@harperfast/harper 5.3.0 → 5.3.1

package/dist/resources/transactionBroadcast.js

@@ -1,13 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.addSubscription = addSubscription;
+exports.endSubscriptionsFromEarlierHandles = endSubscriptionsFromEarlierHandles;
 exports.listenToCommits = listenToCommits;
 exports.whenNextTransaction = whenNextTransaction;
+const node_path_1 = require("node:path");
 const harper_logger_js_1 = require("../utility/logging/harper_logger.js");
+const hdbError_ts_1 = require("../utility/errors/hdbError.js");
 const IterableEventQueue_ts_1 = require("./IterableEventQueue.js");
 const Resources_ts_1 = require("./Resources.js");
 const allSubscriptions = Object.create(null); // using it as a map that doesn't change much
 const allSameThreadSubscriptions = Object.create(null); // using it as a map that doesn't change much
+// The handle each database path was last opened with on this thread, kept as a token so a retired database's closed
+// store graph is not retained. A registration through any other handle would join the entry the current store's
+// commits drive while reading through that handle's closed stores.
+const HANDLE_TOKEN = Symbol('subscription-handle');
+const currentHandles = new Map();
+// A store with no generation (LMDB) is never replaced by a copy, so its reopen is only ever a close.
+function generationChanged(generationId, currentId, tracksGeneration) {
+    return tracksGeneration && !(generationId != null && generationId === currentId);
+}
+function closingError(auditStore, path) {
+    return new hdbError_ts_1.DatabaseClosingError(auditStore?.rootStore?.databaseName ?? (0, node_path_1.basename)(path));
+}
 /**
  * This module/function is responsible for the main work of tracking subscriptions and listening for new transactions
  * that have occurred on any thread, and then reading through the transaction log to notify listeners. This is
@@ -27,6 +42,16 @@ function addSubscription(table, key, listener, startTime, options) {
     if (!path) {
         throw new Error('No path for table primary store');
     }
+    const generationId = table.auditStore?.databaseGeneration?.id ?? null;
+    const current = currentHandles.get(path);
+    const replaced = current !== undefined && table.auditStore?.[HANDLE_TOKEN] !== current.token;
+    if (replaced || table.auditStore?.rootStore?.status === 'closed') {
+        if (options?.scope === 'full-database')
+            return;
+        throw replaced && generationChanged(generationId, current.generationId, current.tracksGeneration)
+            ? new hdbError_ts_1.DatabaseGenerationChangedError()
+            : closingError(table.auditStore, path);
+    }
     if (options?.crossThreads === false) {
         // we are only listening for commits on our own thread, so we use a separate subscriber and sequencer tracker
         databaseSubscriptions = allSameThreadSubscriptions[path] || (allSameThreadSubscriptions[path] = []);
@@ -66,6 +91,7 @@ function addSubscription(table, key, listener, startTime, options) {
         }
     }
     databaseSubscriptions.auditStore = table.auditStore;
+    databaseSubscriptions.generationId ??= generationId;
     if (databaseSubscriptions.lastTxnTime == null) {
         databaseSubscriptions.lastTxnTime = Date.now();
     }
@@ -96,6 +122,45 @@ function addSubscription(table, key, listener, startTime, options) {
     databaseSubscriptions.activeCount = (databaseSubscriptions.activeCount || 0) + 1;
     return subscription;
 }
+/**
+ * End every subscription this thread registered on the database before `auditStore` reopened it: its commit
+ * listener and its table's stores belong to the closed handle, so it can never deliver again. On a store that
+ * tracks generations, another or an unknown one must resynchronize; otherwise the retryable
+ * `DatabaseClosingError`. `auditStore` becomes the only handle `addSubscription` accepts on the path before
+ * any listener runs.
+ */
+function endSubscriptionsFromEarlierHandles(auditStore, tracksGeneration) {
+    const path = auditStore.rootStore.path;
+    const generationId = auditStore.databaseGeneration?.id;
+    const token = Symbol((0, node_path_1.basename)(path));
+    auditStore[HANDLE_TOKEN] = token;
+    currentHandles.set(path, { token, generationId, tracksGeneration });
+    for (const registry of [allSubscriptions, allSameThreadSubscriptions]) {
+        const databaseSubscriptions = registry[path];
+        if (!databaseSubscriptions)
+            continue;
+        delete registry[path];
+        const changed = generationChanged(databaseSubscriptions.generationId, generationId, tracksGeneration);
+        for (const tableId in databaseSubscriptions) {
+            const tableSubscriptions = databaseSubscriptions[tableId];
+            if (!(tableSubscriptions instanceof Map))
+                continue;
+            for (const keySubscriptions of tableSubscriptions.values()) {
+                for (const subscription of [...keySubscriptions]) {
+                    try {
+                        subscription.close(changed ? new hdbError_ts_1.DatabaseGenerationChangedError() : closingError(auditStore, path));
+                    }
+                    catch (error) {
+                        try {
+                            (0, harper_logger_js_1.warn)(error);
+                        }
+                        catch { }
+                    }
+                }
+            }
+        }
+    }
+}
 /**
  * This is the class that is returned from subscribe calls and provide the interface to set a callback, end the
  * subscription and get the initial state.

package/dist/resources/transactionBroadcast.js.map

@@ -1 +1 @@
