axiodb 11.9.16 → 12.10.17

package/README.md

@@ -29,6 +29,7 @@
 - [AxioDBCloud — Connecting Remotely](#-axiodbcloud--connecting-remotely)
   - [Simple: connect without authentication](#simple-connect-without-authentication)
   - [Advanced: TCP authentication](#advanced-tcp-authentication)
+  - [Advanced: TLS encryption](#advanced-tls-encryption)
 - [Troubleshooting](#-troubleshooting)
 - [Docker Deployment](#-docker-deployment)
   - [Simple: run the container](#simple-run-the-container)
@@ -212,7 +213,9 @@ await session.withTransaction(async (tx) => {
 - **🔁 Auto-Reconnect:** exponential backoff, up to 10 retry attempts
 - **💓 Heartbeat Monitoring:** `PING`/`PONG` every 30 seconds
 - **🆔 Request Correlation:** UUID-based request/response matching
-- **🧵 Connection Pooling:** client keeps a pool of `maxPoolSize` concurrent connections (default: 10, mirrors MongoDB's driver option) and distributes commands round-robin; server accepts 1,000+ concurrent connections total
+- **🧵 Connection Pooling:** client keeps a pool of `maxPoolSize` concurrent connections (default: 10, mirrors MongoDB's driver option) and routes each command to the least-busy connected member (fewest in-flight requests); server accepts 1,000+ concurrent connections total, capped at 100 per remote IP (see the [file descriptor limit note](#connection-refused--too-many-open-files-errors-at-high-concurrency) below if you're running near that scale)
+- **🛡️ Connection-Level DoS Protection:** per-IP concurrent connection cap (100) plus a separate per-IP connection-*attempt* rate limiter (300 attempts / 10s → 30s cooldown), so one client can't starve the server either by holding too many sockets open or by rapidly opening and dropping them
+- **🔒 Optional TLS Encryption:** encrypt the wire protocol with your own cert (see [Advanced: TLS](#advanced-tls-encryption) below) — off by default, so existing plaintext deployments are unaffected unless you turn it on
 - **📐 TypeScript Support:** full type definitions included
 
 **Use cases:** microservices sharing one AxioDB instance, Electron apps connecting to a local or remote database, teams sharing a development database, container/cloud deployments (AWS, Azure, GCP, DigitalOcean).
@@ -280,7 +283,56 @@ await client.login('admin', 'admin');
 - **Accounts that still need their forced password change are rejected outright (`403`)**, not allowed through with a warning — there's no TCP command to change a password today, so log into the GUI (`http://localhost:27018`) to complete it first, or authenticate with an account that already has.
 - If a Super Admin resets a user's password, changes their role, or deletes them via the GUI while that user has an open TCP connection, the TCP connection is immediately forced to re-authenticate on its next command.
 
-**Known limitations:** the TCP protocol itself is unencrypted (no TLS) — deploy behind a private network, VPN, or your own TLS termination if connecting over an untrusted network. There's currently no TCP command to change a password; that must go through the GUI.
+**Known limitations:** there's currently no TCP command to change a password; that must go through the GUI.
+
+### Advanced: TLS encryption
+
+By default, the TCP protocol is **plaintext** — anyone who can capture the network traffic between client and server (e.g. Wireshark on a shared network) can read your data and, if `TCPAuth` is on, your password. TLS fixes this. It's **off by default** — nothing below is required, and existing plaintext deployments keep working exactly as before unless you turn it on.
+
+**You must provide your own certificate + key.** AxioDB never generates one for you — that's a security decision only you can make (a real cert from a CA, or a self-signed one for local/private use).
+
+**Step 1 — get a cert + key.** For local/dev/private use, generate a self-signed one (one-time, takes a second):
+```bash
+openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes -subj "/CN=localhost"
+```
+This creates two files, `cert.pem` and `key.pem`, in your current folder. For a real production deployment reachable from the internet, use a cert from a real CA (Let's Encrypt, your org's CA, your cloud provider's managed cert) instead — the rest of the setup below is identical either way.
+
+**Step 2 — point the server at them:**
+```javascript
+const { AxioDB } = require('axiodb');
+const db = new AxioDB({
+  TCP: true,
+  TLS: true,
+  TLSCertPath: './cert.pem', // path to the file from step 1
+  TLSKeyPath: './key.pem',
+});
+```
+If `TLS: true` but either path is missing or unreadable, AxioDB throws immediately at startup — it never silently falls back to plaintext.
+
+**Step 3 — point the client at the same cert** (only needed because it's self-signed; a real CA-issued cert wouldn't need this step, the same way your browser trusts `https://` sites without extra setup):
+```javascript
+const { AxioDBCloud } = require('axiodb');
+const client = new AxioDBCloud("axiodb://localhost:27019", {
+  tls: true,
+  tlsCAPath: './cert.pem', // same cert.pem from step 1 - proves this server is the real one
+});
+await client.connect();
+```
+Without `tlsCAPath`, the client refuses to connect to a self-signed server by default (`tlsRejectUnauthorized` defaults to `true`) — this is intentional, it's the same protection that stops your browser from silently trusting a fake `https://` site. Only set `tlsRejectUnauthorized: false` for local/dev testing, never in production, since it turns that protection off entirely.
+
+**Running this in Docker?** The cert/key files need to get *into* the container. The simplest way to think about it: your cert files live on your real machine; a Docker **bind mount** (`-v`) makes a folder from your machine visible inside the container at whatever path you choose, and you point `AXIODB_TLS_CERT_PATH`/`AXIODB_TLS_KEY_PATH` at *that in-container path*, not your real machine's path:
+```bash
+# cert.pem and key.pem are really at /home/you/mycerts/ on your machine.
+# "/certs" below is just a name we're choosing for where they'll appear inside the container.
+docker run -d --name axiodb-server \
+  -p 27018:27018 -p 27019:27019 \
+  -v /home/you/mycerts:/certs:ro \
+  -e AXIODB_TLS=true \
+  -e AXIODB_TLS_CERT_PATH=/certs/cert.pem \
+  -e AXIODB_TLS_KEY_PATH=/certs/key.pem \
+  theankansaha/axiodb
+```
+The rule: the `-e AXIODB_TLS_CERT_PATH=...` value must always match the *right-hand side* of the `-v` mount (`/certs/...`), never the real path on your machine (`/home/you/mycerts/...`) — the container can't see your machine's filesystem directly, only whatever you've explicitly mounted into it.
 
 👉 **[Full AxioDBCloud Documentation](https://axiodb.in/cloud)** — setup guides, API reference, Docker examples
 
@@ -316,6 +368,27 @@ Your credentials are correct, but that account is still flagged for a forced pas
 
 Five failed logins from your IP within 15 minutes trigger a 15-minute lockout, shared between TCP and the GUI. Double check the credentials you're sending, wait out the cooldown, or fix the underlying typo/config issue causing repeated failures — there's no way to clear the lockout early.
 
