@harperfast/harper 5.0.25 → 5.1.0-beta.1

package/dist/security/keys.d.ts

@@ -1,40 +1,8 @@
-export function getPrivateKeys(): Map<any, any>;
-export function generateKeys(): Promise<{
-    publicKey: any;
-    privateKey: any;
-}>;
-export function updateConfigCert(): void;
-export function setCertTable(certRecord: any): Promise<void>;
-export function getCertTable(): any;
-/**
- * This is responsible for loading any certificates that are in the harperdb-config.yaml file and putting them into the hdbCertificate table.
- * @return {*}
- */
-export function loadCertificates(): any;
-export function reviewSelfSignedCert(): Promise<void>;
-/**
- * Create a TLS selector that will choose the best TLS configuration/context for a given hostname
- * @param type
- * @param mtlsOptions
- * @return {(function(*, *): (*|undefined))|*}
- */
-export function createTLSSelector(type: any, mtlsOptions: any): ((arg0: any, arg1: any) => (any | undefined)) | any;
-/**
- * List all the records in hdbCertificate table
- * @returns {Promise<*[]>}
- */
-export function listCertificates(): Promise<any[]>;
-export function generateCertsKeys(): Promise<void>;
-export function getReplicationCert(): Promise<any>;
-export function getReplicationCertAuth(): Promise<any>;
-/**
- * Delete any existing self-signed certs (including CA) and create new ones
- * @returns {Promise<void>}
- */
-export function renewSelfSigned(): Promise<void>;
-export function hostnamesFromCert(cert: any): any;
-export function getHostnamesFromCertificate(certificate: any): any[];
-export function getPrimaryHostName(cert: any): any;
+export declare const getPrivateKeys: () => Map<any, any>;
+export declare const CERT_ATTRIBUTES: {
+    name: string;
+    value: string;
+}[];
 /**
  * Generates a cryptographically secure serial number for X.509 certificates.
  *
@@ -43,12 +11,17 @@ export function getPrimaryHostName(cert: any): any;
  *
  * @returns {string} 16-character hex string
  */
-export function generateSerialNumber(): string;
-export function getCertAuthority(): Promise<{
-    ca: any;
-    private_key: any;
-}>;
-export function certExtensions(): ({
+export declare function generateSerialNumber(): string;
+export declare function getCertTable(): any;
+export declare function getReplicationCert(): Promise<any>;
+export declare function getReplicationCertAuth(): Promise<any>;
+/**
+ * This is responsible for loading any certificates that are in the harperdb-config.yaml file and putting them into the hdbCertificate table.
+ * @return {*}
+ */
+export declare function loadCertificates(): any;
+export declare function getCommonName(): string;
+export declare function certExtensions(): ({
     name: string;
     cA: boolean;
     critical: boolean;
@@ -112,8 +85,32 @@ export function certExtensions(): ({
     client?: undefined;
     server?: undefined;
 })[];
-export function getCommonName(): string;
-export const CERT_ATTRIBUTES: {
-    name: string;
-    value: string;
-}[];
+export declare function setCertTable(certRecord: any): Promise<void>;
+export declare function generateKeys(): Promise<{
+    publicKey: any;
+    privateKey: any;
+}>;
+export declare function getCertAuthority(): Promise<any>;
+export declare function generateCertsKeys(): Promise<void>;
+/**
+ * Delete any existing self-signed certs (including CA) and create new ones
+ * @returns {Promise<void>}
+ */
+export declare function renewSelfSigned(): Promise<void>;
+export declare function reviewSelfSignedCert(): Promise<void>;
+export declare function updateConfigCert(): void;
+/**
+ * Create a TLS selector that will choose the best TLS configuration/context for a given hostname
+ * @param type
+ * @param mtlsOptions
+ * @return {(function(*, *): (*|undefined))|*}
+ */
+export declare function createTLSSelector(type: any, mtlsOptions?: any): any;
+/**
+ * List all the records in hdbCertificate table
+ * @returns {Promise<*[]>}
+ */
+export declare function listCertificates(): Promise<any[]>;
+export declare function getPrimaryHostName(cert: any): any;
+export declare function hostnamesFromCert(cert: any): any;
+export declare function getHostnamesFromCertificate(certificate: any): any[];

package/dist/security/keys.js

