@scriptdb/server 1.1.0 → 1.1.1

package/dist/index.mjs

@@ -0,0 +1,3121 @@
+// src/protocal.ts
+import * as net from "net";
+import * as tls from "tls";
+import * as fs2 from "fs";
+import * as jwt from "jsonwebtoken";
+import * as crypto from "crypto";
+import Bottleneck from "bottleneck";
+import * as path from "path";
+import * as os2 from "os";
+import { Worker } from "worker_threads";
+import { LRUCache } from "lru-cache";
+
+// src/utils/basePath.ts
+import * as fs from "fs";
+function getBasePath() {
+  return fs.realpathSync(".");
+}
+var basePath_default = getBasePath;
+
+// src/utils/homeDir.ts
+import * as os from "os";
+function getHomeDir() {
+  return os.homedir();
+}
+
+// src/protocal.ts
+var fileConfig = {};
+try {
+  const configPath = path.join(getHomeDir(), ".scriptdb", "config.json");
+  if (fs2.existsSync(configPath)) {
+    const configContent = fs2.readFileSync(configPath, "utf8");
+    fileConfig = JSON.parse(configContent);
+  } else {
+    console.log("No config file found at:", configPath, "- using defaults");
+  }
+} catch (e) {
+  console.error("Failed to load config:", e);
+  fileConfig = {};
+}
+var Protocal = class {
+  // Helper to get the effective secret for JWT operations
+  getEffectiveSecret() {
+    return this.serverSecret || "default-dev-secret-change-in-production";
+  }
+  constructor(options = {}) {
+    this.host = options.host || fileConfig.host || "localhost";
+    this.port = Number.isFinite(Number(options.port)) ? Number(options.port) : fileConfig.port || 1234;
+    this.secure = options.secure !== void 0 ? options.secure : fileConfig.secure !== void 0 ? fileConfig.secure : true;
+    if (Array.isArray(options.users)) {
+      this.users = options.users;
+      console.log("Using users from options:", this.users.length, "users");
+    } else if (options.users && typeof options.users === "object") {
+      this.users = [options.users];
+      console.log("Using single user from options");
+    } else if (Array.isArray(fileConfig.users)) {
+      this.users = fileConfig.users;
+      console.log("Using users from fileConfig:", this.users.length, "users");
+    } else {
+      this.users = [];
+      console.log("No users configured!");
+    }
+    if (this.users.length > 0) {
+      console.log("First user config:", {
+        username: this.users[0].username,
+        hasPassword: !!this.users[0].password,
+        hash: this.users[0].hash,
+        algorithm: this.users[0].algorithm
+      });
+    }
+    if (options.vm) {
+      this.vm = options.vm;
+    } else {
+      try {
+        const basePath = basePath_default ? basePath_default() : process.cwd();
+        const folder = options.folder || fileConfig.folder || "databases";
+      } catch (err) {
+        console.error(
+          "Failed to create internal VM:",
+          err && err.message ? err.message : err
+        );
+        this.vm = null;
+      }
+    }
+    this.serverSecret = options.serverSecret || process.env.SCRIPTDB_JWT_SECRET || fileConfig.serverSecret || null;
+    if (!this.serverSecret) {
+      console.warn(
+        "Protocal: No serverSecret configured. In production a serverSecret is required."
+      );
+    }
+    const cpuCount = os2.cpus && os2.cpus().length ? os2.cpus().length : 1;
+    const defaultValidatorPool = Math.max(
+      0,
+      Math.min(2, Math.floor(cpuCount / 4))
+    );
+    this.validatorPoolSize = typeof options.validatorPoolSize === "number" ? options.validatorPoolSize : defaultValidatorPool;
+    this.ipLimiterGroup = new Bottleneck.Group({
+      maxConcurrent: 1,
+      minTime: 50
+    });
+    this.loginAttemptCache = /* @__PURE__ */ new Map();
+    this.ipAttemptCache = /* @__PURE__ */ new Map();
+    this.IP_FAIL_WINDOW_MS = options.ipFailWindowMs || fileConfig.ipFailWindowMs || 15 * 60 * 1e3;
+    this.MAX_LOGIN_ATTEMPTS = options.maxLoginAttempts || fileConfig.maxLoginAttempts || 5;
+    this.LOCK_DURATION_MS = options.lockDurationMs || fileConfig.lockDurationMs || 15 * 60 * 1e3;
+    this.ENABLE_IP_LOCKOUT = options.enableIpLockout !== void 0 ? options.enableIpLockout : fileConfig.enableIpLockout !== void 0 ? fileConfig.enableIpLockout : true;
+    this.MAX_MESSAGE_BYTES = options.maxMessageBytes || 64 * 1024;
+    this.MAX_MESSAGES_PER_CONNECTION = options.maxMessagesPerConnection || 1e3;
+    this.CONNECTION_TIMEOUT_MS = typeof options.connectionTimeoutMs === "number" ? options.connectionTimeoutMs : typeof fileConfig.connectionTimeoutMs === "number" ? fileConfig.connectionTimeoutMs : 0;
+    this.tlsOptions = options.tlsOptions || fileConfig.tlsOptions || null;
+    this.requireTlsInProduction = options.requireTlsInProduction !== void 0 ? options.requireTlsInProduction : true;
+    this.payloadSchema = options.payloadSchema || fileConfig.payloadSchema || {
+      command: "string",
+      args: "object",
+      code: "string",
+      databaseName: "string"
+    };
+    this.allowPerUserSigning = options.allowPerUserSigning || false;
+    this._payloadMaxDepth = options.payloadMaxDepth || 4;
+    this._payloadMaxNodes = options.payloadMaxNodes || 1e3;
+    this._payloadMaxBytes = options.payloadMaxBytes || 16 * 1024;
+    this._sanitizeMaxDepth = options.sanitizeMaxDepth || 6;
+    this._sanitizeMaxNodes = options.sanitizeMaxNodes || 2e3;
+    this._sanitizeMaxString = options.sanitizeMaxString || 1e3;
+    this._attemptCacheTTL = options.attemptCacheTTL || 60 * 60 * 1e3;
+    this._attemptCacheCleanupInterval = setInterval(() => {
+      const now = Date.now();
+      this.loginAttemptCache.forEach((v, k) => {
+        if (v.expiresAt && v.expiresAt <= now) this.loginAttemptCache.delete(k);
+      });
+      this.ipAttemptCache.forEach((v, k) => {
+        if (v.expiresAt && v.expiresAt <= now) this.ipAttemptCache.delete(k);
+      });
+    }, Math.max(30 * 1e3, this._attemptCacheTTL / 4));
+    this.audit = function(event, meta) {
+      try {
+        const safeMeta = Object.assign({}, meta || {});
+        if (safeMeta.token) safeMeta.token = "[REDACTED]";
+        if (safeMeta.password) safeMeta.password = "[REDACTED]";
+        if (safeMeta.passwordHash) safeMeta.passwordHash = "[REDACTED]";
+        if (safeMeta.signingSecret) safeMeta.signingSecret = "[REDACTED]";
+        console.warn(
+          JSON.stringify({
+            ts: (/* @__PURE__ */ new Date()).toISOString(),
+            event,
+            meta: safeMeta
+          })
+        );
+      } catch (e) {
+      }
+    };
+    this._bcryptWorkers = [];
+    this._bcryptNext = 0;
+    this._bcryptPending = /* @__PURE__ */ new Map();
+    const defaultBcrypt = Math.max(1, Math.min(4, Math.floor(cpuCount / 2)));
+    this.bcryptPoolSize = typeof options.bcryptPoolSize === "number" ? options.bcryptPoolSize : defaultBcrypt;
+    this.bcryptMaxPoolSize = options.bcryptMaxPoolSize || Math.max(4, this.bcryptPoolSize * 4);
+    for (let i = 0; i < this.bcryptPoolSize; i++) {
+      const w = new Worker(path.join(__dirname, "workers", "bcrypt-worker.js"));
+      w.on("message", (m) => {
+        const p = this._bcryptPending.get(m.id);
+        if (p) {
+          const start = p.start || 0;
+          const lat = start ? Date.now() - start : 0;
+          if (lat > 0)
+            this._recordLatency(
+              this._bcryptLatencies,
+              lat,
+              this._bcryptLatencyWindow
+            );
+          clearTimeout(p.timer);
+          this._bcryptPending.delete(m.id);
+          if (m.error) {
+            this._bcryptFailures.push(Date.now());
+            p.reject(new Error(m.error));
+          } else {
+            p.resolve(m.ok);
+          }
+        }
+        try {
+          this._autoscalePools();
+        } catch (e) {
+        }
+      });
+      w.on("error", (e) => {
+        console.error("bcrypt worker error", e && e.message);
+        this._bcryptFailures.push(Date.now());
+        try {
+          this._autoscalePools();
+        } catch (e2) {
+        }
+      });
+      this._bcryptWorkers.push(w);
+    }
+    this._bcryptLatencies = [];
+    this._bcryptLatencyWindow = options.bcryptLatencyWindow || 100;
+    this._bcryptFailures = [];
+    this._bcryptFailureWindowMs = options.bcryptFailureWindowMs || 60 * 1e3;
+    this._bcryptFailureThreshold = options.bcryptFailureThreshold || 5;
+    this._bcryptCircuitCooldownMs = options.bcryptCircuitCooldownMs || 2 * 60 * 1e3;
+    this._bcryptTrippedUntil = 0;
+    this._tokenVerifyCache = new LRUCache({ max: 1e3, ttl: 1e3 * 60 * 5 });
+    this.storage = options.storage || null;
+    this.alertPendingThreshold = typeof options.alertPendingThreshold === "number" ? options.alertPendingThreshold : 50;
+    this._vmWorkers = [];
+    this._vmNext = 0;
+    this._vmPending = /* @__PURE__ */ new Map();
+    this._vmLatencies = [];
+    this._vmLatencyWindow = options.vmLatencyWindow || 100;
+    this._vmFailures = [];
+    this._vmFailureWindowMs = options.vmFailureWindowMs || 60 * 1e3;
+    this._vmFailureThreshold = options.vmFailureThreshold || 3;
+    this._vmCircuitCooldownMs = options.vmCircuitCooldownMs || 2 * 60 * 1e3;
+    this._vmTrippedUntil = 0;
+    if (options.vmWorkerPoolSize && options.vmWorkerPoolSize > 0) {
+      const defaultVmPool = Math.max(
+        0,
+        Math.min(2, Math.max(1, Math.floor(cpuCount / 2)) - 1)
+      );
+      const vmPool = typeof options.vmWorkerPoolSize === "number" ? options.vmWorkerPoolSize : defaultVmPool;
+      for (let i = 0; i < vmPool; i++) {
+        const w = new Worker(path.join(__dirname, "vm-worker.js"));
+        w.postMessage({
+          id: `init-${i}`,
+          action: "init",
+          options: {
+            baseDir: options.folder ? path.join(basePath_default ? basePath_default() : process.cwd(), options.folder) : void 0
+          }
+        });
+        w.on("message", (m) => {
+          const p = this._vmPending.get(m.id);
+          if (p) {
+            const start = p.start || 0;
+            const lat = start ? Date.now() - start : 0;
+            if (lat > 0)
+              this._recordLatency(
+                this._vmLatencies,
+                lat,
+                this._vmLatencyWindow
+              );
+            clearTimeout(p.timer);
+            this._vmPending.delete(m.id);
+            if (m.error) {
+              this._vmFailures.push(Date.now());
+              p.reject(new Error(m.error));
+            } else {
+              p.resolve(m.res);
+            }
+          }
+          try {
+            this._autoscalePools();
+          } catch (e) {
+          }
+        });
+        w.on("error", (e) => {
+          console.error("vm worker error", e && e.message);
+          this._vmFailures.push(Date.now());
+          try {
+            this._autoscalePools();
+          } catch (e2) {
+          }
+        });
+        this._vmWorkers.push(w);
+      }
+    }
+    this._validatorWorkers = [];
+    this._validatorNext = 0;
+    this._validatorPending = /* @__PURE__ */ new Map();
+    const validatorPoolSize = options.validatorPoolSize || 0;
+    this.validatorPoolSize = validatorPoolSize;
+    this._validatorLatencies = [];
+    this._validatorLatencyWindow = options.validatorLatencyWindow || 100;
+    this._validatorFailures = [];
+    this._validatorFailureWindowMs = options.validatorFailureWindowMs || 60 * 1e3;
+    this._validatorFailureThreshold = options.validatorFailureThreshold || 5;
+    this._validatorCircuitCooldownMs = options.validatorCircuitCooldownMs || 2 * 60 * 1e3;
+    this._validatorTrippedUntil = 0;
+    if (validatorPoolSize > 0) {
+      for (let i = 0; i < validatorPoolSize; i++) {
+        const vw = new Worker(path.join(__dirname, "validator-worker.js"));
+        vw.on("message", (m) => {
+          const p = this._validatorPending.get(m.id);
+          if (p) {
+            const start = p.start || 0;
+            const lat = start ? Date.now() - start : 0;
+            if (lat > 0)
+              this._recordLatency(
+                this._validatorLatencies,
+                lat,
+                this._validatorLatencyWindow
+              );
+            clearTimeout(p.timer);
+            this._validatorPending.delete(m.id);
+            if (m.error) {
+              this._validatorFailures.push(Date.now());
+              p.reject(new Error(m.error));
+            } else {
+              p.resolve(m.res);
+            }
+          }
+        });
+        vw.on("error", (e) => {
+          console.error("validator worker error", e && e.message);
+          this._validatorFailures.push(Date.now());
+        });
+        this._validatorWorkers.push(vw);
+      }
+    }
+    this.metrics = {
+      bcryptPending: () => this._bcryptPending.size,
+      vmPending: () => this._vmPending.size,
+      vmWorkers: () => this._vmWorkers.length,
+      activeConnections: 0,
+      validatorPending: () => this._validatorPending.size,
+      validatorWorkers: () => this._validatorWorkers.length,
+      bcryptAvgLatency: () => {
+        const a = this._bcryptLatencies;
+        return a.length ? a.reduce((s, v) => s + v, 0) / a.length : 0;
+      },
+      vmAvgLatency: () => {
+        const a = this._vmLatencies;
+        return a.length ? a.reduce((s, v) => s + v, 0) / a.length : 0;
+      },
+      validatorAvgLatency: () => {
+        const a = this._validatorLatencies;
+        return a.length ? a.reduce((s, v) => s + v, 0) / a.length : 0;
+      },
+      compactActive: () => this.storage && this.storage._compactActive ? this.storage._compactActive : 0,
+      compactTripped: () => this.storage && this.storage._compactTrippedUntil && Date.now() < this.storage._compactTrippedUntil ? true : false
+    };
+    this.maxConnections = options.maxConnections || 1e3;
+    this.backlog = options.backlog || 128;
+    this.bcryptWorkerTimeoutMs = options.bcryptWorkerTimeoutMs || 5e3;
+    this.vmWorkerTimeoutMs = options.vmWorkerTimeoutMs || (options.runTimeoutMs ? options.runTimeoutMs + 500 : 5e3);
+    this._autoscaleIntervalMs = options.autoscaleIntervalMs || 2e3;
+    this._autoscaleTimer = null;
+  }
+  // simple helper to record latency into a fixed window
+  _recordLatency(arr, val, cap) {
+    try {
+      arr.push(val);
+      if (arr.length > cap) arr.shift();
+    } catch (e) {
+    }
+  }
+  // check and perform simple autoscaling for bcrypt pool
+  _autoscalePools() {
+    try {
+      const pending = this._bcryptPending.size;
+      const workers = this._bcryptWorkers.length;
+      if (pending > workers * 2 && workers < this.bcryptMaxPoolSize) {
+        const w = new Worker(path.join(__dirname, "workers", "bcrypt-worker.js"));
+        w.on("message", (m) => {
+          const p = this._bcryptPending.get(m.id);
+          if (p) {
+            clearTimeout(p.timer);
+            this._bcryptPending.delete(m.id);
+            if (m.error) p.reject(new Error(m.error));
+            else p.resolve(m.ok);
+          }
+        });
+        w.on("error", (e) => {
+          console.error("bcrypt worker error (autoscale)", e && e.message);
+        });
+        this._bcryptWorkers.push(w);
+      }
+      if (pending > Math.max(this.alertPendingThreshold, workers * 5)) {
+        try {
+          this.audit("queue.high", { type: "bcrypt", pending, workers });
+        } catch (e) {
+        }
+      }
+      const vmPending = this._vmPending.size;
+      const vmWorkers = this._vmWorkers.length;
+      const vmMax = Math.max(
+        this._vmWorkers.length,
