly routerProvider = $inject(ServerRouterProvider);\n  protected readonly alepha = $inject(Alepha);\n\n  protected readonly configure = $hook({\n    on: \"configure\",\n    handler: () => {\n      for (const proxy of this.alepha.descriptors($proxy)) {\n        this.createProxy(proxy.options);\n      }\n    },\n  });\n\n  public createProxy(options: ProxyDescriptorOptions): void {\n    if (options.disabled) {\n      return;\n    }\n\n    const path = options.path;\n    const target =\n      typeof options.target === \"function\" ? options.target() : options.target;\n\n    if (!path.endsWith(\"/*\")) {\n      throw new AlephaError(\"Proxy path should end with '/*'\");\n    }\n\n    // Extract base path without /*\n    const handler = this.createProxyHandler(target, options);\n\n    for (const method of routeMethods) {\n      this.routerProvider.createRoute({\n        method,\n        path,\n        handler,\n      });\n    }\n\n    this.log.info(\"Proxying\", { path, target });\n  }\n\n  public createProxyHandler(\n    target: string,\n    options: Omit<ProxyDescriptorOptions, \"path\">,\n  ): ServerHandler {\n    return async (request) => {\n      const url = new URL(target + request.url.pathname);\n      if (request.url.search) {\n        url.search = request.url.search;\n      }\n\n      options.rewrite?.(url);\n\n      const requestInit = {\n        url: url.toString(),\n        method: request.method,\n        headers: {\n          ...request.headers,\n          \"accept-encoding\": \"identity\", // ignore compression\n        },\n        body: this.getRawRequestBody(request),\n      };\n\n      if (requestInit.body) {\n        (requestInit as any).duplex = \"half\";\n      }\n\n      if (options.beforeRequest) {\n        await options.beforeRequest(request, requestInit);\n      }\n\n      this.log.debug(\"Proxying request\", {\n        url: url.toString(),\n        method: request.method,\n        headers: request.headers,\n      });\n\n      const response = await fetch(requestInit.url, requestInit);\n\n      request.reply.status = response.status;\n      request.reply.headers = Object.fromEntries(response.headers.entries());\n      request.reply.body = response.body;\n\n      this.log.debug(\"Received response\", {\n        status: request.reply.status,\n        headers: request.reply.headers,\n      });\n\n      if (options.afterResponse) {\n        await options.afterResponse(request, response);\n      }\n    };\n  }\n\n  private getRawRequestBody(req: ServerRequest): ReadableStream | undefined {\n    const { method } = req;\n\n    if (method === \"GET\" || method === \"HEAD\" || method === \"OPTIONS\") {\n      return;\n    }\n\n    if (req.raw?.web?.req) {\n      return req.raw.web.req.body as ReadableStream;\n    }\n\n    if (req.raw?.node?.req) {\n      const nodeReq = req.raw.node.req;\n      return WebStream.from(nodeReq) as ReadableStream;\n    }\n  }\n}\n","import { $module } from \"alepha\";\nimport { AlephaServer } from \"alepha/server\";\nimport { $proxy } from \"./descriptors/$proxy.ts\";\nimport { ServerProxyProvider } from \"./providers/ServerProxyProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./descriptors/$proxy.ts\";\nexport * from \"./providers/ServerProxyProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Plugin for Alepha that provides a proxy server functionality.\n *\n * @see {@link $proxy}\n * @module alepha.server.proxy\n */\nexport const AlephaServerProxy = $module({\n  name: \"alepha.server.proxy\",\n  descriptors: [$proxy],\n  services: [AlephaServer, ServerProxyProvider],\n});\n","import { $env, $hook, $inject, Alepha, t } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport { $retry } from \"alepha/retry\";\nimport type { ServiceAccountDescriptor } from \"alepha/security\";\nimport { ServerProxyProvider } from \"alepha/server/proxy\";\nimport { $remote, type RemoteDescriptor } from \"../descriptors/$remote.ts\";\nimport {\n  type ApiLinksResponse,\n  apiLinksResponseSchema,\n} from \"../schemas/apiLinksResponseSchema.ts\";\nimport { LinkProvider } from \"./LinkProvider.ts\";\n\nconst envSchema = t.object({\n  SERVER_API_PREFIX: t.text({\n    description: \"Prefix for all API routes (e.g. $action).\",\n    default: \"/api\",\n  }),\n});\n\nexport class RemoteDescriptorProvider {\n  protected readonly env = $env(envSchema);\n  protected readonly alepha = $inject(Alepha);\n  protected readonly proxyProvider = $inject(ServerProxyProvider);\n  protected readonly linkProvider = $inject(LinkProvider);\n  protected readonly remotes: Array<ServerRemote> = [];\n  protected readonly log = $logger();\n\n  public getRemotes(): ServerRemote[] {\n    return this.remotes;\n  }\n\n  public readonly configure = $hook({\n    on: \"configure\",\n    handler: async () => {\n      const remotes = this.alepha.descriptors($remote);\n      for (const remote of remotes) {\n        await this.registerRemote(remote);\n      }\n    },\n  });\n\n  public readonly start = $hook({\n    on: \"start\",\n    handler: async () => {\n      for (const remote of this.remotes) {\n        const token =\n          typeof remote.serviceAccount?.token === \"function\"\n            ? await remote.serviceAccount.token()\n            : undefined;\n\n        if (!remote.internal) {\n          continue; // skip download links for remotes that are not internal\n        }\n\n        const { links } = await remote.links({ authorization: token });\n\n        for (const link of links) {\n          let path = link.path.replace(remote.prefix, \"\");\n          if (link.service) {\n            path = `/${link.service}${path}`;\n          }\n\n          this.linkProvider.registerLink({\n            ...link,\n            prefix: remote.prefix,\n            path,\n            method: link.method ?? \"GET\",\n            host: remote.url,\n            service: remote.name,\n          });\n        }\n\n        this.log.info(`Remote '${remote.name}' OK`, {\n          links: remote.links.length,\n          prefix: remote.prefix,\n        });\n      }\n    },\n  });\n\n  public async registerRemote(value: RemoteDescriptor): Promise<void> {\n    const options = value.options;\n    const url = typeof options.url === \"string\" ? options.url : options.url();\n    const linkPath = LinkProvider.path.apiLinks;\n    const name = value.name;\n    const proxy = typeof options.proxy === \"object\" ? options.proxy : {};\n\n    const remote: ServerRemote = {\n      url,\n      name,\n      prefix: \"/api\",\n      serviceAccount: options.serviceAccount,\n      proxy: !!options.proxy,\n      internal: !proxy.noInternal,\n      schema: async (opts) => {\n        const { authorization, name } = opts;\n        return await fetch(`${url}${linkPath}/${name}/schema`, {\n          headers: new Headers(\n            authorization\n              ? {\n                  authorization,\n                }\n              : {},\n          ),\n        }).then((it) => it.json()); // TODO: use schema validation for response\n      },\n      links: async (opts) => {\n        const { authorization } = opts;\n        const remoteApi = await this.fetchLinks.run({\n          service: name,\n          url: `${url}${linkPath}`,\n          authorization,\n        });\n\n        if (remoteApi.prefix != null) {\n          remote.prefix = remoteApi.prefix; // monkey patch the prefix, not ideal but works\n        }\n\n        return remoteApi;\n      },\n    };\n\n    this.remotes.push(remote);\n\n    if (options.proxy) {\n      this.proxyProvider.createProxy({\n        path: `${this.env.SERVER_API_PREFIX}/${name}/*`,\n        target: url,\n        rewrite: (url) => {\n          url.pathname = url.pathname.replace(\n            `${this.env.SERVER_API_PREFIX}/${name}`,\n            remote.prefix,\n          );\n        },\n        ...proxy,\n      });\n    }\n  }\n\n  protected readonly fetchLinks = $retry({\n    max: 10,\n    backoff: {\n      initial: 1000,\n    },\n    onError: (_, attempt, { service, url }) => {\n      this.log.warn(`Failed to fetch links, retry (${attempt})...`, {\n        service,\n        url,\n      });\n    },\n    handler: async (opts: FetchLinksOptions): Promise<ApiLinksResponse> => {\n      const { url, authorization } = opts;\n      const response = await fetch(url, {\n        headers: new Headers(\n          authorization\n            ? {\n                authorization,\n              }\n            : {},\n        ),\n      });\n\n      if (!response.ok) {\n        throw new Error(`Failed to fetch links from ${url}`);\n      }\n\n      return this.alepha.codec.decode(\n        apiLinksResponseSchema,\n        await response.json(),\n      );\n    },\n  });\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface FetchLinksOptions {\n  /**\n   * Name of the remote service.\n   */\n  service: string;\n\n  /**\n   * URL to fetch links from.\n   */\n  url: string;\n\n  /**\n   * Authorization header containing access token.\n   */\n  authorization?: string;\n}\n\nexport interface ServerRemote {\n  /**\n   * URL of the remote service.\n   */\n  url: string;\n\n  /**\n   * Name of the remote service.\n   */\n  name: string;\n\n  /**\n   * Expose links as endpoint. It's not only internal.\n   */\n  proxy: boolean;\n\n  /**\n   * It's only used inside the application.\n   */\n  internal: boolean;\n\n  /**\n   * Links fetcher.\n   */\n  links: (args: { authorization?: string }) => Promise<ApiLinksResponse>;\n\n  /**\n   * Fetches schema for the remote service.