kuzzle 2.60.0-beta.4 → 2.60.0-beta.5

package/dist/lib/api/controllers/adminController.d.ts

@@ -44,7 +44,13 @@ declare class AdminController extends NativeController {
     shutdown(): Promise<{
         acknowledge: boolean;
     }>;
-    loadFixtures(request: KuzzleRequest): Promise<any>;
+    /**
+     * Always waits for the import, so that a failure is reported to the caller:
+     * `refresh=false` only skips waiting for the documents to be indexed.
+     */
+    loadFixtures(request: KuzzleRequest): Promise<{
+        acknowledge: boolean;
+    }>;
     loadMappings(request: KuzzleRequest): Promise<{
         acknowledge: boolean;
     }>;

package/dist/lib/api/controllers/adminController.js

@@ -161,15 +161,22 @@ class AdminController extends baseController_1.NativeController {
         if (this.shuttingDown) {
             throw kerror.get("api", "process", "action_locked", "Kuzzle is already shutting down.");
         }
+        this.shuttingDown = true;
         global.kuzzle.shutdown();
         return { acknowledge: true };
     }
-    loadFixtures(request) {
+    /**
+     * Always waits for the import, so that a failure is reported to the caller:
+     * `refresh=false` only skips waiting for the documents to be indexed.
+     */
+    async loadFixtures(request) {
         const fixtures = request.getBody();
         const refresh = request.getRefresh("wait_for");
-        return global.kuzzle.ask("core:storage:public:document:import", fixtures, {
+        await global.kuzzle.ask("core:storage:public:document:import", fixtures, {
             refresh,
         });
+        // The documented answer. 2.17.6 to 2.59 answered `null` instead.
+        return { acknowledge: true };
     }
     loadMappings(request) {
         const mappings = request.getBody();

package/dist/lib/api/funnel.js

@@ -664,13 +664,24 @@ class Funnel {
             catch (e) {
                 error = e;
                 debug("Error processing request %s: %a", request.id, error);
+                // processRequest does not dump: do it as the event-less path does.
+                // Rethrown, never falling through to the event-less execution below,
+                // which ran a failed (or pipe-rejected) request a second time.
+                this.handleErrorDump((0, thrown_1.causeOf)(e));
+                throw e;
             }
             finally {
-                global.kuzzle.pipe("request:afterExecution", {
+                // Not awaited, as it always was: the caller's result does not depend
+                // on it. Its rejection is logged instead of left unhandled.
+                global.kuzzle
+                    .pipe("request:afterExecution", {
                     error: error,
                     request: request,
                     result: res,
                     success: error === undefined,
+                })
+                    ?.catch((pipeError) => {
+                    this.logger.error(pipeError, `request:afterExecution pipe failed for plugin request ${request.id}`);
                 });
             }
         }

package/dist/lib/api/httpRoutes.js

@@ -184,12 +184,6 @@ const routes = [
         controller: "admin",
         action: "resetDatabase",
     },
-    {
-        verb: "post",
-        path: "/admin/_resetKuzzleData",
-        controller: "admin",
-        action: "resetKuzzleData",
-    },
     { verb: "post", path: "/admin/_dump", controller: "admin", action: "dump" },
     {
         verb: "post",
@@ -251,12 +245,6 @@ const routes = [
         controller: "index",
         action: "exists",
     },
-    {
-        verb: "get",
-        path: "/:index/_autoRefresh",
-        controller: "index",
-        action: "getAutoRefresh",
-    },
     { verb: "get", path: "/_list", controller: "index", action: "list" },
     { verb: "get", path: "/_storageStats", controller: "index", action: "stats" },
     {
@@ -1133,13 +1121,6 @@ const routes = [
         controller: "ms",
         action: "append",
     },
-    {
-        verb: "post",
-        path: "/ms/_bgrewriteaof",
-        controller: "ms",
-        action: "bgrewriteaof",
-    },
-    { verb: "post", path: "/ms/_bgsave", controller: "ms", action: "bgsave" },
     { verb: "post", path: "/ms/_bitop/:_id", controller: "ms", action: "bitop" },
     { verb: "post", path: "/ms/_decr/:_id", controller: "ms", action: "decr" },
     {
@@ -1514,7 +1495,7 @@ const routes = [
         controller: "security",
         action: "deleteApiKey",
         openapi: {
-            description: "Deletes a user API key, identified by its clear-text `key` or its `fingerprint` instead of its `_id`. Exactly one of `key` or `fingerprint` must be provided. If you are looking to manage your own API keys, use the `auth` controller instead.",
+            description: "Deletes a user API key, identified by its clear-text `key` or its `fingerprint` instead of its `_id`. One of them must be provided; if several are given, `_id` is used first, then `key`, then `fingerprint`, and the others are ignored. A `key` in the query string is a secret written in the URL: prefer the `fingerprint`. If you are looking to manage your own API keys, use the `auth` controller instead.",
             parameters: [
                 {
                     in: "path",
@@ -1572,6 +1553,57 @@ const routes = [
         controller: "auth",
         action: "deleteApiKey",
     },
+    {
+        verb: "delete",
+        path: "/api-keys",
+        controller: "auth",
+        action: "deleteApiKey",
+        openapi: {
+            description: "Deletes an API key of the current user, identified by its clear-text `key` or its `fingerprint` instead of its `_id`. One of them must be provided; if several are given, `_id` is used first, then `key`, then `fingerprint`, and the others are ignored. A `key` in the query string is a secret written in the URL: prefer the `fingerprint`.",
+            parameters: [
+                {
+                    in: "query",
+                    name: "key",
+                    schema: { type: "string" },
+                    required: false,
+                    description: "Clear-text API key to delete",
+                },
+                {
+                    in: "query",
+                    name: "fingerprint",
+                    schema: { type: "string" },
+                    required: false,
+                    description: "SHA256 fingerprint of the API key to delete",
+                },
+                {
+                    in: "query",
+                    name: "refresh",
+                    schema: {
+                        type: "string",
+                        enum: ["wait_for", "false"],
+                        default: "wait_for",
+                    },
+                    required: false,
+                    description: "If set to `wait_for`, waits for the deletion to be indexed before responding",
+                },
+            ],
+            responses: {
+                200: {
+                    description: "The deleted API key ID",
+                    content: {
+                        "application/json": {
+                            schema: {
+                                type: "object",
+                                properties: {
+                                    _id: { type: "string" },
+                                },
+                            },
+                        },
+                    },
+                },
+            },
+        },
+    },
     // PUT (idempotent)
     { verb: "put", path: "/_me", controller: "auth", action: "updateSelf" },
     {

