@topgunbuild/server 0.1.0

package/dist/index.mjs

@@ -0,0 +1,2872 @@
+// src/ServerCoordinator.ts
+import { createServer as createHttpServer } from "http";
+import { createServer as createHttpsServer } from "https";
+import { readFileSync as readFileSync2 } from "fs";
+import { WebSocketServer as WebSocketServer2, WebSocket as WebSocket2 } from "ws";
+import { HLC, LWWMap as LWWMap2, ORMap as ORMap2, serialize as serialize2, deserialize, MessageSchema } from "@topgunbuild/core";
+import * as jwt from "jsonwebtoken";
+import * as crypto from "crypto";
+
+// src/query/Matcher.ts
+import { evaluatePredicate } from "@topgunbuild/core";
+function matchesQuery(record, query) {
+  const data = record.value;
+  if (!data) return false;
+  if (record.ttlMs) {
+    const now = Date.now();
+    if (record.timestamp.millis + record.ttlMs < now) {
+      return false;
+    }
+  }
+  if (query.predicate) {
+    return evaluatePredicate(query.predicate, data);
+  }
+  if (!query.where) return true;
+  for (const [field, expected] of Object.entries(query.where)) {
+    const actual = data[field];
+    if (typeof expected === "object" && expected !== null && !Array.isArray(expected)) {
+      for (const [op, opValueRaw] of Object.entries(expected)) {
+        const opValue = opValueRaw;
+        switch (op) {
+          case "$gt":
+            if (!(actual > opValue)) return false;
+            break;
+          case "$gte":
+            if (!(actual >= opValue)) return false;
+            break;
+          case "$lt":
+            if (!(actual < opValue)) return false;
+            break;
+          case "$lte":
+            if (!(actual <= opValue)) return false;
+            break;
+          case "$ne":
+            if (!(actual !== opValue)) return false;
+            break;
+          // Add more operators as needed ($in, etc.)
+          default:
+            return false;
+        }
+      }
+    } else {
+      if (actual !== expected) {
+        return false;
+      }
+    }
+  }
+  return true;
+}
+function executeQuery(records, query) {
+  if (!query) {
+    query = {};
+  }
+  let results = [];
+  if (records instanceof Map) {
+    for (const [key, record] of records) {
+      if (matchesQuery(record, query)) {
+        results.push({ key, record });
+      }
+    }
+  } else {
+    for (const record of records) {
+      if (matchesQuery(record, query)) {
+        results.push({ key: "?", record });
+      }
+    }
+  }
+  if (query.sort) {
+    results.sort((a, b) => {
+      for (const [field, direction] of Object.entries(query.sort)) {
+        const valA = a.record.value[field];
+        const valB = b.record.value[field];
+        if (valA < valB) return direction === "asc" ? -1 : 1;
+        if (valA > valB) return direction === "asc" ? 1 : -1;
+      }
+      return 0;
+    });
+  }
+  if (query.offset || query.limit) {
+    const offset = query.offset || 0;
+    const limit = query.limit || results.length;
+    results = results.slice(offset, offset + limit);
+  }
+  return results.map((r) => ({ key: r.key, value: r.record.value }));
+}
+
+// src/query/QueryRegistry.ts
+import { serialize } from "@topgunbuild/core";
+
+// src/utils/logger.ts
+import pino from "pino";
+var logLevel = process.env.LOG_LEVEL || "info";
+var logger = pino({
+  level: logLevel,
+  transport: process.env.NODE_ENV !== "production" ? {
+    target: "pino-pretty",
+    options: {
+      colorize: true,
+      translateTime: "SYS:standard",
+      ignore: "pid,hostname"
+    }
+  } : void 0,
+  formatters: {
+    level: (label) => {
+      return { level: label };
+    }
+  }
+});
+
+// src/query/QueryRegistry.ts
+var ReverseQueryIndex = class {
+  constructor() {
+    // field -> value -> Set<Subscription>
+    this.equality = /* @__PURE__ */ new Map();
+    // field -> Set<Subscription>
+    this.interest = /* @__PURE__ */ new Map();
+    // catch-all
+    this.wildcard = /* @__PURE__ */ new Set();
+  }
+  add(sub) {
+    const query = sub.query;
+    let indexed = false;
+    const cleanupFns = [];
+    if (query.where) {
+      for (const [field, value] of Object.entries(query.where)) {
+        if (typeof value !== "object") {
+          this.addEquality(field, value, sub);
+          cleanupFns.push(() => this.removeEquality(field, value, sub));
+          indexed = true;
+        } else {
+          this.addInterest(field, sub);
+          cleanupFns.push(() => this.removeInterest(field, sub));
+          indexed = true;
+        }
+      }
+    }
+    if (query.predicate) {
+      const visit = (node) => {
+        if (node.op === "eq" && node.attribute && node.value !== void 0) {
+          this.addEquality(node.attribute, node.value, sub);
+          cleanupFns.push(() => this.removeEquality(node.attribute, node.value, sub));
+          indexed = true;
+        } else if (node.attribute) {
+          this.addInterest(node.attribute, sub);
+          cleanupFns.push(() => this.removeInterest(node.attribute, sub));
+          indexed = true;
+        }
+        if (node.children) {
+          node.children.forEach(visit);
+        }
+      };
+      visit(query.predicate);
+    }
+    if (query.sort) {
+      Object.keys(query.sort).forEach((k) => {
+        this.addInterest(k, sub);
+        cleanupFns.push(() => this.removeInterest(k, sub));
+        indexed = true;
+      });
+    }
+    if (!indexed) {
+      this.wildcard.add(sub);
+      cleanupFns.push(() => this.wildcard.delete(sub));
+    }
+    sub._cleanup = () => cleanupFns.forEach((fn) => fn());
+  }
+  remove(sub) {
+    if (sub._cleanup) {
+      sub._cleanup();
+      sub._cleanup = void 0;
+    }
+  }
+  getCandidates(changedFields, oldVal, newVal) {
+    const candidates = new Set(this.wildcard);
+    if (changedFields === "ALL") {
+      for (const set of this.interest.values()) {
+        for (const s of set) candidates.add(s);
+      }
+      for (const map of this.equality.values()) {
+        for (const set of map.values()) {
+          for (const s of set) candidates.add(s);
+        }
+      }
+      return candidates;
+    }
+    if (changedFields.size === 0) return candidates;
+    for (const field of changedFields) {
+      if (this.interest.has(field)) {
+        for (const sub of this.interest.get(field)) {
+          candidates.add(sub);
+        }
+      }
+      if (this.equality.has(field)) {
+        const valMap = this.equality.get(field);
+        if (newVal && newVal[field] !== void 0 && valMap.has(newVal[field])) {
+          for (const sub of valMap.get(newVal[field])) {
+            candidates.add(sub);
+          }
+        }
+        if (oldVal && oldVal[field] !== void 0 && valMap.has(oldVal[field])) {
+          for (const sub of valMap.get(oldVal[field])) {
+            candidates.add(sub);
+          }
+        }
+      }
+    }
+    return candidates;
+  }
+  addEquality(field, value, sub) {
+    if (!this.equality.has(field)) this.equality.set(field, /* @__PURE__ */ new Map());
+    const valMap = this.equality.get(field);
+    if (!valMap.has(value)) valMap.set(value, /* @__PURE__ */ new Set());
+    valMap.get(value).add(sub);
+  }
+  removeEquality(field, value, sub) {
+    const valMap = this.equality.get(field);
+    if (valMap) {
+      const set = valMap.get(value);
+      if (set) {
+        set.delete(sub);
+        if (set.size === 0) valMap.delete(value);
+      }
+      if (valMap.size === 0) this.equality.delete(field);
+    }
+  }
+  addInterest(field, sub) {
+    if (!this.interest.has(field)) this.interest.set(field, /* @__PURE__ */ new Set());
+    this.interest.get(field).add(sub);
+  }
+  removeInterest(field, sub) {
+    const set = this.interest.get(field);
+    if (set) {
+      set.delete(sub);
+      if (set.size === 0) this.interest.delete(field);
+    }
+  }
+};
+var QueryRegistry = class {
+  constructor() {
+    // MapName -> Set of Subscriptions (Legacy/Backup)
+    this.subscriptions = /* @__PURE__ */ new Map();
+    // MapName -> Reverse Index
+    this.indexes = /* @__PURE__ */ new Map();
+  }
+  register(sub) {
+    if (!this.subscriptions.has(sub.mapName)) {
+      this.subscriptions.set(sub.mapName, /* @__PURE__ */ new Set());
+      this.indexes.set(sub.mapName, new ReverseQueryIndex());
+    }
+    const interestedFields = this.analyzeQueryFields(sub.query);
+    sub.interestedFields = interestedFields;
+    this.subscriptions.get(sub.mapName).add(sub);
+    this.indexes.get(sub.mapName).add(sub);
+    logger.info({ clientId: sub.clientId, mapName: sub.mapName, query: sub.query }, "Client subscribed");
+  }
+  unregister(queryId) {
+    for (const [mapName, subs] of this.subscriptions) {
+      for (const sub of subs) {
+        if (sub.id === queryId) {
+          subs.delete(sub);
+          this.indexes.get(mapName)?.remove(sub);
+          return;
+        }
+      }
+    }
+  }
+  unsubscribeAll(clientId) {
+    for (const [mapName, subs] of this.subscriptions) {
+      for (const sub of subs) {
+        if (sub.clientId === clientId) {
+          subs.delete(sub);
+          this.indexes.get(mapName)?.remove(sub);
+        }
+      }
+    }
+  }
+  /**
+   * Refreshes all subscriptions for a given map.
+   * Useful when the map is bulk-loaded from storage.
+   */
+  refreshSubscriptions(mapName, map) {
+    const subs = this.subscriptions.get(mapName);
+    if (!subs || subs.size === 0) return;
+    const allRecords = this.getMapRecords(map);
+    for (const sub of subs) {
+      const newResults = executeQuery(allRecords, sub.query);
+      const newResultKeys = new Set(newResults.map((r) => r.key));
+      for (const key of sub.previousResultKeys) {
+        if (!newResultKeys.has(key)) {
+          this.sendUpdate(sub, key, null, "REMOVE");
+        }
+      }
+      for (const res of newResults) {
+        this.sendUpdate(sub, res.key, res.value, "UPDATE");
+      }
+      sub.previousResultKeys = newResultKeys;
+    }
+  }
+  getMapRecords(map) {
+    const recordsMap = /* @__PURE__ */ new Map();
+    const mapAny = map;
+    if (typeof mapAny.allKeys === "function" && typeof mapAny.getRecord === "function") {
+      for (const key of mapAny.allKeys()) {
+        const rec = mapAny.getRecord(key);
+        if (rec) {
+          recordsMap.set(key, rec);
+        }
+      }
+    } else if (mapAny.items instanceof Map && typeof mapAny.get === "function") {
+      const items = mapAny.items;
+      for (const key of items.keys()) {
+        const values = mapAny.get(key);
+        if (values.length > 0) {
+          recordsMap.set(key, { value: values });
+        }
+      }
+    }
+    return recordsMap;
+  }
+  /**
+   * Processes a record change for all relevant subscriptions.
+   * Calculates diffs and sends updates.