\n   */\n  schema: (args: { name: string; authorization?: string }) => Promise<any>;\n\n  /**\n   * Force a default access token provider when not provided.\n   */\n  serviceAccount?: ServiceAccountDescriptor;\n\n  /**\n   * Prefix for the remote service links.\n   */\n  prefix: string;\n}\n","import { $env, $hook, $inject, Alepha, t } from \"alepha\";\nimport {\n  type Permission,\n  SecurityProvider,\n  type UserAccountToken,\n} from \"alepha/security\";\nimport {\n  $action,\n  $route,\n  type ClientRequestEntry,\n  type ClientRequestOptions,\n  type RequestConfigSchema,\n  ServerTimingProvider,\n} from \"alepha/server\";\nimport {\n  type ApiLink,\n  type ApiLinksResponse,\n  apiLinksResponseSchema,\n} from \"../schemas/apiLinksResponseSchema.ts\";\nimport { LinkProvider } from \"./LinkProvider.ts\";\nimport { RemoteDescriptorProvider } from \"./RemoteDescriptorProvider.ts\";\n\nconst envSchema = t.object({\n  SERVER_API_PREFIX: t.text({\n    description: \"Prefix for all API routes (e.g. $action).\",\n    default: \"/api\",\n  }),\n});\n\nexport class ServerLinksProvider {\n  protected readonly env = $env(envSchema);\n  protected readonly alepha = $inject(Alepha);\n  protected readonly linkProvider = $inject(LinkProvider);\n  protected readonly remoteProvider = $inject(RemoteDescriptorProvider);\n  protected readonly serverTimingProvider = $inject(ServerTimingProvider);\n\n  public get prefix() {\n    return this.env.SERVER_API_PREFIX;\n  }\n\n  public readonly onRoute = $hook({\n    on: \"configure\",\n    handler: () => {\n      // convert all $action to local links\n      for (const action of this.alepha.descriptors($action)) {\n        this.linkProvider.registerLink({\n          name: action.name,\n          group: action.group,\n          schema: action.options.schema,\n          requestBodyType: action.getBodyContentType(),\n          secured: action.options.secure ?? true,\n          method: action.method === \"GET\" ? undefined : action.method,\n          prefix: action.prefix,\n          path: action.path,\n          // by local, we mean that it can be called directly via the handler\n          handler: (\n            config: ClientRequestEntry<RequestConfigSchema>,\n            options: ClientRequestOptions = {},\n          ) => action.run(config, options),\n        });\n      }\n    },\n  });\n\n  /**\n   * First API - Get all API links for the user.\n   *\n   * This is based on the user's permissions.\n   */\n  public readonly links = $route({\n    path: LinkProvider.path.apiLinks,\n    schema: {\n      response: apiLinksResponseSchema,\n    },\n    handler: ({ user, headers }) => {\n      return this.getUserApiLinks({\n        user,\n        authorization: headers.authorization,\n      });\n    },\n  });\n\n  /**\n   * Second API - Get schema for a specific API link.\n   *\n   * Note: Body/Response schema are not included in `links` API because it's TOO BIG.\n   * I mean for 150+ links, you got 50ms of serialization time.\n   */\n  public readonly schema = $route({\n    path: LinkProvider.path.apiSchema,\n    schema: {\n      params: t.object({\n        name: t.text(),\n      }),\n      response: t.json(),\n    },\n    handler: ({ params, user, headers }) => {\n      return this.getSchemaByName(params.name, {\n        user,\n        authorization: headers.authorization,\n      });\n    },\n  });\n\n  public async getSchemaByName(\n    name: string,\n    options: GetApiLinksOptions = {},\n  ): Promise<RequestConfigSchema> {\n    const authorization = options.authorization;\n    const api = await this.getUserApiLinks({\n      user: options.user,\n      authorization,\n    });\n\n    for (const link of api.links) {\n      if (link.name === name) {\n        if (link.service) {\n          // remote\n          return this.remoteProvider\n            .getRemotes()\n            .find((it) => it.name === link.service)\n            ?.schema({ name: name, authorization });\n        }\n\n        // local\n        return (\n          this.linkProvider.getServerLinks().find((it) => it.name === name)\n            ?.schema ?? {}\n        );\n      }\n    }\n\n    return {};\n  }\n\n  /**\n   * Retrieves API links for the user based on their permissions.\n   * Will check on local links and remote links.\n   */\n  public async getUserApiLinks(\n    options: GetApiLinksOptions,\n  ): Promise<ApiLinksResponse> {\n    const { user } = options;\n    let permissions: Permission[] | undefined;\n    let permissionMap: Map<string, Permission> | undefined;\n    const hasSecurity = this.alepha.has(SecurityProvider);\n    if (hasSecurity && user) {\n      permissions = this.alepha.inject(SecurityProvider).getPermissions(user);\n      permissionMap = new Map(\n        permissions.map((it) => [`${it.group}:${it.name}`, it]),\n      );\n    }\n\n    const userLinks: ApiLink[] = [];\n\n    // bonus: add permissions not related to $action\n    for (const permission of permissions ?? []) {\n      if (\n        !permission.path &&\n        !permission.method &&\n        permission.name &&\n        permission.group\n      ) {\n        userLinks.push({\n          path: \"\", // this is a placeholder for links without specific path\n          name: permission.name,\n          group: permission.group,\n        });\n      }\n    }\n\n    // add local links\n    for (const link of this.linkProvider.getServerLinks()) {\n      // SKIP REMOTE LINKS, remote links are handled separately for security\n      if (link.host) continue;\n\n      if (hasSecurity && link.secured) {\n        // skip secured links if user is not provided\n        if (!user) {\n          continue;\n        }\n\n        if (typeof link.secured === \"object\" && link.secured.realm) {\n          // realm check\n          if (user.realm !== link.secured.realm) {\n            continue;\n          }\n        } else if (permissionMap) {\n          // small permissions check, can be optimized later ... :')\n\n          if (!permissionMap.has(`${link.group}:${link.name}`)) {\n            continue;\n          }\n        }\n      }\n\n      userLinks.push({\n        name: link.name,\n        group: link.group,\n        requestBodyType: link.requestBodyType,\n        method: link.method,\n        path: link.path,\n      });\n    }\n\n    this.serverTimingProvider.beginTiming(\"fetchRemoteLinks\");\n    // this does not scale well, but it's working for now\n    // TODO: remote links can be cached by user.roles\n    const promises = this.remoteProvider\n      .getRemotes()\n      .filter((it) => it.proxy) // add only \"proxy\" remotes\n      .map(async (remote) => {\n        const { links, prefix } = await remote.links(options);\n        return links.map((link) => {\n          let path = link.path.replace(prefix ?? \"/api\", \"\");\n          if (link.service) {\n            path = `/${link.service}${path}`;\n          }\n\n          return {\n            ...link,\n            path,\n            proxy: true,\n            service: remote.name,\n          };\n        });\n      });\n\n    userLinks.push(...(await Promise.all(promises)).flat());\n    this.serverTimingProvider.endTiming(\"fetchRemoteLinks\");\n\n    return {\n      prefix: this.env.SERVER_API_PREFIX,\n      links: userLinks,\n    };\n  }\n}\n\nexport interface GetApiLinksOptions {\n  user?: UserAccountToken;\n  authorization?: string;\n}\n","import \"alepha/server/security\";\nimport { $module } from \"alepha\";\nimport { AlephaServer } from \"alepha/server\";\nimport { $client } from \"./descriptors/$client.ts\";\nimport { $remote } from \"./descriptors/$remote.ts\";\nimport { LinkProvider } from \"./providers/LinkProvider.ts\";\nimport { RemoteDescriptorProvider } from \"./providers/RemoteDescriptorProvider.ts\";\nimport { ServerLinksProvider } from \"./providers/ServerLinksProvider.ts\";\nimport type { ApiLinksResponse } from \"./schemas/apiLinksResponseSchema.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./descriptors/$client.ts\";\nexport * from \"./descriptors/$remote.ts\";\nexport * from \"./providers/LinkProvider.ts\";\nexport * from \"./providers/RemoteDescriptorProvider.ts\";\nexport * from \"./providers/ServerLinksProvider.ts\";\nexport * from \"./schemas/apiLinksResponseSchema.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\ndeclare module \"alepha\" {\n  interface State {\n    /**\n     * API links attached to the server request state.\n     *\n     * @see {@link ApiLinksResponse}\n     * @internal\n     */\n    \"alepha.server.request.apiLinks\"?: ApiLinksResponse;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Provides server-side link management and remote capabilities for client-server interactions.\n *\n * The server-links module enables declarative link definitions using `$remote` and `$client` descriptors,\n * facilitating seamless API endpoint management and client-server communication. It integrates with server\n * security features to ensure safe and controlled access to resources.