package/dist/lib/api/request/kuzzleRequest.d.ts

@@ -385,12 +385,17 @@ export declare class KuzzleRequest {
      */
     getDate(name: string, format?: string): string;
     /**
-     * Gets a parameter from a request arguments and returns it to timestamp format.
+     * Gets a parameter from a request arguments and checks that it is an integer
+     * timestamp (e.g. milliseconds since Epoch).
+     *
+     * An integer string, such as an HTTP query string value, is accepted and
+     * converted. A date string (e.g. `"2026-10-27"`) is rejected.
      *
      * @param name parameter name.
      * @throws {api.assert.missing_argument} If parameter not found and no default
      *                                       value provided
-     * @throws {api.assert.invalid_type} If parameter value is not a valid date.
+     * @throws {api.assert.invalid_type} If parameter value is not an integer
+     *                                   timestamp.
      */
     getTimestamp(name: string): number;
     /**

package/dist/lib/api/request/kuzzleRequest.js

@@ -676,31 +676,41 @@ class KuzzleRequest {
         if (args[name] === undefined) {
             throw assertionError.get("missing_argument", name);
         }
-        if (format && !(0, moment_1.default)(args[name], format, true).isValid()) {
-            throw assertionError.get("invalid_type", name, "date");
-        }
-        if (!(0, moment_1.default)(args[name], moment_1.default.ISO_8601).isValid()) {
+        // A custom format replaces the ISO 8601 check: applying both rejected
+        // every value of a format that is not ISO 8601.
+        const isValid = format
+            ? (0, moment_1.default)(args[name], format, true).isValid()
+            : (0, moment_1.default)(args[name], moment_1.default.ISO_8601).isValid();
+        if (!isValid) {
             throw assertionError.get("invalid_type", name, "date");
         }
         return this.getString(name);
     }
     /**
-     * Gets a parameter from a request arguments and returns it to timestamp format.
+     * Gets a parameter from a request arguments and checks that it is an integer
+     * timestamp (e.g. milliseconds since Epoch).
+     *
+     * An integer string, such as an HTTP query string value, is accepted and
+     * converted. A date string (e.g. `"2026-10-27"`) is rejected.
      *
      * @param name parameter name.
      * @throws {api.assert.missing_argument} If parameter not found and no default
      *                                       value provided
-     * @throws {api.assert.invalid_type} If parameter value is not a valid date.
+     * @throws {api.assert.invalid_type} If parameter value is not an integer
+     *                                   timestamp.
      */
     getTimestamp(name) {
-        const args = this.input.args;
-        if (args[name] === undefined) {
+        const value = this.input.args[name];
+        if (value === undefined) {
             throw assertionError.get("missing_argument", name);
         }
-        if ((0, moment_1.default)(args[name], true).isValid() === false) {
+        const timestamp = typeof value === "string" && /^-?\d+$/.test(value)
+            ? Number(value)
+            : value;
+        if (!Number.isSafeInteger(timestamp)) {
             throw assertionError.get("invalid_type", name, "date");
         }
-        return this.getInteger(name);
+        return timestamp;
     }
     /**
      * Returns the index specified in the request

package/dist/lib/api/request/requestContext.d.ts

@@ -19,7 +19,7 @@ export type ContextMisc = {
      */
     path?: string;
     /**
-     * HTTP headers
+     * HTTP method, uppercase (e.g. `GET`)
      */
     verb?: string;
     /**

package/dist/lib/api/request/requestResponse.js

@@ -127,7 +127,8 @@ class Headers {
             case "host":
             case "if-modified-since":
             case "if-unmodified-since":
-            case "last-modified, location":
+            case "last-modified":
+            case "location":
             case "max-forwards":
             case "proxy-authorization":
             case "referer":

package/dist/lib/config/index.js

@@ -28,21 +28,27 @@ const assert_1 = __importDefault(require("assert"));
 const node_util_1 = require("node:util");
 const rc_1 = __importDefault(require("rc"));
 const default_config_1 = __importDefault(require("./default.config"));
+const authTokenSettings_1 = require("../core/security/authTokenSettings");
 const package_json_1 = __importDefault(require("../../package.json"));
 const kerror_1 = require("../kerror");
 const safeObject_1 = require("../util/safeObject");
 const bytes_1 = __importDefault(require("../util/bytes"));
 const wrapped = (0, kerror_1.wrap)("core", "configuration");
 function loadConfig() {
-    let loaded;
+    let raw;
     try {
-        loaded = (0, rc_1.default)("kuzzle", default_config_1.default);
+        raw = (0, rc_1.default)("kuzzle", withoutTokenDefaults(default_config_1.default));
     }
     catch (e) {
         throw wrapped.get("cannot_parse", e instanceof Error ? e.message : (0, node_util_1.inspect)(e));
     }
     // In place: what `unstringify` answers is the object it was given.
-    unstringify(loaded);
+    unstringify(raw);
+    const { authToken, deprecatedSettings, jwt } = resolveTokenSettings(raw.security);
+    const loaded = {
+        ...raw,
+        security: { ...raw.security, authToken, jwt },
+    };
     checkLimitsConfig(loaded);
     checkHttpOptions(loaded);
     checkWebSocketOptions(loaded);
@@ -56,6 +62,7 @@ function loadConfig() {
             hash: {
                 seed: Buffer.from("^m&mOISKBvb1xpl1mRsrylaQXpjb&IJX"),
             },
+            deprecatedSettings,
             notifiableProtocols: [],
         },
         version: package_json_1.default.version,
@@ -66,6 +73,56 @@ function loadConfig() {
     preprocessRedisOptions(config.services.memoryStorage);
     return config;
 }
+/**
+ * The packaged defaults, minus the values of `security.authToken` and of its
+ * deprecated spelling `security.jwt`: both sections ship the same non-null
+ * defaults, so once `rc` has merged them nothing tells a user's
+ * `jwt.expiresIn` from the packaged one. Left empty here, they hold only what
+ * the user set, and {@link resolveTokenSettings} applies the defaults after.
+ *
+ * A shallow copy: the other sections stay the packaged objects `rc` merges
+ * into, as before.
+ */
+function withoutTokenDefaults(defaults) {
+    const authToken = {};
+    const jwt = {};
+    return { ...defaults, security: { ...defaults.security, authToken, jwt } };
+}
+/**
+ * Resolves the authentication token settings: for each one, the value set
+ * under `security.authToken` wins, then the one set under the deprecated
+ * `security.jwt`, then the packaged default. A `null` counts as unset, as the
+ * readers' `authToken.x ?? jwt.x` always did. Exception: `gracePeriod` set in
+ * both sections keeps the `jwt` one, as it always did (see
+ * {@link LEGACY_FIRST}).
+ *
+ * Both sections get the resolved values, so a reader of either — a plugin
+ * may still read `jwt` — sees the settings in effect. `deprecatedSettings`
+ * lists the `security.jwt.*` keys the user set, for the deprecation warning.
+ */
+function resolveTokenSettings(security) {
+    const packaged = default_config_1.default.security.authToken;
+    const fromPackage = packaged;
+    const fromAuthToken = (0, safeObject_1.isPlainObject)(security.authToken)
+        ? security.authToken
+        : {};
+    const fromJwt = (0, safeObject_1.isPlainObject)(security.jwt) ? security.jwt : {};
+    const resolved = {};
+    for (const key of new Set([
+        ...Object.keys(packaged),
+        ...Object.keys(fromJwt),
+        ...Object.keys(fromAuthToken),
+    ])) {
+        resolved[key] = authTokenSettings_1.LEGACY_FIRST.has(key)
+            ? (fromJwt[key] ?? fromAuthToken[key] ?? fromPackage[key])
+            : (fromAuthToken[key] ?? fromJwt[key] ?? fromPackage[key]);
+    }
+    return {
+        authToken: { ...packaged, ...resolved },
+        deprecatedSettings: Object.keys(fromJwt).map((key) => `security.jwt.${key}`),
+        jwt: { ...resolved },
+    };
+}
 /**
  * RC params can be overriden using environment variables,
  * in which case all values are passed as strings.