+        this.vmMaxPoolSize || this._vmWorkers.length + 4
+      );
+      if (vmPending > vmWorkers * 2 && vmWorkers < vmMax) {
+        const w = new Worker(path.join(__dirname, "vm-worker.js"));
+        w.postMessage({
+          id: `init-auto-${Date.now()}`,
+          action: "init",
+          options: { baseDir: void 0 }
+        });
+        w.on("message", (m) => {
+          const p = this._vmPending.get(m.id);
+          if (p) {
+            clearTimeout(p.timer);
+            this._vmPending.delete(m.id);
+            if (m.error) p.reject(new Error(m.error));
+            else p.resolve(m.res);
+          }
+        });
+        w.on("error", (e) => {
+          console.error("vm worker error (autoscale)", e && e.message);
+        });
+        this._vmWorkers.push(w);
+      }
+      if (vmPending > Math.max(this.alertPendingThreshold, vmWorkers * 5)) {
+        try {
+          this.audit("queue.high", {
+            type: "vm",
+            pending: vmPending,
+            workers: vmWorkers
+          });
+        } catch (e) {
+        }
+      }
+    } catch (e) {
+    }
+  }
+  start() {
+    const createListener = async (socket) => {
+      if (this.metrics.activeConnections >= this.maxConnections) {
+        try {
+          socket.end();
+        } catch (e) {
+        }
+        return;
+      }
+      this.metrics.activeConnections++;
+      console.log("Client connected");
+      socket.on("error", (err) => {
+        console.error("Socket error:", err && err.message ? err.message : err);
+      });
+      socket.on("close", (hadError) => {
+        console.log("Socket closed", hadError ? "(due to error)" : "");
+        this.metrics.activeConnections = Math.max(
+          0,
+          this.metrics.activeConnections - 1
+        );
+      });
+      let recvBuf = "";
+      let messagesReceived = 0;
+      socket.setTimeout(this.CONNECTION_TIMEOUT_MS);
+      socket.on("timeout", () => {
+        try {
+          sendWithBackpressure({ command: "error", message: "TIMEOUT" });
+        } catch (e) {
+        }
+        socket.end();
+      });
+      const sendWithBackpressure = (obj) => {
+        try {
+          const s = JSON.stringify(obj) + "\n";
+          console.log("sendWithBackpressure: sending message to socket:", socket.remoteAddress, socket.remotePort, ":", s.trim());
+          const ok = socket.write(s);
+          console.log("sendWithBackpressure: write returned:", ok);
+          if (!ok) {
+            socket.pause();
+            socket.once("drain", () => socket.resume());
+          }
+        } catch (e) {
+          console.error("sendWithBackpressure error:", e);
+        }
+      };
+      const sendCritical = (obj) => {
+        return new Promise((resolve2, reject) => {
+          try {
+            const s = JSON.stringify(obj) + "\n";
+            console.log("sendCritical writing:", s.trim());
+            socket.write(s, (err) => {
+              if (err) {
+                console.error("sendCritical write error:", err);
+                return reject(err);
+              }
+              console.log("sendCritical write callback called, waiting 50ms...");
+              setTimeout(() => {
+                console.log("sendCritical resolved after 50ms");
+                resolve2();
+              }, 50);
+            });
+          } catch (e) {
+            console.error("sendCritical exception:", e);
+            reject(e);
+          }
+        });
+      };
+      socket.on("data", async (data) => {
+        if (data.length > this.MAX_MESSAGE_BYTES) {
+          try {
+            sendWithBackpressure({
+              command: "error",
+              message: "MSG_TOO_LARGE"
+            });
+          } catch (e) {
+          }
+          socket.end();
+          return;
+        }
+        recvBuf += data.toString();
+        let idx;
+        while ((idx = recvBuf.indexOf("\n")) !== -1) {
+          if (++messagesReceived > this.MAX_MESSAGES_PER_CONNECTION) {
+            try {
+              sendWithBackpressure({
+                command: "error",
+                message: "TOO_MANY_MESSAGES"
+              });
+            } catch (e) {
+            }
+            socket.end();
+            return;
+          }
+          const line = recvBuf.slice(0, idx).trim();
+          recvBuf = recvBuf.slice(idx + 1);
+          if (!line) continue;
+          let object;
+          try {
+            object = JSON.parse(line);
+          } catch (err) {
+            console.error(
+              "Invalid JSON from client:",
+              err && err.message ? err.message : err
+            );
+            try {
+              sendWithBackpressure({
+                command: "error",
+                message: "INVALID_JSON"
+              });
+            } catch (e) {
+            }
+            continue;
+          }
+          const commandOrAction = object.command || object.action;
+          switch (commandOrAction) {
+            case "login":
+              const username = object.data?.username || "";
+              const password = object.data?.password || "";
+              console.log("Login attempt:", { username, hasPassword: !!password, objectId: object.id, secure: this.secure });
+              if (!this.secure) {
+                console.log("Secure mode disabled - allowing anonymous access");
+                const secretToUse = this.getEffectiveSecret();
+                const token2 = jwt.sign(
+                  { username: username || "", role: "anonymous" },
+                  secretToUse,
+                  { expiresIn: "24h" }
+                );
+                try {
+                  sendWithBackpressure({
+                    id: object.id,
+                    action: "login",
+                    command: "login",
+                    message: "AUTH OK",
+                    data: { token: token2 }
+                  });
+                  console.log("Anonymous AUTH OK sent (secure=false)");
+                } catch (e) {
+                  console.error("Error sending AUTH OK:", e);
+                }
+                break;
+              }
+              if (!username || !password) {
+                console.log("Secure mode enabled - credentials required but not provided");
+                try {
+                  await sendCritical({
+                    id: object.id,
+                    action: "login",
+                    command: "login",
+                    message: "AUTH FAIL",
+                    data: "Username and password are required in secure mode"
+                  });
+                  console.log("AUTH FAIL message sent and flushed, now closing socket...");
+                  socket.end();
+                  console.log("Socket closed after AUTH FAIL");
+                } catch (e) {
+                  console.error("Error sending AUTH FAIL:", e);
+                  socket.end();
+                }
+                return;
+              }
+              const remoteIP = socket.remoteAddress || socket.remoteAddress || "unknown";
+              try {
+                const ipLimiter = this.ipLimiterGroup.key(remoteIP);
+                await ipLimiter.schedule(() => Promise.resolve());
+              } catch (e) {
+                this.audit("limiter.schedule.error", {
+                  ip: remoteIP,
+                  err: e && e.message || String(e)
+                });
+              }
+              if (this.ENABLE_IP_LOCKOUT) {
+                const nowTs = Date.now();
+                const ipRec = this.ipAttemptCache.get(remoteIP) || {
+                  attempts: 0,
+                  lockedUntil: 0,
+                  expiresAt: nowTs + this._attemptCacheTTL
+                };
+                ipRec.attempts = (ipRec.attempts || 0) + 1;
+                ipRec.expiresAt = nowTs + this._attemptCacheTTL;
+                if (ipRec.attempts >= this.MAX_LOGIN_ATTEMPTS) {
+                  ipRec.lockedUntil = nowTs + this.LOCK_DURATION_MS;
+                  this.audit("ip.lockout", {
+                    ip: remoteIP,
+                    attempts: ipRec.attempts
+                  });
+                }
+                this.ipAttemptCache.set(remoteIP, ipRec);
+                if (ipRec.lockedUntil && ipRec.lockedUntil > nowTs) {
+                  this.audit("ip.locked", { ip: remoteIP });
+                  try {
+                    sendWithBackpressure({
+                      command: "login",
+                      message: "LOCKED_IP",
+                      data: null
+                    });
+                  } catch (e) {
+                  }
+                  break;
+                }
+              }
+              const now = Date.now();
+              const record = this.loginAttemptCache.get(username) || {
+                attempts: 0,
+                lockedUntil: 0,
+                expiresAt: now + this._attemptCacheTTL
+              };
+              if (record.lockedUntil && record.lockedUntil > now) {
+                try {
+                  sendWithBackpressure({
+                    command: "login",
+                    message: "LOCKED",
+                    data: null
+                  });
+                } catch (e) {
+                }
+                break;
+              }
+              const user = this.users.find((u) => u.username === username);
+              if (!user) {
+                record.attempts = (record.attempts || 0) + 1;
+                record.expiresAt = Date.now() + this._attemptCacheTTL;
+                if (record.attempts >= this.MAX_LOGIN_ATTEMPTS) {
+                  record.lockedUntil = now + this.LOCK_DURATION_MS;
+                  this.audit("login.lockout", { user: username, ip: remoteIP });
+                }
+                this.loginAttemptCache.set(username, record);
+                try {
+                  sendWithBackpressure({
+                    id: object.id,
+                    action: "login",
+                    command: "login",
+                    message: "AUTH FAIL",
+                    data: null
+                  });
+                } catch (e) {
+                }
+                break;
+              }
+              console.log("User found:", {
+                username: user.username,
+                hasPassword: !!user.password,
+                passwordValue: user.password,
+                hash: user.hash,
+                algorithm: user.algorithm
+              });
+              console.log("Password received:", password);
+              let matches = false;
+              if (user.hash === false && user.password) {
+                console.log("Using plain password authentication (hash: false)");
+                matches = user.password === password;
+              } else if (user.hash === true && user.password) {
+                console.log("Using password hashing with algorithm:", user.algorithm || "bcrypt");
+                const algorithm = user.algorithm || "bcrypt";
+                if (algorithm === "bcrypt") {
+                  const doBcryptCompare = (password2, hash) => new Promise((resolve2, reject) => {
+                    if (!this._bcryptWorkers || this._bcryptWorkers.length === 0)
+                      return resolve2(false);
+                    const id = Math.random().toString(36).slice(2);
+                    const wIndex = this._bcryptNext++ % this._bcryptWorkers.length;
+                    const start = Date.now();
+                    const timer = setTimeout(() => {
+                      const p = this._bcryptPending.get(id);
+                      if (p) {
+                        this._bcryptPending.delete(id);
+                        p.reject(new Error("bcrypt worker timeout"));
+                      }
+                      try {
+                        this._bcryptWorkers[wIndex].terminate();
+                      } catch (e) {
+                      }
+                      const nw = new Worker(
+                        path.join(__dirname, "workers", "bcrypt-worker.js")
+                      );
+                      this._bcryptWorkers[wIndex] = nw;
+                    }, this.bcryptWorkerTimeoutMs);
+                    this._bcryptPending.set(id, {
+                      resolve: resolve2,
+                      reject,
+                      timer,
+                      start
+                    });
+                    try {
+                      this._bcryptWorkers[wIndex].postMessage({
+                        id,
+                        password: password2,
+                        hash
+                      });
+                    } catch (e) {
+                      clearTimeout(timer);
+                      this._bcryptPending.delete(id);
+                      return resolve2(false);
+                    }
+                  });
+                  try {
+                    matches = user.password === password;
+                  } catch (e) {
+                    matches = false;
+                  }
+                } else if (algorithm === "sha256" || algorithm === "sha512") {
+                  const hashedPassword = crypto.createHash(algorithm).update(password).digest("hex");
+                  matches = user.password === hashedPassword;
+                }
+              }
+              if (!matches) {
+                record.attempts = (record.attempts || 0) + 1;
+                record.expiresAt = Date.now() + this._attemptCacheTTL;
+                if (record.attempts >= this.MAX_LOGIN_ATTEMPTS) {
+                  record.lockedUntil = now + this.LOCK_DURATION_MS;
+                  this.audit("login.lockout", { user: username, ip: remoteIP });
+                }
+                this.loginAttemptCache.set(username, record);
+                try {
+                  sendWithBackpressure({
+                    id: object.id,
+                    action: "login",
+                    command: "login",
+                    message: "AUTH FAIL",
+                    data: null
+                  });
+                } catch (e) {
+                }
+                break;
+              }
+              this.loginAttemptCache.delete(username);
+              let token;
+              try {
+                token = jwt.sign({ username: user.username }, this.getEffectiveSecret(), {
+                  expiresIn: "1d"
+                });
+              } catch (e) {
+                try {
+                  sendWithBackpressure({
+                    id: object.id,
+                    action: "login",
+                    command: "login",
+                    message: "ERROR",
+                    data: { error: e && e.message || String(e) }
+                  });
+                } catch (e2) {
+                }
+                break;
+              }
+              try {
+                sendWithBackpressure({
+                  id: object.id,
+                  action: "login",
+                  command: "login",
+                  message: "AUTH OK",
+                  data: { token }
+                });
+              } catch (e) {
+              }
+              break;
+            case "script-code":
+              console.log("script-code command", object);
+              try {
+                const token2 = object.token || object.data && object.data.token;
+                if (!token2) throw new Error("Missing token");
+                if (typeof token2 === "string" && Buffer.byteLength(token2, "utf8") > 4096)