@@ -1,60 +1,98 @@
 'use strict';
-const path = require('path');
-const { watch } = require('chokidar');
-const fs = require('fs-extra');
-const forge = require('node-forge');
-const net = require('net');
-let { generateKeyPair, X509Certificate, createPrivateKey, randomBytes } = require('node:crypto');
-const util = require('util');
-generateKeyPair = util.promisify(generateKeyPair);
-const pki = forge.pki;
-const { v4: uuidv4 } = require('uuid');
-const { forComponent } = require('../utility/logging/harper_logger.js');
-const envManager = require('../utility/environment/environmentManager.js');
-const hdbTerms = require("../utility/hdbTerms.js");
-const { CONFIG_PARAMS } = hdbTerms;
-const certificatesTerms = require('../utility/terms/certificates.js');
-const tls = require('node:tls');
-const { relative, join } = require('node:path');
-const { CERTIFICATE_VALUES } = certificatesTerms;
-const assignCmdenvVars = require('../utility/assignCmdEnvVariables.js');
-const configUtils = require('../config/configUtils.js');
-const { table, getDatabases, databases } = require("../resources/databases.js");
-const logger = forComponent('tls').conditional;
-const { getThisNodeName, getThisNodeUrl, urlToNodeName, clearThisNodeName } = require("../server/nodeName.js");
-exports.generateKeys = generateKeys;
-exports.updateConfigCert = updateConfigCert;
-exports.setCertTable = setCertTable;
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CERT_ATTRIBUTES = exports.getPrivateKeys = void 0;
+exports.generateSerialNumber = generateSerialNumber;
 exports.getCertTable = getCertTable;
+exports.getReplicationCert = getReplicationCert;
+exports.getReplicationCertAuth = getReplicationCertAuth;
 exports.loadCertificates = loadCertificates;
+exports.getCommonName = getCommonName;
+exports.certExtensions = certExtensions;
+exports.setCertTable = setCertTable;
+exports.generateKeys = generateKeys;
+exports.getCertAuthority = getCertAuthority;
+exports.generateCertsKeys = generateCertsKeys;
+exports.renewSelfSigned = renewSelfSigned;
 exports.reviewSelfSignedCert = reviewSelfSignedCert;
+exports.updateConfigCert = updateConfigCert;
 exports.createTLSSelector = createTLSSelector;
 exports.listCertificates = listCertificates;
-exports.generateCertsKeys = generateCertsKeys;
-exports.getReplicationCert = getReplicationCert;
-exports.getReplicationCertAuth = getReplicationCertAuth;
-exports.renewSelfSigned = renewSelfSigned;
+exports.getPrimaryHostName = getPrimaryHostName;
 exports.hostnamesFromCert = hostnamesFromCert;
 exports.getHostnamesFromCertificate = getHostnamesFromCertificate;
-exports.getPrimaryHostName = getPrimaryHostName;
-exports.generateSerialNumber = generateSerialNumber;
-exports.getPrivateKeys = () => privateKeys;
-exports.getCertAuthority = getCertAuthority;
-exports.certExtensions = certExtensions;
-exports.getCommonName = getCommonName;
-const { readFileSync, statSync } = require('node:fs');
-const { getTicketKeys, onMessageFromWorkers } = require('../server/threads/manageThreads.js');
-const { isMainThread } = require('worker_threads');
-const { TLSSocket } = require('node:tls');
+const path = __importStar(require("path"));
+const chokidar_1 = require("chokidar");
+const fs = __importStar(require("fs-extra"));
+const forge = __importStar(require("node-forge"));
+const net = __importStar(require("net"));
+const node_crypto_1 = require("node:crypto");
+const util = __importStar(require("util"));
+const generateKeyPair = util.promisify(node_crypto_1.generateKeyPair);
+const pki = forge.pki;
+const uuid_1 = require("uuid");
+const harper_logger_ts_1 = require("../utility/logging/harper_logger.js");
+const envManager = __importStar(require("../utility/environment/environmentManager.js"));
+const hdbTerms = __importStar(require("../utility/hdbTerms.js"));
+const certificatesTerms = __importStar(require("../utility/terms/certificates.js"));
+const tls = require('node:tls');
+const node_path_1 = require("node:path");
+const assignCmdEnvVariables_ts_1 = __importDefault(require("../utility/assignCmdEnvVariables.js"));
+const configUtils = __importStar(require("../config/configUtils.js"));
+const databases_ts_1 = require("../resources/databases.js");