+### `429` — "Too many concurrent connections from this IP address"
+
+Unrelated to the login lockout above — this fires at connection time, before any `AUTHENTICATE`, once a single remote IP has 100 concurrent open TCP sockets to the server (`MAX_CONNECTIONS_PER_IP`), regardless of whether any of those connections are authenticated. This caps how much of the server's total 1,000-connection budget one IP can claim, so one client can't starve every other client. It's per-*connection*, not per-*request* — a single `AxioDBCloud` client at the default `maxPoolSize: 10` is nowhere near this limit; you'd only hit it by running many separate client processes behind the same IP/NAT gateway, or a runaway reconnect loop leaking sockets. If you legitimately need more than 100 concurrent connections from one IP, that's a server-side constant (`MAX_CONNECTIONS_PER_IP` in `source/tcp/config/keys.ts`) — there's no runtime option to raise it yet.
+
+If you do set a `maxPoolSize` that pushes past this cap (or any other subset of the pool fails for another reason, e.g. a network blip), `connect()` doesn't throw as long as at least one pool member connected — it resolves with a smaller-than-requested pool and emits a `poolDegraded` event so you know about it instead of silently running under capacity:
+
+```javascript
+client.on('poolDegraded', ({ requested, connected, failed, errors }) => {
+  console.warn(`Pool came up smaller than requested: ${connected}/${requested} connected, ${failed} failed`);
+  console.warn(errors[0].message); // e.g. "Too many concurrent connections from this IP address"
+});
+
+await client.connect(); // resolves even if some pool members were rejected
+```
+
+(The very first connection in the pool is the exception — if *that* one fails, `connect()` rejects entirely, since it's the signal that the server is reachable and credentials are valid at all.)
+
+### `429` — "Too many connection attempts from this IP address. Try again later."
+
+Different from both `429`s above, and checked first: this guards against rapid connect-then-drop *churn*, which the concurrent-connection cap (`MAX_CONNECTIONS_PER_IP`) doesn't catch on its own — an attacker who never holds more than a few sockets open at once could still hammer the server with a high rate of connection attempts, each costing a TCP handshake and an accept/reject cycle, and stay under that cap the whole time. This is tracked separately, per IP, as a sliding window: once an IP crosses 300 connection attempts (successful or rejected, it doesn't matter which) within a trailing 10-second window, every new connection from that IP is rejected outright for the next 30 seconds. A normal `AxioDBCloud` client, even reconnecting a full `maxPoolSize: 10` pool repeatedly, is nowhere near this threshold — you'd only hit it via a genuine connection flood or a reconnect loop gone very wrong (e.g. retrying without backoff). There's no runtime option to raise these thresholds yet; they're constants in `source/tcp/config/keys.ts` (`CONNECTION_RATE_LIMIT_*`).
+
 ### `403` — "This is a reserved system database"
 
 You (or a client) tried to read/write a database literally named `config` — that name is reserved for AxioDB's own RBAC storage (`users`/`roles`/`permissions`) and is blocked on both the GUI and TCP, authenticated or not. Use a different database name.
@@ -330,6 +403,37 @@ You (or a client) tried to read/write a database literally named `config` — th
 
 See the [Docker Deployment](#-docker-deployment) section below, and `Docker/README.md` in the repository for a fuller Docker-specific troubleshooting guide (`docker logs`, port-conflict remapping, volume-mounting checklist).
 
+### Connection refused / "Too many open files" errors at high concurrency
+
+Each `AxioDBCloud` client opens `maxPoolSize` TCP sockets (default: 10), and the server holds one socket per connected client — both count against the OS's open-file-descriptor limit. Most Linux distros default `ulimit -n` to 1024 per process, which is enough for only ~100 clients at the default pool size before the server starts refusing new connections with `EMFILE`/`ENFILE`.
+
+If you're deploying towards the 1,000+ concurrent connections the server supports, raise the limit before starting the process:
+
+```bash
+ulimit -n 65536          # current shell / process
+node lib/config/DB.js
+```
+
+In Docker, set it on the container instead of the host shell:
+
+```bash
+docker run --ulimit nofile=65536:65536 -p 27018:27018 -p 27019:27019 theankansaha/axiodb
+```
+
+or, in Compose:
+
+```yaml
+services:
+  axiodb:
+    image: theankansaha/axiodb
+    ulimits:
+      nofile:
+        soft: 65536
+        hard: 65536
+```
+
+On the client side, prefer a smaller `maxPoolSize` per instance rather than raising it — the least-busy routing (see [Connection Pooling](#-axiodbcloud--connecting-remotely) above) already avoids the head-of-line blocking a bigger pool would otherwise compensate for.
+
 ---
 
 ## 🐳 Docker Deployment
@@ -362,12 +466,15 @@ Every option below has a default matching the image's previous fixed behavior
 | `AXIODB_GUI` | `true` | Enable the HTTP Control Server / web GUI on port 27018 |
 | `AXIODB_TCP` | `true` | Enable the AxioDBCloud TCP server on port 27019 |
 | `AXIODB_TCP_AUTH` | `true` | Require username/password authentication on TCP connections (same RBAC accounts as the GUI) |
+| `AXIODB_TLS` | `false` | Encrypt TCP connections with TLS instead of plaintext (see [Advanced: TLS encryption](#advanced-tls-encryption)) |
+| `AXIODB_TLS_CERT_PATH` | *(none)* | Path **inside the container** to a PEM cert file - required when `AXIODB_TLS=true`. Mount the real file in with `-v` first (see the TLS section above) |
+| `AXIODB_TLS_KEY_PATH` | *(none)* | Path **inside the container** to the matching PEM private key - required when `AXIODB_TLS=true` |
 | `AXIODB_ROOT_NAME` | `AxioDB` | Name of the root database folder created under the data volume |
 | `AXIODB_CUSTOM_PATH` | *(container's working directory)* | Custom path for database storage inside the container |
 
 > Ports themselves (27018/27019) aren't configurable via environment variable — remap them at the Docker layer with `-p <host-port>:27018` / `-p <host-port>:27019`.
 
