@delali/sirannon-db 0.3.5 → 0.3.6-next.78

package/dist/replication/index.mjs

@@ -1,20 +1,21 @@
 import { groupMemberIds, isGroupMember, sameNodeIdSet, compatibilityAllowsPromotion, arraysEqual } from '../chunk-PJRCMG7L.mjs';
 import { CoordinatorError, TopologyError, WriteConcernError, AuthorityError, SyncError, StalePrimaryError, NodeDrainingError, NodeNotInSyncError, ReadConcernError, ProtocolVersionMismatchError } from '../chunk-KU32OT4H.mjs';
 export { AuthorityError, CoordinatorError, FailoverError, NoSafePrimaryError, NodeDrainingError, NodeNotInSyncError, ProtocolVersionMismatchError, ReadConcernError, StalePrimaryError, SyncError, TopologyError, TransportError, UnsafeRecoveryRequiredError, WriteConcernError } from '../chunk-KU32OT4H.mjs';
-import { LWWResolver, BatchReader, BatchApplier, StampOps, writeOutcome, failedStatementOutcome, StatementRecorder, batchWriteOutcome, isWellFormedHlc, Transaction, loadPersistedHlc } from '../chunk-AP4367HK.mjs';
-export { LWWResolver } from '../chunk-AP4367HK.mjs';
-import '../chunk-ZFFUVYYE.mjs';
-import { runWriterTransaction, execute, withoutRowCounts } from '../chunk-DDIHBUEN.mjs';
-import { DumpOps, dumpSchema, tablesInFkOrder } from '../chunk-DKML5425.mjs';
-import { canonicaliseForChecksum, HLC, PkResolver, selectMaxChangeHlc, selectMaxColumnVersionHlc, selectMaxAppliedSourceSeq, upsertPeerAckedSeq, selectPeerAckedSeq, selectMaxChangeSeq, selectMaxNodeChangeSeq, selectMinPeerAckedSeq, upsertSyncTableStatus, upsertSyncMeta, selectSyncMetaRow, selectCompletedSyncTableNames, ensureChangesTable, ensureReplicationStateTables, ensureMetaTable, IDENTIFIER_RE, setForeignKeysEnabled, deleteSyncTableStates, extractDroppedTable, insertDdlChange, validateDdlSafety, prepareInsertAppliedChange, selectNewestHistoryChange, upsertQuarantined, deleteStampedChangesUpToSeq, deleteColumnVersions, upsertHistoryBase, deleteAppliedChangesAfterSeq, deletePeerState, upsertAnchoredTerm, selectPrimaryTermStart, selectMaxHistoryChangeSeq, deletePeerStates, upsertPrimaryTermStart, selectHistoryTransaction, selectMaxAppliedSourceSeqByNode, selectAnchoredTerm, selectQuarantined, selectHistoryBase, selectHistoryChangesAfterHlc, deleteHistoryChangesAfterHlc, deleteColumnVersionsAfterHlc, tablePkColumns, deletePrimaryTermStart, selectMaxAssignedChangeSeq } from '../chunk-RPWBYASV.mjs';
-export { HLC } from '../chunk-RPWBYASV.mjs';