+const logger = (0, harper_logger_ts_1.forComponent)('tls').conditional;
+const { CONFIG_PARAMS } = hdbTerms;
+const { CERTIFICATE_VALUES } = certificatesTerms;
+const nodeName_ts_1 = require("../server/nodeName.js");
+const getPrivateKeys = () => privateKeys;
+exports.getPrivateKeys = getPrivateKeys;
+const node_fs_1 = require("node:fs");
+const manageThreads_js_1 = require("../server/threads/manageThreads.js");
+const worker_threads_1 = require("worker_threads");
+const node_tls_1 = require("node:tls");
 const CERT_VALIDITY_DAYS = 3650;
 const CERT_DOMAINS = ['127.0.0.1', 'localhost', '::1'];
-const CERT_ATTRIBUTES = [
+exports.CERT_ATTRIBUTES = [
     { name: 'countryName', value: 'USA' },
     { name: 'stateOrProvinceName', value: 'Colorado' },
     { name: 'localityName', value: 'Denver' },
     { name: 'organizationName', value: 'HarperDB, Inc.' },
 ];
-exports.CERT_ATTRIBUTES = CERT_ATTRIBUTES;
 /**
  * Generates a cryptographically secure serial number for X.509 certificates.
  *
@@ -64,11 +102,11 @@ exports.CERT_ATTRIBUTES = CERT_ATTRIBUTES;
  * @returns {string} 16-character hex string
  */
 function generateSerialNumber() {
-    const bytes = randomBytes(8);
+    const bytes = (0, node_crypto_1.randomBytes)(8);
     bytes[0] = (bytes[0] & 0x7f) | 0x01; // Clear high bit with bitmask 0x7F (01111111) and ensure that it is non-zero
     return bytes.toString('hex');
 }
-onMessageFromWorkers(async (message) => {
+(0, manageThreads_js_1.onMessageFromWorkers)(async (message) => {
     if (message.type === hdbTerms.ITC_EVENT_TYPES.RESTART) {
         envManager.initSync(true);
         // This will also call loadCertificates
@@ -78,9 +116,9 @@ onMessageFromWorkers(async (message) => {
 let certificateTable;
 function getCertTable() {
     if (!certificateTable) {
-        certificateTable = getDatabases()['system']['hdb_certificate'];
+        certificateTable = (0, databases_ts_1.getDatabases)()['system']?.['hdb_certificate'];
         if (!certificateTable) {
-            certificateTable = table({
+            certificateTable = (0, databases_ts_1.table)({
                 table: 'hdb_certificate',
                 database: 'system',
                 attributes: [
@@ -116,16 +154,16 @@ function getCertTable() {
     return certificateTable;
 }
 async function getReplicationCert() {
-    const SNICallback = createTLSSelector('replication');
+    const SNICallback = createTLSSelector('replication', undefined);
     const secureTarget = {
         secureContexts: null,
         setSecureContext: (_ctx) => { },
     };
     await SNICallback.initialize(secureTarget);
-    const cert = secureTarget.secureContexts.get(getThisNodeName());
+    const cert = secureTarget.secureContexts.get((0, nodeName_ts_1.getThisNodeName)());
     if (!cert)
         return;
-    const certParsed = new X509Certificate(cert.options.cert);
+    const certParsed = new node_crypto_1.X509Certificate(cert.options.cert);
     cert.cert_parsed = certParsed;
     cert.issuer = certParsed.issuer;
     return cert;
@@ -133,7 +171,7 @@ async function getReplicationCert() {
 async function getReplicationCertAuth() {
     getCertTable();
     const certPem = (await getReplicationCert()).options.cert;
-    const repCert = new X509Certificate(certPem);
+    const repCert = new node_crypto_1.X509Certificate(certPem);
     const caName = repCert.issuer.match(/CN=(.*)/)?.[1];
     return certificateTable.get(caName);
 }
@@ -162,7 +200,7 @@ function loadCertificates() {
             for (let config of configs) {
                 const privateKeyPath = config.privateKey;
                 // need to relativize the paths so they aren't exposed
-                let private_key_name = privateKeyPath && relative(join(rootPath, 'keys'), privateKeyPath);
+                let private_key_name = privateKeyPath && (0, node_path_1.relative)((0, node_path_1.join)(rootPath, 'keys'), privateKeyPath);
                 if (private_key_name) {
                     loadAndWatch(privateKeyPath, (private_key) => {
                         privateKeys.set(private_key_name, private_key);
@@ -170,7 +208,7 @@ function loadCertificates() {
                 }
                 for (let ca of [false, true]) {
