@typedb/driver-http 3.14.0-rc0 → 3.15.0-rc3

package/README.md

@@ -45,3 +45,16 @@ if (answer.answerType === "conceptRows") {
     })
 }
 ```
+
+To connect over TLS to a server whose certificate is signed by a private CA, pass the CA certificate file in Node.js:
+
+```ts
+const driver = new TypeDBHttpDriver({
+    username: "admin",
+    password: "password",
+    addresses: [ "https://typedb.example.com:8000" ],
+    tls: { rootCAPath: "ca.pem" },
+});
+```
+
+With a root CA, every address must use `https`. In browsers, add the CA to the operating system's or the browser's trust store instead.

package/dist/index.cjs

@@ -1,4 +1,4 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// ../../../../../../../../../execroot/_main/bazel-out/k8-opt/bin/http-ts/src/params.ts
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } async function _asyncNullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return await rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }// ../../../../../../../../../execroot/_main/bazel-out/k8-opt/bin/http-ts/src/params.ts
 function isBasicParams(params) {
   return `addresses` in params;
 }
@@ -47,6 +47,126 @@ function allOrigins(params) {
   else return params.translatedAddresses.map((ta) => ta.external);
 }
 
+// ../../../../../../../../../execroot/_main/bazel-out/k8-opt/bin/http-ts/src/transport.ts
+var CONNECT_TIMEOUT_MILLIS = 1e4;
+var REQUEST_INACTIVITY_TIMEOUT_MILLIS = 3e5;
+var KEEP_ALIVE_SOCKET_TIMEOUT_MILLIS = 5e3;
+var PEM_CERTIFICATE_REGEX = /-----BEGIN (TRUSTED )?CERTIFICATE-----.*?-----END \1CERTIFICATE-----/gs;
+var TlsConfigError = class extends Error {
+};
+function createFetch(tls, origins) {
+  const rootCAPath = _optionalChain([tls, 'optionalAccess', _ => _.rootCAPath]);
+  if (rootCAPath === void 0) return (url, init) => fetch(url, init);
+  const plainOrigin = origins.find((origin) => !isHttps(origin));
+  const plainOriginError = plainOrigin === void 0 ? void 0 : plainHttpError(plainOrigin);
+  let httpsClient;
+  return async (url, init) => {
+    if (plainOriginError !== void 0) throw plainOriginError;
+    if (!isHttps(url)) {
+      const { protocol, host } = new URL(url);
+      throw plainHttpError(`${protocol}//${host}`);
+    }
+    _nullishCoalesce(httpsClient, () => ( (httpsClient = createHttpsClient(rootCAPath).catch((error) => {
+      httpsClient = void 0;
+      throw error;
+    }))));
+    const { https, agent } = await httpsClient;
+    return requestWithAgent(https, agent, url, init);
+  };
+}
+async function createHttpsClient(rootCAPath) {
+  if (!isNodeJs()) {
+    throw new TlsConfigError("A TLS root CA can only be set in Node.js: in browsers, add the CA to the trust store.");
+  }
+  let https;
+  let fs;
+  let crypto;
+  try {
+    [https, fs, crypto] = await Promise.all([
+      importNodeModule("node:https"),
+      importNodeModule("node:fs/promises"),
+      importNodeModule("node:crypto")
+    ]);
+  } catch (error) {
+    throw new TlsConfigError(`Cannot load the Node.js modules for TLS: ${error.message}`);
+  }
+  let rootCA;
+  try {
+    rootCA = await fs.readFile(rootCAPath, "utf8");
+  } catch (error) {
+    throw new TlsConfigError(`Cannot read the TLS root CA file '${rootCAPath}': ${error.message}`);
+  }
+  const certificates = _nullishCoalesce(rootCA.match(PEM_CERTIFICATE_REGEX), () => ( []));
+  if (certificates.length === 0) {
+    throw new TlsConfigError(`The TLS root CA file '${rootCAPath}' does not contain a PEM certificate.`);
+  }
+  try {
+    certificates.forEach((certificate) => new crypto.X509Certificate(certificate));
+  } catch (error) {
+    throw new TlsConfigError(
+      `The TLS root CA file '${rootCAPath}' contains an invalid certificate: ${error.message}`
+    );
+  }
+  const agent = new https.Agent({ ca: rootCA, keepAlive: true, timeout: KEEP_ALIVE_SOCKET_TIMEOUT_MILLIS });
+  return { https, agent };
+}
+function plainHttpError(origin) {
+  return new TlsConfigError(`A TLS root CA is set, but ${origin} does not use https.`);
+}
+function isHttps(url) {
+  try {
+    return new URL(url).protocol === "https:";
+  } catch (e3) {
+    return false;
+  }
+}
+function isNodeJs() {
+  return typeof process !== "undefined" && typeof _optionalChain([process, 'access', _2 => _2.versions, 'optionalAccess', _3 => _3.node]) === "string";
+}
+function importNodeModule(specifier) {
+  return Promise.resolve().then(() => _interopRequireWildcard(require(
+    /* @vite-ignore */
+    /* webpackIgnore: true */
+    specifier
+  )));
+}
+function requestWithAgent(https, agent, url, init) {
+  return new Promise((resolve, reject) => {
+    const options = { method: init.method, headers: init.headers, agent };
+    const request = https.request(url, options, (response) => {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(chunk));