-{"version":3,"file":"transactionBroadcast.js","sourceRoot":"","sources":["../../resources/transactionBroadcast.ts"],"names":[],"mappings":";;AAiBA,0CA2EC;AA2OD,0CAkCC;AAUD,kDAeC;AAlYD,0EAA2D;AAC3D,mEAA6D;AAC7D,iDAAkD;AAGlD,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;AAC3F,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;AACrG;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,QAAuB,EAAE,SAAkB,EAAE,OAAa;IACrG,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3C,sGAAsG;IACtG,iEAAiE;IACjE,IAAI,qBAAqB,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,EAAE,YAAY,KAAK,KAAK,EAAE,CAAC;QACrC,6GAA6G;QAC7G,qBAAqB,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpG,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACP,qBAAqB,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,6BAA6B,EAAE,CAAC;YAC/C,IAAI,gBAAgB,CAAC;YACrB,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACjC,iHAAiH;gBACjH,4FAA4F;gBAC5F,8CAA8C;gBAC9C,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YACD,UAAU,CAAC,6BAA6B,GAAG,IAAI,CAAC;YAChD,2FAA2F;YAC3F,0FAA0F;YAC1F,wFAAwF;YACxF,sFAAsF;YACtF,iFAAiF;YACjF,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;gBAC/B,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC;oBACxC,mFAAmF;oBACnF,kFAAkF;oBAClF,yEAAyE;oBACzE,IAAI,UAAU,CAAC,eAAe;wBAAE,eAAe,CAAC,UAAU,CAAC,CAAC;oBAC5D,OAAO;gBACR,CAAC;gBACD,IAAI,qBAAqB,CAAC,eAAe;oBAAE,OAAO;gBAClD,qBAAqB,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC7C,YAAY,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9F,CAAC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,qBAAqB,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpD,IAAI,qBAAqB,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QAC/C,qBAAqB,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO;IACR,CAAC;IACD,IAAI,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzB,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QAChE,kBAAkB,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAChD,kBAAkB,CAAC,OAAO,GAAG,OAAO,CAAC;QACrC,kBAAkB,CAAC,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,GAAG,GAAG,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,YAAY,CAAC,SAAS,GAAG,SAAS,CAAC;IACnC,IAAI,aAAa,GAAQ,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAErD,IAAI,aAAa;QAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SAC/C,CAAC;QACL,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9D,aAAa,CAAC,MAAM,GAAG,kBAAkB,CAAC;QAC1C,aAAa,CAAC,GAAG,GAAG,GAAG,CAAC;QACxB,aAAa,CAAC,UAAU,GAAG,CAAC,CAAC;QAC7B,aAAa,CAAC,QAAQ,GAAG,KAAK,CAAC;IAChC,CAAC;IACD,YAAY,CAAC,aAAa,GAAG,aAAa,CAAC;IAC3C,qBAAqB,CAAC,WAAW,GAAG,CAAC,qBAAqB,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjF,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,MAAM,YAAa,SAAQ,0CAAkB;IAC5C,QAAQ,CAAgF;IACxF,aAAa,CAAM;IACnB,SAAS,CAAU;IACnB,kBAAkB,CAAW;IAC7B,oBAAoB,CAAW;IAC/B,YAAY,CAAW;IACvB,YAAY,QAAQ;QACnB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,GAAG;QACF,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,IAAI,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;YACpD,IAAI,gBAAgB,EAAE,WAAW,GAAG,CAAC;gBAAE,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACtE,8GAA8G;YAC9G,IAAI,aAAa,CAAC,UAAU,GAAG,CAAC;gBAAE,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC;iBAC3D,CAAC;gBACL,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;oBAAE,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC/C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;oBAAE,sBAAsB,CAAC,aAAa,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;IACD,MAAM;QACL,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACjC,CAAC;CACD;AACD,SAAS,YAAY,CAAC,gBAAgB;IACrC,IAAI,EAAE,gBAAgB,CAAC,UAAU,KAAK,CAAC,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QACtE,gBAAgB,CAAC,QAAQ,GAAG,KAAK,CAAC;QAClC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,YAAY,CAAC,aAAa;gBAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC;QACzE,CAAC;QACD,gBAAgB,CAAC,MAAM,GAAG,IAAI,CAAC;QAC/B,IAAI,IAAI,KAAK,CAAC;YAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,CAAC;AACF,CAAC;AACD,SAAS,sBAAsB,CAAC,gBAAgB;IAC/C,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACnD,IAAI,kBAAkB,EAAE,CAAC;QACxB,mCAAmC;QACnC,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,kBAAkB,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/F,CAAC;AACF,CAAC;AACD,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAChF,+FAA+F;AAC/F,4FAA4F;AAC5F,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,SAAS,yBAAyB,CAAC,aAAa,EAAE,gBAAiB,EAAE,UAAU,GAAG,KAAK;IACtF,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,oEAAoE;IAChG,+FAA+F;IAC/F,8EAA8E;IAC9E,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAChC,aAAa,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,4CAA4C;QACxF,IAAI,UAAU;YAAE,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC;QACtD,OAAO;IACR,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;IAC5C,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC;IAC5B,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5B,0FAA0F;IAC1F,kDAAkD;IAClD,IAAI,mBAAmB,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAC9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,8EAA8E;QAC9E,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC;YACtC,KAAK,EAAE,aAAa,CAAC,WAAW;YAChC,cAAc,EAAE,IAAI;SACpB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,gBAAgB,CAAC;IAC3E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACJ,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,iEAAiE;gBACjE,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,2CAA2C;gBAC3C,IAAA,uBAAI,EAAC,gEAAgE,EAAE,KAAK,CAAC,CAAC;gBAC9E,MAAM;YACP,CAAC;YACD,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;YACjC,MAAM,SAAS,GAAW,WAAW,CAAC,SAAS,CAAC;YAChD,aAAa,CAAC,WAAW,GAAG,SAAS,CAAC;YACtC,uFAAuF;YACvF,2FAA2F;YAC3F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7E,IAAI,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,kBAAkB,GAAG,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;oBACtC,mCAAmC;oBACnC,IAAI,WAAW,GAAG,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;oBAC7C,IAAI,aAAa,GAAG,CAAC,CAAC;oBACtB,GAAG,CAAC;wBACH,gFAAgF;wBAChF,gIAAgI;wBAChI,iEAAiE;wBACjE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBAC7D,IAAI,gBAAgB,EAAE,CAAC;4BACtB,gBAAgB,CAAC,UAAU,EAAE,CAAC;4BAC9B,IAAI,CAAC;gCACJ,kEAAkE;gCAClE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oCACnE,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;oCACzC,IAAI,CAAC,YAAY,CAAC,aAAa;wCAAE,SAAS;oCAC1C,IACC,aAAa,GAAG,CAAC,IAAI,sGAAsG;wCAC3H,CAAC,CAAC,YAAY,CAAC,kBAAkB,IAAI,CAAC,CAAC,YAAY,CAAC,YAAY,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;wCAEvF,SAAS;oCACV,IAAI,YAAY,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;wCACzC,SAAS;oCACV,CAAC;oCACD,IAAI,CAAC;wCACJ,IAAI,QAAQ,CAAC;wCACb,IAAI,YAAY,CAAC,oBAAoB,IAAI,YAAY,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;4CAChF,8FAA8F;4CAC9F,uFAAuF;4CACvF,0DAA0D;4CAC1D,QAAQ,GAAG,IAAI,CAAC;4CAChB,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;gDACjC,uGAAuG;gDACvG,IAAI,CAAC,mBAAmB;oDAAE,mBAAmB,GAAG,CAAC,YAAY,CAAC,CAAC;;oDAC1D,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;4CAC7C,CAAC;4CACD,YAAY,CAAC,aAAa,GAAG,MAAM,CAAC;wCACrC,CAAC;wCACD,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;oCACnE,CAAC;oCAAC,OAAO,KAAK,EAAE,CAAC;wCAChB,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;oCACb,CAAC;gCACF,CAAC;4BACF,CAAC;oCAAS,CAAC;gCACV,YAAY,CAAC,gBAAgB,CAAC,CAAC;4BAChC,CAAC;wBACF,CAAC;wBACD,IAAI,WAAW,IAAI,IAAI;4BAAE,MAAM;wBAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;wBACzE,IAAI,SAAS,KAAK,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC1C,aAAa,EAAE,CAAC,CAAC,8EAA8E;wBAChG,CAAC;wBACD,4FAA4F;wBAC5F,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;wBAC9E,WAAW,GAAG,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC5D,CAAC,QAAQ,IAAI,EAAE;gBAChB,CAAC;YACF,CAAC;iBAAM,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1C,6FAA6F;gBAC7F,gGAAgG;gBAChG,kGAAkG;gBAClG,iGAAiG;gBACjG,MAAM,kBAAkB,GAAG,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,EAAE,CAAC;oBACxB,yFAAyF;oBACzF,IAAI,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC;oBAC5C,KAAK,MAAM,gBAAgB,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;wBAC5D,IAAI,aAAa,EAAE,KAAK,CAAC;4BAAE,MAAM;wBACjC,gBAAgB,CAAC,UAAU,EAAE,CAAC;wBAC9B,IAAI,CAAC;4BACJ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gCACnE,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;gCACzC,IAAI,CAAC,YAAY,CAAC,aAAa,IAAI,YAAY,CAAC,SAAS,IAAI,SAAS;oCAAE,SAAS;gCACjF,IAAI,CAAC;oCACJ,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gCAC5D,CAAC;gCAAC,OAAO,KAAK,EAAE,CAAC;oCAChB,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;gCACb,CAAC;4BACF,CAAC;wBACF,CAAC;gCAAS,CAAC;4BACV,YAAY,CAAC,gBAAgB,CAAC,CAAC;wBAChC,CAAC;oBACF,CAAC;gBACF,CAAC;YACF,CAAC;YACD,IAAI,UAAU,IAAI,EAAE,SAAS,IAAI,iBAAiB,EAAE,CAAC;gBACpD,iFAAiF;gBACjF,oFAAoF;gBACpF,yFAAyF;gBACzF,4FAA4F;gBAC5F,aAAa,CAAC,qBAAqB,GAAG,mBAAmB,CAAC;gBAC1D,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,GAAG,EAAE,CACjB,yBAAyB,CAAC,aAAa,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CACrG,CAAC;gBACF,OAAO;YACR,CAAC;QACF,CAAC;QACD,aAAa,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAC3C,IAAI,mBAAmB,EAAE,CAAC;YACzB,iHAAiH;YACjH,KAAK,MAAM,YAAY,IAAI,mBAAmB,EAAE,CAAC;gBAChD,YAAY,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,WAAW;gBAC9C,IAAI,CAAC,YAAY,CAAC,aAAa;oBAAE,SAAS;gBAC1C,IAAI,CAAC;oBACJ,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACnF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;gBACb,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;YAAS,CAAC;QACV,0FAA0F;QAC1F,iFAAiF;QACjF,IAAI,UAAU,IAAI,CAAC,OAAO;YAAE,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC;IACnE,CAAC;AACF,CAAC;AACD;;;;GAIG;AACH,SAAgB,eAAe,CAAC,YAAY,EAAE,UAAU;IACvD,MAAM,KAAK,GAAG,UAAU,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QACrC,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACtC,KAAK,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,EAAE;YACtC,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,wEAAwE;YAChI,IAAI,CAAC,aAAa;gBAAE,OAAO;YAC3B,uFAAuF;YACvF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,yBAAyB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC7D,CAAC;YACD,0KAA0K;YAC1K,MAAM,YAAY,GAAG,GAAG,EAAE;gBACzB,wHAAwH;gBACxH,IAAI,CAAC,KAAK,CAAC,iBAAiB;oBAC3B,uCAAuC;oBACvC,KAAK,CAAC,iBAAiB,GAAG,IAAI,YAAY,CACzC,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CACxE,CAAC;gBACH,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,sBAAsB;gBACxF,IAAI,CAAC;oBACJ,yBAAyB,CAAC,aAAa,CAAC,CAAC;gBAC1C,CAAC;wBAAS,CAAC;oBACV,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC,uBAAuB;oBAC/E,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,uBAAuB;gBAC7D,CAAC;YACF,CAAC,CAAC;YACF,iCAAiC;YACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,YAAY,CAAC;gBAAE,OAAO;YAChE,YAAY,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AACD,SAAS,eAAe,CAAC,UAAU;IAClC,UAAU,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC;IACtC,IAAI,WAAW,CAAC;IAChB,UAAU,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACpD,WAAW,GAAG,OAAO,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,eAAe,CAAC,OAAO,GAAG,WAAW,CAAC;AAClD,CAAC;AAED,SAAgB,mBAAmB,CAAC,UAAU;IAC7C,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;QACjC,eAAe,CACd;YACC,YAAY,EAAE,UAAU;YACxB,UAAU;SACV,EACD,IAAI,EACJ,IAAI,EACJ,CAAC,EACD,EAAE,KAAK,EAAE,eAAe,EAAE,CAC1B,CAAC;QACF,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,UAAU,CAAC,eAAe,CAAC;AACnC,CAAC"}
+{"version":3,"file":"transactionBroadcast.js","sourceRoot":"","sources":["../../resources/transactionBroadcast.ts"],"names":[],"mappings":";;AAwCA,0CAqFC;AASD,gFA2BC;AA2OD,0CAkCC;AAUD,kDAeC;AAvcD,yCAAqC;AACrC,0EAA2D;AAC3D,+DAAqG;AACrG,mEAA6D;AAC7D,iDAAkD;AAGlD,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;AAC3F,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;AACrG,oHAAoH;AACpH,gHAAgH;AAChH,mEAAmE;AACnE,MAAM,YAAY,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;AACnD,MAAM,cAAc,GAAG,IAAI,GAAG,EAG3B,CAAC;AAEJ,qGAAqG;AACrG,SAAS,iBAAiB,CACzB,YAAuC,EACvC,SAAoC,EACpC,gBAAyB;IAEzB,OAAO,gBAAgB,IAAI,CAAC,CAAC,YAAY,IAAI,IAAI,IAAI,YAAY,KAAK,SAAS,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,YAAY,CAAC,UAAe,EAAE,IAAY;IAClD,OAAO,IAAI,kCAAoB,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,IAAI,IAAA,oBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC;AACD;;;;;;;;;GASG;AACH,SAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,QAAuB,EAAE,SAAkB,EAAE,OAAa;IACrG,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC;IAC3C,sGAAsG;IACtG,iEAAiE;IACjE,IAAI,qBAAqB,CAAC;IAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,EAAE,kBAAkB,EAAE,EAAE,IAAI,IAAI,CAAC;IACtE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,YAAY,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC;IAC7F,IAAI,QAAQ,IAAI,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClE,IAAI,OAAO,EAAE,KAAK,KAAK,eAAe;YAAE,OAAO;QAC/C,MAAM,QAAQ,IAAI,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC;YAChG,CAAC,CAAC,IAAI,4CAA8B,EAAE;YACtC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,EAAE,YAAY,KAAK,KAAK,EAAE,CAAC;QACrC,6GAA6G;QAC7G,qBAAqB,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACpG,eAAe,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACP,qBAAqB,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,UAAU,CAAC,6BAA6B,EAAE,CAAC;YAC/C,IAAI,gBAAgB,CAAC;YACrB,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBACjC,iHAAiH;gBACjH,4FAA4F;gBAC5F,8CAA8C;gBAC9C,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC5C,CAAC;YACD,UAAU