\n *\n * @see {@link $remote}\n * @see {@link $client}\n * @module alepha.server.links\n */\nexport const AlephaServerLinks = $module({\n  name: \"alepha.server.links\",\n  descriptors: [$remote, $client],\n  services: [\n    AlephaServer,\n    ServerLinksProvider,\n    RemoteDescriptorProvider,\n    LinkProvider,\n  ],\n});\n"],"mappings":";;;;;;;;;AAyBA,IAAa,0BAAb,MAAqC;CACnC,AAAmB,SAAS,QAAQ,OAAO;CAC3C,AAAmB,MAAM,SAAS;CAClC,AAAmB,iBAAiB,QAAQ,qBAAqB;CACjE,AAAmB,QAAQ;;;;CAK3B,AAAgB,kBAA+C,EAAE;;;;CAKjE,AAAO,aAAa,QAAyC;AAC3D,OAAK,gBAAgB,KAAK,OAAO;;CAGnC,AAAgB,UAAU,MAAM;EAC9B,IAAI;EACJ,SAAS,YAAY;AACnB,QAAK,MAAM,QAAQ,KAAK,gBACtB,KAAI,KAAK,MACP,MAAK,MAAM,WAAW,KAAK,OAAO;IAChC,MAAM,gBAAgB,KAAK,eAAe,UAAU,QAAQ;AAC5D,SAAK,MAAM,SAAS,cAClB,OAAM,SAAS,EACb,OAAO;KACL,UAAU,KAAK;KACf,UAAU,KAAK;KAChB,EACF;;AAMT,OAAI,KAAK,gBAAgB,SAAS,EAChC,MAAK,IAAI,KACP,oBAAoB,KAAK,gBAAgB,OAAO,wCACjD;;EAGN,CAAC;;;;CAKF,AAAgB,YAAY,MAAM;EAChC,IAAI;EACJ,SAAS,OAAO,EAAE,OAAO,cAAc;GACrC,MAAM,YAAY,MAAM;AACxB,OACE,OAAO,cAAc,YACrB,WAAW,aACX,UAAU,MAEV,MAAK,UAAU,SAAS,UAAU,MAAM;;EAG7C,CAAC;;;;CAKF,AAAgB,kBAAkB,MAAM;EACtC,IAAI;EACJ,SAAS,OAAO,EAAE,QAAQ,cAAc;GACtC,MAAM,YAAY,OAAO,MAAM;AAC/B,OAAI,YAAY,UAAU,CACxB,MAAK,UAAU,SAAS,UAAU,MAAM;;EAG7C,CAAC;;;;CAKF,AAAO,UAAU,SAAwB,SAAiC;EACxE,MAAM,aAAa,QAAQ,SAAS;AAEpC,MAAI,CAAC,cAAc,CAAC,WAAW,WAAW,SAAS,EAAE;AACnD,QAAK,iBAAiB,QAAQ;AAC9B,SAAM,IAAI,UAAU;IAClB,QAAQ;IACR,SAAS;IACV,CAAC;;EAIJ,MAAM,oBAAoB,WAAW,MAAM,EAAE;EAC7C,MAAM,cAAc,OAAO,KAAK,mBAAmB,SAAS,CAAC,SAC3D,QACD;EAGD,MAAM,aAAa,YAAY,QAAQ,IAAI;EAC3C,MAAM,WACJ,eAAe,KAAK,YAAY,MAAM,GAAG,WAAW,GAAG;EACzD,MAAM,WAAW,eAAe,KAAK,YAAY,MAAM,aAAa,EAAE,GAAG;AAUzE,MAAI,CAPY,KAAK,0BACnB,UACA,UACA,QAAQ,UACR,QAAQ,SACT,EAEa;AACZ,QAAK,iBAAiB,QAAQ;AAC9B,QAAK,IAAI,KAAK,sCAAsC,EAClD,UACD,CAAC;AACF,SAAM,IAAI,UAAU;IAClB,QAAQ;IACR,SAAS;IACV,CAAC;;;;;;;CAQN,AAAU,0BACR,eACA,eACA,kBACA,kBACS;EAET,MAAM,eAAe,OAAO,KAAK,eAAe,QAAQ;EACxD,MAAM,kBAAkB,OAAO,KAAK,kBAAkB,QAAQ;EAC9D,MAAM,eAAe,OAAO,KAAK,eAAe,QAAQ;EACxD,MAAM,kBAAkB,OAAO,KAAK,kBAAkB,QAAQ;AAS9D,UALkB,KAAK,YAAY,cAAc,gBAAgB,GAC/C,KAAK,YAAY,cAAc,gBAAgB,MAI9B;;;;;;CAOrC,AAAU,YAAY,OAAe,UAA0B;AAG7D,MAAI,MAAM,WAAW,SAAS,QAAQ;AAEpC,mBAAgB,OAAO,MAAM;AAC7B,UAAO;;AAGT,SAAO,gBAAgB,OAAO,SAAS,GAAG,IAAI;;;;;CAMhD,AAAU,iBAAiB,SAA8B;AACvD,UAAQ,MAAM,UAAU,oBAAoB,gBAAgB,KAAK,MAAM,GAAG;;;AAI9E,MAAa,eACX,UACyC;AACzC,QACE,OAAO,UAAU,YAAY,CAAC,CAAC,SAAS,WAAW,SAAS,CAAC,CAAC,MAAM;;;;;;;;;AC5LxE,MAAa,cACX,YACgC;AAChC,QAAO,iBAAiB,qBAAqB,QAAQ;;AAWvD,IAAa,sBAAb,cACU,WAEV;CACE,AAAmB,0BAA0B,QAAQ,wBAAwB;CAE7E,IAAW,OAAe;AACxB,SAAO,KAAK,QAAQ,QAAQ,GAAG,KAAK,OAAO;;CAG7C,AAAU,SAAS;AAEjB,OAAK,wBAAwB,aAAa,KAAK,QAAQ;;;;;CAMzD,AAAO,MAAM,SAAwB,SAAkC;EACrE,MAAM,gBAAgB;GAAE,GAAG,KAAK;GAAS,GAAG;GAAS;AACrD,OAAK,wBAAwB,UAAU,SAAS,cAAc;;;AAIlE,WAAW,QAAQ;;;;AC7BnB,IAAa,yBAAb,MAAoC;CAClC,AAAmB,MAAM,SAAS;CAClC,AAAmB,mBAAmB,QAAQ,iBAAiB;CAC/D,AAAmB,cAAc,QAAQ,YAAY;CACrD,AAAmB,SAAS,QAAQ,OAAO;CAE3C,AAAmB,cAAc,MAAM;EACrC,IAAI;EACJ,SAAS,YAAY;AACnB,QAAK,MAAM,UAAU,KAAK,OAAO,YAAY,QAAQ,EAAE;AAIrD,QACE,OAAO,QAAQ,YACf,OAAO,QAAQ,WAAW,SAC1B,KAAK,iBAAiB,WAAW,CAAC,WAAW,EAE7C;AAIF,QAAI,OADW,OAAO,QAAQ,WACR,SACpB,MAAK,iBAAiB,iBAAiB;KACrC,MAAM,OAAO;KACb,OAAO,OAAO;KACd,QAAQ,OAAO,MAAM;KACrB,MAAM,OAAO,MAAM;KACpB,CAAC;;;EAIT,CAAC;CAIF,AAAmB,kBAAkB,MAAM;EACzC,IAAI;EACJ,SAAS,OAAO,EAAE,QAAQ,SAAS,cAAc;AAG/C,OAAI,OAAO,QAAQ,WAAW,SAAS,CAAC,QAAQ,MAAM;AACpD,SAAK,IAAI,MAAM,oCAAoC;AACnD;;AAGF,OAAI,YAAY,OAAO,MAAM,OAAO,CAClC;GAGF,MAAM,aAAa,KAAK,iBACrB,gBAAgB,CAChB,MACE,OACC,GAAG,SAAS,OAAO,MAAM,QAAQ,GAAG,WAAW,OAAO,MAAM,OAC/D;AAEH,OAAI;AACF,YAAQ,OAAO,KAAK,mCAClB,SACA,WACD;IAED,MAAM,QAAQ,OAAO;AACrB,QAAI,OAAO,MAAM,WAAW,SAC1B,MAAK,MAAM,QAAQ,MAAM,MAAM,OAAO;AAGxC,SAAK,OAAO,MAAM,IAChB,8BACA,KAAK,OAAO,MAAM,OAAO,uBAAuB,QAAQ,KAAK,CAC9D;YACM,OAAO;AACd,QAAI,OAAO,QAAQ,UAAU,WAC3B,OAAM;AAGR,SAAK,IAAI,MAAM,qCAAqC;;;EAGzD,CAAC;CAEF,AAAmB,YAAY,MAAM;EACnC,IAAI;EACJ,UAAU;EACV,SAAS,OAAO,EAAE,SAAS,YAAY;AAErC,OAAI,MAAM,WAAW,OAAO;AAC1B,SAAK,IAAI,MACP,0DACD;AACD;;AAGF,OAAI,YAAY,MAAM,OAAO,CAC3B;GAGF,MAAM,aAAa,KAAK,iBACrB,gBAAgB,CAChB,MAAM,OAAO,GAAG,SAAS,MAAM,QAAQ,GAAG,WAAW,MAAM,OAAO;AAErE,OAAI,CAAC,QAAQ,QAAQ,iBAAiB,CAAC,MAAM,UAAU,CAAC,YAAY;AAClE,SAAK,IAAI,MACP,6EACD;AACD;;AAGF,OAAI;AAEF,YAAQ,OAAO,MAAM,KAAK,iBAAiB,oBACzC,QAAQ,QAAQ,eAChB,EAAE,YAAY,CACf;AAED,QAAI,OAAO,MAAM,WAAW,SAC1B,MAAK,MAAM,QAAQ,MAAM,MAAM,OAAO;AAGxC,SAAK,OAAO,MAAM,IAChB,8BAEA,KAAK,OAAO,MAAM,OAAO,uBAAuB,QAAQ,KAAK,CAC9D;AAED,SAAK,IAAI,MAAM,+BAA+B;KAC5C,MAAM,QAAQ;KACd;KACD,CAAC;YACK,OAAO;AACd,QAAI,MAAM,UAAU,WAClB,OAAM;AAIR,SAAK,IAAI,MACP,sDACA,MACD;;;EAGN,CAAC;CAIF,AAAU,MAAM,MAAwB,QAA2B;AACjE,MAAI,OAAO,OACT;OAAI,KAAK,UAAU,OAAO,MACxB,OAAM,IAAI,eACR,8BAA8B,OAAO,MAAM,wBAC5C;;;;;;;;;;;;;;CAgBP,AAAU,mCACR,SACA,YACkB;EAClB,MAAM,cACJ,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;EAEpD,MAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;EAE/D,IAAIA;EAEJ,MAAM,cAAc,KAAK,OAAO,QAAQ,IAAmB,UAAU,EAAE;EACvE,MAAM,aAAa,KAAK,OAAO,MAAM,IACnC,qCACD;AAED,MAAI,SAAS,SACX,QAAO;WACE,SAAS,UAClB,QAAO;MAEP,QAAO,eAAe,eAAe;AAGvC,MAAI,CAAC,MAAM;AAET,OAAI,KAAK,OAAO,QAAQ,IAAI,EAAE,UAAU,SACtC,QAAO,KAAK,gBAAgB;AAG9B,SAAM,IAAI,kBAAkB,2CAA2C;;EAGzE,MAAM,QACJ,KAAK,UACJ,KAAK,OAAO,QAAQ,GACjB,KAAK,iBAAiB,UAAU,CAAC,KAAK,SAAS,KAAK,KAAK,GACzD,EAAE;EACR,IAAIC;AAEJ,MAAI,YAAY;GACd,MAAM,SAAS,KAAK,iBAAiB,gBACnC,YACA,GAAG,MACJ;AACD,OAAI,CAAC,OAAO,aACV,OAAM,IAAI,eACR,eAAe,KAAK,iBAAiB,mBAAmB,WAAW,CAAC,8BACrE;AAEH,eAAY,OAAO;;AAIrB,SAAO;GACL,GAAG;GACH;GACD;;CAOH,AAAU,iBAAmC;AAC3C,SAAO;GACL,IAAI,YAAY;GAChB,MAAM;GACN,OAAO,KAAK,iBAAiB,UAAU,CAAC,KAAK,SAAS,KAAK,KAAK;GACjE;;CAGH,AAAmB,kBAAkB,MAAM;EACzC,IAAI;EACJ,SAAS,OAAO,EAAE,SAAS,cAAc;AACvC,OAAI,CAAC,KAAK,OAAO,QAAQ,CACvB;AAIF,OAAI,UAAU,WAAW,QAAQ,SAAS,OACxC;AAGF,WAAQ,UAAU,IAAI,QAAQ,QAAQ,QAAQ;AAE9C,OAAI,CAAC,QAAQ,QAAQ,IAAI,gBAAgB,EAAE;IACzC,MAAM,OAAO,KAAK,gBAAgB;IAClC,MAAM,OACJ,OAAO,SAAS,SAAS,WAAW,QAAQ,OAAO;IACrD,MAAM,MAAM,MAAM,MAAM,KAAK;IAC7B,MAAM,QAAQ,MAAM,SAAS,KAAK;IAElC,MAAM,QAAQ,MAAM,KAAK,YAAY,OACnC;KACE;KACA;KACD,EACD,MAAM,SAAS,KAAK,iBAAiB,WAAW,CAAC,IAAI,KACtD;AAED,YAAQ,QAAQ,IAAI,iBAAiB,UAAU,QAAQ;;;EAG5D,CAAC;;;;;;;;;;;;;AChNJ,MAAa,uBAAuB,QAAQ;CAC1C,MAAM;CACN,aAAa;EAAC;EAAQ;EAAO;EAAa;EAAW;CACrD,UAAU;EACR;EACA;EACA;EACA;EACD;CACF,CAAC;;;;AC1FF,MAAa,gBAAgB,EAAE,OAAO;CACpC,MAAM,EAAE,KAAK,EACX,aAAa,kDACd,CAAC;CAEF,OAAO,EAAE,SACP,EAAE,KAAK,EACL,aACE,iEACH,CAAC,CACH;CAED,MAAM,EAAE,KAAK,EACX,aAAa,yCACd,CAAC;CAEF,QAAQ,EAAE,SACR,EAAE,KAAK,EACL,aACE,+FACH,CAAC,CACH;CAED,iBAAiB,EAAE,SACjB,EAAE,KAAK,EACL,aACE,+GACH,CAAC,CACH;CAED,SAAS,EAAE,SACT,EAAE,KAAK,EACL,aACE,0EACH,CAAC,CACH;CACF,CAAC;AAEF,MAAa,yBAAyB,EAAE,OAAO;CAC7C,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;CAC5B,OAAO,EAAE,MAAM,cAAc;CAC9B,CAAC;;;;;;;ACnBF,IAAa,eAAb,MAAa,aAAa;CACxB,OAAO,OAAO;EACZ,UAAU;EACV,WAAW;EACZ;CAED,AAAmB,MAAM,SAAS;CAClC,AAAmB,SAAS,QAAQ,OAAO;CAC3C,AAAmB,aAAa,QAAQ,WAAW;CAInD,AAAU,cAAqC,EAAE;;;;;CAMjD,AAAO,iBAAmC;AACxC,MAAI,KAAK,OAAO,WAAW,EAAE;AAC3B,QAAK,IAAI,KACP,uGACD;AACD,UAAO,EAAE;;AAGX,SAAO,KAAK;;;;;CAMd,AAAO,aAAa,MAA4B;AAC9C,MAAI,KAAK,OAAO,WAAW,EAAE;AAC3B,QAAK,IAAI,KACP,oGACD;AACD;;AAGF,MAAI,CAAC,KAAK,WAAW,CAAC,KAAK,KACzB,OAAM,IAAI,YACR,sDACD;AAGH,MAAI,KAAK,YAAY,MAAM,MAAM,EAAE,SAAS,KAAK,KAAK,CAEpD,MAAK,cAAc,KAAK,YAAY,QAAQ,MAAM,EAAE,SAAS,KAAK,KAAK;AAGzE,OAAK,YAAY,KAAK,KAAK;;CAG7B,IAAW,QAA0B;EAEnC,MAAM,WAAW,KAAK,OAAO,MAAM,IACjC,iCACD,EAAE;AACH,MAAI,UAAU;AACZ,OAAI,KAAK,OAAO,WAAW,CACzB,QAAO;GAGT,MAAM,QAAQ,EAAE;AAChB,QAAK,MAAM,QAAQ,UAAU;IAC3B,MAAM,eAAe,KAAK,YAAY,MAAM,MAAM,EAAE,SAAS,KAAK,KAAK;AACvE,QAAI,aACF,OAAM,KAAK,aAAa;;AAG5B,UAAO;;AAGT,SAAO,KAAK,eAAe,EAAE;;;;;CAM/B,MAAa,aAAwC;EACnD,MAAM,EAAE,SAAS,MAAM,KAAK,WAAW,MACrC,GAAG,aAAa,KAAK,YACrB;GACE,QAAQ;GACR,QAAQ,EACN,UAAU,wBACX;GACF,CACF;AAED,OAAK,OAAO,MAAM,IAAI,kCAAkC,KAAK;AAE7D,SAAO,KAAK;;;;;;;CAQd,AAAO,OACL,QAAqB,EAAE,EACD;AACtB,SAAO,IAAI,MAA4B,EAAE,EAA0B,EACjE,MAAM,GAAG,SAAS;AAChB,OAAI,OAAO,SAAS,SAClB;AAGF,UAAO,KAAK,oBAAyC,MAAM,MAAM;KAEpE,CAAC;;;;;;CAOJ,AAAO,IAAI,MAAuB;AAChC,SAAO,KAAK,MAAM,MAAM,SAAS,KAAK,SAAS,KAAK;;;;;;;CAQtD,MAAa,OACX,MACA,SAA4C,EAAE,EAC9C,UAA8C,EAAE,EAClC;AACd,OAAK,IAAI,MAAM,kBAAkB;GAAE;GAAM;GAAQ;GAAS,CAAC;EAC3D,MAAM,OAAO,MAAM,KAAK,cAAc,MAAM,QAAQ;AAGpD,MAAI,KAAK,WAAW,CAAC,QAAQ,SAAS;AACpC,QAAK,IAAI,MAAM,oBAAoB,EAAE,MAAM,CAAC;AAC5C,UAAO,KAAK,QACV;IACE,QAAQ,KAAK;IACb,KAAK,IAAI,IAAI,mBAAmB,KAAK,OAAO;IAC5C,OAAO,OAAO,SAAS,EAAE;IACzB,MAAM,OAAO,QAAQ,EAAE;IACvB,QAAQ,OAAO,UAAU,EAAE;IAC3B,SAAS,OAAO,WAAW,EAAE;IAC7B,UAAU,EAAE;IACZ,OAAO,IAAI,aAAa;IACzB,EACD,QACD;;AAGH,OAAK,IAAI,MAAM,qBAAqB;GAClC;GACA,MAAM,KAAK;GACX,SAAS,KAAK;GACf,CAAC;AAEF,SAAO,KAAK,aAAa,MAAM,QAAQ,QAAQ,CAAC,MAC7C,aAAa,SAAS,KACxB;;CAGH,AAAU,oBACR,MACA,QAAqB,EAAE,EACL;EAClB,MAAMC,IAAsB,OAC1B,SAAc,EAAE,EAChB,UAAgC,EAAE,KAC/B;AACH,UAAO,KAAK,OAAO,MAAM,QAAQ;IAC/B,GAAG;IACH,GAAG;IACJ,CAAC;;AAGJ,SAAO,eAAe,GAAG,QAAQ;GAC/B,OAAO;GACP,UAAU;GACX,CAAC;AAEF,IAAE,MAAM,OAAO,SAAc,EAAE,EAAE,UAAgC,EAAE,KAAK;AACtE,UAAO,KAAK,OAAO,MAAM,QAAQ;IAC/B,GAAG;IACH,GAAG;IACJ,CAAC;;AAGJ,IAAE,QAAQ,OAAO,SAAc,EAAE,EAAE,UAAgC,EAAE,KAAK;GACxE,MAAM,OAAO,MAAM,KAAK,cAAc,MAAM,MAAM;AAClD,UAAO,KAAK,aAAa,MAAM,QAAQ,QAAQ;;AAGjD,IAAE,YAAY;AACZ,UAAO,KAAK,IAAI,KAAK;;AAGvB,SAAO;;CAGT,MAAgB,aACd,MACA,SAA4C,EAAE,EAC9C,UAAgC,EAAE,EACV;AACxB,UAAQ,YAAY,EAAE;AACtB,UAAQ,QAAQ,UAAU,IAAI,QAAQ,QAAQ,QAAQ,QAAQ;EAE9D,MAAM,MAAM,KAAK,OAAO,QAAQ,IAAmB,UAAU;AAC7D,MAAI,KAAK,QAAQ,cACf,SAAQ,QAAQ,QAAQ,IAAI,iBAAiB,IAAI,QAAQ,cAAc;EAGzE,MAAM,UAAU,KAAK,OAAO,QAAQ,IAAI,UAAU;AAClD,MAAI,OAAO,YAAY,SACrB,SAAQ,QAAQ,QAAQ,IAAI,gBAAgB,QAAQ;EAGtD,MAAM,SAAS;GACb,GAAG;GAGH,QAAQ;IACN,MAAM,EAAE,KAAK;IACb,UAAU,EAAE,KAAK;IAClB;GACF;AAGD,MAAI,CAAC,KAAK,QAAQ,KAAK,QACrB,QAAO,OAAO,IAAI,KAAK,UAAU,OAAO;AAG1C,SAAO,OAAO,GAAG,OAAO,UAAU,SAAS,OAAO;AAClD,SAAO,SAAS;AAGhB,SAAO,KAAK,WAAW,YAAY;GACjC,MAAM,KAAK;GACX;GACA;GACQ;GACT,CAAC;;CAGJ,MAAgB,cACd,MACA,UAAuB,EAAE,EACA;AACzB,MACE,KAAK,OAAO,WAAW,IACvB,CAAC,KAAK,OAAO,MAAM,IAAI,iCAAiC,CAExD,OAAM,KAAK,YAAY;EAGzB,MAAM,OAAO,KAAK,MAAM,MACrB,MACC,EAAE,SAAS,SACV,CAAC,QAAQ,SAAS,EAAE,UAAU,QAAQ,WACtC,CAAC,QAAQ,WAAW,QAAQ,YAAY,EAAE,SAC9C;AAED,MAAI,CAAC,MAAM;GACT,MAAM,QAAQ,IAAI,kBAAkB,UAAU,KAAK,aAAa;AAEhE,SAAM,KAAK,OAAO,OAAO,KAAK,kBAAkB;IAC9C,OAAO;IACP;IACD,CAAC;AACF,SAAM;;AAGR,MAAI,QAAQ,SACV,QAAO;GACL,GAAG;GACH,MAAM,QAAQ;GACf;AAGH,SAAO;;;;;;;;;AC1SX,MAAa,WACX,UACyB;AACzB,QAAO,QAAQ,aAAa,CAAC,OAAU,MAAM;;AAG/C,QAAQ,QAAQ;;;;;;;;;;;;;ACHhB,MAAa,WAAW,YAAqC;AAC3D,QAAO,iBAAiB,kBAAkB,QAAQ;;AAuDpD,IAAa,mBAAb,cAAsC,WAAoC;CACxE,IAAW,OAAe;AACxB,SAAO,KAAK,QAAQ,QAAQ,KAAK,OAAO;;;AAI5C,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACWhB,MAAa,UAAU,YAAqD;AAC1E,QAAO,iBAAiB,iBAAiB,QAAQ;;AAsInD,IAAa,kBAAb,cAAqC,WAAmC;AAExE,OAAO,QAAQ;;;;ACpNf,IAAa,sBAAb,MAAiC;CAC/B,AAAmB,MAAM,SAAS;CAClC,AAAmB,iBAAiB,QAAQ,qBAAqB;CACjE,AAAmB,SAAS,QAAQ,OAAO;CAE3C,AAAmB,YAAY,MAAM;EACnC,IAAI;EACJ,eAAe;AACb,QAAK,MAAM,SAAS,KAAK,OAAO,YAAY,OAAO,CACjD,MAAK,YAAY,MAAM,QAAQ;;EAGpC,CAAC;CAEF,AAAO,YAAY,SAAuC;AACxD,MAAI,QAAQ,SACV;EAGF,MAAM,OAAO,QAAQ;EACrB,MAAM,SACJ,OAAO,QAAQ,WAAW,aAAa,QAAQ,QAAQ,GAAG,QAAQ;AAEpE,MAAI,CAAC,KAAK,SAAS,KAAK,CACtB,OAAM,IAAI,YAAY,kCAAkC;EAI1D,MAAM,UAAU,KAAK,mBAAmB,QAAQ,QAAQ;AAExD,OAAK,MAAM,UAAU,aACnB,MAAK,eAAe,YAAY;GAC9B;GACA;GACA;GACD,CAAC;AAGJ,OAAK,IAAI,KAAK,YAAY;GAAE;GAAM;GAAQ,CAAC;;CAG7C,AAAO,mBACL,QACA,SACe;AACf,SAAO,OAAO,YAAY;GACxB,MAAM,MAAM,IAAI,IAAI,SAAS,QAAQ,IAAI,SAAS;AAClD,OAAI,QAAQ,IAAI,OACd,KAAI,SAAS,QAAQ,IAAI;AAG3B,WAAQ,UAAU,IAAI;GAEtB,MAAM,cAAc;IAClB,KAAK,IAAI,UAAU;IACnB,QAAQ,QAAQ;IAChB,SAAS;KACP,GAAG,QAAQ;KACX,mBAAmB;KACpB;IACD,MAAM,KAAK,kBAAkB,QAAQ;IACtC;AAED,OAAI,YAAY,KACd,CAAC,YAAoB,SAAS;AAGhC,OAAI,QAAQ,cACV,OAAM,QAAQ,cAAc,SAAS,YAAY;AAGnD,QAAK,IAAI,MAAM,oBAAoB;IACjC,KAAK,IAAI,UAAU;IACnB,QAAQ,QAAQ;IAChB,SAAS,QAAQ;IAClB,CAAC;GAEF,MAAM,WAAW,MAAM,MAAM,YAAY,KAAK,YAAY;AAE1D,WAAQ,MAAM,SAAS,SAAS;AAChC,WAAQ,MAAM,UAAU,OAAO,YAAY,SAAS,QAAQ,SAAS,CAAC;AACtE,WAAQ,MAAM,OAAO,SAAS;AAE9B,QAAK,IAAI,MAAM,qBAAqB;IAClC,QAAQ,QAAQ,MAAM;IACtB,SAAS,QAAQ,MAAM;IACxB,CAAC;AAEF,OAAI,QAAQ,cACV,OAAM,QAAQ,cAAc,SAAS,SAAS;;;CAKpD,AAAQ,kBAAkB,KAAgD;EACxE,MAAM,EAAE,WAAW;AAEnB,MAAI,WAAW,SAAS,WAAW,UAAU,WAAW,UACtD;AAGF,MAAI,IAAI,KAAK,KAAK,IAChB,QAAO,IAAI,IAAI,IAAI,IAAI;AAGzB,MAAI,IAAI,KAAK,MAAM,KAAK;GACtB,MAAM,UAAU,IAAI,IAAI,KAAK;AAC7B,UAAOC,eAAU,KAAK,QAAQ;;;;;;;;;;;;;ACpGpC,MAAa,oBAAoB,QAAQ;CACvC,MAAM;CACN,aAAa,CAAC,OAAO;CACrB,UAAU,CAAC,cAAc,oBAAoB;CAC9C,CAAC;;;;ACVF,MAAMC,cAAY,EAAE,OAAO,EACzB,mBAAmB,EAAE,KAAK;CACxB,aAAa;CACb,SAAS;CACV,CAAC,EACH,CAAC;AAEF,IAAa,2BAAb,MAAsC;CACpC,AAAmB,MAAM,KAAKA,YAAU;CACxC,AAAmB,SAAS,QAAQ,OAAO;CAC3C,AAAmB,gBAAgB,QAAQ,oBAAoB;CAC/D,AAAmB,eAAe,QAAQ,aAAa;CACvD,AAAmB,UAA+B,EAAE;CACpD,AAAmB,MAAM,SAAS;CAElC,AAAO,aAA6B;AAClC,SAAO,KAAK;;CAGd,AAAgB,YAAY,MAAM;EAChC,IAAI;EACJ,SAAS,YAAY;GACnB,MAAM,UAAU,KAAK,OAAO,YAAY,QAAQ;AAChD,QAAK,MAAM,UAAU,QACnB,OAAM,KAAK,eAAe,OAAO;;EAGtC,CAAC;CAEF,AAAgB,QAAQ,MAAM;EAC5B,IAAI;EACJ,SAAS,YAAY;AACnB,QAAK,MAAM,UAAU,KAAK,SAAS;IACjC,MAAM,QACJ,OAAO,OAAO,gBAAgB,UAAU,aACpC,MAAM,OAAO,eAAe,OAAO,GACnC;AAEN,QAAI,CAAC,OAAO,SACV;IAGF,MAAM,EAAE,UAAU,MAAM,OAAO,MAAM,EAAE,eAAe,OAAO,CAAC;AAE9D,SAAK,MAAM,QAAQ,OAAO;KACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,OAAO,QAAQ,GAAG;AAC/C,SAAI,KAAK,QACP,QAAO,IAAI,KAAK,UAAU;AAG5B,UAAK,aAAa,aAAa;MAC7B,GAAG;MACH,QAAQ,OAAO;MACf;MACA,QAAQ,KAAK,UAAU;MACvB,MAAM,OAAO;MACb,SAAS,OAAO;MACjB,CAAC;;AAGJ,SAAK,IAAI,KAAK,WAAW,OAAO,KAAK,OAAO;KAC1C,OAAO,OAAO,MAAM;KACpB,QAAQ,OAAO;KAChB,CAAC;;;EAGP,CAAC;CAEF,MAAa,eAAe,OAAwC;EAClE,MAAM,UAAU,MAAM;EACtB,MAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM,QAAQ,KAAK;EACzE,MAAM,WAAW,aAAa,KAAK;EACnC,MAAM,OAAO,MAAM;EACnB,MAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,EAAE;EAEpE,MAAMC,SAAuB;GAC3B;GACA;GACA,QAAQ;GACR,gBAAgB,QAAQ;GACxB,OAAO,CAAC,CAAC,QAAQ;GACjB,UAAU,CAAC,MAAM;GACjB,QAAQ,OAAO,SAAS;IACtB,MAAM,EAAE,eAAe,iBAAS;AAChC,WAAO,MAAM,MAAM,GAAG,MAAM,SAAS,GAAGC,OAAK,UAAU,EACrD,SAAS,IAAI,QACX,gBACI,EACE,eACD,GACD,EAAE,CACP,EACF,CAAC,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC;;GAE5B,OAAO,OAAO,SAAS;IACrB,MAAM,EAAE,kBAAkB;IAC1B,MAAM,YAAY,MAAM,KAAK,WAAW,IAAI;KAC1C,SAAS;KACT,KAAK,GAAG,MAAM;KACd;KACD,CAAC;AAEF,QAAI,UAAU,UAAU,KACtB,QAAO,SAAS,UAAU;AAG5B,WAAO;;GAEV;AAED,OAAK,QAAQ,KAAK,OAAO;AAEzB,MAAI,QAAQ,MACV,MAAK,cAAc,YAAY;GAC7B,MAAM,GAAG,KAAK,IAAI,kBAAkB,GAAG,KAAK;GAC5C,QAAQ;GACR,UAAU,UAAQ;AAChB,UAAI,WAAWC,MAAI,SAAS,QAC1B,GAAG,KAAK,IAAI,kBAAkB,GAAG,QACjC,OAAO,OACR;;GAEH,GAAG;GACJ,CAAC;;CAIN,AAAmB,aAAa,OAAO;EACrC,KAAK;EACL,SAAS,EACP,SAAS,KACV;EACD,UAAU,GAAG,SAAS,EAAE,SAAS,UAAU;AACzC,QAAK,IAAI,KAAK,iCAAiC,QAAQ,OAAO;IAC5D;IACA;IACD,CAAC;;EAEJ,SAAS,OAAO,SAAuD;GACrE,MAAM,EAAE,KAAK,kBAAkB;GAC/B,MAAM,WAAW,MAAM,MAAM,KAAK,EAChC,SAAS,IAAI,QACX,gBACI,EACE,eACD,GACD,EAAE,CACP,EACF,CAAC;AAEF,OAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,8BAA8B,MAAM;AAGtD,UAAO,KAAK,OAAO,MAAM,OACvB,wBACA,MAAM,SAAS,MAAM,CACtB;;EAEJ,CAAC;;;;;ACrJJ,MAAM,YAAY,EAAE,OAAO,EACzB,mBAAmB,EAAE,KAAK;CACxB,aAAa;CACb,SAAS;CACV,CAAC,EACH,CAAC;AAEF,IAAa,sBAAb,MAAiC;CAC/B,AAAmB,MAAM,KAAK,UAAU;CACxC,AAAmB,SAAS,QAAQ,OAAO;CAC3C,AAAmB,eAAe,QAAQ,aAAa;CACvD,AAAmB,iBAAiB,QAAQ,yBAAyB;CACrE,AAAmB,uBAAuB,QAAQ,qBAAqB;CAEvE,IAAW,SAAS;AAClB,SAAO,KAAK,IAAI;;CAGlB,AAAgB,UAAU,MAAM;EAC9B,IAAI;EACJ,eAAe;AAEb,QAAK,MAAM,UAAU,KAAK,OAAO,YAAY,QAAQ,CACnD,MAAK,aAAa,aAAa;IAC7B,MAAM,OAAO;IACb,OAAO,OAAO;IACd,QAAQ,OAAO,QAAQ;IACvB,iBAAiB,OAAO,oBAAoB;IAC5C,SAAS,OAAO,QAAQ,UAAU;IAClC,QAAQ,OAAO,WAAW,QAAQ,SAAY,OAAO;IACrD,QAAQ,OAAO;IACf,MAAM,OAAO;IAEb,UACE,QACA,UAAgC,EAAE,KAC/B,OAAO,IAAI,QAAQ,QAAQ;IACjC,CAAC;;EAGP,CAAC;;;;;;CAOF,AAAgB,QAAQ,OAAO;EAC7B,MAAM,aAAa,KAAK;EACxB,QAAQ,EACN,UAAU,wBACX;EACD,UAAU,EAAE,MAAM,cAAc;AAC9B,UAAO,KAAK,gBAAgB;IAC1B;IACA,eAAe,QAAQ;IACxB,CAAC;;EAEL,CAAC;;;;;;;CAQF,AAAgB,SAAS,OAAO;EAC9B,MAAM,aAAa,KAAK;EACxB,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,EACf,CAAC;GACF,UAAU,EAAE,MAAM;GACnB;EACD,UAAU,EAAE,QAAQ,MAAM,cAAc;AACtC,UAAO,KAAK,gBAAgB,OAAO,MAAM;IACvC;IACA,eAAe,QAAQ;IACxB,CAAC;;EAEL,CAAC;CAEF,MAAa,gBACX,MACA,UAA8B,EAAE,EACF;EAC9B,MAAM,gBAAgB,QAAQ;EAC9B,MAAM,MAAM,MAAM,KAAK,gBAAgB;GACrC,MAAM,QAAQ;GACd;GACD,CAAC;AAEF,OAAK,MAAM,QAAQ,IAAI,MACrB,KAAI,KAAK,SAAS,MAAM;AACtB,OAAI,KAAK,QAEP,QAAO,KAAK,eACT,YAAY,CACZ,MAAM,OAAO,GAAG,SAAS,KAAK,QAAQ,EACrC,OAAO;IAAQ;IAAM;IAAe,CAAC;AAI3C,UACE,KAAK,aAAa,gBAAgB,CAAC,MAAM,OAAO,GAAG,SAAS,KAAK,EAC7D,UAAU,EAAE;;AAKtB,SAAO,EAAE;;;;;;CAOX,MAAa,gBACX,SAC2B;EAC3B,MAAM,EAAE,SAAS;EACjB,IAAIC;EACJ,IAAIC;EACJ,MAAM,cAAc,KAAK,OAAO,IAAI,iBAAiB;AACrD,MAAI,eAAe,MAAM;AACvB,iBAAc,KAAK,OAAO,OAAO,iBAAiB,CAAC,eAAe,KAAK;AACvE,mBAAgB,IAAI,IAClB,YAAY,KAAK,OAAO,CAAC,GAAG,GAAG,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC,CACxD;;EAGH,MAAMC,YAAuB,EAAE;AAG/B,OAAK,MAAM,cAAc,eAAe,EAAE,CACxC,KACE,CAAC,WAAW,QACZ,CAAC,WAAW,UACZ,WAAW,QACX,WAAW,MAEX,WAAU,KAAK;GACb,MAAM;GACN,MAAM,WAAW;GACjB,OAAO,WAAW;GACnB,CAAC;AAKN,OAAK,MAAM,QAAQ,KAAK,aAAa,gBAAgB,EAAE;AAErD,OAAI,KAAK,KAAM;AAEf,OAAI,eAAe,KAAK,SAAS;AAE/B,QAAI,CAAC,KACH;AAGF,QAAI,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,OAEnD;SAAI,KAAK,UAAU,KAAK,QAAQ,MAC9B;eAEO,eAGT;SAAI,CAAC,cAAc,IAAI,GAAG,KAAK,MAAM,GAAG,KAAK,OAAO,CAClD;;;AAKN,aAAU,KAAK;IACb,MAAM,KAAK;IACX,OAAO,KAAK;IACZ,iBAAiB,KAAK;IACtB,QAAQ,KAAK;IACb,MAAM,KAAK;IACZ,CAAC;;AAGJ,OAAK,qBAAqB,YAAY,mBAAmB;EAGzD,MAAM,WAAW,KAAK,eACnB,YAAY,CACZ,QAAQ,OAAO,GAAG,MAAM,CACxB,IAAI,OAAO,WAAW;GACrB,MAAM,EAAE,OAAO,WAAW,MAAM,OAAO,MAAM,QAAQ;AACrD,UAAO,MAAM,KAAK,SAAS;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,UAAU,QAAQ,GAAG;AAClD,QAAI,KAAK,QACP,QAAO,IAAI,KAAK,UAAU;AAG5B,WAAO;KACL,GAAG;KACH;KACA,OAAO;KACP,SAAS,OAAO;KACjB;KACD;IACF;AAEJ,YAAU,KAAK,IAAI,MAAM,QAAQ,IAAI,SAAS,EAAE,MAAM,CAAC;AACvD,OAAK,qBAAqB,UAAU,mBAAmB;AAEvD,SAAO;GACL,QAAQ,KAAK,IAAI;GACjB,OAAO;GACR;;;;;;;;;;;;;;;;;AC5LL,MAAa,oBAAoB,QAAQ;CACvC,MAAM;CACN,aAAa,CAAC,SAAS,QAAQ;CAC/B,UAAU;EACR;EACA;EACA;EACA;EACD;CACF,CAAC"}
+{"version":3,"file":"index.js","names":["$: VirtualAction<T>","envSchema","remote: ServerRemote","name","url","permissions: Permission[] | undefined","permissionMap: Map<string, Permission> | undefined","userLinks: ApiLink[]"],"sources":["../../src/server-links/schemas/apiLinksResponseSchema.ts","../../src/server-links/providers/LinkProvider.ts","../../src/server-links/primitives/$client.ts","../../src/server-links/primitives/$remote.ts","../../src/server-links/providers/RemotePrimitiveProvider.ts","../../src/server-links/providers/ServerLinksProvider.ts","../../src/server-links/index.ts"],"sourcesContent":["import type { Static } from \"alepha\";\nimport { t } from \"alepha\";\n\nexport const apiLinkSchema = t.object({\n  name: t.text({\n    description: \"Name of the API link, used for identification.\",\n  }),\n\n  group: t.optional(\n    t.text({\n      description:\n        \"Group to which the API link belongs, used for categorization.\",\n    }),\n  ),\n\n  path: t.text({\n    description: \"Pathname used to access the API link.\",\n  }),\n\n  method: t.optional(\n    t.text({\n      description:\n        \"HTTP method used for the API link, e.g., GET, POST, etc. If not specified, defaults to GET.\",\n    }),\n  ),\n\n  requestBodyType: t.optional(\n    t.text({\n      description:\n        \"Type of the request body for the API link. Default is application/json for POST/PUT/PATCH, null for others.\",\n    }),\n  ),\n\n  service: t.optional(\n    t.text({\n      description:\n        \"Service name associated with the API link, used for service discovery.