+      response.on("error", reject);
+      response.on("end", () => {
+        try {
+          const status = _nullishCoalesce(response.statusCode, () => ( 0));
+          const headers = new Headers();
+          for (const [name, value] of Object.entries(response.headers)) {
+            if (value !== void 0) headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+          }
+          const body = status === 204 || status === 304 ? null : Buffer.concat(chunks);
+          resolve(new Response(body, { status, statusText: response.statusMessage, headers }));
+        } catch (error) {
+          reject(error);
+        }
+      });
+    });
+    request.on("error", reject);
+    request.on("socket", (socket) => {
+      if (!socket.connecting) return;
+      socket.setTimeout(0);
+      const connectTimeout = setTimeout(
+        () => request.destroy(new Error("Connection timed out")),
+        CONNECT_TIMEOUT_MILLIS
+      );
+      socket.once("secureConnect", () => clearTimeout(connectTimeout));
+      socket.once("close", () => clearTimeout(connectTimeout));
+    });
+    request.setTimeout(REQUEST_INACTIVITY_TIMEOUT_MILLIS, () => request.destroy(new Error("Request timed out")));
+    request.end(init.body);
+  });
+}
+
 // ../../../../../../../../../execroot/_main/bazel-out/k8-opt/bin/http-ts/src/response.ts
 function isApiError(err) {
   return err != null && typeof err.code === "string" && typeof err.message === "string";
@@ -293,25 +413,38 @@ function isDigit(c) {
 
 // ../../../../../../../../../execroot/_main/bazel-out/k8-opt/bin/http-ts/src/analyzed-conjunction.ts
 function getVariableName(structure, variable) {
-  return _optionalChain([structure, 'access', _ => _.variables, 'access', _2 => _2[variable.id], 'optionalAccess', _3 => _3.name]);
+  return _optionalChain([structure, 'access', _4 => _4.variables, 'access', _5 => _5[variable.id], 'optionalAccess', _6 => _6.name]);
 }
 
 // ../../../../../../../../../execroot/_main/bazel-out/k8-opt/bin/http-ts/src/index.ts
 var HTTP_UNAUTHORIZED = 401;
 var HTTP_MISDIRECTED = 421;
-var TRANSIENT_SIGNIN_ERROR_CODES = /* @__PURE__ */ new Set(["HDR2", "SRV14", "CSV8", "CSV9"]);
+var TRANSIENT_SIGNIN_ERROR_CODES = /* @__PURE__ */ new Set(["SRV14", "CSV8", "CSV9"]);
 var PRIMARY_FAILOVER_RETRIES = 3;
 var PRIMARY_SELECTION_WAIT_MS = 2e3;
 function isApiErrResp(value) {
-  return value !== null && "err" in value;
+  return "err" in value;
+}
+function isOriginFailure(value) {
+  return "failure" in value;
+}
+function tokenErrToResult(tokenResp, origin) {
+  const { code, message } = tokenResp.err;
+  if (TRANSIENT_SIGNIN_ERROR_CODES.has(code))
+    return { failure: `Server at ${origin} failed signin with [${code}] ${message}` };
+  else
+    return tokenResp;
 }
-function tokenErrToResult(tokenResp) {
-  return TRANSIENT_SIGNIN_ERROR_CODES.has(tokenResp.err.code) ? null : tokenResp;
+function errorMessage(error) {
+  const reason = _nullishCoalesce(_optionalChain([error, 'optionalAccess', _7 => _7.cause]), () => ( error));
+  const { message, code } = _nullishCoalesce(reason, () => ( {}));
+  return (message || code || String(reason)).trim();
 }
 var TypeDBHttpDriver = class {
   constructor(params) {
     this.params = params;
     this.currentOrigin = remoteOrigin(params);
+    this.fetch = createFetch(params.tls, allOrigins(params));
   }
   getDatabases() {
     return this.apiGet(`/v1/databases`);
@@ -428,59 +561,58 @@ var TypeDBHttpDriver = class {
     const initial = await this.tryApiReq(method, path, body, options);
     if (isApiErrResp(initial)) return initial;
     let result = initial;
-    if (result !== null && result.status === HTTP_MISDIRECTED) {
+    if (!isOriginFailure(result) && result.status === HTTP_MISDIRECTED) {
       const redirected = await this.followMisdirected(result, method, path, body, options);
       if (isApiErrResp(redirected)) return redirected;
       result = redirected;
     }
-    if (result === null || !result.ok) {
-      const startOrigin = this.currentOrigin;
-      triedOrigins.add(startOrigin);
-      const fallback = await this.tryFallbackOrigins(method, path, body, options, triedOrigins);
+    if (isOriginFailure(result) || !result.ok) {
+      const fallback = await this.tryFallbackOrigins(method, path, body, options, triedOrigins, result);
       if (isApiErrResp(fallback)) return fallback;
-      if (fallback !== null && (result === null || fallback.ok)) {
-        result = fallback;
-      } else if (result !== null) {
-        this.switchOrigin(startOrigin);
-      }
+      result = fallback;
+    }
+    if (isOriginFailure(result)) {
+      return driverError("HDR1", `Cannot connect to any server (last error: ${result.failure})`);
     }