                     let path = config[ca ? 'certificateAuthority' : 'certificate'];
-                    if (path && isMainThread) {
+                    if (path && worker_threads_1.isMainThread) {
                         loadAndWatch(path, (certificate) => {
                             if (CERTIFICATE_VALUES.cert === certificate) {
                                 // this is the compromised Harper certificate authority, and we do not even want to bother to
@@ -181,7 +219,7 @@ function loadCertificates() {
                             if (hostnames && !Array.isArray(hostnames))
                                 hostnames = [hostnames];
                             const certificatePem = readPEM(path);
-                            const x509Cert = new X509Certificate(certificatePem);
+                            const x509Cert = new node_crypto_1.X509Certificate(certificatePem);
                             let certCn;
                             try {
                                 certCn = (!ca && config.name) || getPrimaryHostName(x509Cert);
@@ -195,12 +233,12 @@ function loadCertificates() {
                                 return;
                             }
                             // Check if cert issued by compromised Harper certificate authority, if it is, do not load it
-                            if (x509Cert.checkIssued(new X509Certificate(CERTIFICATE_VALUES.cert)))
+                            if (x509Cert.checkIssued(new node_crypto_1.X509Certificate(CERTIFICATE_VALUES.cert)))
                                 return;
                             // If a record already exists for cert check to see who is newer, cert record or cert file.
                             // If cert file is newer, add it to table
                             const certRecord = certificateTable.primaryStore.get(certCn);
-                            let fileTimestamp = statSync(path).mtimeMs;
+                            let fileTimestamp = (0, node_fs_1.statSync)(path).mtimeMs;
                             let recordTimestamp = !certRecord || certRecord.is_self_signed
                                 ? 1
                                 : (certRecord.file_timestamp ?? certRecord.__updatedtime__);
@@ -247,7 +285,7 @@ function loadAndWatch(path, loadCert, type) {
         try {
             let modified = stats.mtimeMs;
             if (modified && modified !== lastModified) {
-                if (lastModified && isMainThread)
+                if (lastModified && worker_threads_1.isMainThread)
                     logger.warn?.(`Reloading ${type}:`, path);
                 lastModified = modified;
                 loadCert(readPEM(path));
@@ -258,22 +296,22 @@ function loadAndWatch(path, loadCert, type) {
         }
     };
     if (fs.existsSync(path))
-        loadFile(path, statSync(path));
+        loadFile(path, (0, node_fs_1.statSync)(path));
     else
         logger.error?.(`${type} file not found:`, path);
-    watch(path, { persistent: false }).on('change', loadFile);
+    (0, chokidar_1.watch)(path, { persistent: false }).on('change', loadFile);
 }
 function getHost() {
-    let url = getThisNodeUrl();
+    let url = (0, nodeName_ts_1.getThisNodeUrl)();
     if (url == null) {
         const host = CERT_DOMAINS[0];
         logger.info?.('node url is missing from harperdb-config.yaml, using default host' + host);
         return host;
     }
-    return urlToNodeName(url);
+    return (0, nodeName_ts_1.urlToNodeName)(url);
 }
 function getCommonName() {
-    let node_name = getThisNodeName();
+    let node_name = (0, nodeName_ts_1.getThisNodeName)();
     if (node_name == null) {
         const host = CERT_DOMAINS[0];
         logger.info?.('replication url is missing from harperdb-config.yaml, using default host' + host);
@@ -321,7 +359,7 @@ function certExtensions() {
 }
 async function createCertificateTable(cert, caCert) {
     await setCertTable({
-        name: getThisNodeName(),
+        name: (0, nodeName_ts_1.getThisNodeName)(),
         uses: ['replication'],
         certificate: cert,
         private_key_name: 'privateKey.pem',
@@ -340,7 +378,7 @@ async function createCertificateTable(cert, caCert) {
 async function setCertTable(certRecord) {