+import { LWWResolver, BatchReader, BatchApplier, StampOps, writeOutcome, failedStatementOutcome, StatementRecorder, batchWriteOutcome, isWellFormedHlc, Transaction, loadPersistedHlc } from '../chunk-VGRAAQX3.mjs';
+export { LWWResolver } from '../chunk-VGRAAQX3.mjs';
+import { runWriterTransaction, execute, withoutRowCounts } from '../chunk-ZWW53O5P.mjs';
+import { DumpOps, dumpSchema, tablesInFkOrder } from '../chunk-GBVB6WSC.mjs';
+import { canonicaliseForChecksum, HLC, PkResolver, selectMaxChangeHlc, selectMaxColumnVersionHlc, selectMaxAppliedSourceSeq, upsertPeerAckedSeq, selectPeerAckedSeq, selectMaxChangeSeq, selectMaxNodeChangeSeq, selectMinPeerAckedSeq, upsertSyncTableStatus, upsertSyncMeta, selectSyncMetaRow, selectCompletedSyncTableNames, ensureChangesTable, ensureReplicationStateTables, ensureMetaTable, IDENTIFIER_RE, setForeignKeysEnabled, deleteSyncTableStates, extractDroppedTable, insertDdlChange, validateDdlSafety, prepareInsertAppliedChange, selectNewestHistoryChange, upsertQuarantined, deleteStampedChangesUpToSeq, deleteColumnVersions, upsertHistoryBase, deleteAppliedChangesAfterSeq, deletePeerState, upsertAnchoredTerm, selectPrimaryTermStart, selectMaxHistoryChangeSeq, deletePeerStates, upsertPrimaryTermStart, selectHistoryTransaction, selectMaxAppliedSourceSeqByNode, selectAnchoredTerm, selectQuarantined, selectHistoryBase, selectHistoryChangesAfterHlc, deleteHistoryChangesAfterHlc, deleteColumnVersionsAfterHlc, tablePkColumns, deletePrimaryTermStart, selectMaxAssignedChangeSeq } from '../chunk-MTOQ6QIS.mjs';
+export { HLC } from '../chunk-MTOQ6QIS.mjs';
+import '../chunk-5DKWHT6K.mjs';
 import { ReplicationError, BatchValidationError } from '../chunk-BLMRNSUG.mjs';
 export { BatchValidationError, ConflictError, ReplicationError } from '../chunk-BLMRNSUG.mjs';
-import { CHANGES_TABLE, INTERNAL_TABLE_PREFIX, isReservedIdentifier, decodeTaggedValues } from '../chunk-JFVEGN7J.mjs';
+import { CHANGES_TABLE, INTERNAL_TABLE_PREFIX, isReservedIdentifier, decodeTaggedValues } from '../chunk-ZAUHAJ4G.mjs';
 import '../chunk-GVCNMPOS.mjs';
 import '../chunk-K43WJORM.mjs';
 import { rowCountsOf } from '../chunk-E2GRX4ZD.mjs';
 import '../chunk-HO2XTXVX.mjs';
+import { EncryptionError } from '../chunk-5O4J6LQQ.mjs';
 import '../chunk-KINDFBQP.mjs';
 import { EventEmitter } from 'events';
 import { randomBytes, randomUUID, createHash } from 'crypto';
@@ -2948,6 +2949,39 @@ var RejoinState = class {
   quarantineRecorded = false;
 };
 