-    return _nullishCoalesce(result, () => ( driverError("HDR1", "Cannot connect to any server")));
+    return result;
   }
   async tryApiReq(method, path, body, options) {
-    const url = `${this.currentOrigin}${path}`;
+    const origin = this.currentOrigin;
     let tokenResp = await this.getToken();
-    if ("err" in tokenResp) return tokenErrToResult(tokenResp);
+    if (isOriginFailure(tokenResp)) return tokenResp;
+    if (isApiErrResp(tokenResp)) return tokenErrToResult(tokenResp, origin);
     const bodyString = body !== void 0 ? stringifyJson(body) : void 0;
     let headers = this.authHeaders(tokenResp.ok.token, options);
-    let resp;
-    try {
-      resp = await fetch(url, { method, body: bodyString, headers });
-    } catch (e3) {
-      return null;
-    }
-    if (resp.status === HTTP_UNAUTHORIZED) {
+    let resp = await this.fetchFrom(origin, path, { method, body: bodyString, headers });
+    if (!isApiErrResp(resp) && !isOriginFailure(resp) && resp.status === HTTP_UNAUTHORIZED) {
       tokenResp = await this.refreshToken();
-      if ("err" in tokenResp) return tokenErrToResult(tokenResp);
+      if (isOriginFailure(tokenResp)) return tokenResp;
+      if (isApiErrResp(tokenResp)) return tokenErrToResult(tokenResp, origin);
       headers = this.authHeaders(tokenResp.ok.token, options);
-      try {
-        resp = await fetch(url, { method, body: bodyString, headers });
-      } catch (e4) {
-        return null;
-      }
+      resp = await this.fetchFrom(origin, path, { method, body: bodyString, headers });
     }
     return resp;
   }
+  async fetchFrom(origin, path, init) {
+    try {
+      return await this.fetch(`${origin}${path}`, init);
+    } catch (error) {
+      if (error instanceof TlsConfigError) return driverError("HDR3", error.message);
+      return { failure: `Cannot connect to server at ${origin}: ${errorMessage(error)}` };
+    }
+  }
   async followMisdirected(resp, method, path, body, options) {
+    const origin = this.currentOrigin;
     if (await this.switchToRedirectTarget(resp)) {
       return await this.tryApiReq(method, path, body, options);
     }
-    return null;
+    return { failure: `Server at ${origin} returned 421 Misdirected Request without another primary address` };
   }
   async switchToRedirectTarget(resp) {
     let json;
     try {
       json = parseJson(await resp.text());
-    } catch (e5) {
+    } catch (e4) {
       return false;
     }
     if (!isMisdirectedError(json)) return false;
@@ -489,33 +621,46 @@ var TypeDBHttpDriver = class {
     this.switchOrigin(newOrigin);
     return true;
   }
-  async tryFallbackOrigins(method, path, body, options, triedOrigins) {
+  async tryFallbackOrigins(method, path, body, options, triedOrigins, startResult) {
+    const startOrigin = this.currentOrigin;
+    triedOrigins.add(startOrigin);
     const origins = allOrigins(this.params);
     let lastError = null;
+    let lastFailure = null;
     for (const origin of origins) {
       if (triedOrigins.has(origin)) continue;
       this.switchOrigin(origin);
       const initial = await this.tryApiReq(method, path, body, options);
-      if (initial === null) continue;
+      if (isOriginFailure(initial)) {
+        lastFailure = initial;
+        continue;
+      }
       if (isApiErrResp(initial)) return initial;
       let result = initial;
       if (result.status === HTTP_MISDIRECTED) {
         const redirected = await this.followMisdirected(result, method, path, body, options);
-        if (redirected === null) continue;
+        if (isOriginFailure(redirected)) {
+          lastFailure = redirected;
+          continue;
+        }
         if (isApiErrResp(redirected)) return redirected;
         result = redirected;
       }
       if (result.ok) return result;
       lastError = result;
     }
-    return lastError;
+    if (!isOriginFailure(startResult)) {
+      this.switchOrigin(startOrigin);
+      return startResult;
+    }
+    return _nullishCoalesce(_nullishCoalesce(lastError, () => ( lastFailure)), () => ( startResult));
   }
   switchOrigin(origin) {
     this.currentOrigin = origin;
     this.token = void 0;
   }
   authHeaders(token, options) {
-    return { "Authorization": `Bearer ${token}`, "Content-Type": "application/json", ..._optionalChain([options, 'optionalAccess', _4 => _4.headers]) };
+    return { "Authorization": `Bearer ${token}`, "Content-Type": "application/json", ..._optionalChain([options, 'optionalAccess', _8 => _8.headers]) };
   }
   getToken() {
     if (this.token) {
@@ -527,26 +672,21 @@ var TypeDBHttpDriver = class {
     return this.signinOnce();
   }
   async signinOnce() {
-    const url = `${this.currentOrigin}/v1/signin`;
     const body = { username: this.params.username, password: this.params.password };
-    let resp;