\",\n    }),\n  ),\n});\n\nexport const apiLinksResponseSchema = t.object({\n  prefix: t.optional(t.text()),\n  links: t.array(apiLinkSchema),\n});\n\nexport type ApiLinksResponse = Static<typeof apiLinksResponseSchema>;\nexport type ApiLink = Static<typeof apiLinkSchema>;\n","import { $inject, Alepha, AlephaError, type Async, t } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport {\n  type ActionPrimitive,\n  type ClientRequestEntry,\n  type ClientRequestOptions,\n  type ClientRequestResponse,\n  type FetchResponse,\n  HttpClient,\n  type RequestConfigSchema,\n  ServerReply,\n  type ServerRequest,\n  type ServerRequestConfigEntry,\n  type ServerResponseBody,\n  UnauthorizedError,\n} from \"alepha/server\";\nimport type { ServerRouteSecure } from \"alepha/server/security\";\nimport {\n  type ApiLink,\n  apiLinksResponseSchema,\n} from \"../schemas/apiLinksResponseSchema.ts\";\n\n/**\n * Browser, SSR friendly, service to handle links.\n */\nexport class LinkProvider {\n  static path = {\n    apiLinks: \"/api/_links\",\n    apiSchema: \"/api/_links/:name/schema\",\n  };\n\n  protected readonly log = $logger();\n  protected readonly alepha = $inject(Alepha);\n  protected readonly httpClient = $inject(HttpClient);\n\n  // all server links (local + remote)\n  // THIS IS NOT USER LINKS! (which are filtered by permissions)\n  protected serverLinks: Array<HttpClientLink> = [];\n\n  /**\n   * Get applicative links registered on the server.\n   * This does not include lazy-loaded remote links.\n   */\n  public getServerLinks(): HttpClientLink[] {\n    if (this.alepha.isBrowser()) {\n      this.log.warn(\n        \"Getting server links in the browser is not supported. Use `fetchLinks` to get links from the server.\",\n      );\n      return [];\n    }\n\n    return this.serverLinks;\n  }\n\n  /**\n   * Register a new link for the application.\n   */\n  public registerLink(link: HttpClientLink): void {\n    if (this.alepha.isBrowser()) {\n      this.log.warn(\n        \"Registering links in the browser is not supported. Use `fetchLinks` to get links from the server.\",\n      );\n      return;\n    }\n\n    if (!link.handler && !link.host) {\n      throw new AlephaError(\n        \"Can't create link - 'handler' or 'host' is required\",\n      );\n    }\n\n    if (this.serverLinks.some((l) => l.name === link.name)) {\n      // remove existing link with the same name\n      this.serverLinks = this.serverLinks.filter((l) => l.name !== link.name);\n    }\n\n    this.serverLinks.push(link);\n  }\n\n  public get links(): HttpClientLink[] {\n    // TODO: not performant at all, use a map instead for ServerLinks\n    const apiLinks = this.alepha.store.get(\n      \"alepha.server.request.apiLinks\",\n    )?.links;\n    if (apiLinks) {\n      if (this.alepha.isBrowser()) {\n        return apiLinks;\n      }\n\n      const links = [];\n      for (const link of apiLinks) {\n        const originalLink = this.serverLinks.find((l) => l.name === link.name);\n        if (originalLink) {\n          links.push(originalLink);\n        }\n      }\n      return links;\n    }\n\n    return this.serverLinks ?? [];\n  }\n\n  /**\n   * Force browser to refresh links from the server.\n   */\n  public async fetchLinks(): Promise<HttpClientLink[]> {\n    const { data } = await this.httpClient.fetch(\n      `${LinkProvider.path.apiLinks}`,\n      {\n        method: \"GET\",\n        schema: {\n          response: apiLinksResponseSchema,\n        },\n      },\n    );\n\n    this.alepha.store.set(\"alepha.server.request.apiLinks\", data);\n\n    return data.links;\n  }\n\n  /**\n   * Create a virtual client that can be used to call actions.\n   *\n   * Use js Proxy under the hood.\n   */\n  public client<T extends object>(\n    scope: ClientScope = {},\n  ): HttpVirtualClient<T> {\n    return new Proxy<HttpVirtualClient<T>>({} as HttpVirtualClient<T>, {\n      get: (_, prop) => {\n        if (typeof prop !== \"string\") {\n          return;\n        }\n\n        return this.createVirtualAction<RequestConfigSchema>(prop, scope);\n      },\n    });\n  }\n\n  /**\n   * Check if a link with the given name exists.\n   * @param name\n   */\n  public can(name: string): boolean {\n    return this.links.some((link) => link.name === name);\n  }\n\n  /**\n   * Resolve a link by its name and call it.\n   * - If link is local, it will call the local handler.\n   * - If link is remote, it will make a fetch request to the remote server.\n   */\n  public async follow(\n    name: string,\n    config: Partial<ServerRequestConfigEntry> = {},\n    options: ClientRequestOptions & ClientScope = {},\n  ): Promise<any> {\n    this.log.trace(\"Following link\", { name, config, options });\n    const link = await this.getLinkByName(name, options);\n\n    // if a handler is defined, use it (ssr)\n    if (link.handler && !options.request) {\n      this.log.trace(\"Local link found\", { name });\n      return link.handler(\n        {\n          method: link.method,\n          url: new URL(`http://localhost${link.path}`),\n          query: config.query ?? {},\n          body: config.body ?? {},\n          params: config.params ?? {},\n          headers: config.headers ?? {},\n          metadata: {},\n          reply: new ServerReply(),\n        } as Partial<ServerRequest> as ServerRequest,\n        options,\n      );\n    }\n\n    this.log.trace(\"Remote link found\", {\n      name,\n      host: link.host,\n      service: link.service,\n    });\n\n    return this.followRemote(link, config, options).then(\n      (response) => response.data,\n    );\n  }\n\n  protected createVirtualAction<T extends RequestConfigSchema>(\n    name: string,\n    scope: ClientScope = {},\n  ): VirtualAction<T> {\n    const $: VirtualAction<T> = async (\n      config: any = {},\n      options: ClientRequestOptions = {},\n    ) => {\n      return this.follow(name, config, {\n        ...scope,\n        ...options,\n      });\n    };\n\n    Object.defineProperty($, \"name\", {\n      value: name,\n      writable: false,\n    });\n\n    $.run = async (config: any = {}, options: ClientRequestOptions = {}) => {\n      return this.follow(name, config, {\n        ...scope,\n        ...options,\n      });\n    };\n\n    $.fetch = async (config: any = {}, options: ClientRequestOptions = {}) => {\n      const link = await this.getLinkByName(name, scope);\n      return this.followRemote(link, config, options);\n    };\n\n    $.can = () => {\n      return this.can(name);\n    };\n\n    return $;\n  }\n\n  protected async followRemote(\n    link: HttpClientLink,\n    config: Partial<ServerRequestConfigEntry> = {},\n    options: ClientRequestOptions = {},\n  ): Promise<FetchResponse> {\n    options.request ??= {};\n    options.request.headers = new Headers(options.request.headers);\n\n    const als = this.alepha.context.get<ServerRequest>(\"request\");\n    if (als?.headers.authorization) {\n      options.request.headers.set(\"authorization\", als.headers.authorization);\n    }\n\n    const context = this.alepha.context.get(\"context\");\n    if (typeof context === \"string\") {\n      options.request.headers.set(\"x-request-id\", context);\n    }\n\n    const action = {\n      ...link,\n      // schema is not used in the client,\n      // we assume that typescript will check\n      schema: {\n        body: t.any(),\n        response: t.any(),\n      },\n    };\n\n    // prefix with service when host is not defined (e.g. browser)\n    if (!link.host && link.service) {\n      action.path = `/${link.service}${action.path}`;\n    }\n\n    action.path = `${action.prefix ?? \"/api\"}${action.path}`;\n    action.prefix = undefined; // prefix is not used in the client\n\n    // else, make a request\n    return this.httpClient.fetchAction({\n      host: link.host,\n      config,\n      options,\n      action: action as any, // schema.body TAny is not accepted\n    });\n  }\n\n  protected async getLinkByName(\n    name: string,\n    options: ClientScope = {},\n  ): Promise<HttpClientLink> {\n    if (\n      this.alepha.isBrowser() &&\n      !this.alepha.store.get(\"alepha.server.request.apiLinks\")\n    ) {\n      await this.fetchLinks();\n    }\n\n    const link = this.links.find(\n      (a) =>\n        a.name === name &&\n        (!options.group || a.group === options.group) &&\n        (!options.service || options.service === a.service),\n    );\n\n    if (!link) {\n      const error = new UnauthorizedError(`Action ${name} not found.`);\n      // mimic http error handling\n      await this.alepha.events.emit(\"client:onError\", {\n        route: link,\n        error,\n      });\n      throw error;\n    }\n\n    if (options.hostname) {\n      return {\n        ...link,\n        host: options.hostname,\n      };\n    }\n\n    return link;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface HttpClientLink extends ApiLink {\n  secured?: boolean | ServerRouteSecure;\n  prefix?: string;\n  // -- server only --\n  // only for remote actions\n  host?: string;\n  service?: string;\n  // used only for local actions, not for remote actions\n  schema?: RequestConfigSchema;\n  handler?: (\n    request: ServerRequest,\n    options: ClientRequestOptions,\n  ) => Async<ServerResponseBody>;\n}\n\nexport interface ClientScope {\n  group?: string;\n  service?: string;\n  hostname?: string;\n}\n\nexport type HttpVirtualClient<T> = {\n  [K in keyof T as T[K] extends ActionPrimitive<RequestConfigSchema>\n    ? K\n    : never]: T[K] extends ActionPrimitive<infer Schema>\n    ? VirtualAction<Schema>\n    : never;\n};\n\nexport interface VirtualAction<T extends RequestConfigSchema>\n  extends Pick<ActionPrimitive<T>, \"name\" | \"run\" | \"fetch\"> {\n  (\n    config?: ClientRequestEntry<T>,\n    opts?: ClientRequestOptions,\n  ): Promise<ClientRequestResponse<T>>;\n  can: () => boolean;\n}\n","import { $inject, KIND } from \"alepha\";\nimport {\n  type ClientScope,\n  type HttpVirtualClient,\n  LinkProvider,\n} from \"../providers/LinkProvider.ts\";\n\n/**\n * Create a new client.