+   */
+  processChange(mapName, map, changeKey, changeRecord, oldRecord) {
+    const index = this.indexes.get(mapName);
+    if (!index) return;
+    const newVal = this.extractValue(changeRecord);
+    const oldVal = this.extractValue(oldRecord);
+    const changedFields = this.getChangedFields(oldVal, newVal);
+    if (changedFields !== "ALL" && changedFields.size === 0 && oldRecord && changeRecord) {
+      return;
+    }
+    const candidates = index.getCandidates(changedFields, oldVal, newVal);
+    if (candidates.size === 0) return;
+    let recordsMap = null;
+    const getRecordsMap = () => {
+      if (recordsMap) return recordsMap;
+      recordsMap = this.getMapRecords(map);
+      return recordsMap;
+    };
+    for (const sub of candidates) {
+      const dummyRecord = {
+        value: newVal,
+        timestamp: { millis: 0, counter: 0, nodeId: "" }
+        // Dummy timestamp for matchesQuery
+      };
+      const isMatch = matchesQuery(dummyRecord, sub.query);
+      const wasInResult = sub.previousResultKeys.has(changeKey);
+      if (!isMatch && !wasInResult) {
+        continue;
+      }
+      const allRecords = getRecordsMap();
+      const newResults = executeQuery(allRecords, sub.query);
+      const newResultKeys = new Set(newResults.map((r) => r.key));
+      for (const key of sub.previousResultKeys) {
+        if (!newResultKeys.has(key)) {
+          this.sendUpdate(sub, key, null, "REMOVE");
+        }
+      }
+      for (const res of newResults) {
+        const key = res.key;
+        const isNew = !sub.previousResultKeys.has(key);
+        if (key === changeKey) {
+          this.sendUpdate(sub, key, res.value, "UPDATE");
+        } else if (isNew) {
+          this.sendUpdate(sub, key, res.value, "UPDATE");
+        }
+      }
+      sub.previousResultKeys = newResultKeys;
+    }
+  }
+  extractValue(record) {
+    if (!record) return null;
+    if (Array.isArray(record)) {
+      return record.map((r) => r.value);
+    }
+    return record.value;
+  }
+  sendUpdate(sub, key, value, type) {
+    if (sub.socket.readyState === 1) {
+      sub.socket.send(serialize({
+        type: "QUERY_UPDATE",
+        payload: {
+          queryId: sub.id,
+          key,
+          value,
+          type
+        }
+      }));
+    }
+  }
+  analyzeQueryFields(query) {
+    const fields = /* @__PURE__ */ new Set();
+    try {
+      if (query.predicate) {
+        const extract = (node) => {
+          if (node.attribute) fields.add(node.attribute);
+          if (node.children) node.children.forEach(extract);
+        };
+        extract(query.predicate);
+      }
+      if (query.where) {
+        Object.keys(query.where).forEach((k) => fields.add(k));
+      }
+      if (query.sort) {
+        Object.keys(query.sort).forEach((k) => fields.add(k));
+      }
+    } catch (e) {
+      return "ALL";
+    }
+    return fields.size > 0 ? fields : "ALL";
+  }
+  getChangedFields(oldValue, newValue) {
+    if (Array.isArray(oldValue) || Array.isArray(newValue)) return "ALL";
+    if (oldValue === newValue) return /* @__PURE__ */ new Set();
+    if (!oldValue && !newValue) return /* @__PURE__ */ new Set();
+    if (!oldValue) return new Set(Object.keys(newValue || {}));
+    if (!newValue) return new Set(Object.keys(oldValue || {}));
+    const changes = /* @__PURE__ */ new Set();
+    const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldValue), ...Object.keys(newValue)]);
+    for (const key of allKeys) {
+      if (oldValue[key] !== newValue[key]) {
+        changes.add(key);
+      }
+    }
+    return changes;
+  }
+};
+
+// src/topic/TopicManager.ts
+var TopicManager = class {
+  // M1: Basic limit
+  constructor(config) {
+    this.subscribers = /* @__PURE__ */ new Map();
+    this.MAX_SUBSCRIPTIONS = 100;
+    this.cluster = config.cluster;
+    this.sendToClient = config.sendToClient;
+  }
+  validateTopic(topic) {
+    if (!topic || topic.length > 256 || !/^[\w\-.:/]+$/.test(topic)) {
+      throw new Error("Invalid topic name");
+    }
+  }
+  /**
+   * Subscribe a client to a topic
+   */
+  subscribe(clientId, topic) {
+    this.validateTopic(topic);
+    let count = 0;
+    for (const subs of this.subscribers.values()) {
+      if (subs.has(clientId)) count++;
+    }
+    if (count >= this.MAX_SUBSCRIPTIONS) {
+      throw new Error("Subscription limit reached");
+    }
+    if (!this.subscribers.has(topic)) {
+      this.subscribers.set(topic, /* @__PURE__ */ new Set());
+    }
+    this.subscribers.get(topic).add(clientId);
+    logger.debug({ clientId, topic }, "Client subscribed to topic");
+  }
+  /**
+   * Unsubscribe a client from a topic
+   */
+  unsubscribe(clientId, topic) {
+    const subs = this.subscribers.get(topic);
+    if (subs) {
+      subs.delete(clientId);
+      if (subs.size === 0) {
+        this.subscribers.delete(topic);
+      }
+      logger.debug({ clientId, topic }, "Client unsubscribed from topic");
+    }
+  }
+  /**
+   * Clean up all subscriptions for a client (e.g. on disconnect)
+   */
+  unsubscribeAll(clientId) {
+    for (const [topic, subs] of this.subscribers) {
+      if (subs.has(clientId)) {
+        subs.delete(clientId);
+        if (subs.size === 0) {
+          this.subscribers.delete(topic);
+        }
+      }
+    }
+  }
+  /**
+   * Publish a message to a topic
+   * @param topic Topic name
+   * @param data Message data
+   * @param senderId Client ID of the publisher (optional)
+   * @param fromCluster Whether this message came from another cluster node
+   */
+  publish(topic, data, senderId, fromCluster = false) {
+    this.validateTopic(topic);
+    const subs = this.subscribers.get(topic);
+    if (subs) {
+      const payload = {
+        topic,
+        data,
+        publisherId: senderId,
+        timestamp: Date.now()
+      };
+      const message = {
+        type: "TOPIC_MESSAGE",
+        payload
+      };
+      for (const clientId of subs) {
+        if (clientId !== senderId) {
+          this.sendToClient(clientId, message);
+        }
+      }
+    }
+    if (!fromCluster) {
+      this.cluster.getMembers().forEach((nodeId) => {
+        if (!this.cluster.isLocal(nodeId)) {
+          this.cluster.send(nodeId, "CLUSTER_TOPIC_PUB", {
+            topic,
+            data,
+            originalSenderId: senderId
+          });
+        }
+      });
+    }
+  }
+};
+
+// src/cluster/ClusterManager.ts
+import { WebSocket, WebSocketServer } from "ws";
+import { EventEmitter } from "events";
+import * as dns from "dns";
+import { readFileSync } from "fs";
+import * as https from "https";
+var ClusterManager = class extends EventEmitter {
+  constructor(config) {
+    super();
+    this.members = /* @__PURE__ */ new Map();
+    this.pendingConnections = /* @__PURE__ */ new Set();
+    this.reconnectIntervals = /* @__PURE__ */ new Map();
+    this._actualPort = 0;
+    this.config = config;
+  }
+  /** Get the actual port the cluster is listening on */
+  get port() {
+    return this._actualPort;
+  }
+  start() {
+    return new Promise((resolve) => {
+      logger.info({ port: this.config.port, tls: !!this.config.tls?.enabled }, "Starting Cluster Manager");
+      if (this.config.tls?.enabled) {
+        const tlsOptions = this.buildClusterTLSOptions();
+        const httpsServer = https.createServer(tlsOptions);
+        this.server = new WebSocketServer({ server: httpsServer });
+        httpsServer.listen(this.config.port, () => {
+          const addr = httpsServer.address();
+          this._actualPort = typeof addr === "object" && addr ? addr.port : this.config.port;
+          logger.info({ port: this._actualPort }, "Cluster Manager listening (TLS enabled)");
+          this.onServerReady(resolve);
+        });
+      } else {
+        this.server = new WebSocketServer({ port: this.config.port });
+        this.server.on("listening", () => {
+          const addr = this.server.address();
+          this._actualPort = typeof addr === "object" && addr ? addr.port : this.config.port;
+          logger.info({ port: this._actualPort }, "Cluster Manager listening");
+          this.onServerReady(resolve);
+        });
+      }
+      this.server?.on("connection", (ws, req) => {
+        logger.info({ remoteAddress: req.socket.remoteAddress }, "Incoming cluster connection");
+        this.handleSocket(ws, false);
+      });
+    });
+  }
+  /** Called when server is ready - registers self and initiates peer connections */
+  onServerReady(resolve) {
+    this.members.set(this.config.nodeId, {
+      nodeId: this.config.nodeId,
+      host: this.config.host,
+      port: this._actualPort,
+      socket: null,
+      isSelf: true
+    });
+    if (this.config.discovery === "kubernetes" && this.config.serviceName) {
+      this.startDiscovery();
+    } else {
+      this.connectToPeers();
+    }
+    resolve(this._actualPort);
+  }
+  stop() {
+    logger.info({ port: this.config.port }, "Stopping Cluster Manager");
+    for (const timeout of this.reconnectIntervals.values()) {
+      clearTimeout(timeout);
+    }
+    this.reconnectIntervals.clear();
+    if (this.discoveryTimer) {
+      clearInterval(this.discoveryTimer);
+      this.discoveryTimer = void 0;
+    }
+    this.pendingConnections.clear();
+    for (const member of this.members.values()) {
+      if (member.socket) {
+        member.socket.terminate();
+      }
+    }
+    this.members.clear();
+    if (this.server) {
+      this.server.close();
+    }
+  }
+  connectToPeers() {
+    for (const peer of this.config.peers) {
+      this.connectToPeer(peer);
+    }
+  }
+  startDiscovery() {
+    const runDiscovery = async () => {
+      if (!this.config.serviceName) return;
+      try {
+        const addresses = await dns.promises.resolve4(this.config.serviceName);
+        logger.debug({ addresses, serviceName: this.config.serviceName }, "DNS discovery results");
+        for (const ip of addresses) {
+          const targetPort = this._actualPort || this.config.port;
+          const peerAddress = `${ip}:${targetPort}`;
+          this.connectToPeer(peerAddress);
+        }
+      } catch (err) {
+        logger.error({ err: err.message, serviceName: this.config.serviceName }, "DNS discovery failed");
+      }
+    };
+    logger.info({ serviceName: this.config.serviceName }, "Starting Kubernetes DNS discovery");
+    runDiscovery();
+    this.discoveryTimer = setInterval(runDiscovery, this.config.discoveryInterval || 1e4);
+  }
+  scheduleReconnect(peerAddress, attempt = 0) {
+    if (this.reconnectIntervals.has(peerAddress)) return;
+    const delay = Math.min(5e3 * Math.pow(2, attempt), 6e4);
+    const timeout = setTimeout(() => {
+      this.reconnectIntervals.delete(peerAddress);
+      this.connectToPeerWithBackoff(peerAddress, attempt + 1);
+    }, delay);
+    this.reconnectIntervals.set(peerAddress, timeout);
+  }
+  // Helper to track attempts
+  connectToPeerWithBackoff(peerAddress, attempt) {
+    this._connectToPeerInternal(peerAddress, attempt);
+  }
+  connectToPeer(peerAddress) {
+    this._connectToPeerInternal(peerAddress, 0);
+  }
+  _connectToPeerInternal(peerAddress, attempt) {
+    if (this.pendingConnections.has(peerAddress)) return;
+    for (const member of this.members.values()) {
+      if (`${member.host}:${member.port}` === peerAddress) return;
+    }
+    logger.info({ peerAddress, attempt, tls: !!this.config.tls?.enabled }, "Connecting to peer");
+    this.pendingConnections.add(peerAddress);
+    try {
+      let ws;
+      if (this.config.tls?.enabled) {
+        const protocol = "wss://";
+        const wsOptions = {
+          rejectUnauthorized: this.config.tls.rejectUnauthorized !== false
+        };
+        if (this.config.tls.certPath && this.config.tls.keyPath) {
+          wsOptions.cert = readFileSync(this.config.tls.certPath);
+          wsOptions.key = readFileSync(this.config.tls.keyPath);
+          if (this.config.tls.passphrase) {
+            wsOptions.passphrase = this.config.tls.passphrase;
+          }
+        }
+        if (this.config.tls.caCertPath) {
+          wsOptions.ca = readFileSync(this.config.tls.caCertPath);
+        }
+        ws = new WebSocket(`${protocol}${peerAddress}`, wsOptions);
+      } else {
+        ws = new WebSocket(`ws://${peerAddress}`);
+      }
+      ws.on("open", () => {
+        this.pendingConnections.delete(peerAddress);
+        logger.info({ peerAddress }, "Connected to peer");
+        this.handleSocket(ws, true, peerAddress);
+      });
+      ws.on("error", (err) => {
+        logger.error({ peerAddress, err: err.message }, "Connection error to peer");
+        this.pendingConnections.delete(peerAddress);