-    try {
-      resp = await fetch(url, { method: "POST", body: stringifyJson(body), headers: { "Content-Type": "application/json" } });
-    } catch (e6) {
-      return driverError("HDR2", `Cannot connect to server at ${this.currentOrigin}`);
-    }
+    const resp = await this.fetchFrom(this.currentOrigin, "/v1/signin", { method: "POST", body: stringifyJson(body), headers: { "Content-Type": "application/json" } });
+    if (isApiErrResp(resp) || isOriginFailure(resp)) return resp;
     const json = await this.jsonOrNull(resp);
-    if (resp.ok && typeof _optionalChain([json, 'optionalAccess', _5 => _5.token]) === "string") {
+    if (resp.ok && typeof _optionalChain([json, 'optionalAccess', _9 => _9.token]) === "string") {
       this.token = json.token;
       return { ok: json };
     }
     if (isApiError(json)) return { err: json, status: resp.status };
-    return driverError("HDR2", `Unexpected signin response from ${this.currentOrigin} (HTTP ${resp.status})`);
+    return { failure: `Unexpected signin response from ${this.currentOrigin} (HTTP ${resp.status})` };
   }
   async jsonOrNull(resp) {
     try {
       return parseJson(await resp.text());
-    } catch (e7) {
+    } catch (e5) {
       return null;
     }
   }

package/dist/index.d.ts

@@ -2,11 +2,26 @@ interface DriverParamsBasic {
     username: string;
     password: string;
     addresses: string[];
+    tls?: DriverTlsConfig;
 }
 interface DriverParamsTranslated {
     username: string;
     password: string;
     translatedAddresses: TranslatedAddress[];
+    tls?: DriverTlsConfig;
+}
+/**
+ * TLS settings for `https` addresses. Without them, the driver trusts the certificate authorities that the
+ * runtime trusts by default.
+ */
+interface DriverTlsConfig {
+    /**
+     * The path to the PEM file with the certificate of the CA that signed the servers' certificates. When set, the
+     * driver trusts only this CA, and every address must use `https`. The file is read on the first request, and
+     * requests fail with `HDR3` if it cannot be used. Supported in Node.js only: browsers trust the certificates of
+     * their own trust store.
+     */
+    rootCAPath?: string;
 }
 interface TranslatedAddress {
     external: string;
@@ -123,7 +138,7 @@ type ConjunctionIndex$1 = number;
 type VariableInfo = {
     name: string | null;
 };
-type ConstraintAny = ConstraintIsa | ConstraintIsaExact | ConstraintHas | ConstraintLinks | ConstraintSub | ConstraintSubExact | ConstraintOwns | ConstraintRelates | ConstraintPlays | ConstraintExpression | ConstraintFunction | ConstraintComparison | ConstraintIs | ConstraintIid | ConstraintDeleteConcepts | ConstraintKind | ConstraintValue | ConstraintLabel | ConstraintOr | ConstraintNot | ConstraintTry;
+type ConstraintAny = ConstraintIsa | ConstraintIsaExact | ConstraintHas | ConstraintLinks | ConstraintSub | ConstraintSubExact | ConstraintOwns | ConstraintRelates | ConstraintPlays | ConstraintExpression | ConstraintFunction | ConstraintComparison | ConstraintIs | ConstraintIid | ConstraintDeleteConcepts | ConstraintKind | ConstraintValue | ConstraintIsSet | ConstraintLabel | ConstraintOr | ConstraintNot | ConstraintTry;
 type ConstraintSpan = {
     begin: number;
     end: number;
@@ -233,6 +248,11 @@ interface ConstraintValue {
     attributeType: ConstraintVertexVariable;
     valueType: string;
 }
+interface ConstraintIsSet {
+    tag: "isSet";
+    textSpan: ConstraintSpan;
+    variables: ConstraintVertexVariable[];
+}
 interface ConstraintKind {
     tag: "kind";
     textSpan: ConstraintSpan;
@@ -485,6 +505,7 @@ declare class TypeDBHttpDriver {
     private params;
     private token?;
     private currentOrigin;
+    private readonly fetch;
     constructor(params: DriverParams);
     getDatabases(): Promise<ApiResponse<DatabasesListResponse>>;
     getDatabase(name: string): Promise<ApiResponse<Database>>;
@@ -519,6 +540,7 @@ declare class TypeDBHttpDriver {
     private apiReq;
     private apiReqOnce;
     private tryApiReq;
+    private fetchFrom;
     private followMisdirected;
     private switchToRedirectTarget;
     private tryFallbackOrigins;
@@ -554,4 +576,4 @@ type GivenRows = {
     [varName: string]: GivenRowEntry;
 }[];
 