     let cert;
     try {
-        cert = new X509Certificate(certRecord.certificate);
+        cert = new node_crypto_1.X509Certificate(certRecord.certificate);
     }
     catch (error) {
         // Log the specific error for debugging
@@ -401,7 +439,7 @@ async function generateCertificates(caPrivateKey, publicKey, caCert) {
             name: 'commonName',
             value: getCommonName(),
         },
-        ...CERT_ATTRIBUTES,
+        ...exports.CERT_ATTRIBUTES,
     ];
     publicCert.setSubject(subject);
     publicCert.setIssuer(caCert.subject.attributes);
@@ -417,7 +455,7 @@ async function getCertAuthority() {
             continue;
         const matchingPrivateKey = getPrivateKeyByName(cert.private_key_name);
         if (cert.private_key_name && matchingPrivateKey) {
-            const keyCheck = new X509Certificate(cert.certificate).checkPrivateKey(createPrivateKey(matchingPrivateKey));
+            const keyCheck = new node_crypto_1.X509Certificate(cert.certificate).checkPrivateKey((0, node_crypto_1.createPrivateKey)(matchingPrivateKey));
             if (keyCheck) {
                 logger.trace?.(`CA named: ${cert.name} found with matching private key`);
                 match = { ca: cert, private_key: matchingPrivateKey };
@@ -440,9 +478,9 @@ async function generateCertAuthority(private_key, publicKey, writeKey = true) {
     const subject = [
         {
             name: 'commonName',
-            value: `Harper-Certificate-Authority-${envManager.get(CONFIG_PARAMS.NODE_HOSTNAME) ?? uuidv4().split('-')[0]}`,
+            value: `Harper-Certificate-Authority-${envManager.get(CONFIG_PARAMS.NODE_HOSTNAME) ?? (0, uuid_1.v4)().split('-')[0]}`,
         },
-        ...CERT_ATTRIBUTES,
+        ...exports.CERT_ATTRIBUTES,
     ];
     caCert.setSubject(subject);
     caCert.setIssuer(subject);
@@ -481,7 +519,7 @@ async function renewSelfSigned() {
 }
 async function reviewSelfSignedCert() {
     // Clear any cached node name var
-    clearThisNodeName();
+    (0, nodeName_ts_1.clearThisNodeName)();
     await loadCertificates();
     getCertTable();
     let caAndKey = await getCertAuthority();
@@ -520,7 +558,7 @@ async function reviewSelfSignedCert() {
             tlsPrivateKeyPath = result.keyPath;
         }
         const keysPath = path.join(envManager.getHdbBasePath(), hdbTerms.LICENSE_KEY_DIR_NAME);
-        let keyName = relative(keysPath, tlsPrivateKeyPath);
+        let keyName = (0, node_path_1.relative)(keysPath, tlsPrivateKeyPath);
         if (!privateKey) {
             logger.warn?.('Unable to parse the TLS key', tlsPrivateKeyPath, 'A new key will be generated and used to create Certificate Authority');
             // Currently we can only parse RSA keys, so if it's not an RSA key, we need to generate a new one
@@ -528,7 +566,7 @@ async function reviewSelfSignedCert() {
             ({ privateKey } = await generateKeys());
             // If there is an existing private key, we will save the new one with a unique name
             if (fs.existsSync(path.join(keysPath, certificatesTerms.PRIVATEKEY_PEM_NAME)))
-                keyName = `privateKey${uuidv4().split('-')[0]}.pem`;
+                keyName = `privateKey${(0, uuid_1.v4)().split('-')[0]}.pem`;
             await fs.writeFile(path.join(keysPath, keyName), pki.privateKeyToPem(privateKey));
         }
         const hdbCa = await generateCertAuthority(privateKey, pki.setRsaPublicKey(privateKey.n, privateKey.e), false);
@@ -543,7 +581,7 @@ async function reviewSelfSignedCert() {
     }
     const existingCert = await getReplicationCert();
     if (!existingCert) {
-        const certName = getThisNodeName();
+        const certName = (0, nodeName_ts_1.getThisNodeName)();
         logger.notify?.(`A suitable replication certificate was not found, creating new self singed cert named: ${certName}`);
         caAndKey = caAndKey ?? (await getCertAuthority());
         const hdbCa = pki.certificateFromPem(caAndKey.ca.certificate);
@@ -562,7 +600,7 @@ async function reviewSelfSignedCert() {
 // Update the cert config in harperdb-config.yaml
 // If CLI or Env values are present it will use those values, else it will use default private key.