-**Disabling TCP authentication** (only on a trusted private network — the wire is unencrypted; see [Known limitations](#advanced-tcp-authentication)):
+**Disabling TCP authentication** (only on a trusted private network — the wire is plaintext unless you also enable `AXIODB_TLS`; see [Advanced: TLS encryption](#advanced-tls-encryption)):
 ```bash
 docker run -d \
   --name axiodb-server \
@@ -402,6 +509,34 @@ volumes:
   axiodb-data:
 ```
 
+**The same, with TLS enabled** — note the two different kinds of entry under `volumes:`: `./mycerts:/certs:ro` is *your real folder* on the machine running Compose (because it contains a `/`), mounted read-only at `/certs` inside the container; `axiodb-data:/app` is a Docker-managed named volume (no `/`, just a label) for the actual database files:
+```yaml
+version: "3.8"
+
+services:
+  axiodb:
+    image: theankansaha/axiodb
+    container_name: axiodb-server
+    ports:
+      - "27018:27018"
+      - "27019:27019"
+    environment:
+      - AXIODB_GUI=true
+      - AXIODB_TCP=true
+      - AXIODB_TCP_AUTH=true
+      - AXIODB_TLS=true
+      - AXIODB_TLS_CERT_PATH=/certs/cert.pem
+      - AXIODB_TLS_KEY_PATH=/certs/key.pem
+      - AXIODB_ROOT_NAME=AxioDB
+    volumes:
+      - ./mycerts:/certs:ro      # your real cert.pem/key.pem folder -> /certs in the container
+      - axiodb-data:/app         # Docker-managed volume for database files
+    restart: unless-stopped
+
+volumes:
+  axiodb-data:
+```
+
 **Building the image from source, and a fuller Docker troubleshooting guide** (container won't start, port-in-use, data-persistence checks) live in [`Docker/README.md`](Docker/README.md) — the canonical Docker doc, not duplicated here in full.
 
 ---
@@ -445,7 +580,7 @@ A Super Admin can create additional roles from the predefined permission catalog
 
 **Index management:** the Control Server also exposes `GET /api/index/list`, `POST /api/index/create`, and `DELETE /api/index/delete`, gated by the same `index:view` / `index:create` / `index:delete` permissions (View role gets view-only, Admin and Super Admin get all three).
 
-> **Security note:** RBAC protects the Control Server's HTTP API and TCP server; both are still intended for trusted local/network access, not public internet exposure. See [Troubleshooting](#-troubleshooting) for the TLS caveat on TCP.
+> **Security note:** RBAC protects the Control Server's HTTP API and TCP server, but the HTTP GUI itself has no TLS support - keep it on a trusted local/private network, not public internet exposure. The TCP server *can* be encrypted (see [Advanced: TLS encryption](#advanced-tls-encryption)), which is recommended if it's reachable over any untrusted network.
 
 ---
 
@@ -764,7 +899,7 @@ Yes. Full type definitions are included — no separate `@types` package needed.
 No. AxioDB requires Node.js (v20+) and the filesystem — server-side and desktop only.
 
 **Q: What is AxioDBCloud?**
-TCP-based remote access for AxioDB. Deploy AxioDB in Docker, connect from multiple clients with the exact same API. Supports 1,000+ concurrent connections with auto-reconnect. Optional username/password authentication (`TCPAuth: true`) reuses the same RBAC accounts as the GUI — see [AxioDBCloud](#-axiodbcloud--connecting-remotely) above.
+TCP-based remote access for AxioDB. Deploy AxioDB in Docker, connect from multiple clients with the exact same API. Supports 1,000+ concurrent connections with auto-reconnect. Optional username/password authentication (`TCPAuth: true`) reuses the same RBAC accounts as the GUI, and optional TLS encryption (`TLS: true`) protects the wire protocol on untrusted networks — see [AxioDBCloud](#-axiodbcloud--connecting-remotely) above.
 
 ---
 

package/lib/Services/Indexation.operation.d.ts

@@ -27,6 +27,9 @@ export declare class AxioDB {
     private GUI;
     private TCP;
     private TCPAuth;
+    private TLS;
+    private TLSCertPath?;
+    private TLSKeyPath?;
     constructor(options?: AxioDBOptions);
     /**
      * Initializes the root directory for the AxioDB.

package/lib/Services/Indexation.operation.js

@@ -19,6 +19,7 @@ const FileManager_1 = __importDefault(require("../engine/Filesystem/FileManager"
 const FolderManager_1 = __importDefault(require("../engine/Filesystem/FolderManager"));
 const Keys_1 = require("../config/Keys/Keys");
 const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
 const database_operation_1 = __importDefault(require("./Database/database.operation"));
 // import startWebServer from "../server/Fastify";
 // Helper Classes
@@ -50,11 +51,12 @@ class AxioDB {
         this.GUI = Keys_1.General.DBMS_GUI_Enable;
         this.TCP = false;
         this.TCPAuth = false;
+        this.TLS = false;
         if (AxioDB._instance) {
             throw new Error("Only one instance of AxioDB is allowed.");
         }
         AxioDB._instance = this;
-        const { GUI, RootName, CustomPath, TCP, TCPAuth } = options;
+        const { GUI, RootName, CustomPath, TCP, TCPAuth, TLS, TLSCertPath, TLSKeyPath } = options;
         // Default Vlaues
         this.RootName = RootName || Keys_1.General.DBMS_Name; // Set the root name
         this.currentPATH = path_1.default.resolve(CustomPath || "."); // Set the current path
@@ -66,7 +68,23 @@ class AxioDB {
         this.GUI = GUI !== undefined ? GUI : Keys_1.General.DBMS_GUI_Enable; // Set GUI option
         this.TCP = TCP !== undefined ? TCP : false; // Set TCP option
         this.TCPAuth = TCPAuth !== undefined ? TCPAuth : false; // Set TCPAuth option
-        this.initializeRoot(); // Ensure root initialization (reads GUI/TCP/TCPAuth, so runs after they're set)
+        this.TLS = TLS !== undefined ? TLS : false; // Set TLS option
+        this.TLSCertPath = TLSCertPath;
+        this.TLSKeyPath = TLSKeyPath;
+        // Fail fast: never silently fall back to plaintext because a cert/key path was
+        // missing or unreadable - that would be a silent security downgrade.
+        if (this.TLS) {
+            if (!this.TLSCertPath || !this.TLSKeyPath) {
+                throw new Error("TLS: true requires both TLSCertPath and TLSKeyPath to be set.");
+            }
+            if (!fs_1.default.existsSync(this.TLSCertPath)) {
+                throw new Error(`TLSCertPath does not exist: ${this.TLSCertPath}`);
+            }
+            if (!fs_1.default.existsSync(this.TLSKeyPath)) {
+                throw new Error(`TLSKeyPath does not exist: ${this.TLSKeyPath}`);
+            }
+        }
+        this.initializeRoot(); // Ensure root initialization (reads GUI/TCP/TCPAuth/TLS, so runs after they're set)
     }
     /**
      * Initializes the root directory for the AxioDB.
@@ -100,9 +118,12 @@ class AxioDB {
                 (0, server_1.default)(this); // Start the web Control Server with the AxioDB instance
             }
             if (this.TCP) {
-                Console_helper_1.default.green("Starting AxioDB TCP Server...");
+                Console_helper_1.default.green(this.TLS ? "Starting AxioDB TCP Server (TLS)..." : "Starting AxioDB TCP Server...");
                 // Start the TCP Server with the AxioDB instance
-                (0, server_2.default)(this, undefined, this.TCPAuth).catch((error) => {
+                const tlsOptions = this.TLS
+                    ? { certPath: this.TLSCertPath, keyPath: this.TLSKeyPath }
+                    : undefined;
+                (0, server_2.default)(this, undefined, this.TCPAuth, tlsOptions).catch((error) => {
                     console.error("[AxioDB TCP Server] Failed to start:", error);
                 });
             }