-export { type AnalyzeOptions, type AnalyzeResponse, type AnalyzedConjunction, type AnalyzedFetch, type AnalyzedFunction, type AnalyzedPipeline, type Answer, type AnswerType, type ApiError, type ApiErrorResponse, type ApiOkResponse, type ApiResponse, type Attribute, type AttributeType, type Concept, type ConceptDocument, type ConceptDocumentsQueryResponse, type ConceptRow, type ConceptRowAnswer, type ConceptRowsQueryResponse, type ConceptRowsQueryResponseLegacy, type ConjunctionAnnotations, type ConstraintAny, type ConstraintComparison, type ConstraintDeleteConcepts, type ConstraintExpression, type ConstraintExpressionLegacy, type ConstraintFunction, type ConstraintHas, type ConstraintIid, type ConstraintIs, type ConstraintIsa, type ConstraintIsaExact, type ConstraintKind, type ConstraintLabel, type ConstraintLinks, type ConstraintLinksLegacy, type ConstraintNot, type ConstraintOr, type ConstraintOwns, type ConstraintPlays, type ConstraintRelates, type ConstraintSpan, type ConstraintSub, type ConstraintSubExact, type ConstraintTry, type ConstraintValue, type ConstraintVertexAny, type ConstraintVertexLabel, type ConstraintVertexNamedRole, type ConstraintVertexValue, type ConstraintVertexVariable, type Database, type DatabasesListResponse, type Distribution, type DriverParams, type DriverParamsBasic, type DriverParamsTranslated, type EdgeKind, type Entity, type EntityType, type FetchAnnotationFieldEntry, type FunctionReturnStructure, type FunctionSingleReturnSelector, type Given, type GivenRowEntry, type GivenRows, type InstantiableType, type MisdirectedError, type OkQueryResponse, type PipelineStage, type QueryConjunctionLegacy, type QueryOptions, type QueryResponse, type QueryResponseBase, type QueryStructureLegacy, type QueryType, type Reducer, type Relation, type RelationType, type ReplicationRole, type ReplicationStatus, type RoleType, type Server, type ServersListResponse, type SignInResponse, type ThingKind, type TransactionOpenResponse, type TransactionOptions, type TransactionType, type TranslatedAddress, type Type, TypeDBHttpDriver, type TypeKind, type User, type UsersListResponse, type Value, type ValueKind, type ValueType, type VariableAnnotations, type VariableId, type VariableInfo, type VersionResponse, allOrigins, driverError, getVariableName, hostPortFromOrigin, isApiError, isApiErrorResponse, isBasicParams, isMisdirectedError, isOkResponse, isQueryResponseLegacy, isTranslatedParams, parseJson, remoteOrigin, resolveOrigin, stringifyJson };
+export { type AnalyzeOptions, type AnalyzeResponse, type AnalyzedConjunction, type AnalyzedFetch, type AnalyzedFunction, type AnalyzedPipeline, type Answer, type AnswerType, type ApiError, type ApiErrorResponse, type ApiOkResponse, type ApiResponse, type Attribute, type AttributeType, type Concept, type ConceptDocument, type ConceptDocumentsQueryResponse, type ConceptRow, type ConceptRowAnswer, type ConceptRowsQueryResponse, type ConceptRowsQueryResponseLegacy, type ConjunctionAnnotations, type ConstraintAny, type ConstraintComparison, type ConstraintDeleteConcepts, type ConstraintExpression, type ConstraintExpressionLegacy, type ConstraintFunction, type ConstraintHas, type ConstraintIid, type ConstraintIs, type ConstraintIsSet, type ConstraintIsa, type ConstraintIsaExact, type ConstraintKind, type ConstraintLabel, type ConstraintLinks, type ConstraintLinksLegacy, type ConstraintNot, type ConstraintOr, type ConstraintOwns, type ConstraintPlays, type ConstraintRelates, type ConstraintSpan, type ConstraintSub, type ConstraintSubExact, type ConstraintTry, type ConstraintValue, type ConstraintVertexAny, type ConstraintVertexLabel, type ConstraintVertexNamedRole, type ConstraintVertexValue, type ConstraintVertexVariable, type Database, type DatabasesListResponse, type Distribution, type DriverParams, type DriverParamsBasic, type DriverParamsTranslated, type DriverTlsConfig, type EdgeKind, type Entity, type EntityType, type FetchAnnotationFieldEntry, type FunctionReturnStructure, type FunctionSingleReturnSelector, type Given, type GivenRowEntry, type GivenRows, type InstantiableType, type MisdirectedError, type OkQueryResponse, type PipelineStage, type QueryConjunctionLegacy, type QueryOptions, type QueryResponse, type QueryResponseBase, type QueryStructureLegacy, type QueryType, type Reducer, type Relation, type RelationType, type ReplicationRole, type ReplicationStatus, type RoleType, type Server, type ServersListResponse, type SignInResponse, type ThingKind, type TransactionOpenResponse, type TransactionOptions, type TransactionType, type TranslatedAddress, type Type, TypeDBHttpDriver, type TypeKind, type User, type UsersListResponse, type Value, type ValueKind, type ValueType, type VariableAnnotations, type VariableId, type VariableInfo, type VersionResponse, allOrigins, driverError, getVariableName, hostPortFromOrigin, isApiError, isApiErrorResponse, isBasicParams, isMisdirectedError, isOkResponse, isQueryResponseLegacy, isTranslatedParams, parseJson, remoteOrigin, resolveOrigin, stringifyJson };

package/dist/index.mjs

@@ -47,6 +47,126 @@ function allOrigins(params) {
   else return params.translatedAddresses.map((ta) => ta.external);
 }
 
+// ../../../../../../../../../execroot/_main/bazel-out/k8-opt/bin/http-ts/src/transport.ts
+var CONNECT_TIMEOUT_MILLIS = 1e4;
+var REQUEST_INACTIVITY_TIMEOUT_MILLIS = 3e5;
