harperdb 4.7.8 → 4.7.9

package/bin/harperdb.js

@@ -16,7 +16,7 @@
 `,t)}function DC(e){e&&_$.push(e)}var Zl,d$,f$,ph,NC,CC,Eh,m$,Cle,Ole,on,xS,p$,hh,wC,OC,h$,E$,_$,g$,s$,i$,US,y$,xle,Ble,a$,c$,b$,l$,u$,Fle,I$,Nc,Hle,ws=se(()=>{Zl=require("worker_threads"),d$=b(rt());Ce();f$=b(Q()),ph=require("path"),NC=require("fs/promises"),CC=b(qn()),Eh=b(ce());H();Kr();m$=b(require("node:fs"));RC();bC();({getLogFilePath:Cle,forComponent:Ole}=f$.default);setTimeout(()=>{Promise.resolve().then(()=>t$())},1e3);on=Ole("analytics").conditional;(0,Eh.initSync)();xS=new Map,p$=(0,Eh.get)(x.ANALYTICS_AGGREGATEPERIOD)>-1;a(Ple,"setAnalyticsEnabled");a(Lle,"recordExistingAction");a(Dle,"recordNewAction");a(We,"recordAction");Ue.recordAnalytics=We;a(an,"recordActionBinary");wC=0,OC=1e3,h$="analytics-report",E$=[],_$=[];a(_h,"addAnalyticsListener");g$=[.01,.1,.25,.5,.75,.9,.95,.99,.999,1];a(vle,"sendAnalytics");a(PC,"recordHostname");a(zd,"storeMetric");a(S$,"calculateCPUUtilization");a(T$,"diffResourceUsage");a(Mle,"storeTableSizeMetrics");a(r$,"storeDBSizeMetrics");a(n$,"storeVolumeMetrics");a(Ule,"aggregation");s$=0,i$=0,US={userCPUTime:0,systemCPUTime:0},y$=a(()=>new Promise(setImmediate),"rest");a(o$,"cleanup");xle=36e5,Ble=31536e6;a(LC,"getRawAnalyticsTable");a(R$,"getAnalyticsTable");(0,d$.setChildListenerByType)(h$,A$);a(kle,"startScheduledTasks");l$=0,u$=new Map,Fle=!1;a(A$,"recordAnalytics");Hle=1e6;a(Gle,"logAnalytics");a(DC,"onAnalyticsAggregate")});function gh(e,t,r,n){if(e.append)e.append(t,r,n);else if(e.set){let s=e.get(t);if(s)if(n)r=(typeof s=="string"?s:s.join(", "))+", "+r;else if(typeof s=="string")r=[s,r];else{s.push(r);return}return e.set(t,r)}else e[t]=(e[t]?e[t]+", ":"")+r}function w$(e,t){(typeof e.set!="function"||typeof e.has!="function")&&(e=new js(e));for(let[r,n]of t)e.has(r)?r.toLowerCase()==="set-cookie"&&e.append?.(r,n,!0):e.set(r,n);return e}var js,Sh=se(()=>{js=class extends Map{static{a(this,"Headers")}constructor(t){if(t)if(t[Symbol.iterator])super(t);else{super();for(let r in t)this.set(r,t[r])}else super()}set(t,r){return typeof t!="string"&&(t=""+t),typeof r!="string"&&(r=""+r),super.set(t.toLowerCase(),[t,r])}get(t){return typeof t!="string"&&(t=""+t),super.get(t.toLowerCase())?.[1]}has(t){return typeof t!="string"&&(t=""+t),super.has(t.toLowerCase())}setIfNone(t,r){typeof t!="string"&&(t=""+t),typeof r!="string"&&(r=""+r);let n=t.toLowerCase();if(!super.has(n))return super.set(n,[t,r])}append(t,r,n){typeof t!="string"&&(t=""+t),typeof r!="string"&&(r=""+r);let s=t.toLowerCase(),i=super.get(s);if(i){let o=i[1];if(n)r=(typeof o=="string"?o:o.join(", "))+", "+r;else if(typeof o=="string")r=[o,r];else{o.push(r);return}}return super.set(s,[t,r])}*[Symbol.iterator](){for(let[t,r]of super.values()){if(Array.isArray(r)&&t.toLowerCase()==="set-cookie"){for(let n of r)yield[t,n];continue}yield[t,r]}}};a(gh,"appendHeader");a(w$,"mergeHeaders")});function FS(e,t){let r={openapi:qle,info:{title:"HarperDB HTTP REST interface",version:D$.packageJson.version},servers:[{description:"REST API",url:t}],paths:{},components:{schemas:{},securitySchemes:{basicAuth:{type:"http",scheme:"basic"},bearerAuth:{type:"http",scheme:"bearer",bearerFormat:"JWT"}}}},n=[{basicAuth:[],bearerAuth:[]}],s=a(i=>{if(i.type&&!r.components.schemas[i.type]){r.components.schemas[i.type]={};let o={},c=[];for(let l of i.properties)kS[l.type]?o[l.name]=new MC(kS[l.type],l.type):l.properties?(o[l.name]=new M$(l.type),s(l)):l.elements?.properties&&(o[l.name]=new Yle(l.elements.type),s(l.elements)),l.nullable===!1&&c.push(l.name);r.components.schemas[i.type]=new L$(o,!i.sealed,c)}},"includeDefinitionInSchema");for(let[,i]of e){if(!i.path||i.Resource.isError)continue;let{path:o}=i,c=o.split("/").pop(),{attributes:l,sealed:u}=i.Resource,{prototype:d,primaryKey:f="id"}=i.Resource;if(!l&&e.allTypes.has(i.path)){let F=e.allTypes.get(i.path);u=F.sealed,l=F.properties}if(!f)continue;let m={},p=[],h=[];if(l)for(let{type:F,name:z,elements:Y,relationship:le,definition:fe,nullable:te}of l){let Se=fe??Y?.definition;Se&&s(Se),te===!1&&h.push(z),le?F==="array"?m[z]={type:"array",items:{$ref:zs+Y.type}}:m[z]={$ref:zs+F}:Se?F==="array"?m[z]={type:"array",items:{$ref:zs+Se.type}}:m[z]={$ref:zs+Se.type}:F==="array"?Y.type==="Any"?m[z]={type:"array",items:{format:Y.type}}:m[z]={type:"array",items:new MC(kS[Y.type],Y.type)}:F==="Any"?m[z]={format:F}:m[z]=new MC(kS[F],F),p.push(new UC(z,"query",m[z]))}let E=Object.keys(m),_=new UC(f,"path",{type:"string",format:"ID"});_.required=!0,_.description="primary key of record";let R=new UC("property","path",{enum:E});R.required=!0,r.components.schemas[c]=new L$(m,!u,h);let S=d.post!==Resource.prototype.post||d.update,y=typeof d.put=="function",w=typeof d.get=="function",I=typeof d.delete=="function",G=typeof d.patch=="function",X=`/${o}/`;r.paths[X]||(r.paths[X]={}),S&&(r.paths[X].post=new $le(c,n,{200:new Jd({$ref:zs+c},{Location:{description:"primary key of new record",schema:{type:"string",format:"ID"}}})},"create a new record auto-assigning a primary key")),r.paths[X].options=new N$(p,n,{200:new C$},"retrieve information about the communication options available for a target resource or the server as a whole, without performing any resource action"),w&&(r.paths[X].get=new vC(p,n,{200:new Jd({type:"array",items:{$ref:zs+c}})},"search for records by the specified property name and value pairs")),I&&(r.paths[X].delete=new P$(p,n,"delete all the records that match the provided query",{204:new O$}));let q="/"+o+"/{"+f+"}";if(r.paths[q]||(r.paths[q]={}),r.paths[q].options=new N$(p,n,{200:new C$},"retrieve information about the communication options available for a target resource or the server as a whole, without performing any resource action"),w&&(r.paths[q].get=new vC([_],n,{200:new Jd({$ref:zs+c})},"retrieve a record by its primary key")),y&&(r.paths[q].put=new Vle([_],n,c,{200:new Jd({$ref:zs+c})},"create or update the record with the URL path that maps to the record's primary key")),G&&(r.paths[q].patch=new Kle([_],n,c,{200:new Jd({$ref:zs+c})},"patch the record with the URL path that maps to the record's primary key")),I&&(r.paths[q].delete=new P$([_],n,"delete a record with the given primary key",{204:new O$})),w&&R.schema.enum.length>0){let F=`/${o}/{${f}}.{property}`;r.paths[F]||(r.paths[F]={}),r.paths[F].get=new vC([_,R],n,{200:new Jd({enum:E})},"used to retrieve the specified property of the specified record")}}for(let[,i]of e.allTypes)s(i),i.sealed&&r.components.schemas[i.type].additionalProperties&&(r.components.schemas[i.type].additionalProperties=!1);return r}function $le(e,t,r,n){this.description=n,this.requestBody={content:{"application/json":{schema:{$ref:zs+e}}}},this.security=t,this.responses=r}function vC(e,t,r,n){this.description=n,this.parameters=e,this.security=t,this.responses=r}function N$(e,t,r,n){this.description=n,this.parameters=e,this.security=t,this.responses=r}function C$(){this.description=v$,this.headers={},this.content={}}function Jd(e,t){this.description=v$,this.content={"application/json":{schema:e}},this.headers=t}function O$(){this.description="successfully processed request, no content returned to client"}function Vle(e,t,r,n,s){this.description=s,this.parameters=e,this.security=t,this.requestBody={content:{"application/json":{schema:{$ref:zs+r}}}},this.responses=n}function Kle(e,t,r,n,s){this.description=s,this.parameters=e,this.security=t,this.requestBody={content:{"application/json":{schema:{$ref:zs+r}}}},this.responses=n}function P$(e,t,r,n){this.description=r,this.parameters=e,this.security=t,this.responses=n}function L$(e,t,r){this.type="object",this.properties=e,this.additionalProperties=t,this.required=r}function MC(e,t){this.type=e,(e==="string"||e==="number"||e==="integer")&&t!=="String"&&(this.format=t)}function M$(e){this.$ref=`#/components/schemas/${e}`}function Yle(e){this.type="array",this.items=new M$(e)}function UC(e,t,r){this.name=e,this.in=t,this.schema=r}var D$,qle,kS,zs,v$,xC=se(()=>{D$=b(Et()),qle="3.0.3",kS={Int:"integer",Float:"number",Long:"integer",ID:"string",String:"string",Boolean:"boolean",Date:"string",Bytes:"string",BigInt:"integer"},zs="#/components/schemas/",v$="successful operation";a(FS,"generateJsonApi");a($le,"Post");a(vC,"Get");a(N$,"Options");a(C$,"ResponseOptions200");a(Jd,"Response200");a(O$,"Response204");a(Vle,"Put");a(Kle,"Patch");a(P$,"Delete");a(L$,"ResourceSchema");a(MC,"Type");a(M$,"Ref");a(Yle,"ArrayRef");a(UC,"Parameter")});var x$={};ye(x$,{Request:()=>Cc,createReuseportFd:()=>HS});var U$,Cc,BC,kC,HS,Th=se(()=>{U$=require("os"),Cc=class{static{a(this,"Request")}#e;#t;_nodeRequest;_nodeResponse;method;url;headers;isWebSocket;user;constructor(t,r){this.method=t.method;let n=t.url;this._nodeRequest=t,this._nodeResponse=r,this.url=n,this.headers=new kC(t.headers)}get absoluteURL(){return this.protocol+"://"+this.host+this.url}get pathname(){let t=this.url.indexOf("?");return t>-1?this.url.slice(0,t):this.url}set pathname(t){let r=this.url.indexOf("?");r>-1?this.url=t+this.url.slice(r):this.url=t}get protocol(){return this._nodeRequest.socket.encrypted?"https":"http"}get ip(){return this._nodeRequest.socket.remoteAddress}get authorized(){return this._nodeRequest.socket.authorized}get peerCertificate(){return this.#t===void 0&&(this.#t=this._nodeRequest.socket.getPeerCertificate?.(!0)||null),this.#t}get mtlsConfig(){return this._nodeRequest.socket.server.mtlsConfig}get body(){return this.#e||(this.#e=new BC(this._nodeRequest))}get host(){return this._nodeRequest.authority||this._nodeRequest.headers.host}get hostname(){return this._nodeRequest.headers.host}get httpVersion(){return this._nodeRequest.httpVersion}get isAborted(){return!1}get nodeRequest(){return this._nodeRequest}sendEarlyHints(t,r={}){r.link=t,this._nodeResponse.writeEarlyHints(r)}},BC=class{static{a(this,"RequestBody")}#e;constructor(t){this.#e=t}on(t,r){return this.#e.on(t,r),this}pipe(t,r){return this.#e.pipe(t,r)}},kC=class{static{a(this,"Headers")}asObject;constructor(t){this.asObject=t}set(t,r){this.asObject[t.toLowerCase()]=r}get(t){return this.asObject[t.toLowerCase()]}has(t){return Object.prototype.hasOwnProperty.call(this.asObject,t.toLowerCase())}[Symbol.iterator](){return Object.entries(this.asObject)[Symbol.iterator]()}keys(){return Object.keys(this.asObject)}values(){return Object.values(this.asObject)}delete(t){delete this.asObject[t.toLowerCase()]}forEach(t){for(let[r,n]of this)t(n,r,this)}};(0,U$.platform)()!="win32"&&(HS=require("node-unix-socket").createReuseportFd)});var B$,Js,GS=se(()=>{B$=b(Ti());So();Js=class extends URLSearchParams{static{a(this,"RequestTarget")}#e;pathname;search;id;isCollection;constructor(t){let r,n;if(t&&(r=t.indexOf("?"))>-1){n=t.slice(0,r);let s=t.slice(r+1);super(s),this.search=s}else super(),n=t;this.pathname=n??"",this.#e=t}toString(){return this.#e?this.#e:this.size>0?this.pathname+"?"+super.toString():this.pathname}get url(){return this.toString()}delete(t){super.delete(t),this.conditions&&(this.conditions=this.conditions.filter(r=>r.attribute!==t)),this.#e=void 0}set(t,r){this.delete(t),super.set(t,r),this.conditions?.push({attribute:t,value:r})}append(t,r){super.append(t,r),this.#e=void 0,this.conditions?.push({attribute:t,value:r})}};(0,B$._assignPackageExport)("Resource",Zt)});var $S={};ye($S,{parseHeaderValue:()=>HC,start:()=>zle});async function jle(e,t){let r=e.headers.asObject,n=r.accept==="text/event-stream",s=n?"CONNECT":e.method;e.search&&VS(e);let i=new js;try{e.responseHeaders=i;let o=e.url.slice(1),c,l;if(o!==k$){let _=qS.getMatch(o,n?"sse":"rest");if(!_)return t(e);e.handlerPath=_.path,c=new Js(_.relativeURL),c.async=!0,l=_.Resource}if(l?.isCaching){let _=r["cache-control"];if(_){let R=HC(_);for(let S of R)switch(S.name){case"max-age":e.expiresAt=S.value*1e3+Date.now();break;case"only-if-cached":e.onlyIfCached=!0;break;case"no-cache":e.noCache=!0;break;case"no-store":e.noCacheStore=!0;break;case"stale-if-error":e.staleIfError=!0;break;case"must-revalidate":e.mustRevalidate=!0;break}}}let u=r["x-replicate-to"];if(u){let _=HC(u).map(R=>(R.next?.name==="confirm"&&R.next.value>=0&&(e.replicatedConfirmation=+R.next.value),R.name));e.replicateTo=_.length===1&&+_[0]>=0?+_[0]:_[0]==="*"?void 0:_}r["x-replicate-from"]==="none"&&(e.replicateFrom=!1);let f=await It(e,()=>{if(r["content-length"]||r["transfer-encoding"])try{e.data=ca(r["content-type"],!0)(e.body,e.headers)}catch(_){throw new Qd.ClientError(_,400)}if(e.authorize=!0,o===k$&&s==="GET"){if(e?.user?.role?.permission?.super_user)return FS(qS,`${e.protocol}://${e.hostname}`);throw new Qd.ServerError("Forbidden",403)}switch(c.checkPermission=e.user?.role?.permission??{},s){case"GET":case"HEAD":return l.get(c,e);case"POST":return l.post(c,e.data,e);case"PUT":return l.put(c,e.data,e);case"DELETE":return l.delete(c,e);case"PATCH":return l.patch(c,e.data,e);case"OPTIONS":i.setIfNone("Allow","GET, HEAD, POST, PUT, DELETE, PATCH, OPTIONS, TRACE, QUERY, COPY, MOVE");return;case"CONNECT":return l.connect(c,null,e);case"TRACE":return"HarperDB is the terminating server";case"QUERY":return l.query(c,e.data,e);case"COPY":return l.copy(c,r.destination,e);case"MOVE":return l.move(c,r.destination,e);case"BREW":throw new Qd.ClientError("HarperDB is short and stout and can't brew coffee",418);default:throw new Qd.ServerError(`Method ${s} is not recognized`,501)}}),m=200,p=e.lastModified;if(f==null)m=s==="GET"||s==="HEAD"?404:204,FC.lastModified&&isFinite(p)&&i.setIfNone("Last-Modified",new Date(p).toUTCString());else if(f.status>0&&f.headers){let _=w$(f.headers,i);return f.headers!==_&&(f.headers=_),f.data!==void 0&&(f.body=Rp(f.data,e,f)),f}else if(isFinite(p)){Wle[0]=p;let _=String.fromCharCode(34,(cn[0]&63)+62,(cn[0]>>6)+(cn[1]<<2&63)+62,(cn[1]>>4)+(cn[2]<<4&63)+62,(cn[2]>>2)+62,(cn[3]&63)+62,(cn[3]>>6)+(cn[4]<<2&63)+62,(cn[4]>>4)+(cn[5]<<4&63)+62,(cn[5]>>2)+62,(cn[6]&63)+62,(cn[6]>>6)+(cn[7]<<2&63)+62,34),R=r["if-none-match"];R&&_==R?(f?.onDone&&f.onDone(),m=304,f=void 0):i.setIfNone("ETag",_),FC.lastModified&&i.setIfNone("Last-Modified",new Date(p).toUTCString())}e.createdResource&&(m=201),e.newLocation&&i.setIfNone("Location",e.newLocation);let h={status:m,headers:i,body:void 0},E=e.loadedFromSource??f?.wasLoadedFromSource?.();return E!==void 0&&(h.wasCacheMiss=E,!E&&isFinite(p)&&i.setIfNone("Age",Math.round((Date.now()-(e.lastRefreshed||p))/1e3))),f!==void 0&&(h.body=Rp(f,e,h),s==="HEAD"&&(h.body=void 0)),h}catch(o){o.statusCode?o.statusCode===500?Li.warn(o):Li.info(o):Li.error(o),o.statusCode===405&&(o.method&&(o.message+=` to handle HTTP method ${o.method.toUpperCase()||""}`),o.allow&&(o.allow.push("trace","head","options"),i.setIfNone("Allow",o.allow.map(l=>l.toUpperCase()).join(", "))));let c={status:o.statusCode||500,headers:i,body:void 0};return c.body=Rp(o instanceof Error?G$(o):o,e,c),c}}function zle(e){FC=e,e.includeExpensiveRecordCountEstimates&&(Cc.prototype.includeExpensiveRecordCountEstimates=!0),!F$&&(F$=!0,qS=e.resources,e.server.http(async(t,r)=>{if(!t.isWebSocket)return jle(t,r)},e),e.webSocket!==!1&&e.server.ws(async(t,r,n)=>{yh++;let s=new ps;H$||(H$=!0,_h(l=>{yh>0&&l.push({metric:"ws-connections",connections:yh,byThread:!0})}));let i;t.on("error",l=>{i=!0,Li.warn(l)});let o;t.on("message",a(function(u){o||(o=ca(r.requestedContentType??r.headers.asObject["content-type"],!1));let d=o(u);We(u.length,"bytes-received",r.handlerPath,"message","ws"),s.push(d)},"message"));let c;t.on("close",()=>{yh--,an(!i,"connection","ws","disconnect"),s.emit("close"),c&&c.return()});try{await n;let l=r.url.slice(1),u=qS.getMatch(l,"ws");if(an(!!u,"connection","ws","connect"),u){r.handlerPath=u.path,We(h=>({count:h.count,total:yh}),"connections",r.handlerPath,"connect","ws"),r.authorize=!0;let d=new Js(u.relativeURL);d.checkPermission=r.user?.role?.permission??{};let f=u.Resource;c=(await It(r,()=>f.connect(d,s,r)))[Symbol.asyncIterator]();let p;for(;!(p=await c.next()).done;){let h=await aa(p.value,r);t.send(h),We(h.length,"bytes-sent",r.handlerPath,"message","ws"),t._socket.writableNeedDrain&&await new Promise(E=>t._socket.once("drain",E))}}else return t.close(1011,`No resource was found to handle ${r.pathname}`)}catch(l){l.statusCode?l.statusCode===500?Li.warn(l):Li.info(l):Li.error(l),t.close(Jle[l.statusCode]||1011,G$(l))}t.close()},e))}function HC(e){return e.trim().split(",").map(t=>{let r,n=t.trim().split(";"),s;for(;s=n.pop();)if(s.includes("=")){let[i,o]=s.trim().split("=");i=i.trim(),o&&(o=o.trim()),r={name:i.toLowerCase(),value:o,next:r}}else r={name:s.toLowerCase(),next:r};return r})}var Li,Qd,G$,cn,Wle,FC,k$,F$,qS,H$,yh,Jle,q$=se(()=>{sa();ws();Li=b(Q()),Qd=b(Ee());KS();hd();dc();Sh();xC();Th();GS();({errorToString:G$}=Li),cn=new Uint8Array(8),Wle=new Float64Array(cn.buffer,0,1),FC={},k$="openapi";a(jle,"http");yh=0;a(zle,"start");Jle={401:3e3,403:3003};a(HC,"parseHeaderValue")});var GC=M((yBe,V$)=>{var{recordAction:YS,recordActionBinary:$$}=(ws(),L(BS)),Qle=require("fastify-plugin"),Xle=200;V$.exports=Qle(function(e,t,r){e.addHook("onResponse",async(n,s)=>{let i=s.elapsedTime}),e.addHook("onSend",async(n,s,i)=>{let o=s.elapsedTime,c=performance.now(),l=s.request.routeOptions,u,d,f;l.config?.isOperation?(u=n.body?.operation,d="operation"):(u=l.url,d="fastify-route",f=l.method),YS(o,"duration",u,f,d),$$(s.raw.statusCode<400,"success",u,f,d),$$(1,"response_"+s.raw.statusCode,u,f,d);let m=Xle;i?.pipe?(i.on("data",_=>{m+=_.length}),i.on("end",()=>{YS(performance.now()-c,"transfer",u,f,d),YS(m,"bytes-sent",u,f,d)})):(m+=i?.length||0,YS(m,"bytes-sent",u,f,d));let p=o.toFixed(3),h=s.getHeader("Server-Timing"),E=`db;dur=${p}`;s.header("Server-Timing",h?`${h}, ${E}`:E)}),r()},{name:"hdb-request-time"})});var Y$=M((RBe,K$)=>{var Zle=ht(),eue={user:{presence:!0},schema:{presence:!0},table:{presence:!0},operation:{presence:!0}};K$.exports=function(e){return Zle.validateObject(e,eue)}});var WS=M((bBe,W$)=>{"use strict";var tue=(H(),L(j)).OPERATIONS_ENUM,qC=class{static{a(this,"UpdateObject")}constructor(t,r,n,s=void 0){this.operation=tue.UPDATE,this.schema=t,this.table=r,this.records=n,this.__origin=s}};W$.exports=qC});var Ah={};ye(Ah,{createTokens:()=>VC,getJWTRSAKeys:()=>XS,refreshOperationToken:()=>KC,validateOperationToken:()=>YC,validateRefreshToken:()=>ZS});async function XS(){if(jS)return jS;try{let e=Rh.default.join(bh.default.getHdbBasePath(),nI),t=await zS.default.readFile(Rh.default.join(e,tp.JWT_PASSPHRASE_NAME),"utf8"),r=await zS.default.readFile(Rh.default.join(e,tp.JWT_PRIVATE_KEY_NAME),"utf8");return jS={publicKey:await zS.default.readFile(Rh.default.join(e,tp.JWT_PUBLIC_KEY_NAME),"utf8"),privateKey:r,passphrase:t},jS}catch(e){throw QS.default.error(e),new Di.ClientError(Zd.NO_ENCRYPTION_KEYS,Xd.INTERNAL_SERVER_ERROR)}}async function VC(e){let t=(0,$C.validateBySchema)(e,Ro.default.object({username:Ro.default.string().optional(),password:Ro.default.string().optional(),role:Ro.default.string().optional(),expires_in:Ro.default.alternatives(Ro.default.string(),Ro.default.number()).optional()}));if(t)throw new Di.ClientError(t.message);let r;try{let f=e.bypass_auth!==!0;!e.username&&!e.password&&(e.username=e.hdb_user?.username,f=!1),r=await Ld(e.username,e.password,f)}catch(f){throw QS.default.error(f),new Di.ClientError(Zd.INVALID_CREDENTIALS,Xd.UNAUTHORIZED)}if(!r)throw new Di.ClientError(Zd.INVALID_CREDENTIALS,Xd.UNAUTHORIZED);let n=!1,s=!1;r.role?.permission&&(n=r.role.permission.super_user===!0,s=r.role.permission.cluster_user===!0);let i={username:e.username,super_user:n,cluster_user:s};e.role&&(i.role=e.role);let o=await XS(),c=await ef.default.sign(i,{key:o.privateKey,passphrase:o.passphrase},{expiresIn:e.expires_in??X$,algorithm:JS,subject:tf.OPERATION}),l=await ef.default.sign(i,{key:o.privateKey,passphrase:o.passphrase},{expiresIn:rue,algorithm:JS,subject:tf.REFRESH}),u=Rw(l,jr.SHA256);if((await(0,j$.update)(new z$.default(Zm,fd.USER_TABLE_NAME,[{username:e.username,refresh_token:u}]))).skipped_hashes.length>0)throw new Di.ClientError(Zd.REFRESH_TOKEN_SAVE_FAILED,Xd.INTERNAL_SERVER_ERROR);return J$.default.signalUserChange(new Q$.UserEventMsg(process.pid)),{operation_token:c,refresh_token:l}}async function KC(e){let t=(0,$C.validateBySchema)(e,Ro.default.object({refresh_token:Ro.default.string().required()}).required());if(t)throw new Di.ClientError(t.message);let{refresh_token:r}=e;await ZS(r);let n=await XS(),s=await ef.default.decode(r);return{operation_token:await ef.default.sign({username:s.username,super_user:s.super_user,cluster_user:s.cluster_user},{key:n.privateKey,passphrase:n.passphrase},{expiresIn:X$,algorithm:JS,subject:tf.OPERATION})}}async function YC(e){return Z$(e,tf.OPERATION)}async function ZS(e){return Z$(e,tf.REFRESH)}async function Z$(e,t){try{let r=await XS(),n=await ef.default.verify(e,r.publicKey,{algorithms:JS,subject:t});if(n.role)throw new Error("Invalid token");let s=await Ld(n.username,void 0,!1);if(t===tf.REFRESH&&!bw(s.refresh_token,e))throw new Error("Invalid token");return s}catch(r){throw QS.default.warn(r),r?.name==="TokenExpiredError"?new Di.ClientError(Zd.TOKEN_EXPIRED,Xd.FORBIDDEN):new Di.ClientError(Zd.INVALID_TOKEN,Xd.UNAUTHORIZED)}}var ef,zS,Rh,Ro,$C,Di,QS,j$,z$,J$,Q$,bh,Xd,Zd,X$,rue,JS,tf,jS,rf=se(()=>{ef=b(require("jsonwebtoken")),zS=b(require("fs-extra")),Rh=b(require("node:path")),Ro=b(require("joi")),$C=b(ht());H();Di=b(Ee()),QS=b(Q());Iw();zn();j$=b(Jn()),z$=b(WS()),J$=b(ma()),Q$=b(Rs()),bh=b(ce()),{HTTP_STATUS_CODES:Xd,AUTHENTICATION_ERROR_MSGS:Zd}=Di.hdbErrors;bh.default.initSync();X$=bh.default.get(x.AUTHENTICATION_OPERATIONTOKENTIMEOUT)||"1d",rue=bh.default.get(x.AUTHENTICATION_REFRESHTOKENTIMEOUT)||"30d",JS="RS256",tf={OPERATION:"operation",REFRESH:"refresh"};a(XS,"getJWTRSAKeys");a(VC,"createTokens");a(KC,"refreshOperationToken");a(YC,"validateOperationToken");a(ZS,"validateRefreshToken");a(Z$,"validateToken")});var WC=M((OBe,rV)=>{"use strict";var nue=Y$(),nf=require("passport"),sue=require("passport-local").Strategy,iue=require("passport-http").BasicStrategy,oue=require("util"),aue=(zn(),L(Ci)),tV=oue.callbackify(aue.findAndValidateUser),CBe=Vr(),cue=(H(),L(j)),eV=(rf(),L(Ah)),{AccessViolation:lue}=Ee();nf.use(new sue(function(e,t,r){tV(e,t,r)}));nf.use(new iue(function(e,t,r){tV(e,t,r)}));nf.serializeUser(function(e,t){t(null,e)});nf.deserializeUser(function(e,t){t(null,e)});function uue(e,t,r){if(e.raw?.user!