IFClite TypeScript API
    Preparing search index...

    Interface StartSecureCollabServerOptions

    interface StartSecureCollabServerOptions {
        auditSink?: AuditSink;
        authenticate?: AuthenticateFn;
        authorizeBlob?: BlobAuthorizeFn | null;
        authorizeRegistry?: RegistryAuthorizeFn | null;
        blobMaxBytes?: number;
        blobStorage?: ServerBlobStorage;
        compactEvery?: number;
        cors?: false | CorsOptions;
        host?: string;
        idleUnloadMs?: number;
        keepaliveIntervalMs?: number;
        kickEndpoint?: Pick<KickEndpointOptions, "secret" | "isRevoked">;
        layerRegistry?:
            | boolean
            | {
                maxBytes?: number;
                store?: LayerRegistryStore;
                webhooks?: RegistryWebhook[];
            };
        maxRooms?: number;
        metrics?: MetricsRegistry;
        metricsToken?: string;
        persistence?: Persistence;
        port?: number;
        rateLimit?: RateLimitOptions
        | ((principal: Principal) => RateLimitOptions);
        releaseEndpoint?: ReleaseEndpointOptions;
        revokeEndpoint?: RevokeEndpointOptions;
        tls: SecureHttpServerOptions;
        tokenEndpoint?: TokenEndpointOptions;
        verifyMessage?: VerifyMessageFn;
    }

    Hierarchy

    Index
    auditSink? authenticate? authorizeBlob? authorizeRegistry? blobMaxBytes? blobStorage? compactEvery? cors? host? idleUnloadMs? keepaliveIntervalMs? kickEndpoint? layerRegistry? maxRooms? metrics? metricsToken? persistence? port? rateLimit? releaseEndpoint? revokeEndpoint? tls tokenEndpoint? verifyMessage?
    auditSink?: AuditSink

    Append-only audit sink. Default: drop all events.

    authenticate?: AuthenticateFn
    authorizeBlob?: BlobAuthorizeFn | null

    Authorizer for the /blobs route. When omitted it defaults to one derived from authenticate so the blob route shares the websocket sync token (a missing/invalid token is rejected, and PUT/DELETE additionally require write capability). With the anonymous default authenticate, blob access stays anonymous — matching the WS path. Pass null to explicitly disable blob authorization.

    authorizeRegistry?: RegistryAuthorizeFn | null

    Registry authorizer override. The default adapts authenticate with a pseudo-room, which room-BOUND token schemes can never satisfy — those deployments supply their own (see createRoomTokenRegistryAuthorizer). null disables auth (anonymous registry).

    blobMaxBytes?: number

    Reject blob PUTs above this size (default 100 MB).

    blobStorage?: ServerBlobStorage

    Pluggable blob storage for the /blobs/... route. Default: in-memory. Pass a custom ServerBlobStorage to back with S3 or filesystem in production.

    compactEvery?: number
    cors?: false | CorsOptions

    Cross-origin access for the HTTP routes. Default: enabled with origin reflection (permissive). Pass an allow-list to restrict, or false to disable entirely (e.g. when a reverse proxy owns CORS). Only applies to the server this function creates — ignored when you pass your own server.

    host?: string
    idleUnloadMs?: number

    Unload rooms that have had zero peers for this many ms (default disabled). Persistence keeps the durable copy; rehydrate on next connect.

    keepaliveIntervalMs?: number

    Application-level keepalive period in ms (default 15s). Exposed so tests can observe the keepalive without waiting on the real cadence; production callers should leave it alone. See Room.sendKeepalive.

    kickEndpoint?: Pick<KickEndpointOptions, "secret" | "isRevoked">

    Enable the POST /collab/kick route so an admin can force-disconnect a peer by awareness clientId. The server binds the kick to its room manager; only the verifying secret is supplied here. Omit to disable (404).

    layerRegistry?:
        | boolean
        | {
            maxBytes?: number;
            store?: LayerRegistryStore;
            webhooks?: RegistryWebhook[];
        }

    Mount the layer-registry routes (/api/v1/layers|refs|reviews, 10-registry.md): push/pull content-addressed layers, refs with server-side merge-policy enforcement, and review objects. Off by default. Pass true for an in-memory registry, or supply a store. Authorization derives from authenticate exactly like the blob route: any authenticated principal may read, writes require write capability, and the principal's userId becomes the acting resolver for merges and waivers.

    maxRooms?: number
    metrics?: MetricsRegistry

    Metrics registry to publish at /metrics. Defaults to the package singleton.

    metricsToken?: string

    Require a bearer token (compared against this shared secret) for the /metrics diagnostics endpoint, which labels gauges with raw room IDs. /healthz stays open for liveness probes but omits room detail unless this token is presented. Defaults to COLLAB_METRICS_TOKEN.

    persistence?: Persistence
    port?: number
    rateLimit?: RateLimitOptions | ((principal: Principal) => RateLimitOptions)

    Per-peer rate limit. Function form lets you tune by role/user.

    releaseEndpoint?: ReleaseEndpointOptions

    Enable POST /collab/release (hand back an unused fresh-room claim). Omit to disable (404).

    revokeEndpoint?: RevokeEndpointOptions

    Enable the POST /collab/revoke route so an admin can invalidate a share link (its jti is added to a deny-list the authenticator's isRevoked consults). Omit to leave the route disabled (404).

    tls: SecureHttpServerOptions
    tokenEndpoint?: TokenEndpointOptions

    Enable the POST /collab/token mint route for link-based sharing. Omit to leave the route disabled (404). Pair with authenticate: createRoomTokenAuthenticator({ secret }) so connections are verified against the same secret.

    verifyMessage?: VerifyMessageFn

    Optional per-message verifier (anti-replay HMAC etc.). Runs before rate limit / role check. Returning { ok: false } audits as reject with the reason and drops the message.

    Settings
    Member Visibility

    On This Page
    Properties