+var KEEP_ALIVE_SOCKET_TIMEOUT_MILLIS = 5e3;
+var PEM_CERTIFICATE_REGEX = /-----BEGIN (TRUSTED )?CERTIFICATE-----.*?-----END \1CERTIFICATE-----/gs;
+var TlsConfigError = class extends Error {
+};
+function createFetch(tls, origins) {
+  const rootCAPath = tls?.rootCAPath;
+  if (rootCAPath === void 0) return (url, init) => fetch(url, init);
+  const plainOrigin = origins.find((origin) => !isHttps(origin));
+  const plainOriginError = plainOrigin === void 0 ? void 0 : plainHttpError(plainOrigin);
+  let httpsClient;
+  return async (url, init) => {
+    if (plainOriginError !== void 0) throw plainOriginError;
+    if (!isHttps(url)) {
+      const { protocol, host } = new URL(url);
+      throw plainHttpError(`${protocol}//${host}`);
+    }
+    httpsClient ?? (httpsClient = createHttpsClient(rootCAPath).catch((error) => {
+      httpsClient = void 0;
+      throw error;
+    }));
+    const { https, agent } = await httpsClient;
+    return requestWithAgent(https, agent, url, init);
+  };
+}
+async function createHttpsClient(rootCAPath) {
+  if (!isNodeJs()) {
+    throw new TlsConfigError("A TLS root CA can only be set in Node.js: in browsers, add the CA to the trust store.");
+  }
+  let https;
+  let fs;
+  let crypto;
+  try {
+    [https, fs, crypto] = await Promise.all([
+      importNodeModule("node:https"),
+      importNodeModule("node:fs/promises"),
+      importNodeModule("node:crypto")
+    ]);
+  } catch (error) {
+    throw new TlsConfigError(`Cannot load the Node.js modules for TLS: ${error.message}`);
+  }
+  let rootCA;
+  try {
+    rootCA = await fs.readFile(rootCAPath, "utf8");
+  } catch (error) {
+    throw new TlsConfigError(`Cannot read the TLS root CA file '${rootCAPath}': ${error.message}`);
+  }
+  const certificates = rootCA.match(PEM_CERTIFICATE_REGEX) ?? [];
+  if (certificates.length === 0) {
+    throw new TlsConfigError(`The TLS root CA file '${rootCAPath}' does not contain a PEM certificate.`);
+  }
+  try {
+    certificates.forEach((certificate) => new crypto.X509Certificate(certificate));
+  } catch (error) {
+    throw new TlsConfigError(
+      `The TLS root CA file '${rootCAPath}' contains an invalid certificate: ${error.message}`
+    );
+  }
+  const agent = new https.Agent({ ca: rootCA, keepAlive: true, timeout: KEEP_ALIVE_SOCKET_TIMEOUT_MILLIS });
+  return { https, agent };
+}
+function plainHttpError(origin) {
+  return new TlsConfigError(`A TLS root CA is set, but ${origin} does not use https.`);
+}
+function isHttps(url) {
+  try {
+    return new URL(url).protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function isNodeJs() {
+  return typeof process !== "undefined" && typeof process.versions?.node === "string";
+}
+function importNodeModule(specifier) {
+  return import(
+    /* @vite-ignore */
+    /* webpackIgnore: true */
+    specifier
+  );
+}
+function requestWithAgent(https, agent, url, init) {
+  return new Promise((resolve, reject) => {
+    const options = { method: init.method, headers: init.headers, agent };
+    const request = https.request(url, options, (response) => {
+      const chunks = [];
+      response.on("data", (chunk) => chunks.push(chunk));
+      response.on("error", reject);
+      response.on("end", () => {
+        try {
+          const status = response.statusCode ?? 0;
+          const headers = new Headers();
+          for (const [name, value] of Object.entries(response.headers)) {
+            if (value !== void 0) headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+          }
+          const body = status === 204 || status === 304 ? null : Buffer.concat(chunks);
+          resolve(new Response(body, { status, statusText: response.statusMessage, headers }));
+        } catch (error) {
+          reject(error);
+        }
+      });
+    });
+    request.on("error", reject);
+    request.on("socket", (socket) => {
+      if (!socket.connecting) return;
+      socket.setTimeout(0);
+      const connectTimeout = setTimeout(
+        () => request.destroy(new Error("Connection timed out")),
+        CONNECT_TIMEOUT_MILLIS
+      );
+      socket.once("secureConnect", () => clearTimeout(connectTimeout));
+      socket.once("close", () => clearTimeout(connectTimeout));
+    });
+    request.setTimeout(REQUEST_INACTIVITY_TIMEOUT_MILLIS, () => request.destroy(new Error("Request timed out")));
+    request.end(init.body);
+  });
+}
+
 // ../../../../../../../../../execroot/_main/bazel-out/k8-opt/bin/http-ts/src/response.ts
 function isApiError(err) {
   return err != null && typeof err.code === "string" && typeof err.message === "string";
@@ -299,19 +419,32 @@ function getVariableName(structure, variable) {
 // ../../../../../../../../../execroot/_main/bazel-out/k8-opt/bin/http-ts/src/index.ts
 var HTTP_UNAUTHORIZED = 401;