==void 0)return r(null,e.raw.user);let n,s;if(e.headers?.authorization){let o=e.headers.authorization.split(" ");n=o[0],s=o[1]}function i(o,c){return o?r(o):c?r(null,c):r(new lue)}switch(a(i,"handleResponse"),n){case"Basic":nf.authenticate("basic",{session:!1},(o,c)=>{i(o,c)})(e,t,r);break;case"Bearer":e.body?.operation&&e.body.operation===cue.OPERATIONS_ENUM.REFRESH_OPERATION_TOKEN?eV.validateRefreshToken(s).then(o=>{e.body.refresh_token=s,r(null,o)}).catch(o=>{r(o)}):eV.validateOperationToken(s).then(o=>{r(null,o)}).catch(o=>{r(o)});break;default:nf.authenticate("local",{session:!1},function(o,c){i(o,c)})(e,t,r);break}}a(uue,"authorize");function due(e,t){let r=nue(e);if(r){t(r);return}let n={authorized:!0,messages:[]},s=e.user.role;if(!s?.permission)return t("Invalid role");let i=JSON.parse(s.permission);if(i.super_user)return t(null,n);if(!i[e.schema])return n.authorized=!1,n.messages.push(`Not authorized to access ${e.schema} schema`),t(null,n);if(!i[e.schema].tables[e.table])return n.authorized=!1,n.messages.push(`Not authorized to access ${e.table} table`),t(null,n);if(!i[e.schema].tables[e.table][e.operation])return n.authorized=!1,n.messages.push(`Not authorized to access ${e.operation} on ${e.table} table`),t(null,n);if(i[e.schema].tables[e.table].attribute_permissions&&!e.attributes)return n.authorized=!1,n.messages.push(`${e.schema}.${e.table} has attribute permissions. Missing attributes to validate`),t(null,n);if(i[e.schema].tables[e.table].attribute_permissions&&e.attributes){let o=i[e.schema].tables[e.table].attribute_permissions;for(let c in o)e.attributes.indexOf(o[c].attribute_name)>-1&&!o[c][e.operation]&&(n.authorized=!1,n.messages.push(`Not authorized to ${e.operation} ${o[c].attribute_name} `))}return t(null,n)}a(due,"checkPermissions");rV.exports={authorize:uue,checkPermissions:due}});var ZC=M((vBe,oV)=>{var nT=require("clone"),sT=ht(),fue=ae(),tT=(H(),L(j)),LBe=Q(),jC=require("fs"),JC=require("joi"),{string:rT}=JC.types(),{hdbErrors:mue,handleHDBError:eT}=Ee(),{HDB_ERROR_MSGS:DBe,HTTP_STATUS_CODES:zC}=mue,{commonValidators:sf}=lo(),nV=" is required",pue=["insert","update","upsert"],QC={database:{presence:!1,format:sf.schema_format,length:sf.schema_length},schema:{presence:!1,format:sf.schema_format,length:sf.schema_length},table:{presence:!0,format:sf.schema_format,length:sf.schema_length},action:{inclusion:{within:pue,message:"is required and must be either insert, update, or upsert"}},file_path:{},csv_url:{url:{allowLocal:!0}},data:{},passthrough_headers:{}},hue={schema:rT.required(),table:rT.required(),action:rT.valid("insert","update","upsert")},{AWS_ACCESS_KEY:Eue,AWS_SECRET:_ue,AWS_BUCKET:gue,AWS_FILE_KEY:Sue,REGION:Tue}=tT.S3_BUCKET_AUTH_KEYS,yue={s3:{presence:!0},[`s3.${Eue}`]:{presence:!0,type:"String"},[`s3.${_ue}`]:{presence:!0,type:"String"},[`s3.${gue}`]:{presence:!0,type:"String"},[`s3.${Sue}`]:{presence:!0,type:"String",hasValidFileExt:[".csv",".json"]},[`s3.${Tue}`]:{presence:!0,type:"String"}},sV=nT(QC);sV.data.presence={message:nV};var iV=nT(QC);iV.file_path.presence={message:nV};var Rue=Object.assign(nT(QC),yue),XC=nT(hue);XC.csv_url=rT.uri().messages({"string.uri":"'csv_url' must be a valid url"}).required();XC.passthrough_headers=JC.object();function bue(e){let t=sT.validateObject(e,sV);return iT(e,t)}a(bue,"dataObject");function Aue(e){let t=sT.validateBySchema(e,JC.object(XC));return iT(e,t)}a(Aue,"urlObject");function Iue(e){let t=sT.validateObject(e,iV);return iT(e,t)}a(Iue,"fileObject");function wue(e){let t=sT.validateObject(e,Rue);return iT(e,t)}a(wue,"s3FileObject");function iT(e,t){if(!t){let r=fue.checkGlobalSchemaTable(e.schema,e.table);if(r)return eT(new Error,r,zC.BAD_REQUEST);if(e.operation===tT.OPERATIONS_ENUM.CSV_FILE_LOAD)try{jC.accessSync(e.file_path,jC.constants.R_OK|jC.constants.F_OK)}catch(n){return n.code===tT.NODE_ERROR_CODES.ENOENT?eT(n,`No such file or directory ${n.path}`,zC.BAD_REQUEST):n.code===tT.NODE_ERROR_CODES.EACCES?eT(n,`Permission denied ${n.path}`,zC.BAD_REQUEST):eT(n)}}return t}a(iT,"postValidateChecks");oV.exports={dataObject:bue,urlObject:Aue,fileObject:Iue,s3FileObject:wue}});var eO=M((UBe,aV)=>{"use strict";var Ih=Q(),oT=(H(),L(j));async function Nue(e,t,r,n=void 0){if(!e||typeof e!="function")throw new Error("Invalid function parameter");let s;try{return s=await e(t),r&&await r(t,s,n),t.operation===oT.OPERATIONS_ENUM.INSERT||t.operation===oT.OPERATIONS_ENUM.UPDATE||t.operation===oT.OPERATIONS_ENUM.UPSERT?(delete s.new_attributes,delete s.txn_time):t.operation===oT.OPERATIONS_ENUM.DELETE&&delete s.txn_time,s}catch(i){throw i.message&&typeof i.message=="string"&&i.message.includes("already exists")?(Ih.info(i.message),i):i.http_resp_msg?(Ih.error(`Error calling operation: ${e.name}`),Ih.error(i.http_resp_msg),i):(Ih.error(`Error calling operation: ${e.name}`),Ih.error(i),i)}}a(Nue,"callOperationFunctionAsAwait");aV.exports={callOperationFunctionAsAwait:Nue}});var tO=M((BBe,lV)=>{"use strict";var{S3:Cue,GetObjectCommand:Oue}=require("@aws-sdk/client-s3");lV.exports={getFileStreamFromS3:Pue,getS3AuthObj:cV};async function Pue(e){let{s3:t}=e,r={Bucket:t.bucket,Key:t.key};return(await cV(t.aws_access_key_id,t.aws_secret_access_key,t.region).send(new Oue(r))).Body}a(Pue,"getFileStreamFromS3");function cV(e,t,r){return new Cue({credentials:{accessKeyId:e,secretAccessKey:t},region:r})}a(cV,"getS3AuthObj")});var dV=M((FBe,uV)=>{"use strict";var rO=class{static{a(this,"BulkLoadFileObject")}constructor(t,r,n,s,i,o,c=null){this.op=t,this.action=r,this.schema=n,this.table=s,this.file_path=i,this.file_type=o,this.role_perms=c}},nO=class{static{a(this,"BulkLoadDataObject")}constructor(t,r,n,s){this.action=t,this.schema=r,this.table=n,this.data=s}};uV.exports={BulkLoadFileObject:rO,BulkLoadDataObject:nO}});var mV=M((GBe,fV)=>{"use strict";var sO=class{static{a(this,"PermissionTableResponseObject")}constructor(t,r,n=[],s=[]){this.schema=t,this.table=r,this.required_table_permissions=n,this.required_attribute_permissions=s}};fV.exports=sO});var hV=M(($Be,pV)=>{"use strict";var iO=class{static{a(this,"PermissionAttributeResponseObject")}constructor(t,r=[]){this.attribute_name=t,this.required_permissions=r}};pV.exports=iO});var aO=M((KBe,_V)=>{"use strict";var EV=mV(),Lue=hV(),{HDB_ERROR_MSGS:Due}=Vr(),oO=class{static{a(this,"PermissionResponseObject")}constructor(){this.error=Due.OP_AUTH_PERMS_ERROR,this.unauthorized_access={},this.invalid_schema_items=[]}handleUnauthorizedItem(t){return this.invalid_schema_items=[],this.unauthorized_access=[t],this}handleInvalidItem(t){return this.invalid_schema_items=[t],this.unauthorized_access=[],this}addInvalidItem(t,r,n){if(r&&n){let s=`${r}_${n}`;if(this.unauthorized_access[s])return}this.invalid_schema_items.push(t)}addUnauthorizedTable(t,r,n){let s=new EV(t,r,n),i=`${t}_${r}`;this.unauthorized_access[i]=s}addUnauthorizedAttributes(t,r,n,s){let i=[];t.forEach(c=>{let l=new Lue(c,s[c]);i.push(l)});let o=`${r}_${n}`;if(this.unauthorized_access[o])this.unauthorized_access[o].required_attribute_permissions=i;else{let c=new EV(r,n,[],i);this.unauthorized_access[o]=c}}getPermsResponse(){let t=Object.values(this.unauthorized_access);return t.length>0||this.invalid_schema_items.length>0?(this.unauthorized_access=t,this):null}};_V.exports=oO});var eu=M((jBe,yV)=>{"use strict";var WBe=yn(),wh=Q(),{validateBySchema:gV}=ht(),_a=require("joi"),vue=po(),aT=ae(),{handleHDBError:cT,hdbErrors:Mue,ClientError:SV}=Ee(),{HDB_ERROR_MSGS:lT,HTTP_STATUS_CODES:cO}=Mue,TV=ce();TV.initSync();var{getDatabases:lO}=(Ce(),L(ct)),Uue=require("fs-extra"),xue=(H(),L(j));yV.exports={describeAll:Bue,describeTable:uT,describeSchema:kue};async function Bue(e={}){try{let t=aT.isEmptyOrZeroLength(e),r=!!e.bypass_auth,n,s;!t&&!r&&(n=e.hdb_user?.role?.permission,s=n?.super_user||n?.cluster_user);let i=lO(),o={},c={},l=[],u=e?.exact_count,d=e?.include_computed;for(let m in i){o[m]=!0,!t&&!s&&!r&&(c[m]=e.hdb_user?.role?.permission[m]?.describe);let p=i[m];for(let h in p)try{let E;if(t||s||r)E=await uT({schema:m,table:h,exact_count:u,include_computed:d});else if(n&&n[m].describe&&n[m].tables[h].describe){let _=n[m].tables[h].attribute_permissions;E=await uT({schema:m,table:h,exact_count:u,include_computed:d},_)}E&&l.push(E)}catch(E){wh.error(E)}}let f={};for(let m in l)t||s||r?(f[l[m].schema]==null&&(f[l[m].schema]={}),f[l[m].schema][l[m].name]=l[m],o[l[m].schema]&&delete o[l[m].schema]):c[l[m].schema]&&(f[l[m].schema]==null&&(f[l[m].schema]={}),f[l[m].schema][l[m].name]=l[m],o[l[m].schema]&&delete o[l[m].schema]);for(let m in o)t||s||r?f[m]={}:c[m]&&(f[m]={});return f}catch(t){return wh.error("Got an error in describeAll"),wh.error(t),cT(new Error,lT.DESCRIBE_ALL_ERR)}}a(Bue,"describeAll");async function uT(e,t){aT.transformReq(e);let{schema:r,table:n}=e;r=r?.toString(),n=n?.toString();let s=t;e.hdb_user&&!e.hdb_user?.role?.permission?.super_user&&(s=e.hdb_user?.role?.permission[r]?.tables[n]?.attribute_permissions);let i=gV(e,_a.object({database:_a.string(),table:_a.string().required(),exact_count:_a.boolean().strict(),include_computed:_a.boolean().strict()}));if(i)throw new SV(i.message);let c=lO()[r];if(!c)throw cT(new Error,lT.SCHEMA_NOT_FOUND(e.schema),cO.NOT_FOUND);let l=c[n];if(!l)throw cT(new Error,lT.TABLE_NOT_FOUND(e.schema,e.table),cO.NOT_FOUND);function u(p){(!p.computed||e.include_computed)&&d.push({attribute:p.attribute,type:p.type,elements:p.elements?.type,indexed:p.indexed,is_primary_key:p.isPrimaryKey,assigned_created_time:p.assignCreatedTime,assigned_updated_time:p.assignUpdatedTime,nullable:p.nullable,computed:p.computed?!0:void 0,properties:p.properties?p.properties.map(h=>({type:h.type,name:h.name})):void 0})}a(u,"pushAtt");let d=[];if(s){let p={};s.forEach(h=>{h.describe&&(p[h.attribute_name]=!0)}),l.attributes.forEach(h=>{p[h.name]&&u(h)})}else l.attributes?.forEach(p=>u(p));let f;try{f=(await Uue.stat(l.primaryStore.env.path)).size}catch(p){wh.warn("unable to get database size",p)}let m={schema:r,name:l.tableName,hash_attribute:l.attributes.find(p=>p.isPrimaryKey||p.is_hash_attribute)?.name,audit:l.audit,schema_defined:l.schemaDefined,attributes:d,db_size:f};l.replicate!==void 0&&(m.replicate=l.replicate),l.expirationMS!==void 0&&(m.expiration=l.expirationMS/1e3+"s"),l.sealed!==void 0&&(m.sealed=l.sealed),l.sources?.length>0&&(m.sources=l.sources.map(p=>p.name).filter(p=>p&&p!=="NATSReplicator"&&p!=="Replicator")),TV.get(xue.CONFIG_PARAMS.CLUSTERING_ENABLED)&&(m.clustering_stream_name=vue.createNatsTableStreamName(m.schema,m.name));try{let p=await l.getRecordCount({exactCount:!!e.exact_count});m.record_count=p.recordCount,m.table_size=l.getSize(),m.db_audit_size=l.getAuditSize(),m.estimated_record_range=p.estimatedRange;let h=l.auditStore;if(h)for(let E of h.getKeys({reverse:!0,limit:1}))m.last_updated_record=E[0];if(!m.last_updated_record&&l.indices.__updatedtime__)for(let E of l.indices.__updatedtime__.getKeys({reverse:!0,limit:1}))m.last_updated_record=E}catch(p){wh.warn(`unable to stat table dbi due to ${p}`)}return m}a(uT,"descTable");async function kue(e){aT.transformReq(e);let t=gV(e,_a.object({database:_a.string(),exact_count:_a.boolean().strict(),include_computed:_a.boolean().strict()}));if(t)throw new SV(t.message);let r;e.hdb_user&&!e.hdb_user?.role?.permission?.super_user&&(r=e.hdb_user?.role?.permission[e.schema]);let n=e.schema.toString(),i=lO()[n];if(!i)throw cT(new Error,lT.SCHEMA_NOT_FOUND(e.schema),cO.NOT_FOUND);let o={};for(let c in i){let l;if(r&&r.tables[c]&&(l=r.tables[c]),aT.isEmpty(l)||l.describe){let u=await uT({schema:e.schema,table:c,exact_count:e.exact_count,include_computed:e.include_computed},l?l.attribute_permissions:null);u&&(o[u.name]=u)}}return o}a(kue,"describeSchema")});var wV=M((JBe,IV)=>{"use strict";var Fue=eu(),{hdbErrors:RV}=Ee(),{getDatabases:bV}=(Ce(),L(ct));IV.exports={checkSchemaExists:AV,checkSchemaTableExists:Hue,schemaDescribe:Fue};async function AV(e){if(!bV()[e])return RV.HDB_ERROR_MSGS.SCHEMA_NOT_FOUND(e)}a(AV,"checkSchemaExists");async function Hue(e,t){let r=await AV(e);if(r)return r;if(!bV()[e][t])return RV.HDB_ERROR_MSGS.TABLE_NOT_FOUND(e,t)}a(Hue,"checkSchemaTableExists")});var dT=M((XBe,NV)=>{"use strict";var Gue=gs();NV.exports={writeTransaction:que};function que(e,t,r){return Gue.writeTransaction(e,t,r)}a(que,"writeTransaction")});var pO=M((nke,FV)=>{"use strict";var{decode:$ue}=require("msgpackr"),{isMainThread:eke,parentPort:tke,threadId:rke}=require("worker_threads"),pT=dr(),of=Nt(),fO=(H(),L(j)),wn=Q(),dO=ce(),Vue=(H(),L(j)),{onMessageByType:Kue}=rt(),LV=po(),{recordAction:CV,recordActionBinary:Yue}=(ws(),L(BS)),{publishToStream:Wue}=pT,{ConsumerEvents:OV}=require("nats"),jue=yn(),{promisify:zue}=require("util"),{decodeBlobsWithWrites:Jue}=(hs(),L(Og)),DV=zue(setTimeout),hT=1e4,ET,mT,Que,Xue,vV,Nh=new Map,af=new Map;FV.exports={initialize:MV,ingestConsumer:mO,setSubscription:Zue,setIgnoreOrigin:rde,getDatabaseSubscriptions:tde,updateConsumer:UV};async function MV(){Kue(fO.ITC_EVENT_TYPES.NATS_CONSUMER_UPDATE,async n=>{await UV(n)}),vV=!0,wn.notify("Initializing clustering ingest service.");let{connection:e,jsm:t,js:r}=await pT.getNATSReferences();ET=e,mT=e.info.server_name,Que=t,Xue=r}a(MV,"initialize");async function UV(e){if(e.status==="start"){let{js:t,jsm:r}=await xV(e.node_domain_name);mO(e.stream_name,t,r,e.node_domain_name)}else if(e.status==="stop"){let t=Nh.get(e.stream_name+e.node_domain_name);t&&(wn.notify("Closing ingest consumer for node:",e.node_domain_name,"stream:",e.stream_name),await t.close?.(),Nh.set(e.stream_name+e.node_domain_name,"close")),af.get(e.node_domain_name)==="failed"&&af.set(e.node_domain_name,"close")}}a(UV,"updateConsumer");var _T=new Map;function Zue(e,t,r){let n=_T.get(e);n||_T.set(e,n=new Map),n.set(t,r),vV||MV().then(ede)}a(Zue,"setSubscription");async function ede(){let e=await jue.searchByValue({database:"system",table:"hdb_nodes",attribute:"name",value:"*"});for await(let t of e){let r=t.name+of.SERVER_SUFFIX.LEAF,n,s;for(let i of t.subscriptions||[])if(i.subscribe===!0){if(!n&&({js:n,jsm:s}=await xV(r),!n))break;let{schema:o,table:c}=i,l=LV.createNatsTableStreamName(o,c);mO(l,n,s,r)}}}a(ede,"accessConsumers");async function xV(e){let t,r,n=1;for(;!r;)try{t=await ET.jetstream({domain:e}),r=await ET.jetstreamManager({domain:e,checkAPI:!1})}catch(s){if(af.get(e)==="close")break;af.set(e,"failed"),n%10===1&&wn.warn("Nats ingest attempting to connect to:",e,"Nats error:",s.message);let i=n++*100<hT?n++*100:hT;await DV(i)}return{js:t,jsm:r}}a(xV,"connectToRemoteJS");function tde(){return _T}a(tde,"getDatabaseSubscriptions");var BV;function rde(e){BV=e}a(rde,"setIgnoreOrigin");var kV=100,PV=new Array(kV),fT=0;async function mO(e,t,r,n){let{connection:s}=await pT.getNATSReferences();ET=s,mT=s.info.server_name;let i,o=1;for(;!i;)try{i=await t.consumers.get(e,mT),wn.notify("Initializing ingest consumer for node:",n,"stream:",e)}catch(u){if(af.get(n)==="close")break;o%10===1&&wn.warn("Nats ingest error getting consumer:",n,"stream:",e,"Nats error:",u.message),u.code==="404"&&(wn.notify("Nats ingest creating consumer for node:",n,"stream:",e),i=await pT.createConsumer(r,e,mT,new Date(Date.now()).toISOString()));let d=o++*100<hT?o++*100:hT;await DV(d)}let c=!1,l;for(;!c;){if(Nh.get(e+n)==="close"||af.get(n)==="close"){Nh.delete(e+n),c=!0;continue}l=await i.consume({max_messages:dO.get(fO.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXCONSUMEMSGS)??100,bind:!0}),Nh.set(e+n,l);let u=!1;(async()=>{for await(let d of await l.status())if(d.type===OV.ConsumerDeleted&&(await l.close(),c=!0),d.type===OV.HeartbeatsMissed){let f=d.data;wn.trace(`${f} clustering ingest consumer heartbeats missed, node: ${n} stream: ${l.consumer.stream}`),f===100&&(wn.warn(`Restarting clustering ingest consumer due to missed heartbeat threshold being met, node: ${n} stream: ${l.consumer.stream}`),l.stop(),u=!0)}})();try{for await(let d of l)await PV[fT],PV[fT]=nde(d).catch(f=>{wn.error(f)}),++fT>=kV&&(fT=0)}catch(d){d.message==="consumer deleted"?(wn.notify("Nats consumer deleted, closing messages for node:",n,"stream:",l.consumer.stream),await l.close(),c=!0):wn.error("Error consuming clustering ingest, restarting consumer",d)}}}a(mO,"ingestConsumer");async function nde(e){let t;await Jue(()=>{t=$ue(e.data)}),CV(e.data.length,"bytes-received",e.subject,t.operation,"ingest"),wn.trace("Nats message processor message size:",e?.msg?._msg?.size,"bytes");let r=e.headers,n=!1,s=dO.get(fO.CONFIG_PARAMS.CLUSTERING_NODENAME);r.has(of.MSG_HEADERS.TRANSACTED_NODES)&&r.values(of.MSG_HEADERS.TRANSACTED_NODES).indexOf(s)>-1&&(n=!0);let i=r.get(of.MSG_HEADERS.ORIGIN);if(n||(n=i===s&&!BV),Yue(n,"echo",e.subject,t.operation,"ingest"),n){e.ack();return}r.append(of.MSG_HEADERS.TRANSACTED_NODES,s);try{let{operation:o,schema:c,next:l,table:u,records:d,hash_values:f,__origin:m,expiresAt:p}=t;wn.trace("processing message:",o,c,u,(d?"records: "+d.map(I=>I?.id):"")+(f?"ids: "+f:""),"with sequence:",e.seq),wn.trace(`messageProcessor nats msg id: ${e.headers.get(of.MSG_HEADERS.NATS_MSG_ID)}`);let h;d||(d=f);let E=new Promise(I=>h=I),{timestamp:_,user:R,node_name:S}=m||{},y=_T.get(c)?.get(u);if(!y)throw new Error(`Missing table for replication message: ${u}`);if(o==="define_schema")t.type=o,t.onCommit=h,y.send(t);else if(d.length===1&&!l)y.send({type:uO(o),value:d[0],id:f?.[0],expiresAt:p,timestamp:_,table:u,onCommit:h,user:R,nodeName:S});else{let I=d.map((G,X)=>({type:uO(o),value:G,expiresAt:p,id:f?.[X],table:u}));for(;l;)I.push({type:uO(l.operation),value:l.record,expiresAt:l.expiresAt,id:l.id,table:l.table}),l=l.next;y.send({type:"transaction",writes:I,table:u,timestamp:_,onCommit:h,user:R,nodeName:S})}dO.get(Vue.CONFIG_PARAMS.CLUSTERING_REPUBLISHMESSAGES)!==!1&&Wue(e.subject.split(".").slice(0,-1).join("."),LV.createNatsTableStreamName(c,u),e.headers,e.data),await E;let w=Date.now()-_;_&&CV(w,"replication-latency",e.subject,o,"ingest")}catch(o){wn.error(o)}e.ack()}a(nde,"messageProcessor");function uO(e){switch(e){case"insert":case"upsert":case"update":return"put"}return e}a(uO,"convertOperation")});var dr=M((uke,r1)=>{"use strict";var zr=ce();zr.initSync();var sde=require("fs-extra"),ide=require("semver"),Ph=require("path"),{monotonicFactory:ode}=require("ulidx"),GV=ode(),ade=require("util"),qV=require("child_process"),cde=ade.promisify(qV.exec),lde=qV.spawn,ln=Nt(),nt=(H(),L(j)),{packageJson:ude,PACKAGE_ROOT:dde}=Et(),gT=ae(),vi=Q(),ST=po(),fde=dT(),Ch=_t(),{broadcast:mde,onMessageByType:pde,getWorkerIndex:hde}=rt(),{isMainThread:$V}=require("worker_threads"),{Encoder:Ede,decode:gO}=require("msgpackr"),VV=new Ede,{isEmpty:su}=gT,KV=(zn(),L(Ci)),ike=48*36e11;$V&&pde(nt.ITC_EVENT_TYPES.RESTART,()=>{Nn=void 0,nu=void 0});var{connect:_de,StorageType:gde,RetentionPolicy:Sde,AckPolicy:SO,DeliverPolicy:TO,DiscardPolicy:Tde,NatsConnection:oke,JetStreamManager:ake,JetStreamClient:cke,StringCodec:lke,JSONCodec:yde,createInbox:yO,headers:Rde,ErrorCode:HV}=require("nats"),{recordAction:bde}=(ws(),L(BS)),{encodeBlobsAsBuffers:Ade}=(hs(),L(Og)),YV=yde(),Ide="clustering",wde=ude.engines[ln.NATS_SERVER_NAME],Nde=Ph.join(dde,"dependencies"),_O=Ph.join(Nde,`${process.platform}-${process.arch}`,ln.NATS_BINARY_NAME),hO,EO,Oh,tu,ru;r1.exports={runCommand:WV,checkNATSServerInstalled:Cde,createConnection:RO,getConnection:Lh,getJetStreamManager:Dh,getJetStream:zV,getNATSReferences:bo,getServerList:Pde,createLocalStream:bO,listStreams:JV,deleteLocalStream:Lde,getServerConfig:cf,listRemoteStreams:Dde,viewStream:vde,viewStreamIterator:Mde,publishToStream:Ude,request:kde,reloadNATS:AO,reloadNATSHub:Fde,reloadNATSLeaf:Hde,extractServerName:Bde,requestErrorHandler:Gde,createLocalTableStream:e1,createTableStreams:Vde,purgeTableStream:t1,purgeSchemaTableStreams:Kde,getStreamInfo:Yde,updateLocalStreams:jde,closeConnection:Ode,getJsmServerName:TT,addNatsMsgHeader:QV,clearClientCache:jV,updateRemoteConsumer:qde,createConsumer:XV,updateConsumerIterator:$de};async function WV(e,t=void 0){let{stdout:r,stderr:n}=await cde(e,{cwd:t});if(n)throw new Error(n.replace(`
 `,""));return r.replace(`