,CAAC,6BAA6B,GAAG,IAAI,CAAC;YAChD,2FAA2F;YAC3F,0FAA0F;YAC1F,wFAAwF;YACxF,sFAAsF;YACtF,iFAAiF;YACjF,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;gBAC/B,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,CAAC;oBACxC,mFAAmF;oBACnF,kFAAkF;oBAClF,yEAAyE;oBACzE,IAAI,UAAU,CAAC,eAAe;wBAAE,eAAe,CAAC,UAAU,CAAC,CAAC;oBAC5D,OAAO;gBACR,CAAC;gBACD,IAAI,qBAAqB,CAAC,eAAe;oBAAE,OAAO;gBAClD,qBAAqB,CAAC,eAAe,GAAG,IAAI,CAAC;gBAC7C,YAAY,CAAC,GAAG,EAAE,CAAC,yBAAyB,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;YAC9F,CAAC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,qBAAqB,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpD,qBAAqB,CAAC,YAAY,KAAK,YAAY,CAAC;IACpD,IAAI,qBAAqB,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QAC/C,qBAAqB,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,EAAE,KAAK,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO;IACR,CAAC;IACD,IAAI,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzB,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC;QAChE,kBAAkB,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAChD,kBAAkB,CAAC,OAAO,GAAG,OAAO,CAAC;QACrC,kBAAkB,CAAC,KAAK,GAAG,KAAK,CAAC,YAAY,CAAC;IAC/C,CAAC;IAED,GAAG,GAAG,IAAA,+BAAgB,EAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;IAChD,YAAY,CAAC,SAAS,GAAG,SAAS,CAAC;IACnC,IAAI,aAAa,GAAQ,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAErD,IAAI,aAAa;QAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;SAC/C,CAAC;QACL,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,aAAa,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9D,aAAa,CAAC,MAAM,GAAG,kBAAkB,CAAC;QAC1C,aAAa,CAAC,GAAG,GAAG,GAAG,CAAC;QACxB,aAAa,CAAC,UAAU,GAAG,CAAC,CAAC;QAC7B,aAAa,CAAC,QAAQ,GAAG,KAAK,CAAC;IAChC,CAAC;IACD,YAAY,CAAC,aAAa,GAAG,aAAa,CAAC;IAC3C,qBAAqB,CAAC,WAAW,GAAG,CAAC,qBAAqB,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACjF,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kCAAkC,CAAC,UAAe,EAAE,gBAAyB;IAC5F,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;IACvC,MAAM,YAAY,GAAG,UAAU,CAAC,kBAAkB,EAAE,EAAE,CAAC;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAA,oBAAQ,EAAC,IAAI,CAAC,CAAC,CAAC;IACrC,UAAU,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;IACjC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACpE,KAAK,MAAM,QAAQ,IAAI,CAAC,gBAAgB,EAAE,0BAA0B,CAAC,EAAE,CAAC;QACvE,MAAM,qBAAqB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,qBAAqB;YAAE,SAAS;QACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,YAAY,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACtG,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;YAC7C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,CAAC,CAAC,kBAAkB,YAAY,GAAG,CAAC;gBAAE,SAAS;YACnD,KAAK,MAAM,gBAAgB,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC5D,KAAK,MAAM,YAAY,IAAI,CAAC,GAAG,gBAAgB,CAAC,EAAE,CAAC;oBAClD,IAAI,CAAC;wBACJ,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,4CAA8B,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;oBACrG,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,IAAI,CAAC;4BACJ,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;wBACb,CAAC;wBAAC,MAAM,CAAC,CAAA,CAAC;oBACX,CAAC;gBACF,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,MAAM,YAAa,SAAQ,0CAAkB;IAC5C,QAAQ,CAAgF;IACxF,aAAa,CAAM;IACnB,SAAS,CAAU;IACnB,kBAAkB,CAAW;IAC7B,oBAAoB,CAAW;IAC/B,YAAY,CAAW;IACvB,YAAY,QAAQ;QACnB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,GAAG;QACF,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,IAAI,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,MAAM,gBAAgB,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;YACpD,IAAI,gBAAgB,EAAE,WAAW,GAAG,CAAC;gBAAE,gBAAgB,CAAC,WAAW,EAAE,CAAC;YACtE,8GAA8G;YAC9G,IAAI,aAAa,CAAC,UAAU,GAAG,CAAC;gBAAE,aAAa,CAAC,QAAQ,GAAG,IAAI,CAAC;iBAC3D,CAAC;gBACL,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;oBAAE,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC/C,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;oBAAE,sBAAsB,CAAC,aAAa,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACd,CAAC;IACD,MAAM;QACL,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IACjC,CAAC;CACD;AACD,SAAS,YAAY,CAAC,gBAAgB;IACrC,IAAI,EAAE,gBAAgB,CAAC,UAAU,KAAK,CAAC,IAAI,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QACtE,gBAAgB,CAAC,QAAQ,GAAG,KAAK,CAAC;QAClC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,YAAY,CAAC,aAAa;gBAAE,gBAAgB,CAAC,IAAI,EAAE,CAAC,GAAG,YAAY,CAAC;QACzE,CAAC;QACD,gBAAgB,CAAC,MAAM,GAAG,IAAI,CAAC;QAC/B,IAAI,IAAI,KAAK,CAAC;YAAE,sBAAsB,CAAC,gBAAgB,CAAC,CAAC;IAC1D,CAAC;AACF,CAAC;AACD,SAAS,sBAAsB,CAAC,gBAAgB;IAC/C,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACnD,IAAI,kBAAkB,EAAE,CAAC;QACxB,mCAAmC;QACnC,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAChD,IAAI,kBAAkB,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/F,CAAC;AACF,CAAC;AACD,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAChF,+FAA+F;AAC/F,4FAA4F;AAC5F,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,SAAS,yBAAyB,CAAC,aAAa,EAAE,gBAAiB,EAAE,UAAU,GAAG,KAAK;IACtF,IAAI,CAAC,aAAa;QAAE,OAAO,CAAC,oEAAoE;IAChG,+FAA+F;IAC/F,8EAA8E;IAC9E,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAChC,aAAa,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC,4CAA4C;QACxF,IAAI,UAAU;YAAE,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC;QACtD,OAAO;IACR,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;IAC5C,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC;IAC5B,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5B,0FAA0F;IAC1F,kDAAkD;IAClD,IAAI,mBAAmB,GAAG,aAAa,CAAC,qBAAqB,CAAC;IAC9D,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,8EAA8E;QAC9E,gBAAgB,GAAG,UAAU,CAAC,QAAQ,CAAC;YACtC,KAAK,EAAE,aAAa,CAAC,WAAW;YAChC,cAAc,EAAE,IAAI;SACpB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,gBAAgB,CAAC;IAC3E,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;YACb,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACJ,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC1B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,iEAAiE;gBACjE,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,uEAAuE;gBACvE,2CAA2C;gBAC3C,IAAA,uBAAI,EAAC,gEAAgE,EAAE,KAAK,CAAC,CAAC;gBAC9E,MAAM;YACP,CAAC;YACD,IAAI,MAAM,CAAC,IAAI;gBAAE,MAAM;YACvB,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;YACjC,MAAM,SAAS,GAAW,WAAW,CAAC,SAAS,CAAC;YAChD,aAAa,CAAC,WAAW,GAAG,SAAS,CAAC;YACtC,uFAAuF;YACvF,2FAA2F;YAC3F,MAAM,MAAM,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC;YAC7E,