+                  throw new Error("Token too large");
+                const decodedUnverified = jwt.decode(token2);
+                if (!decodedUnverified)
+                  throw new Error("Invalid token payload");
+                const username2 = decodedUnverified.username || (decodedUnverified.role === "anonymous" ? "" : null);
+                if (username2 === null)
+                  throw new Error("Invalid token payload");
+                const userRecord = this.users.find(
+                  (u) => u.username === username2
+                );
+                if (!userRecord) {
+                  if (username2 === "" && !this.secure) {
+                  } else {
+                    throw new Error("Unknown user");
+                  }
+                }
+                let decoded;
+                const cacheKey = `${token2}:${this.serverSecret}`;
+                const cached = this._tokenVerifyCache.get(cacheKey);
+                if (cached) {
+                  decoded = cached;
+                } else {
+                  try {
+                    decoded = jwt.verify(token2, this.getEffectiveSecret());
+                    this._tokenVerifyCache.set(cacheKey, decoded);
+                  } catch (eServer) {
+                    this.audit("jwt.verify.failed", {
+                      user: username2
+                    });
+                    throw new Error("Invalid token after verify");
+                  }
+                }
+                if (!decoded)
+                  throw new Error("Invalid token after verify");
+                console.log("script-code: token verified, checking VM...");
+                if (!this.vm || typeof this.vm.run !== "function") {
+                  console.error("script-code: VM not available");
+                  sendWithBackpressure({
+                    command: "script-code",
+                    message: "ERROR",
+                    data: "VM_NOT_AVAILABLE"
+                  });
+                  break;
+                }
+                console.log("script-code: VM available, preparing data...");
+                const data2 = object.data && typeof object.data === "object" ? object.data : {};
+                const validateViaWorker = (payload) => new Promise((resolve2, reject) => {
+                  try {
+                    if (!this._validatorWorkers || this._validatorWorkers.length === 0)
+                      return resolve2(null);
+                    if (Date.now() < (this._validatorTrippedUntil || 0))
+                      return resolve2(null);
+                    const wIndex = this._validatorNext++ % this._validatorWorkers.length;
+                    const w = this._validatorWorkers[wIndex];
+                    const id = Math.random().toString(36).slice(2);
+                    const timer = setTimeout(
+                      () => {
+                        const p = this._validatorPending.get(id);
+                        if (p) {
+                          this._validatorPending.delete(id);
+                          p.reject(new Error("validator worker timeout"));
+                        }
+                        try {
+                          w.terminate();
+                        } catch (e) {
+                        }
+                        this._validatorFailures.push(Date.now());
+                        const recent = this._validatorFailures.filter(
+                          (t) => t > Date.now() - this._validatorFailureWindowMs
+                        );
+                        if (recent.length >= this._validatorFailureThreshold)
+                          this._validatorTrippedUntil = Date.now() + this._validatorCircuitCooldownMs;
+                      },
+                      this._validatorTimeoutMs || 3e3
+                    );
+                    this._validatorPending.set(id, {
+                      resolve: resolve2,
+                      reject,
+                      timer,
+                      start: Date.now()
+                    });
+                    w.postMessage({
+                      id,
+                      action: "validate",
+                      payload,
+                      options: {
+                        schema: this.payloadSchema,
+                        maxDepth: this._payloadMaxDepth,
+                        maxNodes: this._payloadMaxNodes
+                      }
+                    });
+                  } catch (e) {
+                    return resolve2(null);
+                  }
+                });
+                const sanitizeViaWorker = (payload) => new Promise((resolve2, reject) => {
+                  try {
+                    if (!this._validatorWorkers || this._validatorWorkers.length === 0)
+                      return resolve2(null);
+                    if (Date.now() < (this._validatorTrippedUntil || 0))
+                      return resolve2(null);
+                    const wIndex = this._validatorNext++ % this._validatorWorkers.length;
+                    const w = this._validatorWorkers[wIndex];
+                    const id = Math.random().toString(36).slice(2);
+                    const timer = setTimeout(
+                      () => {
+                        const p = this._validatorPending.get(id);
+                        if (p) {
+                          this._validatorPending.delete(id);
+                          p.reject(new Error("validator worker timeout"));
+                        }
+                        try {
+                          w.terminate();
+                        } catch (e) {
+                        }
+                        this._validatorFailures.push(Date.now());
+                        const recent = this._validatorFailures.filter(
+                          (t) => t > Date.now() - this._validatorFailureWindowMs
+                        );
+                        if (recent.length >= this._validatorFailureThreshold)
+                          this._validatorTrippedUntil = Date.now() + this._validatorCircuitCooldownMs;
+                      },
+                      this._validatorTimeoutMs || 3e3
+                    );
+                    this._validatorPending.set(id, {
+                      resolve: resolve2,
+                      reject,
+                      timer,
+                      start: Date.now()
+                    });
+                    w.postMessage({
+                      id,
+                      action: "sanitize",
+                      payload,
+                      options: {
+                        allowedKeys: [
+                          "result",
+                          "value",
+                          "items",
+                          "length",
+                          "status",
+                          "message"
+                        ],
+                        maxNodes: this._sanitizeMaxNodes,
+                        maxDepth: this._sanitizeMaxDepth,
+                        maxString: this._sanitizeMaxString
+                      }
+                    });
+                  } catch (e) {
+                    return resolve2(null);
+                  }
+                });
+                const localValidate = (payload) => {
+                  const out = {};
+                  let nodes = 0;
+                  const checkDepth = (obj, depth) => {
+                    if (depth > this._payloadMaxDepth) return false;
+                    if (nodes++ > this._payloadMaxNodes) return false;
+                    if (obj && typeof obj === "object") {
+                      for (const k of Object.keys(obj)) {
+                        const expected = (this.payloadSchema || {})[k];
+                        if (!expected) continue;
+                        const val = obj[k];
+                        if (expected === "string" && typeof val === "string")
+                          out[k] = val;
+                        else if (expected === "number" && typeof val === "number")
+                          out[k] = val;
+                        else if (expected === "object" && val && typeof val === "object") {
+                          if (depth + 1 <= this._payloadMaxDepth) {
+                            out[k] = {};
+                            for (const nk of Object.keys(val)) {
+                              if ((this.payloadSchema || {})[nk])
+                                out[k][nk] = val[nk];
+                            }
+                          }
+                        }
+                      }
+                      return true;
+                    }
+                    return false;
+                  };
+                  if (!checkDepth(payload, 0)) return {};
+                  return out;
+                };
+                let allowed = {};
+                try {
+                  if (this._validatorWorkers && this._validatorWorkers.length > 0) {
+                    const res = await Promise.race([
+                      validateViaWorker(data2).catch(() => null),
+                      new Promise((r) => setTimeout(() => r(null), 1500))
+                    ]);
+                    if (res && typeof res === "object") allowed = res;
+                    else allowed = localValidate(data2);
+                  } else {
+                    allowed = localValidate(data2);
+                  }
+                } catch (e) {
+                  allowed = localValidate(data2);
+                }
+                console.log("script-code: validation complete, allowed keys:", Object.keys(allowed));
+                if (Object.keys(allowed).length === 0) {
+                  console.error("script-code: empty payload after validation");
+                  try {
+                    sendWithBackpressure({
+                      id: object.id,
+                      command: "script-code",
+                      message: "ERROR",
+                      data: "INVALID_PAYLOAD"
+                    });
+                  } catch (e) {
+                  }
+                  break;
+                }
+                const runInVmWorker = (payload) => new Promise((resolve2, reject) => {
+                  if (!this._vmWorkers || this._vmWorkers.length === 0)
+                    return resolve2(null);
+                  const wIndex = this._vmNext++ % this._vmWorkers.length;
+                  const w = this._vmWorkers[wIndex];
+                  const id = Math.random().toString(36).slice(2);
+                  const timer = setTimeout(() => {
+                    const p = this._vmPending.get(id);
+                    if (p) {
+                      this._vmPending.delete(id);
+                      p.reject(new Error("vm worker timeout"));
+                    }
+                    try {
+                      w.terminate();
+                    } catch (e) {
+                    }
+                    const nw = new Worker(
+                      path.join(__dirname, "vm-worker.js")
+                    );
+                    nw.on("message", (m) => {
+                      const p2 = this._vmPending.get(m.id);
+                      if (p2) {
+                        clearTimeout(p2.timer);
+                        this._vmPending.delete(m.id);
+                        if (m.error) p2.reject(new Error(m.error));
+                        else p2.resolve(m.res);
+                      }
+                    });
+                    this._vmWorkers[wIndex] = nw;
+                  }, this.vmWorkerTimeoutMs);
+                  this._vmPending.set(id, {
+                    resolve: resolve2,
+                    reject,
+                    timer,
+                    start: Date.now()
+                  });
+                  try {
+                    w.postMessage({ id, action: "run", payload });
+                  } catch (e) {
+                    clearTimeout(timer);
+                    this._vmPending.delete(id);
+                    return resolve2(null);
+                  }
+                });
+                const code = allowed.code;
+                const databaseName = allowed.databaseName;
+                if (!code || typeof code !== "string") {
+                  console.error("script-code: invalid code type");
+                  try {
+                    sendWithBackpressure({
+                      id: object.id,
+                      command: "script-code",
+                      message: "ERROR",
+                      data: "Missing or invalid code"
+                    });
+                  } catch (e) {
+                  }
+                  break;
+                }
+                console.log("script-code: running code for database:", databaseName);
+                const runPromise = this._vmWorkers && this._vmWorkers.length > 0 ? runInVmWorker(code) : Promise.resolve(this.vm.run(code, databaseName));
+                console.log("script-code: calling VM...");
+                Promise.resolve(runPromise).then(async (res) => {
+                  console.log("script-code: VM returned result:", typeof res);
+                  try {
+                    let out;
+                    if (this._validatorWorkers && this._validatorWorkers.length > 0) {
+                      try {
+                        const wres = await Promise.race([
+                          sanitizeViaWorker(res).catch(() => null),
+                          new Promise((r) => setTimeout(() => r(null), 1500))
+                        ]);
+                        out = wres && typeof wres === "object" ? wres : null;
+                      } catch (e) {
+                        out = null;
+                      }
+                    }
+                    if (!out) {
+                      const allowedKeys = [
+                        "result",
+                        "value",
+                        "items",
+                        "length",
+                        "status",
+                        "message",
+                        "namespace",
+                        "logs",
+                        // Log object properties
+                        "type",
+                        "args",
+                        // Database properties
+                        "name",
+                        "id",
+                        "data",
+                        "properties",
+                        "fields",
+                        "records",
+                        "rows",
+                        "columns",
+                        // Allow database name from request
+                        databaseName
+                      ];
+                      let nodes = 0;
+                      const rec = (input, depth = 0, isTopLevel = false, path4 = []) => {
+                        if (nodes++ > this._sanitizeMaxNodes)
+                          return "[REDACTED_NODES]";
+                        if (depth > this._sanitizeMaxDepth)
+                          return "[REDACTED_DEPTH]";
+                        if (input === null || input === void 0)
+                          return input;
+                        if (typeof input === "string") {
+                          if (input.length > this._sanitizeMaxString)
+                            return input.slice(0, this._sanitizeMaxString) + "...[TRUNC]";
+                          return input;
+                        }
+                        if (typeof input === "number" || typeof input === "boolean")