 `,"")}a(WV,"runCommand");async function Cde(){try{await sde.access(_O)}catch{return!1}let e=await WV(`${_O} --version`,void 0),t=e.substring(e.lastIndexOf("v")+1,e.length);return ide.eq(t,wde)}a(Cde,"checkNATSServerInstalled");async function RO(e,t,r,n=!0,s="127.0.0.1"){if(!t&&!r){let o=await KV.getClusterUser();if(su(o))throw new Error("Unable to get nats connection. Cluster user is undefined.");t=o.username,r=o.decrypt_hash}vi.trace("create nats connection called");let i=await _de({name:s,port:e,user:t,pass:r,maxReconnectAttempts:-1,waitOnFirstConnect:n,timeout:2e5,tls:{keyFile:zr.get(nt.CONFIG_PARAMS.CLUSTERING_TLS_PRIVATEKEY),certFile:zr.get(nt.CONFIG_PARAMS.CLUSTERING_TLS_CERTIFICATE),caFile:zr.get(nt.CONFIG_PARAMS.CLUSTERING_TLS_CERT_AUTH),rejectUnauthorized:!1}});return i.protocol.transport.socket.unref(),vi.trace("create connection established a nats client connection with id",i?.info?.client_id),i.closed().then(o=>{o&&vi.error("Error with Nats client connection, connection closed",o),i===Nn&&jV()}),i}a(RO,"createConnection");function jV(){Nn=void 0,tu=void 0,ru=void 0,nu=void 0}a(jV,"clearClientCache");async function Ode(){Nn&&(await Nn.drain(),Nn=void 0,tu=void 0,ru=void 0,nu=void 0)}a(Ode,"closeConnection");var Nn,nu;async function Lh(){return nu||(nu=RO(zr.get(nt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_NETWORK_PORT),void 0,void 0),Nn=await nu),Nn||nu}a(Lh,"getConnection");async function Dh(){if(tu)return tu;su(Nn)&&await Lh();let{domain:e}=cf(nt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF);if(su(e))throw new Error("Error getting JetStream domain. Unable to get JetStream manager.");return tu=await Nn.jetstreamManager({domain:e,timeout:6e4}),tu}a(Dh,"getJetStreamManager");async function zV(){if(ru)return ru;su(Nn)&&await Lh();let{domain:e}=cf(nt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF);if(su(e))throw new Error("Error getting JetStream domain. Unable to get JetStream manager.");return ru=Nn.jetstream({domain:e,timeout:6e4}),ru}a(zV,"getJetStream");async function bo(){let e=Nn||await Lh(),t=tu||await Dh(),r=ru||await zV();return{connection:e,jsm:t,js:r}}a(bo,"getNATSReferences");async function Pde(e){let t=zr.get(nt.CONFIG_PARAMS.CLUSTERING_HUBSERVER_NETWORK_PORT),{sys_name:r,decrypt_hash:n}=await KV.getClusterUser(),s=await RO(t,r,n),i=yO(),o=s.subscribe(i),c=[],l,u=(async()=>{for await(let d of o){let f=YV.decode(d.data);f.response_time=Date.now()-l,c.push(f)}})();return l=Date.now(),await s.publish("$SYS.REQ.SERVER.PING.VARZ",void 0,{reply:i}),await s.publish("$SYS.REQ.SERVER.PING",void 0,{reply:i}),await s.flush(),await gT.asyncSetTimeout(e),await o.drain(),await s.close(),await u,c}a(Pde,"getServerList");async function bO(e,t){let{jsm:r}=await bo(),n=zr.get(nt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXAGE);n=n===null?0:n*1e9;let s=zr.get(nt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXMSGS);s=s===null?-1:s;let i=zr.get(nt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXBYTES);i=i===null?-1:i,await r.streams.add({name:e,storage:gde.File,retention:Sde.Limits,subjects:t,discard:Tde.Old,maxMsgs:s,maxBytes:i,maxAge:n})}a(bO,"createLocalStream");async function JV(){let{jsm:e}=await bo(),t=await e.streams.list().next(),r=[];return t.forEach(n=>{r.push(n)}),r}a(JV,"listStreams");async function Lde(e){let{jsm:t}=await bo();await t.streams.delete(e)}a(Lde,"deleteLocalStream");async function Dde(e){let{connection:t}=await bo(),r=[],n=yO(),s=t.subscribe(n),i=(async()=>{for await(let o of s)r.push(YV.decode(o.data))})();return await t.publish(`$JS.${e}.API.STREAM.LIST`,void 0,{reply:n}),await t.flush(),await s.drain(),await i,r}a(Dde,"listRemoteStreams");async function vde(e,t=void 0,r=void 0){let{jsm:n,js:s}=await bo(),i=GV(),o={durable_name:i,ack_policy:SO.Explicit};t&&(o.deliver_policy=TO.StartTime,o.opt_start_time=new Date(t).toISOString()),await n.consumers.add(e,o);let c=await s.consumers.get(e,i),l=r?await c.fetch({max_messages:r,expires:2e3}):await c.consume();if(c._info.num_pending===0)return[];let u=[];for await(let d of l){let f=gO(d.data),m={nats_timestamp:d.info.timestampNanos,nats_sequence:d.info.streamSequence,entry:f};if(d.headers&&(m.origin=d.headers.get(ln.MSG_HEADERS.ORIGIN)),u.push(m),d.ack(),d.info.pending===0)break}return await c.delete(),u}a(vde,"viewStream");async function*Mde(e,t=void 0,r=void 0){let{jsm:n,js:s}=await bo(),i=GV(),o={durable_name:i,ack_policy:SO.Explicit};t&&(o.deliver_policy=TO.StartTime,o.opt_start_time=new Date(t).toISOString()),await n.consumers.add(e,o);let c=await s.consumers.get(e,i),l=r?await c.fetch({max_messages:r,expires:2e3}):await c.consume();if(c._info.num_pending===0)return[];for await(let u of l){let d=gO(u.data);d[0]||(d=[d]);for(let f of d){let m={nats_timestamp:u.info.timestampNanos,nats_sequence:u.info.streamSequence,entry:f};u.headers&&(m.origin=u.headers.get(ln.MSG_HEADERS.ORIGIN)),yield m}if(u.ack(),u.info.pending===0)break}await c.delete()}a(Mde,"viewStreamIterator");async function Ude(e,t,r,n){vi.trace(`publishToStream called with subject: ${e}, stream: ${t}, entries:`,n.operation),r=QV(n,r);let{js:s}=await bo(),i=await TT(),o=`${e}.${i}`,c=await Ade(()=>n instanceof Uint8Array?n:VV.encode(n));try{vi.trace(`publishToStream publishing to subject: ${o}`),bde(c.length,"bytes-sent",e,n.operation,"replication"),await s.publish(o,c,{headers:r})}catch(l){if(l.code&&l.code.toString()==="503")return ZV(async()=>{try{await s.publish(o,c,{headers:r})}catch{if(l.code&&l.code.toString()==="503"){vi.trace(`publishToStream creating stream: ${t}`);let d=o.split(".");d[2]="*",await bO(t,[o]),await s.publish(o,c,{headers:r})}else throw l}});throw l}}a(Ude,"publishToStream");function QV(e,t){t===void 0&&(t=Rde());let r=zr.get(nt.CONFIG_PARAMS.CLUSTERING_NODENAME);return!t.has(ln.MSG_HEADERS.ORIGIN)&&r&&t.append(ln.MSG_HEADERS.ORIGIN,r),t}a(QV,"addNatsMsgHeader");function cf(e){e=e.toLowerCase();let t=Ph.join(zr.get(nt.CONFIG_PARAMS.ROOTPATH),Ide);if(e===nt.PROCESS_DESCRIPTORS.CLUSTERING_HUB.toLowerCase())return su(EO)&&(EO={port:Ch.getConfigFromFile(nt.CONFIG_PARAMS.CLUSTERING_HUBSERVER_NETWORK_PORT),server_name:Ch.getConfigFromFile(nt.CONFIG_PARAMS.CLUSTERING_NODENAME)+ln.SERVER_SUFFIX.HUB,config_file:ln.NATS_CONFIG_FILES.HUB_SERVER,pid_file_path:Ph.join(t,ln.PID_FILES.HUB),hdbNatsPath:t}),EO;if(e===nt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF.toLowerCase())return su(hO)&&(hO={port:Ch.getConfigFromFile(nt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_NETWORK_PORT),server_name:Ch.getConfigFromFile(nt.CONFIG_PARAMS.CLUSTERING_NODENAME)+ln.SERVER_SUFFIX.LEAF,config_file:ln.NATS_CONFIG_FILES.LEAF_SERVER,domain:Ch.getConfigFromFile(nt.CONFIG_PARAMS.CLUSTERING_NODENAME)+ln.SERVER_SUFFIX.LEAF,pid_file_path:Ph.join(t,ln.PID_FILES.LEAF),hdbNatsPath:t}),hO;vi.error(`Unable to get Nats server config. Unrecognized process: ${e}`)}a(cf,"getServerConfig");async function XV(e,t,r,n){try{await e.consumers.add(t,{ack_policy:SO.Explicit,durable_name:r,deliver_policy:TO.StartTime,opt_start_time:n})}catch(s){if(s.message!=="consumer already exists")throw s}}a(XV,"createConsumer");async function xde(e,t,r){await e.consumers.delete(t,r)}a(xde,"removeConsumer");function Bde(e){return e.split(".")[1]}a(Bde,"extractServerName");async function kde(e,t,r=6e4,n=yO()){if(!gT.isObject(t))throw new Error("data param must be an object");let s=VV.encode(t),{connection:i}=await bo(),o={timeout:r};n&&(o.reply=n,o.noMux=!0);let c=await i.request(e,s,o);return gO(c.data)}a(kde,"request");function AO(e){return new Promise(async(t,r)=>{let n=lde(_O,["--signal",`reload=${e}`],{cwd:__dirname}),s,i;n.on("error",o=>{r(o)}),n.stdout.on("data",o=>{i+=o.toString()}),n.stderr.on("data",o=>{s+=o.toString()}),n.stderr.on("close",o=>{s&&r(s),t(i)})})}a(AO,"reloadNATS");async function Fde(){let{pid_file_path:e}=cf(nt.PROCESS_DESCRIPTORS.CLUSTERING_HUB);await AO(e)}a(Fde,"reloadNATSHub");async function Hde(){let{pid_file_path:e}=cf(nt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF);await AO(e)}a(Hde,"reloadNATSLeaf");function Gde(e,t,r){let n;switch(e.code){case HV.NoResponders:n=`Unable to ${t}, node '${r}' is not listening.`;break;case HV.Timeout:n=`Unable to ${t}, node '${r}' is listening but did not respond.`;break;default:n=e.message;break}return n}a(Gde,"requestErrorHandler");async function qde(e,t){let r=t+ln.SERVER_SUFFIX.LEAF,{connection:n}=await bo(),{jsm:s}=await Jde(r),{schema:i,table:o}=e,c=ST.createNatsTableStreamName(i,o),l=e.start_time?e.start_time:new Date(Date.now()).toISOString();await ZV(async()=>{if(e.subscribe===!0)await XV(s,c,n.info.server_name,l);else try{await xde(s,c,n.info.server_name)}catch(u){vi.trace(u)}})}a(qde,"updateRemoteConsumer");async function $de(e,t,r,n){let s=ST.createNatsTableStreamName(e,t),i=r+ln.SERVER_SUFFIX.LEAF,o={type:nt.ITC_EVENT_TYPES.NATS_CONSUMER_UPDATE,status:n,stream_name:s,node_domain_name:i};if(!$V&&hde()<zr.get(nt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXINGESTTHREADS)){let{updateConsumer:c}=pO();await c(o)}await mde(o),n==="stop"&&await gT.asyncSetTimeout(1e3)}a($de,"updateConsumerIterator");function ZV(e){return fde.writeTransaction(nt.SYSTEM_SCHEMA_NAME,nt.SYSTEM_TABLE_NAMES.NODE_TABLE_NAME,e)}a(ZV,"exclusiveLock");async function e1(e,t){let r=ST.createNatsTableStreamName(e,t),n=await TT(),s=Wde(e,t,n);await bO(r,[s])}a(e1,"createLocalTableStream");async function Vde(e){for(let t=0,r=e.length;t<r;t++){let n=e[t].schema,s=e[t].table;await e1(n,s)}}a(Vde,"createTableStreams");async function t1(e,t,r=void 0){if(zr.get(nt.CONFIG_PARAMS.CLUSTERING_ENABLED))try{let n=ST.createNatsTableStreamName(e,t),{domain:s}=cf(nt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF);await(await(await Lh()).jetstreamManager({domain:s,timeout:24e4})).streams.purge(n,r)}catch(n){if(n.message==="stream not found")vi.warn(n);else throw n}}a(t1,"purgeTableStream");async function Kde(e,t){if(zr.get(nt.CONFIG_PARAMS.CLUSTERING_ENABLED))for(let r=0,n=t.length;r<n;r++)await t1(e,t[r])}a(Kde,"purgeSchemaTableStreams");async function Yde(e){return(await Dh()).streams.info(e)}a(Yde,"getStreamInfo");function Wde(e,t,r){return`${ln.SUBJECT_PREFIXES.TXN}.${e}${t?"."+t:""}.${r}`}a(Wde,"createSubjectName");async function TT(){if(Oh)return Oh;if(Oh=(await Dh())?.nc?.info?.server_name,Oh===void 0)throw new Error("Unable to get jetstream manager server name");return Oh}a(TT,"getJsmServerName");async function jde(){let e=await Dh(),t=await TT(),r=await JV();for(let n of r){let s=n.config,i=s.subjects[0];if(!i)continue;let o=zde(n),c=i.split(".");if(c[c.length-1]===t&&!o||s.name==="__HARPERDB_WORK_QUEUE__")continue;let u=i.split(".");u[u.length-1]=t;let d=u.join(".");vi.trace(`Updating stream subject name from: ${i} to: ${d}`),s.subjects[0]=d,await e.streams.update(s.name,s)}}a(jde,"updateLocalStreams");function zde(e){let{config:t}=e,r=!1,n=zr.get(nt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXAGE);n=n===null?0:n*1e9;let s=zr.get(nt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXBYTES);s=s===null?-1:s;let i=zr.get(nt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXMSGS);return i=i===null?-1:i,n!==t.max_age&&(t.max_age=n,r=!0),s!==t.max_bytes&&(t.max_bytes=s,r=!0),i!==t.max_msgs&&(t.max_msgs=i,r=!0),r}a(zde,"updateStreamLimits");async function Jde(e){let t,r;try{t=await Nn.jetstream({domain:e}),r=await Nn.jetstreamManager({domain:e,checkAPI:!1})}catch(n){throw vi.error("Unable to connect to:",e),n}return{js:t,jsm:r}}a(Jde,"connectToRemoteJS")});function IO(e){let t=e.get(yT),r=t?(0,lf.unpack)(t):null;r||(r={remoteNameToId:{}});let n=st(),s=!1;r.nodeName=st();let i=r.remoteNameToId;if(i[n]!==0){let o=0,c;for(let l in i){let u=i[l];u===0?c=l:u>o&&(o=u)}if(c){o++,i[c]=o;let l=[Symbol.for("seq"),o];e.rootStore.dbisDb.transactionSync(()=>{e.rootStore.dbisDb.get(l)||e.rootStore.dbisDb.putSync(l,{seqId:Mh(e)??1,nodes:[]})})}i[n]=0,e.putSync(yT,(0,lf.pack)(r))}return r}function vh(e){return IO(e).remoteNameToId}function s1(e,t){let r=IO(t),n=r.remoteNameToId,s=new Map,i=!1;for(let o in e){let c=e[o],l=n[o];if(l==null){let u=0;for(let d in n){let f=n[d];f>u&&(u=f)}l=u+1,n[o]=l,i=!0}s.set(c,l)}return i&&t.putSync(yT,(0,lf.pack)(r)),s}function RT(e,t){let r=IO(t),n=r.remoteNameToId,s=n[e];if(s==null){let i=0;for(let o in n){let c=n[o];c>i&&(i=c)}s=i+1,n[e]=s,t.putSync(yT,(0,lf.pack)(r))}return n1.trace?.("The remote node name map",e,n,s),s}var n1,lf,yT,wO=se(()=>{n1=b(ar());Zn();lf=require("msgpackr"),yT=Symbol.for("remote-ids");a(IO,"getIdMappingRecord");a(vh,"exportIdMapping");a(s1,"remoteToLocalNodeId");a(RT,"getIdOfRemoteNode")});function OO(e,t,r,n,s){let i=e.primaryStore.env.path,o=e.primaryStore.tableId,c;s?.crossThreads===!1?(c=o1,Qde(e.primaryStore,e.auditStore)):(c=i1,e.primaryStore.env.hasSubscriptionCommitListener||(e.primaryStore.env.hasSubscriptionCommitListener=!0,e.primaryStore.on("committed",()=>{a1(i1[i])})));let l=c[i]||(c[i]=[]);if(l.auditStore=e.auditStore,l.lastTxnTime==null&&(l.lastTxnTime=Date.now()),s?.scope==="full-database")return;let u=l[o];u||(u=l[o]=new Map,u.envs=l,u.tableId=o,u.store=e.primaryStore),t=_d(t);let d=new CO(r);d.startTime=n;let f=u.get(t);return f?f.push(d):(u.set(t,f=[d]),f.tables=u,f.key=t),d.subscriptions=f,d}function a1(e){if(!e)return;let t=e.auditStore;t.resetReadTxn(),c1(e.auditStore);let r;for(let{key:n,value:s}of t.getRange({start:e.lastTxnTime,exclusiveStart:!0})){e.lastTxnTime=n;let i=wt(s),o=e[i.tableId];if(!o)continue;let c=i.recordId,l=_d(c),u=0;do{let d=o.get(l);if(d){for(let m of d)if(!(u>0&&!(m.includeDescendants&&!(m.onlyChildren&&u>1)))){if(m.startTime>=n){(0,NO.info)("omitting",c,m.startTime,n);continue}try{let p;m.supportsTransactions&&m.txnInProgress!==i.version&&(p=!0,m.txnInProgress||(r?r.push(m):r=[m]),m.txnInProgress=i.version),m.listener(c,i,n,p)}catch(p){console.error(p),(0,NO.info)(p)}}}if(l==null)break;let f=l.lastIndexOf?.("/",l.length-2);f!==l.length-1&&u++,f>-1?l=l.slice(0,f+1):l=null}while(!0)}if(r)for(let n of r)n.txnInProgress=null,n.listener(null,{type:"end_txn"},e.lastTxnTime,!0)}function Qde(e,t){let r=t||e,n=r.env;if(!n.hasAfterCommitListener){n.hasAfterCommitListener=!0;let s=n.path;r.on("aftercommit",({next:i,last:o,txnId:c})=>{let l=o1[s];if(!l)return;let u=a(()=>{r.threadLocalWrites||(r.threadLocalWrites=new Float64Array(r.getUserSharedBuffer("last-thread-local-write",new ArrayBuffer(8)))),l.txnTime=r.threadLocalWrites[0]||Date.now();try{a1(l)}finally{r.threadLocalWrites[0]=l.lastTxnTime,r.unlock("thread-local-writes")}},"acquiredLock");r.attemptLock("thread-local-writes",u)&&u()})}}function c1(e){e.nextTransaction?.resolve();let t;e.nextTransaction=new Promise(r=>{t=r}),e.nextTransaction.resolve=t}function l1(e){return e.nextTransaction||(OO({primaryStore:e,auditStore:e},null,null,0,{scope:"full-database"}),c1(e)),e.nextTransaction}var NO,i1,o1,CO,PO=se(()=>{NO=b(Q());hd();fc();io();i1=Object.create(null),o1=Object.create(null);a(OO,"addSubscription");CO=class extends ps{static{a(this,"Subscription")}listener;subscriptions;startTime;includeDescendants;supportsTransactions;onlyChildren;constructor(t){super(),this.listener=t,this.on("close",()=>this.end())}end(){if(this.subscriptions){if(this.subscriptions.splice(this.subscriptions.indexOf(this),1),this.subscriptions.length===0){let t=this.subscriptions.tables;if(t){let r=this.subscriptions.key;if(t.delete(r),t.size===0){let n=t.envs,s=t.dbi;delete n[s]}}}this.subscriptions=null}}toJSON(){return{name:"subscription"}}};a(a1,"notifyFromTransactionData");a(Qde,"listenToCommits");a(c1,"nextTransaction");a(l1,"whenNextTransaction")});var h1={};ye(h1,{commitsAwaitingReplication:()=>uf,getHDBNodeTable:()=>Gt,getReplicationSharedStatus:()=>df,iterateRoutes:()=>xh,shouldReplicateToNode:()=>Uh,subscribeToNodeUpdates:()=>ff});function Gt(){return u1||(u1=je({table:"hdb_nodes",database:"system",attributes:[{name:"name",isPrimaryKey:!0},{attribute:"subscriptions"},{attribute:"system_info"},{attribute:"url"},{attribute:"routes"},{attribute:"ca"},{attribute:"ca_info"},{attribute:"replicates"},{attribute:"revoked_certificates"},{attribute:"__createdtime__"},{attribute:"__updatedtime__"}]}))}function df(e,t,r,n){return new Float64Array(e.getUserSharedBuffer(["replicated",t,r],new ArrayBuffer(64),n&&{callback:n}))}function ff(e){Gt().subscribe({}).then(async t=>{for await(let r of t){let n=r?.value?.name;p1.debug?.("adding node",n,"on  node",st()," on process",process.pid),server.nodes=server.nodes.filter(i=>i.name!==n),r.type==="put"&&n!==st()&&(r.value?server.nodes.push(r.value):console.error("Invalid node update event",r));let s=new Map;for await(let i of Gt().search({}))if(i.shard!=null){let o=s.get(i.shard);o||s.set(i.shard,o=[]),o.push(i)}server.shards=s,(r.type==="put"||r.type==="delete")&&e(r.value,r.id)}})}function Uh(e,t){let r=Oc.default.get(x.REPLICATION_DATABASES);return(e.replicates===!0||e.replicates?.sends)&&databases[t]&&(r==="*"||r?.find?.(n=>(typeof n=="string"?n:n.name)===t&&(!n.sharded||e.shard===Oc.default.get(x.REPLICATION_SHARD))))&&Gt().primaryStore.get(st())?.replicates||e.subscriptions?.some(n=>(n.database||n.schema)===t&&n.subscribe)}function Xde(){ff(e=>{Pc({},(t,r)=>{let n=e.name,s=d1.get(n);if(s||d1.set(n,s=new Map),s.has(r))return;let i;for(let o in t)if(i=t[o].auditStore,i)break;if(i){let o=df(i,r,n,()=>{let c=o[0],l=o.lastTime;for(let{txnTime:u,onConfirm:d}of uf.get(r)||[])u>l&&u<=c&&d();o.lastTime=c});o.lastTime=0,s.set(r,o)}})})}function*xh(e){for(let t of e.routes||[]){let r=t.url,n;if(typeof t=="string"?t.includes("://")?r=t:n=t:n=t.hostname??t.host,n&&!r){let s=Oc.default.get(x.REPLICATION_SECUREPORT)??(!Oc.default.get(x.REPLICATION_PORT)&&Oc.default.get(x.OPERATIONSAPI_NETWORK_SECUREPORT)),i;(i=n.match(/:(\d+)$/)?.[1])?n=n.slice(0,-i[0].length-1):t.port?i=t.port:i=s||Oc.default.get(x.REPLICATION_PORT)||Oc.default.get(x.OPERATIONSAPI_NETWORK_PORT);let o=i?.lastIndexOf?.(":");o>0&&(i=+i.slice(o+1).replace(/[\[\]]/g,"")),r=(s?"wss://":"ws://")+n+":"+i}if(!r){f1.isMainThread&&console.error("Invalid route, must specify a url or host (with port)");continue}yield{replicates:!t.subscriptions,url:r,subscription:t.subscriptions,routes:t.routes,startTime:t.startTime,revoked_certificates:t.revokedCertificates}}}var f1,m1,Oc,p1,u1,d1,uf,mf=se(()=>{Ce();Zn();dp();f1=require("worker_threads"),m1=b(Ee()),Oc=b(ce());H();p1=b(ar());server.nodes=[];a(Gt,"getHDBNodeTable");a(df,"getReplicationSharedStatus");a(ff,"subscribeToNodeUpdates");a(Uh,"shouldReplicateToNode");d1=new Map;d0((e,t,r)=>{if(r>server.nodes.length)throw new m1.ClientError(`Cannot confirm replication to more nodes (${r}) than are in the network (${server.nodes.length})`);uf||(uf=new Map,Xde());let n=uf.get(e);return n||(n=[],uf.set(e,n)),new Promise(s=>{let i=0;n.push({txnTime:t,onConfirm:a(()=>{++i===r&&s()},"onConfirm")})})});a(Xde,"startSubscriptionToReplications");a(xh,"iterateRoutes")});var R1={};ye(R1,{connectedToNode:()=>iu,disconnectedFromNode:()=>hf,ensureNode:()=>ga,requestClusterStatus:()=>y1,startOnMainThread:()=>LO});async function LO(e){let t=0,r=dt();for(let o of Object.getOwnPropertyNames(r)){let c=r[o];for(let l in c){let u=c[l];if(u.auditStore){bT.set(o,Mh(u.auditStore));break}}}Mi.whenThreadsStarted.then(async()=>{let o=[];for await(let u of r.system.hdb_nodes?.search([])||[])o.push(u);let c=st();function l(){let u=Gt().primaryStore.get(c);if(u!==null){let d=e.url??Lc();if(u===void 0||u.url!==d||u.shard!==e.shard)return ga(c,{name:c,url:d,shard:e.shard,replicates:!0})}}a(l,"ensureThisNode"),Gt().primaryStore.get(c)&&l();for(let u of xh(e))try{let d=!u.subscriptions;if(d&&await l(),d&&u.replicates==null&&(u.replicates=!0),E1.push(u),o.find(f=>f.url===u.url))continue;s(u)}catch(d){console.error(d)}ff(s)});let n;function s(o,c=o?.name){let l=st()&&c===st()||Lc()&&o?.url===Lc();if(l){let m=!!o?.replicates;if(n!==void 0&&n!==m)for(let p of Gt().search([]))p.replicates&&p.name!==c&&s(p,p.name);n=m}if(at.trace("Setting up node replication for",o),!o){for(let[m,p]of Ao){let h;for(let[E,{worker:_,nodes:R}]of p){let S=R[0];if(S&&S.name==c){h=!0;for(let[y,{worker:w}]of p)p.delete(y),at.warn("Node was deleted, unsubscribing from node",c,y,m),w?.postMessage({type:"unsubscribe-from-node",node:c,nodes:R,database:y,url:m});break}}if(h){Ao.get(m).iterator.remove(),Ao.delete(m);return}}return}if(l)return;if(!o.url){at.info(`Node ${o.name} is missing url`);return}let u=Ao.get(o.url);if(u&&u.iterator.remove(),!(o.replicates===!0||o.replicates?.sends)&&!o.subscriptions?.length&&!u)return;if(at.info(`Added node ${o.name} at ${o.url} for process ${st()}`),o.replicates&&o.subscriptions&&(o={...o,subscriptions:null}),o.name){for(let[m,p]of pf)if(o.url===p.url){pf.delete(m);break}pf.set(o.name,o)}let d=dt();if(u||(u=new Map,Ao.set(o.url,u)),u.iterator=Pc(e,(m,p,h)=>{h?f(p,!0):f(p,!1)}),o.subscriptions)for(let m of o.subscriptions){let p=m.database||m.schema;d[p]||(at.warn(`Database ${p} not found for node ${o.name}, making a subscription anyway`),f(p,!1))}function f(m,p){at.trace("Setting up replication for database",m,"on node",o.name);let h=u.get(m),E,_=[{replicateByDefault:p,...o}];bT.has(m)&&Bh.default.get(x.REPLICATION_FAILOVER)&&(_.push({replicateByDefault:p,name:st(),startTime:bT.get(m),endTime:Date.now(),replicates:!0}),bT.delete(m));let R=Uh(o,m),S=Mi.workers.filter(y=>y.name==="http");if(h){if(E=h.worker,h.nodes=_,R)return}else R&&(t=t%S.length,E=S[t++],E||at.warn("No http workers available to subscribe to node",o.name,o.url),u.set(m,{worker:E,nodes:_,url:o.url}),E?.on("exit",()=>{u.get(m)?.worker===E&&(u.delete(m),f(m,p))}));if(R){let y=Zde.HDB_LEADER_URL??process.env.HDB_LEADER_URL??E1[0]?.url,w=y?new URL(y).hostname:Array.from(Gt().primaryStore.getKeys({}).filter(G=>G!==st()))[0],I=_[0].name??(_[0].url&&new URL(_[0].url).hostname);at.warn(`Setting up subscription with leader ${w} for node ${I}`),_[0].isLeader=!w||I===w,setTimeout(()=>{let G={..._[0],type:"subscribe-to-node",database:m,nodes:_};E?E.postMessage(G):kh(G)},efe)}else{at.info("Node no longer should be used, unsubscribing from node",{replicates:o.replicates,databaseName:m,node:o,subscriptions:o.subscriptions,hasDatabase:!!d[m],thisReplicates:Gt().primaryStore.get(st())?.replicates}),Gt().primaryStore.get(st())?.replicates||(n=!1,at.info("Disabling replication, this node name",st(),Gt().primaryStore.get(st()),m));let y={type:"unsubscribe-from-node",database:m,url:o.url,name:o.name,nodes:_};E?E.postMessage(y):IT(y)}}a(f,"onDatabase")}a(s,"onNodeUpdate"),hf=a(function(o){try{at.info("Disconnected from node",o.name,o.url,"finished",!!o.finished);let c=Array.from(pf.keys()),l=c.sort(),u=l.indexOf(o.name||Ui(o.url));if(u===-1){at.warn("Disconnected node not found in node map",o.name,c);return}let d=Ao.get(o.url),f=d?.get(o.database);if(!f){at.warn("Disconnected node not found in replication map",o.database,d);return}if(f.connected=!1,o.finished||!Bh.default.get(x.REPLICATION_FAILOVER))return;let m=f.nodes[0];if(!(m.replicates===!0||m.replicates?.sends||m.subscriptions?.length))return;let p=m.shard,h=(u+1)%l.length;for(;u!==h;){let E=l[h],_=pf.get(E);d=Ao.get(_.url);let R=d?.get(o.database);if(!R||R.connected===!1||R.nodes[0].shard!