package/dist/lib/core/backend/backend.d.ts

@@ -99,13 +99,14 @@ export declare class Backend {
      */
     plugin: BackendPlugin;
     /**
-     * InternalLogger
+     * Application logger
      *
+     * @method trace
      * @method debug
      * @method info
      * @method warn
      * @method error
-     * @method verbose
+     * @method fatal
      */
     log: Logger;
     /**

package/dist/lib/core/backend/internalLogger.d.ts

@@ -1,4 +1,10 @@
 import { ApplicationManager } from "./index";
+/**
+ * Kuzzle no longer creates instances of this class: `Backend.log` is a
+ * `Logger` since 2.45.0.
+ *
+ * @deprecated Use `Logger` (`app.log`) instead.
+ */
 export declare class InternalLogger extends ApplicationManager {
     /**
      * Logs a trace message

package/dist/lib/core/backend/internalLogger.js

@@ -26,6 +26,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.InternalLogger = void 0;
 const util_1 = __importDefault(require("util"));
 const index_1 = require("./index");
+/**
+ * Kuzzle no longer creates instances of this class: `Backend.log` is a
+ * `Logger` since 2.45.0.
+ *
+ * @deprecated Use `Logger` (`app.log`) instead.
+ */
 class InternalLogger extends index_1.ApplicationManager {
     /**
      * Logs a trace message

package/dist/lib/core/network/router.d.ts

@@ -32,9 +32,27 @@ declare class Router {
      * Transmit HTTP requests to the funnel controller and forward its response
      * back to the client
      *
+     * Triggers the `http:<verb>` pipe with the verb lowercased, as documented.
+     * A route declared with another case (e.g. `verb: 'GET'`) also triggers the
+     * event under the declared case (`http:GET`), which is the one it used to
+     * trigger: see docs/v3-breaking-changes.md.
+     *
+     * @param verb - the route's HTTP verb, as declared
      * @param request - includes URL and POST query data
      * @param cb - callback to invoke with the result
      */
     _executeFromHttp(verb: string, request: Request, cb: RouteCallback): void;
+    /**
+     * Triggers an `http:<verb>` pipe, and answers its error through `cb` or
+     * hands the piped request over to `next`.
+     *
+     * Callbacks rather than promises: this runs before the funnel.
+     */
+    private _pipeHttpEvent;
+    /**
+     * Executes the piped request in the funnel and answers its result through
+     * `cb`, falling back on the original request when there is none.
+     */
+    private _executeInFunnel;
 }
 export = Router;

package/dist/lib/core/network/router.js

@@ -190,25 +190,59 @@ class Router {
      * Transmit HTTP requests to the funnel controller and forward its response
      * back to the client
      *
+     * Triggers the `http:<verb>` pipe with the verb lowercased, as documented.
+     * A route declared with another case (e.g. `verb: 'GET'`) also triggers the
+     * event under the declared case (`http:GET`), which is the one it used to
+     * trigger: see docs/v3-breaking-changes.md.
+     *
+     * @param verb - the route's HTTP verb, as declared
      * @param request - includes URL and POST query data
      * @param cb - callback to invoke with the result
      */
     _executeFromHttp(verb, request, cb) {
-        global.kuzzle.pipe(`http:${verb}`, request, (error, mutatedRequest) => {
+        const event = `http:${verb.toLowerCase()}`;
+        const declaredEvent = `http:${verb}`;
+        this._pipeHttpEvent(event, request, cb, (pipedRequest) => {
+            if (declaredEvent === event) {
+                this._executeInFunnel(pipedRequest, request, cb);
+                return;
+            }
+            // @deprecated - declared-case event, to drop in v3
+            this._pipeHttpEvent(declaredEvent, pipedRequest, cb, (legacyRequest) => {
+                this._executeInFunnel(legacyRequest, request, cb);
+            });
+        });
+    }
+    /**
+     * Triggers an `http:<verb>` pipe, and answers its error through `cb` or
+     * hands the piped request over to `next`.
+     *
+     * Callbacks rather than promises: this runs before the funnel.
+     */
+    _pipeHttpEvent(event, request, cb, next) {
+        // callback form: the outcome, error included, goes through the callback
+        void global.kuzzle.pipe(event, request, (error, mutatedRequest) => {
             if (error) {
                 request.setError(error);
                 cb(request);
                 return;
             }
-            global.kuzzle.funnel.execute(mutatedRequest, (err, result) => {
-                const _res = result || request;
-                if (err && !_res.error) {
-                    _res.setError(err);
-                }
-                // no sanitisation here: `_res` is a KuzzleRequest, and the stack
-                // is stripped by the protocols, on the serialized response
-                cb(_res);
-            });
+            next(mutatedRequest);
+        });
+    }
+    /**
+     * Executes the piped request in the funnel and answers its result through
+     * `cb`, falling back on the original request when there is none.
+     */
+    _executeInFunnel(pipedRequest, request, cb) {
+        global.kuzzle.funnel.execute(pipedRequest, (err, result) => {
+            const _res = result || request;
+            if (err && !_res.error) {
+                _res.setError(err);
+            }
+            // no sanitisation here: `_res` is a KuzzleRequest, and the stack
+            // is stripped by the protocols, on the serialized response
+            cb(_res);
         });
     }
 }