+                          return input;
+                        if (typeof input === "function") {
+                          const isInsideNamespace = path4.includes("namespace");
+                          if (isInsideNamespace) {
+                            return `[Function: ${input.name || "anonymous"}]`;
+                          }
+                          return "[REDACTED]";
+                        }
+                        if (Array.isArray(input))
+                          return input.map((v) => rec(v, depth + 1, false, path4));
+                        if (typeof input === "object") {
+                          const out2 = {};
+                          const isInsideNamespace = path4.includes("namespace");
+                          const isInsideLogs = path4.includes("logs");
+                          for (const k of Object.keys(input)) {
+                            if (isTopLevel || allowedKeys.includes(k) || isInsideNamespace || isInsideLogs) {
+                              out2[k] = rec(input[k], depth + 1, false, [...path4, k]);
+                            } else {
+                              out2[k] = "[REDACTED]";
+                            }
+                          }
+                          return out2;
+                        }
+                        return "[REDACTED]";
+                      };
+                      out = rec(res, 0, true, []);
+                    }
+                    console.log("script-code: sanitized result:", typeof out, out);
+                    try {
+                      console.log("script-code: sending OK response with id:", object.id);
+                      sendWithBackpressure({
+                        id: object.id,
+                        command: "script-code",
+                        message: "OK",
+                        data: out
+                      });
+                    } catch (e) {
+                      console.error("script-code: failed to send OK response:", e);
+                    }
+                  } catch (e) {
+                    console.error("script-code: error during sanitize:", e);
+                    try {
+                      sendWithBackpressure({
+                        id: object.id,
+                        command: "script-code",
+                        message: "ERROR",
+                        data: e && e.message || String(e)
+                      });
+                    } catch (ee) {
+                    }
+                  }
+                }).catch((err) => {
+                  console.error("script-code: VM error:", err);
+                  try {
+                    sendWithBackpressure({
+                      id: object.id,
+                      command: "script-code",
+                      message: "ERROR",
+                      data: err && err.message || String(err)
+                    });
+                  } catch (e) {
+                    console.error("script-code: failed to send ERROR response:", e);
+                  }
+                });
+              } catch (err) {
+                try {
+                  await sendCritical({
+                    command: "script-code",
+                    message: "AUTH FAIL",
+                    data: err && err.message || null
+                  });
+                  console.log("Token verification AUTH FAIL sent and flushed - client will close");
+                } catch (e) {
+                  console.error("Error sending token AUTH FAIL:", e);
+                }
+                return;
+              }
+              break;
+            case "create-db":
+              console.log("create-db command", object);
+              try {
+                const token2 = object.token || object.data && object.data.token;
+                if (!token2) throw new Error("Missing token");
+                const decoded = jwt.verify(token2, this.getEffectiveSecret());
+                if (!decoded) throw new Error("Invalid token");
+                const username2 = decoded.username || decoded.role || "anonymous";
+                const databaseName = object.data?.databaseName;
+                if (!databaseName || typeof databaseName !== "string") {
+                  throw new Error("Missing or invalid databaseName");
+                }
+                if (!/^[a-zA-Z0-9_-]+$/.test(databaseName)) {
+                  throw new Error("Invalid database name. Use only alphanumeric characters, hyphens, and underscores.");
+                }
+                if (!this.storage) {
+                  throw new Error("Storage not available");
+                }
+                console.log(`Creating database: ${databaseName} for user: ${username2}`);
+                const initialContent = `// Database: ${databaseName}
+// Created: ${(/* @__PURE__ */ new Date()).toISOString()}
+// Author: ${username2}
+
+export const ${databaseName} = {};
+`;
+                const result = await this.storage.addFile(`${databaseName}.ts`, initialContent);
+                console.log("Storage addFile result:", result);
+                if (!result.success) {
+                  throw new Error(result.message);
+                }
+                sendWithBackpressure({
+                  id: object.id,
+                  action: commandOrAction,
+                  command: commandOrAction,
+                  message: "SUCCESS",
+                  data: {
+                    success: true,
+                    databaseName,
+                    path: result.path,
+                    message: `Database '${databaseName}' created successfully`
+                  }
+                });
+              } catch (err) {
+                try {
+                  sendWithBackpressure({
+                    id: object.id,
+                    action: commandOrAction,
+                    command: commandOrAction,
+                    message: "ERROR",
+                    data: err && err.message || String(err)
+                  });
+                } catch (e) {
+                }
+              }
+              break;
+            case "list-dbs":
+              console.log("list-dbs command", object);
+              try {
+                const token2 = object.token || object.data && object.data.token;
+                if (!token2) throw new Error("Missing token");
+                console.log("list-dbs: verifying token...");
+                const decoded = jwt.verify(token2, this.getEffectiveSecret());
+                if (!decoded) throw new Error("Invalid token");
+                console.log("list-dbs: token verified, listing files...");
+                if (!this.storage) {
+                  throw new Error("Storage not available");
+                }
+                const files = await this.storage.listFiles();
+                console.log("list-dbs: found files:", files);
+                const databases = files.filter((file) => file.endsWith(".ts")).map((file) => {
+                  const name = file.replace(/\.ts$/, "");
+                  return { name, path: file };
+                });
+                console.log("list-dbs: sending response with", databases.length, "databases");
+                sendWithBackpressure({
+                  id: object.id,
+                  action: commandOrAction,
+                  command: commandOrAction,
+                  message: "SUCCESS",
+                  data: {
+                    databases,
+                    count: databases.length
+                  }
+                });
+              } catch (err) {
+                console.error("list-dbs ERROR:", err);
+                try {
+                  sendWithBackpressure({
+                    id: object.id,
+                    action: commandOrAction,
+                    command: commandOrAction,
+                    message: "ERROR",
+                    data: err && err.message || String(err)
+                  });
+                } catch (e) {
+                  console.error("Failed to send error response:", e);
+                }
+              }
+              break;
+            case "remove-db":
+              console.log("remove-db command", object);
+              try {
+                const token2 = object.token || object.data && object.data.token;
+                if (!token2) throw new Error("Missing token");
+                const decoded = jwt.verify(token2, this.getEffectiveSecret());
+                if (!decoded) throw new Error("Invalid token");
+                const username2 = decoded.username || decoded.role || "anonymous";
+                const databaseName = object.data?.databaseName;
+                if (!databaseName || typeof databaseName !== "string") {
+                  throw new Error("Missing or invalid databaseName");
+                }
+                if (!this.storage) {
+                  throw new Error("Storage not available");
+                }
+                console.log(`Removing database: ${databaseName} by user: ${username2}`);
+                const result = await this.storage.deleteFile(`${databaseName}.ts`);
+                console.log("Storage deleteFile result:", result);
+                if (!result.success) {
+                  throw new Error(result.message);
+                }
+                sendWithBackpressure({
+                  id: object.id,
+                  action: commandOrAction,
+                  command: commandOrAction,
+                  message: "SUCCESS",
+                  data: {
+                    success: true,
+                    databaseName,
+                    message: `Database '${databaseName}' removed successfully`
+                  }
+                });
+              } catch (err) {
+                console.error("remove-db ERROR:", err);
+                try {
+                  sendWithBackpressure({
+                    id: object.id,
+                    action: commandOrAction,
+                    command: commandOrAction,
+                    message: "ERROR",
+                    data: err && err.message || String(err)
+                  });
+                } catch (e) {
+                  console.error("Failed to send error response:", e);
+                }
+              }
+              break;
+            case "rename-db":
+              console.log("rename-db command", object);
+              try {
+                const token2 = object.token || object.data && object.data.token;
+                if (!token2) throw new Error("Missing token");
+                const decoded = jwt.verify(token2, this.getEffectiveSecret());
+                if (!decoded) throw new Error("Invalid token");
+                const username2 = decoded.username || decoded.role || "anonymous";
+                const databaseName = object.data?.databaseName;
+                const newName = object.data?.newName;
+                if (!databaseName || typeof databaseName !== "string") {
+                  throw new Error("Missing or invalid databaseName");
+                }
+                if (!newName || typeof newName !== "string") {
+                  throw new Error("Missing or invalid newName");
+                }
+                if (!/^[a-zA-Z0-9_-]+$/.test(newName)) {
+                  throw new Error("Invalid new database name. Use only alphanumeric characters, hyphens, and underscores.");
+                }
+                if (!this.storage) {
+                  throw new Error("Storage not available");
+                }
+                console.log(`Renaming database: ${databaseName} to ${newName} by user: ${username2}`);
+                const getResult = await this.storage.getFile(`${databaseName}.ts`);
+                if (!getResult.success) {
+                  throw new Error(getResult.message || `Database '${databaseName}' not found`);
+                }
+                let content = getResult.content || "";
+                content = content.replace(new RegExp(`// Database: ${databaseName}`, "g"), `// Database: ${newName}`).replace(new RegExp(`export const ${databaseName}`, "g"), `export const ${newName}`);
+                const addResult = await this.storage.addFile(`${newName}.ts`, content);
+                if (!addResult.success) {
+                  throw new Error(addResult.message);
+                }
+                const deleteResult = await this.storage.deleteFile(`${databaseName}.ts`);
+                if (!deleteResult.success) {
+                  await this.storage.deleteFile(`${newName}.ts`);
+                  throw new Error(deleteResult.message);
+                }
+                console.log("Database renamed successfully");
+                sendWithBackpressure({
+                  id: object.id,
+                  action: commandOrAction,
+                  command: commandOrAction,
+                  message: "SUCCESS",
+                  data: {
+                    success: true,
+                    oldName: databaseName,
+                    newName,
+                    message: `Database '${databaseName}' renamed to '${newName}' successfully`
+                  }
+                });
+              } catch (err) {
+                console.error("rename-db ERROR:", err);
+                try {
+                  sendWithBackpressure({
+                    id: object.id,
+                    action: commandOrAction,
+                    command: commandOrAction,
+                    message: "ERROR",
+                    data: err && err.message || String(err)
+                  });
+                } catch (e) {
+                  console.error("Failed to send error response:", e);
+                }
+              }
+              break;
+            case "get-db":
+              console.log("get-db command", object);
+              try {
+                const token2 = object.token || object.data && object.data.token;
+                if (!token2) throw new Error("Missing token");
+                const decoded = jwt.verify(token2, this.getEffectiveSecret());
+                if (!decoded) throw new Error("Invalid token");
+                const databaseName = object.data?.databaseName;
+                if (!databaseName || typeof databaseName !== "string") {
+                  throw new Error("Missing or invalid databaseName");
+                }
+                if (!this.storage) {
+                  throw new Error("Storage not available");
+                }
+                console.log(`Getting database: ${databaseName}`);
+                const result = await this.storage.getFile(`${databaseName}.ts`);
+                console.log("Storage getFile result:", result);
+                if (!result.success) {
+                  throw new Error(result.message);
+                }
+                sendWithBackpressure({
+                  id: object.id,
+                  action: commandOrAction,
+                  command: commandOrAction,
+                  message: "SUCCESS",
+                  data: {
+                    success: true,
+                    databaseName,
+                    content: result.content || "",
+                    path: result.path
+                  }
+                });
+              } catch (err) {
+                console.error("get-db ERROR:", err);
+                try {
+                  sendWithBackpressure({
+                    id: object.id,
+                    action: commandOrAction,