IAAI,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,MAAM,kBAAkB,GAAG,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,EAAE,CAAC;oBACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;oBACtC,mCAAmC;oBACnC,IAAI,WAAW,GAAG,IAAA,+BAAgB,EAAC,QAAQ,CAAC,CAAC;oBAC7C,IAAI,aAAa,GAAG,CAAC,CAAC;oBACtB,GAAG,CAAC;wBACH,gFAAgF;wBAChF,gIAAgI;wBAChI,iEAAiE;wBACjE,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;wBAC7D,IAAI,gBAAgB,EAAE,CAAC;4BACtB,gBAAgB,CAAC,UAAU,EAAE,CAAC;4BAC9B,IAAI,CAAC;gCACJ,kEAAkE;gCAClE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oCACnE,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;oCACzC,IAAI,CAAC,YAAY,CAAC,aAAa;wCAAE,SAAS;oCAC1C,IACC,aAAa,GAAG,CAAC,IAAI,sGAAsG;wCAC3H,CAAC,CAAC,YAAY,CAAC,kBAAkB,IAAI,CAAC,CAAC,YAAY,CAAC,YAAY,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;wCAEvF,SAAS;oCACV,IAAI,YAAY,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;wCACzC,SAAS;oCACV,CAAC;oCACD,IAAI,CAAC;wCACJ,IAAI,QAAQ,CAAC;wCACb,IAAI,YAAY,CAAC,oBAAoB,IAAI,YAAY,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;4CAChF,8FAA8F;4CAC9F,uFAAuF;4CACvF,0DAA0D;4CAC1D,QAAQ,GAAG,IAAI,CAAC;4CAChB,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;gDACjC,uGAAuG;gDACvG,IAAI,CAAC,mBAAmB;oDAAE,mBAAmB,GAAG,CAAC,YAAY,CAAC,CAAC;;oDAC1D,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;4CAC7C,CAAC;4CACD,YAAY,CAAC,aAAa,GAAG,MAAM,CAAC;wCACrC,CAAC;wCACD,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;oCACnE,CAAC;oCAAC,OAAO,KAAK,EAAE,CAAC;wCAChB,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;oCACb,CAAC;gCACF,CAAC;4BACF,CAAC;oCAAS,CAAC;gCACV,YAAY,CAAC,gBAAgB,CAAC,CAAC;4BAChC,CAAC;wBACF,CAAC;wBACD,IAAI,WAAW,IAAI,IAAI;4BAAE,MAAM;wBAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;wBACzE,IAAI,SAAS,KAAK,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC1C,aAAa,EAAE,CAAC,CAAC,8EAA8E;wBAChG,CAAC;wBACD,4FAA4F;wBAC5F,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;wBAC9E,WAAW,GAAG,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC5D,CAAC,QAAQ,IAAI,EAAE;gBAChB,CAAC;YACF,CAAC;iBAAM,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC1C,6FAA6F;gBAC7F,gGAAgG;gBAChG,kGAAkG;gBAClG,iGAAiG;gBACjG,MAAM,kBAAkB,GAAG,aAAa,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBAC9D,IAAI,kBAAkB,EAAE,CAAC;oBACxB,yFAAyF;oBACzF,IAAI,aAAa,GAAG,kBAAkB,CAAC,IAAI,CAAC;oBAC5C,KAAK,MAAM,gBAAgB,IAAI,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;wBAC5D,IAAI,aAAa,EAAE,KAAK,CAAC;4BAAE,MAAM;wBACjC,gBAAgB,CAAC,UAAU,EAAE,CAAC;wBAC9B,IAAI,CAAC;4BACJ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC,MAAM,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gCACnE,MAAM,YAAY,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;gCACzC,IAAI,CAAC,YAAY,CAAC,aAAa,IAAI,YAAY,CAAC,SAAS,IAAI,SAAS;oCAAE,SAAS;gCACjF,IAAI,CAAC;oCACJ,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;gCAC5D,CAAC;gCAAC,OAAO,KAAK,EAAE,CAAC;oCAChB,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;gCACb,CAAC;4BACF,CAAC;wBACF,CAAC;gCAAS,CAAC;4BACV,YAAY,CAAC,gBAAgB,CAAC,CAAC;wBAChC,CAAC;oBACF,CAAC;gBACF,CAAC;YACF,CAAC;YACD,IAAI,UAAU,IAAI,EAAE,SAAS,IAAI,iBAAiB,EAAE,CAAC;gBACpD,iFAAiF;gBACjF,oFAAoF;gBACpF,yFAAyF;gBACzF,4FAA4F;gBAC5F,aAAa,CAAC,qBAAqB,GAAG,mBAAmB,CAAC;gBAC1D,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,GAAG,EAAE,CACjB,yBAAyB,CAAC,aAAa,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CACrG,CAAC;gBACF,OAAO;YACR,CAAC;QACF,CAAC;QACD,aAAa,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAC3C,IAAI,mBAAmB,EAAE,CAAC;YACzB,iHAAiH;YACjH,KAAK,MAAM,YAAY,IAAI,mBAAmB,EAAE,CAAC;gBAChD,YAAY,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC,WAAW;gBAC9C,IAAI,CAAC,YAAY,CAAC,aAAa;oBAAE,SAAS;gBAC1C,IAAI,CAAC;oBACJ,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBACnF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAA,uBAAI,EAAC,KAAK,CAAC,CAAC;gBACb,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;YAAS,CAAC;QACV,0FAA0F;QAC1F,iFAAiF;QACjF,IAAI,UAAU,IAAI,CAAC,OAAO;YAAE,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC;IACnE,CAAC;AACF,CAAC;AACD;;;;GAIG;AACH,SAAgB,eAAe,CAAC,YAAY,EAAE,UAAU;IACvD,MAAM,KAAK,GAAG,UAAU,IAAI,YAAY,CAAC;IACzC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;IAC1B,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,CAAC;QACrC,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACtC,KAAK,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE,EAAE;YACtC,MAAM,aAAa,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,wEAAwE;YAChI,IAAI,CAAC,aAAa;gBAAE,OAAO;YAC3B,uFAAuF;YACvF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC/B,OAAO,yBAAyB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC7D,CAAC;YACD,0KAA0K;YAC1K,MAAM,YAAY,GAAG,GAAG,EAAE;gBACzB,wHAAwH;gBACxH,IAAI,CAAC,KAAK,CAAC,iBAAiB;oBAC3B,uCAAuC;oBACvC,KAAK,CAAC,iBAAiB,GAAG,IAAI,YAAY,CACzC,KAAK,CAAC,mBAAmB,CAAC,yBAAyB,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CACxE,CAAC;gBACH,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,sBAAsB;gBACxF,IAAI,CAAC;oBACJ,yBAAyB,CAAC,aAAa,CAAC,CAAC;gBAC1C,CAAC;wBAAS,CAAC;oBACV,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC,uBAAuB;oBAC/E,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,uBAAuB;gBAC7D,CAAC;YACF,CAAC,CAAC;YACF,iCAAiC;YACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,YAAY,CAAC;gBAAE,OAAO;YAChE,YAAY,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AACD,SAAS,eAAe,CAAC,UAAU;IAClC,UAAU,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC;IACtC,IAAI,WAAW,CAAC;IAChB,UAAU,CAAC,eAAe,GAAG,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACpD,WAAW,GAAG,OAAO,CAAC;IACvB,CAAC,CAAC,CAAC;IACH,UAAU,CAAC,eAAe,CAAC,OAAO,GAAG,WAAW,CAAC;AAClD,CAAC;AAED,SAAgB,mBAAmB,CAAC,UAAU;IAC7C,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;QACjC,eAAe,CACd;YACC,YAAY,EAAE,UAAU;YACxB,UAAU;SACV,EACD,IAAI,EACJ,IAAI,EACJ,CAAC,EACD,EAAE,KAAK,EAAE,eAAe,EAAE,CAC1B,CAAC;QACF,eAAe,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,UAAU,CAAC,eAAe,CAAC;AACnC,CAAC"}

package/dist/security/keys.d.ts

@@ -135,7 +135,7 @@ export declare function getEffectiveTlsCiphers(type: any, mtlsOptions?: any): st
  * Create a TLS selector that will choose the best TLS configuration/context for a given hostname
  * @param type
  * @param mtlsOptions
- * @param liveReload when true (default) the selector registers for private-key hot-reload rebuilds.
+ * @param liveReload when true (default) the selector subscribes to certificate-table updates.