 var HTTP_MISDIRECTED = 421;
-var TRANSIENT_SIGNIN_ERROR_CODES = /* @__PURE__ */ new Set(["HDR2", "SRV14", "CSV8", "CSV9"]);
+var TRANSIENT_SIGNIN_ERROR_CODES = /* @__PURE__ */ new Set(["SRV14", "CSV8", "CSV9"]);
 var PRIMARY_FAILOVER_RETRIES = 3;
 var PRIMARY_SELECTION_WAIT_MS = 2e3;
 function isApiErrResp(value) {
-  return value !== null && "err" in value;
+  return "err" in value;
+}
+function isOriginFailure(value) {
+  return "failure" in value;
+}
+function tokenErrToResult(tokenResp, origin) {
+  const { code, message } = tokenResp.err;
+  if (TRANSIENT_SIGNIN_ERROR_CODES.has(code))
+    return { failure: `Server at ${origin} failed signin with [${code}] ${message}` };
+  else
+    return tokenResp;
 }
-function tokenErrToResult(tokenResp) {
-  return TRANSIENT_SIGNIN_ERROR_CODES.has(tokenResp.err.code) ? null : tokenResp;
+function errorMessage(error) {
+  const reason = error?.cause ?? error;
+  const { message, code } = reason ?? {};
+  return (message || code || String(reason)).trim();
 }
 var TypeDBHttpDriver = class {
   constructor(params) {
     this.params = params;
     this.currentOrigin = remoteOrigin(params);
+    this.fetch = createFetch(params.tls, allOrigins(params));
   }
   getDatabases() {
     return this.apiGet(`/v1/databases`);
@@ -428,53 +561,52 @@ var TypeDBHttpDriver = class {
     const initial = await this.tryApiReq(method, path, body, options);
     if (isApiErrResp(initial)) return initial;
     let result = initial;
-    if (result !== null && result.status === HTTP_MISDIRECTED) {
+    if (!isOriginFailure(result) && result.status === HTTP_MISDIRECTED) {
       const redirected = await this.followMisdirected(result, method, path, body, options);
       if (isApiErrResp(redirected)) return redirected;
       result = redirected;
     }
-    if (result === null || !result.ok) {
-      const startOrigin = this.currentOrigin;
-      triedOrigins.add(startOrigin);
-      const fallback = await this.tryFallbackOrigins(method, path, body, options, triedOrigins);
+    if (isOriginFailure(result) || !result.ok) {
+      const fallback = await this.tryFallbackOrigins(method, path, body, options, triedOrigins, result);
       if (isApiErrResp(fallback)) return fallback;
-      if (fallback !== null && (result === null || fallback.ok)) {
-        result = fallback;
-      } else if (result !== null) {
-        this.switchOrigin(startOrigin);
-      }
+      result = fallback;
+    }
+    if (isOriginFailure(result)) {
+      return driverError("HDR1", `Cannot connect to any server (last error: ${result.failure})`);
     }
-    return result ?? driverError("HDR1", "Cannot connect to any server");
+    return result;
   }
   async tryApiReq(method, path, body, options) {
-    const url = `${this.currentOrigin}${path}`;
+    const origin = this.currentOrigin;
     let tokenResp = await this.getToken();
-    if ("err" in tokenResp) return tokenErrToResult(tokenResp);
+    if (isOriginFailure(tokenResp)) return tokenResp;
+    if (isApiErrResp(tokenResp)) return tokenErrToResult(tokenResp, origin);
     const bodyString = body !== void 0 ? stringifyJson(body) : void 0;
     let headers = this.authHeaders(tokenResp.ok.token, options);
-    let resp;
-    try {
-      resp = await fetch(url, { method, body: bodyString, headers });
-    } catch {
-      return null;
-    }
-    if (resp.status === HTTP_UNAUTHORIZED) {
+    let resp = await this.fetchFrom(origin, path, { method, body: bodyString, headers });
+    if (!isApiErrResp(resp) && !isOriginFailure(resp) && resp.status === HTTP_UNAUTHORIZED) {
       tokenResp = await this.refreshToken();
-      if ("err" in tokenResp) return tokenErrToResult(tokenResp);
+      if (isOriginFailure(tokenResp)) return tokenResp;
+      if (isApiErrResp(tokenResp)) return tokenErrToResult(tokenResp, origin);
       headers = this.authHeaders(tokenResp.ok.token, options);
-      try {
-        resp = await fetch(url, { method, body: bodyString, headers });
-      } catch {
-        return null;
-      }
+      resp = await this.fetchFrom(origin, path, { method, body: bodyString, headers });
     }
     return resp;
   }
+  async fetchFrom(origin, path, init) {
+    try {
+      return await this.fetch(`${origin}${path}`, init);
+    } catch (error) {
+      if (error instanceof TlsConfigError) return driverError("HDR3", error.message);
+      return { failure: `Cannot connect to server at ${origin}: ${errorMessage(error)}` };
+    }
+  }
   async followMisdirected(resp, method, path, body, options) {
+    const origin = this.currentOrigin;
     if (await this.switchToRedirectTarget(resp)) {
       return await this.tryApiReq(method, path, body, options);
     }
-    return null;
+    return { failure: `Server at ${origin} returned 421 Misdirected Request without another primary address` };