==p){h=(h+1)%l.length;continue}let{nodes:S}=R,y=!1;for(let w of f.nodes){if(S.some(I=>I.name===w.name)){at.info(`Disconnected node is already failing over to ${E} for ${o.database}`);continue}w.endTime<Date.now()||(S.push(w),at.info(`Failing over ${o.database} from ${o.name} to ${E}`),i(w,o.database,R.nodes[0]),y=!0)}f.nodes=[f.nodes[0]],y||at.info(`Disconnected node ${o.name} has no nodes to fail over to ${E}`);return}at.warn("Unable to find any other node to fail over to",o.name,o.url)}catch(c){at.error("Error failing over node",c)}},"disconnectedFromNode"),iu=a(function(o){let c=Ao.get(o.url),l=c?.get(o.database);if(!l){at.warn("Connected node not found in replication map, this may be because the node is being removed",o.database,c);return}l.connected=!0,l.latency=o.latency;let u=l.nodes[0];if(!u){at.warn("Newly connected node has no node subscriptions",o.database,l);return}if(!u.name){at.debug("Connected node is not named yet",o.database,l);return}if(!Bh.default.get(x.REPLICATION_FAILOVER))return;l.nodes=[u];let d=!1;for(let f of Ao.values()){let m=f.get(o.database);if(!m||m==l)continue;let{worker:p,nodes:h,connected:E}=m;if(h)if(E===!1&&h[0].shard===u.shard&&node.url===u.url)for(let _ of h)i(_,o.database);else{let _=h.filter(R=>{if(R)return R.name===u.name&&R.worker?(R.worker.postMessage({type:"unsubscribe-to-node",database:o.database,url:o.url,nodes:[R]}),!1):!0});_.length<h.length&&(m.nodes=_)}}},"connectedToNode");function i(o,c,l=o){let u=Mi.workers.filter(f=>f.name==="http");t=t%u.length;let d=u[t++];Object.defineProperty(o,"worker",{value:d,configurable:!0}),d?d.postMessage({url:l.url,name:l.name,type:"subscribe-to-node",database:c,nodes:[o]}):kh({url:l.url,name:l.name,database:c,nodes:[o]})}a(i,"connectToNextWorker"),(0,Mi.onMessageByType)("disconnected-from-node",hf),(0,Mi.onMessageByType)("connected-to-node",iu),(0,Mi.onMessageByType)("request-cluster-status",y1)}function y1(e,t){let r=[];for(let[n,s]of pf)try{let i=Ao.get(s.url);at.info("Getting cluster status for",n,s.url,"has dbs",i?.size);let o=[];if(i){for(let[l,{worker:u,connected:d,nodes:f,latency:m}]of i)o.push({database:l,connected:d,latency:m,threadId:u?.threadId,nodes:f.filter(p=>!(p.endTime<Date.now())).map(p=>p.name)});let c=g1(s);c.database_sockets=o,delete c.ca,delete c.node_name,delete c.__updatedtime__,delete c.__createdtime__,r.push(c)}}catch(i){at.warn("Error getting cluster status for",s?.url,i)}return t?.postMessage({type:"cluster-status",connections:r}),{connections:r}}async function ga(e,t){let r=Gt();e=e??Ui(t.url),t.name=e;try{if(t.ca){let s=new S1.X509Certificate(t.ca);t.ca_info={issuer:s.issuer.replace(/\n/g," "),subject:s.subject.replace(/\n/g," "),subjectAltName:s.subjectAltName,serialNumber:s.serialNumber,validFrom:s.validFrom,validTo:s.validTo}}}catch(s){at.error("Error parsing replication CA info for hdb_nodes table",s.message)}let n=r.primaryStore.get(e);if(at.debug(`Ensuring node ${e} at ${t.url}, existing record:`,n,"new record:",t),!n)await r.patch(t);else{t.replicates&&!Bh.default.get(x.CLUSTERING_ENABLED)&&(t.subscriptions=null);for(let s in t)if(n[s]!==t[s]&&s==="subscriptions"&&t[s]&&n[s]){let i=[],o=g1(n[s]);for(let c of t[s]){let l=!1;for(let u of o)if((c.database??c.schema)===(u.database??u.schema)&&c.table===u.table){u.publish=c.publish,u.subscribe=c.subscribe,l=!0;break}l||i.push(c)}t.subscriptions=[...o,...i];break}if(Array.isArray(t.revoked_certificates)){let s=n.revoked_certificates||[];t.revoked_certificates=[...new Set([...s,...t.revoked_certificates])]}at.info(`Updating node ${e} at ${t.url}`),await r.patch(t)}}var Mi,AT,at,_1,Bh,S1,T1,g1,Zde,efe,Ao,hf,iu,pf,bT,E1,Fh=se(()=>{Ce();Mi=b(rt());Zn();AT=require("worker_threads");mf();at=b(Q()),_1=b(require("lodash")),Bh=b(ce());H();S1=require("crypto"),T1=b(require("minimist")),{cloneDeep:g1}=_1.default,Zde=(0,T1.default)(process.argv),efe=200,Ao=new Map,pf=new Map,bT=new Map,E1=[];a(LO,"startOnMainThread");a(y1,"requestClusterStatus");AT.parentPort&&(hf=a(e=>{AT.parentPort.postMessage({type:"disconnected-from-node",...e})},"disconnectedFromNode"),iu=a(e=>{AT.parentPort.postMessage({type:"connected-to-node",...e})},"connectedToNode"),(0,Mi.onMessageByType)("subscribe-to-node",e=>{kh(e)}),(0,Mi.onMessageByType)("unsubscribe-from-node",e=>{IT(e)}));a(ga,"ensureNode")});var Cn=M(qt=>{"use strict";var yr=require("path"),{watch:tfe}=require("chokidar"),es=require("fs-extra"),Ef=require("node-forge"),C1=require("net"),{generateKeyPair:DO,X509Certificate:Sa,createPrivateKey:O1,randomBytes:rfe}=require("node:crypto"),nfe=require("util");DO=nfe.promisify(DO);var Ut=Ef.pki,xi=require("joi"),{v4:P1}=require("uuid"),{validateBySchema:xO}=ht(),{forComponent:sfe}=Q(),Ns=ce(),Qs=(H(),L(j)),{CONFIG_PARAMS:au}=Qs,Bi=kw(),{ClientError:Dc}=Ee(),NT=require("node:tls"),{relative:L1,join:ife}=require("node:path"),{CERTIFICATE_VALUES:b1}=Bi,ofe=lc(),vO=_t(),{table:afe,getDatabases:cfe,databases:wT}=(Ce(),L(ct)),{getJWTRSAKeys:A1}=(rf(),L(Ah)),Xe=sfe("tls").conditional;qt.generateKeys=FO;qt.updateConfigCert=F1;qt.createCsr=hfe;qt.signCertificate=Efe;qt.setCertTable=_f;qt.loadCertificates=x1;qt.reviewSelfSignedCert=GO;qt.createTLSSelector=G1;qt.listCertificates=$1;qt.addCertificate=Rfe;qt.removeCertificate=Afe;qt.createNatsCerts=Sfe;qt.generateCertsKeys=gfe;qt.getReplicationCert=Gh;qt.getReplicationCertAuth=pfe;qt.renewSelfSigned=Tfe;qt.hostnamesFromCert=$O;qt.getKey=Ife;qt.getHostnamesFromCertificate=wfe;qt.getPrimaryHostName=qO;qt.generateSerialNumber=PT;var{urlToNodeName:D1,getThisNodeUrl:lfe,getThisNodeName:OT,clearThisNodeName:ufe}=(Zn(),L(Io)),{readFileSync:dfe,statSync:v1}=require("node:fs"),Dke=ce(),{getTicketKeys:ffe,onMessageFromWorkers:mfe}=rt(),{isMainThread:M1}=require("worker_threads"),{TLSSocket:U1,createSecureContext:vke}=require("node:tls"),BO=3650,Hh=["127.0.0.1","localhost","::1"],kO=[{name:"countryName",value:"USA"},{name:"stateOrProvinceName",value:"Colorado"},{name:"localityName",value:"Denver"},{name:"organizationName",value:"HarperDB, Inc."}];function PT(){let e=rfe(8);return e[0]=e[0]&127|1,e.toString("hex")}a(PT,"generateSerialNumber");mfe(async e=>{e.type===Qs.ITC_EVENT_TYPES.RESTART&&(Ns.initSync(!0),await GO())});var un;function Mc(){return un||(un=cfe().system.hdb_certificate,un||(un=afe({table:"hdb_certificate",database:"system",attributes:[{name:"name",isPrimaryKey:!0},{attribute:"uses"},{attribute:"certificate"},{attribute:"is_authority"},{attribute:"private_key_name"},{attribute:"details"},{attribute:"is_self_signed"},{attribute:"__updatedtime__"}]}))),un}a(Mc,"getCertTable");async function Gh(){let e=G1("operations-api"),t={secureContexts:null,setSecureContext:a(s=>{},"setSecureContext")};await e.initialize(t);let r=t.secureContexts.get(OT());if(!r)return;let n=new Sa(r.options.cert);return r.cert_parsed=n,r.issuer=n.issuer,r}a(Gh,"getReplicationCert");async function pfe(){Mc();let e=(await Gh()).options.cert,r=new Sa(e).issuer.match(/CN=(.*)/)?.[1];return un.get(r)}a(pfe,"getReplicationCertAuth");var I1,vc=new Map;function x1(){if(I1)return;I1=!0;let e=[{configKey:au.TLS},{configKey:au.OPERATIONSAPI_TLS}];Mc();let t=yr.dirname(vO.getConfigFilePath()),r;for(let{configKey:n}of e){let s=vO.getConfigFromFile(n);if(s){Array.isArray(s)||(s=[s]);for(let i of s){let o=i.privateKey,c=o&&L1(ife(t,"keys"),o);c&&w1(o,l=>{vc.set(c,l)},"private key");for(let l of[!1,!0]){let u=i[l?"certificateAuthority":"certificate"];if(u&&M1){let d;w1(u,f=>{if(b1.cert===f)return;let m=i.hostname??i.hostnames??i.host??i.hosts;m&&!Array.isArray(m)&&(m=[m]);let p=H1(u),h=new Sa(p),E;try{E=qO(h)}catch(y){Xe.error?.("error extracting host name from certificate",y);return}if(E==null){Xe.error?.("No host name found on certificate");return}if(h.checkIssued(new Sa(b1.cert)))return;let _=un.primaryStore.get(E),R=v1(u).mtimeMs,S=!_||_.is_self_signed?1:_.file_timestamp??_.__updatedtime__;if(_&&R<=S){R<S&&Xe.info?.(`Certificate ${E} at ${u} is older (${new Date(R)}) than the certificate in the database (${S>1?new Date(S):"only self signed certificate available"})`);return}r=un.put({name:E,uses:["https",...n.includes("operations")?["operations"]:[]],ciphers:i.ciphers,certificate:p,private_key_name:c,is_authority:l,hostnames:m,fileTimestamp:R,details:{issuer:h.issuer.replace(/\n/g," "),subject:h.subject?.replace(/\n/g," "),subject_alt_name:h.subjectAltName,serial_number:h.serialNumber,valid_from:h.validFrom,valid_to:h.validTo}})},l?"certificate authority":"certificate")}}}}}return r}a(x1,"loadCertificates");function w1(e,t,r){let n,s=a((i,o)=>{try{let c=o.mtimeMs;c&&c!==n&&(n&&M1&&Xe.warn?.(`Reloading ${r}:`,i),n=c,t(H1(i)))}catch(c){Xe.error?.(`Error loading ${r}:`,i,c)}},"loadFile");es.existsSync(e)?s(e,v1(e)):Xe.error?.(`${r} file not found:`,e),tfe(e,{persistent:!1}).on("change",s)}a(w1,"loadAndWatch");function MO(){let e=lfe();if(e==null){let t=Hh[0];return Xe.info?.("replication url is missing from harperdb-config.yaml, using default host"+t),t}return D1(e)}a(MO,"getHost");function CT(){let e=OT();if(e==null){let t=Hh[0];return Xe.info?.("replication url is missing from harperdb-config.yaml, using default host"+t),t}return e}a(CT,"getCommonName");async function hfe(){let e=await Gh(),t=Ut.certificateFromPem(e.options.cert),r=Ut.privateKeyFromPem(e.options.key);Xe.info?.("Creating CSR with cert named:",e.name);let n=Ut.createCertificationRequest();n.publicKey=t.publicKey;let s=[{name:"commonName",value:CT()},...kO];Xe.info?.("Creating CSR with subject",s),n.setSubject(s);let i=[{name:"unstructuredName",value:"HarperDB, Inc."},{name:"extensionRequest",extensions:B1()}];return Xe.info?.("Creating CSR with attributes",i),n.setAttributes(i),n.sign(r),Ef.pki.certificationRequestToPem(n)}a(hfe,"createCsr");function B1(){let e=Hh.includes(CT())?Hh:[...Hh,CT()];return e.includes(MO())||e.push(MO()),[{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0,critical:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"nsCertType",client:!0,server:!0},{name:"subjectAltName",altNames:e.map(t=>C1.isIP(t)?{type:7,ip:t}:{type:2,value:t})}]}a(B1,"certExtensions");async function Efe(e){let t={},r=yr.join(Ns.getHdbBasePath(),Qs.LICENSE_KEY_DIR_NAME);if(e.csr){let n,s;Mc();for await(let d of un.search([]))if(d.is_authority&&!d.details.issuer.includes("HarperDB-Certificate-Authority")){if(vc.has(d.private_key_name)){n=vc.get(d.private_key_name),s=d;break}else if(d.private_key_name&&await es.exists(yr.join(r,d.private_key_name))){n=es.readFile(yr.join(r,d.private_key_name)),s=d;break}}if(!n){let d=await UO();s=d.ca,n=d.private_key}n=Ut.privateKeyFromPem(n),t.signingCA=s.certificate;let i=Ut.certificateFromPem(s.certificate);Xe.info?.("Signing CSR with cert named",s.name);let o=Ut.certificationRequestFromPem(e.csr);try{o.verify()}catch(d){return Xe.error?.(d),new Error("Error verifying CSR: "+d.message)}let c=Ef.pki.createCertificate();c.serialNumber=PT(),c.validity.notBefore=new Date;let l=new Date;c.validity.notAfter=l,c.validity.notAfter.setDate(l.getDate()+BO),Xe.info?.("sign cert setting validity:",c.validity),Xe.info?.("sign cert setting subject from CSR:",o.subject.attributes),c.setSubject(o.subject.attributes),Xe.info?.("sign cert setting issuer:",i.subject.attributes),c.setIssuer(i.subject.attributes);let u=o.getAttribute({name:"extensionRequest"}).extensions;Xe.info?.("sign cert adding extensions from CSR:",u),c.setExtensions(u),c.publicKey=o.publicKey,c.sign(n,Ef.md.sha256.create()),t.certificate=Ut.certificateToPem(c)}else Xe.info?.("Sign cert did not receive a CSR from:",e.url,"only the CA will be returned");return t}a(Efe,"signCertificate");async function _fe(e,t){await _f({name:OT(),uses:["https","wss"],certificate:e,private_key_name:"privateKey.pem",is_authority:!1,is_self_signed:!0}),await _f({name:t.subject.getField("CN").value,uses:["https","wss"],certificate:Ut.certificateToPem(t),private_key_name:"privateKey.pem",is_authority:!0,is_self_signed:!0})}a(_fe,"createCertificateTable");async function _f(e){let t;try{t=new Sa(e.certificate)}catch(r){Xe.error?.(`Failed to parse certificate for ${e.name}:`,r.message),Xe.debug?.("Certificate record details:",JSON.stringify(e,null,2));let n=new Error(`Invalid certificate format for ${e.name}: ${r.message}. This may be due to corrupted certificate data during transfer or encoding issues.`);throw n.code="INVALID_CERTIFICATE_FORMAT",n.cause=r,n}e.details={issuer:t.issuer.replace(/\n/g," "),subject:t.subject?.replace(/\n/g," "),subject_alt_name:t.subjectAltName,serial_number:t.serialNumber,valid_from:t.validFrom,valid_to:t.validTo},Mc(),await un.patch(e)}a(_f,"setCertTable");async function FO(){let e=await DO("rsa",{modulusLength:4096,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{publicKey:Ut.publicKeyFromPem(e.publicKey),privateKey:Ut.privateKeyFromPem(e.privateKey)}}a(FO,"generateKeys");async function HO(e,t,r){let n=Ut.createCertificate();if(!t){let o=await Gh();t=Ut.certificateFromPem(o.options.cert).publicKey}n.publicKey=t,n.serialNumber=PT(),n.validity.notBefore=new Date;let s=new Date;n.validity.notAfter=s,n.validity.notAfter.setDate(s.getDate()+BO);let i=[{name:"commonName",value:CT()},...kO];return n.setSubject(i),n.setIssuer(r.subject.attributes),n.setExtensions(B1()),n.sign(e,Ef.md.sha256.create()),Ut.certificateToPem(n)}a(HO,"generateCertificates");async function UO(){let e=await $1(),t;for(let r of e){if(!r.is_authority)continue;let n=await q1(r.private_key_name);if(r.private_key_name&&n&&new Sa(r.certificate).checkPrivateKey(O1(n))){Xe.trace?.(`CA named: ${r.name} found with matching private key`),t={ca:r,private_key:n};break}}if(t)return t;Xe.trace?.("No CA found with matching private key")}a(UO,"getCertAuthority");async function k1(e,t,r=!0){let n=Ut.createCertificate();n.publicKey=t,n.serialNumber=PT(),n.validity.notBefore=new Date;let s=new Date;n.validity.notAfter=s,n.validity.notAfter.setDate(s.getDate()+BO);let i=[{name:"commonName",value:`HarperDB-Certificate-Authority-${Ns.get(au.REPLICATION_HOSTNAME)??D1(Ns.get(au.REPLICATION_URL))??P1().split("-")[0]}`},...kO];n.setSubject(i),n.setIssuer(i),n.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,critical:!0},{name:"subjectKeyIdentifier"}]),n.sign(e,Ef.md.sha256.create());let o=yr.join(Ns.getHdbBasePath(),Qs.LICENSE_KEY_DIR_NAME),c=yr.join(o,Bi.PRIVATEKEY_PEM_NAME);return r&&await es.writeFile(c,Ut.privateKeyToPem(e)),n}a(k1,"generateCertAuthority");async function gfe(){let{privateKey:e,publicKey:t}=await FO(),r=await k1(e,t),n=await HO(e,t,r);await _fe(n,r),F1()}a(gfe,"generateCertsKeys");async function Sfe(){let e=await HO(Ut.privateKeyFromPem(Bi.CERTIFICATE_VALUES.key),void 0,Ut.certificateFromPem(Bi.CERTIFICATE_VALUES.cert)),t=yr.join(Ns.getHdbBasePath(),Qs.LICENSE_KEY_DIR_NAME),r=yr.join(t,Bi.NATS_CERTIFICATE_PEM_NAME);await es.exists(r)||await es.writeFile(r,e);let n=yr.join(t,Bi.NATS_CA_PEM_NAME);await es.exists(n)||await es.writeFile(n,Bi.CERTIFICATE_VALUES.cert)}a(Sfe,"createNatsCerts");async function Tfe(){Mc();for await(let e of un.search([{attribute:"is_self_signed",value:!0}]))await un.delete(e.name);await GO()}a(Tfe,"renewSelfSigned");async function GO(){ufe(),await x1(),Mc();let e=await UO();if(!e){Xe.notify?.("A matching Certificate Authority and key was not found. A new CA will be created in advance, so it's available if needed.");let r=a(u=>{try{return{key:Ut.privateKeyFromPem(es.readFileSync(u)),keyPath:u}}catch(d){return Xe.warn?.(`Failed to parse private key from ${u}:`,d.message),{key:null,keyPath:u}}},"tryToParseKey"),n=Ns.get(au.TLS),s,i;if(Array.isArray(n)){for(let u of n)if(u.privateKey){let d=r(u.privateKey);if(s=d.key,i=d.keyPath,d.key)break}}else{let u=Ns.get(au.TLS_PRIVATEKEY),d=r(u);s=d.key,i=d.keyPath}let o=yr.join(Ns.getHdbBasePath(),Qs.LICENSE_KEY_DIR_NAME),c=L1(o,i);s||(Xe.warn?.("Unable to parse the TLS key",i,"A new key will be generated and used to create Certificate Authority"),{privateKey:s}=await FO(),es.existsSync(yr.join(o,Bi.PRIVATEKEY_PEM_NAME))&&(c=`privateKey${P1().split("-")[0]}.pem`),await es.writeFile(yr.join(o,c),Ut.privateKeyToPem(s)));let l=await k1(s,Ut.setRsaPublicKey(s.n,s.e),!1);await _f({name:l.subject.getField("CN").value,uses:["https"],certificate:Ut.certificateToPem(l),private_key_name:c,is_authority:!0,is_self_signed:!0})}if(!await Gh()){let r=OT();Xe.notify?.(`A suitable replication certificate was not found, creating new self singed cert named: ${r}`),e=e??await UO();let n=Ut.certificateFromPem(e.ca.certificate),s=n.publicKey,i=await HO(Ut.privateKeyFromPem(e.private_key),s,n);await _f({name:r,uses:["https","operations","wss"],certificate:i,is_authority:!1,private_key_name:e.ca.private_key_name,is_self_signed:!0})}}a(GO,"reviewSelfSignedCert");function F1(){let e=ofe(Object.keys(Qs.CONFIG_PARAM_MAP),!0),t=yr.join(Ns.getHdbBasePath(),Qs.LICENSE_KEY_DIR_NAME),r=yr.join(t,Bi.PRIVATEKEY_PEM_NAME),n=yr.join(t,Bi.NATS_CERTIFICATE_PEM_NAME),s=yr.join(t,Bi.NATS_CA_PEM_NAME),i=Qs.CONFIG_PARAMS,o={[i.TLS_PRIVATEKEY]:e[i.TLS_PRIVATEKEY.toLowerCase()]?e[i.TLS_PRIVATEKEY.toLowerCase()]:r};e[i.TLS_CERTIFICATE.toLowerCase()]&&(o[i.TLS_CERTIFICATE]=e[i.TLS_CERTIFICATE.toLowerCase()]),e[i.TLS_CERTIFICATEAUTHORITY.toLowerCase()]&&(o[i.TLS_CERTIFICATEAUTHORITY]=e[i.TLS_CERTIFICATEAUTHORITY.toLowerCase()]),e[i.OPERATIONSAPI_TLS_CERTIFICATE.toLowerCase()]&&(o[i.OPERATIONSAPI_TLS_CERTIFICATE]=e[i.OPERATIONSAPI_TLS_CERTIFICATE.toLowerCase()]),e[i.OPERATIONSAPI_TLS_PRIVATEKEY.toLowerCase()]&&(o[i.OPERATIONSAPI_TLS_PRIVATEKEY]=e[i.OPERATIONSAPI_TLS_PRIVATEKEY.toLowerCase()]),e[i.OPERATIONSAPI_TLS_CERTIFICATEAUTHORITY.toLowerCase()]&&(o[i.OPERATIONSAPI_TLS_CERTIFICATEAUTHORITY]=e[i.OPERATIONSAPI_TLS_CERTIFICATEAUTHORITY.toLowerCase()]),(e[i.CLUSTERING_ENABLED.toLowerCase()]||e.clustering)&&(o[i.CLUSTERING_TLS_CERTIFICATE]=e[i.CLUSTERING_TLS_CERTIFICATE.toLowerCase()]??n,o[i.CLUSTERING_TLS_CERT_AUTH]=e[i.CLUSTERING_TLS_CERT_AUTH.toLowerCase()]??s,o[i.CLUSTERING_TLS_PRIVATEKEY]=e[i.CLUSTERING_TLS_PRIVATEKEY.toLowerCase()]??r),vO.updateConfigValue(void 0,void 0,o,!1,!0)}a(F1,"updateConfigCert");function H1(e){return e.startsWith("-----BEGIN")?e:dfe(e,"utf8")}a(H1,"readPEM");var N1=NT.createSecureContext;NT.createSecureContext=function(e){if(!e.cert||!e.key)return N1(e);let t={...e};delete t.key,delete t.cert;let r=N1(t);return r.context.setCert(e.cert),r.context.setKey(e.key,void 0),r};var yfe=U1.prototype._init;U1.prototype._init=function(e,t){yfe.call(this,e,t);let r=this;this._handle.oncertcb=function(n){let s=n.servername;r._SNICallback(s,(i,o)=>{this.sni_context=o?.context||o,this.certCbDone()})}};var ou=new Map;function G1(e,t){let r=new Map,n,s=!1;return i.initialize=o=>i.ready?i.ready:(o&&(o.secureContexts=r,o.secureContextsListeners=[]),i.ready=new Promise((c,l)=>{async function u(){try{r.clear(),ou.clear();let d=0;if(wT===void 0){c();return}for await(let f of wT.system.hdb_certificate.search([])){let m=f.certificate,p=new Sa(m);f.is_authority&&(p.asString=m,ou.set(p.subject,m))}for await(let f of wT.system.hdb_certificate.search([]))try{if(f.is_authority)continue;let m=e==="operations-api",p=f.is_self_signed?1:3;m&&f.uses?.includes?.("operations")&&(p+=1);let h=await q1(f.private_key_name),E=f.certificate,_=new Sa(E);if(ou.has(_.issuer)&&(E+=`
-`+ou.get(_.issuer)),!h||!E)throw new Error("Missing private key or certificate for secure server");let R={ciphers:f.ciphers,ticketKeys:ffe(),availableCAs:ou,ca:t&&Array.from(ou.values()),cert:E,key:h,key_file:f.private_key_name,is_self_signed:f.is_self_signed};o&&(R.sessionIdContext=o.sessionIdContext);let S=f.hostnames??$O(_);Array.isArray(S)||(S=[S]);for(let I of S)I===MO()&&(p+=1);let y=NT.createSecureContext(R);y.name=f.name,y.options=R,y.quality=p,y.certificateAuthorities=Array.from(ou),y.certStart=E.toString().slice(0,100);let w;for(let I of S)if(I){I[0]==="*"&&(s=!0,I=I.slice(1)),C1.isIP(I)&&(w=!0);let G=r.get(I)?.quality??0;Xe.trace?.("Assigning TLS for hostname",I,"if",p,">",G),p>G&&r.set(I,y)}else Xe.error?.("No hostname found for certificate at",NT.certificate);Xe.trace?.("Adding TLS",y.name,"for",o.ports||"client","cert named",f.name,"hostnames",S,"quality",p,"best quality",d),p>d&&(i.defaultContext=n=y,d=p,o&&(o.defaultContext=y))}catch(m){Xe.error?.("Error applying TLS for",f.name,m)}o?.secureContextsListeners.forEach(f=>f()),c(n)}catch(d){l(d)}}a(u,"updateTLS"),wT?.system.hdb_certificate.subscribe({listener:a(()=>setTimeout(()=>u(),1500).unref(),"listener"),omitCurrent:!0}),u()})),i;function i(o,c){Xe.info?.("TLS requested for",o||"(no SNI)");let l=o;for(;;){let d=r.get(l);if(d)return Xe.debug?.("Found certificate for",o,d.certStart),d.updatedContext&&(d=d.updatedContext),c(null,d);if(s&&l){let f=l.indexOf(".",1);f<0?l="":l=l.slice(f)}else break}o?Xe.debug?.("No certificate found to match",o,"using the default certificate"):Xe.debug?.("No SNI, using the default certificate",n?.name);let u=n;u?u.updatedContext&&(u=u.updatedContext):Xe.info?.("No default certificate found"),c(null,u)}a(i,"SNICallback")}a(G1,"createTLSSelector");async function q1(e){let t=vc.get(e);return!t&&e?await es.readFile(yr.join(Ns.get(au.ROOTPATH),Qs.LICENSE_KEY_DIR_NAME,e),"utf8"):t}a(q1,"getPrivateKeyByName");async function $1(){Mc();let e=[];for await(let t of un.search([]))e.push(t);return e}a($1,"listCertificates");async function Rfe(e){let t=xO(e,xi.object({name:xi.string().required(),certificate:xi.string().required(),is_authority:xi.boolean().required(),private_key:xi.string(),hosts:xi.array(),uses:xi.array()}));if(t)throw new Dc(t.message);let{name:r,certificate:n,private_key:s,is_authority:i}=e,o=new Sa(n),c=!1,l=!1,u;for(let[p,h]of vc)!s&&!c&&o.checkPrivateKey(O1(h))&&(c=!0,u=p),s&&s===h&&(l=!0,u=p);if(!i&&!s&&!c)throw new Dc("A suitable private key was not found for this certificate");let d;if(!r){try{d=qO(o)}catch(p){Xe.error?.(p)}if(d==null)throw new Dc("Error extracting certificate host name, please provide a name parameter")}let f=bfe(r??d);s&&!c&&!l&&(await es.writeFile(yr.join(Ns.getHdbBasePath(),Qs.LICENSE_KEY_DIR_NAME,f+".pem"),s),vc.set(f,s));let m={name:r??d,certificate:n,is_authority:i,hosts:e.hosts,uses:e.uses};return(!i||i&&u||i&&s)&&(m.private_key_name=u??f+".pem"),e.ciphers&&(m.ciphers=e.ciphers),await _f(m),"Successfully added certificate: "+f}a(Rfe,"addCertificate");function bfe(e){return e.replace(/[^a-z0-9\.]/gi,"-")}a(bfe,"sanitizeName");async function Afe(e){let t=xO(e,xi.object({name:xi.string().required()}));if(t)throw new Dc(t.message);let{name:r}=e;Mc();let n=await un.get(r);if(!n)throw new Dc(r+" not found");let{private_key_name:s}=n;if(s){let i=Array.from(await un.search([{attribute:"private_key_name",value:s}]));i.length===1&&i[0].name===r&&(Xe.info?.