+        this.scheduleReconnect(peerAddress, attempt);
+      });
+      ws.on("close", () => {
+        this.pendingConnections.delete(peerAddress);
+      });
+    } catch (e) {
+      this.pendingConnections.delete(peerAddress);
+      this.scheduleReconnect(peerAddress, attempt);
+    }
+  }
+  handleSocket(ws, initiated, peerAddress) {
+    const helloMsg = {
+      type: "HELLO",
+      senderId: this.config.nodeId,
+      payload: {
+        host: this.config.host,
+        port: this._actualPort || this.config.port
+      }
+    };
+    ws.send(JSON.stringify(helloMsg));
+    let remoteNodeId = null;
+    ws.on("message", (data) => {
+      try {
+        const msg = JSON.parse(data.toString());
+        if (msg.type === "HELLO") {
+          remoteNodeId = msg.senderId;
+          const { host, port } = msg.payload;
+          logger.info({ nodeId: remoteNodeId, host, port }, "Peer identified");
+          const myId = this.config.nodeId;
+          const otherId = remoteNodeId;
+          const initiatorId = initiated ? myId : otherId;
+          const receiverId = initiated ? otherId : myId;
+          if (this.members.has(remoteNodeId)) {
+            logger.warn({ nodeId: remoteNodeId }, "Duplicate valid connection. Replacing.");
+          }
+          this.members.set(remoteNodeId, {
+            nodeId: remoteNodeId,
+            host,
+            port,
+            socket: ws,
+            isSelf: false
+          });
+          this.emit("memberJoined", remoteNodeId);
+        } else {
+          this.emit("message", msg);
+        }
+      } catch (err) {
+        logger.error({ err }, "Failed to parse cluster message");
+      }
+    });
+    ws.on("close", () => {
+      if (remoteNodeId) {
+        const current = this.members.get(remoteNodeId);
+        if (current && current.socket === ws) {
+          logger.info({ nodeId: remoteNodeId }, "Peer disconnected");
+          this.members.delete(remoteNodeId);
+          this.emit("memberLeft", remoteNodeId);
+          if (initiated && peerAddress) {
+            this.scheduleReconnect(peerAddress, 0);
+          }
+        } else {
+        }
+      }
+    });
+  }
+  send(nodeId, type, payload) {
+    const member = this.members.get(nodeId);
+    if (member && member.socket && member.socket.readyState === WebSocket.OPEN) {
+      const msg = {
+        type,
+        senderId: this.config.nodeId,
+        payload
+      };
+      member.socket.send(JSON.stringify(msg));
+    } else {
+      logger.warn({ nodeId }, "Cannot send to node: not connected");
+    }
+  }
+  sendToNode(nodeId, message) {
+    this.send(nodeId, "OP_FORWARD", message);
+  }
+  getMembers() {
+    return Array.from(this.members.keys());
+  }
+  isLocal(nodeId) {
+    return nodeId === this.config.nodeId;
+  }
+  buildClusterTLSOptions() {
+    const config = this.config.tls;
+    const options = {
+      cert: readFileSync(config.certPath),
+      key: readFileSync(config.keyPath),
+      minVersion: config.minVersion || "TLSv1.2"
+    };
+    if (config.caCertPath) {
+      options.ca = readFileSync(config.caCertPath);
+    }
+    if (config.requireClientCert) {
+      options.requestCert = true;
+      options.rejectUnauthorized = true;
+    }
+    if (config.passphrase) {
+      options.passphrase = config.passphrase;
+    }
+    return options;
+  }
+};
+
+// src/cluster/PartitionService.ts
+import { hashString } from "@topgunbuild/core";
+var PartitionService = class {
+  // Standard Hazelcast default
+  constructor(cluster) {
+    // partitionId -> { owner, backups }
+    this.partitions = /* @__PURE__ */ new Map();
+    this.PARTITION_COUNT = 271;
+    this.BACKUP_COUNT = 1;
+    this.cluster = cluster;
+    this.cluster.on("memberJoined", () => this.rebalance());
+    this.cluster.on("memberLeft", () => this.rebalance());
+    this.rebalance();
+  }
+  getPartitionId(key) {
+    return Math.abs(hashString(key)) % this.PARTITION_COUNT;
+  }
+  getDistribution(key) {
+    const pId = this.getPartitionId(key);
+    return this.partitions.get(pId) || {
+      owner: this.cluster.config.nodeId,
+      backups: []
+    };
+  }
+  getOwner(key) {
+    return this.getDistribution(key).owner;
+  }
+  isLocalOwner(key) {
+    return this.getOwner(key) === this.cluster.config.nodeId;
+  }
+  isLocalBackup(key) {
+    const dist = this.getDistribution(key);
+    return dist.backups.includes(this.cluster.config.nodeId);
+  }
+  isRelated(key) {
+    return this.isLocalOwner(key) || this.isLocalBackup(key);
+  }
+  rebalance() {
+    let allMembers = this.cluster.getMembers().sort();
+    if (allMembers.length === 0) {
+      allMembers = [this.cluster.config.nodeId];
+    }
+    logger.info({ memberCount: allMembers.length, members: allMembers }, "Rebalancing partitions");
+    for (let i = 0; i < this.PARTITION_COUNT; i++) {
+      const ownerIndex = i % allMembers.length;
+      const owner = allMembers[ownerIndex];
+      const backups = [];
+      if (allMembers.length > 1) {
+        for (let b = 1; b <= this.BACKUP_COUNT; b++) {
+          const backupIndex = (ownerIndex + b) % allMembers.length;
+          backups.push(allMembers[backupIndex]);
+        }
+      }
+      this.partitions.set(i, { owner, backups });
+    }
+  }
+};
+
+// src/cluster/LockManager.ts
+import { EventEmitter as EventEmitter2 } from "events";
+var _LockManager = class _LockManager extends EventEmitter2 {
+  // 5 minutes
+  constructor() {
+    super();
+    this.locks = /* @__PURE__ */ new Map();
+    this.checkInterval = setInterval(() => this.cleanupExpiredLocks(), 1e3);
+  }
+  stop() {
+    clearInterval(this.checkInterval);
+  }
+  acquire(name, clientId, requestId, ttl) {
+    const safeTtl = Math.max(_LockManager.MIN_TTL, Math.min(ttl || _LockManager.MIN_TTL, _LockManager.MAX_TTL));
+    let lock = this.locks.get(name);
+    if (!lock) {
+      lock = {
+        name,
+        owner: "",
+        fencingToken: 0,
+        expiry: 0,
+        queue: []
+      };
+      this.locks.set(name, lock);
+    }
+    const now = Date.now();
+    if (!lock.owner || lock.expiry < now) {
+      this.grantLock(lock, clientId, safeTtl);
+      return { granted: true, fencingToken: lock.fencingToken };
+    }
+    if (lock.owner === clientId) {
+      lock.expiry = Math.max(lock.expiry, now + safeTtl);
+      logger.info({ name, clientId, fencingToken: lock.fencingToken }, "Lock lease extended");
+      return { granted: true, fencingToken: lock.fencingToken };
+    }
+    lock.queue.push({ clientId, requestId, ttl: safeTtl, timestamp: now });
+    logger.info({ name, clientId, queueLength: lock.queue.length }, "Lock queued");
+    return { granted: false };
+  }
+  release(name, clientId, fencingToken) {
+    const lock = this.locks.get(name);
+    if (!lock) return false;
+    if (lock.owner !== clientId) {
+      logger.warn({ name, clientId, owner: lock.owner }, "Release failed: Not owner");
+      return false;
+    }
+    if (lock.fencingToken !== fencingToken) {
+      logger.warn({ name, clientId, sentToken: fencingToken, actualToken: lock.fencingToken }, "Release failed: Token mismatch");
+      return false;
+    }
+    this.processNext(lock);
+    return true;
+  }
+  handleClientDisconnect(clientId) {
+    for (const lock of this.locks.values()) {
+      if (lock.owner === clientId) {
+        logger.info({ name: lock.name, clientId }, "Releasing lock due to disconnect");
+        this.processNext(lock);
+      } else {
+        const initialLen = lock.queue.length;
+        lock.queue = lock.queue.filter((req) => req.clientId !== clientId);
+        if (lock.queue.length < initialLen) {
+          logger.info({ name: lock.name, clientId }, "Removed from lock queue due to disconnect");
+        }
+      }
+    }
+  }
+  grantLock(lock, clientId, ttl) {
+    lock.owner = clientId;
+    lock.expiry = Date.now() + ttl;
+    lock.fencingToken++;
+    logger.info({ name: lock.name, clientId, fencingToken: lock.fencingToken }, "Lock granted");
+  }
+  processNext(lock) {
+    const now = Date.now();
+    lock.owner = "";
+    lock.expiry = 0;
+    while (lock.queue.length > 0) {
+      const next = lock.queue.shift();
+      this.grantLock(lock, next.clientId, next.ttl);
+      this.emit("lockGranted", {
+        clientId: next.clientId,
+        requestId: next.requestId,
+        name: lock.name,
+        fencingToken: lock.fencingToken
+      });
+      return;
+    }
+    if (lock.queue.length === 0) {
+      this.locks.delete(lock.name);
+    }
+  }
+  cleanupExpiredLocks() {
+    const now = Date.now();
+    const lockNames = Array.from(this.locks.keys());
+    for (const name of lockNames) {
+      const lock = this.locks.get(name);
+      if (!lock) continue;
+      if (lock.owner && lock.expiry < now) {
+        logger.info({ name: lock.name, owner: lock.owner }, "Lock expired, processing next");
+        this.processNext(lock);
+      } else if (!lock.owner && lock.queue.length === 0) {
+        this.locks.delete(name);
+      }
+    }
+  }
+};
+_LockManager.MIN_TTL = 1e3;
+// 1 second
+_LockManager.MAX_TTL = 3e5;
+var LockManager = _LockManager;
+
+// src/security/SecurityManager.ts
+var SecurityManager = class {
+  constructor(policies = []) {
+    this.policies = [];
+    this.policies = policies;
+  }
+  addPolicy(policy) {
+    this.policies.push(policy);
+  }
+  checkPermission(principal, mapName, action) {
+    if (principal.roles.includes("ADMIN")) {
+      return true;
+    }
+    if (mapName.startsWith("$sys/")) {
+      logger.warn({ userId: principal.userId, mapName }, "Access Denied: System Map requires ADMIN role");
+      return false;
+    }
+    for (const policy of this.policies) {
+      const hasRole = this.hasRole(principal, policy.role);
+      const matchesMap = this.matchesMap(mapName, policy.mapNamePattern, principal);
+      if (hasRole && matchesMap) {
+        if (policy.actions.includes("ALL") || policy.actions.includes(action)) {
+          return true;
+        }
+      } else {
+      }
+    }
+    logger.warn({
+      userId: principal.userId,
+      roles: principal.roles,
+      mapName,
+      action,
+      policyCount: this.policies.length
+    }, "SecurityManager: Access Denied - No matching policy found");
+    return false;
+  }
+  filterObject(object, principal, mapName) {
+    if (!object || typeof object !== "object") return object;
+    if (principal.roles.includes("ADMIN")) return object;
+    if (Array.isArray(object)) {
+      return object.map((item) => this.filterObject(item, principal, mapName));
+    }
+    let allowedFields = null;
+    let accessGranted = false;
+    for (const policy of this.policies) {
+      if (this.hasRole(principal, policy.role) && this.matchesMap(mapName, policy.mapNamePattern, principal)) {
+        if (policy.actions.includes("ALL") || policy.actions.includes("READ")) {
+          accessGranted = true;
+          if (!policy.allowedFields || policy.allowedFields.length === 0 || policy.allowedFields.includes("*")) {
+            return object;
+          }
+          if (allowedFields === null) allowedFields = /* @__PURE__ */ new Set();
+          policy.allowedFields.forEach((f) => allowedFields.add(f));
+        }
+      }
+    }
+    if (!accessGranted) return null;
+    if (allowedFields === null) return object;
+    const filtered = {};
+    for (const key of Object.keys(object)) {
+      if (allowedFields.has(key)) {
+        filtered[key] = object[key];
+      }
+    }
+    return filtered;
+  }
+  hasRole(principal, role) {
+    return principal.roles.includes(role);
+  }
+  matchesMap(mapName, pattern, principal) {
+    let finalPattern = pattern;
+    if (pattern.includes("{userId}") && principal) {
+      finalPattern = pattern.replace("{userId}", principal.userId);
+    }
+    if (finalPattern === "*") return true;
+    if (finalPattern === mapName) return true;
+    if (finalPattern.endsWith("*")) {
+      const prefix = finalPattern.slice(0, -1);
+      return mapName.startsWith(prefix);
+    }
+    return false;
+  }
+};
+
+// src/monitoring/MetricsService.ts
+import { Registry, Gauge, Counter, collectDefaultMetrics } from "prom-client";
+var MetricsService = class {
+  constructor() {
+    this.registry = new Registry();
+    collectDefaultMetrics({ register: this.registry, prefix: "topgun_" });
+    this.connectedClients = new Gauge({
+      name: "topgun_connected_clients",
+      help: "Number of currently connected clients",
+      registers: [this.registry]
+    });
+    this.mapSizeItems = new Gauge({
+      name: "topgun_map_size_items",
+      help: "Number of items in a map",
+      labelNames: ["map"],
+      registers: [this.registry]
+    });
+    this.opsTotal = new Counter({
+      name: "topgun_ops_total",
+      help: "Total number of operations",
+      labelNames: ["type", "map"],
+      registers: [this.registry]
+    });
+    this.memoryUsage = new Gauge({
+      name: "topgun_memory_usage_bytes",
+      help: "Current memory usage in bytes",
+      registers: [this.registry],
+      collect() {
+        this.set(process.memoryUsage().heapUsed);
+      }
+    });
+    this.clusterMembers = new Gauge({
+      name: "topgun_cluster_members",
+      help: "Number of active cluster members",
+      registers: [this.registry]
+    });
+  }
+  destroy() {
+    this.registry.clear();
+  }
+  setConnectedClients(count) {
+    this.connectedClients.set(count);
+  }
+  setMapSize(mapName, size) {
+    this.mapSizeItems.set({ map: mapName }, size);
+  }
+  incOp(type, mapName) {
+    this.opsTotal.inc({ type, map: mapName });
+  }
+  setClusterMembers(count) {
+    this.clusterMembers.set(count);
+  }
+  async getMetrics() {
+    return this.registry.metrics();
+  }
+  async getMetricsJson() {
+    const metrics = await this.registry.getMetricsAsJSON();
+    const result = {};
+    for (const metric of metrics) {
+      if (metric.values.length === 1) {
+        result[metric.name] = metric.values[0].value;
+      } else {
+        result[metric.name] = metric.values;
+      }
+    }
+    return result;
+  }
+  getContentType() {
+    return this.registry.contentType;
+  }
+};
+
+// src/system/SystemManager.ts
+var SystemManager = class {
+  constructor(cluster, metrics, getMap) {
+    this.cluster = cluster;
+    this.metrics = metrics;
+    this.getMap = getMap;
+  }
+  start() {
+    this.setupClusterMap();
+    this.setupStatsMap();
+    this.setupMapsMap();
+    this.statsInterval = setInterval(() => this.updateStats(), 5e3);
+    this.cluster.on("memberJoined", () => this.updateClusterMap());
+    this.cluster.on("memberLeft", () => this.updateClusterMap());
+    this.updateClusterMap();
+    this.updateStats();
+  }
+  stop() {
+    if (this.statsInterval) {
+      clearInterval(this.statsInterval);
+    }
+  }
+  notifyMapCreated(mapName) {
+    if (mapName.startsWith("$sys/")) return;
+    this.updateMapsMap(mapName);
+  }
+  setupClusterMap() {
+    this.getMap("$sys/cluster");
+  }
+  setupStatsMap() {
+    this.getMap("$sys/stats");
+  }
+  setupMapsMap() {
+    this.getMap("$sys/maps");
+  }
+  updateClusterMap() {
+    try {
+      const map = this.getMap("$sys/cluster");
+      const members = this.cluster.getMembers();
+      for (const memberId of members) {
+        const isLocal = this.cluster.isLocal(memberId);
+        map.set(memberId, {
+          id: memberId,
+          status: "UP",
+          isLocal,
+          lastUpdated: Date.now()
+        });
+      }
+    } catch (err) {
+      logger.error({ err }, "Failed to update $sys/cluster");
+    }
+  }
+  async updateStats() {
+    try {
+      const map = this.getMap("$sys/stats");
+      const metrics = await this.metrics.getMetricsJson();
+      map.set(this.cluster.config.nodeId, {
+        ...metrics,
+        timestamp: Date.now()
+      });
+    } catch (err) {
+      logger.error({ err }, "Failed to update $sys/stats");
+    }
+  }
+  updateMapsMap(mapName) {
+    try {
+      const map = this.getMap("$sys/maps");
+      map.set(mapName, {
+        name: mapName,
+        createdAt: Date.now()
+      });
+    } catch (err) {
+      logger.error({ err }, "Failed to update $sys/maps");
+    }
+  }
+};
+
+// src/ServerCoordinator.ts
+var GC_INTERVAL_MS = 60 * 60 * 1e3;
+var GC_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
+var ServerCoordinator = class {
+  constructor(config) {
+    this.clients = /* @__PURE__ */ new Map();
+    // Interceptors
+    this.interceptors = [];
+    // In-memory storage (partitioned later)
+    this.maps = /* @__PURE__ */ new Map();
+    this.pendingClusterQueries = /* @__PURE__ */ new Map();
+    // GC Consensus State
+    this.gcReports = /* @__PURE__ */ new Map();
+    // Track map loading state to avoid returning empty results during async load
+    this.mapLoadingPromises = /* @__PURE__ */ new Map();
+    this._actualPort = 0;
+    this._actualClusterPort = 0;
+    this._readyPromise = new Promise((resolve) => {
+      this._readyResolve = resolve;
+    });
+    this.hlc = new HLC(config.nodeId);
+    this.storage = config.storage;
+    const rawSecret = config.jwtSecret || process.env.JWT_SECRET || "topgun-secret-dev";
+    this.jwtSecret = rawSecret.replace(/\\n/g, "\n");
+    this.queryRegistry = new QueryRegistry();
+    this.securityManager = new SecurityManager(config.securityPolicies || []);
+    this.interceptors = config.interceptors || [];
+    this.metricsService = new MetricsService();
+    if (config.tls?.enabled) {
+      const tlsOptions = this.buildTLSOptions(config.tls);
+      this.httpServer = createHttpsServer(tlsOptions, (_req, res) => {
+        res.writeHead(200);
+        res.end("TopGun Server Running (Secure)");
+      });
+      logger.info("TLS enabled for client connections");
+    } else {
+      this.httpServer = createHttpServer((_req, res) => {
+        res.writeHead(200);
+        res.end("TopGun Server Running");
+      });
+      if (process.env.NODE_ENV === "production") {
+        logger.warn("\u26A0\uFE0F  TLS is disabled! Client connections are NOT encrypted.");
+      }
+    }
+    const metricsPort = config.metricsPort !== void 0 ? config.metricsPort : 9090;
+    this.metricsServer = createHttpServer(async (req, res) => {
+      if (req.url === "/metrics") {
+        try {
+          res.setHeader("Content-Type", this.metricsService.getContentType());
+          res.end(await this.metricsService.getMetrics());
+        } catch (err) {
+          res.statusCode = 500;
+          res.end("Internal Server Error");
+        }
+      } else {
+        res.statusCode = 404;
+        res.end();
+      }
+    });
+    this.metricsServer.listen(metricsPort, () => {
+      logger.info({ port: metricsPort }, "Metrics server listening");
+    });
+    this.metricsServer.on("error", (err) => {
+      logger.error({ err, port: metricsPort }, "Metrics server failed to start");
+    });
+    this.wss = new WebSocketServer2({ server: this.httpServer });
+    this.wss.on("connection", (ws) => this.handleConnection(ws));
+    this.httpServer.listen(config.port, () => {
+      const addr = this.httpServer.address();
+      this._actualPort = typeof addr === "object" && addr ? addr.port : config.port;
+      logger.info({ port: this._actualPort }, "Server Coordinator listening");
+      const clusterPort = config.clusterPort ?? 0;
+      const peers = config.resolvePeers ? config.resolvePeers() : config.peers || [];
+      this.cluster = new ClusterManager({
+        nodeId: config.nodeId,
+        host: config.host || "localhost",
+        port: clusterPort,
+        peers,
+        discovery: config.discovery,
+        serviceName: config.serviceName,
+        discoveryInterval: config.discoveryInterval,
+        tls: config.clusterTls
+      });
+      this.partitionService = new PartitionService(this.cluster);
+      this.lockManager = new LockManager();
+      this.lockManager.on("lockGranted", (evt) => this.handleLockGranted(evt));
+      this.topicManager = new TopicManager({
+        cluster: this.cluster,
+        sendToClient: (clientId, message) => {
+          const client = this.clients.get(clientId);
+          if (client && client.socket.readyState === WebSocket2.OPEN) {
+            client.socket.send(serialize2(message));
+          }
+        }
+      });
+      this.systemManager = new SystemManager(
+        this.cluster,
+        this.metricsService,
+        (name) => this.getMap(name)
+      );
+      this.setupClusterListeners();
+      this.cluster.start().then((actualClusterPort) => {
+        this._actualClusterPort = actualClusterPort;
+        this.metricsService.setClusterMembers(this.cluster.getMembers().length);
+        logger.info({ clusterPort: this._actualClusterPort }, "Cluster started");
+        this.systemManager.start();
+        this._readyResolve();
+      }).catch((err) => {
+        this._actualClusterPort = clusterPort;
+        this.metricsService.setClusterMembers(this.cluster.getMembers().length);
+        logger.info({ clusterPort: this._actualClusterPort }, "Cluster started (sync)");
+        this.systemManager.start();
+        this._readyResolve();
+      });
+    });
+    if (this.storage) {
+      this.storage.initialize().then(() => {
+        logger.info("Storage adapter initialized");
+      }).catch((err) => {
+        logger.error({ err }, "Failed to initialize storage");
+      });
+    }
+    this.startGarbageCollection();
+  }
+  /** Wait for server to be fully ready (ports assigned) */
+  ready() {
+    return this._readyPromise;
+  }
+  /** Get the actual port the server is listening on */
+  get port() {
+    return this._actualPort;
+  }
+  /** Get the actual cluster port */
+  get clusterPort() {
+    return this._actualClusterPort;
+  }
+  async shutdown() {
+    logger.info("Shutting down Server Coordinator...");
+    this.httpServer.close();
+    if (this.metricsServer) {
+      this.metricsServer.close();
+    }
+    this.metricsService.destroy();
+    this.wss.close();
+    logger.info(`Closing ${this.clients.size} client connections...`);
+    const shutdownMsg = serialize2({ type: "SHUTDOWN_PENDING", retryAfter: 5e3 });
+    for (const client of this.clients.values()) {
+      try {
+        if (client.socket.readyState === WebSocket2.OPEN) {
+          client.socket.send(shutdownMsg);
+          client.socket.close(1001, "Server Shutdown");
+        }
+      } catch (e) {
+        logger.error({ err: e, clientId: client.id }, "Error closing client connection");
+      }
+    }
+    this.clients.clear();
+    if (this.cluster) {
+      this.cluster.stop();
+    }
+    if (this.storage) {
+      logger.info("Closing storage connection...");
+      try {
+        await this.storage.close();
+        logger.info("Storage closed successfully.");
+      } catch (err) {
+        logger.error({ err }, "Error closing storage");
+      }
+    }
+    if (this.gcInterval) {
+      clearInterval(this.gcInterval);
+      this.gcInterval = void 0;
+    }
+    if (this.lockManager) {
+      this.lockManager.stop();
+    }
+    if (this.systemManager) {
+      this.systemManager.stop();
+    }
+    logger.info("Server Coordinator shutdown complete.");
+  }
+  async handleConnection(ws) {
+    const clientId = crypto.randomUUID();
+    logger.info({ clientId }, "Client connected (pending auth)");
+    const connection = {
+      id: clientId,
+      socket: ws,
+      isAuthenticated: false,
+      subscriptions: /* @__PURE__ */ new Set(),
+      lastActiveHlc: this.hlc.now()
+      // Initialize with current time
+    };
+    this.clients.set(clientId, connection);
+    this.metricsService.setConnectedClients(this.clients.size);
+    try {
+      const context = {
+        clientId: connection.id,
+        socket: connection.socket,
+        isAuthenticated: connection.isAuthenticated,
+        principal: connection.principal
+      };
+      for (const interceptor of this.interceptors) {
+        if (interceptor.onConnection) {
+          await interceptor.onConnection(context);
+        }
+      }
+    } catch (err) {
+      logger.error({ clientId, err }, "Interceptor rejected connection");
+      ws.close(4e3, "Connection Rejected");
+      this.clients.delete(clientId);
+      return;
+    }
+    ws.on("message", (message) => {
+      try {
+        let data;
+        let buf;
+        if (Buffer.isBuffer(message)) {
+          buf = message;
+        } else if (message instanceof ArrayBuffer) {
+          buf = new Uint8Array(message);
+        } else if (Array.isArray(message)) {
+          buf = Buffer.concat(message);
+        } else {
+          buf = Buffer.from(message);
+        }
+        try {
+          data = deserialize(buf);
+        } catch (e) {
+          try {
+            const text = Buffer.isBuffer(buf) ? buf.toString() : new TextDecoder().decode(buf);
+            data = JSON.parse(text);
+          } catch (jsonErr) {
+            throw e;
+          }
+        }
+        this.handleMessage(connection, data);
+      } catch (err) {
+        logger.error({ err }, "Invalid message format");
+        ws.close(1002, "Protocol Error");
+      }
+    });
+    ws.on("close", () => {
+      logger.info({ clientId }, "Client disconnected");
+      const context = {
+        clientId: connection.id,
+        socket: connection.socket,
+        isAuthenticated: connection.isAuthenticated,
+        principal: connection.principal
+      };