  *   Pass false for transient, single-use selectors (e.g. getReplicationCert) so they don't accumulate.
  * @return {(function(*, *): (*|undefined))|*}
  */

package/dist/security/keys.js

@@ -80,7 +80,17 @@ const logger = (0, harper_logger_ts_1.forComponent)('tls').conditional;
 const { CONFIG_PARAMS } = hdbTerms;
 const { CERTIFICATE_VALUES } = certificatesTerms;
 const nodeName_ts_1 = require("../server/nodeName.js");
-const getPrivateKeys = () => privateKeys;
+const getPrivateKeys = () => {
+    for (const name of configuredPrivateKeyPaths.keys()) {
+        try {
+            getPrivateKeyByName(name);
+        }
+        catch (error) {
+            (0, harper_logger_ts_1.forComponent)('tls').conditional.trace?.('Could not refresh configured private key:', name, error);
+        }
+    }
+    return privateKeys;
+};
 exports.getPrivateKeys = getPrivateKeys;
 const node_fs_1 = require("node:fs");
 const manageThreads_js_1 = require("../server/threads/manageThreads.js");
@@ -191,46 +201,14 @@ async function getReplicationCertAuth() {
 }
 let configuredCertsLoaded;
 const privateKeys = new Map();
-// Debounce window (ms) for rebuilding TLS secure contexts. Shared by the hdb_certificate
-// subscription and the private-key hot-reload trigger so both coalesce on the same cadence.
+const configuredPrivateKeyPaths = new Map();
+const filePrivateKeys = new Map();
 const TLS_REBUILD_DEBOUNCE_MS = 1500;
 // Self-retry backoff cap: a permanently bad record must not cost every selector on every
 // thread a table scan + X509 parse per debounce interval, forever.
 const TLS_FAILURE_RETRY_MAX_DELAY_MS = 300_000;
 // While a failure signature is unchanged, repeat occurrences log a summary at most this often.
 const TLS_FAILURE_SUMMARY_INTERVAL_MS = 3_600_000;
-// Debounced rebuild triggers, one per live server TLS selector (registered in createTLSSelector's
-// initialize). When a private key is hot-reloaded on this thread, every live selector re-runs
-// updateTLS so a secure context built with a stale key — or built before this key arrived — is
-// regenerated. Transient selectors (getReplicationCert) opt out so they don't accumulate here.
-const liveTLSRebuilders = new Set();
-/**
- * Trigger a debounced rebuild of every live server's TLS secure contexts on this thread.
- *
- * Workers load their private key directly from disk into the privateKeys map (there is no table
- * propagation for keys), so a key rotation must rebuild the secure contexts locally. The cert side
- * already propagates via the hdb_certificate subscription; without this, a worker that rebuilt for
- * the new cert before reloading the matching key would serve the new cert paired with the old key
- * until the next cert-table change.
- */
-function rebuildLiveTLSContexts() {
-    for (const scheduleRebuild of liveTLSRebuilders)
-        scheduleRebuild();
-}
-/**
- * Handle a private-key (re)load: update the in-thread map and, on any content change, trigger a
- * local TLS context rebuild. The `previous !== private_key` guard skips identical-content reloads
- * (so neither chokidar nor the periodic poll thrashes) while still rebuilding when a key first
- * appears or is restored after boot — the recovery case we must not strand. During normal startup
- * this runs before any TLS selector is registered, so the rebuild is a harmless no-op on an empty
- * rebuilder set.
- */
-function handlePrivateKeyReload(private_key_name, private_key) {
-    const previous = privateKeys.get(private_key_name);
-    privateKeys.set(private_key_name, private_key);
-    if (previous !== private_key)
-        rebuildLiveTLSContexts();
-}
 /**
  * This is responsible for loading any certificates that are in the harperdb-config.yaml file and putting them into the hdbCertificate table.
  * @return {*}
@@ -256,12 +234,23 @@ function loadCertificates() {
                 // need to relativize the paths so they aren't exposed
                 let private_key_name = privateKeyPath && (0, node_path_1.relative)((0, node_path_1.join)(rootPath, 'keys'), privateKeyPath);
                 if (private_key_name) {
-                    loadAndWatch(privateKeyPath, (private_key) => handlePrivateKeyReload(private_key_name, private_key), 'private key');
+                    configuredPrivateKeyPaths.set(private_key_name, privateKeyPath);
+                    try {
+                        cacheFilePrivateKey(private_key_name, readPEM(privateKeyPath));
+                    }
+                    catch (error) {
+                        (0, harper_logger_ts_1.forComponent)('tls').conditional.error?.('Error loading private key:', privateKeyPath, error);
+                    }
                 }
                 for (let ca of [false, true]) {
                     let path = config[ca ? 'certificateAuthority' : 'certificate'];
                     if (path && worker_threads_1.isMainThread) {
-                        loadAndWatch(path, (certificate) => {
+                        let pendingPairTimer;
+                        const reportPendingPair = () => {
+                            (0, harper_logger_ts_1.forComponent)('tls').conditional.error?.(`TLS certificate at ${path} still has no matching private key at ${privateKeyPath}`);
+                            pendingPairTimer = setTimeout(reportPendingPair, TLS_FAILURE_SUMMARY_INTERVAL_MS).unref();
+                        };
+                        loadAndWatch(path, (certificate, fileStats) => {
                             if (CERTIFICATE_VALUES.cert === certificate) {
                                 // this is the compromised Harper certificate authority, and we do not even want to bother to
                                 // load it or tempted to use it anywhere
@@ -270,7 +259,7 @@ function loadCertificates() {
                             let hostnames = config.hostname ?? config.hostnames ?? config.host ?? config.hosts;
                             if (hostnames && !Array.isArray(hostnames))
                                 hostnames = [hostnames];
-                            const certificatePem = readPEM(path);
+                            const certificatePem = certificate;
                             const x509Cert = new node_crypto_1.X509Certificate(certificatePem);
                             let certCn;
                             try {
@@ -287,14 +276,25 @@ function loadCertificates() {
                             // Check if cert issued by compromised Harper certificate authority, if it is, do not load it
                             if (x509Cert.checkIssued(new node_crypto_1.X509Certificate(CERTIFICATE_VALUES.cert)))
                                 return;
-                            // If a record already exists for cert check to see who is newer, cert record or cert file.
-                            // If cert file is newer, add it to table
-                            // getSync (not get): this runs in a synchronous loadAndWatch callback. On RocksDB get()
-                            // returns a Promise on a block-cache miss, which is truthy but has no timestamp fields,
-                            // so the staleness guard below is bypassed and a stale on-disk cert can overwrite a
-                            // newer replicated record (TLS churn / downgrade) once hdb_certificate evicts.
+                            // The synchronous timestamp guard must not treat a cold RocksDB read Promise as a record.