+                    command: commandOrAction,
+                    message: "ERROR",
+                    data: err && err.message || String(err)
+                  });
+                } catch (e) {
+                  console.error("Failed to send error response:", e);
+                }
+              }
+              break;
+            case "save-db":
+            case "update-db":
+            case "get-info":
+              console.log(`Command ${commandOrAction} not yet implemented`);
+              try {
+                sendWithBackpressure({
+                  id: object.id,
+                  action: commandOrAction,
+                  command: commandOrAction,
+                  message: "ERROR",
+                  data: `Command ${commandOrAction} not yet implemented in protocol server`
+                });
+              } catch (e) {
+              }
+              break;
+            default:
+              console.log("Unknown command:", commandOrAction, "object:", object);
+              socket.write(
+                JSON.stringify({
+                  command: "error",
+                  message: "UNKNOWN_COMMAND"
+                }) + "\n"
+              );
+              socket.end();
+              return;
+          }
+        }
+      });
+      socket.on("end", () => {
+        console.log("Client disconnected");
+      });
+    };
+    if (this.requireTlsInProduction && process.env.NODE_ENV === "production") {
+      if (!(this.tlsOptions && (this.tlsOptions.key || this.tlsOptions.cert))) {
+        throw new Error(
+          "TLS is required in production but tlsOptions are not configured"
+        );
+      }
+    }
+    let serverImpl;
+    if (this.tlsOptions && (this.tlsOptions.key || this.tlsOptions.cert)) {
+      const tlsOpts = Object.assign({}, this.tlsOptions);
+      try {
+        if (typeof tlsOpts.key === "string" && fs2.existsSync(tlsOpts.key))
+          tlsOpts.key = fs2.readFileSync(tlsOpts.key);
+        if (typeof tlsOpts.cert === "string" && fs2.existsSync(tlsOpts.cert))
+          tlsOpts.cert = fs2.readFileSync(tlsOpts.cert);
+      } catch (e) {
+      }
+      serverImpl = tls.createServer(tlsOpts, createListener);
+    } else {
+      serverImpl = net.createServer(createListener);
+    }
+    this.server = serverImpl;
+    this.server.listen(this.port, this.host, () => {
+      let cred = "";
+      try {
+        if (this.users && Array.isArray(this.users) && this.users.length > 0) {
+          const u = this.users[0] || { username: "" };
+          const uname = u.username || null;
+          if (uname && typeof u.password === "string" && u.password) {
+            cred = encodeURIComponent(String(uname)) + ":*****@";
+          } else if (uname) {
+            cred = encodeURIComponent(String(uname)) + "@";
+          }
+        }
+      } catch (e) {
+      }
+      console.log(
+        `Server listening on scriptdb://${cred}${this.host}:${this.port}`
+      );
+      try {
+        if (!this._autoscaleTimer && this._autoscaleIntervalMs > 0) {
+          this._autoscaleTimer = setInterval(() => {
+            try {
+              this._autoscalePools();
+            } catch (e) {
+            }
+          }, this._autoscaleIntervalMs);
+        }
+      } catch (e) {
+      }
+    });
+    this.server.on("close", () => {
+      try {
+        if (this._autoscaleTimer) {
+          clearInterval(this._autoscaleTimer);
+          this._autoscaleTimer = null;
+        }
+      } catch (e) {
+      }
+    });
+  }
+};
+
+// src/index.ts
+import * as path3 from "path";
+import * as fs4 from "fs";
+import VM from "@scriptdb/vm";
+import { Storage as Storage2 } from "@scriptdb/storage";
+
+// src/utils/setupDir.ts
+import path2 from "path";
+import fs3 from "fs";
+import { spawn } from "child_process";
+import Storage from "@scriptdb/storage";
+var pkgData = `{
+  "name": "scriptdb-workspace",
+  "version": "1.1.1",
+  "description": "ScriptDB workspace for custom scripts, services, and databases",
+  "private": true,
+  "devDependencies": {
+    "@types/bun": "^1.3.2",
+    "@types/node": "^20.0.0",
+    "@typescript-eslint/eslint-plugin": "^6.0.0",
+    "@typescript-eslint/parser": "^6.0.0",
+    "bun-types": "latest",
+    "eslint": "^8.0.0",
+    "typescript": "^5.0.0"
+  },
+  "dependencies": {
+    "lodash": "^4.17.21"
+  }
+}
+`;
+var tsconfigData = `
+{
+  "compilerOptions": {
+    "target": "ES2020",
+    "lib": ["ES2020", "DOM"],
+    "module": "ESNext",
+    "moduleResolution": "node",
+    "allowSyntheticDefaultImports": true,
+    "esModuleInterop": true,
+    "allowJs": true,
+    "strict": true,
+    "noEmit": false,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "removeComments": false,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "incremental": true,
+    "composite": true,
+    "types": ["node"]
+  }
+}
+`;
+var dotGitignoreData = `
+# Ignore all files in this directory
+node_modules/
+bin/
+`;
+var ecosystemData = `
+module.exports = {
+  apps: [{
+    name: 'scriptdb',
+    script: process.platform === 'win32'
+      ? require('path').join(require('os').homedir(), '.scriptdb', 'bin', 'scriptdb.exe')
+      : 'scriptdb',
+    args: 'start --force',
+    cwd: require('path').join(require('os').homedir(), '.scriptdb'),
+    instances: 1,
+    autorestart: true,
+    watch: false,
+    max_memory_restart: '1G',
+    env: {
+      NODE_ENV: 'production'
+    },
+    error_file: require('path').join(require('os').homedir(), '.scriptdb', 'pm2-error.log'),
+    out_file: require('path').join(require('os').homedir(), '.scriptdb', 'pm2-out.log'),
+    log_file: require('path').join(require('os').homedir(), '.scriptdb', 'pm2-combined.log'),
+    time: true,
+    log_date_format: 'YYYY-MM-DD HH:mm:ss Z',
+    merge_logs: true
+  }]
+};
+`;
+var configDefault = {
+  PORT: 3800,
+  HOST: "127.0.0.1",
+  secure: false,
+  jwtSecret: "scriptdb_secret_key",
+  maxConnections: 100,
+  logLevel: "info",
+  DB_USERNAME: "admin",
+  DB_PASSWORD: "password",
+  GITHUB_USERNAME: "",
+  GITHUB_EMAIL: "",
+  GITHUB_URL: "",
+  GITHUB_TOKEN: "",
+  GITHUB_BRANCH: "main",
+  enableIpLockout: true,
+  ipFailWindowMs: 9e5,
+  maxLoginAttempts: 5,
+  lockDurationMs: 9e5,
+  users: [
+    {
+      username: "admin",
+      password: "password",
+      hash: false,
+      algorithm: "bcrypt"
+    }
+  ]
+};
+function isGitUrl(url) {
+  const regex = /^(git@[\w.-]+:[\w./-]+\.git|https?:\/\/[\w.-]+\/[\w./-]+\.git)$/;
+  return regex.test(url);
+}
+function injectGitToken(url, token) {
+  const newUrl = url.replace(
+    "https://",
+    `https://${token}@`
+  );
+  return newUrl;
+}
+function installPackage(scriptdbDir) {
+  return new Promise((resolve2, reject) => {
+    console.log("Installing plugins in:", scriptdbDir);
+    const proc = spawn("bun", ["i"], {
+      cwd: scriptdbDir,
+      stdio: "inherit",
+      shell: true
+    });
+    proc.on("close", (code) => {
+      if (code === 0) {
+        console.log("bun i finished successfully");
+        resolve2();
+      } else {
+        console.error("bun i failed with code:", code);
+        reject(new Error(`bun install failed with code ${code}`));
+      }
+    });
+    proc.on("error", (err) => {
+      console.error("Failed to spawn bun install:", err);
+      reject(err);
+    });
+  });
+}
+async function setupStorage(scriptdbDir) {
+  try {
+    console.log("Initializing storage...");
+    const storage = new Storage(scriptdbDir);
+    const configStr = fs3.readFileSync(path2.join(scriptdbDir, "config.json"), "utf8");
+    const config = JSON.parse(configStr);
+    await storage.initialize(scriptdbDir);
+    console.log("Storage initialized");
+    if (config.GITHUB_USERNAME && config.GITHUB_EMAIL) {
+      const gitConfig = {
+        userName: config.GITHUB_USERNAME,
+        userEmail: config.GITHUB_EMAIL
+      };
+      await storage.setConfig(gitConfig);
+      console.log("Git config set");
+    } else {
+      console.log("Git config not set (configure later with 'scriptdb config')");
+    }
+    if (config.GITHUB_URL && isGitUrl(config.GITHUB_URL)) {
+      const remoteUrl = injectGitToken(config.GITHUB_URL, config.GITHUB_TOKEN);
+      await storage.addRemote("origin", config.GITHUB_TOKEN ? remoteUrl : config.GITHUB_URL);
+      await storage.pull("origin", config.GITHUB_BRANCH || "main");
+      console.log("Remote repository configured");
+    } else {
+      console.log("Remote repository not configured (configure later with 'scriptdb config')");
+    }
+    console.log("Storage setup complete");
+  } catch (err) {
+    console.warn("Storage setup failed (non-critical):", err);
+  }
+}
+async function setupDir() {
+  const scriptdbDir = path2.join(getHomeDir(), ".scriptdb");
+  const databasesDir = path2.join(scriptdbDir, "databases");
+  const servicesDir = path2.join(scriptdbDir, "services");
+  const clientsDir = path2.join(scriptdbDir, "clients");
+  const binDir = path2.join(scriptdbDir, "bin");
+  const configFile = path2.join(scriptdbDir, "config.json");
+  const gitignoreFile = path2.join(scriptdbDir, ".gitignore");
+  const packageJsonFile = path2.join(scriptdbDir, "package.json");
+  const tsconfigFile = path2.join(scriptdbDir, "tsconfig.json");
+  const ecosystemFile = path2.join(scriptdbDir, "ecosystem.config.js");
+  const isFullySetup = fs3.existsSync(scriptdbDir) && fs3.existsSync(databasesDir) && fs3.existsSync(servicesDir) && fs3.existsSync(clientsDir) && fs3.existsSync(binDir) && fs3.existsSync(configFile) && fs3.existsSync(gitignoreFile) && fs3.existsSync(packageJsonFile) && fs3.existsSync(tsconfigFile) && fs3.existsSync(ecosystemFile);
+  if (isFullySetup) {
+    console.log("ScriptDB directory already fully configured:", scriptdbDir);
+    return;
+  }
+  console.log("Setting up scriptdb directory...");
+  if (!fs3.existsSync(scriptdbDir)) {
+    fs3.mkdirSync(scriptdbDir, { recursive: true });
+    fs3.mkdirSync(databasesDir, { recursive: true });
+    fs3.mkdirSync(servicesDir, { recursive: true });
+    fs3.mkdirSync(clientsDir, { recursive: true });
+    fs3.mkdirSync(binDir, { recursive: true });
+    fs3.writeFileSync(configFile, JSON.stringify(configDefault, null, 2), "utf8");
+    fs3.writeFileSync(gitignoreFile, dotGitignoreData, "utf8");
+    fs3.writeFileSync(packageJsonFile, pkgData, "utf8");
+    fs3.writeFileSync(tsconfigFile, tsconfigData, "utf8");
+    fs3.writeFileSync(ecosystemFile, ecosystemData, "utf8");
+    console.log("Created:", scriptdbDir);
+    await installPackage(scriptdbDir);
+    await setupStorage(scriptdbDir);
+  } else {
+    if (!fs3.existsSync(databasesDir)) {
+      fs3.mkdirSync(databasesDir, { recursive: true });
+    }
+    if (!fs3.existsSync(servicesDir)) {
+      fs3.mkdirSync(servicesDir, { recursive: true });
+    }
+    if (!fs3.existsSync(clientsDir)) {
+      fs3.mkdirSync(clientsDir, { recursive: true });
+    }
+    if (!fs3.existsSync(binDir)) {
+      fs3.mkdirSync(binDir, { recursive: true });
+    }
+    if (!fs3.existsSync(configFile)) {
+      fs3.writeFileSync(configFile, JSON.stringify(configDefault, null, 2), "utf8");
+    }
+    if (!fs3.existsSync(gitignoreFile)) {
+      fs3.writeFileSync(gitignoreFile, dotGitignoreData, "utf8");
+    }
+    if (!fs3.existsSync(packageJsonFile)) {
+      fs3.writeFileSync(packageJsonFile, pkgData, "utf8");
+    }
+    if (!fs3.existsSync(tsconfigFile)) {
+      fs3.writeFileSync(tsconfigFile, tsconfigData, "utf8");
+    }
+    if (!fs3.existsSync(ecosystemFile)) {
+      fs3.writeFileSync(ecosystemFile, ecosystemData, "utf8");
+    }
+    if (!fs3.existsSync(path2.join(scriptdbDir, "node_modules"))) {
+      await installPackage(scriptdbDir);
+    }
+    console.log("Setup complete");
+    await setupStorage(scriptdbDir);
+  }
+}
+
+// src/wsProxy.ts
+import { WebSocketServer, WebSocket } from "ws";
+
+// ../client/src/index.ts
+import * as net2 from "net";
+import * as tls2 from "tls";
+import { URL } from "url";
+import * as crypto2 from "crypto";
+var noopLogger = {
+  debug: () => {
+  },
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+var ScriptDBClient = class {
+  /**
+   * Create a new client. Do NOT auto-connect in constructor — call connect()
+   * @param uri - Connection URI
+   * @param options - Client options
+   * @param options.secure - use TLS
+   * @param options.logger - { debug, info, warn, error }
+   * @param options.requestTimeout - Request timeout in ms
+   * @param options.retries - Reconnection retries
+   * @param options.retryDelay - Initial retry delay in ms
+   * @param options.tlsOptions - Passed to tls.connect when secure
+   */
+  constructor(uri, options = {}) {
+    this.socketTimeout = 0;
+    this.maxMessageSize = 0;
+    this._mask = () => {
+    };
+    this._maskArgs = () => [];
+    this.logger = {};
+    this.secure = true;
+    this.requestTimeout = 0;
+    this.retries = 0;
+    this.retryDelay = 0;
+    this.frame = "ndjson";
+    this.uri = "";
+    this.protocolName = "";
+    this.username = null;
+    this.password = null;
+    this.host = "";
+    this.port = 0;
+    this.database = null;
+    this.client = null;
+    this.buffer = Buffer.alloc(0);
+    this._nextId = 1;
+    this._pending = /* @__PURE__ */ new Map();
+    this._maxPending = 0;
+    this._maxQueue = 0;
+    this._pendingQueue = [];
+    this._connected = false;
+    this._authenticating = false;
+    this.token = null;
+    this._currentRetries = 0;
+    this.tokenExpiry = null;
+    this._destroyed = false;
+    this._reconnectTimer = null;
+    this.signing = null;
+    this._stringify = JSON.stringify;
+    this.ready = Promise.resolve();
+    this._resolveReadyFn = null;
+    this._rejectReadyFn = null;
+    this._connecting = null;
+    this._authPendingId = null;
+    if (!uri || typeof uri !== "string") throw new Error("uri required");
+    this.options = Object.assign({}, options);
+    this.socketTimeout = Number.isFinite(this.options.socketTimeout) ? this.options.socketTimeout : 0;
+    this.maxMessageSize = Number.isFinite(this.options.maxMessageSize) ? this.options.maxMessageSize : 5 * 1024 * 1024;
+    this._mask = (obj) => {
+      try {
+        if (!obj || typeof obj !== "object") return obj;
+        const copy = Array.isArray(obj) ? obj.slice() : Object.assign({}, obj);
+        if (copy.token) copy.token = "****";
+        if (copy.password) copy.password = "****";
+        if (copy.data && copy.data.password) copy.data.password = "****";
+        return copy;
+      } catch (e) {
+        return obj;
+      }
+    };
+    const rawLogger = this.options.logger && typeof this.options.logger === "object" ? this.options.logger : noopLogger;
+    this._maskArgs = (args) => {
+      return args.map((a) => {
+        if (!a) return a;
+        if (typeof a === "string") return a;
+        return this._mask(a);
+      });
+    };
+    this.logger = {
+      debug: (...args) => rawLogger.debug && rawLogger.debug(...this._maskArgs(args)),
+      info: (...args) => rawLogger.info && rawLogger.info(...this._maskArgs(args)),
+      warn: (...args) => rawLogger.warn && rawLogger.warn(...this._maskArgs(args)),
+      error: (...args) => rawLogger.error && rawLogger.error(...this._maskArgs(args))
+    };
+    this.secure = typeof this.options.secure === "boolean" ? !!this.options.secure : true;
+    if (!this.secure)
+      this.logger.warn?.(
+        "Warning: connecting in insecure mode (secure=false). This is not recommended."