 function updateConfigCert() {
-    const cliEnvArgs = assignCmdenvVars(Object.keys(hdbTerms.CONFIG_PARAM_MAP), true);
+    const cliEnvArgs = (0, assignCmdEnvVariables_ts_1.default)(Object.keys(hdbTerms.CONFIG_PARAM_MAP), true);
     const keysPath = path.join(envManager.getHdbBasePath(), hdbTerms.LICENSE_KEY_DIR_NAME);
     const private_key = path.join(keysPath, certificatesTerms.PRIVATEKEY_PEM_NAME);
     // This object is what will be added to the harperdb-config.yaml file.
@@ -592,47 +630,53 @@ function updateConfigCert() {
     // Filter out any cert config keys already set by HARPER_SET_CONFIG so we don't overwrite them
     // with defaults. On first boot, HARPER_SET_CONFIG values are written to the config file during
     // createConfigFile(), but updateConfigCert() runs afterward without re-applying HARPER_SET_CONFIG.
-    const { filterArgsAgainstRuntimeConfig } = require("../config/harperConfigEnvVars.js");
+    const { filterArgsAgainstRuntimeConfig } = require('../config/harperConfigEnvVars');
     const filteredCerts = filterArgsAgainstRuntimeConfig(newCerts);
     configUtils.updateConfigValue(undefined, undefined, filteredCerts, false, true);
 }
 function readPEM(path) {
     if (path.startsWith('-----BEGIN'))
         return path;
-    return readFileSync(path, 'utf8');
+    return (0, node_fs_1.readFileSync)(path, 'utf8');
 }
 // this horrifying hack is brought to you by https://github.com/nodejs/node/issues/36655
-const origCreateSecureContext = tls.createSecureContext;
-tls.createSecureContext = function (options) {
-    if (!options.cert || !options.key) {
-        return origCreateSecureContext(options);
-    }
-    let lessOptions = { ...options };
-    delete lessOptions.key;
-    delete lessOptions.cert;
-    let ctx = origCreateSecureContext(lessOptions);
-    ctx.context.setCert(options.cert);
-    ctx.context.setKey(options.key, undefined);
-    return ctx;
-};
-// Node.js SNI callbacks _add_ the certificate and don't replace it, and so we can't have a default certificate,
-// so we have to assign the default certificate during the cert callback, because the default SNI callback isn't
-// consistently called for all TLS connections (isn't called if no SNI server name is provided).
-// first we have interrupt the socket initialization to add our own cert callback
-const originalInit = TLSSocket.prototype._init;
-TLSSocket.prototype._init = function (socket, wrap) {
-    originalInit.call(this, socket, wrap);
-    let tlsSocket = this;
-    this._handle.oncertcb = function (info) {
-        const servername = info.servername;
-        tlsSocket._SNICallback(servername, (err, context) => {
-            this.sni_context = context?.context || context;
-            // note that this skips the checks for multiple callbacks and entirely skips OCSP, so if we ever need that, we
-            // need to call the original oncertcb
-            this.certCbDone();
-        });
+if (typeof globalThis.Bun === 'undefined') {
+    const origCreateSecureContext = tls.createSecureContext;
+    tls.createSecureContext = function (options) {
+        if (!options.cert || !options.key) {
+            return origCreateSecureContext(options);
+        }
+        let lessOptions = { ...options };
+        delete lessOptions.key;
+        delete lessOptions.cert;
+        let ctx = origCreateSecureContext(lessOptions);
+        if (typeof ctx.context?.setCert !== 'function') {
+            // setCert is a Node.js internal — not available in all environments; fall back to default
+            return origCreateSecureContext(options);
+        }
+        ctx.context.setCert(options.cert);
+        ctx.context.setKey(options.key, undefined);
+        return ctx;
     };
-};
+    // Node.js SNI callbacks _add_ the certificate and don't replace it, and so we can't have a default certificate,
+    // so we have to assign the default certificate during the cert callback, because the default SNI callback isn't
+    // consistently called for all TLS connections (isn't called if no SNI server name is provided).