("Removing private key named",s),await es.remove(yr.join(Ns.getHdbBasePath(),Qs.LICENSE_KEY_DIR_NAME,s)))}return await un.delete(r),"Successfully removed "+r}a(Afe,"removeCertificate");function qO(e){let t=e.subject?.match(/CN=(.*)/)?.[1];return t||$O(e)[0]}a(qO,"getPrimaryHostName");function $O(e){if(e.subjectAltName)return e.subjectAltName.split(",").map(r=>{let n=r.indexOf(":");if(r=r.slice(n+1),r=r.trim(),r[0]==='"')try{r=JSON.parse(r)}catch{}return r.indexOf("=")>-1?r.match(/CN=([^,]*)/)?.[1]:r}).filter(r=>r);let t=e.subject?.match(/CN=(.*)/)?.[1];return t?[t]:[]}a($O,"hostnamesFromCert");async function Ife(e){if(e.bypass_auth!==!0)throw new Dc("Unauthorized","401");let t=xO(e,xi.object({name:xi.string().required()}));if(t)throw new Dc(t.message);let{name:r}=e;if(r===".jwtPrivate")return(await A1()).privateKey;if(r===".jwtPublic")return(await A1()).publicKey;if(vc.get(r))return vc.get(e.name);throw new Dc("Key not found")}a(Ife,"getKey");function wfe(e){return[e.subject?.CN,...e.subjectaltname.split(",").filter(t=>t.trim().startsWith("DNS:")).map(t=>t.trim().substring(4))]}a(wfe,"getHostnamesFromCertificate")});var fK={};ye(fK,{BACK_PRESSURE_RATIO_POSITION:()=>uK,CONFIRMATION_STATUS_POSITION:()=>lK,LATENCY_POSITION:()=>FT,NodeReplicationConnection:()=>Sf,OPERATION_REQUEST:()=>jO,RECEIVED_TIME_POSITION:()=>xT,RECEIVED_VERSION_POSITION:()=>UT,RECEIVING_STATUS_POSITION:()=>BT,RECEIVING_STATUS_RECEIVING:()=>dK,RECEIVING_STATUS_WAITING:()=>zO,SENDING_TIME_POSITION:()=>$h,createWebSocket:()=>HT,databaseSubscriptions:()=>xc,replicateOverWS:()=>Vh,tableUpdateListeners:()=>XO});async function HT(e,t){let{authorization:r,rejectUnauthorized:n}=t||{},s=st(),i;if(e==null)throw new TypeError(`Invalid URL: Expected a string URL for node "${s}" but received ${e}`);if(e.includes("wss://")){if(!YO){let l=(0,iK.createTLSSelector)("operations-api"),u={secureContexts:null};await l.initialize(u),YO=u.secureContexts}if(i=YO.get(s),i&&ue.debug?.("Creating web socket for URL",e,"with certificate named:",i.name),!i&&n!==!1)throw new Error("Unable to find a valid certificate to use for replication to connect to "+e)}let o={};r&&(o.Authorization=r);let c={headers:o,localAddress:s?.startsWith("127.0")?s:void 0,servername:(0,aK.isIP)(t?.serverName)?void 0:t?.serverName,noDelay:!0,highWaterMark:128*1024,rejectUnauthorized:n!==!1,secureContext:void 0};return i&&((gf?.caCount!==Ta.size||gf?.derivedFromContext!==i)&&(gf=oK.createSecureContext({...i.options,ca:[...Ta,...i.options.availableCAs.values()]}),gf.caCount=Ta.size,gf.derivedFromContext=i),c.secureContext=gf),new rK.WebSocket(e,"harperdb-replication-v1",c)}function Vh(e,t,r){let n=t.port||t.securePort,s=QO.pid%1e3+"-"+nK.threadId+(n?"s:"+n:"c:"+t.url?.slice(-4))+" "+Math.random().toString().slice(2,3);ue.debug?.(s,"Initializing replication connection",r);let i=0,o=Buffer.allocUnsafeSlow(1024),c=0,l=new DataView(o.buffer,0,1024),u=t.database,d=t.databaseSubscriptions||xc,f,m,p=!1,h=t.subscription;h?.then&&h.then(A=>{h=A,h.auditStore&&(f=h.auditStore)});let E=t.tables||u&&dt()[u],_,R=new Map,S=[];_=r.name,_&&t.connection&&(t.connection.nodeName=_);let y,w,I,G,X,q,F,z=6e4,Y,le=0,fe=0,te=0,Se=tK.default.get(x.REPLICATION_BLOBTIMEOUT)??12e4,Ne=new Map,Ke=[],$e=0,Cr;if(t.url){let A=a(()=>{X&&fe===e._socket?.bytesRead&&te===e._socket?.bytesWritten?e.terminate():(X=performance.now(),e.ping(),fe=e._socket?.bytesRead,te=e._socket?.bytesWritten)},"sendPing");I=setInterval(A,Z1).unref(),A()}else or();e._socket?.setMaxListeners(200);function or(){clearTimeout(G),fe=e._socket?.bytesRead,te=e._socket?.bytesWritten,G=setTimeout(()=>{fe===e._socket?.bytesRead&&te===e._socket?.bytesWritten&&(ue.warn?.(`Timeout waiting for ping from ${_}, terminating connection and reconnecting`),e.terminate())},Z1*2).unref()}a(or,"resetPingTimer");let en=0,Hr=0,od=!1,yl=3e4;function Ft(){if(gn?.length>0){let A=performance.now(),U=A-Hr;en=(en*yl+(od?U:0))/(yl+U),m&&(m[uK]=en),Hr=A}}a(Ft,"updateBackPressureRatio"),setInterval(Ft,yl).unref();function Gs(){if(!(!_||!u))return m||(m=df(f,u,_)),m}a(Gs,"getSharedStatus"),u&&Rl(u);let sc,Y_,Vm=[],W_=[],Km,ve=[],j_=[],WA=[],ad=150,to=25,qs=0,Ym=0,Wm=!1,Zo,Hn,gn,Gr;e.on("message",cd);async function cd(A){if(r=await r,!r){ue.error?.(s,"No authorization provided"),qr(1008,"Unauthorized");return}jm(A),e.off("message",cd),e.on("message",jm)}a(cd,"onWSMessageWhenAuthorized");function jm(A){le=performance.now();try{let U=A.dataView=new du(A.buffer,A.byteOffset,A.byteLength);if(A[0]>127){let W=(0,lt.decode)(A),[J,k,he]=W;switch(J){case K1:{if(k){if(_){if(_!==k){ue.error?.(s,`Node name mismatch, expecting to connect to ${_}, but peer reported name as ${k}, disconnecting`),e.send((0,lt.encode)([qh])),qr(1008,"Node name mismatch");return}}else if(_=k,t.connection?.tentativeNode){let me=t.connection.tentativeNode;me.name=_,t.connection.tentativeNode=null,ga(_,me)}if(t.connection&&(t.connection.nodeName=_),ue.debug?.(s,"received node name:",_,"db:",u??W[2]),!u)try{Rl(u=W[2]),u==="system"&&(sc=Pc(t,(me,ie)=>{ac(ie)&&K(ie)}),e.on("close",()=>{sc?.remove()}))}catch(me){ue.warn?.(s,"Error setting database",me),e.send((0,lt.encode)([qh])),qr(1008,me.message);return}zm()}break}case Q1:{ue.debug?.(s,"Received table definitions for",k.map(me=>me.table));for(let me of k){let ie=W[2];me.database=ie;let Oe;if(ac(ie)){if(u==="system")Me[ie]?.[me.table]||(Oe=v(me,Me[ie]?.[me.table]));else{if(ie!=="data"&&!Me[ie]){ue.warn?.("Database not found",ie);return}Oe=v(me,Me[ie]?.[me.table])}f||(f=Oe?.auditStore),E||(E=dt()?.[ie])}}break}case qh:qr();break;case jO:try{let me=r?.replicates||r?.subscribers||r?.name;ue.debug?.("Received operation request",k,"from",_),server.operation(k,{user:r},!me).then(ie=>{ue.debug?.("Requested request from finished",_,ie),Array.isArray(ie)&&(ie={results:ie}),ie.requestId=k.requestId,e.send((0,lt.encode)([DT,ie]))},ie=>{ue.debug?.("Failed requested operation from",_,ie),e.send((0,lt.encode)([DT,{requestId:k.requestId,error:VO(ie)}]))})}catch(me){e.send((0,lt.encode)([DT,{requestId:k.requestId,error:VO(me)}]))}break;case DT:let{resolve:de,reject:_e}=R.get(k.requestId);ue.debug?.("Received completed operation request",_,k),k.error?_e(new Error(k.error)):de(k),R.delete(k.requestId);break;case KO:let re=W[3];if(!E){u?ue.error?.(s,"No database found for",u):ue.error?.(s,"Database name never received"),qr();return}let oe=E[re];oe=v({table:re,database:u,attributes:k.attributes,schemaDefined:k.schemaDefined},oe),Vm[he]={name:re,decoder:new lt.Packr({useBigIntExtension:!0,randomAccessStructure:!0,freezeData:!0,typedStructs:k.typedStructs,structures:k.structures}),getEntry(me){return oe.primaryStore.getEntry(me)},rootStore:oe.primaryStore.rootStore};break;case Y1:Gr=f?s1(k,f):new Map,Km=W[2],ue.debug?.(s,`Acknowledged subscription request, receiving messages for nodes: ${Km}`);break;case W1:let ge=he;WA[ge]=k;break;case J1:Gs()[lK]=k,ue.trace?.(s,"received and broadcasting committed update",k),Gs().buffer.notify();break;case z1:y=k,h.send({type:"end_txn",localTime:y,remoteNodeIds:S}),Gs(),replication_shared_status[UT]=last_sequence_id_received,replication_shared_status[xT]=Date.now(),replication_shared_status[BT]=zO;break;case vT:{let me=W[1],{fileId:ie,size:Oe,finished:Be,error:He}=me,Te=Ne.get(ie);ue.debug?.("Received blob",ie,"has stream",!!Te,"connectedToBlob",!!Te?.connectedToBlob,"length",W[2].length,"finished",Be),Te||(Te=new WO.PassThrough,Te.expectedSize=Oe,Ne.set(ie,Te)),Te.lastChunk=Date.now();let gt=W[2];We(gt.byteLength,"bytes-received",`${_}.${u}`,"replication","blob");try{Be?(He?(Te.on("error",()=>{}),Te.destroy(new Error("Blob error: "+He+" for record "+(Te.recordId??"unknown")+" from "+_))):Te.end(gt),Te.connectedToBlob&&Ne.delete(ie)):Te.write(gt)}catch(Pt){ue.error?.(`Error receiving blob for ${Te.recordId} from ${_} and streaming to storage`,Pt),Ne.delete(ie)}break}case j1:{let me=k,ie;try{let Oe=W[3],Be=W_[he]||(W_[he]=E[W[4]]);if(!Be)return ue.warn?.("Unknown table id trying to handle record request",he);let He=Be.primaryStore.getBinaryFast(Symbol.for("structures")),Te=He?.length??0;if(Te>0&&Te!==Ym){Ym=Te;let Pt=(0,lt.decode)(He);e.send((0,lt.encode)([KO,{typedStructs:Pt.typed,structures:Pt.named},he,Be.tableName]))}let gt=Be.primaryStore.getBinaryFast(Oe);if(gt){let Pt=Be.primaryStore.decoder.decode(gt,{valueAsBuffer:!0}),Lt=ft||{};Lt.version=(0,cK.getLastVersion)(),ft&&ft[Tf]&rn&&(Pt=Buffer.from(Pt),gp(()=>Be.primaryStore.decoder.decode(gt),J_=>ic(J_,Oe),Be.primaryStore.rootStore)),ie=(0,lt.encode)([LT,me,{value:Pt,expiresAt:Lt.expiresAt,version:Lt.version,residencyId:Lt.residencyId,nodeId:Lt.nodeId,user:Lt.user}])}else ie=(0,lt.encode)([LT,me])}catch(Oe){ie=(0,lt.encode)([LT,me,{error:Oe.message}])}e.send(ie);break}case LT:{let{resolve:me,reject:ie,tableId:Oe,key:Be}=R.get(W[1]),He=W[2];if(He?.error)ie(new Error(He.error));else if(He){let Te;Cg(()=>{let gt=Vm[Oe].decoder.decode(He.value);He.value=gt,He.key=Be,me(He)||Te&&setTimeout(()=>Te.forEach(Ig),6e4).unref()},f?.rootStore,gt=>{let Pt=oc(gt,Be);return Te||(Te=[]),Te.push(Pt),Pt})}else me();R.delete(W[1]);break}case V1:{gn=k;let me,ie,Oe=!1;if(h){if(u!==h.databaseName&&!h.then){ue.error?.("Subscription request for wrong database",u,h.databaseName);return}}else h=d.get(u);if(ue.debug?.(s,"received subscription request for",u,"at",gn),!h){let De;h=new Promise(pt=>{ue.debug?.("Waiting for subscription to database "+u),De=pt}),h.ready=De,xc.set(u,h)}if(r.name)ie=Gt().subscribe(r.name),ie.then(async De=>{me=De;for await(let pt of me){let $r=pt.value;if(!($r?.replicates===!0||$r?.replicates?.receives||$r?.subscriptions?.some(Er=>(Er.database||Er.schema)===u&&Er.publish!==!1))){Oe=!0,qr(1008,`Unauthorized database subscription to ${u}`);return}}},De=>{ue.error?.(s,"Error subscribing to HDB nodes",De)});else if(!(r?.role?.permission?.super_user||r.replicates)){e.send((0,lt.encode)([qh])),qr(1008,`Unauthorized database subscription to ${u}`);return}if(Hn&&(ue.debug?.(s,"stopping previous subscription",u),Hn.emit("close")),gn.length===0)return;let Be=gn[0],He=a(De=>{if(De&&(Be.replicateByDefault?!Be.tables.includes(De.tableName):Be.tables.includes(De.tableName)))return{table:De}},"tableToTableEntry"),Te={txnTime:0},gt,Pt,Lt=1/0,J_,Q_=a((De,pt)=>{if(De.type==="end_txn"){Te.txnTime&&(o[i]!==66&&ue.error?.("Invalid encoding of message"),C(9),C(kT),O(J_=pt),fx()),i=c,Te.txnTime=0;return}let $r=De.nodeId,Er=De.tableId,Qt=Pt[Er];if(!Qt&&(Qt=Pt[Er]=He(h.tableById[Er]),!Qt))return ue.debug?.("Not subscribed to table",Er);let bt=Qt.table,dd=bt.primaryStore,gi=dd.encoder;(De.extendedType&qT||!gi.typedStructs)&&(gi._mergeStructures(gi.getStructures()),gi.typedStructs&&(gi.lastTypedStructuresLength=gi.typedStructs.length));let X_=gt[$r];if(!(X_&&X_.startTime<pt&&(!X_.endTime||X_.endTime>pt)))return MT&&ue.trace?.(s,"skipping replication update",De.recordId,"to:",_,"from:",$r,"subscribed:",gt),mx();MT&&ue.trace?.(s,"sending replication update",De.recordId,"to:",_,"from:",$r,"subscribed:",gt);let jA=De.version,bl=De.residencyId,zA=z_(bl,bt),Z_;if(zA&&!zA.includes(_)){let ro=z_(De.previousResidencyId,bt);if(ro&&!ro.includes(_)&&(De.type==="put"||De.type==="patch")||bt.getResidencyById)return mx();let Al=De.recordId;ue.trace?.(s,"sending invalidation",Al,_,"from",$r);let Jm=0;bl&&(Jm|=lu),De.previousResidencyId&&(Jm|=uu);let XA,eg=null;for(let px in bt.indices){if(!eg){if(XA=De.getValue(dd,!0),!XA)break;eg={}}eg[px]=XA[px]}Z_=cu(De.version,Er,Al,null,$r,De.user,De.type==="put"||De.type==="patch"?"invalidate":De.type,gi.encode(eg),Jm,bl,De.previousResidencyId,De.expiresAt)}function mx(){return ue.trace?.(s,"skipping audit record",De.recordId),q||(q=setTimeout(()=>{q=null,(J_||0)+X1/2<Lt&&(MT&&ue.trace?.(s,"sending skipped sequence update",Lt),e.send((0,lt.encode)([z1,Lt])))},X1).unref()),new Promise(setImmediate)}a(mx,"skipAuditRecord");let JA=gi.typedStructs,QA=gi.structures;if((JA?.length!=Qt.typed_length||QA?.length!=Qt.structure_length)&&(Qt.typed_length=JA?.length,Qt.structure_length=QA.length,ue.debug?.(s,"send table struct",Qt.typed_length,Qt.structure_length),Qt.sentName||(Qt.sentName=!0),e.send((0,lt.encode)([KO,{typedStructs:JA,structures:QA,attributes:bt.attributes,schemaDefined:bt.schemaDefined},Er,Qt.table.tableName]))),bl&&!j_[bl]&&(e.send((0,lt.encode)([W1,zA,bl])),j_[bl]=!0),Te.txnTime!==jA&&(Te.txnTime&&(MT&&ue.trace?.(s,"new txn time, sending queued txn",Te.txnTime),o[i]!==66&&ue.error?.("Invalid encoding of message"),fx()),Te.txnTime=jA,i=c,O(jA)),Z_)C(Z_.length),P(Z_);else{let ro=De.encoded;De.extendedType&rn&&gp(()=>De.getValue(dd),Jm=>ic(Jm,De.recordId),dd.rootStore);let Al=ro[0]===66?8:0;C(ro.length-Al),P(ro,Al),ue.trace?.("wrote record",De.recordId,"length:",ro.length)}if(e._socket.writableNeedDrain){let ro=performance.now();return od=!0,Ft(),new Promise(Al=>{ue.debug?.(`Waiting for remote node ${_} to allow more commits ${e._socket.writableNeedDrain?"due to network backlog":"due to requested flow directive"}`),e._socket.once("drain",()=>{Al(),od=!1,Ft()})})}else return $e>to?new Promise(ro=>{Cr=ro}):new Promise(setImmediate)},"sendAuditRecord"),fx=a(()=>{c-i>8?(e.send(o.subarray(i,c)),ue.debug?.(s,"Sent message, size:",c-i),u!=="system"&&We(c-i,"bytes-sent",`${_}.${u}`,"replication","egress")):ue.debug?.(s,"skipping empty transaction")},"sendQueuedData");Hn=new JO.EventEmitter,Hn.once("close",()=>{Oe=!0,me?.end()});for(let{startTime:De}of gn)De<Lt&&(Lt=De);(ie||Promise.resolve()).then(async()=>{h=await h,f=h.auditStore,Pt=h.tableById.map(He),gt=[];for(let{name:pt,startTime:$r,endTime:Er}of gn){let Qt=RT(pt,f);ue.debug?.("subscription to",pt,"using local id",Qt,"starting",$r),gt[Qt]={startTime:$r,endTime:Er}}K(u),sc||(sc=fu(pt=>{pt.databaseName===u&&K(u)}),Y_=Kh(pt=>{pt===u&&(e.send((0,lt.encode)([qh])),qr())}),e.on("close",()=>{sc?.remove(),Y_?.remove()})),e.send((0,lt.encode)([Y1,vh(h.auditStore),gn.map(({name:pt})=>pt)]));let De=!0;do{if(isFinite(Lt)||(ue.warn?.("Invalid sequence id "+Lt),qr(1008,"Invalid sequence id"+Lt)),De&&!Oe&&(De=!1,Lt===0)){ue.info?.("Replicating all tables to",_);let pt=Date.now(),$r=GT(f);for(let Er in E){if(!He(Er))continue;let Qt=E[Er];for(let bt of Qt.primaryStore.getRange({snapshot:!1,versions:!0})){if(Oe)return;ue.trace?.(s,"Copying record from",u,Er,bt.key,bt.localTime),pt=Math.max(bt.localTime??1,pt),Gs()[$h]=1;let dd=cu(bt.version,Qt.tableId,bt.key,null,$r,null,"put",gp(()=>Qt.primaryStore.encoder.encode(bt.value),gi=>ic(gi,bt.key)),bt.metadataFlags&-256,bt.residencyId,null,bt.expiresAt);await Q_({recordId:bt.key,tableId:Qt.tableId,type:"put",getValue(){return bt.value},encoded:dd,version:bt.version,residencyId:bt.residencyId,nodeId:$r,extendedType:bt.metadataFlags},bt.localTime)}}Te.txnTime||(Te.txnTime=pt,O(pt)),c-i>8&&Q_({type:"end_txn"},Lt),Gs()[$h]=0,Lt=pt}for(let{key:pt,value:$r}of f.getRange({start:Lt||1,exclusiveStart:!0,snapshot:!1})){if(Oe)return;let Er=wt($r);ue.debug?.("sending audit record",pt,Er.recordId),Gs()[$h]=pt,Lt=pt,await Q_(Er,pt),Hn.startTime=pt}c-i>8&&Q_({type:"end_txn"},Lt),Gs()[$h]=0,await l1(f)}while(!Oe)}).catch(De=>{ue.error?.(s,"Error handling subscription to node",De),qr(1008,"Error handling subscription to node")});break}}return}U.position=8;let N=!0,D,$;do{Gs();let W=U.readInt();if(W===9&&U.getUint8(U.position)==kT){U.position++,y=$=U.readFloat64(),m[UT]=y,m[xT]=Date.now(),m[BT]=zO,h.send({type:"end_txn",localTime:y,remoteNodeIds:S}),ue.trace?.("received remote sequence update",y,u);break}let J=U.position,k=wt(A,J,J+W),he=Vm[k.tableId];he||ue.error?.(`No table found with an id of ${k.tableId}`);let de;k.residencyId&&(de=WA[k.residencyId],ue.trace?.(s,"received residency list",de,k.type,k.recordId));let _e=k.recordId;try{Cg(()=>{D={table:he.name,id:k.recordId,type:k.type,nodeId:Gr.get(k.nodeId),residencyList:de,timestamp:k.version,value:k.getValue(he),user:k.user,beginTxn:N,expiresAt:k.expiresAt}},f?.rootStore,re=>oc(re,_e))}catch(re){throw re.message+=" record id: "+_e,re.message+=" typed structures for current decoder"+JSON.stringify(he.decoder.typedStructs),re.message+=" structures for current decoder"+JSON.stringify(he.decoder.structures),re}N=!1,ue.debug?.(s,"received replication message",k.type,"id",D.id,"version",new Date(k.version),"nodeId",D.nodeId),m[UT]=k.version,m[xT]=Date.now(),m[BT]=dK,h.send(D),U.position=J+W}while(U.position<A.byteLength);qs++,u!=="system"&&We(A.byteLength,"bytes-received",`${_}.${u}.${D?.table||"unknown_table"}`,"replication","ingest"),qs>ad&&!Wm&&(Wm=!0,e.pause(),ue.debug?.(`Commit backlog causing replication back-pressure, requesting that ${_} pause replication`)),h.send({type:"end_txn",localTime:y,remoteNodeIds:S,async onCommit(){if(D){let W=Date.now()-D.timestamp;u!=="system"&&We(W,"replication-latency",_+"."+u+"."+D.table,D.type,"ingest")}qs--,Wm&&(Wm=!1,e.resume(),ue.debug?.(`Replication resuming ${_}`)),Ke.length>0&&await Promise.all(Ke),ue.trace?.("All blobs finished"),!w&&$&&(ue.trace?.(s,"queuing confirmation of a commit at",$),setTimeout(()=>{e.send((0,lt.encode)([J1,w])),ue.trace?.(s,"sent confirmation of a commit at",w),w=null},Cfe)),w=$,ue.debug?.("last sequence committed",new Date($),u)}})}catch(U){ue.error?.(s,"Error handling incoming replication message",U)}}a(jm,"onWSMessage"),e.on("ping",or),e.on("pong",()=>{if(t.connection){let A=performance.now()-X;t.connection.latency=A,Gs()&&(m[FT]=A),t.isSubscriptionConnection&&iu({name:_,database:u,url:t.url,latency:A})}X=null}),e.on("close",(A,U)=>{clearInterval(I),clearTimeout(G),clearInterval(F),Hn&&Hn.emit("close"),Zo&&Zo.end();for(let[N,{reject:D}]of R)D(new Error(`Connection closed ${U?.toString()} ${A}`));ue.debug?.(s,"closed",A,U?.toString())});function qr(A,U){try{e.isFinished=!0,ue.debug?.(s,"closing",_,u,A,U),e.close(A,U),t.connection?.emit("finished")}catch(N){ue.error?.(s,"Error closing connection",N)}}a(qr,"close");let ld=new Set;async function ic(A,U){let N=wg(A);if(ld.has(N)){ue.debug?.("Blob already being sent",N);return}ld.add(N);try{let D;$e++;for await(let $ of A.stream())D&&(ue.debug?.("Sending blob chunk",N,"length",D.length),e.send((0,lt.encode)([vT,{fileId:N,size:A.size},D]))),D=$,e._socket.writableNeedDrain&&(ue.debug?.("draining",N),await new Promise(W=>e._socket.once("drain",W)),ue.debug?.("drained",N)),We($.length,"bytes-sent",`${_}.${u}`,"replication","blob");ue.debug?.("Sending final blob chunk",N,"length",D.length),e.send((0,lt.encode)([vT,{fileId:N,size:A.size,finished:!0},D]))}catch(D){ue.warn?.("Error sending blob",D,"blob id",N,"for record",U),e.send((0,lt.encode)([vT,{fileId:N,finished:!0,error:VO(D)},Buffer.alloc(0)]))}finally{ld.delete(N),$e--,$e<to&&Cr?.()}}a(ic,"sendBlobs");function oc(A,U){let N=wg(A),D=Ne.get(N);ue.debug?.("Received transaction with blob",N,"has stream",!!D,"ended",!!D?.writableEnded),D?D.writableEnded&&Ne.delete(N):(D=new WO.PassThrough,Ne.set(N,D)),D.connectedToBlob=!0,D.lastChunk=Date.now(),D.recordId=U,A.size===void 0&&D.expectedSize&&(A.size=D.expectedSize);let $=D.blob??createBlob(D,A);D.blob=$;let W=na(()=>_p($).saving,h.auditStore?.rootStore);return W&&(W.blobId=N,Ke.push(W),W.finally(()=>{ue.debug?.(`Finished receiving blob stream ${N}`),Ke.splice(Ke.indexOf(W),1)})),$}a(oc,"receiveBlobs");function zm(){if(p||(p=!0,t.connection?.on("subscriptions-updated",zm)),!f&&h&&(f=h.auditStore),t.connection?.isFinished)throw new Error("Can not make a subscription request on a connection that is already closed");let A=new Map;f||(f=h?.auditStore);try{for(let D of h?.dbisDB?.getRange({start:Symbol.for("seq"),end:[Symbol.for("seq"),Buffer.from([255])]})||[])for(let $ of D.value.nodes||[])$.lastTxnTime>(A.get($.id)??0)&&A.set($.id,$.lastTxnTime)}catch(D){if(!D.message.includes("Can not re"))throw D}let U=t.connection?.nodeSubscriptions?.[0];S=[];let N=t.connection?.nodeSubscriptions.map((D,$)=>{let W=[],{replicateByDefault:J}=D;if(D.subscriptions){for(let _e of D.subscriptions)if(_e.subscribe&&(_e.schema||_e.database)===u){let re=_e.table;E?.[re]?.replicate!==!1&&W.push(re)}J=!1}else for(let _e in E)(J?E[_e].replicate===!1:E[_e].replicate)&&W.push(_e);let k=f&&RT(D.name,f),he=h?.dbisDB?.get([Symbol.for("seq"),k])??1,de=Math.max(he?.seqId??1,(typeof D.startTime=="string"?new Date(D.startTime).getTime():D.startTime)??1);if(ue.debug?.("Starting time recorded in db",D.name,k,u,he?.seqId,"start time:",de,new Date(de)),U!==D){let _e=f&&RT(U.name,f),re=h?.dbisDB?.get([Symbol.for("seq"),_e])??1;for(let oe of re?.nodes||[])oe.name===D.name&&(de=oe.seqId,ue.debug?.("Using sequence id from proxy node",U.name,de))}return k===void 0?ue.warn("Starting subscription request from node",D,"but no node id found"):S.push(k),A.get(k)>de&&(de=A.get(k),ue.debug?.("Updating start time from more recent txn recorded",U.name,de)),de===1&&(D.isLeader?(ue.warn?.(`Requesting full copy of database ${u} from ${D.url}`),de=0):de=Date.now()-6e4),ue.trace?.(s,"defining subscription request",D.name,u,new Date(de)),{name:D.name,replicateByDefault:J,tables:W,startTime:de,isLeader:D.isLeader,endTime:D.endTime}});if(N)if(ue.debug?.(s,"sending subscription request",N,h?.dbisDB?.path),clearTimeout(Y),N.length>0)e.send((0,lt.encode)([V1,N]));else{let D=a(()=>{let $=performance.now();Y=setTimeout(()=>{le<=$?qr(1008,"Connection has no subscriptions and is no longer used"):D()},z).unref()},"scheduleClose");D()}}a(zm,"sendSubscriptionRequestUpdate");function z_(A,U){if(!A)return;let N=ve[A];return N||(N=U.getResidencyRecord(A),ve[A]=N),N}a(z_,"getResidence");function ac(A){return!(Uc&&Uc!="*"&&!Uc[A]&&!Uc.includes?.(A)&&!Uc.some?.(U=>U.name===A))}a(ac,"checkDatabaseAccess");function Rl(A){if(h=h||d.get(A),!ac(A))throw new Error(`Access to database "${A}" is not permitted`);h||ue.warn?.(`No database named "${A}" was declared and registered`),f=h?.auditStore,E||(E=dt()?.[A]);let U=st();if(U===_)throw U?new Error("Should not connect to self",U):new Error("Node name not defined");return ud(U,A),!0}a(Rl,"setDatabase");function ud(A,U){let N=dt()?.[U],D=[];for(let $ in N){let W=N[$];D.push({table:$,schemaDefined:W.schemaDefined,attributes:W.attributes.map(J=>({name:J.name,type:J.type,isPrimaryKey:J.isPrimaryKey}))})}ue.trace?.