                             const certRecord = certificateTable.primaryStore.getSync(certCn);
-                            let fileTimestamp = (0, node_fs_1.statSync)(path).mtimeMs;
+                            if (!ca && privateKeyPath) {
+                                const privateKey = readPEM(privateKeyPath);
+                                if (!x509Cert.checkPrivateKey((0, node_crypto_1.createPrivateKey)(privateKey))) {
+                                    if (!pendingPairTimer) {
+                                        (0, harper_logger_ts_1.forComponent)('tls').conditional.warn?.(`Waiting for matching TLS certificate and private key: ${path}, ${privateKeyPath}`);
+                                        if (!certRecord || certRecord.is_self_signed)
+                                            reportPendingPair();
+                                        else
+                                            pendingPairTimer = setTimeout(reportPendingPair, 30_000).unref();
+                                    }
+                                    return false;
+                                }
+                                cacheFilePrivateKey(private_key_name, privateKey);
+                                clearTimeout(pendingPairTimer);
+                                pendingPairTimer = undefined;
+                            }
+                            let fileTimestamp = fileStats.mtimeMs;
                             let recordTimestamp = !certRecord || certRecord.is_self_signed
                                 ? 1
                                 : (certRecord.file_timestamp ?? certRecord.__updatedtime__);
@@ -303,7 +303,7 @@ function loadCertificates() {
                                     logger.info?.(`Certificate ${certCn} at ${path} is older (${new Date(fileTimestamp)}) than the certificate in the database (${recordTimestamp > 1 ? new Date(recordTimestamp) : 'only self signed certificate available'})`);
                                 return;
                             }
-                            // Returned so loadAndWatch can roll back its mtime latch if the write fails —
+                            // Returned so loadAndWatch can roll back its fingerprint latch if the write fails —
                             // assigned as well to preserve loadCertificates()'s awaited-return contract.
                             return (promise = certificateTable.put({
                                 name: certCn,
@@ -323,7 +323,7 @@ function loadCertificates() {
                                     valid_to: x509Cert.validTo,
                                 },
                             }));
-                        }, ca ? 'certificate authority' : 'certificate');
+                        }, ca ? 'certificate authority' : 'certificate', !ca && privateKeyPath ? [privateKeyPath] : []);
                     }
                 }
             }
@@ -358,20 +358,12 @@ const certificateWatchTimers = new Map();
 // re-read deterministically (simulating a missed inotify event) without waiting for the interval.
 const certificateWatchPollers = new Map();
 /**
- * Load the certificate file and watch for changes and reload with any changes.
- *
- * Two detection mechanisms feed the same reload path (and share the `lastModified` fingerprint,
- * so they never double-reload for the same change):
- *   1. chokidar inotify watcher — the fast path, reacts immediately to fs events.
- *   2. A periodic re-read (main thread only) — a safety net for filesystems where inotify is
- *      unreliable (overlayfs/containers/network mounts), where a real renewal can otherwise be
- *      silently missed. Interval is tls.certificateWatchInterval (default 5m); 0 disables it.
- * @param path
- * @param loadCert
- * @param type
+ * Watch the certificate and related files through filtered parent directories and the main-thread safety poll.
+ * A false loader result remains unapplied so an unchanged fingerprint can be retried.
  */
-function loadAndWatch(path, loadCert, type) {
+function loadAndWatch(path, loadCert, type, relatedPaths = []) {
     let lastModified;
+    let lastAttempted;
     const loadFile = (path, stats) => {
         // The latch dedupes chokidar/poll but must mean "last successfully APPLIED", or a failed
         // apply is deduplicated forever (#2382). Rollbacks are equality-guarded so an old failure
@@ -379,20 +371,31 @@ function loadAndWatch(path, loadCert, type) {
         const previousModified = lastModified;
         let modified;
         try {
-            // chokidar's 'change' event omits stats unless alwaysStat is set (default off in v4), so
-            // stat the file here when it's missing — otherwise the inotify fast path would throw and
-            // silently never reload, leaving only the periodic poll to catch the change.
-            modified = (stats ?? (0, node_fs_1.statSync)(path)).mtimeMs;
-            if (modified && modified !== lastModified) {
-                if (lastModified && worker_threads_1.isMainThread)
+            const fileStats = stats ?? (0, node_fs_1.statSync)(path);
+            const fingerprints = [fileStats, ...relatedPaths.map((relatedPath) => (0, node_fs_1.statSync)(relatedPath))];
+            modified = JSON.stringify(fingerprints.map(({ mtimeMs, ino, size }) => [mtimeMs, ino, size]));
+            // Restoring an applied fingerprint after a failed attempt must clear the loader's pending state.
+            if (modified !== lastModified || modified !== lastAttempted) {
+                if (lastModified && modified !== lastAttempted && worker_threads_1.isMainThread)
                     logger.warn?.(`Reloading ${type}:`, path);
+                lastAttempted = modified;
                 lastModified = modified;
-                const applied = loadCert(readPEM(path));
-                if (typeof applied?.then === 'function') {
-                    applied.catch((error) => {
+                const rollback = () => {
+                    if (lastModified === modified)
+                        lastModified = previousModified === modified ? undefined : previousModified;
+                };
+                const applied = loadCert(readPEM(path), fileStats);
+                if (applied === false)
+                    rollback();
+                else if (typeof applied?.then === 'function') {
+                    applied
+                        .then((result) => {
+                        if (result === false)
+                            rollback();
+                    })
+                        .catch((error) => {
                         logger.error?.(`Error applying ${type}:`, path, error);
-                        if (lastModified === modified)
-                            lastModified = previousModified;
+                        rollback();
                     });
                 }
             }
@@ -400,55 +403,81 @@ function loadAndWatch(path, loadCert, type) {
         catch (error) {
             logger.error?.(`Error loading ${type}:`, path, error);
             if (modified !== undefined && lastModified === modified)
-                lastModified = previousModified;
+                lastModified = previousModified === modified ? undefined : previousModified;
         }
     };
     if (fs.existsSync(path))
         loadFile(path, (0, node_fs_1.statSync)(path));
     else
         logger.error?.(`${type} file not found:`, path);
-    const watchTarget = (0, watchPath_ts_1.resolveWatchTarget)(path);
-    let usingPolling = watchTarget.mustPoll;
-    let liveWatcher;
-    const openWatcher = () => {
-        const opened = (liveWatcher = (0, watcherFallback_ts_1.guardedWatch)(watchTarget.path, {
-            persistent: false,
-            ...(usingPolling ? watcherFallback_ts_1.POLLING_FALLBACK_OPTIONS : {}),
-        }));
-        opened
-            // The event carries the watched spelling, which is not the configured one once canonicalized;
-            // reload through the configured path so a retargeted link is followed.
-            .on('change', () => loadFile(path))
-            // chokidar emits 'error' unguarded for anything but ENOENT/ENOTDIR.