+      for (const interceptor of this.interceptors) {
+        if (interceptor.onDisconnect) {
+          interceptor.onDisconnect(context).catch((err) => {
+            logger.error({ clientId, err }, "Error in onDisconnect interceptor");
+          });
+        }
+      }
+      for (const subId of connection.subscriptions) {
+        this.queryRegistry.unregister(subId);
+      }
+      this.lockManager.handleClientDisconnect(clientId);
+      this.topicManager.unsubscribeAll(clientId);
+      const members = this.cluster.getMembers();
+      for (const memberId of members) {
+        if (!this.cluster.isLocal(memberId)) {
+          this.cluster.send(memberId, "CLUSTER_CLIENT_DISCONNECTED", {
+            originNodeId: this.cluster.config.nodeId,
+            clientId
+          });
+        }
+      }
+      this.clients.delete(clientId);
+      this.metricsService.setConnectedClients(this.clients.size);
+    });
+    ws.send(serialize2({ type: "AUTH_REQUIRED" }));
+  }
+  async handleMessage(client, rawMessage) {
+    const parseResult = MessageSchema.safeParse(rawMessage);
+    if (!parseResult.success) {
+      logger.error({ clientId: client.id, error: parseResult.error }, "Invalid message format from client");
+      client.socket.send(serialize2({
+        type: "ERROR",
+        payload: { code: 400, message: "Invalid message format", details: parseResult.error.errors }
+      }));
+      return;
+    }
+    const message = parseResult.data;
+    this.updateClientHlc(client, message);
+    if (!client.isAuthenticated) {
+      if (message.type === "AUTH") {
+        const token = message.token;
+        try {
+          const isRSAKey = this.jwtSecret.includes("-----BEGIN");
+          const verifyOptions = isRSAKey ? { algorithms: ["RS256"] } : { algorithms: ["HS256"] };
+          const decoded = jwt.verify(token, this.jwtSecret, verifyOptions);
+          if (!decoded.roles) {
+            decoded.roles = ["USER"];
+          }
+          if (!decoded.userId && decoded.sub) {
+            decoded.userId = decoded.sub;
+          }
+          client.principal = decoded;
+          client.isAuthenticated = true;
+          logger.info({ clientId: client.id, user: client.principal.userId || "anon" }, "Client authenticated");
+          client.socket.send(serialize2({ type: "AUTH_ACK" }));
+          return;
+        } catch (e) {
+          logger.error({ clientId: client.id, err: e }, "Auth failed");
+          client.socket.send(serialize2({ type: "AUTH_FAIL", error: "Invalid token" }));
+          client.socket.close(4001, "Unauthorized");
+        }
+      } else {
+        client.socket.close(4001, "Auth required");
+      }
+      return;
+    }
+    switch (message.type) {
+      case "QUERY_SUB": {
+        const { queryId, mapName, query } = message.payload;
+        if (!this.securityManager.checkPermission(client.principal, mapName, "READ")) {
+          logger.warn({ clientId: client.id, mapName }, "Access Denied: QUERY_SUB");
+          client.socket.send(serialize2({
+            type: "ERROR",
+            payload: { code: 403, message: `Access Denied for map ${mapName}` }
+          }));
+          return;
+        }
+        logger.info({ clientId: client.id, mapName, query }, "Client subscribed");
+        this.metricsService.incOp("SUBSCRIBE", mapName);
+        const allMembers = this.cluster.getMembers();
+        const remoteMembers = allMembers.filter((id) => !this.cluster.isLocal(id));
+        const requestId = crypto.randomUUID();
+        const pending = {
+          requestId,
+          client,
+          queryId,
+          mapName,
+          query,
+          results: [],
+          // Will populate with local results first
+          expectedNodes: new Set(remoteMembers),
+          respondedNodes: /* @__PURE__ */ new Set(),
+          timer: setTimeout(() => this.finalizeClusterQuery(requestId, true), 5e3)
+          // 5s timeout
+        };
+        this.pendingClusterQueries.set(requestId, pending);
+        try {
+          const localResults = await this.executeLocalQuery(mapName, query);
+          pending.results.push(...localResults);
+          if (remoteMembers.length > 0) {
+            for (const nodeId of remoteMembers) {
+              this.cluster.send(nodeId, "CLUSTER_QUERY_EXEC", {
+                requestId,
+                mapName,
+                query
+              });
+            }
+          } else {
+            this.finalizeClusterQuery(requestId);
+          }
+        } catch (err) {
+          logger.error({ err, mapName }, "Failed to execute local query");
+          this.finalizeClusterQuery(requestId);
+        }
+        break;
+      }
+      case "QUERY_UNSUB": {
+        const { queryId: unsubId } = message.payload;
+        this.queryRegistry.unregister(unsubId);
+        client.subscriptions.delete(unsubId);
+        break;
+      }
+      case "CLIENT_OP": {
+        const op = message.payload;
+        const isRemove = op.opType === "REMOVE" || op.record && op.record.value === null;
+        const action = isRemove ? "REMOVE" : "PUT";
+        this.metricsService.incOp(isRemove ? "DELETE" : "PUT", op.mapName);
+        if (!this.securityManager.checkPermission(client.principal, op.mapName, action)) {
+          logger.warn({ clientId: client.id, action, mapName: op.mapName }, "Access Denied: Client OP");
+          client.socket.send(serialize2({
+            type: "OP_REJECTED",
+            payload: { opId: op.id, reason: "Access Denied" }
+          }));
+          return;
+        }
+        logger.info({ clientId: client.id, opType: op.opType, key: op.key, mapName: op.mapName }, "Received op");
+        if (this.partitionService.isLocalOwner(op.key)) {
+          this.processLocalOp(op, false, client.id).catch((err) => {
+            logger.error({ clientId: client.id, err }, "Op failed");
+            client.socket.send(serialize2({
+              type: "OP_REJECTED",
+              payload: { opId: op.id, reason: err.message || "Internal Error" }
+            }));
+          });
+        } else {
+          const owner = this.partitionService.getOwner(op.key);
+          logger.info({ key: op.key, owner }, "Forwarding op");
+          this.cluster.sendToNode(owner, op);
+        }
+        break;
+      }
+      case "OP_BATCH": {
+        const ops = message.payload.ops;
+        logger.info({ clientId: client.id, count: ops.length }, "Received batch");
+        let lastProcessedId = null;
+        let rejectedCount = 0;
+        for (const op of ops) {
+          const isRemove = op.opType === "REMOVE" || op.record && op.record.value === null;
+          const action = isRemove ? "REMOVE" : "PUT";
+          if (!this.securityManager.checkPermission(client.principal, op.mapName, action)) {
+            rejectedCount++;
+            logger.warn({ clientId: client.id, action, mapName: op.mapName }, "Access Denied (Batch)");
+            continue;
+          }
+          if (this.partitionService.isLocalOwner(op.key)) {
+            try {
+              await this.processLocalOp({
+                mapName: op.mapName,
+                key: op.key,
+                record: op.record,
+                orRecord: op.orRecord,
+                orTag: op.orTag,
+                opType: op.opType
+              }, false, client.id);
+              if (op.id) {
+                lastProcessedId = op.id;
+              }
+            } catch (err) {
+              rejectedCount++;
+              logger.warn({ clientId: client.id, mapName: op.mapName, err }, "Op rejected in batch");
+            }
+          } else {
+            const owner = this.partitionService.getOwner(op.key);
+            this.cluster.sendToNode(owner, {
+              type: "CLIENT_OP",
+              payload: {
+                mapName: op.mapName,
+                key: op.key,
+                record: op.record,
+                orRecord: op.orRecord,
+                orTag: op.orTag,
+                opType: op.opType
+              }
+            });
+            if (op.id) {
+              lastProcessedId = op.id;
+            }
+          }
+        }
+        if (lastProcessedId !== null) {
+          client.socket.send(serialize2({
+            type: "OP_ACK",
+            payload: { lastId: lastProcessedId }
+          }));
+        }
+        if (rejectedCount > 0) {
+          client.socket.send(serialize2({
+            type: "ERROR",
+            payload: { code: 403, message: `Partial batch failure: ${rejectedCount} ops denied` }
+          }));
+        }
+        break;
+      }
+      case "SYNC_INIT": {
+        if (!this.securityManager.checkPermission(client.principal, message.mapName, "READ")) {
+          logger.warn({ clientId: client.id, mapName: message.mapName }, "Access Denied: SYNC_INIT");
+          client.socket.send(serialize2({
+            type: "ERROR",
+            payload: { code: 403, message: `Access Denied for map ${message.mapName}` }
+          }));
+          return;
+        }
+        const lastSync = message.lastSyncTimestamp || 0;
+        const now = Date.now();
+        if (lastSync > 0 && now - lastSync > GC_AGE_MS) {
+          logger.warn({ clientId: client.id, lastSync, age: now - lastSync }, "Client too old, sending SYNC_RESET_REQUIRED");
+          client.socket.send(serialize2({
+            type: "SYNC_RESET_REQUIRED",
+            payload: { mapName: message.mapName }
+          }));
+          return;
+        }
+        logger.info({ clientId: client.id, mapName: message.mapName }, "Client requested sync");
+        this.metricsService.incOp("GET", message.mapName);
+        try {
+          const mapForSync = await this.getMapAsync(message.mapName);
+          if (mapForSync instanceof LWWMap2) {
+            const tree = mapForSync.getMerkleTree();
+            const rootHash = tree.getRootHash();
+            client.socket.send(serialize2({
+              type: "SYNC_RESP_ROOT",
+              payload: {
+                mapName: message.mapName,
+                rootHash,
+                timestamp: this.hlc.now()
+              }
+            }));
+          } else {
+            logger.warn({ mapName: message.mapName }, "SYNC_INIT requested for ORMap - Not Implemented");
+            client.socket.send(serialize2({
+              type: "ERROR",
+              payload: { code: 501, message: `Merkle Sync not supported for ORMap ${message.mapName}` }
+            }));
+          }
+        } catch (err) {
+          logger.error({ err, mapName: message.mapName }, "Failed to load map for SYNC_INIT");
+          client.socket.send(serialize2({
+            type: "ERROR",
+            payload: { code: 500, message: `Failed to load map ${message.mapName}` }
+          }));
+        }
+        break;
+      }
+      case "MERKLE_REQ_BUCKET": {
+        if (!this.securityManager.checkPermission(client.principal, message.payload.mapName, "READ")) {
+          client.socket.send(serialize2({
+            type: "ERROR",
+            payload: { code: 403, message: `Access Denied for map ${message.payload.mapName}` }
+          }));
+          return;
+        }
+        const { mapName, path } = message.payload;
+        try {
+          const mapForBucket = await this.getMapAsync(mapName);
+          if (mapForBucket instanceof LWWMap2) {
+            const treeForBucket = mapForBucket.getMerkleTree();
+            const buckets = treeForBucket.getBuckets(path);
+            const node = treeForBucket.getNode(path);
+            if (node && node.entries && node.entries.size > 0) {
+              const diffRecords = [];
+              for (const key of node.entries.keys()) {
+                diffRecords.push({ key, record: mapForBucket.getRecord(key) });
+              }
+              client.socket.send(serialize2({
+                type: "SYNC_RESP_LEAF",
+                payload: { mapName, path, records: diffRecords }
+              }));
+            } else {
+              client.socket.send(serialize2({
+                type: "SYNC_RESP_BUCKETS",
+                payload: { mapName, path, buckets }
+              }));
+            }
+          }
+        } catch (err) {
+          logger.error({ err, mapName }, "Failed to load map for MERKLE_REQ_BUCKET");
+        }
+        break;
+      }
+      case "LOCK_REQUEST": {
+        const { requestId, name, ttl } = message.payload;
+        if (!this.securityManager.checkPermission(client.principal, name, "PUT")) {
+          client.socket.send(serialize2({
+            // We don't have LOCK_DENIED type in schema yet?
+            // Using LOCK_RELEASED with success=false as a hack or ERROR.
+            // Ideally ERROR.