("Sending database info for node",A,"database name",U),e.send((0,lt.encode)([K1,A,U,D]))}a(ud,"sendNodeDBName");function K(A){let U=dt()?.[A],N=[];for(let D in U){if(gn&&!gn.some(W=>W.replicateByDefault?!W.tables.includes(D):W.tables.includes(D)))continue;let $=U[D];N.push({table:D,schemaDefined:$.schemaDefined,attributes:$.attributes.map(W=>({name:W.name,type:W.type,isPrimaryKey:W.isPrimaryKey}))})}e.send((0,lt.encode)([Q1,N,A]))}a(K,"sendDBSchema"),F=setInterval(()=>{for(let[A,U]of Ne)U.lastChunk+Se<Date.now()&&(ue.warn?.(`Timeout waiting for blob stream to finish ${A} for record ${U.recordId??"unknown"} from ${_}`),Ne.delete(A),U.end())},Se).unref();let g=1,T=[];return{end(){Zo&&Zo.end(),Hn&&Hn.emit("close")},getRecord(A){let U=g++;return new Promise((N,D)=>{let $=[j1,U,A.table.tableId,A.id];T[A.table.tableId]||($.push(A.table.tableName),T[A.table.tableId]=!0),e.send((0,lt.encode)($)),le=performance.now(),R.set(U,{tableId:A.table.tableId,key:A.id,resolve(W){let{table:J,entry:k}=A;if(N(W),W)return J._recordRelocate(k,W)},reject:D})})},sendOperation(A){let U=g++;return A.requestId=U,e.send((0,lt.encode)([jO,A])),new Promise((N,D)=>{R.set(U,{resolve:N,reject:D})})}};function C(A){B(5),A<128?o[c++]=A:A<16384?(l.setUint16(c,A|32768),c+=2):A<1056964608?(l.setUint32(c,A|3221225472),c+=4):(o[c]=255,l.setUint32(c+1,A),c+=5)}function P(A,U=0,N=A.length){let D=N-U;B(D),A.copy(o,c,U,N),c+=D}function O(A){B(8),l.setFloat64(c,A),c+=8}function B(A){if(A+16>o.length-c){let U=Buffer.allocUnsafeSlow(c+A-i+65536>>10<<11);o.copy(U,0,i,c),c=c-i,i=0,o=U,l=new DataView(o.buffer,0,o.length)}}function v(A,U){let N=A.database??"data";U||(U={});let D=U.schemaDefined,$=!1,W=A.schemaDefined,J=U.attributes||[];for(let k=0;k<A.attributes?.length;k++){let he=A.attributes[k],de=J.find(_e=>_e.name===he.name);(!de||de.type!==he.type)&&(D?ue.error?.(`Schema for '${u}.${A.table}' is defined locally, but attribute '${he.name}: ${he.type}' from '${_}' does not match local attribute ${de?"'"+de.name+": "+de.type+"'":"which does not exist"}`):($=!0,W||(he.indexed=!0),de?J[J.indexOf(de)]=he:J.push(he)))}return $?(ue.debug?.("(Re)creating",A),je({table:A.table,database:A.database,schemaDefined:A.schemaDefined,attributes:J,...U})):U}}var tK,lt,rK,nK,sK,JO,iK,oK,QO,aK,WO,cK,Nfe,VO,ue,V1,K1,Y1,qh,W1,KO,j1,LT,jO,DT,z1,J1,Q1,vT,lK,UT,xT,$h,FT,BT,uK,zO,dK,XO,xc,MT,X1,Cfe,Z1,YO,gf,eK,Sf,ZO=se(()=>{Ce();io();wO();PO();Zn();tK=b(ce());H();Dl();lt=require("msgpackr"),rK=require("ws"),nK=require("worker_threads"),sK=b(Q());Fh();JO=require("events"),iK=b(Cn()),oK=b(require("node:tls"));mf();QO=b(require("node:process")),aK=require("node:net");ws();hs();WO=require("node:stream"),cK=require("lmdb"),{forComponent:Nfe,errorToString:VO}=sK.default,ue=Nfe("replication").conditional,V1=129,K1=140,Y1=141,qh=142,W1=130,KO=132,j1=133,LT=134,jO=136,DT=137,z1=143,J1=144,Q1=145,vT=146,lK=0,UT=1,xT=2,$h=3,FT=4,BT=5,uK=6,zO=0,dK=1,XO=new Map,xc=new Map,MT=!0,X1=300,Cfe=2,Z1=3e4;a(HT,"createWebSocket");eK=500,Sf=class extends JO.EventEmitter{static{a(this,"NodeReplicationConnection")}socket;startTime;retryTime=eK;retries=0;isConnected=!0;isFinished=!1;nodeSubscriptions;latency=0;replicateTablesByDefault;session;sessionResolve;sessionReject;url;subscription;databaseName;nodeName;authorization;constructor(t,r,n,s,i){super(),this.url=t,this.subscription=r,this.databaseName=n,this.authorization=i,this.nodeName=this.nodeName??Ui(t)}async connect(){this.session||this.resetSession();let t=[];this.socket=await HT(this.url,{serverName:this.nodeName,authorization:this.authorization});let r;ue.debug?.(`Connecting to ${this.url}, db: ${this.databaseName}, process ${QO.pid}`),this.socket.on("open",()=>{this.socket._socket.unref(),ue[this.isConnected?"info":"warn"]?.(`Connected to ${this.url}, db: ${this.databaseName}`),this.retries=0,this.retryTime=eK,this.nodeSubscriptions&&iu({name:this.nodeName,database:this.databaseName,url:this.url}),this.isConnected=!0,r=Vh(this.socket,{database:this.databaseName,subscription:this.subscription,url:this.url,connection:this,isSubscriptionConnection:this.nodeSubscriptions!==void 0},{replicates:!0}),this.sessionResolve(r)}),this.socket.on("error",n=>{n.code==="SELF_SIGNED_CERT_IN_CHAIN"?(ue.warn?.(`Can not connect to ${this.url}, this server does not have a certificate authority for the certificate provided by ${this.url}`),n.isHandled=!0):n.code!=="ECONNREFUSED"&&(n.code==="UNABLE_TO_VERIFY_LEAF_SIGNATURE"?ue.error?.(`Can not connect to ${this.url}, the certificate provided by ${this.url} is not trusted, this node needs to be added to the cluster, or a certificate authority needs to be added`):ue.error?.(`Error in connection to ${this.url} due to ${n.message}`)),this.sessionReject(n)}),this.socket.on("close",(n,s)=>{if(this.isConnected&&(this.nodeSubscriptions&&hf({name:this.nodeName,database:this.databaseName,url:this.url,finished:this.socket.isFinished}),this.isConnected=!1),this.removeAllListeners("subscriptions-updated"),this.socket.isFinished){this.isFinished=!0,r?.end(),this.emit("finished");return}if(++this.retries%20===1){let i=s?.toString();ue.warn?.(`${r?"Disconnected from":"Failed to connect to"} ${this.url} (db: "${this.databaseName}"), due to ${i?'"'+i+'" ':""}(code: ${n})`)}r=null,this.resetSession(),setTimeout(()=>{this.connect()},this.retryTime).unref(),this.retryTime+=this.retryTime>>8})}resetSession(){this.session=new Promise((t,r)=>{this.sessionResolve=t,this.sessionReject=r})}subscribe(t,r){this.nodeSubscriptions=t,this.replicateTablesByDefault=r,this.emit("subscriptions-updated",t)}unsubscribe(){this.socket.isFinished=!0,this.socket.close(1008,"No longer subscribed")}getRecord(t){return this.session.then(r=>r.getRecord(t))}};a(Vh,"replicateOverWS")});function Bc(e,t){let r=e.toString("base64"),n=[`-----BEGIN ${t}-----`];for(let s=0;s<r.length;s+=64)n.push(r.substring(s,s+64));return n.push(`-----END ${t}-----`),n.join(`
+`+ou.get(_.issuer)),!h||!E)throw new Error("Missing private key or certificate for secure server");let R={ciphers:f.ciphers,ticketKeys:ffe(),availableCAs:ou,ca:t&&Array.from(ou.values()),cert:E,key:h,key_file:f.private_key_name,is_self_signed:f.is_self_signed};o&&(R.sessionIdContext=o.sessionIdContext);let S=f.hostnames??$O(_);Array.isArray(S)||(S=[S]);for(let I of S)I===MO()&&(p+=1);let y=NT.createSecureContext(R);y.name=f.name,y.options=R,y.quality=p,y.certificateAuthorities=Array.from(ou),y.certStart=E.toString().slice(0,100);let w;for(let I of S)if(I){I[0]==="*"&&(s=!0,I=I.slice(1)),C1.isIP(I)&&(w=!0);let G=r.get(I)?.quality??0;Xe.trace?.("Assigning TLS for hostname",I,"if",p,">",G),p>G&&r.set(I,y)}else Xe.error?.("No hostname found for certificate at",NT.certificate);Xe.trace?.("Adding TLS",y.name,"for",o.ports||"client","cert named",f.name,"hostnames",S,"quality",p,"best quality",d),p>d&&(i.defaultContext=n=y,d=p,o&&(o.defaultContext=y))}catch(m){Xe.error?.("Error applying TLS for",f.name,m)}o?.secureContextsListeners.forEach(f=>f()),c(n)}catch(d){l(d)}}a(u,"updateTLS"),wT?.system.hdb_certificate.subscribe({listener:a(()=>setTimeout(()=>u(),1500).unref(),"listener"),omitCurrent:!0}),u()})),i;function i(o,c){Xe.info?.("TLS requested for",o||"(no SNI)");let l=o;for(;;){let d=r.get(l);if(d)return Xe.debug?.("Found certificate for",o,d.certStart),d.updatedContext&&(d=d.updatedContext),c(null,d);if(s&&l){let f=l.indexOf(".",1);f<0?l="":l=l.slice(f)}else break}o?Xe.debug?.("No certificate found to match",o,"using the default certificate"):Xe.debug?.("No SNI, using the default certificate",n?.name);let u=n;u?u.updatedContext&&(u=u.updatedContext):Xe.info?.("No default certificate found"),c(null,u)}a(i,"SNICallback")}a(G1,"createTLSSelector");async function q1(e){let t=vc.get(e);return!t&&e?await es.readFile(yr.join(Ns.get(au.ROOTPATH),Qs.LICENSE_KEY_DIR_NAME,e),"utf8"):t}a(q1,"getPrivateKeyByName");async function $1(){Mc();let e=[];for await(let t of un.search([]))e.push(t);return e}a($1,"listCertificates");async function Rfe(e){let t=xO(e,xi.object({name:xi.string().required(),certificate:xi.string().required(),is_authority:xi.boolean().required(),private_key:xi.string(),hosts:xi.array(),uses:xi.array()}));if(t)throw new Dc(t.message);let{name:r,certificate:n,private_key:s,is_authority:i}=e,o=new Sa(n),c=!1,l=!1,u;for(let[p,h]of vc)!s&&!c&&o.checkPrivateKey(O1(h))&&(c=!0,u=p),s&&s===h&&(l=!0,u=p);if(!i&&!s&&!c)throw new Dc("A suitable private key was not found for this certificate");let d;if(!r){try{d=qO(o)}catch(p){Xe.error?.(p)}if(d==null)throw new Dc("Error extracting certificate host name, please provide a name parameter")}let f=bfe(r??d);s&&!c&&!l&&(await es.writeFile(yr.join(Ns.getHdbBasePath(),Qs.LICENSE_KEY_DIR_NAME,f+".pem"),s),vc.set(f,s));let m={name:r??d,certificate:n,is_authority:i,hosts:e.hosts,uses:e.uses};return(!i||i&&u||i&&s)&&(m.private_key_name=u??f+".pem"),e.ciphers&&(m.ciphers=e.ciphers),await _f(m),"Successfully added certificate: "+f}a(Rfe,"addCertificate");function bfe(e){return e.replace(/[^a-z0-9\.]/gi,"-")}a(bfe,"sanitizeName");async function Afe(e){let t=xO(e,xi.object({name:xi.string().required()}));if(t)throw new Dc(t.message);let{name:r}=e;Mc();let n=await un.get(r);if(!n)throw new Dc(r+" not found");let{private_key_name:s}=n;if(s){let i=Array.from(await un.search([{attribute:"private_key_name",value:s}]));i.length===1&&i[0].name===r&&(Xe.info?.("Removing private key named",s),await es.remove(yr.join(Ns.getHdbBasePath(),Qs.LICENSE_KEY_DIR_NAME,s)))}return await un.delete(r),"Successfully removed "+r}a(Afe,"removeCertificate");function qO(e){let t=e.subject?.match(/CN=(.*)/)?.[1];return t||$O(e)[0]}a(qO,"getPrimaryHostName");function $O(e){if(e.subjectAltName)return e.subjectAltName.split(",").map(r=>{let n=r.indexOf(":");if(r=r.slice(n+1),r=r.trim(),r[0]==='"')try{r=JSON.parse(r)}catch{}return r.indexOf("=")>-1?r.match(/CN=([^,]*)/)?.[1]:r}).filter(r=>r);let t=e.subject?.match(/CN=(.*)/)?.[1];return t?[t]:[]}a($O,"hostnamesFromCert");async function Ife(e){if(e.bypass_auth!==!0)throw new Dc("Unauthorized","401");let t=xO(e,xi.object({name:xi.string().required()}));if(t)throw new Dc(t.message);let{name:r}=e;if(r===".jwtPrivate")return(await A1()).privateKey;if(r===".jwtPublic")return(await A1()).publicKey;if(vc.get(r))return vc.get(e.name);throw new Dc("Key not found")}a(Ife,"getKey");function wfe(e){return[e.subject?.CN,...e.subjectaltname.split(",").filter(t=>t.trim().startsWith("DNS:")).map(t=>t.trim().substring(4))]}a(wfe,"getHostnamesFromCertificate")});var fK={};ye(fK,{BACK_PRESSURE_RATIO_POSITION:()=>uK,CONFIRMATION_STATUS_POSITION:()=>lK,LATENCY_POSITION:()=>FT,NodeReplicationConnection:()=>Sf,OPERATION_REQUEST:()=>jO,RECEIVED_TIME_POSITION:()=>xT,RECEIVED_VERSION_POSITION:()=>UT,RECEIVING_STATUS_POSITION:()=>BT,RECEIVING_STATUS_RECEIVING:()=>dK,RECEIVING_STATUS_WAITING:()=>zO,SENDING_TIME_POSITION:()=>$h,createWebSocket:()=>HT,databaseSubscriptions:()=>xc,replicateOverWS:()=>Vh,tableUpdateListeners:()=>XO});async function HT(e,t){let{authorization:r,rejectUnauthorized:n}=t||{},s=st(),i;if(e==null)throw new TypeError(`Invalid URL: Expected a string URL for node "${s}" but received ${e}`);if(e.includes("wss://")){if(!YO){let l=(0,iK.createTLSSelector)("operations-api"),u={secureContexts:null};await l.initialize(u),YO=u.secureContexts}if(i=YO.get(s),i&&ue.debug?.("Creating web socket for URL",e,"with certificate named:",i.name),!i&&n!==!1)throw new Error("Unable to find a valid certificate to use for replication to connect to "+e)}let o={};r&&(o.Authorization=r);let c={headers:o,localAddress:s?.startsWith("127.0")?s:void 0,servername:(0,aK.isIP)(t?.serverName)?void 0:t?.serverName,noDelay:!0,highWaterMark:128*1024,rejectUnauthorized:n!==!1,secureContext:void 0};return i&&((gf?.caCount!==Ta.size||gf?.derivedFromContext!==i)&&(gf=oK.createSecureContext({...i.options,ca:[...Ta,...i.options.availableCAs.values()]}),gf.caCount=Ta.size,gf.derivedFromContext=i),c.secureContext=gf),new rK.WebSocket(e,"harperdb-replication-v1",c)}function Vh(e,t,r){let n=t.port||t.securePort,s=QO.pid%1e3+"-"+nK.threadId+(n?"s:"+n:"c:"+t.url?.slice(-4))+" "+Math.random().toString().slice(2,3);ue.debug?.(s,"Initializing replication connection",r);let i=0,o=Buffer.allocUnsafeSlow(1024),c=0,l=new DataView(o.buffer,0,1024),u=t.database,d=t.databaseSubscriptions||xc,f,m,p=!1,h=t.subscription;h?.then&&h.then(A=>{h=A,h.auditStore&&(f=h.auditStore)});let E=t.tables||u&&dt()[u],_,R=new Map,S=[];_=r.name,_&&t.connection&&(t.connection.nodeName=_);let y,w,I,G,X,q,F,z=6e4,Y,le=0,fe=0,te=0,Se=tK.default.get(x.REPLICATION_BLOBTIMEOUT)??12e4,Ne=new Map,Ke=[],$e=0,Cr;if(t.url){let A=a(()=>{X&&fe===e._socket?.bytesRead&&te===e._socket?.bytesWritten?e.terminate():(X=performance.now(),e.ping(),fe=e._socket?.bytesRead,te=e._socket?.bytesWritten)},"sendPing");I=setInterval(A,Z1).unref(),A()}else or();e._socket?.setMaxListeners(200);function or(){clearTimeout(G),fe=e._socket?.bytesRead,te=e._socket?.bytesWritten,G=setTimeout(()=>{fe===e._socket?.bytesRead&&te===e._socket?.bytesWritten&&(ue.warn?.(`Timeout waiting for ping from ${_}, terminating connection and reconnecting`),e.terminate())},Z1*2).unref()}a(or,"resetPingTimer");let en=0,Hr=0,od=!1,yl=3e4;function Ft(){if(gn?.length>0){let A=performance.now(),U=A-Hr;en=(en*yl+(od?U:0))/(yl+U),m&&(m[uK]=en),Hr=A}}a(Ft,"updateBackPressureRatio"),setInterval(Ft,yl).unref();function Gs(){if(!(!_||!u))return m||(m=df(f,u,_)),m}a(Gs,"getSharedStatus"),u&&Rl(u);let sc,Y_,Vm=[],W_=[],Km,ve=[],j_=[],WA=[],ad=150,to=25,qs=0,Ym=0,Wm=!1,Zo,Hn,gn,Gr;e.on("message",cd);async function cd(A){if(r=await r,!r){ue.error?.(s,"No authorization provided"),qr(1008,"Unauthorized");return}jm(A),e.off("message",cd),e.on("message",jm)}a(cd,"onWSMessageWhenAuthorized");function jm(A){le=performance.now();try{let U=A.dataView=new du(A.buffer,A.byteOffset,A.byteLength);if(A[0]>127){let W=(0,lt.decode)(A),[J,k,he]=W;switch(J){case K1:{if(k){if(_){if(_!==k){ue.error?.(s,`Node name mismatch, expecting to connect to ${_}, but peer reported name as ${k}, disconnecting`),e.send((0,lt.encode)([qh])),qr(1008,"Node name mismatch");return}}else if(_=k,t.connection?.tentativeNode){let me=t.connection.tentativeNode;me.name=_,t.connection.tentativeNode=null,ga(_,me)}if(t.connection&&(t.connection.nodeName=_),ue.debug?.(s,"received node name:",_,"db:",u??W[2]),!u)try{Rl(u=W[2]),u==="system"&&(sc=Pc(t,(me,ie)=>{ac(ie)&&K(ie)}),e.on("close",()=>{sc?.remove()}))}catch(me){ue.warn?.(s,"Error setting database",me),e.send((0,lt.encode)([qh])),qr(1008,me.message);return}zm()}break}case Q1:{ue.debug?.(s,"Received table definitions for",k.map(me=>me.table));for(let me of k){let ie=W[2];me.database=ie;let Oe;if(ac(ie)){if(u==="system")Me[ie]?.[me.table]||(Oe=v(me,Me[ie]?.[me.table]));else{if(ie!=="data"&&!Me[ie]){ue.warn?.("Database not found",ie);return}Oe=v(me,Me[ie]?.[me.table])}f||(f=Oe?.auditStore),E||(E=dt()?.[ie])}}break}case qh:qr();break;case jO:try{let me=r?.replicates||r?.subscribers||r?.name;ue.debug?.("Received operation request",k,"from",_),server.operation(k,{user:r},!me).then(ie=>{ue.debug?.("Requested request from finished",_,ie),Array.isArray(ie)&&(ie={results:ie}),ie.requestId=k.requestId,e.send((0,lt.encode)([DT,ie]))},ie=>{ue.debug?.("Failed requested operation from",_,ie),e.send((0,lt.encode)([DT,{requestId:k.requestId,error:VO(ie)}]))})}catch(me){e.send((0,lt.encode)([DT,{requestId:k.requestId,error:VO(me)}]))}break;case DT:let{resolve:de,reject:_e}=R.get(k.requestId);ue.debug?.("Received completed operation request",_,k),k.error?_e(new Error(k.error)):de(k),R.delete(k.requestId);break;case KO:let re=W[3];if(!E){u?ue.error?.(s,"No database found for",u):ue.error?.(s,"Database name never received"),qr();return}let oe=E[re];oe=v({table:re,database:u,attributes:k.attributes,schemaDefined:k.schemaDefined},oe),Vm[he]={name:re,decoder:new lt.Packr({useBigIntExtension:!0,randomAccessStructure:!0,freezeData:!0,typedStructs:k.typedStructs,structures:k.structures}),getEntry(me){return oe.primaryStore.getEntry(me)},rootStore:oe.primaryStore.rootStore};break;case Y1:Gr=f?s1(k,f):new Map,Km=W[2],ue.debug?.(s,`Acknowledged subscription request, receiving messages for nodes: ${Km}`);break;case W1:let ge=he;WA[ge]=k;break;case J1:Gs()[lK]=k,ue.trace?.(s,"received and broadcasting committed update",k),Gs().buffer.notify();break;case z1:y=k,h.send({type:"end_txn",localTime:y,remoteNodeIds:S}),Gs(),m[UT]=last_sequence_id_received,m[xT]=Date.now(),m[BT]=zO;break;case vT:{let me=W[1],{fileId:ie,size:Oe,finished:Be,error:He}=me,Te=Ne.get(ie);ue.debug?.("Received blob",ie,"has stream",!!Te,"connectedToBlob",!!Te?.connectedToBlob,"length",W[2].length,"finished",Be),Te||(Te=new WO.PassThrough,Te.expectedSize=Oe,Ne.set(ie,Te)),Te.lastChunk=Date.now();let gt=W[2];We(gt.byteLength,"bytes-received",`${_}.${u}`,"replication","blob");try{Be?(He?(Te.on("error",()=>{}),Te.destroy(new Error("Blob error: "+He+" for record "+(Te.recordId??"unknown")+" from "+_))):Te.end(gt),Te.connectedToBlob&&Ne.delete(ie)):Te.write(gt)}catch(Pt){ue.error?.(`Error receiving blob for ${Te.recordId} from ${_} and streaming to storage`,Pt),Ne.delete(ie)}break}case j1:{let me=k,ie;try{let Oe=W[3],Be=W_[he]||(W_[he]=E[W[4]]);if(!Be)return ue.warn?.("Unknown table id trying to handle record request",he);let He=Be.primaryStore.getBinaryFast(Symbol.for("structures")),Te=He?.length??0;if(Te>0&&Te!==Ym){Ym=Te;let Pt=(0,lt.decode)(He);e.send((0,lt.encode)([KO,{typedStructs:Pt.typed,structures:Pt.named},he,Be.tableName]))}let gt=Be.primaryStore.getBinaryFast(Oe);if(gt){let Pt=Be.primaryStore.decoder.decode(gt,{valueAsBuffer:!0}),Lt=ft||{};Lt.version=(0,cK.getLastVersion)(),ft&&ft[Tf]&rn&&(Pt=Buffer.from(Pt),gp(()=>Be.primaryStore.decoder.decode(gt),J_=>ic(J_,Oe),Be.primaryStore.rootStore)),ie=(0,lt.encode)([LT,me,{value:Pt,expiresAt:Lt.expiresAt,version:Lt.version,residencyId:Lt.residencyId,nodeId:Lt.nodeId,user:Lt.user}])}else ie=(0,lt.encode)([LT,me])}catch(Oe){ie=(0,lt.encode)([LT,me,{error:Oe.message}])}e.send(ie);break}case LT:{let{resolve:me,reject:ie,tableId:Oe,key:Be}=R.get(W[1]),He=W[2];if(He?.error)ie(new Error(He.error));else if(He){let Te;Cg(()=>{let gt=Vm[Oe].decoder.decode(He.value);He.value=gt,He.key=Be,me(He)||Te&&setTimeout(()=>Te.forEach(Ig),6e4).unref()},f?.rootStore,gt=>{let Pt=oc(gt,Be);return Te||(Te=[]),Te.push(Pt),Pt})}else me();R.delete(W[1]);break}case V1:{gn=k;let me,ie,Oe=!1;if(h){if(u!==h.databaseName&&!h.then){ue.error?.("Subscription request for wrong database",u,h.databaseName);return}}else h=d.get(u);if(ue.debug?.(s,"received subscription request for",u,"at",gn),!h){let De;h=new Promise(pt=>{ue.debug?.("Waiting for subscription to database "+u),De=pt}),h.ready=De,xc.set(u,h)}if(r.name)ie=Gt().subscribe(r.name),ie.then(async De=>{me=De;for await(let pt of me){let $r=pt.value;if(!($r?.replicates===!0||$r?.replicates?.receives||$r?.subscriptions?.some(Er=>(Er.database||Er.schema)===u&&Er.publish!==!1))){Oe=!0,qr(1008,`Unauthorized database subscription to ${u}`);return}}},De=>{ue.error?.(s,"Error subscribing to HDB nodes",De)});else if(!(r?.role?.permission?.super_user||r.replicates)){e.send((0,lt.encode)([qh])),qr(1008,`Unauthorized database subscription to ${u}`);return}if(Hn&&(ue.debug?.(s,"stopping previous subscription",u),Hn.emit("close")),gn.length===0)return;let Be=gn[0],He=a(De=>{if(De&&(Be.replicateByDefault?!Be.tables.includes(De.tableName):Be.tables.includes(De.tableName)))return{table:De}},"tableToTableEntry"),Te={txnTime:0},gt,Pt,Lt=1/0,J_,Q_=a((De,pt)=>{if(De.type==="end_txn"){Te.txnTime&&(o[i]!==66&&ue.error?.("Invalid encoding of message"),C(9),C(kT),O(J_=pt),fx()),i=c,Te.txnTime=0;return}let $r=De.nodeId,Er=De.tableId,Qt=Pt[Er];if(!Qt&&(Qt=Pt[Er]=He(h.tableById[Er]),!Qt))return ue.debug?.("Not subscribed to table",Er);let bt=Qt.table,dd=bt.primaryStore,gi=dd.encoder;(De.extendedType&qT||!gi.typedStructs)&&(gi._mergeStructures(gi.getStructures()),gi.typedStructs&&(gi.lastTypedStructuresLength=gi.typedStructs.length));let X_=gt[$r];if(!(X_&&X_.startTime<pt&&(!X_.endTime||X_.endTime>pt)))return MT&&ue.trace?.(s,"skipping replication update",De.recordId,"to:",_,"from:",$r,"subscribed:",gt),mx();MT&&ue.trace?.(s,"sending replication update",De.recordId,"to:",_,"from:",$r,"subscribed:",gt);let jA=De.version,bl=De.residencyId,zA=z_(bl,bt),Z_;if(zA&&!zA.includes(_)){let ro=z_(De.previousResidencyId,bt);if(ro&&!ro.includes(_)&&(De.type==="put"||De.type==="patch")||bt.getResidencyById)return mx();let Al=De.recordId;ue.trace?.(s,"sending invalidation",Al,_,"from",$r);let Jm=0;bl&&(Jm|=lu),De.previousResidencyId&&(Jm|=uu);let XA,eg=null;for(let px in bt.indices){if(!eg){if(XA=De.getValue(dd,!0),!XA)break;eg={}}eg[px]=XA[px]}Z_=cu(De.version,Er,Al,null,$r,De.user,De.type==="put"||De.type==="patch"?"invalidate":De.type,gi.encode(eg),Jm,bl,De.previousResidencyId,De.expiresAt)}function mx(){return ue.trace?.(s,"skipping audit record",De.recordId),q||(q=setTimeout(()=>{q=null,(J_||0)+X1/2<Lt&&(MT&&ue.trace?.(s,"sending skipped sequence update",Lt),e.send((0,lt.encode)([z1,Lt])))},X1).unref()),new Promise(setImmediate)}a(mx,"skipAuditRecord");let JA=gi.typedStructs,QA=gi.structures;if((JA?.length!=Qt.typed_length||QA?.length!=Qt.structure_length)&&(Qt.typed_length=JA?.length,Qt.structure_length=QA.length,ue.debug?.(s,"send table struct",Qt.typed_length,Qt.structure_length),Qt.sentName||(Qt.sentName=!0),e.send((0,lt.encode)([KO,{typedStructs:JA,structures:QA,attributes:bt.attributes,schemaDefined:bt.schemaDefined},Er,Qt.table.tableName]))),bl&&!j_[bl]&&(e.send((0,lt.encode)([W1,zA,bl])),j_[bl]=!0),Te.txnTime!==jA&&(Te.txnTime&&(MT&&ue.trace?.(s,"new txn time, sending queued txn",Te.txnTime),o[i]!==66&&ue.error?.("Invalid encoding of message"),fx()),Te.txnTime=jA,i=c,O(jA)),Z_)C(Z_.length),P(Z_);else{let ro=De.encoded;De.extendedType&rn&&gp(()=>De.getValue(dd),Jm=>ic(Jm,De.recordId),dd.rootStore);let Al=ro[0]===66?8:0;C(ro.length-Al),P(ro,Al),ue.trace?.("wrote record",De.recordId,"length:",ro.length)}if(e._socket.writableNeedDrain){let ro=performance.now();return od=!0,Ft(),new Promise(Al=>{ue.debug?.