package/lib/Services/Indexation.operation.js.map

@@ -1 +1 @@
-{"version":3,"file":"Indexation.operation.js","sourceRoot":"","sources":["../../source/Services/Indexation.operation.ts"],"names":[],"mappings":";AAAA,uDAAuD;;;;;;;;;;;;;;;AAEvD,mBAAmB;AACnB,mFAA2D;AAC3D,uFAA+D;AAC/D,8CAA8C;AAC9C,gDAAwB;AACxB,uFAAqD;AACrD,kDAAkD;AAElD,iBAAiB;AACjB,kFAAmD;AACnD,8EAA+C;AAC/C,0DAAwD;AACxD,gFAAuD;AAQvD,qEAAgE;AAEhE,kEAAyD;AACzD,mFAAmD;AACnD,4DAA8D;AAC9D,+FAA+D;AAE/D;;;;;;;;;;;;;GAaG;AACH;IAaE,YAAY,OAAO,GAAkB,EAAE;QAJ/B,QAAG,GAAY,cAAO,CAAC,eAAe,CAAC;QACvC,QAAG,GAAY,KAAK,CAAC;QACrB,YAAO,GAAY,KAAK,CAAC;QAG/B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAExB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAE5D,iBAAiB;QAEjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,cAAO,CAAC,SAAS,CAAC,CAAC,oBAAoB;QACnE,IAAI,CAAC,WAAW,GAAG,cAAI,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,uBAAuB;QAC3E,IAAI,CAAC,WAAW,GAAG,IAAI,qBAAW,EAAE,CAAC,CAAC,mCAAmC;QACzE,IAAI,CAAC,aAAa,GAAG,IAAI,uBAAa,EAAE,CAAC,CAAC,qCAAqC;QAC/E,IAAI,CAAC,SAAS,GAAG,IAAI,0BAAS,EAAE,CAAC,CAAC,iCAAiC;QACnE,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAc,EAAE,CAAC,CAAC,sCAAsC;QAClF,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC,CAAC,6BAA6B;QAChF,IAAI,CAAC,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAO,CAAC,eAAe,CAAC,CAAC,iBAAiB;QAC/E,IAAI,CAAC,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB;QAC7E,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,gFAAgF;IACzG,CAAC;IAED;;;;;;;;OAQG;IACW,cAAc;;YAC1B,IAAI,CAAC,WAAW,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB;YAExF,oCAAoC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE1E,IAAI,MAAM,CAAC,UAAU,KAAK,wBAAW,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CACzD,IAAI,CAAC,WAAW,CACjB,CAAC;gBAEF,IAAI,UAAU,CAAC,UAAU,KAAK,wBAAW,CAAC,EAAE,EAAE,CAAC;oBAC7C,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,CAAC,UAAU,EAAE,CAC3D,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAU,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,mEAAmE;gBAC9G,kCAAgB,CAAC,iBAAiB,EAAE,CAAC,CAAC,kEAAkE;YAC1G,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,wBAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACnD,IAAA,gBAAyB,EAAC,IAAI,CAAC,CAAC,CAAC,wDAAwD;YAC3F,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,wBAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBAC/C,gDAAgD;gBAChD,IAAA,gBAAqB,EAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBACnE,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;gBAC/D,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACH,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACU,QAAQ,CAAC,MAAc;;YAClC,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAEnD,uCAAuC;YACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,UAAU,KAAK,wBAAW,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,4BAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3C,6CAA6C;YAC7C,gFAAgF;YAChF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAED,wCAAwC;IACxC;;;;;;;;;;;;OAYG;IACU,eAAe;;YAC1B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAC3D,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAC/B,CAAC;YAEF,QAAQ;YAER,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CACzD,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAC/B,CAAC;YACF,gCAAgC;YAChC,IAAI,MAAM,IAAI,cAAc,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;gBACpD,8EAA8E;gBAC9E,MAAM,gBAAgB,GAAa,cAAc,CAAC,IAAI,CAAC,MAAM,CAC3D,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,8BAAgB,CACtD,CAAC;gBACF,MAAM,iBAAiB,GAAsB;oBAC3C,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;oBACrC,cAAc,EAAE,GAAG,gBAAgB,CAAC,MAAM,YAAY;oBACtD,eAAe,EAAE,gBAAgB;oBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,iBAAiB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAU,EAAE,EAAE,CACrD,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAChC;iBACF,CAAC;gBACF,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;OAaG;IACU,gBAAgB,CAAC,MAAc;;YAC1C,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC,UAAU,KAAK,wBAAW,CAAC,EAAE,CAAC;QAC9C,CAAC;KAAA;IAED,kBAAkB;IAClB;;;;;;;;;;OAUG;IACU,cAAc,CACzB,MAAc;;YAEd,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAEhE,IAAI,MAAM,CAAC,UAAU,KAAK,wBAAW,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B;gBAC3D,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAChC,aAAa,MAAM,uBAAuB,CAC3C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,aAAa,MAAM,iBAAiB,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;KAAA;CACF"}
+{"version":3,"file":"Indexation.operation.js","sourceRoot":"","sources":["../../source/Services/Indexation.operation.ts"],"names":[],"mappings":";AAAA,uDAAuD;;;;;;;;;;;;;;;AAEvD,mBAAmB;AACnB,mFAA2D;AAC3D,uFAA+D;AAC/D,8CAA8C;AAC9C,gDAAwB;AACxB,4CAAoB;AACpB,uFAAqD;AACrD,kDAAkD;AAElD,iBAAiB;AACjB,kFAAmD;AACnD,8EAA+C;AAC/C,0DAAwD;AACxD,gFAAuD;AAQvD,qEAAgE;AAEhE,kEAAyD;AACzD,mFAAmD;AACnD,4DAA8D;AAC9D,+FAA+D;AAE/D;;;;;;;;;;;;;GAaG;AACH;IAgBE,YAAY,OAAO,GAAkB,EAAE;QAP/B,QAAG,GAAY,cAAO,CAAC,eAAe,CAAC;QACvC,QAAG,GAAY,KAAK,CAAC;QACrB,YAAO,GAAY,KAAK,CAAC;QACzB,QAAG,GAAY,KAAK,CAAC;QAK3B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QAExB,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAE1F,iBAAiB;QAEjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,cAAO,CAAC,SAAS,CAAC,CAAC,oBAAoB;QACnE,IAAI,CAAC,WAAW,GAAG,cAAI,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,uBAAuB;QAC3E,IAAI,CAAC,WAAW,GAAG,IAAI,qBAAW,EAAE,CAAC,CAAC,mCAAmC;QACzE,IAAI,CAAC,aAAa,GAAG,IAAI,uBAAa,EAAE,CAAC,CAAC,qCAAqC;QAC/E,IAAI,CAAC,SAAS,GAAG,IAAI,0BAAS,EAAE,CAAC,CAAC,iCAAiC;QACnE,IAAI,CAAC,cAAc,GAAG,IAAI,yBAAc,EAAE,CAAC,CAAC,sCAAsC;QAClF,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC,CAAC,6BAA6B;QAChF,IAAI,CAAC,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAO,CAAC,eAAe,CAAC,CAAC,iBAAiB;QAC/E,IAAI,CAAC,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,qBAAqB;QAC7E,IAAI,CAAC,GAAG,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,iBAAiB;QAC7D,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAE7B,+EAA+E;QAC/E,qEAAqE;QACrE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,oFAAoF;IAC7G,CAAC;IAED;;;;;;;;OAQG;IACW,cAAc;;YAC1B,IAAI,CAAC,WAAW,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,yBAAyB;YAExF,oCAAoC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAE1E,IAAI,MAAM,CAAC,UAAU,KAAK,wBAAW,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CACzD,IAAI,CAAC,WAAW,CACjB,CAAC;gBAEF,IAAI,UAAU,CAAC,UAAU,KAAK,wBAAW,CAAC,EAAE,EAAE,CAAC;oBAC7C,MAAM,IAAI,KAAK,CACb,mCAAmC,UAAU,CAAC,UAAU,EAAE,CAC3D,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAU,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,mEAAmE;gBAC9G,kCAAgB,CAAC,iBAAiB,EAAE,CAAC,CAAC,kEAAkE;YAC1G,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,wBAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACnD,IAAA,gBAAyB,EAAC,IAAI,CAAC,CAAC,CAAC,wDAAwD;YAC3F,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,wBAAO,CAAC,KAAK,CACX,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,+BAA+B,CACnF,CAAC;gBACF,gDAAgD;gBAChD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG;oBACzB,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,UAAoB,EAAE;oBAC9E,CAAC,CAAC,SAAS,CAAC;gBACd,IAAA,gBAAqB,EAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;oBAC/E,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;gBAC/D,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACH,IAAW,OAAO;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACU,QAAQ,CAAC,MAAc;;YAClC,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAEnD,uCAAuC;YACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,UAAU,KAAK,wBAAW,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;gBACjD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,4BAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3C,6CAA6C;YAC7C,gFAAgF;YAChF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;IAED,wCAAwC;IACxC;;;;;;;;;;;;OAYG;IACU,eAAe;;YAC1B,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAC3D,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAC/B,CAAC;YAEF,QAAQ;YAER,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CACzD,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAC/B,CAAC;YACF,gCAAgC;YAChC,IAAI,MAAM,IAAI,cAAc,IAAI,MAAM,IAAI,SAAS,EAAE,CAAC;gBACpD,8EAA8E;gBAC9E,MAAM,gBAAgB,GAAa,cAAc,CAAC,IAAI,CAAC,MAAM,CAC3D,CAAC,EAAU,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,8BAAgB,CACtD,CAAC;gBACF,MAAM,iBAAiB,GAAsB;oBAC3C,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;oBACrC,cAAc,EAAE,GAAG,gBAAgB,CAAC,MAAM,YAAY;oBACtD,eAAe,EAAE,gBAAgB;oBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,iBAAiB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAU,EAAE,EAAE,CACrD,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAChC;iBACF,CAAC;gBACF,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KAAA;IAED;;;;;;;;;;;;;OAaG;IACU,gBAAgB,CAAC,MAAc;;YAC1C,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAChE,OAAO,MAAM,CAAC,UAAU,KAAK,wBAAW,CAAC,EAAE,CAAC;QAC9C,CAAC;KAAA;IAED,kBAAkB;IAClB;;;;;;;;;;OAUG;IACU,cAAc,CACzB,MAAc;;YAEd,MAAM,MAAM,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAEhE,IAAI,MAAM,CAAC,UAAU,KAAK,wBAAW,CAAC,EAAE,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;gBACjD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B;gBAC3D,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAChC,aAAa,MAAM,uBAAuB,CAC3C,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,aAAa,MAAM,iBAAiB,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;KAAA;CACF"}