+    // first we have interrupt the socket initialization to add our own cert callback
+    const originalInit = node_tls_1.TLSSocket.prototype._init;
+    node_tls_1.TLSSocket.prototype._init = function (socket, wrap) {
+        originalInit.call(this, socket, wrap);
+        let tlsSocket = this;
+        this._handle.oncertcb = function (info) {
+            const servername = info.servername;
+            tlsSocket._SNICallback(servername, (err, context) => {
+                this.sni_context = context?.context || context;
+                // note that this skips the checks for multiple callbacks and entirely skips OCSP, so if we ever need that, we
+                // need to call the original oncertcb
+                this.certCbDone();
+            });
+        };
+    };
+}
 let caCerts = new Map();
 /**
  * Create a TLS selector that will choose the best TLS configuration/context for a given hostname
@@ -657,34 +701,36 @@ function createTLSSelector(type, mtlsOptions) {
                     secureContexts.clear();
                     caCerts.clear();
                     let bestQuality = 0;
-                    if (databases === undefined) {
+                    if (databases_ts_1.databases === undefined) {
                         resolve();
                         return;
                     }
-                    for (const cert of databases.system.hdb_certificate.search([])) {
+                    for (const cert of databases_ts_1.databases.system.hdb_certificate.search([])) {
                         const certificate = cert.certificate;
-                        const certParsed = new X509Certificate(certificate);
+                        const certParsed = new node_crypto_1.X509Certificate(certificate);
                         if (cert.is_authority) {
                             certParsed.asString = certificate;
                             caCerts.set(certParsed.subject, certificate);
                         }
                     }
-                    for (const cert of databases.system.hdb_certificate.search([])) {
+                    for (const cert of databases_ts_1.databases.system.hdb_certificate.search([])) {
                         try {
                             if (cert.is_authority) {
                                 continue;
                             }
                             let quality = cert.is_self_signed ? 1 : 3;
+                            // normalize: stored as scalar in legacy/manual entries, expected array
+                            const uses = Array.isArray(cert.uses) ? cert.uses : cert.uses ? [cert.uses] : [];
                             // prefer operations certificates for operations API
-                            if (cert.uses?.includes(type))
+                            if (uses.includes(type))
                                 quality += 3;
-                            else if (cert.uses?.includes('https'))
+                            else if (uses.includes('https'))
                                 quality += 0.5; // this was a legacy generic general use type
                             else
-                                quality -= (cert.uses?.length ?? 0) / 5; // if there are designed uses for this that don't match, dock points
+                                quality -= uses.length / 5; // if there are designed uses for this that don't match, dock points
                             const private_key = getPrivateKeyByName(cert.private_key_name);
                             let certificate = cert.certificate;
-                            const certParsed = new X509Certificate(certificate);
+                            const certParsed = new node_crypto_1.X509Certificate(certificate);
                             if (caCerts.has(certParsed.issuer)) {
                                 certificate += '\n' + caCerts.get(certParsed.issuer);
                             }
@@ -693,7 +739,7 @@ function createTLSSelector(type, mtlsOptions) {
                             }
                             const secureOptions = {
                                 ciphers: cert.ciphers,
-                                ticketKeys: getTicketKeys(),
+                                ticketKeys: (0, manageThreads_js_1.getTicketKeys)(),
                                 availableCAs: caCerts, // preserve the record of caCerts even if not used for mTLS here
                                 ca: mtlsOptions && Array.from(caCerts.values()),
                                 cert: certificate,
@@ -761,7 +807,7 @@ function createTLSSelector(type, mtlsOptions) {
                     reject(error);
                 }
             }
-            databases?.system.hdb_certificate.subscribe({
+            databases_ts_1.databases?.system.hdb_certificate.subscribe({
                 listener: () => setTimeout(() => updateTLS(), 1500).unref(),
                 omitCurrent: true,
             });