-            .on('error', (error) => {
-            if ((0, watcherFallback_ts_1.claimLostNativeWatchError)(error))
-                return;
-            if ((0, watcherFallback_ts_1.isWatcherExhaustionError)(error)) {
-                if (usingPolling || liveWatcher !== opened)
+    const watchedDirectories = new Map();
+    for (const filePath of [path, ...relatedPaths]) {
+        const target = (0, watchPath_ts_1.resolveWatchTarget)(filePath);
+        const directory = (0, watchPath_ts_1.resolveWatchTarget)((0, node_path_1.dirname)(target.path));
+        let watched = watchedDirectories.get(directory.path);
+        if (!watched)
+            watchedDirectories.set(directory.path, (watched = { mustPoll: target.mustPoll || directory.mustPoll, files: new Set() }));
+        watched.files.add((0, node_path_1.resolve)(target.path));
+    }
+    for (const [directory, watched] of watchedDirectories) {
+        let usingPolling = watched.mustPoll;
+        let pollingFiles = false;
+        let liveWatcher;
+        const openWatcher = () => {
+            const opened = (liveWatcher = (0, watcherFallback_ts_1.guardedWatch)(directory, {
+                persistent: false,
+                depth: 0,
+                ignoreInitial: true,
+                ignored: (filePath) => {
+                    const resolved = (0, node_path_1.resolve)(filePath);
+                    return resolved !== (0, node_path_1.resolve)(directory) && !watched.files.has(resolved);
+                },
+                ...(usingPolling ? watcherFallback_ts_1.POLLING_FALLBACK_OPTIONS : {}),
+            }));
+            const reload = () => loadFile(path);
+            const reopen = () => Promise.resolve()
+                .then(() => opened.close())
+                .catch(() => { })
+                .then(openWatcher)
+                .catch((error) => logger.error?.(`Could not reopen the ${type} watch on polling:`, directory, error));
+            opened
+                .on('add', reload)
+                .on('change', reload)
+                .on('error', (error) => {
+                if ((0, watcherFallback_ts_1.claimLostNativeWatchError)(error))
                     return;
-                (0, watcherFallback_ts_1.warnWatcherFallback)(path);
-                usingPolling = true;
-                Promise.resolve()
-                    .then(() => opened.close())
-                    .catch(() => { })
-                    .then(openWatcher)
-                    .catch((error) => logger.error?.(`Could not reopen the ${type} watch on polling:`, path, error));
-                return;
-            }
-            logger.error?.(`Error watching ${type}:`, path, error);
-        });
-    };
-    openWatcher();
-    // Periodic re-read safety net. For certificates, this runs on the main thread only — workers
-    // receive cert updates via the hdb_certificate table subscription, so polling the cert file on
-    // every worker would be wasteful. Private keys are different: each worker loads its own key
-    // directly from disk into its privateKeys map (no table propagation), so a renewal missed by
-    // inotify on a worker would strand the stale key — therefore the key poll must run on all
-    // threads. mtime is checked first against the last-loaded fingerprint, so an unchanged file does
-    // no PEM read and no reload (and shares the fingerprint with the chokidar watcher, so the two
-    // detection paths never double-reload the same change).
-    const pollsOnThisThread = worker_threads_1.isMainThread || type === 'private key';
-    if (pollsOnThisThread) {
+                if (pollingFiles || liveWatcher !== opened)
+                    return;
+                const errorCode = error.code;
+                if (errorCode === 'EACCES' || errorCode === 'EPERM') {
+                    (0, harper_logger_ts_1.forComponent)('tls').conditional.warn?.(`Cannot watch TLS directory ${directory}; polling its configured files instead`, error);
+                    pollingFiles = true;
+                    Promise.resolve()
+                        .then(() => opened.close())
+                        .catch(() => { });
+                    // watchFile stays armed across ENOENT without needing to list the unreadable parent.
+                    for (const file of watched.files)
+                        (0, node_fs_1.watchFile)(file, { persistent: false, interval: watcherFallback_ts_1.POLLING_FALLBACK_OPTIONS.interval }, (stats) => {
+                            if (stats.nlink)
+                                reload();
+                        });
+                    reload();
+                    return;
+                }
+                if ((0, watcherFallback_ts_1.isWatcherExhaustionError)(error)) {
+                    if (usingPolling || liveWatcher !== opened)
+                        return;
+                    (0, watcherFallback_ts_1.warnWatcherFallback)(directory);
+                    usingPolling = true;
+                    reopen();
+                    return;
+                }
+                logger.error?.(`Error watching ${type}:`, path, error);
+            });
+        };
+        openWatcher();
+    }
+    if (worker_threads_1.isMainThread) {
         const poll = () => {
             let stats;
             try {
@@ -628,7 +657,15 @@ async function getCertAuthority() {
     for (let cert of allCerts) {
         if (!cert.is_authority)
             continue;
-        const matchingPrivateKey = getPrivateKeyByName(cert.private_key_name);
+        let matchingPrivateKey;
+        try {
+            matchingPrivateKey = getPrivateKeyByName(cert.private_key_name);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            continue;
+        }
         if (cert.private_key_name && matchingPrivateKey) {
             const keyCheck = new node_crypto_1.X509Certificate(cert.certificate).checkPrivateKey((0, node_crypto_1.createPrivateKey)(matchingPrivateKey));
             if (keyCheck) {
@@ -999,7 +1036,7 @@ function getEffectiveTlsCiphers(type, mtlsOptions) {
  * Create a TLS selector that will choose the best TLS configuration/context for a given hostname
  * @param type
  * @param mtlsOptions
- * @param liveReload when true (default) the selector registers for private-key hot-reload rebuilds.
+ * @param liveReload when true (default) the selector subscribes to certificate-table updates.
  *   Pass false for transient, single-use selectors (e.g. getReplicationCert) so they don't accumulate.
  * @return {(function(*, *): (*|undefined))|*}
  */
@@ -1410,7 +1447,7 @@ function createTLSSelector(type, mtlsOptions, liveReload = true) {
                         // use the same verifies-client-certs flag the listener was created with (http servers
                         // derive it from more than the selector's mtlsOptions) so this compares like with like
                         const effectiveCiphers = getEffectiveTlsCiphers(type, server.verifiesClientCerts ?? Boolean(mtlsOptions)) ?? null;
-                        // latch per distinct value: rebuilds recur (cert-table changes, key reloads) and the
+                        // latch per distinct value: rebuilds recur (cert-table changes, failure retries) and the
                         // pending change shouldn't re-warn on every cycle until the restart happens
                         if (effectiveCiphers !== server.appliedCiphers && server.lastWarnedCiphers !== effectiveCiphers) {
                             server.lastWarnedCiphers = effectiveCiphers;
@@ -1439,11 +1476,6 @@ function createTLSSelector(type, mtlsOptions, liveReload = true) {
                     updateTLS();
                 }, TLS_REBUILD_DEBOUNCE_MS).unref();
             };
-            // Register the private-key hot-reload rebuild path unconditionally, before the first
-            // updateTLS() pass: that pass may find the system database not yet loaded and retry
-            // (see above) rather than subscribe, so this must not depend on it succeeding.
-            if (liveReload)
-                liveTLSRebuilders.add(scheduleRebuild);
             updateTLS();
         }));
     };
@@ -1485,8 +1517,26 @@ function createTLSSelector(type, mtlsOptions, liveReload = true) {
         cb(null, context);
     }
 }
+function cacheFilePrivateKey(name, key) {
+    if (!privateKeys.has(name) || privateKeys.get(name) === filePrivateKeys.get(name))
+        privateKeys.set(name, key);
+    filePrivateKeys.set(name, key);
+    return privateKeys.get(name);
+}
 function getPrivateKeyByName(private_key_name) {
     const private_key = privateKeys.get(private_key_name);
+    const configuredPath = configuredPrivateKeyPaths.get(private_key_name);
+    if (configuredPath && (!private_key || private_key === filePrivateKeys.get(private_key_name))) {
+        try {
+            return cacheFilePrivateKey(private_key_name, readPEM(configuredPath));
+        }
+        catch (error) {
+            if (!private_key)
+                throw error;
+            (0, harper_logger_ts_1.forComponent)('tls').conditional.trace?.('Could not refresh configured private key:', private_key_name, error);
+            return private_key;
+        }
+    }
     if (!private_key && private_key_name) {
         return fs.readFileSync(path.join(envManager.get(CONFIG_PARAMS.ROOTPATH), hdbTerms.LICENSE_KEY_DIR_NAME, private_key_name), 'utf8');
     }