package/dist/lib/core/security/authTokenSettings.d.ts

@@ -0,0 +1,21 @@
+import type { SecurityConfiguration } from "../../types/config/SecurityConfiguration";
+type AuthTokenSettings = SecurityConfiguration["authToken"];
+/**
+ * The settings for which a value set under the deprecated `security.jwt`
+ * wins over one set under `security.authToken`: `gracePeriod` used to be
+ * read from `jwt` only, so a configuration setting both keeps working as it
+ * did. To drop in v3 (docs/v3-breaking-changes.md).
+ */
+export declare const LEGACY_FIRST: ReadonlySet<string>;
+/**
+ * Reads one authentication token setting: the value set under
+ * `security.authToken` wins, then the one set under its deprecated spelling
+ * `security.jwt`, then the packaged default (except for {@link LEGACY_FIRST}).
+ *
+ * `loadConfig()` already resolves both sections from what the configuration
+ * files and the environment set. This covers a change made afterwards, e.g.
+ * `app.config.set("security.jwt.expiresIn", "2h")` before `app.start()`: a
+ * value that differs from the packaged default is one somebody set.
+ */
+export declare function authTokenSetting<K extends keyof AuthTokenSettings>(key: K): AuthTokenSettings[K];
+export {};

package/dist/lib/core/security/authTokenSettings.js

@@ -0,0 +1,61 @@
+"use strict";
+/*
+ * Kuzzle, a backend software, self-hostable and ready to use
+ * to power modern apps
+ *
+ * Copyright 2015-2022 Kuzzle
+ * mailto: support AT kuzzle.io
+ * website: http://kuzzle.io
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEGACY_FIRST = void 0;
+exports.authTokenSetting = authTokenSetting;
+const default_config_1 = __importDefault(require("../../config/default.config"));
+/**
+ * The settings for which a value set under the deprecated `security.jwt`
+ * wins over one set under `security.authToken`: `gracePeriod` used to be
+ * read from `jwt` only, so a configuration setting both keeps working as it
+ * did. To drop in v3 (docs/v3-breaking-changes.md).
+ */
+exports.LEGACY_FIRST = new Set(["gracePeriod"]);
+function isSet(value) {
+    return value !== undefined && value !== null;
+}
+/**
+ * Reads one authentication token setting: the value set under
+ * `security.authToken` wins, then the one set under its deprecated spelling
+ * `security.jwt`, then the packaged default (except for {@link LEGACY_FIRST}).
+ *
+ * `loadConfig()` already resolves both sections from what the configuration
+ * files and the environment set. This covers a change made afterwards, e.g.
+ * `app.config.set("security.jwt.expiresIn", "2h")` before `app.start()`: a
+ * value that differs from the packaged default is one somebody set.
+ */
+function authTokenSetting(key) {
+    const { authToken, jwt } = global.kuzzle.config.security; // NOSONAR: the deprecated section is read on purpose, as the documented fallback
+    const packaged = default_config_1.default.security.authToken[key];
+    const current = authToken?.[key];
+    const legacy = jwt?.[key]; // NOSONAR
+    const candidates = exports.LEGACY_FIRST.has(key)
+        ? [legacy, current]
+        : [current, legacy];
+    return (candidates.find((value) => isSet(value) && value !== packaged) ??
+        candidates.find(isSet) ??
+        packaged);
+}
+//# sourceMappingURL=authTokenSettings.js.map

package/dist/lib/core/security/tokenRepository.js

@@ -66,15 +66,8 @@ const token_1 = require("../../model/security/token");
 const apiKey_1 = __importDefault(require("../../model/storage/apiKey"));
 const ObjectRepository_1 = require("../shared/ObjectRepository");
 const crypto_1 = require("../../util/crypto");
+const authTokenSettings_1 = require("./authTokenSettings");
 const securityError = kerror.wrap("security", "token");
-/**
- * The deprecated `security.jwt` section, which the `authToken` settings fall
- * back to. The packaged defaults always ship it; the type says optional only
- * because v2.56.0's did (see SecurityConfiguration.jwt).
- */
-function legacyJwtConfig() {
-    return global.kuzzle.config.security.jwt; // NOSONAR: the deprecated section is read on purpose, as the documented fallback
-}
 class TokenRepository extends ObjectRepository_1.ObjectRepository {
     constructor(opts = {}) {
         super();
@@ -83,7 +76,11 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
         if (opts.ttl !== undefined) {
             this.ttl = opts.ttl;
         }
-        this.tokenGracePeriod = Math.floor(legacyJwtConfig().gracePeriod);
+        this.tokenGracePeriod = Math.floor((0, authTokenSettings_1.authTokenSetting)("gracePeriod"));
+        const deprecated = global.kuzzle.config.internal?.deprecatedSettings;
+        if (deprecated?.length) {
+            global.kuzzle.log.warn(`[DEPRECATED] The configuration section "security.jwt" is deprecated, use "security.authToken" instead (set: ${deprecated.join(", ")}). A value set under "security.authToken" takes precedence.`);
+        }
         this.anonymousToken = new token_1.Token({ userId: "-1" });
     }
     async init() {
@@ -194,17 +191,14 @@ class TokenRepository extends ObjectRepository_1.ObjectRepository {
      *
      * @returns {Promise.<Object>} { _id, jwt, userId, ttl, expiresAt }
      */
-    async generateToken(user, { algorithm = global.kuzzle.config.security.authToken.algorithm ??
-        legacyJwtConfig().algorithm, expiresIn = global.kuzzle.config.security.authToken.expiresIn ??
-        legacyJwtConfig().expiresIn, bypassMaxTTL = false, type = "authToken", singleUse = false, } = {}) {
+    async generateToken(user, { algorithm = (0, authTokenSettings_1.authTokenSetting)("algorithm"), expiresIn = (0, authTokenSettings_1.authTokenSetting)("expiresIn"), bypassMaxTTL = false, type = "authToken", singleUse = false, } = {}) {
         if (!user || user._id === null) {
             throw securityError.get("unknown_user");
         }
         const parsedExpiresIn = parseTimespan(expiresIn);
         const maxTTL = type === "apiKey"
             ? global.kuzzle.config.security.apiKey.maxTTL
-            : (global.kuzzle.config.security.authToken.maxTTL ??
-                legacyJwtConfig().maxTTL);
+            : (0, authTokenSettings_1.authTokenSetting)("maxTTL");
         if (!bypassMaxTTL &&
             maxTTL > -1 &&
             (parsedExpiresIn > maxTTL || parsedExpiresIn === -1)) {