   }
   async switchToRedirectTarget(resp) {
     let json;
@@ -489,26 +621,39 @@ var TypeDBHttpDriver = class {
     this.switchOrigin(newOrigin);
     return true;
   }
-  async tryFallbackOrigins(method, path, body, options, triedOrigins) {
+  async tryFallbackOrigins(method, path, body, options, triedOrigins, startResult) {
+    const startOrigin = this.currentOrigin;
+    triedOrigins.add(startOrigin);
     const origins = allOrigins(this.params);
     let lastError = null;
+    let lastFailure = null;
     for (const origin of origins) {
       if (triedOrigins.has(origin)) continue;
       this.switchOrigin(origin);
       const initial = await this.tryApiReq(method, path, body, options);
-      if (initial === null) continue;
+      if (isOriginFailure(initial)) {
+        lastFailure = initial;
+        continue;
+      }
       if (isApiErrResp(initial)) return initial;
       let result = initial;
       if (result.status === HTTP_MISDIRECTED) {
         const redirected = await this.followMisdirected(result, method, path, body, options);
-        if (redirected === null) continue;
+        if (isOriginFailure(redirected)) {
+          lastFailure = redirected;
+          continue;
+        }
         if (isApiErrResp(redirected)) return redirected;
         result = redirected;
       }
       if (result.ok) return result;
       lastError = result;
     }
-    return lastError;
+    if (!isOriginFailure(startResult)) {
+      this.switchOrigin(startOrigin);
+      return startResult;
+    }
+    return lastError ?? lastFailure ?? startResult;
   }
   switchOrigin(origin) {
     this.currentOrigin = origin;
@@ -527,21 +672,16 @@ var TypeDBHttpDriver = class {
     return this.signinOnce();
   }
   async signinOnce() {
-    const url = `${this.currentOrigin}/v1/signin`;
     const body = { username: this.params.username, password: this.params.password };
-    let resp;
-    try {
-      resp = await fetch(url, { method: "POST", body: stringifyJson(body), headers: { "Content-Type": "application/json" } });
-    } catch {
-      return driverError("HDR2", `Cannot connect to server at ${this.currentOrigin}`);
-    }
+    const resp = await this.fetchFrom(this.currentOrigin, "/v1/signin", { method: "POST", body: stringifyJson(body), headers: { "Content-Type": "application/json" } });
+    if (isApiErrResp(resp) || isOriginFailure(resp)) return resp;
     const json = await this.jsonOrNull(resp);
     if (resp.ok && typeof json?.token === "string") {
       this.token = json.token;
       return { ok: json };
     }
     if (isApiError(json)) return { err: json, status: resp.status };
-    return driverError("HDR2", `Unexpected signin response from ${this.currentOrigin} (HTTP ${resp.status})`);
+    return { failure: `Unexpected signin response from ${this.currentOrigin} (HTTP ${resp.status})` };
   }
   async jsonOrNull(resp) {
     try {

package/package.json

@@ -1 +1 @@
-{"name": "@typedb/driver-http", "version": "3.14.0-rc0", "description": "TypeDB HTTP Driver", "author": "TypeDB Community <community@typedb.com>", "license": "Apache-2.0", "homepage": "https://typedb.com", "repository": {"type": "git", "url": "https://github.com/typedb/typedb-driver"}, "bugs": {"url": "https://github.com/typedb/typedb-driver/issues"}, "keywords": ["database", "typedb"], "main": "dist/index.cjs", "module": "dist/index.mjs", "types": "dist/index.d.ts", "type": "module", "exports": {".": {"types": "./dist/index.d.ts", "import": "./dist/index.mjs", "require": "./dist/index.cjs"}}, "scripts": {"build:dev": "tsc", "build": "tsup", "test": "cucumber-js", "docs": "typedoc"}, "packageManager": "pnpm@8.15.9", "packageConfig": {"access": "public"}, "devDependencies": {"@cucumber/cucumber": "9.0.0", "@types/node": "24.0.12", "tsup": "8.5.0", "typedoc": "^0.28.7", "typescript": "5.8.3"}}
+{"name": "@typedb/driver-http", "version": "3.15.0-rc3", "description": "TypeDB HTTP Driver", "author": "TypeDB Community <community@typedb.com>", "license": "Apache-2.0", "homepage": "https://typedb.com", "repository": {"type": "git", "url": "https://github.com/typedb/typedb-driver"}, "bugs": {"url": "https://github.com/typedb/typedb-driver/issues"}, "keywords": ["database", "typedb"], "main": "dist/index.cjs", "module": "dist/index.mjs", "types": "dist/index.d.ts", "type": "module", "exports": {".": {"types": "./dist/index.d.ts", "import": "./dist/index.mjs", "require": "./dist/index.cjs"}}, "scripts": {"build:dev": "tsc", "build": "tsup", "test": "cucumber-js", "docs": "typedoc"}, "packageManager": "pnpm@8.15.9", "packageConfig": {"access": "public"}, "devDependencies": {"@cucumber/cucumber": "9.0.0", "@types/node": "24.0.12", "tsup": "8.5.0", "typedoc": "^0.28.7", "typescript": "5.8.3"}}