+            type: "ERROR",
+            payload: { code: 403, message: `Access Denied for lock ${name}` }
+          }));
+          return;
+        }
+        if (this.partitionService.isLocalOwner(name)) {
+          const result = this.lockManager.acquire(name, client.id, requestId, ttl || 1e4);
+          if (result.granted) {
+            client.socket.send(serialize2({
+              type: "LOCK_GRANTED",
+              payload: { requestId, name, fencingToken: result.fencingToken }
+            }));
+          }
+        } else {
+          const owner = this.partitionService.getOwner(name);
+          if (!this.cluster.getMembers().includes(owner)) {
+            client.socket.send(serialize2({
+              type: "ERROR",
+              payload: { code: 503, message: `Lock owner ${owner} is unavailable` }
+            }));
+            return;
+          }
+          this.cluster.send(owner, "CLUSTER_LOCK_REQ", {
+            originNodeId: this.cluster.config.nodeId,
+            clientId: client.id,
+            requestId,
+            name,
+            ttl
+          });
+        }
+        break;
+      }
+      case "LOCK_RELEASE": {
+        const { requestId, name, fencingToken } = message.payload;
+        if (this.partitionService.isLocalOwner(name)) {
+          const success = this.lockManager.release(name, client.id, fencingToken);
+          client.socket.send(serialize2({
+            type: "LOCK_RELEASED",
+            payload: { requestId, name, success }
+          }));
+        } else {
+          const owner = this.partitionService.getOwner(name);
+          this.cluster.send(owner, "CLUSTER_LOCK_RELEASE", {
+            originNodeId: this.cluster.config.nodeId,
+            clientId: client.id,
+            requestId,
+            name,
+            fencingToken
+          });
+        }
+        break;
+      }
+      case "TOPIC_SUB": {
+        const { topic } = message.payload;
+        if (!this.securityManager.checkPermission(client.principal, `topic:${topic}`, "READ")) {
+          logger.warn({ clientId: client.id, topic }, "Access Denied: TOPIC_SUB");
+          client.socket.send(serialize2({
+            type: "ERROR",
+            payload: { code: 403, message: `Access Denied for topic ${topic}` }
+          }));
+          return;
+        }
+        try {
+          this.topicManager.subscribe(client.id, topic);
+        } catch (e) {
+          client.socket.send(serialize2({
+            type: "ERROR",
+            payload: { code: 400, message: e.message }
+          }));
+        }
+        break;
+      }
+      case "TOPIC_UNSUB": {
+        const { topic } = message.payload;
+        this.topicManager.unsubscribe(client.id, topic);
+        break;
+      }
+      case "TOPIC_PUB": {
+        const { topic, data } = message.payload;
+        if (!this.securityManager.checkPermission(client.principal, `topic:${topic}`, "PUT")) {
+          logger.warn({ clientId: client.id, topic }, "Access Denied: TOPIC_PUB");
+          client.socket.send(serialize2({
+            type: "ERROR",
+            payload: { code: 403, message: `Access Denied for topic ${topic}` }
+          }));
+          return;
+        }
+        try {
+          this.topicManager.publish(topic, data, client.id);
+        } catch (e) {
+          client.socket.send(serialize2({
+            type: "ERROR",
+            payload: { code: 400, message: e.message }
+          }));
+        }
+        break;
+      }
+      default:
+        logger.warn({ type: message.type }, "Unknown message type");
+    }
+  }
+  updateClientHlc(client, message) {
+    let ts;
+    if (message.type === "CLIENT_OP") {
+      const op = message.payload;
+      if (op.record && op.record.timestamp) {
+        ts = op.record.timestamp;
+      } else if (op.orRecord && op.orRecord.timestamp) {
+      } else if (op.orTag) {
+        try {
+          ts = HLC.parse(op.orTag);
+        } catch (e) {
+        }
+      }
+    }
+    if (ts) {
+      this.hlc.update(ts);
+      client.lastActiveHlc = ts;
+    } else {
+      client.lastActiveHlc = this.hlc.now();
+    }
+  }
+  broadcast(message, excludeClientId) {
+    const isServerEvent = message.type === "SERVER_EVENT";
+    if (isServerEvent) {
+      for (const [id, client] of this.clients) {
+        if (id !== excludeClientId && client.socket.readyState === 1 && client.isAuthenticated && client.principal) {
+          const payload = message.payload;
+          const mapName = payload.mapName;
+          const newPayload = { ...payload };
+          if (newPayload.record) {
+            const newVal = this.securityManager.filterObject(newPayload.record.value, client.principal, mapName);
+            newPayload.record = { ...newPayload.record, value: newVal };
+          }
+          if (newPayload.orRecord) {
+            const newVal = this.securityManager.filterObject(newPayload.orRecord.value, client.principal, mapName);
+            newPayload.orRecord = { ...newPayload.orRecord, value: newVal };
+          }
+          client.socket.send(serialize2({ ...message, payload: newPayload }));
+        }
+      }
+    } else {
+      const msgData = serialize2(message);
+      for (const [id, client] of this.clients) {
+        if (id !== excludeClientId && client.socket.readyState === 1) {
+          client.socket.send(msgData);
+        }
+      }
+    }
+  }
+  setupClusterListeners() {
+    this.cluster.on("memberJoined", () => {
+      this.metricsService.setClusterMembers(this.cluster.getMembers().length);
+    });
+    this.cluster.on("memberLeft", () => {
+      this.metricsService.setClusterMembers(this.cluster.getMembers().length);
+    });
+    this.cluster.on("message", (msg) => {
+      switch (msg.type) {
+        case "OP_FORWARD":
+          logger.info({ senderId: msg.senderId }, "Received forwarded op");
+          if (this.partitionService.isLocalOwner(msg.payload.key)) {
+            this.processLocalOp(msg.payload, true, msg.senderId).catch((err) => {
+              logger.error({ err, senderId: msg.senderId }, "Forwarded op failed");
+            });
+          } else {
+            logger.warn({ key: msg.payload.key }, "Received OP_FORWARD but not owner. Dropping.");
+          }
+          break;
+        case "CLUSTER_EVENT":
+          this.handleClusterEvent(msg.payload);
+          break;
+        case "CLUSTER_QUERY_EXEC": {
+          const { requestId, mapName, query } = msg.payload;
+          this.executeLocalQuery(mapName, query).then((results) => {
+            this.cluster.send(msg.senderId, "CLUSTER_QUERY_RESP", {
+              requestId,
+              results
+            });
+          }).catch((err) => {
+            logger.error({ err, mapName }, "Failed to execute cluster query");
+            this.cluster.send(msg.senderId, "CLUSTER_QUERY_RESP", {
+              requestId,
+              results: []
+            });
+          });
+          break;
+        }
+        case "CLUSTER_QUERY_RESP": {
+          const { requestId: reqId, results: remoteResults } = msg.payload;
+          const pendingQuery = this.pendingClusterQueries.get(reqId);
+          if (pendingQuery) {
+            pendingQuery.results.push(...remoteResults);
+            pendingQuery.respondedNodes.add(msg.senderId);
+            if (pendingQuery.respondedNodes.size === pendingQuery.expectedNodes.size) {
+              this.finalizeClusterQuery(reqId);
+            }
+          }
+          break;
+        }
+        case "CLUSTER_GC_REPORT": {
+          this.handleGcReport(msg.senderId, msg.payload.minHlc);
+          break;
+        }
+        case "CLUSTER_GC_COMMIT": {
+          this.performGarbageCollection(msg.payload.safeTimestamp);
+          break;
+        }
+        case "CLUSTER_LOCK_REQ": {
+          const { originNodeId, clientId, requestId, name, ttl } = msg.payload;
+          const compositeId = `${originNodeId}:${clientId}`;
+          const result = this.lockManager.acquire(name, compositeId, requestId, ttl || 1e4);
+          if (result.granted) {
+            this.cluster.send(originNodeId, "CLUSTER_LOCK_GRANTED", {
+              clientId,
+              requestId,
+              name,
+              fencingToken: result.fencingToken
+            });
+          }
+          break;
+        }
+        case "CLUSTER_LOCK_RELEASE": {
+          const { originNodeId, clientId, requestId, name, fencingToken } = msg.payload;
+          const compositeId = `${originNodeId}:${clientId}`;
+          const success = this.lockManager.release(name, compositeId, fencingToken);
+          this.cluster.send(originNodeId, "CLUSTER_LOCK_RELEASED", {
+            clientId,
+            requestId,
+            name,
+            success
+          });
+          break;
+        }
+        case "CLUSTER_LOCK_RELEASED": {
+          const { clientId, requestId, name, success } = msg.payload;
+          const client = this.clients.get(clientId);
+          if (client) {
+            client.socket.send(serialize2({
+              type: "LOCK_RELEASED",
+              payload: { requestId, name, success }
+            }));
+          }
+          break;
+        }
+        case "CLUSTER_LOCK_GRANTED": {
+          const { clientId, requestId, name, fencingToken } = msg.payload;
+          const client = this.clients.get(clientId);
+          if (client) {
+            client.socket.send(serialize2({
+              type: "LOCK_GRANTED",
+              payload: { requestId, name, fencingToken }
+            }));
+          }
+          break;
+        }
+        case "CLUSTER_CLIENT_DISCONNECTED": {
+          const { clientId, originNodeId } = msg.payload;
+          const compositeId = `${originNodeId}:${clientId}`;
+          this.lockManager.handleClientDisconnect(compositeId);
+          break;
+        }
+        case "CLUSTER_TOPIC_PUB": {
+          const { topic, data, originalSenderId } = msg.payload;
+          this.topicManager.publish(topic, data, originalSenderId, true);
+          break;
+        }
+      }
+    });
+  }
+  async executeLocalQuery(mapName, query) {
+    const map = await this.getMapAsync(mapName);
+    const records = /* @__PURE__ */ new Map();
+    if (map instanceof LWWMap2) {
+      for (const key of map.allKeys()) {
+        const rec = map.getRecord(key);
+        if (rec && rec.value !== null) {
+          records.set(key, rec);
+        }
+      }
+    } else if (map instanceof ORMap2) {
+      const items = map.items;
+      for (const key of items.keys()) {
+        const values = map.get(key);
+        if (values.length > 0) {
+          records.set(key, { value: values });
+        }
+      }
+    }
+    const localQuery = { ...query };
+    delete localQuery.offset;
+    delete localQuery.limit;
+    return executeQuery(records, localQuery);
+  }
+  finalizeClusterQuery(requestId, timeout = false) {
+    const pending = this.pendingClusterQueries.get(requestId);
+    if (!pending) return;
+    if (timeout) {
+      logger.warn({ requestId, responded: pending.respondedNodes.size, expected: pending.expectedNodes.size }, "Query timed out. Returning partial results.");
+    }
+    clearTimeout(pending.timer);
+    this.pendingClusterQueries.delete(requestId);
+    const { client, queryId, mapName, query, results } = pending;
+    const uniqueResults = /* @__PURE__ */ new Map();
+    for (const res of results) {
+      uniqueResults.set(res.key, res);
+    }
+    const finalResults = Array.from(uniqueResults.values());
+    if (query.sort) {
+      finalResults.sort((a, b) => {
+        for (const [field, direction] of Object.entries(query.sort)) {
+          const valA = a.value[field];
+          const valB = b.value[field];
+          if (valA < valB) return direction === "asc" ? -1 : 1;
+          if (valA > valB) return direction === "asc" ? 1 : -1;
+        }
+        return 0;
+      });
+    }
+    const slicedResults = query.offset || query.limit ? finalResults.slice(query.offset || 0, (query.offset || 0) + (query.limit || finalResults.length)) : finalResults;
+    const resultKeys = new Set(slicedResults.map((r) => r.key));
+    const sub = {
+      id: queryId,
+      clientId: client.id,
+      mapName,
+      query,
+      socket: client.socket,
+      previousResultKeys: resultKeys,
+      interestedFields: "ALL"
+    };
+    this.queryRegistry.register(sub);
+    client.subscriptions.add(queryId);
+    const filteredResults = slicedResults.map((res) => {
+      const filteredValue = this.securityManager.filterObject(res.value, client.principal, mapName);
+      return { ...res, value: filteredValue };
+    });
+    client.socket.send(serialize2({
+      type: "QUERY_RESP",
+      payload: { queryId, results: filteredResults }
+    }));
+  }
+  handleLockGranted({ clientId, requestId, name, fencingToken }) {
+    const client = this.clients.get(clientId);
+    if (client) {
+      client.socket.send(serialize2({