package/dist/lib/core/shared/KoncordeWrapper.d.ts

@@ -29,6 +29,15 @@ export declare class NormalizedFilterV3 {
     normalized: JSONObject[][];
     constructor(index: string, collection: string, normalized: JSONObject);
 }
+/**
+ * Exposes Koncorde v4 through an interface emulating Koncorde v3, to prevent
+ * breaking changes in Kuzzle.
+ *
+ * This class should either be removed entirely in the next major version, or
+ * perhaps proposed in a compatibility mode to help clients migrate smoothly.
+ *
+ * @deprecated Use the `koncorde` package (v4) directly.
+ */
 export declare class Koncorde {
     private filterIdIndexMap;
     private koncorde;

package/dist/lib/core/shared/KoncordeWrapper.js

@@ -35,14 +35,14 @@ class NormalizedFilterV3 {
     }
 }
 exports.NormalizedFilterV3 = NormalizedFilterV3;
-/*
-  @deprecated
-
-  Exposes Koncorde v4 through an interface emulating Koncorde v3, to prevent
-  breaking changes in Kuzzle.
-
-  This class should either be removed entirely in the next major version, or
-  perhaps proposed in a compatibility mode to help clients migrate smoothly.
+/**
+ * Exposes Koncorde v4 through an interface emulating Koncorde v3, to prevent
+ * breaking changes in Kuzzle.
+ *
+ * This class should either be removed entirely in the next major version, or
+ * perhaps proposed in a compatibility mode to help clients migrate smoothly.
+ *
+ * @deprecated Use the `koncorde` package (v4) directly.
  */
 class Koncorde {
     constructor(options = {}) {

package/dist/lib/core/storage/clientAdapter.js

@@ -96,8 +96,13 @@ class ClientAdapter {
         this.registerLockEvents();
         // The cache and the locks were first loaded before this node joined the
         // cluster: an index, a collection or a lock a peer added in between was
-        // broadcast before this node could hear it. Reading them again once the
-        // cluster is joined closes that gap.
+        // broadcast before this node could hear it. `Kuzzle.start()` asks for this
+        // reload right after the cluster is joined, before the plugins' `init()`
+        // runs (#3044).
+        global.kuzzle.onAsk(`core:storage:${this.scope}:cache:reload`, () => this.reloadCache());
+        // Read again once the node goes live: a peer that joined after this node
+        // may have created indexes or collections before its own join (e.g. its
+        // internal index), and that broadcast reached no one.
         global.kuzzle.onPipe("kuzzle:state:live", () => this.reloadCache());
         // Global store events registration
         /**

package/dist/lib/kuzzle/Logger.d.ts

@@ -28,5 +28,9 @@ export declare class Logger extends KuzzleLogger {
     verbose(message: string): void;
     getLevel(): string;
     setLevel(level: string): void;
+    /**
+     * Creates a child logger with the given namespace, appended to the parent's
+     * one. Its level follows the parent's until it is set on the child.
+     */
     child(namespace: string): Logger;
 }

package/dist/lib/kuzzle/Logger.js

@@ -128,9 +128,16 @@ class Logger extends kuzzle_logger_1.KuzzleLogger {
     setLevel(level) {
         this.level = level;
     }
+    /**
+     * Creates a child logger with the given namespace, appended to the parent's
+     * one. Its level follows the parent's until it is set on the child.
+     */
     child(namespace) {
-        // TODO, this is fishy we will probably need to properly remove the "as Logger"
-        return super.child(namespace);
+        // kuzzle-logger builds the child as a plain KuzzleLogger (no getLevel,
+        // setLevel, silly, verbose): give it this class's prototype so it is the
+        // Logger it is declared to be. Its state is all KuzzleLogger's, and the
+        // deprecation flags start unset, as on a new Logger.
+        return Object.setPrototypeOf(super.child(namespace), Logger.prototype);
     }
 }
 exports.Logger = Logger;

package/dist/lib/kuzzle/internalIndexHandler.js

@@ -57,6 +57,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const bluebird_1 = __importDefault(require("bluebird"));
+const authTokenSettings_1 = require("../core/security/authTokenSettings");
 const store_1 = require("../core/shared/store");
 const storeScopeEnum_1 = require("../core/storage/storeScopeEnum");
 const specification_1 = require("../core/validation/specification");
@@ -191,11 +192,9 @@ class InternalIndexHandler extends store_1.Store {
         await bluebird_1.default.all(promises);
     }
     async _initSecret() {
-        // NOSONAR: `jwt` is the deprecated spelling of `authToken`, read second so
-        // an existing configuration keeps working. Dropping it is a breaking change
-        // for anyone who has not migrated, not a conversion's to make.
-        const { authToken, jwt } = global.kuzzle.config.security; // NOSONAR
-        const configSeed = authToken?.secret ?? jwt?.secret; // NOSONAR
+        // `jwt` is the deprecated spelling of `authToken`, read second so an
+        // existing configuration keeps working (see authTokenSetting).
+        const configSeed = (0, authTokenSettings_1.authTokenSetting)("secret");
         let storedSeed = await this.exists("config", this._JWT_SECRET_ID);
         if (!configSeed) {
             if (!storedSeed) {

package/dist/lib/kuzzle/kuzzle.d.ts

@@ -107,6 +107,23 @@ declare class Kuzzle extends KuzzleEventEmitter {
      * it hands the application wrapper the implementation reads.
      */
     start(application: unknown, options?: StartOptions): Promise<void>;
+    /**
+     * A node asked to stop while it starts must not go on taking cluster-wide
+     * locks or running the application's installations: if it is killed before
+     * its shutdown releases them, the other nodes wait for their TTL (#3045).
+     */
+    private stopIfShuttingDown;
+    /**
+     * The shutdown began during the startup, which stopped (or failed because
+     * of it): no "Cannot start" error and no second shutdown, the one running
+     * keeps its exit code and ends the process.
+     *
+     * The returned promise never settles, as `withLock` once the process is
+     * exiting: rejecting would send the caller down its failed-start path
+     * (often a `process.exit(1)`, which would cut the shutdown short), and
+     * resolving would tell it that Kuzzle is running.
+     */
+    private leaveStartupToShutdown;
     /**
      * Generates the node ID.
      *