\n */\nexport const $client = <T extends object>(\n  scope?: ClientScope,\n): HttpVirtualClient<T> => {\n  return $inject(LinkProvider).client<T>(scope);\n};\n\n$client[KIND] = \"$client\";\n","import { createPrimitive, KIND, Primitive } from \"alepha\";\nimport type { ServiceAccountPrimitive } from \"alepha/security\";\nimport type { ProxyPrimitiveOptions } from \"alepha/server/proxy\";\n\n/**\n * $remote is a primitive that allows you to define remote service access.\n *\n * Use it only when you have 2 or more services that need to communicate with each other.\n *\n * All remote services can be exposed as actions, ... or not.\n *\n * You can add a service account if you want to use a security layer.\n */\nexport const $remote = (options: RemotePrimitiveOptions) => {\n  return createPrimitive(RemotePrimitive, options);\n};\n\nexport interface RemotePrimitiveOptions {\n  /**\n   * The URL of the remote service.\n   * You can use a function to generate the URL dynamically.\n   * You probably should use $env(env) to get the URL from the environment.\n   *\n   * @example\n   * ```ts\n   * import { $remote } from \"alepha/server\";\n   * import { $inject, t } from \"alepha\";\n   *\n   * class App {\n   *   env = $env(t.object({\n   *     REMOTE_URL: t.text({default: \"http://localhost:3000\"}),\n   *   }));\n   *   remote = $remote({\n   *     url: this.env.REMOTE_URL,\n   *   });\n   * }\n   * ```\n   */\n  url: string | (() => string);\n\n  /**\n   * The name of the remote service.\n   *\n   * @default Member of the class containing the remote service.\n   */\n  name?: string;\n\n  /**\n   * If true, all methods of the remote service will be exposed as actions in this context.\n   * > Note: Proxy will never use the service account, it just... proxies the request.\n   */\n  proxy?:\n    | boolean\n    | Partial<\n        ProxyPrimitiveOptions & {\n          /**\n           * If true, the remote service won't be available internally, only through the proxy.\n           */\n          noInternal: boolean;\n        }\n      >;\n\n  /**\n   * For communication between the server and the remote service with a security layer.\n   * This will be used for internal communication and will not be exposed to the client.\n   */\n  serviceAccount?: ServiceAccountPrimitive;\n}\n\nexport class RemotePrimitive extends Primitive<RemotePrimitiveOptions> {\n  public get name(): string {\n    return this.options.name ?? this.config.propertyKey;\n  }\n}\n\n$remote[KIND] = RemotePrimitive;\n","import { $env, $hook, $inject, Alepha, t } from \"alepha\";\nimport { $logger } from \"alepha/logger\";\nimport { $retry } from \"alepha/retry\";\nimport type { ServiceAccountPrimitive } from \"alepha/security\";\nimport { ServerProxyProvider } from \"alepha/server/proxy\";\nimport { $remote, type RemotePrimitive } from \"../primitives/$remote.ts\";\nimport {\n  type ApiLinksResponse,\n  apiLinksResponseSchema,\n} from \"../schemas/apiLinksResponseSchema.ts\";\nimport { LinkProvider } from \"./LinkProvider.ts\";\n\nconst envSchema = t.object({\n  SERVER_API_PREFIX: t.text({\n    description: \"Prefix for all API routes (e.g. $action).\",\n    default: \"/api\",\n  }),\n});\n\nexport class RemotePrimitiveProvider {\n  protected readonly env = $env(envSchema);\n  protected readonly alepha = $inject(Alepha);\n  protected readonly proxyProvider = $inject(ServerProxyProvider);\n  protected readonly linkProvider = $inject(LinkProvider);\n  protected readonly remotes: Array<ServerRemote> = [];\n  protected readonly log = $logger();\n\n  public getRemotes(): ServerRemote[] {\n    return this.remotes;\n  }\n\n  public readonly configure = $hook({\n    on: \"configure\",\n    handler: async () => {\n      const remotes = this.alepha.primitives($remote);\n      for (const remote of remotes) {\n        await this.registerRemote(remote);\n      }\n    },\n  });\n\n  public readonly start = $hook({\n    on: \"start\",\n    handler: async () => {\n      for (const remote of this.remotes) {\n        const token =\n          typeof remote.serviceAccount?.token === \"function\"\n            ? await remote.serviceAccount.token()\n            : undefined;\n\n        if (!remote.internal) {\n          continue; // skip download links for remotes that are not internal\n        }\n\n        const { links } = await remote.links({ authorization: token });\n\n        for (const link of links) {\n          let path = link.path.replace(remote.prefix, \"\");\n          if (link.service) {\n            path = `/${link.service}${path}`;\n          }\n\n          this.linkProvider.registerLink({\n            ...link,\n            prefix: remote.prefix,\n            path,\n            method: link.method ?? \"GET\",\n            host: remote.url,\n            service: remote.name,\n          });\n        }\n\n        this.log.info(`Remote '${remote.name}' OK`, {\n          links: remote.links.length,\n          prefix: remote.prefix,\n        });\n      }\n    },\n  });\n\n  public async registerRemote(value: RemotePrimitive): Promise<void> {\n    const options = value.options;\n    const url = typeof options.url === \"string\" ? options.url : options.url();\n    const linkPath = LinkProvider.path.apiLinks;\n    const name = value.name;\n    const proxy = typeof options.proxy === \"object\" ? options.proxy : {};\n\n    const remote: ServerRemote = {\n      url,\n      name,\n      prefix: \"/api\",\n      serviceAccount: options.serviceAccount,\n      proxy: !!options.proxy,\n      internal: !proxy.noInternal,\n      schema: async (opts) => {\n        const { authorization, name } = opts;\n        return await fetch(`${url}${linkPath}/${name}/schema`, {\n          headers: new Headers(\n            authorization\n              ? {\n                  authorization,\n                }\n              : {},\n          ),\n        }).then((it) => it.json()); // TODO: use schema validation for response\n      },\n      links: async (opts) => {\n        const { authorization } = opts;\n        const remoteApi = await this.fetchLinks.run({\n          service: name,\n          url: `${url}${linkPath}`,\n          authorization,\n        });\n\n        if (remoteApi.prefix != null) {\n          remote.prefix = remoteApi.prefix; // monkey patch the prefix, not ideal but works\n        }\n\n        return remoteApi;\n      },\n    };\n\n    this.remotes.push(remote);\n\n    if (options.proxy) {\n      this.proxyProvider.createProxy({\n        path: `${this.env.SERVER_API_PREFIX}/${name}/*`,\n        target: url,\n        rewrite: (url) => {\n          url.pathname = url.pathname.replace(\n            `${this.env.SERVER_API_PREFIX}/${name}`,\n            remote.prefix,\n          );\n        },\n        ...proxy,\n      });\n    }\n  }\n\n  protected readonly fetchLinks = $retry({\n    max: 10,\n    backoff: {\n      initial: 1000,\n    },\n    onError: (_, attempt, { service, url }) => {\n      this.log.warn(`Failed to fetch links, retry (${attempt})...`, {\n        service,\n        url,\n      });\n    },\n    handler: async (opts: FetchLinksOptions): Promise<ApiLinksResponse> => {\n      const { url, authorization } = opts;\n      const response = await fetch(url, {\n        headers: new Headers(\n          authorization\n            ? {\n                authorization,\n              }\n            : {},\n        ),\n      });\n\n      if (!response.ok) {\n        throw new Error(`Failed to fetch links from ${url}`);\n      }\n\n      return this.alepha.codec.decode(\n        apiLinksResponseSchema,\n        await response.json(),\n      );\n    },\n  });\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface FetchLinksOptions {\n  /**\n   * Name of the remote service.\n   */\n  service: string;\n\n  /**\n   * URL to fetch links from.\n   */\n  url: string;\n\n  /**\n   * Authorization header containing access token.\n   */\n  authorization?: string;\n}\n\nexport interface ServerRemote {\n  /**\n   * URL of the remote service.\n   */\n  url: string;\n\n  /**\n   * Name of the remote service.\n   */\n  name: string;\n\n  /**\n   * Expose links as endpoint. It's not only internal.\n   */\n  proxy: boolean;\n\n  /**\n   * It's only used inside the application.\n   */\n  internal: boolean;\n\n  /**\n   * Links fetcher.\n   */\n  links: (args: { authorization?: string }) => Promise<ApiLinksResponse>;\n\n  /**\n   * Fetches schema for the remote service.\n   */\n  schema: (args: { name: string; authorization?: string }) => Promise<any>;\n\n  /**\n   * Force a default access token provider when not provided.\n   */\n  serviceAccount?: ServiceAccountPrimitive;\n\n  /**\n   * Prefix for the remote service links.\n   */\n  prefix: string;\n}\n","import { $env, $hook, $inject, Alepha, t } from \"alepha\";\nimport {\n  type Permission,\n  SecurityProvider,\n  type UserAccountToken,\n} from \"alepha/security\";\nimport {\n  $action,\n  $route,\n  type ClientRequestEntry,\n  type ClientRequestOptions,\n  type RequestConfigSchema,\n  ServerTimingProvider,\n} from \"alepha/server\";\nimport {\n  type ApiLink,\n  type ApiLinksResponse,\n  apiLinksResponseSchema,\n} from \"../schemas/apiLinksResponseSchema.ts\";\nimport { LinkProvider } from \"./LinkProvider.ts\";\nimport { RemotePrimitiveProvider } from \"./RemotePrimitiveProvider.ts\";\n\nconst envSchema = t.object({\n  SERVER_API_PREFIX: t.text({\n    description: \"Prefix for all API routes (e.g. $action).