+        type: "LOCK_GRANTED",
+        payload: { requestId, name, fencingToken }
+      }));
+      return;
+    }
+    const parts = clientId.split(":");
+    if (parts.length === 2) {
+      const [nodeId, realClientId] = parts;
+      if (nodeId !== this.cluster.config.nodeId) {
+        this.cluster.send(nodeId, "CLUSTER_LOCK_GRANTED", {
+          clientId: realClientId,
+          requestId,
+          name,
+          fencingToken
+        });
+        return;
+      }
+    }
+    logger.warn({ clientId, name }, "Lock granted to unknown client");
+  }
+  async processLocalOp(op, fromCluster, originalSenderId) {
+    let context = {
+      clientId: originalSenderId || "unknown",
+      isAuthenticated: false,
+      // We might need to fetch this if local
+      fromCluster,
+      originalSenderId
+    };
+    if (!fromCluster && originalSenderId) {
+      const client = this.clients.get(originalSenderId);
+      if (client) {
+        context = {
+          clientId: client.id,
+          socket: client.socket,
+          isAuthenticated: client.isAuthenticated,
+          principal: client.principal,
+          fromCluster,
+          originalSenderId
+        };
+      }
+    }
+    let currentOp = op;
+    try {
+      for (const interceptor of this.interceptors) {
+        if (interceptor.onBeforeOp) {
+          if (currentOp) {
+            currentOp = await interceptor.onBeforeOp(currentOp, context);
+            if (!currentOp) {
+              logger.debug({ interceptor: interceptor.name, opId: op.id }, "Interceptor silently dropped op");
+              return;
+            }
+          }
+        }
+      }
+    } catch (err) {
+      logger.warn({ err, opId: op.id }, "Interceptor rejected op");
+      throw err;
+    }
+    if (!currentOp) return;
+    op = currentOp;
+    const typeHint = op.opType === "OR_ADD" || op.opType === "OR_REMOVE" ? "OR" : "LWW";
+    const map = this.getMap(op.mapName, typeHint);
+    if (typeHint === "OR" && map instanceof LWWMap2) {
+      logger.error({ mapName: op.mapName }, "Map type mismatch: LWWMap but received OR op");
+      throw new Error("Map type mismatch: LWWMap but received OR op");
+    }
+    if (typeHint === "LWW" && map instanceof ORMap2) {
+      logger.error({ mapName: op.mapName }, "Map type mismatch: ORMap but received LWW op");
+      throw new Error("Map type mismatch: ORMap but received LWW op");
+    }
+    let oldRecord;
+    let recordToStore;
+    let tombstonesToStore;
+    const eventPayload = {
+      mapName: op.mapName,
+      key: op.key
+      // Common fields
+    };
+    if (map instanceof LWWMap2) {
+      oldRecord = map.getRecord(op.key);
+      map.merge(op.key, op.record);
+      recordToStore = op.record;
+      eventPayload.eventType = "UPDATED";
+      eventPayload.record = op.record;
+    } else if (map instanceof ORMap2) {
+      oldRecord = map.getRecords(op.key);
+      if (op.opType === "OR_ADD") {
+        map.apply(op.key, op.orRecord);
+        eventPayload.eventType = "OR_ADD";
+        eventPayload.orRecord = op.orRecord;
+        recordToStore = {
+          type: "OR",
+          records: map.getRecords(op.key)
+        };
+      } else if (op.opType === "OR_REMOVE") {
+        map.applyTombstone(op.orTag);
+        eventPayload.eventType = "OR_REMOVE";
+        eventPayload.orTag = op.orTag;
+        recordToStore = {
+          type: "OR",
+          records: map.getRecords(op.key)
+        };
+        tombstonesToStore = {
+          type: "OR_TOMBSTONES",
+          tags: map.getTombstones()
+        };
+      }
+    }
+    this.queryRegistry.processChange(op.mapName, map, op.key, op.record || op.orRecord, oldRecord);
+    const mapSize = map instanceof ORMap2 ? map.totalRecords : map.size;
+    this.metricsService.setMapSize(op.mapName, mapSize);
+    if (this.storage) {
+      if (recordToStore) {
+        this.storage.store(op.mapName, op.key, recordToStore).catch((err) => {
+          logger.error({ mapName: op.mapName, key: op.key, err }, "Failed to persist op");
+        });
+      }
+      if (tombstonesToStore) {
+        this.storage.store(op.mapName, "__tombstones__", tombstonesToStore).catch((err) => {
+          logger.error({ mapName: op.mapName, err }, "Failed to persist tombstones");
+        });
+      }
+    }
+    this.broadcast({
+      type: "SERVER_EVENT",
+      payload: eventPayload,
+      timestamp: this.hlc.now()
+    }, originalSenderId);
+    const members = this.cluster.getMembers();
+    for (const memberId of members) {
+      if (!this.cluster.isLocal(memberId)) {
+        this.cluster.send(memberId, "CLUSTER_EVENT", eventPayload);
+      }
+    }
+    for (const interceptor of this.interceptors) {
+      if (interceptor.onAfterOp) {
+        interceptor.onAfterOp(op, context).catch((err) => {
+          logger.error({ err }, "Error in onAfterOp");
+        });
+      }
+    }
+  }
+  handleClusterEvent(payload) {
+    const { mapName, key, eventType } = payload;
+    const map = this.getMap(mapName, eventType === "OR_ADD" || eventType === "OR_REMOVE" ? "OR" : "LWW");
+    const oldRecord = map instanceof LWWMap2 ? map.getRecord(key) : null;
+    if (this.partitionService.isRelated(key)) {
+      if (map instanceof LWWMap2 && payload.record) {
+        map.merge(key, payload.record);
+      } else if (map instanceof ORMap2) {
+        if (eventType === "OR_ADD" && payload.orRecord) {
+          map.apply(key, payload.orRecord);
+        } else if (eventType === "OR_REMOVE" && payload.orTag) {
+          map.applyTombstone(payload.orTag);
+        }
+      }
+    }
+    this.queryRegistry.processChange(mapName, map, key, payload.record || payload.orRecord, oldRecord);
+    this.broadcast({
+      type: "SERVER_EVENT",
+      payload,
+      timestamp: this.hlc.now()
+    });
+  }
+  getMap(name, typeHint = "LWW") {
+    if (!this.maps.has(name)) {
+      let map;
+      if (typeHint === "OR") {
+        map = new ORMap2(this.hlc);
+      } else {
+        map = new LWWMap2(this.hlc);
+      }
+      this.maps.set(name, map);
+      if (this.storage) {
+        logger.info({ mapName: name }, "Loading map from storage...");
+        const loadPromise = this.loadMapFromStorage(name, typeHint);
+        this.mapLoadingPromises.set(name, loadPromise);
+        loadPromise.finally(() => {
+          this.mapLoadingPromises.delete(name);
+        });
+      }
+    }
+    return this.maps.get(name);
+  }
+  /**
+   * Returns map after ensuring it's fully loaded from storage.
+   * Use this for queries to avoid returning empty results during initial load.
+   */
+  async getMapAsync(name, typeHint = "LWW") {
+    const mapExisted = this.maps.has(name);
+    this.getMap(name, typeHint);
+    const loadingPromise = this.mapLoadingPromises.get(name);
+    const map = this.maps.get(name);
+    const mapSize = map instanceof LWWMap2 ? Array.from(map.entries()).length : map instanceof ORMap2 ? map.size : 0;
+    logger.info({
+      mapName: name,
+      mapExisted,
+      hasLoadingPromise: !!loadingPromise,
+      currentMapSize: mapSize
+    }, "[getMapAsync] State check");
+    if (loadingPromise) {
+      logger.info({ mapName: name }, "[getMapAsync] Waiting for loadMapFromStorage...");
+      await loadingPromise;
+      const newMapSize = map instanceof LWWMap2 ? Array.from(map.entries()).length : map instanceof ORMap2 ? map.size : 0;
+      logger.info({ mapName: name, mapSizeAfterLoad: newMapSize }, "[getMapAsync] Load completed");
+    }
+    return this.maps.get(name);
+  }
+  async loadMapFromStorage(name, typeHint) {
+    try {
+      const keys = await this.storage.loadAllKeys(name);
+      if (keys.length === 0) return;
+      const hasTombstones = keys.includes("__tombstones__");
+      const relatedKeys = keys.filter((k) => this.partitionService.isRelated(k));
+      if (relatedKeys.length === 0) return;
+      const records = await this.storage.loadAll(name, relatedKeys);
+      let count = 0;
+      let isOR = hasTombstones;
+      if (!isOR) {
+        for (const [k, v] of records) {
+          if (k !== "__tombstones__" && v.type === "OR") {
+            isOR = true;
+            break;
+          }
+        }
+      }
+      const currentMap = this.maps.get(name);
+      if (!currentMap) return;
+      let targetMap = currentMap;
+      if (isOR && currentMap instanceof LWWMap2) {
+        logger.info({ mapName: name }, "Map auto-detected as ORMap. Switching type.");
+        targetMap = new ORMap2(this.hlc);
+        this.maps.set(name, targetMap);
+      } else if (!isOR && currentMap instanceof ORMap2 && typeHint !== "OR") {
+        logger.info({ mapName: name }, "Map auto-detected as LWWMap. Switching type.");
+        targetMap = new LWWMap2(this.hlc);
+        this.maps.set(name, targetMap);
+      }
+      if (targetMap instanceof ORMap2) {
+        for (const [key, record] of records) {
+          if (key === "__tombstones__") {
+            const t = record;
+            if (t && t.tags) t.tags.forEach((tag) => targetMap.applyTombstone(tag));
+          } else {
+            const orVal = record;
+            if (orVal && orVal.records) {
+              orVal.records.forEach((r) => targetMap.apply(key, r));
+              count++;
+            }
+          }
+        }
+      } else if (targetMap instanceof LWWMap2) {
+        for (const [key, record] of records) {
+          if (!record.type) {
+            targetMap.merge(key, record);
+            count++;
+          }
+        }
+      }
+      if (count > 0) {
+        logger.info({ mapName: name, count }, "Loaded records for map");
+        this.queryRegistry.refreshSubscriptions(name, targetMap);
+        const mapSize = targetMap instanceof ORMap2 ? targetMap.totalRecords : targetMap.size;
+        this.metricsService.setMapSize(name, mapSize);
+      }
+    } catch (err) {
+      logger.error({ mapName: name, err }, "Failed to load map");
+    }
+  }
+  startGarbageCollection() {
+    this.gcInterval = setInterval(() => {
+      this.reportLocalHlc();
+    }, GC_INTERVAL_MS);
+  }
+  reportLocalHlc() {
+    let minHlc = this.hlc.now();
+    for (const client of this.clients.values()) {
+      if (HLC.compare(client.lastActiveHlc, minHlc) < 0) {
+        minHlc = client.lastActiveHlc;
+      }
+    }
+    const members = this.cluster.getMembers().sort();
+    const leaderId = members[0];
+    const myId = this.cluster.config.nodeId;
+    if (leaderId === myId) {
+      this.handleGcReport(myId, minHlc);
+    } else {
+      this.cluster.send(leaderId, "CLUSTER_GC_REPORT", { minHlc });
+    }
+  }
+  handleGcReport(nodeId, minHlc) {
+    this.gcReports.set(nodeId, minHlc);
+    const members = this.cluster.getMembers();
+    const allReported = members.every((m) => this.gcReports.has(m));
+    if (allReported) {
+      let globalSafe = this.hlc.now();
+      let initialized = false;
+      for (const ts of this.gcReports.values()) {
+        if (!initialized || HLC.compare(ts, globalSafe) < 0) {
+          globalSafe = ts;
+          initialized = true;
+        }
+      }
+      const olderThanMillis = globalSafe.millis - GC_AGE_MS;
+      const safeTimestamp = {
+        millis: olderThanMillis,
+        counter: 0,
+        nodeId: globalSafe.nodeId
+        // Doesn't matter much for comparison if millis match, but best effort
+      };
+      logger.info({
+        globalMinHlc: globalSafe.millis,
+        safeGcTimestamp: olderThanMillis,
+        reportsCount: this.gcReports.size
+      }, "GC Consensus Reached. Broadcasting Commit.");
+      const commitMsg = {
+        type: "CLUSTER_GC_COMMIT",
+        // Handled by cluster listener
+        payload: { safeTimestamp }
+      };
+      for (const member of members) {
+        if (!this.cluster.isLocal(member)) {
+          this.cluster.send(member, "CLUSTER_GC_COMMIT", { safeTimestamp });
+        }
+      }
+      this.performGarbageCollection(safeTimestamp);
+      this.gcReports.clear();
+    }
+  }
+  performGarbageCollection(olderThan) {
+    logger.info({ olderThanMillis: olderThan.millis }, "Performing Garbage Collection");
+    const now = Date.now();
+    for (const [name, map] of this.maps) {
+      if (map instanceof LWWMap2) {
+        for (const key of map.allKeys()) {
+          const record = map.getRecord(key);
+          if (record && record.value !== null && record.ttlMs) {
+            const expirationTime = record.timestamp.millis + record.ttlMs;
+            if (expirationTime < now) {
+              logger.info({ mapName: name, key }, "Record expired (TTL). Converting to tombstone.");
+              const tombstoneTimestamp = {
+                millis: expirationTime,
+                counter: 0,
+                // Reset counter for expiration time
+                nodeId: this.hlc.getNodeId
+                // Use our ID
+              };
+              const tombstone = { value: null, timestamp: tombstoneTimestamp };