package/lib/client/AxioDBCloud.client.d.ts

@@ -6,18 +6,20 @@ import DatabaseProxy from './DatabaseProxy';
  * AxioDBCloud - TCP Client for remote AxioDB access
  *
  * Maintains a pool of `maxPoolSize` concurrent TCP connections (default: 10, mirrors
- * MongoDB's driver default naming/behavior) to the same server. Commands are distributed
- * round-robin across connected pool members; each member independently reconnects (with
- * exponential backoff) and re-authenticates, so one dropped connection never affects the
- * others or blocks in-flight commands routed to healthy members.
+ * MongoDB's driver default naming/behavior) to the same server. Commands are routed to
+ * whichever connected pool member has the fewest in-flight requests, so a slow command
+ * on one connection doesn't queue new commands behind it while other members sit idle;
+ * each member independently reconnects (with exponential backoff) and re-authenticates,
+ * so one dropped connection never affects the others or blocks in-flight commands routed
+ * to healthy members.
  */
 export declare class AxioDBCloud extends EventEmitter {
     private host;
     private port;
     private pool;
-    private roundRobinIndex;
     private options;
     private credentials?;
+    private readonly tlsCA?;
     constructor(connectionString: string, options?: AxioDBCloudOptions);
     /**
      * Parse connection string: axiodb://host:port
@@ -29,6 +31,13 @@ export declare class AxioDBCloud extends EventEmitter {
      * attempts against the server's shared per-IP rate limiter N times over for a single bad
      * -credentials connect() call, and ensures a bad-credentials failure never leaves any pool
      * member mid-reconnect.
+     *
+     * The first connection must succeed or `connect()` rejects entirely (it's the signal that
+     * the server is reachable and credentials are valid at all). The rest of the pool uses
+     * allSettled rather than all: if `maxPoolSize` asks for more connections than the server
+     * allows from this IP (see the server's per-IP connection cap) or a handful hit a transient
+     * error, the pool still comes up with however many succeeded instead of failing outright -
+     * a smaller-than-requested pool is far more useful to the caller than no pool at all.
      */
     connect(): Promise<void>;
     private createPooledConnection;
@@ -48,9 +57,14 @@ export declare class AxioDBCloud extends EventEmitter {
      */
     get authenticatedUser(): AuthenticatedUser | undefined;
     /**
-     * Send command to server - picks a connected pool member round-robin.
+     * Send command to server - picks the least-busy connected pool member.
      */
     sendCommand(command: CommandType, params: any): Promise<any>;
+    /**
+     * Picks the connected pool member with the fewest in-flight requests (least-busy),
+     * rather than round-robin, so a connection stuck on a slow command doesn't receive
+     * more work while other members are idle.
+     */
     private pickConnection;
     /**
      * Disconnect from server - closes every connection in the pool.