package/dist/lib/kuzzle/kuzzle.js

@@ -99,6 +99,17 @@ let _kuzzle = null;
  * not keep a failed node alive, which a bare `process.exit(1)` never did
  */
 const FAILURE_SHUTDOWN_TIMEOUT = 30000;
+/**
+ * Stops the startup sequence once a shutdown has begun (#3045): `start()`
+ * catches it and leaves the shutdown to end the process. Internal: never
+ * handed to the caller of `start()`.
+ */
+class StartupInterruptedError extends Error {
+    constructor() {
+        super("Kuzzle is shutting down");
+        this.name = "StartupInterruptedError";
+    }
+}
 Reflect.defineProperty(global, "kuzzle", {
     configurable: true,
     enumerable: false,
@@ -175,9 +186,11 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             await new cacheEngine_1.default().init();
             await new storageEngine_1.default().init();
             await new realtime_1.default().init();
+            this.stopIfShuttingDown();
             await this.internalIndex.init();
             await new security_1.default().init();
             // This will init the cluster module if enabled
+            this.stopIfShuttingDown();
             await this.initKuzzleNode();
             this.vault = vault_1.default.load(options?.vaultKey, options?.secretsFile, this.config.vault?.newAlgorithm);
             this.validation.init();
@@ -189,21 +202,25 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             // before opening connections to external users
             await this.entryPoint.init();
             await this.debugger.init();
+            this.stopIfShuttingDown();
             this.pluginsManager.application = application;
             const pluginImports = await this.pluginsManager.init(options?.plugins);
             const imports = lodash_1.default.merge({}, pluginImports, options?.import);
             // Authentification plugins must be loaded before users import to avoid
             // credentials related error which would prevent Kuzzle from starting
+            this.stopIfShuttingDown();
             await this.loadInitialState(imports, options?.support);
             await this.ask("core:security:verify");
             this.router.init();
             this.log.info("[✔] Core components loaded");
+            this.stopIfShuttingDown();
             await this.install(options?.installations);
             // `application` is the very wrapper handed to the plugins manager six
             // lines up, so reading the name back off the manager was a round trip
             // through a getter that can answer `undefined`.
             this.log.info(`[✔] Start "${application.name}" application`);
             this.openApiManager = new openapi_1.OpenApiManager(application.openApi, this.config.http.routes, this.pluginsManager.routes);
+            this.stopIfShuttingDown();
             // @deprecated
             await this.pipe("kuzzle:start");
             await this.pipe("kuzzle:state:live");
@@ -215,6 +232,9 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             this._state = kuzzleStateEnum_1.default.RUNNING;
         }
         catch (error) {
+            if (this._state === kuzzleStateEnum_1.default.SHUTTING_DOWN) {
+                return this.leaveStartupToShutdown(error);
+            }
             this.log.error(`[X] Cannot start Kuzzle ${this.version}: ${error instanceof Error ? error.message : (0, node_util_1.inspect)(error)}`);
             // A failed start cannot be retried (a second Kuzzle instance cannot be
             // built), and what it did start keeps the process alive: in production,
@@ -229,6 +249,36 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             throw error;
         }
     }
+    /**
+     * A node asked to stop while it starts must not go on taking cluster-wide
+     * locks or running the application's installations: if it is killed before
+     * its shutdown releases them, the other nodes wait for their TTL (#3045).
+     */
+    stopIfShuttingDown() {
+        if (this._state === kuzzleStateEnum_1.default.SHUTTING_DOWN) {
+            throw new StartupInterruptedError();
+        }
+    }
+    /**
+     * The shutdown began during the startup, which stopped (or failed because
+     * of it): no "Cannot start" error and no second shutdown, the one running
+     * keeps its exit code and ends the process.
+     *
+     * The returned promise never settles, as `withLock` once the process is
+     * exiting: rejecting would send the caller down its failed-start path
+     * (often a `process.exit(1)`, which would cut the shutdown short), and
+     * resolving would tell it that Kuzzle is running.
+     */
+    leaveStartupToShutdown(error) {
+        let message = "[ℹ] Startup stopped: Kuzzle is shutting down";
+        // A step that failed because of the shutdown, rather than stopped by it
+        if (!(error instanceof StartupInterruptedError)) {
+            const reason = error instanceof Error ? error.message : (0, node_util_1.inspect)(error);
+            message += ` (${reason})`;
+        }
+        this.log.info(message);
+        return new Promise(() => undefined);
+    }
     /**
      * Generates the node ID.
      *
@@ -238,6 +288,13 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         if (this.config.cluster.enabled) {
             await new cluster_1.default().init();
             this.log.info("[✔] Cluster initialized");
+            // The storage caches were loaded before the join: what a peer created
+            // in between was broadcast before this node could hear it. Read them
+            // again before the plugins' `init()` relies on them (#3044).
+            await Promise.all([
+                this.ask("core:storage:public:cache:reload"),
+                this.ask("core:storage:private:cache:reload"),
+            ]);
         }
         else {
             this.log.info("[X] Cluster disabled: single node mode.");
@@ -317,6 +374,9 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         // one must not start before they are recorded
         await (0, distributedLock_1.withLock)("backend:installations", async () => {
             for (const installation of installations) {
+                // The lock may come long after it was asked for, once the node
+                // holding it is done: by then, this one may be shutting down
+                this.stopIfShuttingDown();
                 const isAlreadyInstalled = await this.ask("core:storage:private:document:exist", "kuzzle", "installations", installation.id);
                 if (!isAlreadyInstalled) {
                     try {
@@ -508,6 +568,8 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             // cannot serialise, and the payload is built right above.
             const importPayloadHash = (0, crypto_1.sha256)((0, json_stable_stringify_1.default)(importPayload) ?? "");
             const importType = async () => {
+                // Same as for the installations: the lock may come after a SIGTERM
+                this.stopIfShuttingDown();
                 // Read the bookkeeping *after* the lock, never before: a read taken
                 // before acquiring it is not protected by it, and the holder that
                 // acted on a stale "not initialized" used to create a document the

package/dist/lib/kuzzle/vault.d.ts

@@ -1,6 +1,19 @@
 import { Vault } from "kuzzle-vault";
+/**
+ * The default secrets file, `config/secrets.enc.json` at the project root.
+ *
+ * Installed as an npm package (KaaF), Kuzzle lives under `node_modules/kuzzle`
+ * and the project root is above it: from `node_modules/kuzzle/dist/lib/kuzzle`
+ * since the build outputs to `dist/` (2.50.0), from
+ * `node_modules/kuzzle/lib/kuzzle` before. Anywhere else (a Kuzzle checkout),
+ * the file is the checkout's own `config/secrets.enc.json`.
+ *
+ * @param dirname - the directory of this module
+ */
+declare function defaultSecretsFile(dirname: string): string;
 declare function load(vaultKey?: string, secretsFile?: string, useNewAlgorithm?: boolean): Vault;
 declare const _default: {
+    defaultSecretsFile: typeof defaultSecretsFile;
     load: typeof load;
 };
 export = _default;