+// src/replication/engine/encryption-refusal.ts
+var PLAINTEXT_PEER_MESSAGE = "This node holds an encrypted database, so it sends no batch and no snapshot to a peer that announces a plaintext database";
+var refusedPeers = /* @__PURE__ */ new WeakMap();
+function refusedBy(engine) {
+  const existing = refusedPeers.get(engine);
+  if (existing) return existing;
+  const created = /* @__PURE__ */ new Set();
+  refusedPeers.set(engine, created);
+  return created;
+}
+function withholdsDataFrom(engine, peer) {
+  return engine.database.encryptedFile && peer?.encrypted !== true;
+}
+function encryptionRequired(peerId) {
+  return new EncryptionError(`${PLAINTEXT_PEER_MESSAGE}, and peer '${peerId}' announces one`, "ENCRYPTION_REQUIRED");
+}
+function refusePlaintextPeer(engine, peerId) {
+  const refused = refusedBy(engine);
+  const error = encryptionRequired(peerId);
+  const transport = engine.config.transport;
+  if (!refused.has(peerId)) {
+    refused.add(peerId);
+    engine.emitError({ error, operation: "encryption-required", peerId, recoverable: true });
+  }
+  transport.refusePeer?.(peerId, error).catch((err) => {
+    const wrappedErr = err instanceof Error ? err : new Error(String(err));
+    engine.emitError({ error: wrappedErr, operation: "encryption-required", peerId, recoverable: true });
+  });
+}
+function forgetPeerRefusal(engine, peerId) {
+  refusedPeers.get(engine)?.delete(peerId);
+}
+
 // src/replication/engine/sender-loop.ts
 var SenderLoop = class {
   constructor(engine) {
@@ -3009,6 +3043,10 @@ var SenderLoop = class {
       if (!this.shouldReplicateTo(peerId, peerInfo.role)) {
         continue;
       }
+      if (withholdsDataFrom(engine, peerInfo)) {
+        refusePlaintextPeer(engine, peerId);
+        continue;
+      }
       const peerState = engine.peerTracker.getPeerState(peerId);
       if (peerState) {
         engine.peerTracker.expireTimedOutBatches(peerId, nowMs, engine.ackTimeoutMs);
@@ -3240,6 +3278,7 @@ function wireTransportHandlers(engine) {
     }
   });
   engine.config.transport.onPeerDisconnected((peerId) => {
+    forgetPeerRefusal(engine, peerId);
     engine.peerTracker.removePeer(peerId);
     engine.syncServer.abortSessionsForPeer(peerId);
     if (engine.syncState.phase === "syncing" && engine.syncState.sourcePeerId === peerId) {
@@ -3319,8 +3358,10 @@ async function recoverHlcFromDurableState(engine) {
   if (maxObserved === null) return;
   engine.hlc.receive(maxObserved);
 }
+var databaseRegistrations = /* @__PURE__ */ new WeakMap();
 async function startEngine(engine) {
   if (engine.running) return;
+  databaseRegistrations.set(engine, engine.database.registerReplicationEngine());
   engine.running = true;
   engine.history.active = false;
   await startEngineSteps(engine);
@@ -3341,7 +3382,8 @@ async function startEngineSteps(engine) {
     localRole: engine.config.topology.role,
     groupId: engine.config.coordinator?.groupId ?? engine.config.transportConfig?.groupId,
     primaryTerm: engine.coordinatorState?.primaryTerm ?? engine.config.transportConfig?.primaryTerm,
-    protocolVersion: engine.config.coordinator?.compatibility?.protocolVersion ?? engine.config.transportConfig?.protocolVersion
+    protocolVersion: engine.config.coordinator?.compatibility?.protocolVersion ?? engine.config.transportConfig?.protocolVersion,
+    encrypted: engine.database.encryptedFile
   };
   await engine.config.transport.connect(engine.nodeId, transportConfig);
   await refreshMemberAddresses(engine).catch(
@@ -3411,6 +3453,14 @@ async function startEngineSteps(engine) {
 async function stopEngine(engine) {
   if (!engine.running) return;
   engine.running = false;
+  try {
+    await stopEngineSteps(engine);
+  } finally {
+    databaseRegistrations.get(engine)?.();
+    databaseRegistrations.delete(engine);
+  }
+}
+async function stopEngineSteps(engine) {
   stopCoordinatorTimers(engine);
   engine.syncJoiner.stopTimers();
   engine.syncServer.abortAll();
@@ -3807,6 +3857,13 @@ var SyncServer = class {
     const engine = this.engine;
     const knownPeers = engine.config.transport.peers();
     if (!knownPeers.has(fromPeerId)) return;
+    if (withholdsDataFrom(engine, knownPeers.get(fromPeerId))) {
+      const refusal = encryptionRequired(fromPeerId);
+      await this.rejectSyncRequest(fromPeerId, request, `${refusal.code}: ${refusal.message}`).finally(
+        () => refusePlaintextPeer(engine, fromPeerId)
+      );
+      return;
+    }
     if (engine.isCoordinatorMode()) {
       try {
         await engine.verifyPrimaryAuthority();