package/lib/client/AxioDBCloud.client.js

@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AxioDBCloud = void 0;
 /* eslint-disable @typescript-eslint/no-explicit-any */
 const events_1 = require("events");
+const fs_1 = __importDefault(require("fs"));
 const PooledConnection_1 = __importDefault(require("./PooledConnection"));
 const command_types_1 = require("../tcp/types/command.types");
 const client_types_1 = require("./types/client.types");
@@ -24,16 +25,18 @@ const DEFAULT_MAX_POOL_SIZE = 10;
  * AxioDBCloud - TCP Client for remote AxioDB access
  *
  * Maintains a pool of `maxPoolSize` concurrent TCP connections (default: 10, mirrors
- * MongoDB's driver default naming/behavior) to the same server. Commands are distributed
- * round-robin across connected pool members; each member independently reconnects (with
- * exponential backoff) and re-authenticates, so one dropped connection never affects the
- * others or blocks in-flight commands routed to healthy members.
+ * MongoDB's driver default naming/behavior) to the same server. Commands are routed to
+ * whichever connected pool member has the fewest in-flight requests, so a slow command
+ * on one connection doesn't queue new commands behind it while other members sit idle;
+ * each member independently reconnects (with exponential backoff) and re-authenticates,
+ * so one dropped connection never affects the others or blocks in-flight commands routed
+ * to healthy members.
  */
 class AxioDBCloud extends events_1.EventEmitter {
     constructor(connectionString, options) {
+        var _a, _b;
         super();
         this.pool = [];
-        this.roundRobinIndex = 0;
         // Increase max listeners for reconnection scenarios
         this.setMaxListeners(20);
         // Default 'error' listener: Node's EventEmitter throws synchronously when 'error' is
@@ -59,7 +62,12 @@ class AxioDBCloud extends events_1.EventEmitter {
             reconnectDelay: (options === null || options === void 0 ? void 0 : options.reconnectDelay) || 1000,
             heartbeatInterval: (options === null || options === void 0 ? void 0 : options.heartbeatInterval) || 30000,
             maxPoolSize: (options === null || options === void 0 ? void 0 : options.maxPoolSize) || DEFAULT_MAX_POOL_SIZE,
+            tls: (_a = options === null || options === void 0 ? void 0 : options.tls) !== null && _a !== void 0 ? _a : false,
+            tlsRejectUnauthorized: (_b = options === null || options === void 0 ? void 0 : options.tlsRejectUnauthorized) !== null && _b !== void 0 ? _b : true,
         };
+        if (options === null || options === void 0 ? void 0 : options.tlsCAPath) {
+            this.tlsCA = fs_1.default.readFileSync(options.tlsCAPath);
+        }
         if ((options === null || options === void 0 ? void 0 : options.username) && (options === null || options === void 0 ? void 0 : options.password)) {
             this.credentials = { username: options.username, password: options.password };
         }
@@ -83,6 +91,13 @@ class AxioDBCloud extends events_1.EventEmitter {
      * attempts against the server's shared per-IP rate limiter N times over for a single bad
      * -credentials connect() call, and ensures a bad-credentials failure never leaves any pool
      * member mid-reconnect.
+     *
+     * The first connection must succeed or `connect()` rejects entirely (it's the signal that
+     * the server is reachable and credentials are valid at all). The rest of the pool uses
+     * allSettled rather than all: if `maxPoolSize` asks for more connections than the server
+     * allows from this IP (see the server's per-IP connection cap) or a handful hit a transient
+     * error, the pool still comes up with however many succeeded instead of failing outright -
+     * a smaller-than-requested pool is far more useful to the caller than no pool at all.
      */
     connect() {
         return __awaiter(this, void 0, void 0, function* () {
@@ -93,7 +108,17 @@ class AxioDBCloud extends events_1.EventEmitter {
             this.pool = Array.from({ length: poolSize }, () => this.createPooledConnection());
             yield this.pool[0].connect();
             if (poolSize > 1) {
-                yield Promise.all(this.pool.slice(1).map((connection) => connection.connect()));
+                const results = yield Promise.allSettled(this.pool.slice(1).map((connection) => connection.connect()));
+                const failures = results.filter((result) => result.status === 'rejected');
+                if (failures.length > 0) {
+                    const event = {
+                        requested: poolSize,
+                        connected: poolSize - failures.length,
+                        failed: failures.length,
+                        errors: failures.map((failure) => failure.reason instanceof Error ? failure.reason : new Error(String(failure.reason))),
+                    };
+                    this.emit('poolDegraded', event);
+                }
             }
             this.emit('connected');
         });
@@ -104,6 +129,9 @@ class AxioDBCloud extends events_1.EventEmitter {
             reconnectAttempts: this.options.reconnectAttempts,
             reconnectDelay: this.options.reconnectDelay,
             heartbeatInterval: this.options.heartbeatInterval,
+            tls: this.options.tls,
+            tlsCA: this.tlsCA,
+            tlsRejectUnauthorized: this.options.tlsRejectUnauthorized,
         }, () => this.credentials, {
             onError: (error) => this.emit('error', error),
             onDisconnected: (hadError) => this.emit('disconnected', hadError),
@@ -145,7 +173,7 @@ class AxioDBCloud extends events_1.EventEmitter {
         return (_a = this.pool.find((connection) => connection.authUser)) === null || _a === void 0 ? void 0 : _a.authUser;
     }
     /**
-     * Send command to server - picks a connected pool member round-robin.
+     * Send command to server - picks the least-busy connected pool member.
      */
     sendCommand(command, params) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -156,19 +184,22 @@ class AxioDBCloud extends events_1.EventEmitter {
             return connection.sendCommand(command, params);
         });
     }
+    /**
+     * Picks the connected pool member with the fewest in-flight requests (least-busy),
+     * rather than round-robin, so a connection stuck on a slow command doesn't receive
+     * more work while other members are idle.
+     */
     pickConnection() {
-        const poolSize = this.pool.length;
-        if (poolSize === 0) {
-            return null;
-        }
-        for (let attempts = 0; attempts < poolSize; attempts++) {
-            const connection = this.pool[this.roundRobinIndex % poolSize];
-            this.roundRobinIndex = (this.roundRobinIndex + 1) % poolSize;
-            if (connection.state === client_types_1.ConnectionState.CONNECTED) {
-                return connection;
+        let best = null;
+        for (const connection of this.pool) {
+            if (connection.state !== client_types_1.ConnectionState.CONNECTED) {
+                continue;
+            }
+            if (best === null || connection.pendingCount < best.pendingCount) {
+                best = connection;
             }
         }
-        return null;
+        return best;
     }
     /**
      * Disconnect from server - closes every connection in the pool.