package/dist/lib/kuzzle/vault.js

@@ -35,15 +35,33 @@ const isEmpty_1 = __importDefault(require("lodash/isEmpty"));
 // strict while being false for every read before that first assignment
 // (TD-57, #2760).
 let ENV_VAULT_KEY;
+/**
+ * The default secrets file, `config/secrets.enc.json` at the project root.
+ *
+ * Installed as an npm package (KaaF), Kuzzle lives under `node_modules/kuzzle`
+ * and the project root is above it: from `node_modules/kuzzle/dist/lib/kuzzle`
+ * since the build outputs to `dist/` (2.50.0), from
+ * `node_modules/kuzzle/lib/kuzzle` before. Anywhere else (a Kuzzle checkout),
+ * the file is the checkout's own `config/secrets.enc.json`.
+ *
+ * @param dirname - the directory of this module
+ */
+function defaultSecretsFile(dirname) {
+    const dir = dirname.split(node_path_1.default.sep).join("/");
+    for (const installed of [
+        "/node_modules/kuzzle/dist/lib/kuzzle",
+        "/node_modules/kuzzle/lib/kuzzle",
+    ]) {
+        if (dir.endsWith(installed)) {
+            return node_path_1.default.resolve(dirname.slice(0, dirname.length - installed.length + 1), "config/secrets.enc.json");
+        }
+    }
+    return node_path_1.default.resolve(dirname, "../../config/secrets.enc.json");
+}
 function load(vaultKey, secretsFile, useNewAlgorithm = false) {
-    // Using KaaF kuzzle is an npm package and is located under node_modules folder
-    // We need to get back to root folder of the project to get the secret file
-    const defaultEncryptedSecretsFile = __dirname.endsWith("/node_modules/kuzzle/lib/kuzzle")
-        ? node_path_1.default.resolve(`${__dirname}/../../../../config/secrets.enc.json`)
-        : node_path_1.default.resolve(`${__dirname}/../../config/secrets.enc.json`);
     const encryptedSecretsFile = secretsFile ||
         process.env.KUZZLE_SECRETS_FILE ||
-        defaultEncryptedSecretsFile;
+        defaultSecretsFile(__dirname);
     let key = vaultKey;
     if ((0, isEmpty_1.default)(vaultKey) &&
         (!(0, isEmpty_1.default)(process.env.KUZZLE_VAULT_KEY) || !(0, isEmpty_1.default)(ENV_VAULT_KEY))) {
@@ -71,5 +89,5 @@ function load(vaultKey, secretsFile, useNewAlgorithm = false) {
     }
     return vault;
 }
-module.exports = { load };
+module.exports = { defaultSecretsFile, load };
 //# sourceMappingURL=vault.js.map

package/dist/lib/service/storage/7/elasticsearch.d.ts

@@ -452,6 +452,12 @@ export declare class ES7 {
         mappings?: TypeMapping;
         settings?: JSONObject;
     }): Promise<null>;
+    /**
+     * Applies the mappings and settings of a `createCollection` call to a
+     * collection that already exists because another request created it,
+     * maybe so recently that its primary shards are still initializing.
+     */
+    private _updateConcurrentlyCreatedCollection;
     /**
      * Waits until the primary shards of a collection are active, for at most
      * `timeout`, and rejects if they are not by then.

package/dist/lib/service/storage/7/elasticsearch.js

@@ -1149,23 +1149,23 @@ class ES7 {
         this._checkDynamicProperty(mappings);
         const exists = await this.hasCollection(index, collection);
         if (exists) {
-            // Another node created it, maybe so recently that its primary shards
-            // are still initializing
-            await this.waitForCollectionShards(index, collection);
-            return this.updateCollection(index, collection, { mappings, settings });
+            return this._updateConcurrentlyCreatedCollection(index, collection, mappings, settings);
         }
         this._checkMappings(mappings);
+        // Copies, not in-place changes: the race branch below must hand the
+        // caller's own mappings and settings to `updateCollection`
         requestBody.mappings = {
             _meta: mappings._meta || this._config.commonMapping._meta,
             dynamic: mappings.dynamic || this._config.commonMapping.dynamic,
-            properties: lodash_1.default.merge(mappings.properties, this._config.commonMapping.properties),
+            properties: lodash_1.default.merge({}, mappings.properties, this._config.commonMapping.properties),
+        };
+        requestBody.settings = {
+            ...settings,
+            number_of_replicas: settings.number_of_replicas ||
+                this._config.defaultSettings.number_of_replicas,
+            number_of_shards: settings.number_of_shards ||
+                this._config.defaultSettings.number_of_shards,
         };
-        settings.number_of_replicas =
-            settings.number_of_replicas ||
-                this._config.defaultSettings.number_of_replicas;
-        settings.number_of_shards =
-            settings.number_of_shards ||
-                this._config.defaultSettings.number_of_shards;
         try {
             await this._client.indices.create(esRequest);
         }
@@ -1174,9 +1174,9 @@ class ES7 {
                 "resource_already_exists_exception") {
                 // race condition: the indice has been created between the "exists"
                 // check above and this "create" attempt, by a request that may not
-                // have waited for its shards yet
-                await this.waitForCollectionShards(index, collection);
-                return null;
+                // have waited for its shards yet. This request's mappings and
+                // settings must still be applied, as if it had seen it exist
+                return this._updateConcurrentlyCreatedCollection(index, collection, mappings, settings);
             }
             throw this._esWrapper.formatESError(error);
         }
@@ -1195,6 +1195,15 @@ class ES7 {
         }
         return null;
     }
+    /**
+     * Applies the mappings and settings of a `createCollection` call to a
+     * collection that already exists because another request created it,
+     * maybe so recently that its primary shards are still initializing.
+     */
+    async _updateConcurrentlyCreatedCollection(index, collection, mappings, settings) {
+        await this.waitForCollectionShards(index, collection);
+        return this.updateCollection(index, collection, { mappings, settings });
+    }
     /**
      * Waits until the primary shards of a collection are active, for at most
      * `timeout`, and rejects if they are not by then.

package/dist/lib/service/storage/8/elasticsearch.d.ts

@@ -443,6 +443,12 @@ export declare class ES8 {
         mappings?: estypes.MappingTypeMapping;
         settings?: estypes.IndicesIndexSettings;
     }): Promise<null>;
+    /**
+     * Applies the mappings and settings of a `createCollection` call to a
+     * collection that already exists because another request created it,
+     * maybe so recently that its primary shards are still initializing.
+     */
+    private _updateConcurrentlyCreatedCollection;
     /**
      * Waits until the primary shards of a collection are active, for at most
      * `timeout`, and rejects if they are not by then.