(`Waiting for remote node ${_} to allow more commits ${e._socket.writableNeedDrain?"due to network backlog":"due to requested flow directive"}`),e._socket.once("drain",()=>{Al(),od=!1,Ft()})})}else return $e>to?new Promise(ro=>{Cr=ro}):new Promise(setImmediate)},"sendAuditRecord"),fx=a(()=>{c-i>8?(e.send(o.subarray(i,c)),ue.debug?.(s,"Sent message, size:",c-i),u!=="system"&&We(c-i,"bytes-sent",`${_}.${u}`,"replication","egress")):ue.debug?.(s,"skipping empty transaction")},"sendQueuedData");Hn=new JO.EventEmitter,Hn.once("close",()=>{Oe=!0,me?.end()});for(let{startTime:De}of gn)De<Lt&&(Lt=De);(ie||Promise.resolve()).then(async()=>{h=await h,f=h.auditStore,Pt=h.tableById.map(He),gt=[];for(let{name:pt,startTime:$r,endTime:Er}of gn){let Qt=RT(pt,f);ue.debug?.("subscription to",pt,"using local id",Qt,"starting",$r),gt[Qt]={startTime:$r,endTime:Er}}K(u),sc||(sc=fu(pt=>{pt.databaseName===u&&K(u)}),Y_=Kh(pt=>{pt===u&&(e.send((0,lt.encode)([qh])),qr())}),e.on("close",()=>{sc?.remove(),Y_?.remove()})),e.send((0,lt.encode)([Y1,vh(h.auditStore),gn.map(({name:pt})=>pt)]));let De=!0;do{if(isFinite(Lt)||(ue.warn?.("Invalid sequence id "+Lt),qr(1008,"Invalid sequence id"+Lt)),De&&!Oe&&(De=!1,Lt===0)){ue.info?.("Replicating all tables to",_);let pt=Date.now(),$r=GT(f);for(let Er in E){if(!He(Er))continue;let Qt=E[Er];for(let bt of Qt.primaryStore.getRange({snapshot:!1,versions:!0})){if(Oe)return;ue.trace?.(s,"Copying record from",u,Er,bt.key,bt.localTime),pt=Math.max(bt.localTime??1,pt),Gs()[$h]=1;let dd=cu(bt.version,Qt.tableId,bt.key,null,$r,null,"put",gp(()=>Qt.primaryStore.encoder.encode(bt.value),gi=>ic(gi,bt.key)),bt.metadataFlags&-256,bt.residencyId,null,bt.expiresAt);await Q_({recordId:bt.key,tableId:Qt.tableId,type:"put",getValue(){return bt.value},encoded:dd,version:bt.version,residencyId:bt.residencyId,nodeId:$r,extendedType:bt.metadataFlags},bt.localTime)}}Te.txnTime||(Te.txnTime=pt,O(pt)),c-i>8&&Q_({type:"end_txn"},Lt),Gs()[$h]=0,Lt=pt}for(let{key:pt,value:$r}of f.getRange({start:Lt||1,exclusiveStart:!0,snapshot:!1})){if(Oe)return;let Er=wt($r);ue.debug?.("sending audit record",pt,Er.recordId),Gs()[$h]=pt,Lt=pt,await Q_(Er,pt),Hn.startTime=pt}c-i>8&&Q_({type:"end_txn"},Lt),Gs()[$h]=0,await l1(f)}while(!Oe)}).catch(De=>{ue.error?.(s,"Error handling subscription to node",De),qr(1008,"Error handling subscription to node")});break}}return}U.position=8;let N=!0,D,$;do{Gs();let W=U.readInt();if(W===9&&U.getUint8(U.position)==kT){U.position++,y=$=U.readFloat64(),m[UT]=y,m[xT]=Date.now(),m[BT]=zO,h.send({type:"end_txn",localTime:y,remoteNodeIds:S}),ue.trace?.("received remote sequence update",y,u);break}let J=U.position,k=wt(A,J,J+W),he=Vm[k.tableId];he||ue.error?.(`No table found with an id of ${k.tableId}`);let de;k.residencyId&&(de=WA[k.residencyId],ue.trace?.(s,"received residency list",de,k.type,k.recordId));let _e=k.recordId;try{Cg(()=>{D={table:he.name,id:k.recordId,type:k.type,nodeId:Gr.get(k.nodeId),residencyList:de,timestamp:k.version,value:k.getValue(he),user:k.user,beginTxn:N,expiresAt:k.expiresAt}},f?.rootStore,re=>oc(re,_e))}catch(re){throw re.message+=" record id: "+_e,re.message+=" typed structures for current decoder"+JSON.stringify(he.decoder.typedStructs),re.message+=" structures for current decoder"+JSON.stringify(he.decoder.structures),re}N=!1,ue.debug?.(s,"received replication message",k.type,"id",D.id,"version",new Date(k.version),"nodeId",D.nodeId),m[UT]=k.version,m[xT]=Date.now(),m[BT]=dK,h.send(D),U.position=J+W}while(U.position<A.byteLength);qs++,u!=="system"&&We(A.byteLength,"bytes-received",`${_}.${u}.${D?.table||"unknown_table"}`,"replication","ingest"),qs>ad&&!Wm&&(Wm=!0,e.pause(),ue.debug?.(`Commit backlog causing replication back-pressure, requesting that ${_} pause replication`)),h.send({type:"end_txn",localTime:y,remoteNodeIds:S,async onCommit(){if(D){let W=Date.now()-D.timestamp;u!=="system"&&We(W,"replication-latency",_+"."+u+"."+D.table,D.type,"ingest")}qs--,Wm&&(Wm=!1,e.resume(),ue.debug?.(`Replication resuming ${_}`)),Ke.length>0&&await Promise.all(Ke),ue.trace?.("All blobs finished"),!w&&$&&(ue.trace?.(s,"queuing confirmation of a commit at",$),setTimeout(()=>{e.send((0,lt.encode)([J1,w])),ue.trace?.(s,"sent confirmation of a commit at",w),w=null},Cfe)),w=$,ue.debug?.("last sequence committed",new Date($),u)}})}catch(U){ue.error?.(s,"Error handling incoming replication message",U)}}a(jm,"onWSMessage"),e.on("ping",or),e.on("pong",()=>{if(t.connection){let A=performance.now()-X;t.connection.latency=A,Gs()&&(m[FT]=A),t.isSubscriptionConnection&&iu({name:_,database:u,url:t.url,latency:A})}X=null}),e.on("close",(A,U)=>{clearInterval(I),clearTimeout(G),clearInterval(F),Hn&&Hn.emit("close"),Zo&&Zo.end();for(let[N,{reject:D}]of R)D(new Error(`Connection closed ${U?.toString()} ${A}`));ue.debug?.(s,"closed",A,U?.toString())});function qr(A,U){try{e.isFinished=!0,ue.debug?.(s,"closing",_,u,A,U),e.close(A,U),t.connection?.emit("finished")}catch(N){ue.error?.(s,"Error closing connection",N)}}a(qr,"close");let ld=new Set;async function ic(A,U){let N=wg(A);if(ld.has(N)){ue.debug?.("Blob already being sent",N);return}ld.add(N);try{let D;$e++;for await(let $ of A.stream())D&&(ue.debug?.("Sending blob chunk",N,"length",D.length),e.send((0,lt.encode)([vT,{fileId:N,size:A.size},D]))),D=$,e._socket.writableNeedDrain&&(ue.debug?.("draining",N),await new Promise(W=>e._socket.once("drain",W)),ue.debug?.("drained",N)),We($.length,"bytes-sent",`${_}.${u}`,"replication","blob");ue.debug?.("Sending final blob chunk",N,"length",D.length),e.send((0,lt.encode)([vT,{fileId:N,size:A.size,finished:!0},D]))}catch(D){ue.warn?.("Error sending blob",D,"blob id",N,"for record",U),e.send((0,lt.encode)([vT,{fileId:N,finished:!0,error:VO(D)},Buffer.alloc(0)]))}finally{ld.delete(N),$e--,$e<to&&Cr?.()}}a(ic,"sendBlobs");function oc(A,U){let N=wg(A),D=Ne.get(N);ue.debug?.("Received transaction with blob",N,"has stream",!!D,"ended",!!D?.writableEnded),D?D.writableEnded&&Ne.delete(N):(D=new WO.PassThrough,Ne.set(N,D)),D.connectedToBlob=!0,D.lastChunk=Date.now(),D.recordId=U,A.size===void 0&&D.expectedSize&&(A.size=D.expectedSize);let $=D.blob??createBlob(D,A);D.blob=$;let W=na(()=>_p($).saving,h.auditStore?.rootStore);return W&&(W.blobId=N,Ke.push(W),W.finally(()=>{ue.debug?.(`Finished receiving blob stream ${N}`),Ke.splice(Ke.indexOf(W),1)})),$}a(oc,"receiveBlobs");function zm(){if(p||(p=!0,t.connection?.on("subscriptions-updated",zm)),!f&&h&&(f=h.auditStore),t.connection?.isFinished)throw new Error("Can not make a subscription request on a connection that is already closed");let A=new Map;f||(f=h?.auditStore);try{for(let D of h?.dbisDB?.getRange({start:Symbol.for("seq"),end:[Symbol.for("seq"),Buffer.from([255])]})||[])for(let $ of D.value.nodes||[])$.lastTxnTime>(A.get($.id)??0)&&A.set($.id,$.lastTxnTime)}catch(D){if(!D.message.includes("Can not re"))throw D}let U=t.connection?.nodeSubscriptions?.[0];S=[];let N=t.connection?.nodeSubscriptions.map((D,$)=>{let W=[],{replicateByDefault:J}=D;if(D.subscriptions){for(let _e of D.subscriptions)if(_e.subscribe&&(_e.schema||_e.database)===u){let re=_e.table;E?.[re]?.replicate!==!1&&W.push(re)}J=!1}else for(let _e in E)(J?E[_e].replicate===!1:E[_e].replicate)&&W.push(_e);let k=f&&RT(D.name,f),he=h?.dbisDB?.get([Symbol.for("seq"),k])??1,de=Math.max(he?.seqId??1,(typeof D.startTime=="string"?new Date(D.startTime).getTime():D.startTime)??1);if(ue.debug?.("Starting time recorded in db",D.name,k,u,he?.seqId,"start time:",de,new Date(de)),U!==D){let _e=f&&RT(U.name,f),re=h?.dbisDB?.get([Symbol.for("seq"),_e])??1;for(let oe of re?.nodes||[])oe.name===D.name&&(de=oe.seqId,ue.debug?.("Using sequence id from proxy node",U.name,de))}return k===void 0?ue.warn("Starting subscription request from node",D,"but no node id found"):S.push(k),A.get(k)>de&&(de=A.get(k),ue.debug?.("Updating start time from more recent txn recorded",U.name,de)),de===1&&(D.isLeader?(ue.warn?.(`Requesting full copy of database ${u} from ${D.url}`),de=0):de=Date.now()-6e4),ue.trace?.(s,"defining subscription request",D.name,u,new Date(de)),{name:D.name,replicateByDefault:J,tables:W,startTime:de,isLeader:D.isLeader,endTime:D.endTime}});if(N)if(ue.debug?.(s,"sending subscription request",N,h?.dbisDB?.path),clearTimeout(Y),N.length>0)e.send((0,lt.encode)([V1,N]));else{let D=a(()=>{let $=performance.now();Y=setTimeout(()=>{le<=$?qr(1008,"Connection has no subscriptions and is no longer used"):D()},z).unref()},"scheduleClose");D()}}a(zm,"sendSubscriptionRequestUpdate");function z_(A,U){if(!A)return;let N=ve[A];return N||(N=U.getResidencyRecord(A),ve[A]=N),N}a(z_,"getResidence");function ac(A){return!(Uc&&Uc!="*"&&!Uc[A]&&!Uc.includes?.(A)&&!Uc.some?.(U=>U.name===A))}a(ac,"checkDatabaseAccess");function Rl(A){if(h=h||d.get(A),!ac(A))throw new Error(`Access to database "${A}" is not permitted`);h||ue.warn?.(`No database named "${A}" was declared and registered`),f=h?.auditStore,E||(E=dt()?.[A]);let U=st();if(U===_)throw U?new Error("Should not connect to self",U):new Error("Node name not defined");return ud(U,A),!0}a(Rl,"setDatabase");function ud(A,U){let N=dt()?.[U],D=[];for(let $ in N){let W=N[$];D.push({table:$,schemaDefined:W.schemaDefined,attributes:W.attributes.map(J=>({name:J.name,type:J.type,isPrimaryKey:J.isPrimaryKey}))})}ue.trace?.("Sending database info for node",A,"database name",U),e.send((0,lt.encode)([K1,A,U,D]))}a(ud,"sendNodeDBName");function K(A){let U=dt()?.[A],N=[];for(let D in U){if(gn&&!gn.some(W=>W.replicateByDefault?!W.tables.includes(D):W.tables.includes(D)))continue;let $=U[D];N.push({table:D,schemaDefined:$.schemaDefined,attributes:$.attributes.map(W=>({name:W.name,type:W.type,isPrimaryKey:W.isPrimaryKey}))})}e.send((0,lt.encode)([Q1,N,A]))}a(K,"sendDBSchema"),F=setInterval(()=>{for(let[A,U]of Ne)U.lastChunk+Se<Date.now()&&(ue.warn?.(`Timeout waiting for blob stream to finish ${A} for record ${U.recordId??"unknown"} from ${_}`),Ne.delete(A),U.end())},Se).unref();let g=1,T=[];return{end(){Zo&&Zo.end(),Hn&&Hn.emit("close")},getRecord(A){let U=g++;return new Promise((N,D)=>{let $=[j1,U,A.table.tableId,A.id];T[A.table.tableId]||($.push(A.table.tableName),T[A.table.tableId]=!0),e.send((0,lt.encode)($)),le=performance.now(),R.set(U,{tableId:A.table.tableId,key:A.id,resolve(W){let{table:J,entry:k}=A;if(N(W),W)return J._recordRelocate(k,W)},reject:D})})},sendOperation(A){let U=g++;return A.requestId=U,e.send((0,lt.encode)([jO,A])),new Promise((N,D)=>{R.set(U,{resolve:N,reject:D})})}};function C(A){B(5),A<128?o[c++]=A:A<16384?(l.setUint16(c,A|32768),c+=2):A<1056964608?(l.setUint32(c,A|3221225472),c+=4):(o[c]=255,l.setUint32(c+1,A),c+=5)}function P(A,U=0,N=A.length){let D=N-U;B(D),A.copy(o,c,U,N),c+=D}function O(A){B(8),l.setFloat64(c,A),c+=8}function B(A){if(A+16>o.length-c){let U=Buffer.allocUnsafeSlow(c+A-i+65536>>10<<11);o.copy(U,0,i,c),c=c-i,i=0,o=U,l=new DataView(o.buffer,0,o.length)}}function v(A,U){let N=A.database??"data";U||(U={});let D=U.schemaDefined,$=!1,W=A.schemaDefined,J=U.attributes||[];for(let k=0;k<A.attributes?.length;k++){let he=A.attributes[k],de=J.find(_e=>_e.name===he.name);(!de||de.type!==he.type)&&(D?ue.error?.(`Schema for '${u}.${A.table}' is defined locally, but attribute '${he.name}: ${he.type}' from '${_}' does not match local attribute ${de?"'"+de.name+": "+de.type+"'":"which does not exist"}`):($=!0,W||(he.indexed=!0),de?J[J.indexOf(de)]=he:J.push(he)))}return $?(ue.debug?.("(Re)creating",A),je({table:A.table,database:A.database,schemaDefined:A.schemaDefined,attributes:J,...U})):U}}var tK,lt,rK,nK,sK,JO,iK,oK,QO,aK,WO,cK,Nfe,VO,ue,V1,K1,Y1,qh,W1,KO,j1,LT,jO,DT,z1,J1,Q1,vT,lK,UT,xT,$h,FT,BT,uK,zO,dK,XO,xc,MT,X1,Cfe,Z1,YO,gf,eK,Sf,ZO=se(()=>{Ce();io();wO();PO();Zn();tK=b(ce());H();Dl();lt=require("msgpackr"),rK=require("ws"),nK=require("worker_threads"),sK=b(Q());Fh();JO=require("events"),iK=b(Cn()),oK=b(require("node:tls"));mf();QO=b(require("node:process")),aK=require("node:net");ws();hs();WO=require("node:stream"),cK=require("lmdb"),{forComponent:Nfe,errorToString:VO}=sK.default,ue=Nfe("replication").conditional,V1=129,K1=140,Y1=141,qh=142,W1=130,KO=132,j1=133,LT=134,jO=136,DT=137,z1=143,J1=144,Q1=145,vT=146,lK=0,UT=1,xT=2,$h=3,FT=4,BT=5,uK=6,zO=0,dK=1,XO=new Map,xc=new Map,MT=!0,X1=300,Cfe=2,Z1=3e4;a(HT,"createWebSocket");eK=500,Sf=class extends JO.EventEmitter{static{a(this,"NodeReplicationConnection")}socket;startTime;retryTime=eK;retries=0;isConnected=!0;isFinished=!1;nodeSubscriptions;latency=0;replicateTablesByDefault;session;sessionResolve;sessionReject;url;subscription;databaseName;nodeName;authorization;constructor(t,r,n,s,i){super(),this.url=t,this.subscription=r,this.databaseName=n,this.authorization=i,this.nodeName=this.nodeName??Ui(t)}async connect(){this.session||this.resetSession();let t=[];this.socket=await HT(this.url,{serverName:this.nodeName,authorization:this.authorization});let r;ue.debug?.(`Connecting to ${this.url}, db: ${this.databaseName}, process ${QO.pid}`),this.socket.on("open",()=>{this.socket._socket.unref(),ue[this.isConnected?"info":"warn"]?.(`Connected to ${this.url}, db: ${this.databaseName}`),this.retries=0,this.retryTime=eK,this.nodeSubscriptions&&iu({name:this.nodeName,database:this.databaseName,url:this.url}),this.isConnected=!0,r=Vh(this.socket,{database:this.databaseName,subscription:this.subscription,url:this.url,connection:this,isSubscriptionConnection:this.nodeSubscriptions!==void 0},{replicates:!0}),this.sessionResolve(r)}),this.socket.on("error",n=>{n.code==="SELF_SIGNED_CERT_IN_CHAIN"?(ue.warn?.(`Can not connect to ${this.url}, this server does not have a certificate authority for the certificate provided by ${this.url}`),n.isHandled=!0):n.code!=="ECONNREFUSED"&&(n.code==="UNABLE_TO_VERIFY_LEAF_SIGNATURE"?ue.error?.(`Can not connect to ${this.url}, the certificate provided by ${this.url} is not trusted, this node needs to be added to the cluster, or a certificate authority needs to be added`):ue.error?.(`Error in connection to ${this.url} due to ${n.message}`)),this.sessionReject(n)}),this.socket.on("close",(n,s)=>{if(this.isConnected&&(this.nodeSubscriptions&&hf({name:this.nodeName,database:this.databaseName,url:this.url,finished:this.socket.isFinished}),this.isConnected=!1),this.removeAllListeners("subscriptions-updated"),this.socket.isFinished){this.isFinished=!0,r?.end(),this.emit("finished");return}if(++this.retries%20===1){let i=s?.toString();ue.warn?.(`${r?"Disconnected from":"Failed to connect to"} ${this.url} (db: "${this.databaseName}"), due to ${i?'"'+i+'" ':""}(code: ${n})`)}r=null,this.resetSession(),setTimeout(()=>{this.connect()},this.retryTime).unref(),this.retryTime+=this.retryTime>>8})}resetSession(){this.session=new Promise((t,r)=>{this.sessionResolve=t,this.sessionReject=r})}subscribe(t,r){this.nodeSubscriptions=t,this.replicateTablesByDefault=r,this.emit("subscriptions-updated",t)}unsubscribe(){this.socket.isFinished=!0,this.socket.close(1008,"No longer subscribed")}getRecord(t){return this.session.then(r=>r.getRecord(t))}};a(Vh,"replicateOverWS")});function Bc(e,t){let r=e.toString("base64"),n=[`-----BEGIN ${t}-----`];for(let s=0;s<r.length;s+=64)n.push(r.substring(s,s+64));return n.push(`-----END ${t}-----`),n.join(`
 `)}function pK(e){let t=[],r=e;for(;r?.raw;){let n={cert:r.raw};if(r.issuerCertificate&&r.issuerCertificate!==r&&r.issuerCertificate.raw&&(n.issuer=r.issuerCertificate.raw),t.push(n),r.issuerCertificate&&r.issuerCertificate!==r)r=r.issuerCertificate;else break}return t}function rP(e){try{let t=mu(e),n=Co.Certificate.fromBER(t).extensions?.find(c=>c.extnID==="2.5.29.31");if(!n)return wo.debug?.("Certificate has no CRL Distribution Points extension"),[];let s=No.fromBER(n.extnValue.valueBlock.valueHexView);if(s.offset===-1)throw new Error("Failed to parse ASN.1 structure in CRL Distribution Points extension");let i=new Co.CRLDistributionPoints({schema:s.result}),o=[];for(let c of i.distributionPoints)if(c.distributionPoint&&Array.isArray(c.distributionPoint)){for(let l of c.distributionPoint)if(l.type===6&&typeof l.value=="string"){let u=l.value;(u.startsWith("http://")||u.startsWith("https://"))&&o.push(u)}}return wo.debug?.(`Found ${o.length} CRL distribution points: ${o}`),o}catch(t){return wo.warn?.(`Failed to extract CRL distribution points: ${t}`),[]}}function hK(e){try{let t=mu(e),r=Co.Certificate.fromBER(t),n=[],s=[];for(let i of r.extensions||[])if(i.extnID==="2.5.29.31")try{let o=No.fromBER(i.extnValue.valueBlock.valueHexView);if(o.offset!==-1){let c=new Co.CRLDistributionPoints({schema:o.result});for(let l of c.distributionPoints)if(l.distributionPoint&&Array.isArray(l.distributionPoint)){for(let u of l.distributionPoint)if(u.type===6&&typeof u.value=="string"){let d=u.value;(d.startsWith("http://")||d.startsWith("https://"))&&n.push(d)}}}}catch(o){wo.warn?.(`Failed to parse CRL Distribution Points extension: ${o}`)}else if(i.extnID==="1.3.6.1.5.5.7.1.1")try{let o=No.fromBER(i.extnValue.valueBlock.valueHexView);if(o.offset!==-1&&o.result instanceof No.Sequence){for(let c of o.result.valueBlock.value)if(c instanceof No.Sequence&&c.valueBlock.value.length>=2){let l=c.valueBlock.value[0],u=c.valueBlock.value[1];if(l instanceof No.ObjectIdentifier&&l.valueBlock.toString()==="1.3.6.1.5.5.7.48.1"&&u.idBlock.tagNumber===6){let d=String.fromCharCode(...Array.from(u.valueBlock.valueHexView));(d.startsWith("http://")||d.startsWith("https://"))&&s.push(d)}}}}catch(o){wo.warn?.(`Failed to parse Authority Information Access extension: ${o}`)}return wo.debug?.(`Found ${n.length} CRL distribution points and ${s.length} OCSP responder URLs`),{crlUrls:n,ocspUrls:s}}catch(t){return wo.warn?.(`Failed to extract revocation URLs: ${t}`),{crlUrls:[],ocspUrls:[]}}}function mu(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s/g,""),r=atob(t),n=new ArrayBuffer(r.length),s=new Uint8Array(n);for(let i=0;i<r.length;i++)s[i]=r.charCodeAt(i);return n}function $T(e,t,r,n){let s={certPem:e,issuerPem:t,method:r,...n},i=(0,tP.createHash)("sha256").update(JSON.stringify(s)).digest("hex");return`${r}:${i}`}function nP(e,t){return`${e}:${t}`}function EK(e){try{let t=mu(e),n=Co.Certificate.fromBER(t).serialNumber.valueBlock.valueHexView;return Array.from(n).map(s=>s.toString(16).padStart(2,"0")).join("")}catch(t){throw wo.error?.(`Failed to extract serial number: ${t}`),new Error(`Failed to extract certificate serial number: ${t.message}`)}}function sP(e){try{let t=mu(e),r=Co.Certificate.fromBER(t),n=r.extensions?.find(i=>i.extnID==="2.5.29.35");if(n)try{let i=No.fromBER(n.extnValue.valueBlock.valueHexView);if(i.offset!==-1){let o=new Co.AuthorityKeyIdentifier({schema:i.result});if(o.keyIdentifier){let c=o.keyIdentifier.valueBlock.valueHexView;return Array.from(c).map(l=>l.toString(16).padStart(2,"0")).join("")}}}catch(i){wo.debug?.(`Failed to parse Authority Key Identifier: ${i}, falling back to hash`)}let s=r.issuer.typesAndValues.map(i=>`${i.type}=${i.value.valueBlock.value}`).join(",");return(0,tP.createHash)("sha256").update(s).digest("hex")}catch(t){throw wo.error?.(`Failed to extract issuer key ID: ${t}`),new Error(`Failed to extract issuer key ID: ${t.message}`)}}function VT(){return eP||(eP=je({table:"hdb_certificate_cache",database:"system",attributes:[{name:"certificate_id",isPrimaryKey:!0},{name:"status"},{name:"reason"},{name:"checked_at"},{name:"expiresAt",expiresAt:!0,indexed:!0},{name:"method"}]})),eP}var tP,Co,No,mK,wo,eP,KT=se(()=>{tP=require("node:crypto"),Co=b(require("pkijs")),No=b(require("asn1js")),mK=b(ar());Ce();wo=(0,mK.loggerWithTag)("cert-verification-utils");a(Bc,"bufferToPem");a(pK,"extractCertificateChain");a(rP,"extractCRLDistributionPoints");a(hK,"extractRevocationUrls");a(mu,"pemToBuffer");a($T,"createCacheKey");a(nP,"createRevokedCertificateId");a(EK,"extractSerialNumber");a(sP,"extractIssuerKeyId");eP=null;a(VT,"getCertificateCacheTable")});function _K(e){let{error:t,value:r}=Dfe.validate(e,{abortEarly:!1,allowUnknown:!1});if(t){let n=t.details.map(s=>s.message).join("; ");throw new Error(`Invalid certificate verification configuration: ${n}`)}return r}var Jr,Ofe,yf,Rf,iP,Pfe,Lfe,Dfe,gK=se(()=>{Jr=b(require("joi")),Ofe="fail-closed",yf={timeout:5e3,cacheTtl:36e5,errorCacheTtl:3e5,failureMode:"fail-closed"},Rf={timeout:1e4,cacheTtl:864e5,failureMode:"fail-closed",gracePeriod:864e5},iP=Jr.default.string().valid("fail-open","fail-closed"),Pfe=Jr.default.alternatives().try(Jr.default.boolean().custom(e=>e===!1?{enabled:!1}:{enabled:!0,...Rf}),Jr.default.object({enabled:Jr.default.boolean().default(!0),timeout:Jr.default.number().min(1e3).default(Rf.timeout).messages({"number.min":"CRL timeout must be at least 1000ms (1 second)"}),cacheTtl:Jr.default.number().min(1e3).default(Rf.cacheTtl).messages({"number.min":"CRL cacheTtl must be at least 1000ms (1 second)"}),failureMode:iP.default(Rf.failureMode),gracePeriod:Jr.default.number().min(0).default(Rf.gracePeriod).messages({"number.min":"CRL gracePeriod must be at least 0ms"})})),Lfe=Jr.default.alternatives().try(Jr.default.boolean().custom(e=>e===!1?{enabled:!1}:{enabled:!0,...yf}),Jr.default.object({enabled:Jr.default.boolean().default(!0),timeout:Jr.default.number().min(1e3).default(yf.timeout).messages({"number.min":"OCSP timeout must be at least 1000ms (1 second)"}),cacheTtl:Jr.default.number().min(1e3).default(yf.cacheTtl).messages({"number.min":"OCSP cacheTtl must be at least 1000ms (1 second)"}),errorCacheTtl:Jr.default.number().min(1e3).default(yf.errorCacheTtl).messages({"number.min":"OCSP errorCacheTtl must be at least 1000ms (1 second)"}),failureMode:iP.default(yf.failureMode)})),Dfe=Jr.default.object({failureMode:iP.default(Ofe),crl:Pfe.default({enabled:!0,...Rf}),ocsp:Lfe.default({enabled:!0,...yf})});a(_K,"validateAndParseCertificateVerificationConfig")});function NK(e){if(typeof e=="boolean"||e==null){if(e===oP&&aP)return Oo.trace?.("Using cached validation error result (primitive) - returning disabled"),!1;if(e===oP&&YT!==null)return Oo.trace?.("Using cached certificate verification config (primitive)"),YT;Oo.trace?.