package/dist/{restore-options-CcMukOLO.d.ts → restore-options-B6HV_5XT.d.ts}

@@ -1,4 +1,4 @@
-import { B as BackupDestination, S as SQLiteDriver } from './types-DTmi7pXp.js';
+import { B as BackupDestination, S as SQLiteDriver, E as EncryptionOptions } from './types-BWyv_N18.js';
 
 /** The progress of one restore, which Sirannon reports after every piece that it fetches and after every batch.
  * @public
@@ -50,6 +50,11 @@ interface BackupRestoreOptions {
     destinationTimeoutMs?: number;
     /** Called after every piece that Sirannon fetches, and after every batch. */
     onProgress?: (progress: BackupRestoreProgress) => void;
+    /**
+     * The key of the database that the restore rebuilds, which the backups of an encrypted database need. Sirannon
+     * opens the rebuilt file under this key, so the result holds ciphertext under the same key as the backups.
+     */
+    encryption?: EncryptionOptions;
 }
 /** The report of one finished restore.
  * @public

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
-import { h as BackupChain, l as BackupChainRecord, p as BackupCycleStatus, C as BackupVerifyResult } from '../types-DTmi7pXp.js';
-import { b as BackupRestoreProgress, a as BackupRestoreReport } from '../restore-options-CcMukOLO.js';
-import { a as TransactionStatement, Q as QueryResponse, E as ExecuteResponse, T as TransactionResponse, B as BatchResponse, L as LoadResponse, A as AckResponse } from '../protocol-DZSYSv0S.js';
-export { b as BatchRequest, c as ErrorResponse, d as ExecuteRequest, e as LoadRequest, f as QueryRequest, g as TransactionRequest, t as toExecuteResponse } from '../protocol-DZSYSv0S.js';
-import { S as Sirannon } from '../sirannon-D0CjDULa.js';
-import { B as BulkLoadDurability, S as ServerOptions, W as WSHandlerOptions } from '../server-options-B9CsAZp5.js';
+import { h as BackupChain, l as BackupChainRecord, p as BackupCycleStatus, C as BackupVerifyResult } from '../types-BWyv_N18.js';
+import { b as BackupRestoreProgress, a as BackupRestoreReport } from '../restore-options-B6HV_5XT.js';
+import { a as TransactionStatement, Q as QueryResponse, E as ExecuteResponse, T as TransactionResponse, B as BatchResponse, L as LoadResponse, A as AckResponse } from '../protocol-DE10taas.js';
+export { b as BatchRequest, c as ErrorResponse, d as ExecuteRequest, e as LoadRequest, f as QueryRequest, g as TransactionRequest, t as toExecuteResponse } from '../protocol-DE10taas.js';
+import { S as Sirannon } from '../sirannon-Ba1o2HUQ.js';
+import { B as BulkLoadDurability, S as ServerOptions, W as WSHandlerOptions } from '../server-options-Bhdlvehe.js';
 import { W as WriteConcern, R as ReadConcern } from '../query-types-5B02ixH0.js';
-import '../database-fz-8CJBP.js';
-import '../change-tracker-Dpo99EI-.js';
-import '../database-backup-BwTNiBm2.js';
+import '../database-BZ96ZzAx.js';
+import '../errors-DLMAGQFb.js';
+import '../database-backup-BhM8yJ1A.js';
 import '../types-BG31TtrQ.js';
 import '../types-CEJG0eFS.js';
 import '../operation-registry-CGhNT-Sn.js';
@@ -495,6 +495,7 @@ declare class SirannonServer<Identity = unknown> {
     private readonly authenticateHook;
     private readonly acceptSql;
     private readonly acceptBackupRestore;
+    private readonly encryptionChange;
     private readonly acceptDeviceSync;
     private readonly restoreRuns;
     private readonly drain;
@@ -542,7 +543,6 @@ declare class SirannonServer<Identity = unknown> {
     get listeningPort(): number;
     private loadRuntime;
     private registerRoutes;
-    private registerBackupRoutes;
     private withCors;
     private routeDeps;
     private wrapDbRoute;