+      );
+    this.requestTimeout = Number.isFinite(this.options.requestTimeout) ? this.options.requestTimeout : 0;
+    this.retries = Number.isFinite(this.options.retries) ? this.options.retries : 3;
+    this.retryDelay = Number.isFinite(this.options.retryDelay) ? this.options.retryDelay : 1e3;
+    this.frame = this.options.frame === "length-prefix" || this.options.preferLengthPrefix ? "length-prefix" : "ndjson";
+    let parsed;
+    try {
+      parsed = new URL(uri);
+    } catch (e) {
+      throw new Error("Invalid uri");
+    }
+    if (parsed.protocol !== "scriptdb:") {
+      throw new Error("URI must use scriptdb:// protocol");
+    }
+    this.uri = uri;
+    this.protocolName = parsed.protocol ? parsed.protocol.replace(":", "") : "scriptdb";
+    this.username = (typeof this.options.username === "string" ? this.options.username : parsed.username) || null;
+    this.password = (typeof this.options.password === "string" ? this.options.password : parsed.password) || null;
+    if (parsed.username && !(typeof this.options.username === "string")) {
+      this.logger.warn?.(
+        "Credentials found in URI \u2014 consider passing credentials via options instead of embedding in URI"
+      );
+    }
+    try {
+      parsed.username = "";
+      parsed.password = "";
+      this.uri = parsed.toString();
+    } catch (e) {
+      this.uri = uri;
+    }
+    this.host = parsed.hostname || "localhost";
+    this.port = parsed.port ? parseInt(parsed.port, 10) : 1234;
+    this.database = parsed.pathname && parsed.pathname.length > 1 ? parsed.pathname.slice(1) : null;
+    this.client = null;
+    this.buffer = Buffer.alloc(0);
+    this._nextId = 1;
+    this._pending = /* @__PURE__ */ new Map();
+    this._maxPending = Number.isFinite(this.options.maxPending) ? this.options.maxPending : 100;
+    this._maxQueue = Number.isFinite(this.options.maxQueue) ? this.options.maxQueue : 1e3;
+    this._pendingQueue = [];
+    this._connected = false;
+    this._authenticating = false;
+    this.token = null;
+    this._currentRetries = 0;
+    this.tokenExpiry = null;
+    this._destroyed = false;
+    this._reconnectTimer = null;
+    this.signing = this.options.signing && this.options.signing.secret ? this.options.signing : null;
+    this._stringify = typeof this.options.stringify === "function" ? this.options.stringify : JSON.stringify;
+    this._createReady();
+  }
+  _createReady() {
+    this.ready = new Promise((resolve2, reject) => {
+      this._resolveReadyFn = resolve2;
+      this._rejectReadyFn = reject;
+    });
+  }
+  _resolveReady(value) {
+    if (this._resolveReadyFn) {
+      try {
+        this._resolveReadyFn(value);
+      } catch (e) {
+      }
+      this._resolveReadyFn = null;
+      this._rejectReadyFn = null;
+    }
+  }
+  _rejectReady(err) {
+    if (this._rejectReadyFn) {
+      const rejectFn = this._rejectReadyFn;
+      this._resolveReadyFn = null;
+      this._rejectReadyFn = null;
+      process.nextTick(() => {
+        try {
+          rejectFn(err);
+        } catch (e) {
+        }
+      });
+    }
+  }
+  /**
+   * Check if connected
+   */
+  get connected() {
+    return this._connected;
+  }
+  /**
+   * Connect to server and authenticate. Returns a Promise that resolves when authenticated.
+   */
+  connect() {
+    if (this._connecting) return this._connecting;
+    this._connecting = new Promise((resolve2, reject) => {
+      const opts = { host: this.host, port: this.port };
+      const onConnect = () => {
+        console.log("ScriptDBClient: Connected to server at", opts.host, opts.port);
+        this.logger?.info?.("Connected to server");
+        this._connected = true;
+        this._currentRetries = 0;
+        console.log("ScriptDBClient: Setting up listeners...");
+        this._setupListeners();
+        console.log("ScriptDBClient: Authenticating...");
+        this.authenticate().then(() => {
+          this._processQueue();
+          resolve2(this);
+        }).catch((err) => {
+          reject(err);
+        });
+      };
+      try {
+        if (this.secure) {
+          const connectionOpts = { host: opts.host, port: opts.port };
+          const tlsOptions = Object.assign(
+            {},
+            this.options.tlsOptions || {},
+            connectionOpts
+          );
+          if (typeof tlsOptions.rejectUnauthorized === "undefined")
+            tlsOptions.rejectUnauthorized = true;
+          this.client = tls2.connect(tlsOptions, onConnect);
+        } else {
+          this.client = net2.createConnection(opts, onConnect);
+        }
+      } catch (e) {
+        const error = e;
+        this.logger?.error?.("Connection failed", error.message);
+        this._rejectReady(error);
+        this._createReady();
+        this._connecting = null;
+        return reject(error);
+      }
+      if (!this.client) {
+        const error = new Error("Failed to create client socket");
+        this.logger?.error?.("Connection failed", error.message);
+        this._connecting = null;
+        return reject(error);
+      }
+      const onError = (err) => {
+        this.logger?.error?.(
+          "Client socket error:",
+          err && err.message ? err.message : err
+        );
+        this._handleDisconnect(err);
+      };
+      const onClose = (hadError) => {
+        this.logger?.info?.("Server closed connection");
+        this._handleDisconnect(null);
+      };
+      this.client.on("error", onError);
+      this.client.on("close", onClose);
+      if (this.socketTimeout > 0 && this.client) {
+        this.client.setTimeout(this.socketTimeout);
+        this.client.on("timeout", () => {
+          this.logger?.warn?.("Socket timeout, destroying connection");
+          try {
+            this.client?.destroy();
+          } catch (e) {
+          }
+        });
+      }
+    }).catch((err) => {
+      this._connecting = null;
+      throw err;
+    });
+    return this._connecting;
+  }
+  _setupListeners() {
+    if (!this.client) return;
+    console.log("ScriptDBClient _setupListeners: called, client exists:", !!this.client);
+    this.client.removeAllListeners("data");
+    this.buffer = Buffer.alloc(0);
+    console.log("ScriptDBClient _setupListeners: frame mode:", this.frame);
+    if (this.frame === "length-prefix") {
+      this.client.on("data", (chunk) => {
+        if (!Buffer.isBuffer(chunk)) {
+          try {
+            chunk = Buffer.from(chunk);
+          } catch (e) {
+            return;
+          }
+        }
+        this.buffer = Buffer.concat([this.buffer, chunk]);
+        while (this.buffer.length >= 4) {
+          const len = this.buffer.readUInt32BE(0);
+          if (len > this.maxMessageSize) {
+            this.logger?.error?.(
+              "Incoming length-prefixed frame exceeds maxMessageSize \u2014 closing connection"
+            );
+            try {
+              this.client?.destroy();
+            } catch (e) {
+            }
+            return;
+          }
+          if (this.buffer.length < 4 + len) break;
+          const payload = this.buffer.slice(4, 4 + len);
+          this.buffer = this.buffer.slice(4 + len);
+          let msg;
+          try {
+            msg = JSON.parse(payload.toString("utf8"));
+          } catch (e) {
+            this.logger?.error?.(
+              "Invalid JSON frame",
+              e && e.message ? e.message : e
+            );
+            continue;
+          }
+          if (!msg || typeof msg !== "object") continue;
+          const validSchema = (typeof msg.id === "undefined" || typeof msg.id === "number") && (typeof msg.action === "string" || typeof msg.action === "undefined") && (typeof msg.command === "string" || typeof msg.command === "undefined") && (typeof msg.message === "string" || typeof msg.message === "undefined") && (typeof msg.data === "object" || typeof msg.data === "undefined" || msg.data === null);
+          if (!validSchema) {
+            this.logger?.warn?.("Message failed schema validation \u2014 ignoring");
+            continue;
+          }
+          this._handleMessage(msg);
+        }
+      });
+    } else {
+      console.log("ScriptDBClient _setupListeners: Setting up NDJSON data listener");
+      this.client.on("data", (chunk) => {
+        console.log("ScriptDBClient: Received data chunk, length:", chunk.length);
+        if (!Buffer.isBuffer(chunk)) {
+          try {
+            chunk = Buffer.from(chunk);
+          } catch (e) {
+            return;
+          }
+        }
+        const idxLastNewline = chunk.indexOf(10);
+        if (this.buffer.length === 0 && idxLastNewline === chunk.length - 1) {
+          let start = 0;
+          let idx2;
+          while ((idx2 = chunk.indexOf(10, start)) !== -1) {
+            const lineBuf = chunk.slice(start, idx2);
+            start = idx2 + 1;
+            if (lineBuf.length === 0) continue;
+            let msg;
+            try {
+              msg = JSON.parse(lineBuf.toString("utf8"));
+            } catch (e) {
+              this.logger?.error?.(
+                "Invalid JSON from server",
+                e && e.message ? e.message : e
+              );
+              continue;
+            }
+            if (!msg || typeof msg !== "object") continue;
+            const validSchema = (typeof msg.id === "undefined" || typeof msg.id === "number") && (typeof msg.action === "string" || typeof msg.action === "undefined") && (typeof msg.command === "string" || typeof msg.command === "undefined") && (typeof msg.message === "string" || typeof msg.message === "undefined");
+            if (!validSchema) continue;
+            this._handleMessage(msg);
+          }
+          return;
+        }
+        this.buffer = Buffer.concat([this.buffer, chunk]);
+        if (this.buffer.length > this.maxMessageSize) {
+          this.logger?.error?.(
+            "Incoming message exceeds maxMessageSize \u2014 closing connection"
+          );
+          try {
+            this.client?.destroy();
+          } catch (e) {
+          }
+          return;
+        }
+        let idx;
+        while ((idx = this.buffer.indexOf(10)) !== -1) {
+          const lineBuf = this.buffer.slice(0, idx);
+          this.buffer = this.buffer.slice(idx + 1);
+          if (lineBuf.length === 0) continue;
+          let msg;
+          try {
+            msg = JSON.parse(lineBuf.toString("utf8"));
+          } catch (e) {
+            this.logger?.error?.(
+              "Invalid JSON from server",
+              e && e.message ? e.message : e
+            );
+            continue;
+          }
+          const validSchema = (typeof msg.id === "undefined" || typeof msg.id === "number") && (typeof msg.action === "string" || typeof msg.action === "undefined") && (typeof msg.command === "string" || typeof msg.command === "undefined") && (typeof msg.message === "string" || typeof msg.message === "undefined");
+          if (!validSchema) {
+            this.logger?.warn?.("Message failed schema validation \u2014 ignoring");
+            continue;
+          }
+          this._handleMessage(msg);
+        }
+      });
+    }
+  }
+  // build the final buffer for sending using current token and signing settings
+  _buildFinalBuffer(payloadBase, id) {
+    const payloadObj = Object.assign(
+      { id, action: payloadBase.action },
+      payloadBase.data !== void 0 ? { data: payloadBase.data } : {}
+    );
+    if (this.token) payloadObj.token = this.token;
+    const payloadStr = this._stringify(payloadObj);
+    if (this.signing && this.signing.secret) {
+      const hmac = crypto2.createHmac(
+        this.signing.algorithm || "sha256",
+        this.signing.secret
+      );
+      hmac.update(payloadStr);
+      const sig = hmac.digest("hex");
+      const envelope = { id, signature: sig, payload: payloadObj };
+      const envelopeStr = this._stringify(envelope);
+      if (this.frame === "length-prefix") {
+        const body = Buffer.from(envelopeStr, "utf8");
+        const buf = Buffer.allocUnsafe(4 + body.length);
+        buf.writeUInt32BE(body.length, 0);
+        body.copy(buf, 4);
+        return buf;
+      }
+      return Buffer.from(envelopeStr + "\n", "utf8");
+    }
+    if (this.frame === "length-prefix") {
+      const body = Buffer.from(payloadStr, "utf8");
+      const buf = Buffer.allocUnsafe(4 + body.length);
+      buf.writeUInt32BE(body.length, 0);
+      body.copy(buf, 4);
+      return buf;
+    }
+    return Buffer.from(payloadStr + "\n", "utf8");
+  }
+  _handleMessage(msg) {
+    console.log("ScriptDBClient _handleMessage:", JSON.stringify(msg));
+    console.log("ScriptDBClient _handleMessage msg.id:", msg.id, "msg.action:", msg.action, "msg.command:", msg.command, "msg.message:", msg.message);
+    if (msg && typeof msg.id !== "undefined") {
+      console.log("Handling message with id:", msg.id, "action:", msg.action, "message:", msg.message);
+      const pending = this._pending.get(msg.id);
+      if (!pending) {
+        console.log("No pending request for id", msg.id, "pending map size:", this._pending.size);
+        this.logger?.debug?.("No pending request for id", msg.id);
+        return;
+      }
+      const { resolve: resolve2, reject, timer } = pending;
+      if (timer) clearTimeout(timer);
+      this._pending.delete(msg.id);
+      this._processQueue();
+      if (msg.action === "login" || msg.command === "login") {
+        console.log("Processing login response with id");
+        if (msg.message === "AUTH OK") {
+          console.log("AUTH OK - setting token and resolving");
+          this.token = msg.data && msg.data.token ? msg.data.token : null;
+          this._resolveReady(null);
+          return resolve2(msg.data);
+        } else {
+          console.log("AUTH FAILED:", msg.data);
+          this._rejectReady(new Error("Authentication failed"));
+          const errorMsg = msg.data || "Authentication failed";
+          try {
+            this.client?.end();
+          } catch (e) {
+          }
+          return reject(new Error(typeof errorMsg === "string" ? errorMsg : "Authentication failed"));
+        }
+      }