\",\n    default: \"/api\",\n  }),\n});\n\nexport class ServerLinksProvider {\n  protected readonly env = $env(envSchema);\n  protected readonly alepha = $inject(Alepha);\n  protected readonly linkProvider = $inject(LinkProvider);\n  protected readonly remoteProvider = $inject(RemotePrimitiveProvider);\n  protected readonly serverTimingProvider = $inject(ServerTimingProvider);\n\n  public get prefix() {\n    return this.env.SERVER_API_PREFIX;\n  }\n\n  public readonly onRoute = $hook({\n    on: \"configure\",\n    handler: () => {\n      // convert all $action to local links\n      for (const action of this.alepha.primitives($action)) {\n        this.linkProvider.registerLink({\n          name: action.name,\n          group: action.group,\n          schema: action.options.schema,\n          requestBodyType: action.getBodyContentType(),\n          secured: action.options.secure ?? true,\n          method: action.method === \"GET\" ? undefined : action.method,\n          prefix: action.prefix,\n          path: action.path,\n          // by local, we mean that it can be called directly via the handler\n          handler: (\n            config: ClientRequestEntry<RequestConfigSchema>,\n            options: ClientRequestOptions = {},\n          ) => action.run(config, options),\n        });\n      }\n    },\n  });\n\n  /**\n   * First API - Get all API links for the user.\n   *\n   * This is based on the user's permissions.\n   */\n  public readonly links = $route({\n    path: LinkProvider.path.apiLinks,\n    schema: {\n      response: apiLinksResponseSchema,\n    },\n    handler: ({ user, headers }) => {\n      return this.getUserApiLinks({\n        user,\n        authorization: headers.authorization,\n      });\n    },\n  });\n\n  /**\n   * Second API - Get schema for a specific API link.\n   *\n   * Note: Body/Response schema are not included in `links` API because it's TOO BIG.\n   * I mean for 150+ links, you got 50ms of serialization time.\n   */\n  public readonly schema = $route({\n    path: LinkProvider.path.apiSchema,\n    schema: {\n      params: t.object({\n        name: t.text(),\n      }),\n      response: t.json(),\n    },\n    handler: ({ params, user, headers }) => {\n      return this.getSchemaByName(params.name, {\n        user,\n        authorization: headers.authorization,\n      });\n    },\n  });\n\n  public async getSchemaByName(\n    name: string,\n    options: GetApiLinksOptions = {},\n  ): Promise<RequestConfigSchema> {\n    const authorization = options.authorization;\n    const api = await this.getUserApiLinks({\n      user: options.user,\n      authorization,\n    });\n\n    for (const link of api.links) {\n      if (link.name === name) {\n        if (link.service) {\n          // remote\n          return this.remoteProvider\n            .getRemotes()\n            .find((it) => it.name === link.service)\n            ?.schema({ name: name, authorization });\n        }\n\n        // local\n        return (\n          this.linkProvider.getServerLinks().find((it) => it.name === name)\n            ?.schema ?? {}\n        );\n      }\n    }\n\n    return {};\n  }\n\n  /**\n   * Retrieves API links for the user based on their permissions.\n   * Will check on local links and remote links.\n   */\n  public async getUserApiLinks(\n    options: GetApiLinksOptions,\n  ): Promise<ApiLinksResponse> {\n    const { user } = options;\n    let permissions: Permission[] | undefined;\n    let permissionMap: Map<string, Permission> | undefined;\n    const hasSecurity = this.alepha.has(SecurityProvider);\n    if (hasSecurity && user) {\n      permissions = this.alepha.inject(SecurityProvider).getPermissions(user);\n      permissionMap = new Map(\n        permissions.map((it) => [`${it.group}:${it.name}`, it]),\n      );\n    }\n\n    const userLinks: ApiLink[] = [];\n\n    // bonus: add permissions not related to $action\n    for (const permission of permissions ?? []) {\n      if (\n        !permission.path &&\n        !permission.method &&\n        permission.name &&\n        permission.group\n      ) {\n        userLinks.push({\n          path: \"\", // this is a placeholder for links without specific path\n          name: permission.name,\n          group: permission.group,\n        });\n      }\n    }\n\n    // add local links\n    for (const link of this.linkProvider.getServerLinks()) {\n      // SKIP REMOTE LINKS, remote links are handled separately for security\n      if (link.host) continue;\n\n      if (hasSecurity && link.secured) {\n        // skip secured links if user is not provided\n        if (!user) {\n          continue;\n        }\n\n        if (typeof link.secured === \"object\" && link.secured.realm) {\n          // realm check\n          if (user.realm !== link.secured.realm) {\n            continue;\n          }\n        } else if (permissionMap) {\n          // small permissions check, can be optimized later ... :')\n\n          if (!permissionMap.has(`${link.group}:${link.name}`)) {\n            continue;\n          }\n        }\n      }\n\n      userLinks.push({\n        name: link.name,\n        group: link.group,\n        requestBodyType: link.requestBodyType,\n        method: link.method,\n        path: link.path,\n      });\n    }\n\n    this.serverTimingProvider.beginTiming(\"fetchRemoteLinks\");\n    // this does not scale well, but it's working for now\n    // TODO: remote links can be cached by user.roles\n    const promises = this.remoteProvider\n      .getRemotes()\n      .filter((it) => it.proxy) // add only \"proxy\" remotes\n      .map(async (remote) => {\n        const { links, prefix } = await remote.links(options);\n        return links.map((link) => {\n          let path = link.path.replace(prefix ?? \"/api\", \"\");\n          if (link.service) {\n            path = `/${link.service}${path}`;\n          }\n\n          return {\n            ...link,\n            path,\n            proxy: true,\n            service: remote.name,\n          };\n        });\n      });\n\n    userLinks.push(...(await Promise.all(promises)).flat());\n    this.serverTimingProvider.endTiming(\"fetchRemoteLinks\");\n\n    return {\n      prefix: this.env.SERVER_API_PREFIX,\n      links: userLinks,\n    };\n  }\n}\n\nexport interface GetApiLinksOptions {\n  user?: UserAccountToken;\n  authorization?: string;\n}\n","import \"alepha/server/security\";\nimport { $module } from \"alepha\";\nimport { AlephaServer } from \"alepha/server\";\nimport { $client } from \"./primitives/$client.ts\";\nimport { $remote } from \"./primitives/$remote.ts\";\nimport { LinkProvider } from \"./providers/LinkProvider.ts\";\nimport { RemotePrimitiveProvider } from \"./providers/RemotePrimitiveProvider.ts\";\nimport { ServerLinksProvider } from \"./providers/ServerLinksProvider.ts\";\nimport type { ApiLinksResponse } from \"./schemas/apiLinksResponseSchema.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./primitives/$client.ts\";\nexport * from \"./primitives/$remote.ts\";\nexport * from \"./providers/LinkProvider.ts\";\nexport * from \"./providers/RemotePrimitiveProvider.ts\";\nexport * from \"./providers/ServerLinksProvider.ts\";\nexport * from \"./schemas/apiLinksResponseSchema.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\ndeclare module \"alepha\" {\n  interface State {\n    /**\n     * API links attached to the server request state.\n     *\n     * @see {@link ApiLinksResponse}\n     * @internal\n     */\n    \"alepha.server.request.apiLinks\"?: ApiLinksResponse;\n  }\n}\n\n// ---------------------------------------------------------------------------------------------------------------------\n\n/**\n * Provides server-side link management and remote capabilities for client-server interactions.\n *\n * The server-links module enables declarative link definitions using `$remote` and `$client` primitives,\n * facilitating seamless API endpoint management and client-server communication. It integrates with server\n * security features to ensure safe and controlled access to resources.