package/lib/client/AxioDBCloud.client.js.map

@@ -1 +1 @@
-{"version":3,"file":"AxioDBCloud.client.js","sourceRoot":"","sources":["../../source/client/AxioDBCloud.client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,uDAAuD;AACvD,mCAAsC;AACtC,0EAAkD;AAClD,8DAAyD;AACzD,uDAAsH;AACtH,oEAA4C;AAE5C,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;GAQG;AACH,iBAAyB,SAAQ,qBAAY;IAU3C,YAAY,gBAAwB,EAAE,OAA4B;QAChE,KAAK,EAAE,CAAC;QARF,SAAI,GAAuB,EAAE,CAAC;QAC9B,oBAAe,GAAG,CAAC,CAAC;QAS1B,oDAAoD;QACpD,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAEzB,qFAAqF;QACrF,oFAAoF;QACpF,wFAAwF;QACxF,kFAAkF;QAClF,yFAAyF;QACzF,wFAAwF;QACxF,4DAA4D;QAC5D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YAChC,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,KAAK,CACX,2CAA2C,EAC3C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAExB,4BAA4B;QAC5B,IAAI,CAAC,OAAO,GAAG;YACb,OAAO,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,KAAI,KAAK;YAClC,iBAAiB,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,iBAAiB,KAAI,EAAE;YACnD,cAAc,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,KAAI,IAAI;YAC/C,iBAAiB,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,iBAAiB,KAAI,KAAK;YACtD,WAAW,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,KAAI,qBAAqB;SAC3D,CAAC;QAEF,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,MAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA,EAAE,CAAC;YAC3C,IAAI,CAAC,WAAW,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,gBAAwB;QACpD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAEnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACd,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACG,OAAO;;YACX,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3G,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC1C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;YAElF,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAE7B,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAClF,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;KAAA;IAEO,sBAAsB;QAC5B,OAAO,IAAI,0BAAgB,CACzB,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EACT;YACE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;YAC3C,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;SAClD,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EACtB;YACE,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;YACpD,cAAc,EAAE,CAAC,QAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;YAC1E,cAAc,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;YACvE,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YAC7C,WAAW,EAAE,GAAG,EAAE;gBAChB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;SACF,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACG,KAAK,CAAC,QAAgB,EAAE,QAAgB;;YAC5C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,SAAS,CAAC,CAAC;YAC1G,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,gBAAgB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAClF,CAAC;YACF,IAAI,CAAC,WAAW,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;KAAA;IAED;;;OAGG;IACH,IAAI,iBAAiB;;QACnB,OAAO,MAAA,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,0CAAE,QAAQ,CAAC;IACvE,CAAC;IAED;;OAEG;IACG,WAAW,CAAC,OAAoB,EAAE,MAAW;;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YAED,OAAO,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;KAAA;IAEO,cAAc;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAClC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;YACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe,GAAG,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;YAC7D,IAAI,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,SAAS,EAAE,CAAC;gBACnD,OAAO,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACG,UAAU;;YACd,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,CAAC;KAAA;IAED;;OAEG;IACG,QAAQ,CAAC,IAAY;;YACzB,MAAM,IAAI,CAAC,WAAW,CAAC,2BAAW,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,OAAO,IAAI,uBAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;KAAA;IAEK,cAAc,CAAC,IAAY;;YAC/B,MAAM,IAAI,CAAC,WAAW,CAAC,2BAAW,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;KAAA;IAEK,gBAAgB,CAAC,IAAY;;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,2BAAW,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;KAAA;IAEK,eAAe;;YACnB,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,2BAAW,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;KAAA;IAED;;;OAGG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,8BAAe,CAAC,YAAY,CAAC;QACtC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YACnF,OAAO,8BAAe,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YACtF,OAAO,8BAAe,CAAC,YAAY,CAAC;QACtC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YACpF,OAAO,8BAAe,CAAC,UAAU,CAAC;QACpC,CAAC;QACD,OAAO,8BAAe,CAAC,MAAM,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,SAAS,CAAC,CAAC;IACxF,CAAC;CACF"}
+{"version":3,"file":"AxioDBCloud.client.js","sourceRoot":"","sources":["../../source/client/AxioDBCloud.client.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,uDAAuD;AACvD,mCAAsC;AACtC,4CAAoB;AACpB,0EAAkD;AAClD,8DAAyD;AACzD,uDAAyI;AACzI,oEAA4C;AAE5C,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,iBAAyB,SAAQ,qBAAY;IAY3C,YAAY,gBAAwB,EAAE,OAA4B;;QAChE,KAAK,EAAE,CAAC;QAVF,SAAI,GAAuB,EAAE,CAAC;QAYpC,oDAAoD;QACpD,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAEzB,qFAAqF;QACrF,oFAAoF;QACpF,wFAAwF;QACxF,kFAAkF;QAClF,yFAAyF;QACzF,wFAAwF;QACxF,4DAA4D;QAC5D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;YAChC,IAAI,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,KAAK,CACX,2CAA2C,EAC3C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC/C,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,0BAA0B;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QAExB,4BAA4B;QAC5B,IAAI,CAAC,OAAO,GAAG;YACb,OAAO,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO,KAAI,KAAK;YAClC,iBAAiB,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,iBAAiB,KAAI,EAAE;YACnD,cAAc,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,cAAc,KAAI,IAAI;YAC/C,iBAAiB,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,iBAAiB,KAAI,KAAK;YACtD,WAAW,EAAE,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,KAAI,qBAAqB;YAC1D,GAAG,QAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,mCAAI,KAAK;YAC1B,qBAAqB,QAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,qBAAqB,mCAAI,IAAI;SAC9D,CAAC;QAEF,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,YAAE,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,MAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA,EAAE,CAAC;YAC3C,IAAI,CAAC,WAAW,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAChF,CAAC;IACH,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,gBAAwB;QACpD,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAEnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACd,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;SAC7B,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;OAaG;IACG,OAAO;;YACX,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3G,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC1C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;YAElF,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAE7B,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACvG,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAC7B,CAAC,MAAM,EAAmC,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,UAAU,CAC1E,CAAC;gBAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,KAAK,GAAsB;wBAC/B,SAAS,EAAE,QAAQ;wBACnB,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC,MAAM;wBACrC,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC/B,OAAO,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CACrF;qBACF,CAAC;oBACF,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzB,CAAC;KAAA;IAEO,sBAAsB;QAC5B,OAAO,IAAI,0BAAgB,CACzB,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EACT;YACE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO;YAC7B,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc;YAC3C,iBAAiB,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YACjD,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,qBAAqB,EAAE,IAAI,CAAC,OAAO,CAAC,qBAAqB;SAC1D,EACD,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EACtB;YACE,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC;YACpD,cAAc,EAAE,CAAC,QAAiB,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC;YAC1E,cAAc,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC;YACvE,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;YAC7C,WAAW,EAAE,GAAG,EAAE;gBAChB,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;gBACtE,CAAC;YACH,CAAC;SACF,CACF,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACG,KAAK,CAAC,QAAgB,EAAE,QAAgB;;YAC5C,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,SAAS,CAAC,CAAC;YAC1G,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,gBAAgB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAClF,CAAC;YACF,IAAI,CAAC,WAAW,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;YAC1C,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;KAAA;IAED;;;OAGG;IACH,IAAI,iBAAiB;;QACnB,OAAO,MAAA,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,0CAAE,QAAQ,CAAC;IACvE,CAAC;IAED;;OAEG;IACG,WAAW,CAAC,OAAoB,EAAE,MAAW;;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YAED,OAAO,UAAU,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;KAAA;IAED;;;;OAIG;IACK,cAAc;QACpB,IAAI,IAAI,GAA4B,IAAI,CAAC;QAEzC,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,SAAS,EAAE,CAAC;gBACnD,SAAS;YACX,CAAC;YACD,IAAI,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACjE,IAAI,GAAG,UAAU,CAAC;YACpB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACG,UAAU;;YACd,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;QACjB,CAAC;KAAA;IAED;;OAEG;IACG,QAAQ,CAAC,IAAY;;YACzB,MAAM,IAAI,CAAC,WAAW,CAAC,2BAAW,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,OAAO,IAAI,uBAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;KAAA;IAEK,cAAc,CAAC,IAAY;;YAC/B,MAAM,IAAI,CAAC,WAAW,CAAC,2BAAW,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;KAAA;IAEK,gBAAgB,CAAC,IAAY;;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,2BAAW,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;KAAA;IAEK,eAAe;;YACnB,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,2BAAW,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;KAAA;IAED;;;OAGG;IACH,IAAI,KAAK;QACP,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,8BAAe,CAAC,YAAY,CAAC;QACtC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,SAAS,CAAC,EAAE,CAAC;YACnF,OAAO,8BAAe,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,YAAY,CAAC,EAAE,CAAC;YACtF,OAAO,8BAAe,CAAC,YAAY,CAAC;QACtC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,UAAU,CAAC,EAAE,CAAC;YACpF,OAAO,8BAAe,CAAC,UAAU,CAAC;QACpC,CAAC;QACD,OAAO,8BAAe,CAAC,MAAM,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,KAAK,8BAAe,CAAC,SAAS,CAAC,CAAC;IACxF,CAAC;CACF"}