+      if ((msg.action === "script-code" || msg.command === "script-code") && msg.message === "OK")
+        return resolve2(msg.data);
+      if ((msg.action === "script-code" || msg.command === "script-code") && msg.message === "ERROR")
+        return reject(new Error(typeof msg.data === "string" ? msg.data : "Server returned ERROR"));
+      if (msg.action === "create-db" && msg.message === "SUCCESS")
+        return resolve2(msg.data);
+      if (msg.action === "create-db" && msg.message === "ERROR")
+        return reject(new Error(typeof msg.data === "string" ? msg.data : "Failed to create database"));
+      if (msg.message === "OK" || msg.message === "SUCCESS") {
+        return resolve2(msg.data);
+      } else if (msg.message === "ERROR") {
+        return reject(new Error(typeof msg.data === "string" ? msg.data : "Request failed"));
+      }
+      return reject(new Error("Invalid response from server"));
+    }
+    console.log("Unhandled message:", msg);
+    this.logger?.debug?.("Unhandled message from server", this._mask(msg));
+  }
+  authenticate() {
+    if (this._authenticating)
+      return Promise.reject(new Error("Already authenticating"));
+    this._authenticating = true;
+    return new Promise((resolve2, reject) => {
+      const id = this._nextId++;
+      const payload = {
+        id,
+        action: "login",
+        data: { username: this.username, password: this.password }
+      };
+      let timer = null;
+      if (this.requestTimeout > 0) {
+        timer = setTimeout(() => {
+          this._pending.delete(id);
+          this._authenticating = false;
+          reject(new Error("Auth timeout"));
+          this.close();
+        }, this.requestTimeout);
+      }
+      this._pending.set(id, {
+        resolve: (data) => {
+          if (timer) clearTimeout(timer);
+          this._authenticating = false;
+          if (data && data.token) this.token = data.token;
+          resolve2(data);
+        },
+        reject: (err) => {
+          if (timer) clearTimeout(timer);
+          this._authenticating = false;
+          reject(err);
+        },
+        timer
+      });
+      try {
+        const buf = Buffer.from(JSON.stringify(payload) + "\n", "utf8");
+        this._write(buf).catch((err) => {
+          if (timer) clearTimeout(timer);
+          this._pending.delete(id);
+          this._authenticating = false;
+          reject(err);
+        });
+      } catch (e) {
+        clearTimeout(timer);
+        this._pending.delete(id);
+        this._authenticating = false;
+        reject(e);
+      }
+    }).then((data) => {
+      if (data && data.token) {
+        this.token = data.token;
+        this._resolveReady(null);
+      }
+      return data;
+    }).catch((err) => {
+      this._rejectReady(err);
+      throw err;
+    });
+  }
+  // internal write helper that respects backpressure
+  _write(buf) {
+    return new Promise((resolve2, reject) => {
+      if (!this.client || !this._connected)
+        return reject(new Error("Not connected"));
+      try {
+        const ok = this.client.write(buf, (err) => {
+          if (err) return reject(err);
+          resolve2(void 0);
+        });
+        if (!ok) {
+          this.client.once("drain", () => resolve2(void 0));
+        }
+      } catch (e) {
+        reject(e);
+      }
+    });
+  }
+  async _processQueue() {
+    while (this._pending.size < this._maxPending && this._pendingQueue.length > 0) {
+      const item = this._pendingQueue.shift();
+      const { payloadBase, id, resolve: resolve2, reject, timer } = item;
+      if (this.tokenExpiry && Date.now() >= this.tokenExpiry) {
+        const refreshed = await this._maybeRefreshToken();
+        if (!refreshed) {
+          clearTimeout(timer);
+          try {
+            reject(new Error("Token expired and refresh failed"));
+          } catch (e) {
+          }
+          continue;
+        }
+      }
+      let buf;
+      try {
+        buf = this._buildFinalBuffer(payloadBase, id);
+      } catch (e) {
+        clearTimeout(timer);
+        try {
+          reject(e);
+        } catch (er) {
+        }
+        continue;
+      }
+      this._pending.set(id, { resolve: resolve2, reject, timer });
+      try {
+        await this._write(buf);
+      } catch (e) {
+        clearTimeout(timer);
+        this._pending.delete(id);
+        try {
+          reject(e);
+        } catch (er) {
+        }
+      }
+    }
+  }
+  /**
+   * Execute a command. Supports concurrent requests via request id mapping.
+   * Returns a Promise resolved with response.data or rejected on ERROR/timeout.
+   */
+  async execute(payload) {
+    try {
+      await this.ready;
+    } catch (err) {
+      throw new Error(
+        "Not authenticated: " + (err && err.message ? err.message : err)
+      );
+    }
+    if (!this.token) throw new Error("Not authenticated");
+    const id = this._nextId++;
+    const payloadBase = { action: payload.action, data: payload.data };
+    if (this.tokenExpiry && Date.now() >= this.tokenExpiry) {
+      const refreshed = await this._maybeRefreshToken();
+      if (!refreshed) throw new Error("Token expired");
+    }
+    return new Promise((resolve2, reject) => {
+      let timer = null;
+      if (this.requestTimeout > 0) {
+        timer = setTimeout(() => {
+          if (this._pending.has(id)) {
+            this._pending.delete(id);
+            reject(new Error("Request timeout"));
+          }
+        }, this.requestTimeout);
+      }
+      if (this._pending.size >= this._maxPending) {
+        if (this._pendingQueue.length >= this._maxQueue) {
+          if (timer) clearTimeout(timer);
+          return reject(new Error("Pending queue full"));
+        }
+        this._pendingQueue.push({ payloadBase, id, resolve: resolve2, reject, timer });
+        this._processQueue().catch(() => {
+        });
+        return;
+      }
+      let finalBuf;
+      try {
+        finalBuf = this._buildFinalBuffer(payloadBase, id);
+      } catch (e) {
+        clearTimeout(timer);
+        return reject(e);
+      }
+      this._pending.set(id, { resolve: resolve2, reject, timer });
+      this._write(finalBuf).catch((e) => {
+        if (timer) clearTimeout(timer);
+        this._pending.delete(id);
+        reject(e);
+      });
+    });
+  }
+  /**
+   * Attempt to refresh token using provided tokenRefresh option if token expired.
+   * options.tokenRefresh should be async function that returns { token, expiresAt }
+   */
+  async _maybeRefreshToken() {
+    if (!this.options.tokenRefresh || typeof this.options.tokenRefresh !== "function")
+      return false;
+    try {
+      const res = await this.options.tokenRefresh();
+      if (res && res.token) {
+        this.token = res.token;
+        if (res.expiresAt) this.tokenExpiry = res.expiresAt;
+        return true;
+      }
+    } catch (e) {
+      this.logger?.error?.(
+        "Token refresh failed",
+        e && e.message ? e.message : String(e)
+      );
+    }
+    return false;
+  }
+  destroy() {
+    this._destroyed = true;
+    if (this._reconnectTimer) {
+      clearTimeout(this._reconnectTimer);
+      this._reconnectTimer = null;
+    }
+    this._rejectReady(new Error("Client destroyed"));
+    this._pending.forEach((pending, id) => {
+      if (pending.timer) clearTimeout(pending.timer);
+      try {
+        pending.reject(new Error("Client destroyed"));
+      } catch (e) {
+      }
+      this._pending.delete(id);
+    });
+    this._pendingQueue = [];
+    try {
+      if (this.client) this.client.destroy();
+    } catch (e) {
+    }
+    this.client = null;
+  }
+  _handleDisconnect(err) {
+    if (!this._connected && !this._authenticating) {
+      return;
+    }
+    const wasAuthenticating = this._authenticating;
+    this._pending.forEach((pending, id) => {
+      if (pending.timer) clearTimeout(pending.timer);
+      const errorMsg = wasAuthenticating ? "Authentication failed - credentials may be required" : err && err.message ? err.message : "Disconnected";
+      process.nextTick(() => {
+        try {
+          pending.reject(new Error(errorMsg));
+        } catch (e) {
+        }
+      });
+      this._pending.delete(id);
+    });
+    this._connected = false;
+    this._connecting = null;
+    this._authenticating = false;
+    if (wasAuthenticating && this.retries === 0) {
+      const rejectErr = err || new Error("Authentication failed and no retries configured");
+      try {
+        this._rejectReady(rejectErr);
+      } catch (e) {
+      }
+      return;
+    }
+    if (this._currentRetries < this.retries) {
+      this._createReady();
+      const base = Math.min(
+        this.retryDelay * Math.pow(2, this._currentRetries),
+        3e4
+      );
+      const jitter = Math.floor(Math.random() * Math.min(1e3, base));
+      const delay = base + jitter;
+      this._currentRetries += 1;
+      this.logger?.info?.(
+        "Attempting reconnect in " + delay + "ms (attempt " + this._currentRetries + ")"
+      );
+      this.token = null;
+      setTimeout(() => {
+        this.connect().catch((e) => {
+          this.logger?.error?.("Reconnect failed", e && e.message ? e.message : e);
+        });
+      }, delay);
+    } else {
+      try {
+        this._rejectReady(err || new Error("Disconnected and no retries left"));
+      } catch (e) {
+      }
+    }
+  }
+  close() {
+    if (!this.client) return;
+    try {
+      this.client.removeAllListeners("data");
+      this.client.removeAllListeners("error");
+      this.client.removeAllListeners("close");
+      this.client.end();
+    } catch (e) {
+    }
+    this.client = null;
+  }
+  /**
+   * Disconnect (alias for close)
+   */
+  disconnect() {
+    this.close();
+  }
+  /**
+   * Send request helper (for public API methods)
+   */
+  async sendRequest(action, data = {}) {
+    return this.execute({ action, data });
+  }
+  // ========== Public API Methods ==========
+  /**
+   * Login with username and password
+   */
+  async login(username, password) {
+    return this.sendRequest("login", { username, password });
+  }
+  /**
+   * Logout from server
+   */
+  async logout() {
+    return this.sendRequest("logout", {});
+  }
+  /**
+   * List all databases
+   */
+  async listDatabases() {
+    return this.sendRequest("list-dbs", {});
+  }
+  /**
+   * Create a new database
+   */
+  async createDatabase(name) {
+    return this.sendRequest("create-db", { databaseName: name });
+  }
+  /**
+   * Remove a database
+   */
+  async removeDatabase(name) {
+    return this.sendRequest("remove-db", { databaseName: name });
+  }
+  /**
+   * Rename a database
+   */
+  async renameDatabase(oldName, newName) {
+    return this.sendRequest("rename-db", { databaseName: oldName, newName });
+  }
+  /**
+   * Execute code in a database
+   */
+  async run(code, databaseName) {
+    return this.sendRequest("script-code", { code, databaseName });
+  }
+  /**
+   * Save a database to disk
+   */
+  async saveDatabase(databaseName) {
+    return this.sendRequest("save-db", { databaseName });
+  }
+  /**
+   * Update database metadata
+   */
+  async updateDatabase(databaseName, data) {
+    return this.sendRequest("update-db", { databaseName, ...data });
+  }
+  /**
+   * Get server information
+   */
+  async getInfo() {
+    return this.sendRequest("get-info", {});
+  }
+  /**
+   * Execute shell command on server
+   */
+  async executeShell(command) {
+    return this.sendRequest("shell-command", { command });
+  }
+};
+var src_default = ScriptDBClient;
+
+// src/wsProxy.ts
+import { exec } from "child_process";
+import { promisify } from "util";
+var execPromise = promisify(exec);
+var noopLogger2 = {
+  debug: () => {
+  },
+  info: () => {
+  },
+  warn: () => {
+  },
+  error: () => {
+  }
+};
+var WebSocketProxy = class {
+  constructor(options) {
+    this.wss = null;
+    this.sessions = /* @__PURE__ */ new Map();
+    this.options = options;
+    this.logger = options.logger || noopLogger2;
+  }
+  /**
+   * Start the WebSocket proxy server
+   */
+  start() {
+    return new Promise((resolve2, reject) => {
+      try {
+        this.wss = new WebSocketServer({ port: this.options.wsPort });
+        this.wss.on("listening", () => {
+          this.logger.info?.(`WebSocket proxy listening on port ${this.options.wsPort}`);
+          resolve2();
+        });
+        this.wss.on("error", (error) => {
+          this.logger.error?.("WebSocket server error:", error);
+          reject(error);
+        });
+        this.wss.on("connection", (ws) => {
+          this.handleConnection(ws);
+        });
+      } catch (error) {
+        reject(error);
+      }
+    });
+  }
+  /**
+   * Handle new WebSocket connection
+   */
+  handleConnection(ws) {
+    this.logger.info?.("New WebSocket connection");
+    const session = {
+      ws,
+      client: null,
+      authenticated: false
+    };
+    this.sessions.set(ws, session);
+    ws.on("message", async (data) => {
+      await this.handleMessage(session, data);
+    });
+    ws.on("close", () => {
+      this.handleClose(session);
+    });
+    ws.on("error", (error) => {
+      this.logger.error?.("WebSocket error:", error);
+      this.handleClose(session);
+    });
+  }
+  /**
+   * Handle incoming message from browser
+   */
+  async handleMessage(session, data) {
+    try {
+      const message = JSON.parse(data.toString());
+      const { id, action, data: payload } = message;
+      if (action === "login") {
+        await this.handleLogin(session, id, payload);
+        return;
+      }
+      if (!session.authenticated || !session.client) {
+        this.sendError(session.ws, id, "Not authenticated");
+        return;
+      }
+      await this.forwardAction(session, id, action, payload);
+    } catch (error) {
+      this.logger.error?.("Error handling message:", error);
+      this.sendError(session.ws, void 0, error.message);
+    }
+  }
+  /**
+   * Handle login action
+   */
+  async handleLogin(session, id, payload) {
+    try {
+      const { username, password, secure: clientSecure } = payload;
+      const serverSecure = this.options.secure !== void 0 ? this.options.secure : false;