+              const changed = map.merge(key, tombstone);
+              if (changed) {
+                if (this.storage) {
+                  this.storage.store(name, key, tombstone).catch(
+                    (err) => logger.error({ mapName: name, key, err }, "Failed to persist expired tombstone")
+                  );
+                }
+                const eventPayload = {
+                  mapName: name,
+                  key,
+                  eventType: "UPDATED",
+                  record: tombstone
+                };
+                this.broadcast({
+                  type: "SERVER_EVENT",
+                  payload: eventPayload,
+                  timestamp: this.hlc.now()
+                });
+                const members = this.cluster.getMembers();
+                for (const memberId of members) {
+                  if (!this.cluster.isLocal(memberId)) {
+                    this.cluster.send(memberId, "CLUSTER_EVENT", eventPayload);
+                  }
+                }
+              }
+            }
+          }
+        }
+        const removedKeys = map.prune(olderThan);
+        if (removedKeys.length > 0) {
+          logger.info({ mapName: name, count: removedKeys.length }, "Pruned records from LWW map");
+          if (this.storage) {
+            this.storage.deleteAll(name, removedKeys).catch((err) => {
+              logger.error({ mapName: name, err }, "Failed to delete pruned keys from storage");
+            });
+          }
+        }
+      } else if (map instanceof ORMap2) {
+        const items = map.items;
+        const tombstonesSet = map.tombstones;
+        const tagsToExpire = [];
+        for (const [key, keyMap] of items) {
+          for (const [tag, record] of keyMap) {
+            if (!tombstonesSet.has(tag)) {
+              if (record.ttlMs) {
+                const expirationTime = record.timestamp.millis + record.ttlMs;
+                if (expirationTime < now) {
+                  tagsToExpire.push({ key, tag });
+                }
+              }
+            }
+          }
+        }
+        for (const { key, tag } of tagsToExpire) {
+          logger.info({ mapName: name, key, tag }, "ORMap Record expired (TTL). Removing.");
+          map.applyTombstone(tag);
+          if (this.storage) {
+            const records = map.getRecords(key);
+            if (records.length > 0) {
+              this.storage.store(name, key, { type: "OR", records });
+            } else {
+              this.storage.delete(name, key);
+            }
+            const currentTombstones = map.getTombstones();
+            this.storage.store(name, "__tombstones__", {
+              type: "OR_TOMBSTONES",
+              tags: currentTombstones
+            });
+          }
+          const eventPayload = {
+            mapName: name,
+            key,
+            eventType: "OR_REMOVE",
+            orTag: tag
+          };
+          this.broadcast({
+            type: "SERVER_EVENT",
+            payload: eventPayload,
+            timestamp: this.hlc.now()
+          });
+          const members = this.cluster.getMembers();
+          for (const memberId of members) {
+            if (!this.cluster.isLocal(memberId)) {
+              this.cluster.send(memberId, "CLUSTER_EVENT", eventPayload);
+            }
+          }
+        }
+        const removedTags = map.prune(olderThan);
+        if (removedTags.length > 0) {
+          logger.info({ mapName: name, count: removedTags.length }, "Pruned tombstones from OR map");
+          if (this.storage) {
+            const currentTombstones = map.getTombstones();
+            this.storage.store(name, "__tombstones__", {
+              type: "OR_TOMBSTONES",
+              tags: currentTombstones
+            }).catch((err) => {
+              logger.error({ mapName: name, err }, "Failed to update tombstones");
+            });
+          }
+        }
+      }
+    }
+    this.broadcast({
+      type: "GC_PRUNE",
+      payload: {
+        olderThan
+      }
+    });
+  }
+  buildTLSOptions(config) {
+    const options = {
+      cert: readFileSync2(config.certPath),
+      key: readFileSync2(config.keyPath),
+      minVersion: config.minVersion || "TLSv1.2"
+    };
+    if (config.caCertPath) {
+      options.ca = readFileSync2(config.caCertPath);
+    }
+    if (config.ciphers) {
+      options.ciphers = config.ciphers;
+    }
+    if (config.passphrase) {
+      options.passphrase = config.passphrase;
+    }
+    return options;
+  }
+};
+
+// src/storage/PostgresAdapter.ts
+import { Pool } from "pg";
+var DEFAULT_TABLE_NAME = "topgun_maps";
+var TABLE_NAME_REGEX = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+function validateTableName(name) {
+  if (!TABLE_NAME_REGEX.test(name)) {
+    throw new Error(
+      `Invalid table name "${name}". Table name must start with a letter or underscore and contain only alphanumeric characters and underscores.`
+    );
+  }
+}
+var PostgresAdapter = class {
+  constructor(configOrPool, options) {
+    if (configOrPool instanceof Pool || configOrPool.connect) {
+      this.pool = configOrPool;
+    } else {
+      this.pool = new Pool(configOrPool);
+    }
+    const tableName = options?.tableName ?? DEFAULT_TABLE_NAME;
+    validateTableName(tableName);
+    this.tableName = tableName;
+  }
+  async initialize() {
+    const client = await this.pool.connect();
+    try {
+      await client.query(`
+        CREATE TABLE IF NOT EXISTS ${this.tableName} (
+          map_name TEXT NOT NULL,
+          key TEXT NOT NULL,
+          value JSONB,
+          ts_millis BIGINT NOT NULL,
+          ts_counter INTEGER NOT NULL,
+          ts_node_id TEXT NOT NULL,
+          is_deleted BOOLEAN DEFAULT FALSE,
+          PRIMARY KEY (map_name, key)
+        );
+      `);
+    } finally {
+      client.release();
+    }
+  }
+  async close() {
+    await this.pool.end();
+  }
+  async load(mapName, key) {
+    const res = await this.pool.query(
+      `SELECT value, ts_millis, ts_counter, ts_node_id, is_deleted 
+       FROM ${this.tableName} 
+       WHERE map_name = $1 AND key = $2`,
+      [mapName, key]
+    );
+    if (res.rows.length === 0) return void 0;
+    const row = res.rows[0];
+    return this.mapRowToRecord(row);
+  }
+  async loadAll(mapName, keys) {
+    const result = /* @__PURE__ */ new Map();
+    if (keys.length === 0) return result;
+    const res = await this.pool.query(
+      `SELECT key, value, ts_millis, ts_counter, ts_node_id, is_deleted 
+       FROM ${this.tableName} 
+       WHERE map_name = $1 AND key = ANY($2)`,
+      [mapName, keys]
+    );
+    for (const row of res.rows) {
+      result.set(row.key, this.mapRowToRecord(row));
+    }
+    return result;
+  }
+  async loadAllKeys(mapName) {
+    const res = await this.pool.query(
+      `SELECT key FROM ${this.tableName} WHERE map_name = $1`,
+      [mapName]
+    );
+    return res.rows.map((row) => row.key);
+  }
+  async store(mapName, key, record) {
+    let value;
+    let tsMillis;
+    let tsCounter;
+    let tsNodeId;
+    let isDeleted;
+    if (this.isORMapValue(record)) {
+      value = record;
+      tsMillis = 0;
+      tsCounter = 0;
+      tsNodeId = "__ORMAP__";
+      isDeleted = false;
+    } else {
+      const lww = record;
+      value = lww.value;
+      tsMillis = lww.timestamp.millis;
+      tsCounter = lww.timestamp.counter;
+      tsNodeId = lww.timestamp.nodeId;
+      isDeleted = lww.value === null;
+    }
+    await this.pool.query(
+      `INSERT INTO ${this.tableName} (map_name, key, value, ts_millis, ts_counter, ts_node_id, is_deleted)
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (map_name, key) DO UPDATE SET
+         value = EXCLUDED.value,
+         ts_millis = EXCLUDED.ts_millis,
+         ts_counter = EXCLUDED.ts_counter,
+         ts_node_id = EXCLUDED.ts_node_id,
+         is_deleted = EXCLUDED.is_deleted`,
+      [
+        mapName,
+        key,
+        JSON.stringify(value),
+        tsMillis,
+        tsCounter,
+        tsNodeId,
+        isDeleted
+      ]
+    );
+  }
+  async storeAll(mapName, records) {
+    const client = await this.pool.connect();
+    try {
+      await client.query("BEGIN");
+      for (const [key, record] of records) {
+        await this.store(mapName, key, record);
+      }
+      await client.query("COMMIT");
+    } catch (e) {
+      await client.query("ROLLBACK");
+      throw e;
+    } finally {
+      client.release();
+    }
+  }
+  async delete(mapName, key) {
+    await this.pool.query(`DELETE FROM ${this.tableName} WHERE map_name = $1 AND key = $2`, [mapName, key]);
+  }
+  async deleteAll(mapName, keys) {
+    if (keys.length === 0) return;
+    await this.pool.query(
+      `DELETE FROM ${this.tableName} WHERE map_name = $1 AND key = ANY($2)`,
+      [mapName, keys]
+    );
+  }
+  mapRowToRecord(row) {
+    if (row.ts_node_id === "__ORMAP__") {
+      return row.value;
+    }
+    return {
+      value: row.is_deleted ? null : row.value,
+      timestamp: {
+        millis: Number(row.ts_millis),
+        counter: row.ts_counter,
+        nodeId: row.ts_node_id
+      }
+    };
+  }
+  isORMapValue(record) {
+    return record && typeof record === "object" && (record.type === "OR" || record.type === "OR_TOMBSTONES");
+  }
+};
+
+// src/storage/MemoryServerAdapter.ts
+var MemoryServerAdapter = class {
+  constructor() {
+    // Map<mapName, Map<key, value>>
+    this.storage = /* @__PURE__ */ new Map();
+  }
+  async initialize() {
+    console.log("[MemoryServerAdapter] Initialized in-memory storage");
+  }
+  async close() {
+    this.storage.clear();
+    console.log("[MemoryServerAdapter] Storage cleared and closed");
+  }
+  getMap(mapName) {
+    let map = this.storage.get(mapName);
+    if (!map) {
+      map = /* @__PURE__ */ new Map();
+      this.storage.set(mapName, map);
+    }
+    return map;
+  }
+  async load(mapName, key) {
+    return this.getMap(mapName).get(key);
+  }
+  async loadAll(mapName, keys) {
+    const map = this.getMap(mapName);
+    const result = /* @__PURE__ */ new Map();
+    for (const key of keys) {
+      const value = map.get(key);
+      if (value !== void 0) {
+        result.set(key, value);
+      }
+    }
+    return result;
+  }
+  async loadAllKeys(mapName) {
+    return Array.from(this.getMap(mapName).keys());
+  }
+  async store(mapName, key, record) {
+    this.getMap(mapName).set(key, record);
+  }
+  async storeAll(mapName, records) {
+    const map = this.getMap(mapName);
+    for (const [key, value] of records) {
+      map.set(key, value);
+    }
+  }
+  async delete(mapName, key) {
+    this.getMap(mapName).delete(key);
+  }
+  async deleteAll(mapName, keys) {
+    const map = this.getMap(mapName);
+    for (const key of keys) {
+      map.delete(key);
+    }
+  }
+};
+
+// src/interceptor/TimestampInterceptor.ts
+var TimestampInterceptor = class {
+  constructor() {
+    this.name = "TimestampInterceptor";
+  }
+  async onBeforeOp(op, context) {
+    if (op.opType === "PUT" && op.record && op.record.value) {
+      if (typeof op.record.value === "object" && op.record.value !== null && !Array.isArray(op.record.value)) {
+        const newValue = {
+          ...op.record.value,
+          _serverTimestamp: Date.now()
+        };
+        logger.debug({ key: op.key, mapName: op.mapName, interceptor: this.name }, "Added timestamp");
+        return {
+          ...op,
+          record: {
+            ...op.record,
+            value: newValue
+          }
+        };
+      }
+    }
+    return op;
+  }
+};
+
+// src/interceptor/RateLimitInterceptor.ts
+var RateLimitInterceptor = class {
+  constructor(config = { windowMs: 1e3, maxOps: 50 }) {
+    this.name = "RateLimitInterceptor";
+    this.limits = /* @__PURE__ */ new Map();
+    this.config = config;
+  }
+  async onBeforeOp(op, context) {
+    const clientId = context.clientId;
+    const now = Date.now();
+    let limit = this.limits.get(clientId);
+    if (!limit || now > limit.resetTime) {
+      limit = {
+        count: 0,
+        resetTime: now + this.config.windowMs
+      };
+      this.limits.set(clientId, limit);
+    }
+    limit.count++;
+    if (limit.count > this.config.maxOps) {
+      logger.warn({ clientId, opId: op.id, count: limit.count }, "Rate limit exceeded");
+      throw new Error("Rate limit exceeded");
+    }
+    return op;
+  }
+  // Cleanup old entries periodically? 
+  // For now we rely on resetTime check, but map grows. 
+  // Simple cleanup on reset logic:
+  // In a real system, we'd use Redis or a proper cache with TTL.
+  // Here we can just prune occasionally or relying on connection disconnect?
+  // Optimization: Cleanup on disconnect
+  async onDisconnect(context) {
+    this.limits.delete(context.clientId);
+  }
+};
+export {
+  MemoryServerAdapter,
+  PostgresAdapter,
+  RateLimitInterceptor,
+  SecurityManager,
+  ServerCoordinator,
+  TimestampInterceptor,
+  logger
+};
+//# sourceMappingURL=index.mjs.map