package/lib/client/PooledConnection.d.ts

@@ -6,6 +6,11 @@ export interface PooledConnectionOptions {
     reconnectAttempts: number;
     reconnectDelay: number;
     heartbeatInterval: number;
+    /** Encrypt this connection with TLS instead of plaintext. */
+    tls?: boolean;
+    /** Pre-read CA certificate content (see AxioDBCloud's tlsCAPath) - read once at the pool level, not per connection. */
+    tlsCA?: Buffer;
+    tlsRejectUnauthorized?: boolean;
 }
 /** Callbacks a PooledConnection uses to surface lifecycle events to its owning AxioDBCloud pool. */
 export interface PooledConnectionCallbacks {
@@ -34,6 +39,8 @@ export default class PooledConnection {
     private heartbeatInterval;
     state: ConnectionState;
     authUser?: AuthenticatedUser;
+    /** Number of requests sent on this connection awaiting a response - used by the owning pool to route new commands to the least-busy member instead of blind round-robin. */
+    get pendingCount(): number;
     constructor(host: string, port: number, options: PooledConnectionOptions, getCredentials: () => {
         username: string;
         password: string;

package/lib/client/PooledConnection.js

@@ -11,6 +11,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 Object.defineProperty(exports, "__esModule", { value: true });
 /* eslint-disable @typescript-eslint/no-explicit-any */
 const net_1 = require("net");
+const tls_1 = require("tls");
 const crypto_1 = require("crypto");
 const protocol_1 = require("../tcp/config/protocol");
 const command_types_1 = require("../tcp/types/command.types");
@@ -21,6 +22,10 @@ const client_types_1 = require("./types/client.types");
  * failure on one pooled connection never affects the others in the pool.
  */
 class PooledConnection {
+    /** Number of requests sent on this connection awaiting a response - used by the owning pool to route new commands to the least-busy member instead of blind round-robin. */
+    get pendingCount() {
+        return this.pendingRequests.size;
+    }
     constructor(host, port, options, getCredentials, callbacks) {
         this.host = host;
         this.port = port;
@@ -41,6 +46,7 @@ class PooledConnection {
      */
     connect() {
         return new Promise((resolve, reject) => {
+            var _a;
             if (this.state === client_types_1.ConnectionState.CONNECTED) {
                 resolve();
                 return;
@@ -53,8 +59,6 @@ class PooledConnection {
                 this.socket = null;
             }
             this.state = client_types_1.ConnectionState.CONNECTING;
-            const socket = new net_1.Socket();
-            this.socket = socket;
             const connectionTimeout = setTimeout(() => {
                 socket.destroy();
                 this.state = client_types_1.ConnectionState.FAILED;
@@ -70,9 +74,7 @@ class PooledConnection {
                 this.state = client_types_1.ConnectionState.FAILED;
                 reject(error);
             };
-            socket.once('error', connectErrorHandler);
-            this.setupSocketHandlers(socket);
-            socket.connect(this.port, this.host, () => __awaiter(this, void 0, void 0, function* () {
+            const onReady = () => __awaiter(this, void 0, void 0, function* () {
                 clearTimeout(connectionTimeout);
                 socket.off('error', connectErrorHandler);
                 this.state = client_types_1.ConnectionState.CONNECTED;
@@ -96,7 +98,25 @@ class PooledConnection {
                     socket.destroy();
                     reject(authError);
                 }
-            }));
+            });
+            // tls.connect() both creates and initiates the connection in one call (unlike
+            // net.Socket, which needs a separate .connect()), firing 'secureConnect' once the TLS
+            // handshake completes - a stronger readiness signal than plain TCP's 'connect', since
+            // it also implies certificate validation passed (rejectUnauthorized: true, the default).
+            const socket = this.options.tls
+                ? (0, tls_1.connect)({
+                    host: this.host,
+                    port: this.port,
+                    ca: this.options.tlsCA,
+                    rejectUnauthorized: (_a = this.options.tlsRejectUnauthorized) !== null && _a !== void 0 ? _a : true,
+                }, onReady)
+                : new net_1.Socket();
+            this.socket = socket;
+            socket.once('error', connectErrorHandler);
+            this.setupSocketHandlers(socket);
+            if (!this.options.tls) {
+                socket.connect(this.port, this.host, onReady);
+            }
         });
     }
     /** Sends the AUTHENTICATE command over this connection and stores the resulting identity. */