\n *\n * @see {@link $remote}\n * @see {@link $client}\n * @module alepha.server.links\n */\nexport const AlephaServerLinks = $module({\n  name: \"alepha.server.links\",\n  primitives: [$remote, $client],\n  services: [\n    AlephaServer,\n    ServerLinksProvider,\n    RemotePrimitiveProvider,\n    LinkProvider,\n  ],\n});\n"],"mappings":";;;;;;;;;AAGA,MAAa,gBAAgB,EAAE,OAAO;CACpC,MAAM,EAAE,KAAK,EACX,aAAa,kDACd,CAAC;CAEF,OAAO,EAAE,SACP,EAAE,KAAK,EACL,aACE,iEACH,CAAC,CACH;CAED,MAAM,EAAE,KAAK,EACX,aAAa,yCACd,CAAC;CAEF,QAAQ,EAAE,SACR,EAAE,KAAK,EACL,aACE,+FACH,CAAC,CACH;CAED,iBAAiB,EAAE,SACjB,EAAE,KAAK,EACL,aACE,+GACH,CAAC,CACH;CAED,SAAS,EAAE,SACT,EAAE,KAAK,EACL,aACE,0EACH,CAAC,CACH;CACF,CAAC;AAEF,MAAa,yBAAyB,EAAE,OAAO;CAC7C,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;CAC5B,OAAO,EAAE,MAAM,cAAc;CAC9B,CAAC;;;;;;;ACnBF,IAAa,eAAb,MAAa,aAAa;CACxB,OAAO,OAAO;EACZ,UAAU;EACV,WAAW;EACZ;CAED,AAAmB,MAAM,SAAS;CAClC,AAAmB,SAAS,QAAQ,OAAO;CAC3C,AAAmB,aAAa,QAAQ,WAAW;CAInD,AAAU,cAAqC,EAAE;;;;;CAMjD,AAAO,iBAAmC;AACxC,MAAI,KAAK,OAAO,WAAW,EAAE;AAC3B,QAAK,IAAI,KACP,uGACD;AACD,UAAO,EAAE;;AAGX,SAAO,KAAK;;;;;CAMd,AAAO,aAAa,MAA4B;AAC9C,MAAI,KAAK,OAAO,WAAW,EAAE;AAC3B,QAAK,IAAI,KACP,oGACD;AACD;;AAGF,MAAI,CAAC,KAAK,WAAW,CAAC,KAAK,KACzB,OAAM,IAAI,YACR,sDACD;AAGH,MAAI,KAAK,YAAY,MAAM,MAAM,EAAE,SAAS,KAAK,KAAK,CAEpD,MAAK,cAAc,KAAK,YAAY,QAAQ,MAAM,EAAE,SAAS,KAAK,KAAK;AAGzE,OAAK,YAAY,KAAK,KAAK;;CAG7B,IAAW,QAA0B;EAEnC,MAAM,WAAW,KAAK,OAAO,MAAM,IACjC,iCACD,EAAE;AACH,MAAI,UAAU;AACZ,OAAI,KAAK,OAAO,WAAW,CACzB,QAAO;GAGT,MAAM,QAAQ,EAAE;AAChB,QAAK,MAAM,QAAQ,UAAU;IAC3B,MAAM,eAAe,KAAK,YAAY,MAAM,MAAM,EAAE,SAAS,KAAK,KAAK;AACvE,QAAI,aACF,OAAM,KAAK,aAAa;;AAG5B,UAAO;;AAGT,SAAO,KAAK,eAAe,EAAE;;;;;CAM/B,MAAa,aAAwC;EACnD,MAAM,EAAE,SAAS,MAAM,KAAK,WAAW,MACrC,GAAG,aAAa,KAAK,YACrB;GACE,QAAQ;GACR,QAAQ,EACN,UAAU,wBACX;GACF,CACF;AAED,OAAK,OAAO,MAAM,IAAI,kCAAkC,KAAK;AAE7D,SAAO,KAAK;;;;;;;CAQd,AAAO,OACL,QAAqB,EAAE,EACD;AACtB,SAAO,IAAI,MAA4B,EAAE,EAA0B,EACjE,MAAM,GAAG,SAAS;AAChB,OAAI,OAAO,SAAS,SAClB;AAGF,UAAO,KAAK,oBAAyC,MAAM,MAAM;KAEpE,CAAC;;;;;;CAOJ,AAAO,IAAI,MAAuB;AAChC,SAAO,KAAK,MAAM,MAAM,SAAS,KAAK,SAAS,KAAK;;;;;;;CAQtD,MAAa,OACX,MACA,SAA4C,EAAE,EAC9C,UAA8C,EAAE,EAClC;AACd,OAAK,IAAI,MAAM,kBAAkB;GAAE;GAAM;GAAQ;GAAS,CAAC;EAC3D,MAAM,OAAO,MAAM,KAAK,cAAc,MAAM,QAAQ;AAGpD,MAAI,KAAK,WAAW,CAAC,QAAQ,SAAS;AACpC,QAAK,IAAI,MAAM,oBAAoB,EAAE,MAAM,CAAC;AAC5C,UAAO,KAAK,QACV;IACE,QAAQ,KAAK;IACb,KAAK,IAAI,IAAI,mBAAmB,KAAK,OAAO;IAC5C,OAAO,OAAO,SAAS,EAAE;IACzB,MAAM,OAAO,QAAQ,EAAE;IACvB,QAAQ,OAAO,UAAU,EAAE;IAC3B,SAAS,OAAO,WAAW,EAAE;IAC7B,UAAU,EAAE;IACZ,OAAO,IAAI,aAAa;IACzB,EACD,QACD;;AAGH,OAAK,IAAI,MAAM,qBAAqB;GAClC;GACA,MAAM,KAAK;GACX,SAAS,KAAK;GACf,CAAC;AAEF,SAAO,KAAK,aAAa,MAAM,QAAQ,QAAQ,CAAC,MAC7C,aAAa,SAAS,KACxB;;CAGH,AAAU,oBACR,MACA,QAAqB,EAAE,EACL;EAClB,MAAMA,IAAsB,OAC1B,SAAc,EAAE,EAChB,UAAgC,EAAE,KAC/B;AACH,UAAO,KAAK,OAAO,MAAM,QAAQ;IAC/B,GAAG;IACH,GAAG;IACJ,CAAC;;AAGJ,SAAO,eAAe,GAAG,QAAQ;GAC/B,OAAO;GACP,UAAU;GACX,CAAC;AAEF,IAAE,MAAM,OAAO,SAAc,EAAE,EAAE,UAAgC,EAAE,KAAK;AACtE,UAAO,KAAK,OAAO,MAAM,QAAQ;IAC/B,GAAG;IACH,GAAG;IACJ,CAAC;;AAGJ,IAAE,QAAQ,OAAO,SAAc,EAAE,EAAE,UAAgC,EAAE,KAAK;GACxE,MAAM,OAAO,MAAM,KAAK,cAAc,MAAM,MAAM;AAClD,UAAO,KAAK,aAAa,MAAM,QAAQ,QAAQ;;AAGjD,IAAE,YAAY;AACZ,UAAO,KAAK,IAAI,KAAK;;AAGvB,SAAO;;CAGT,MAAgB,aACd,MACA,SAA4C,EAAE,EAC9C,UAAgC,EAAE,EACV;AACxB,UAAQ,YAAY,EAAE;AACtB,UAAQ,QAAQ,UAAU,IAAI,QAAQ,QAAQ,QAAQ,QAAQ;EAE9D,MAAM,MAAM,KAAK,OAAO,QAAQ,IAAmB,UAAU;AAC7D,MAAI,KAAK,QAAQ,cACf,SAAQ,QAAQ,QAAQ,IAAI,iBAAiB,IAAI,QAAQ,cAAc;EAGzE,MAAM,UAAU,KAAK,OAAO,QAAQ,IAAI,UAAU;AAClD,MAAI,OAAO,YAAY,SACrB,SAAQ,QAAQ,QAAQ,IAAI,gBAAgB,QAAQ;EAGtD,MAAM,SAAS;GACb,GAAG;GAGH,QAAQ;IACN,MAAM,EAAE,KAAK;IACb,UAAU,EAAE,KAAK;IAClB;GACF;AAGD,MAAI,CAAC,KAAK,QAAQ,KAAK,QACrB,QAAO,OAAO,IAAI,KAAK,UAAU,OAAO;AAG1C,SAAO,OAAO,GAAG,OAAO,UAAU,SAAS,OAAO;AAClD,SAAO,SAAS;AAGhB,SAAO,KAAK,WAAW,YAAY;GACjC,MAAM,KAAK;GACX;GACA;GACQ;GACT,CAAC;;CAGJ,MAAgB,cACd,MACA,UAAuB,EAAE,EACA;AACzB,MACE,KAAK,OAAO,WAAW,IACvB,CAAC,KAAK,OAAO,MAAM,IAAI,iCAAiC,CAExD,OAAM,KAAK,YAAY;EAGzB,MAAM,OAAO,KAAK,MAAM,MACrB,MACC,EAAE,SAAS,SACV,CAAC,QAAQ,SAAS,EAAE,UAAU,QAAQ,WACtC,CAAC,QAAQ,WAAW,QAAQ,YAAY,EAAE,SAC9C;AAED,MAAI,CAAC,MAAM;GACT,MAAM,QAAQ,IAAI,kBAAkB,UAAU,KAAK,aAAa;AAEhE,SAAM,KAAK,OAAO,OAAO,KAAK,kBAAkB;IAC9C,OAAO;IACP;IACD,CAAC;AACF,SAAM;;AAGR,MAAI,QAAQ,SACV,QAAO;GACL,GAAG;GACH,MAAM,QAAQ;GACf;AAGH,SAAO;;;;;;;;;AC1SX,MAAa,WACX,UACyB;AACzB,QAAO,QAAQ,aAAa,CAAC,OAAU,MAAM;;AAG/C,QAAQ,QAAQ;;;;;;;;;;;;;ACHhB,MAAa,WAAW,YAAoC;AAC1D,QAAO,gBAAgB,iBAAiB,QAAQ;;AAuDlD,IAAa,kBAAb,cAAqC,UAAkC;CACrE,IAAW,OAAe;AACxB,SAAO,KAAK,QAAQ,QAAQ,KAAK,OAAO;;;AAI5C,QAAQ,QAAQ;;;;AC/DhB,MAAMC,cAAY,EAAE,OAAO,EACzB,mBAAmB,EAAE,KAAK;CACxB,aAAa;CACb,SAAS;CACV,CAAC,EACH,CAAC;AAEF,IAAa,0BAAb,MAAqC;CACnC,AAAmB,MAAM,KAAKA,YAAU;CACxC,AAAmB,SAAS,QAAQ,OAAO;CAC3C,AAAmB,gBAAgB,QAAQ,oBAAoB;CAC/D,AAAmB,eAAe,QAAQ,aAAa;CACvD,AAAmB,UAA+B,EAAE;CACpD,AAAmB,MAAM,SAAS;CAElC,AAAO,aAA6B;AAClC,SAAO,KAAK;;CAGd,AAAgB,YAAY,MAAM;EAChC,IAAI;EACJ,SAAS,YAAY;GACnB,MAAM,UAAU,KAAK,OAAO,WAAW,QAAQ;AAC/C,QAAK,MAAM,UAAU,QACnB,OAAM,KAAK,eAAe,OAAO;;EAGtC,CAAC;CAEF,AAAgB,QAAQ,MAAM;EAC5B,IAAI;EACJ,SAAS,YAAY;AACnB,QAAK,MAAM,UAAU,KAAK,SAAS;IACjC,MAAM,QACJ,OAAO,OAAO,gBAAgB,UAAU,aACpC,MAAM,OAAO,eAAe,OAAO,GACnC;AAEN,QAAI,CAAC,OAAO,SACV;IAGF,MAAM,EAAE,UAAU,MAAM,OAAO,MAAM,EAAE,eAAe,OAAO,CAAC;AAE9D,SAAK,MAAM,QAAQ,OAAO;KACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,OAAO,QAAQ,GAAG;AAC/C,SAAI,KAAK,QACP,QAAO,IAAI,KAAK,UAAU;AAG5B,UAAK,aAAa,aAAa;MAC7B,GAAG;MACH,QAAQ,OAAO;MACf;MACA,QAAQ,KAAK,UAAU;MACvB,MAAM,OAAO;MACb,SAAS,OAAO;MACjB,CAAC;;AAGJ,SAAK,IAAI,KAAK,WAAW,OAAO,KAAK,OAAO;KAC1C,OAAO,OAAO,MAAM;KACpB,QAAQ,OAAO;KAChB,CAAC;;;EAGP,CAAC;CAEF,MAAa,eAAe,OAAuC;EACjE,MAAM,UAAU,MAAM;EACtB,MAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM,QAAQ,KAAK;EACzE,MAAM,WAAW,aAAa,KAAK;EACnC,MAAM,OAAO,MAAM;EACnB,MAAM,QAAQ,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ,EAAE;EAEpE,MAAMC,SAAuB;GAC3B;GACA;GACA,QAAQ;GACR,gBAAgB,QAAQ;GACxB,OAAO,CAAC,CAAC,QAAQ;GACjB,UAAU,CAAC,MAAM;GACjB,QAAQ,OAAO,SAAS;IACtB,MAAM,EAAE,eAAe,iBAAS;AAChC,WAAO,MAAM,MAAM,GAAG,MAAM,SAAS,GAAGC,OAAK,UAAU,EACrD,SAAS,IAAI,QACX,gBACI,EACE,eACD,GACD,EAAE,CACP,EACF,CAAC,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC;;GAE5B,OAAO,OAAO,SAAS;IACrB,MAAM,EAAE,kBAAkB;IAC1B,MAAM,YAAY,MAAM,KAAK,WAAW,IAAI;KAC1C,SAAS;KACT,KAAK,GAAG,MAAM;KACd;KACD,CAAC;AAEF,QAAI,UAAU,UAAU,KACtB,QAAO,SAAS,UAAU;AAG5B,WAAO;;GAEV;AAED,OAAK,QAAQ,KAAK,OAAO;AAEzB,MAAI,QAAQ,MACV,MAAK,cAAc,YAAY;GAC7B,MAAM,GAAG,KAAK,IAAI,kBAAkB,GAAG,KAAK;GAC5C,QAAQ;GACR,UAAU,UAAQ;AAChB,UAAI,WAAWC,MAAI,SAAS,QAC1B,GAAG,KAAK,IAAI,kBAAkB,GAAG,QACjC,OAAO,OACR;;GAEH,GAAG;GACJ,CAAC;;CAIN,AAAmB,aAAa,OAAO;EACrC,KAAK;EACL,SAAS,EACP,SAAS,KACV;EACD,UAAU,GAAG,SAAS,EAAE,SAAS,UAAU;AACzC,QAAK,IAAI,KAAK,iCAAiC,QAAQ,OAAO;IAC5D;IACA;IACD,CAAC;;EAEJ,SAAS,OAAO,SAAuD;GACrE,MAAM,EAAE,KAAK,kBAAkB;GAC/B,MAAM,WAAW,MAAM,MAAM,KAAK,EAChC,SAAS,IAAI,QACX,gBACI,EACE,eACD,GACD,EAAE,CACP,EACF,CAAC;AAEF,OAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,8BAA8B,MAAM;AAGtD,UAAO,KAAK,OAAO,MAAM,OACvB,wBACA,MAAM,SAAS,MAAM,CACtB;;EAEJ,CAAC;;;;;ACrJJ,MAAM,YAAY,EAAE,OAAO,EACzB,mBAAmB,EAAE,KAAK;CACxB,aAAa;CACb,SAAS;CACV,CAAC,EACH,CAAC;AAEF,IAAa,sBAAb,MAAiC;CAC/B,AAAmB,MAAM,KAAK,UAAU;CACxC,AAAmB,SAAS,QAAQ,OAAO;CAC3C,AAAmB,eAAe,QAAQ,aAAa;CACvD,AAAmB,iBAAiB,QAAQ,wBAAwB;CACpE,AAAmB,uBAAuB,QAAQ,qBAAqB;CAEvE,IAAW,SAAS;AAClB,SAAO,KAAK,IAAI;;CAGlB,AAAgB,UAAU,MAAM;EAC9B,IAAI;EACJ,eAAe;AAEb,QAAK,MAAM,UAAU,KAAK,OAAO,WAAW,QAAQ,CAClD,MAAK,aAAa,aAAa;IAC7B,MAAM,OAAO;IACb,OAAO,OAAO;IACd,QAAQ,OAAO,QAAQ;IACvB,iBAAiB,OAAO,oBAAoB;IAC5C,SAAS,OAAO,QAAQ,UAAU;IAClC,QAAQ,OAAO,WAAW,QAAQ,SAAY,OAAO;IACrD,QAAQ,OAAO;IACf,MAAM,OAAO;IAEb,UACE,QACA,UAAgC,EAAE,KAC/B,OAAO,IAAI,QAAQ,QAAQ;IACjC,CAAC;;EAGP,CAAC;;;;;;CAOF,AAAgB,QAAQ,OAAO;EAC7B,MAAM,aAAa,KAAK;EACxB,QAAQ,EACN,UAAU,wBACX;EACD,UAAU,EAAE,MAAM,cAAc;AAC9B,UAAO,KAAK,gBAAgB;IAC1B;IACA,eAAe,QAAQ;IACxB,CAAC;;EAEL,CAAC;;;;;;;CAQF,AAAgB,SAAS,OAAO;EAC9B,MAAM,aAAa,KAAK;EACxB,QAAQ;GACN,QAAQ,EAAE,OAAO,EACf,MAAM,EAAE,MAAM,EACf,CAAC;GACF,UAAU,EAAE,MAAM;GACnB;EACD,UAAU,EAAE,QAAQ,MAAM,cAAc;AACtC,UAAO,KAAK,gBAAgB,OAAO,MAAM;IACvC;IACA,eAAe,QAAQ;IACxB,CAAC;;EAEL,CAAC;CAEF,MAAa,gBACX,MACA,UAA8B,EAAE,EACF;EAC9B,MAAM,gBAAgB,QAAQ;EAC9B,MAAM,MAAM,MAAM,KAAK,gBAAgB;GACrC,MAAM,QAAQ;GACd;GACD,CAAC;AAEF,OAAK,MAAM,QAAQ,IAAI,MACrB,KAAI,KAAK,SAAS,MAAM;AACtB,OAAI,KAAK,QAEP,QAAO,KAAK,eACT,YAAY,CACZ,MAAM,OAAO,GAAG,SAAS,KAAK,QAAQ,EACrC,OAAO;IAAQ;IAAM;IAAe,CAAC;AAI3C,UACE,KAAK,aAAa,gBAAgB,CAAC,MAAM,OAAO,GAAG,SAAS,KAAK,EAC7D,UAAU,EAAE;;AAKtB,SAAO,EAAE;;;;;;CAOX,MAAa,gBACX,SAC2B;EAC3B,MAAM,EAAE,SAAS;EACjB,IAAIC;EACJ,IAAIC;EACJ,MAAM,cAAc,KAAK,OAAO,IAAI,iBAAiB;AACrD,MAAI,eAAe,MAAM;AACvB,iBAAc,KAAK,OAAO,OAAO,iBAAiB,CAAC,eAAe,KAAK;AACvE,mBAAgB,IAAI,IAClB,YAAY,KAAK,OAAO,CAAC,GAAG,GAAG,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC,CACxD;;EAGH,MAAMC,YAAuB,EAAE;AAG/B,OAAK,MAAM,cAAc,eAAe,EAAE,CACxC,KACE,CAAC,WAAW,QACZ,CAAC,WAAW,UACZ,WAAW,QACX,WAAW,MAEX,WAAU,KAAK;GACb,MAAM;GACN,MAAM,WAAW;GACjB,OAAO,WAAW;GACnB,CAAC;AAKN,OAAK,MAAM,QAAQ,KAAK,aAAa,gBAAgB,EAAE;AAErD,OAAI,KAAK,KAAM;AAEf,OAAI,eAAe,KAAK,SAAS;AAE/B,QAAI,CAAC,KACH;AAGF,QAAI,OAAO,KAAK,YAAY,YAAY,KAAK,QAAQ,OAEnD;SAAI,KAAK,UAAU,KAAK,QAAQ,MAC9B;eAEO,eAGT;SAAI,CAAC,cAAc,IAAI,GAAG,KAAK,MAAM,GAAG,KAAK,OAAO,CAClD;;;AAKN,aAAU,KAAK;IACb,MAAM,KAAK;IACX,OAAO,KAAK;IACZ,iBAAiB,KAAK;IACtB,QAAQ,KAAK;IACb,MAAM,KAAK;IACZ,CAAC;;AAGJ,OAAK,qBAAqB,YAAY,mBAAmB;EAGzD,MAAM,WAAW,KAAK,eACnB,YAAY,CACZ,QAAQ,OAAO,GAAG,MAAM,CACxB,IAAI,OAAO,WAAW;GACrB,MAAM,EAAE,OAAO,WAAW,MAAM,OAAO,MAAM,QAAQ;AACrD,UAAO,MAAM,KAAK,SAAS;IACzB,IAAI,OAAO,KAAK,KAAK,QAAQ,UAAU,QAAQ,GAAG;AAClD,QAAI,KAAK,QACP,QAAO,IAAI,KAAK,UAAU;AAG5B,WAAO;KACL,GAAG;KACH;KACA,OAAO;KACP,SAAS,OAAO;KACjB;KACD;IACF;AAEJ,YAAU,KAAK,IAAI,MAAM,QAAQ,IAAI,SAAS,EAAE,MAAM,CAAC;AACvD,OAAK,qBAAqB,UAAU,mBAAmB;AAEvD,SAAO;GACL,QAAQ,KAAK,IAAI;GACjB,OAAO;GACR;;;;;;;;;;;;;;;;;AC5LL,MAAa,oBAAoB,QAAQ;CACvC,MAAM;CACN,YAAY,CAAC,SAAS,QAAQ;CAC9B,UAAU;EACR;EACA;EACA;EACA;EACD;CACF,CAAC"}

package/dist/server-metrics/index.d.ts

@@ -9,10 +9,10 @@ declare class ServerMetricsProvider {
   protected readonly alepha: Alepha;
   protected httpRequestDuration?: Histogram<string>;
   readonly options: ServerMetricsProviderOptions;
-  readonly metrics: alepha_server0.RouteDescriptor<alepha_server0.RequestConfigSchema>;
-  protected readonly onStart: alepha1.HookDescriptor<"start">;
-  protected readonly onRequest: alepha1.HookDescriptor<"server:onRequest">;
-  protected readonly onResponse: alepha1.HookDescriptor<"server:onResponse">;
+  readonly metrics: alepha_server0.RoutePrimitive<alepha_server0.RequestConfigSchema>;
+  protected readonly onStart: alepha1.HookPrimitive<"start">;
+  protected readonly onRequest: alepha1.HookPrimitive<"server:onRequest">;
+  protected readonly onResponse: alepha1.HookPrimitive<"server:onResponse">;
 }
 interface ServerMetricsProviderOptions {
   prefix?: string;