+      console.log("Login validation:", { clientSecure, serverSecure, username: username || "(empty)" });
+      if (clientSecure !== void 0 && clientSecure !== serverSecure) {
+        const errorMsg = serverSecure ? 'Server is in secure mode (secure: true). Please uncheck "Anonymous Connection" and provide credentials.' : 'Server is in non-secure mode (secure: false). Please check "Anonymous Connection".';
+        this.logger.warn?.("Secure mode mismatch:", { clientSecure, serverSecure });
+        throw new Error(errorMsg);
+      }
+      let uri;
+      if (username && username !== "") {
+        uri = `scriptdb://${username}:${password || ""}@${this.options.scriptdbHost}:${this.options.scriptdbPort}`;
+      } else {
+        uri = `scriptdb://${this.options.scriptdbHost}:${this.options.scriptdbPort}`;
+      }
+      this.logger.info?.("Creating ScriptDB client with URI:", uri.replace(/:[^:@]+@/, ":****@"));
+      const client = new src_default(uri, {
+        secure: false,
+        // Always use plain TCP (secure option controls authentication, not transport)
+        logger: this.logger,
+        requestTimeout: 0,
+        // Disable timeout - let browser handle it
+        retries: 0
+        // No retries in proxy
+      });
+      console.log("Connecting to ScriptDB server...");
+      this.logger.info?.("Connecting to ScriptDB server...");
+      const connectStartTime = Date.now();
+      await client.connect().catch((err) => {
+        throw err;
+      });
+      const connectDuration = Date.now() - connectStartTime;
+      console.log(`ScriptDB client connected and authenticated in ${connectDuration}ms`);
+      this.logger.info?.("ScriptDB client connected and authenticated");
+      session.client = client;
+      session.authenticated = true;
+      console.log("Sending AUTH OK to browser with id:", id);
+      this.logger.info?.("Sending AUTH OK to browser");
+      this.sendResponse(session.ws, id, "login", "AUTH OK", { token: "proxy-session" });
+      console.log("AUTH OK sent to browser");
+    } catch (error) {
+      this.logger.error?.("Login failed:", error);
+      this.sendResponse(session.ws, id, "login", "AUTH FAILED", error.message);
+      if (session.client) {
+        try {
+          session.client.destroy();
+        } catch (e) {
+        }
+        session.client = null;
+      }
+      this.sessions.delete(session.ws);
+      session.ws.close();
+    }
+  }
+  /**
+   * Forward action to ScriptDB client
+   */
+  async forwardAction(session, id, action, payload) {
+    try {
+      console.log("Forwarding action:", action, "payload:", payload);
+      const client = session.client;
+      let result;
+      switch (action) {
+        case "logout":
+          console.log("Executing logout");
+          result = await client.execute({ action: "logout" });
+          session.authenticated = false;
+          session.client = null;
+          break;
+        case "list-dbs":
+          console.log("Executing list-dbs");
+          result = await client.execute({ action: "list-dbs" });
+          console.log("list-dbs result:", result);
+          break;
+        case "create-db":
+          result = await client.execute({
+            action: "create-db",
+            data: { databaseName: payload.databaseName }
+          });
+          break;
+        case "remove-db":
+          result = await client.execute({
+            action: "remove-db",
+            data: { databaseName: payload.databaseName }
+          });
+          break;
+        case "rename-db":
+          result = await client.execute({
+            action: "rename-db",
+            data: {
+              databaseName: payload.databaseName,
+              newName: payload.newName
+            }
+          });
+          break;
+        case "script-code":
+          console.log("wsProxy: executing script-code");
+          result = await client.execute({
+            action: "script-code",
+            data: {
+              code: payload.code,
+              databaseName: payload.databaseName
+            }
+          });
+          console.log("wsProxy: script-code result:", result);
+          break;
+        case "save-db":
+          result = await client.execute({
+            action: "save-db",
+            data: { databaseName: payload.databaseName }
+          });
+          break;
+        case "update-db":
+          result = await client.execute({
+            action: "update-db",
+            data: payload
+          });
+          break;
+        case "get-info":
+          result = await client.execute({ action: "get-info" });
+          break;
+        case "get-db":
+          result = await client.execute({
+            action: "get-db",
+            data: { databaseName: payload.databaseName }
+          });
+          break;
+        case "shell-command":
+          result = await this.executeShellCommand(payload.command);
+          break;
+        default:
+          throw new Error(`Unknown action: ${action}`);
+      }
+      this.sendResponse(session.ws, id, action, "OK", result);
+    } catch (error) {
+      this.logger.error?.(`Error executing ${action}:`, error);
+      this.sendResponse(session.ws, id, action, "ERROR", error.message);
+    }
+  }
+  /**
+   * Send response to browser
+   */
+  sendResponse(ws, id, action, message, data) {
+    if (!ws || ws.readyState !== WebSocket.OPEN) {
+      console.error("Cannot send response - WebSocket not ready:", {
+        exists: !!ws,
+        readyState: ws?.readyState,
+        expectedState: WebSocket.OPEN
+      });
+      this.logger.error?.("Cannot send response: WebSocket not ready");
+      return;
+    }
+    const response = {
+      id,
+      action,
+      message,
+      data
+    };
+    console.log("Sending response to browser:", response);
+    this.logger.info?.("Sending response to browser:", { id, action, message });
+    try {
+      ws.send(JSON.stringify(response));
+      console.log("Response sent successfully via ws.send()");
+      this.logger.info?.("Response sent successfully");
+    } catch (error) {
+      console.error("Failed to send response:", error);
+      this.logger.error?.("Failed to send response:", error);
+    }
+  }
+  /**
+   * Send error to browser
+   */
+  sendError(ws, id, error) {
+    this.sendResponse(ws, id, "error", "ERROR", error);
+  }
+  /**
+   * Execute shell command
+   */
+  async executeShellCommand(command) {
+    try {
+      this.logger.info?.(`Executing shell command: ${command}`);
+      if (command.length > 1e3) {
+        throw new Error("Command too long");
+      }
+      const { stdout, stderr } = await execPromise(command, {
+        timeout: 3e4,
+        // 30 second timeout
+        maxBuffer: 1024 * 1024,
+        // 1MB buffer
+        cwd: process.cwd()
+      });
+      return {
+        stdout: stdout || "",
+        stderr: stderr || ""
+      };
+    } catch (error) {
+      this.logger.error?.("Shell command failed:", error);
+      return {
+        stdout: "",
+        stderr: error.message || String(error)
+      };
+    }
+  }
+  /**
+   * Handle connection close
+   */
+  handleClose(session) {
+    this.logger.info?.("WebSocket connection closed");
+    if (session.client) {
+      try {
+        session.client.destroy();
+      } catch (error) {
+        this.logger.error?.("Error destroying client:", error);
+      }
+      session.client = null;
+    }
+    this.sessions.delete(session.ws);
+  }
+  /**
+   * Stop the WebSocket proxy server
+   */
+  async stop() {
+    return new Promise((resolve2) => {
+      this.sessions.forEach((session) => {
+        if (session.client) {
+          try {
+            session.client.destroy();
+          } catch (error) {
+            this.logger.error?.("Error destroying client:", error);
+          }
+        }
+        session.ws.close();
+      });
+      this.sessions.clear();
+      if (this.wss) {
+        this.wss.close(() => {
+          this.logger.info?.("WebSocket proxy stopped");
+          resolve2();
+        });
+      } else {
+        resolve2();
+      }
+    });
+  }
+};
+async function createWebSocketProxy(options) {
+  const proxy = new WebSocketProxy(options);
+  await proxy.start();
+  return proxy;
+}
+
+// src/index.ts
+import SystemModuleResolver from "@scriptdb/system-modules";
+function exitWithError(message, err) {
+  console.error(message);
+  if (err) console.error(err);
+  process.exit(1);
+}
+async function server() {
+  let basePath = path3.join(getHomeDir(), ".scriptdb");
+  try {
+    console.log("Setting up scriptdb directory...");
+    await setupDir();
+    console.log("Setup complete");
+  } catch (err) {
+    exitWithError("Failed to setup scriptdb directory", err);
+  }
+  console.log("Loading configuration...");
+  let config = {
+    host: "localhost",
+    port: 1234,
+    users: [
+      {
+        username: "",
+        password: void 0
+      }
+    ],
+    folder: "databases",
+    secure: false
+  };
+  const configPath = path3.join(basePath, "config.json");
+  if (fs4.existsSync(configPath)) {
+    try {
+      const fileContent = fs4.readFileSync(configPath, "utf8");
+      const parsed = JSON.parse(fileContent);
+      if (parsed && typeof parsed === "object") {
+        const parsedConfig = parsed;
+        const allowed = {};
+        if (typeof parsedConfig.host === "string") allowed.host = parsedConfig.host;
+        if (parsedConfig.port !== void 0) allowed.port = parsedConfig.port;
+        if (parsedConfig.users !== void 0) {
+          if (Array.isArray(parsedConfig.users)) {
+            if (parsedConfig.users.length === 0) {
+              allowed.users = [];
+            } else if (typeof parsedConfig.users[0] === "string") {
+              allowed.users = parsedConfig.users.map((username) => ({
+                username,
+                password: "",
+                hash: false
+              }));
+            } else {
+              allowed.users = parsedConfig.users;
+            }
+          } else {
+            allowed.users = [parsedConfig.users];
+          }
+        }
+        if (typeof parsedConfig.folder === "string") allowed.folder = parsedConfig.folder;
+        if (typeof parsedConfig.secure === "boolean") allowed.secure = parsedConfig.secure;
+        config = { ...config, ...allowed };
+      } else {
+        console.warn("config.json parsed to a non-object, ignoring");
+      }
+    } catch (err) {
+      console.warn("Failed to read/parse config.json, using defaults:", err);
+    }
+  }
+  if (typeof config.port === "string") {
+    const p = parseInt(config.port, 10);
+    if (!Number.isNaN(p)) config.port = p;
+  }
+  if (!Number.isFinite(config.port)) config.port = 1234;
+  if (config.port < 1 || config.port > 65535) {
+    console.warn("Configured port out of range, falling back to 1234");
+    config.port = 1234;
+  }
+  if (!Array.isArray(config.users)) {
+    if (config.users && typeof config.users === "object") config.users = [config.users];
+    else config.users = [{ username: "", password: void 0 }];
+  }
+  config.users = config.users.map((u) => {
+    if (!u) return { username: "", password: void 0 };
+    if (typeof u === "string") return { username: u, password: void 0 };
+    if (typeof u === "object") {
+      return {
+        username: typeof u.username === "string" ? u.username : "",
+        password: typeof u.password === "string" ? u.password : void 0,
+        hash: typeof u.hash === "boolean" ? u.hash : void 0,
+        algorithm: u.algorithm === "bcrypt" || u.algorithm === "sha256" || u.algorithm === "sha512" ? u.algorithm : void 0
+      };
+    }
+    return { username: "", password: void 0 };
+  });
+  const baseDir = path3.resolve(basePath, String(config.folder || "databases"));
+  const pluginDir = path3.resolve(basePath, "plugins");
+  try {
+    if (!fs4.existsSync(baseDir)) {
+      fs4.mkdirSync(baseDir, { recursive: true });
+      console.log(`Created folder for databases at ${baseDir}`);
+    } else if (!fs4.statSync(baseDir).isDirectory()) {
+      exitWithError(`Configured folder exists but is not a directory: ${baseDir}`);
+    }
+  } catch (err) {
+    exitWithError("Failed to ensure database folder exists", err);
+  }
+  let vm;
+  try {
+    vm = new VM({ language: "ts", registerModules: {} });
+    console.log("Loading databases and plugins into VM...");
+    const systemModules = await SystemModuleResolver();
+    vm.register(systemModules);
+    console.log("VM initialized with databases and plugins");
+  } catch (err) {
+    exitWithError("Failed to initialize VM", err);
+  }
+  let storage = null;
+  try {
+    storage = new Storage2(baseDir, basePath);
+    await storage.initialize();
+    console.log(`Storage initialized at ${baseDir} (git at ${basePath})`);
+  } catch (err) {
+    exitWithError("Failed to initialize Storage", err);
+  }
+  if (!storage) {
+    exitWithError("Storage was not initialized");
+  }
+  let scriptDBServer;
+  try {
+    scriptDBServer = new Protocal({
+      host: config.host,
+      port: config.port,
+      users: config.users,
+      vm,
+      storage
+    });
+    if (typeof scriptDBServer.start !== "function") {
+      exitWithError("Protocal.start is not a function");
+    }
+    scriptDBServer.start();
+    console.log(`ScriptDB server started on ${config.host}:${config.port}`);
+  } catch (err) {
+    exitWithError("Failed to start Protocal", err);
+  }
+  try {
+    const wsPort = config.port + 1;
+    await createWebSocketProxy({
+      wsPort,
+      scriptdbHost: config.host,
+      scriptdbPort: config.port,
+      secure: config.secure !== void 0 ? config.secure : false,
+      logger: {
+        debug: console.log,
+        info: console.log,
+        warn: console.warn,
+        error: console.error
+      }
+    });
+    console.log(`WebSocket proxy started on port ${wsPort}`);
+  } catch (err) {
+    console.warn("Failed to start WebSocket proxy (browser support disabled)", err);
+  }
+}
+var index_default = server;
+export {
+  index_default as default,
+  server
+};
+//# sourceMappingURL=index.mjs.map