package/dist/lib/service/storage/8/elasticsearch.js

@@ -1171,23 +1171,23 @@ class ES8 {
         this._checkDynamicProperty(mappings);
         const exists = await this.hasCollection(index, collection);
         if (exists) {
-            // Another node created it, maybe so recently that its primary shards
-            // are still initializing
-            await this.waitForCollectionShards(index, collection);
-            return this.updateCollection(index, collection, { mappings, settings });
+            return this._updateConcurrentlyCreatedCollection(index, collection, mappings, settings);
         }
         this._checkMappings(mappings);
+        // Copies, not in-place changes: the race branch below must hand the
+        // caller's own mappings and settings to `updateCollection`
         esRequest.mappings = {
             _meta: mappings._meta || this._config.commonMapping._meta,
             dynamic: mappings.dynamic || this._config.commonMapping.dynamic,
-            properties: lodash_1.default.merge(mappings.properties, this._config.commonMapping.properties),
+            properties: lodash_1.default.merge({}, mappings.properties, this._config.commonMapping.properties),
+        };
+        esRequest.settings = {
+            ...settings,
+            number_of_replicas: settings.number_of_replicas ||
+                this._config.defaultSettings.number_of_replicas,
+            number_of_shards: settings.number_of_shards ||
+                this._config.defaultSettings.number_of_shards,
         };
-        settings.number_of_replicas =
-            settings.number_of_replicas ||
-                this._config.defaultSettings.number_of_replicas;
-        settings.number_of_shards =
-            settings.number_of_shards ||
-                this._config.defaultSettings.number_of_shards;
         try {
             await this._client.indices.create(esRequest);
         }
@@ -1196,9 +1196,9 @@ class ES8 {
                 "resource_already_exists_exception") {
                 // race condition: the indice has been created between the "exists"
                 // check above and this "create" attempt, by a request that may not
-                // have waited for its shards yet
-                await this.waitForCollectionShards(index, collection);
-                return null;
+                // have waited for its shards yet. This request's mappings and
+                // settings must still be applied, as if it had seen it exist
+                return this._updateConcurrentlyCreatedCollection(index, collection, mappings, settings);
             }
             throw this._esWrapper.formatESError(error);
         }
@@ -1217,6 +1217,15 @@ class ES8 {
         }
         return null;
     }
+    /**
+     * Applies the mappings and settings of a `createCollection` call to a
+     * collection that already exists because another request created it,
+     * maybe so recently that its primary shards are still initializing.
+     */
+    async _updateConcurrentlyCreatedCollection(index, collection, mappings, settings) {
+        await this.waitForCollectionShards(index, collection);
+        return this.updateCollection(index, collection, { mappings, settings });
+    }
     /**
      * Waits until the primary shards of a collection are active, for at most
      * `timeout`, and rejects if they are not by then.

package/dist/lib/types/config/KuzzleConfiguration.d.ts

@@ -163,6 +163,13 @@ export interface IKuzzleConfiguration {
          * Optional here for the reason given on {@link IKuzzleConfiguration.version}.
          */
         allowAllOrigins?: boolean;
+        /**
+         * Derived at startup: the deprecated configuration keys the user set
+         * (today, those of "security.jwt"), logged as a warning.
+         *
+         * Optional here for the reason given on {@link IKuzzleConfiguration.version}.
+         */
+        deprecatedSettings?: string[];
     };
     /**
      * Collection specifications to apply at startup, by index then collection.

package/dist/lib/types/config/SecurityConfiguration.d.ts

@@ -21,9 +21,10 @@ export type SecurityConfiguration = {
     /**
      * @deprecated Use `security.authToken` instead.
      *
-     * `default.config.ts` always ships it, and `authToken`'s readers fall back
-     * to it — `authToken.algorithm ?? jwt.algorithm`. Optional all the same, as
-     * v2.56.0 declared it: a required member breaks code that builds this type.
+     * Each setting the configuration sets here applies unless `authToken` sets
+     * it too (`loadConfig()` resolves both sections to the values in effect,
+     * see `authTokenSetting`). Optional all the same, as v2.56.0 declared it:
+     * a required member breaks code that builds this type.
      */
     jwt?: JSONObject;
     /**

package/dist/lib/types/controllers/ControllerDefinition.d.ts

@@ -54,8 +54,8 @@ export type ControllerDefinition = {
             handler: (request: KuzzleRequest) => Promise<any>;
             /**
              * Declare HTTP routes (optional).
-             * Http routes will be auto-generated unless at least one is provided
-             * or an empty array is provided.
+             * When omitted or empty, a default route is generated:
+             * `GET /_/<controller>/<action>`, both names in kebab-case.
              */
             http?: HttpRoute[];
         };
@@ -71,8 +71,8 @@ export type HttpRoute = {
     verb: "get" | "head" | "post" | "put" | "delete" | "patch" | "options";
     /**
      * Route path.
-     * A route starting with `/` will be prefixed by `/_` otherwise the route
-     * will be prefixed by `/_/<application-name>/`.
+     * A route starting with `/` is used as is, any other route is prefixed
+     * with `/_/`.
      */
     path: string;
     /**

package/dist/lib/util/mutex.d.ts

@@ -86,9 +86,9 @@ export declare class Mutex {
      *
      * @return {Promise.<boolean>} True if the ressource has been unlocked before the `timeout`
      */
-    wait({ attemptDelay, timeout, }: {
-        attemptDelay?: number | undefined;
-        timeout?: number | undefined;
+    wait({ attemptDelay, timeout, }?: {
+        attemptDelay?: number;
+        timeout?: number;
     }): Promise<boolean>;
     /**
      * Frees every lock this process holds, and stops it from taking new ones.

package/dist/lib/util/mutex.js

@@ -196,7 +196,7 @@ class Mutex {
      *
      * @return {Promise.<boolean>} True if the ressource has been unlocked before the `timeout`
      */
-    async wait({ attemptDelay = this.attemptDelay, timeout = this.timeout, }) {
+    async wait({ attemptDelay = this.attemptDelay, timeout = this.timeout, } = {}) {
         let duration = 0;
         let isLocked;
         do {

package/dist/package.json

@@ -1,7 +1,7 @@
 {
     "name": "kuzzle",
     "author": "The Kuzzle Team <support@kuzzle.io>",
-    "version": "2.60.0-beta.4",
+    "version": "2.60.0-beta.5",
     "description": "Kuzzle is an open-source solution that handles all the data management through a secured API, with a large choice of protocols.",
     "scripts": {
         "build": "rm -Rf ./dist && tsc && node -r ts-node/register/transpile-only ./bin/copy-binaries.ts",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "kuzzle",
   "author": "The Kuzzle Team <support@kuzzle.io>",
-  "version": "2.60.0-beta.4",
+  "version": "2.60.0-beta.5",
   "description": "Kuzzle is an open-source solution that handles all the data management through a secured API, with a large choice of protocols.",
   "scripts": {
     "build": "rm -Rf ./dist && tsc && node -r ts-node/register/transpile-only ./bin/copy-binaries.ts",