("Parsing and caching certificate verification config (primitive)"),oP=e;try{return YT=yK(e),aP=null,YT}catch(n){return aP=n,Oo.error?.(`Certificate verification config validation failed - defaulting to disabled: ${n.message}`),!1}}if(TK.get(e))return Oo.trace?.("Using cached validation error result (object) - returning disabled"),!1;let r=SK.get(e);if(r!==void 0)return Oo.trace?.("Using cached certificate verification config (object)"),r;Oo.trace?.("Parsing and caching certificate verification config (object)");try{let n=yK(e);return SK.set(e,n),n}catch(n){return TK.set(e,n),Oo.error?.(`Certificate verification config validation failed - defaulting to disabled: ${n.message}`),!1}}function yK(e){if(Oo.trace?.(`getCertificateVerificationConfig called with: ${JSON.stringify({mtlsConfig:e})}`),!e)return!1;let t=e===!0?void 0:e.certificateVerification;return Oo.trace?.(`Certificate verification config: ${JSON.stringify({verificationConfig:t})}`),t==null||t===!1?!1:_K(t===!0?{}:t)}var RK,bK,Oo,AK,IK,wK,SK,oP,YT,TK,aP,cP=se(()=>{RK=b(ar()),bK=b(Et());gK();Oo=(0,RK.loggerWithTag)("cert-verification-config"),AK=10080*60*1e3,IK=3e5,wK=`Harper/${bK.packageJson.version} CRL-Client`,SK=new WeakMap,oP=null,YT=null,TK=new WeakMap,aP=null;a(NK,"getCachedCertificateVerificationConfig");a(yK,"getCertificateVerificationConfig")});function Yh(e){return e===OK||e===vfe}function Mfe(e){return e===PK||e===LK}function lP(e){return e===OK?PK:LK}function Ufe(){if(CK)return;CK=!0;let e=pu.CryptoEngine.prototype,t=pu.Certificate.prototype,r={getHashAlgorithm:e.getHashAlgorithm,getAlgorithmByOID:e.getAlgorithmByOID,getAlgorithmParameters:e.getAlgorithmParameters,verifyWithPublicKey:e.verifyWithPublicKey,certificateVerify:t.verify,getPublicKey:t.getPublicKey};e.getHashAlgorithm=function(...n){let[s]=n;return Yh(s.algorithmId)?"UNUSED-EDDSA-BUILTIN-HASH":r.getHashAlgorithm.call(this,s)},e.getAlgorithmByOID=function(...n){let[s]=n;return Yh(s)?{name:lP(s)}:r.getAlgorithmByOID.call(this,...n)},e.getAlgorithmParameters=function(...n){let[s,i]=n;return Mfe(s)?{algorithm:{name:s},usages:i==="sign"?["sign"]:["verify"]}:r.getAlgorithmParameters.call(this,...n)},t.getPublicKey=async function(...n){let[,s=pu.getCrypto(!0)]=n,i=this.subjectPublicKeyInfo.algorithm.algorithmId;if(Yh(i)){let o=lP(i);return s.importKey("spki",this.subjectPublicKeyInfo.toSchema().toBER(!1),o,!0,["verify"])}return r.getPublicKey.call(this,...n)},t.verify=async function(...n){let[s]=n;if(Yh(this.signatureAlgorithm.algorithmId))try{let i=this.toSchema().toBER(!1),o=s.toSchema().toBER(!1),c=new Wh.X509Certificate(Buffer.from(i)),l=new Wh.X509Certificate(Buffer.from(o));return c.verify(l.publicKey)}catch{return!1}return r.certificateVerify.call(this,...n)},r.verifyWithPublicKey&&(e.verifyWithPublicKey=async function(...n){let[s,i,o]=n,c=o.algorithm.algorithmId;if(Yh(c)){let l=lP(c);try{let u=this.crypto?.subtle||this.subtle||pu.getCrypto(!0)?.subtle||Wh.webcrypto?.subtle;if(!u)throw new Error("No crypto.subtle available");let d=await u.importKey("spki",o.toSchema().toBER(!1),l,!1,["verify"]),f=i.valueBlock.valueHexView;return"unusedBits"in i.valueBlock&&i.valueBlock.unusedBits>0&&(f=f.slice(0,f.length-1)),await u.verify(l,d,f,s)}catch{return!1}}return r.verifyWithPublicKey.call(this,...n)})}var pu,Wh,OK,vfe,PK,LK,CK,DK=se(()=>{pu=b(require("pkijs")),Wh=require("node:crypto"),OK="1.3.101.112",vfe="1.3.101.113",PK="Ed25519",LK="Ed448",CK=!1;a(Yh,"isEd25519OrEd448");a(Mfe,"isEdDSAAlgorithmName");a(lP,"getEdDSAAlgorithmName");a(Ufe,"applyEd25519Patch");Ufe()});var xK={};ye(xK,{CRLSignatureVerificationError:()=>jh,performCRLCheck:()=>kfe,verifyCRL:()=>fP});function xfe(){return WT||(WT=VT(),WT.sourcedFrom(bf)),WT}function Bfe(){return jT||(jT=je({table:"hdb_crl_cache",database:"system",attributes:[{name:"distribution_point",isPrimaryKey:!0},{name:"issuer_dn"},{name:"crl_blob"},{name:"this_update"},{name:"next_update"},{name:"signature_valid"},{name:"expiresAt",expiresAt:!0,indexed:!0}]}),jT.sourcedFrom(dP)),jT}function MK(){return uP||(uP=je({table:"hdb_revoked_certificates",database:"system",attributes:[{name:"composite_id",isPrimaryKey:!0},{name:"serial_number",indexed:!0},{name:"issuer_key_id",indexed:!0},{name:"revocation_date"},{name:"revocation_reason"},{name:"crl_source",indexed:!0},{name:"crl_next_update"},{name:"expiresAt",expiresAt:!0,indexed:!0}]})),uP}async function fP(e,t,r,n){if(r?.enabled===!1)return{valid:!0,status:"disabled",method:"disabled"};try{let s=Bc(e,"CERTIFICATE"),i=Bc(t,"CERTIFICATE"),o=n??rP(s);if(o.length===0)return{valid:!0,status:"no-crl-distribution-points",method:"crl"};let c=$T(s,i,"crl"),l=await xfe().get(c,{certPem:s,issuerPem:i,distributionPoint:o[0],config:{crl:r??{}}});if(!l)return Lr.error?.("Cache fetch returned null - this indicates a source configuration issue"),r.failureMode==="fail-closed"?{valid:!1,status:"error",error:"Cache fetch failed",method:"crl"}:(Lr.warn?.("CRL cache fetch failed, allowing connection (fail-open mode)"),{valid:!0,status:"error-allowed",method:"crl"});let u=l,d=l.wasLoadedFromSource?.();return Lr.trace?.(`CRL ${d?"source fetch":"cache hit"} for certificate`),{valid:u.status==="good",status:u.status,cached:!d,method:u.method||"crl"}}catch(s){return Lr.error?.(`CRL verification error: ${s}`),r.failureMode==="fail-closed"?{valid:!1,status:"error",error:s.message,method:"crl"}:(Lr.warn?.("CRL check failed, allowing connection (fail-open mode)"),{valid:!0,status:"error-allowed",method:"crl"})}}async function kfe(e,t,r,n){let s=n??rP(e);if(s.length===0)return{status:"good"};let i=EK(e),o=sP(t),c=nP(o,i);try{let u=await MK().get(c);if(u){let f=Date.now(),m=u;return m.crl_next_update>f?{status:"revoked",reason:m.revocation_reason||"unspecified",source:m.crl_source}:m.crl_next_update+r.gracePeriod>f?(Lr.warn?.("Using expired CRL data within grace period"),{status:"revoked",reason:m.revocation_reason||"unspecified",source:m.crl_source}):(Lr.warn?.("CRL data is too old, treating as unknown"),{status:"unknown",reason:"crl-expired"})}let d=await Ffe(s,t,r);return d.upToDate?{status:"good",source:d.source}:(Lr.warn?.("CRL data is stale or missing, treating as unknown"),{status:"unknown",reason:d.reason||"crl-unavailable"})}catch(l){return Lr.error?.(`CRL lookup error: ${l}`),{status:"unknown",reason:l.message}}}async function Ffe(e,t,r){let n=Date.now();for(let s of e)try{let i=Bfe(),o=null,c=null;try{c=await i.get(s),(c&&c.next_update>n||c&&c.next_update+r.gracePeriod>n)&&(o=c)}catch{}o||(o=await UK(s,t,r.timeout));let l=o.next_update;if(l>n){if(!c)try{await i.put(s,o)}catch{}return{upToDate:!0,source:s}}else return l+r.gracePeriod>n?{upToDate:!0,source:s}:{upToDate:!1,reason:"crl-expired"}}catch(i){if(i instanceof jh)throw i}return{upToDate:!1,reason:"no-current-crl-data"}}async function UK(e,t,r){let n=new AbortController,s=setTimeout(()=>n.abort(),r);try{let i=await fetch(e,{signal:n.signal,headers:{"User-Agent":wK}});if(clearTimeout(s),!i.ok)throw new Error(`CRL download failed: ${i.status}`);let o=Buffer.from(await i.arrayBuffer()),c,l=o.toString("utf8");l.includes("-----BEGIN X509 CRL-----")?c=Buffer.from(mu(l)):c=o;let u=zT.CertificateRevocationList.fromBER(c),d=zT.Certificate.fromBER(mu(t)),f=await u.verify({issuerCertificate:d});if(!f){let _=`CRL signature verification failed for: ${e}`;throw Lr.error?.(_),new jh(_)}let m=u.thisUpdate.value.getTime(),p=u.nextUpdate?.value.getTime()??m+AK,h=d.issuer.typesAndValues.map(_=>`${_.type}=${_.value.valueBlock.value}`).join(","),E={distribution_point:e,issuer_dn:h,crl_blob:o,this_update:m,next_update:p,signature_valid:f,expiresAt:p};return Hfe(u,t,e,p).catch(_=>{Lr.error?.(`Error processing revoked certificates: ${_}`)}),E}finally{clearTimeout(s)}}async function Hfe(e,t,r,n){let s=MK(),i=sP(t),o=r;try{await Gfe(s,o)}catch(c){Lr.warn?.(`Failed to clear existing CRL entries: ${c}`)}if(e.revokedCertificates)for(let c of e.revokedCertificates)try{let l=c.userCertificate.valueBlock.valueHexView;if(!l){Lr.warn?.("Could not extract serial number from revoked certificate");continue}let u=Array.from(l).map(h=>h.toString(16).padStart(2,"0")).join(""),d=nP(i,u),f=c.revocationDate.value.getTime(),p={composite_id:d,serial_number:u,issuer_key_id:i,revocation_date:f,revocation_reason:"unspecified",crl_source:o,crl_next_update:n,expiresAt:n};await s.create(p.composite_id,p)}catch(l){Lr.warn?.(`Failed to process revoked certificate: ${l}`)}}async function Gfe(e,t){try{let r=e.search([{attribute:"crl_source",value:t}]);for await(let n of r)try{await e.delete(n.composite_id)}catch(s){Lr.warn?.(`Failed to delete revoked certificate entry: ${s}`)}}catch(r){throw Lr.error?.(`Failed to search for existing CRL entries: ${r}`),r}}var zT,vK,jh,Lr,WT,dP,jT,uP,mP=se(()=>{zT=b(require("pkijs")),vK=b(ar());Ce();So();KT();cP();pP();jh=class extends Error{static{a(this,"CRLSignatureVerificationError")}constructor(t){super(t),this.name="CRLSignatureVerificationError"}},Lr=(0,vK.loggerWithTag)("crl-verification");a(xfe,"getCertificateCacheTable");dP=class extends Zt{static{a(this,"CertificateRevocationListSource")}async get(t){let n=this.getContext()?.requestContext;if(!n?.distributionPoint||!n?.issuerPem)throw new Error(`No CRL data provided for cache key: ${t}`);let{distributionPoint:s,issuerPem:i,config:o}=n;try{let c=await UK(s,i,o.timeout),l=c.next_update,u=Date.now()+o.cacheTtl,d=Math.min(l,u);return{...c,expiresAt:d}}catch(c){if(Lr.error?.(`CRL fetch error for: ${s} - ${c}`),o.failureMode==="fail-closed"){let l=Date.now()+IK;return{crl_id:t,distribution_point:s,issuer_dn:"unknown",crl_blob:Buffer.alloc(0),this_update:Date.now(),next_update:l,signature_valid:!1,expiresAt:l}}return Lr.warn?.("CRL fetch failed, not caching (fail-open mode)"),null}}};a(Bfe,"getCRLCacheTable");a(MK,"getRevokedCertificateTable");a(fP,"verifyCRL");a(kfe,"performCRLCheck");a(Ffe,"checkCRLFreshness");a(UK,"downloadAndParseCRL");a(Hfe,"processRevokedCertificates");a(Gfe,"clearExistingCRLEntries")});async function qfe(){hP||(hP=(await Promise.resolve().then(()=>(mP(),xK))).performCRLCheck),EP||(EP=(await Promise.resolve().then(()=>(_P(),kK))).performOCSPCheck)}var BK,dFe,hP,EP,bf,pP=se(()=>{So();BK=b(ar()),dFe=(0,BK.loggerWithTag)("cert-verification-source");a(qfe,"loadVerificationFunctions");bf=class extends Zt{static{a(this,"CertificateVerificationSource")}async get(t){let r=t.id,s=this.getContext()?.requestContext;if(!s||!s.certPem||!s.issuerPem)return null;let{certPem:i,issuerPem:o,ocspUrls:c,config:l}=s,u;r.startsWith("crl:")?u="crl":r.startsWith("ocsp:")?u="ocsp":u="unknown",await qfe();let d,f;if(u==="crl"){f=l.crl;let p=s.distributionPoint?[s.distributionPoint]:void 0;d=await hP(i,o,f,p)}else if(u==="ocsp")f=l.ocsp,d=await EP(i,o,f,c);else throw new Error(`Unsupported verification method: ${u} for ID: ${r}`);let m=Date.now()+f.cacheTtl;return{certificate_id:r,status:d.status,reason:d.reason,checked_at:Date.now(),expiresAt:m,method:u}}}});var kK={};ye(kK,{performOCSPCheck:()=>Vfe,verifyOCSP:()=>gP});function $fe(){return QT||(QT=VT(),QT.sourcedFrom(bf)),QT}async function gP(e,t,r,n){if(r?.enabled===!1)return{valid:!0,status:"disabled",method:"disabled"};try{let s=Bc(e,"CERTIFICATE"),i=Bc(t,"CERTIFICATE"),o=$T(s,i,"ocsp"),c=await $fe().get(o,{certPem:s,issuerPem:i,ocspUrls:n,config:{ocsp:r??{}}});if(!c)return r.failureMode==="fail-closed"?{valid:!1,status:"error",error:"Cache fetch failed",method:"ocsp"}:(JT.warn?.("OCSP cache fetch failed, allowing connection (fail-open mode)"),{valid:!0,status:"error-allowed",method:"ocsp"});let l=c,u=c.wasLoadedFromSource?.();return JT.trace?.(`OCSP ${u?"source fetch":"cache hit"} for certificate`),{valid:l.status==="good",status:l.status,cached:!u,method:l.method||"ocsp"}}catch(s){return JT.error?.(`OCSP verification error: ${s}`),r.failureMode==="fail-closed"?{valid:!1,status:"error",error:s.message,method:"ocsp"}:(JT.warn?.("OCSP check failed, allowing connection (fail-open mode)"),{valid:!0,status:"error-allowed",method:"ocsp"})}}async function Vfe(e,t,r,n){try{let s=await(0,FK.getCertStatus)(e,{ca:t,timeout:r.timeout,...n?.length&&{ocspUrl:n[0]}});switch(s.status){case"good":return{status:"good"};case"revoked":return{status:"revoked",reason:s.revocationReason?.toString()||"unspecified"};default:return{status:"unknown",reason:"unknown-status"}}}catch(s){return{status:"unknown",reason:s.name==="AbortError"?"timeout":"ocsp-error"}}}var FK,HK,JT,QT,_P=se(()=>{DK();FK=require("easy-ocsp"),HK=b(ar());KT();pP();JT=(0,HK.loggerWithTag)("ocsp-verification");a($fe,"getCertificateCacheTable");a(gP,"verifyOCSP");a(Vfe,"performOCSPCheck")});async function Af(e,t){dn.debug?.(`verifyCertificate called for: ${e.subject?.CN||"unknown"}`);let r=NK(t);if(r===!1)return dn.debug?.("Certificate verification disabled"),{valid:!0,status:"disabled",method:"disabled"};let n=pK(e);if(dn.trace?.(`Certificate chain length: ${n.length}`),n.length<2||!n[0].issuer)return dn.debug?.("Certificate chain insufficient for revocation checking - need certificate and issuer"),{valid:!0,status:"no-issuer-cert",method:"disabled"};let s=Bc(n[0].cert,"CERTIFICATE"),{crlUrls:i,ocspUrls:o}=hK(s);if(dn.debug?.(`Certificate extensions: CRL distribution points=${i.length}, OCSP URLs=${o.length}`),i.length>0)if(r.crl.enabled)try{dn.debug?.("Attempting CRL verification");let c=await fP(n[0].cert,n[0].issuer,r.crl,i);if(c.status==="good"||c.status==="revoked")return dn.debug?.(`CRL verification result: ${c.status}`),c;dn.debug?.(`CRL verification inconclusive: ${c.status}, trying OCSP fallback`)}catch(c){dn.warn?.(`CRL verification failed: ${c}`)}else dn.debug?.("Skipping CRL - disabled in configuration");else dn.debug?.("Skipping CRL - no distribution points in certificate");if(o.length>0)if(r.ocsp.enabled)try{dn.debug?.("Attempting OCSP verification");let c=await gP(n[0].cert,n[0].issuer,r.ocsp,o);return dn.debug?.(`OCSP verification result: ${c.status}`),c}catch(c){dn.warn?.(`OCSP verification failed: ${c}`)}else dn.debug?.("Skipping OCSP - disabled in configuration");else dn.debug?.("Skipping OCSP - no responder URLs in certificate");return r.failureMode==="fail-closed"?{valid:!1,status:"no-verification-available",method:"disabled"}:{valid:!0,status:"verification-unavailable-allowed",method:"disabled"}}var GK,dn,XT=se(()=>{GK=b(ar());KT();cP();_P();mP();dn=(0,GK.loggerWithTag)("cert-verification");a(Af,"verifyCertificate")});var Io={};ye(Io,{buildReplicationMtlsConfig:()=>JK,clearThisNodeName:()=>Zfe,disableReplication:()=>jfe,enabledDatabases:()=>Uc,forEachReplicatedDatabase:()=>Pc,getThisNodeId:()=>GT,getThisNodeName:()=>st,getThisNodeUrl:()=>Lc,hostnameToUrl:()=>ny,lastTimeInAuditStore:()=>Mh,monitorNodeCAs:()=>QK,replicateOperation:()=>tme,replicationCertificateAuthorities:()=>Ta,sendOperationToNode:()=>zh,servers:()=>Yfe,setReplicator:()=>ZK,start:()=>Wfe,startOnMainThread:()=>LO,subscribeToNode:()=>kh,unsubscribeFromNode:()=>IT,urlToNodeName:()=>Ui});function JK(e){return e?.mtls&&typeof e.mtls=="object"?e.mtls:!0}function Wfe(e){if(!e.port&&!e.securePort&&(e.port=Xs.default.get(x.OPERATIONSAPI_NETWORK_PORT),e.securePort=Xs.default.get(x.OPERATIONSAPI_NETWORK_SECUREPORT)),!st())throw new Error("Can not load replication without a url (see replication.url in the config)");let t=new Map;for(let i of xh(e))t.set(Ui(i.url),i);zfe(e);let r=JK(e);e={isOperationsServer:!0,maxPayload:10*1024*1024*1024,...e,mtls:r};let n=Ue.ws(async(i,o,c,l)=>{if(Ct.debug("Incoming WS connection received "+o.url),o.headers.get("sec-websocket-protocol")!=="harperdb-replication-v1")return l(i,o,c);i._socket.unref(),Vh(i,e,c.then(()=>o?.user)),i.on("error",u=>{u.code!=="ECONNREFUSED"&&Ct.error("Error in connection to "+this.url,u.message)})},e);e.runFirst=!0,Ue.http(async(i,o)=>{if(i.isWebSocket&&i.headers.get("Sec-WebSocket-Protocol")==="harperdb-replication-v1"){Ct.debug("Incoming replication WS connection received, authorized: "+i.authorized),!i.authorized&&i._nodeRequest.socket.authorizationError&&Ct.error(`Incoming client connection from ${i.ip} did not have valid certificate, you may need turn on enableRootCAs in the config if you are using a publicly signed certificate, or add the CA to the server's trusted CAs`,i._nodeRequest.socket.authorizationError);let c=Gt().primaryStore;if(i.authorized&&i.peerCertificate.subjectaltname){let l=(0,jK.getHostnamesFromCertificate)(i.peerCertificate),u;for(let d of l)if(u=d&&(c.get(d)||t.get(d)),u)break;if(u){let d=await Af(i.peerCertificate,e.mtls);if(!d.valid){Ct.warn("Certificate verification failed:",d.status,"for node",u.name,"certificate serial number",i.peerCertificate.serialNumber);return}if(u?.revoked_certificates?.includes(i.peerCertificate.serialNumber)){Ct.warn("Revoked certificate used in attempt to connect to node",u.name,"certificate serial number",i.peerCertificate.serialNumber);return}else i.user=u}else Ct.warn(`No node found for certificate common name/SANs: ${l}, available nodes are ${Array.from(c.getRange({}).filter(({value:d})=>d).map(({key:d})=>d)).join(", ")} and routes ${Array.from(t.keys()).join(", ")}, connection will require credentials.`)}else{let l=c.get(i.ip)||t.get(i.ip);l?i.user=l:Ct.warn(`No node found for IP address ${i.ip}, available nodes are ${Array.from(new Set([...c.getKeys(),...t.keys()])).join(", ")}, connection will require credentials.`)}}return o(i)},e);let s=[];for(let i of n)if(i.secureContexts){let o=a(()=>{let c=new Set(i.secureContexts.values());i.defaultContext&&c.add(i.defaultContext);for(let l of c)try{let u=Array.from(Ta);l.options.availableCAs&&u.push(...l.options.availableCAs.values());let d={...l.options,ca:u};l.updatedContext=ry.createSecureContext(d)}catch(u){Ct.error("Error creating replication TLS config",u)}},"updateContexts");i.secureContextsListeners.push(o),s.push(o),Xs.default.get(x.REPLICATION_ENABLEROOTCAS)!==!1&&o()}QK(()=>{for(let i of s)i()})}function QK(e){let t=0;ff(r=>{r?.ca&&(Ta.add(r.ca),Ta.size!==t&&(t=Ta.size,e?.()))})}function jfe(e=!0){zK=e}function zfe(e){zK||(dt(),Uc=e.databases,Pc(e,(t,r)=>{if(!t){let n=e.databaseSubscriptions||xc;for(let[s,i]of ey){let o=i.get(r);o&&(o.subscribe([],!1),i.delete(r))}n.delete(r);return}for(let n in t){let s=t[n];ZK(r,s,e),XO.get(s)?.forEach(i=>i(s))}}))}function ZK(e,t,r){if(!t)return console.error(`Attempt to replicate non-existent table ${t.name} from database ${e}`);if(t.replicate===!1||t.sources?.some(s=>s.isReplicator))return;let n;t.sourcedFrom(class XK extends Zt{static{a(this,"Replicator")}static connection;static subscription;static async subscribe(){let i=r.databaseSubscriptions||xc,o=i.get(e),c=o?.tableById||[];c[t.tableId]=t;let l=o?.ready;if(Ct.trace("Setting up replicator subscription to database",e),!o?.auditStore)return this.subscription=o=new ps,i.set(e,o),o.tableById=c,o.auditStore=t.auditStore,o.dbisDB=t.dbisDB,o.databaseName=e,l&&l(o),o;this.subscription=o}static subscribeOnThisThread(i,o){return!0}static async load(i){if(i){let o=i.residencyId,c=i.residency||t.dbisDB.get([Symbol.for("residency_by_id"),o]);if(c){let l,u=new Set;do{let d,f="",m=1/0;for(let h of c){if(u.has(h)||h===Ue.hostname)continue;let E=Qfe(h,XK.subscription,e);if(E?.isConnected){let _=df(t.auditStore,e,h)[FT];(!d||_<m)&&(d=E,f=h,m=_)}}if(!d)throw l||new YK.ServerError(`No connection to any other nodes are available: ${c}`,502);let p={requestId:Kfe++,table:t,entry:i,id:i.key};u.add(f);try{return await d.getRecord(p)}catch(h){if(d.isConnected)throw h;Ct.warn("Error in load from node",ty,h),l||(l=h)}}while(!0)}}}static isReplicator=!0},{intermediateSource:!0})}function Jfe(e,t,r,n,s,i){let o=t+"-"+e,c=ey.get(o);c||(c=new Map,ey.set(o,c));let l=c.get(n);if(l)return l;if(r)return c.set(n,l=new Sf(t,r,n,s,i)),l.connect(),l.once("finished",()=>c.delete(n)),l}function Qfe(e,t,r){let n=qK.get(e);n||(n=new Map,qK.set(e,n));let s=n.get(r);if(s)return s;let i=Gt().primaryStore.get(e);return i?.url&&(s=new Sf(i.url,t,r,e,i.authorization),n.set(r,s),s.connect(),s.once("finished",()=>n.delete(r))),s}async function zh(e,t,r){r||(r={}),r.serverName=e.name;let n=await HT(e.url,r),s=Vh(n,{},{});return new Promise((i,o)=>{n.on("open",()=>{Ct.debug("Sending operation connection to "+e.url+" opened",t),i(s.sendOperation(t))}),n.on("error",c=>{o(c)}),n.on("close",c=>{Ct.info("Sending operation connection to "+e.url+" closed",c)})}).finally(()=>{n.close()})}function kh(e){try{WK.isMainThread&&Ct.warn("Subscribing on main thread (should not happen in multi-threaded instance)",e.nodes[0].url,e.database);let t=xc.get(e.database);if(!t){let n;t=new Promise(s=>{Ct.info("Waiting for subscription to database "+e.database),n=s}),t.ready=n,xc.set(e.database,t)}let r=Jfe(e.nodes[0].url,e.url,t,e.database,e.name,e.nodes[0].authorization);e.nodes[0].name===void 0?r.tentativeNode=e.nodes[0]:r.nodeName=e.nodes[0].name,r.subscribe(e.nodes.filter(n=>Uh(n,e.database)),e.replicateByDefault)}catch(t){Ct.error("Error in subscription to node",e.nodes[0]?.url,t)}}async function IT({url:e,nodes:t,database:r}){Ct.trace("Unsubscribing from node",e,r,"nodes",Array.from(Gt().primaryStore.getRange({})));let n=e+"-"+(t[0]?.url??e),s=ey.get(n);if(s){let i=s.get(r);i&&(i.unsubscribe(),s.delete(r))}}function Xfe(){if(SP!==void 0)return SP;let e=Xs.default.get(x.OPERATIONSAPI_TLS_CERTIFICATE)||Xs.default.get(x.TLS_CERTIFICATE);if(e)return SP=new VK.X509Certificate((0,KK.readFileSync)(e)).subject?.match(/CN=(.*)/)?.[1]??null}function st(){return ty||(ty=Xs.default.get("replication_hostname")??Ui(Xs.default.get("replication_url"))??Xfe()??$K("operationsapi_network_secureport")??$K("operationsapi_network_port")??"127.0.0.1")}function Zfe(){ty=void 0}function $K(e){let t=Xs.default.get(e),r=t?.lastIndexOf?.(":");if(r>0)return t.slice(0,r)}function ZT(e){let t=Xs.default.get(e),r=t?.lastIndexOf?.(":");return r>0?+t.slice(r+1).replace(/[\[\]]/g,""):+t}function GT(e){return vh(e)?.[st()]}function Lc(){let e=Xs.default.get("replication_url");return e||ny(st())}function ny(e){let t=ZT("replication_port");if(t)return`ws://${e}:${t}`;if(t=ZT("replication_secureport"),t)return`wss://${e}:${t}`;if(t=ZT("operationsapi_network_port"),t)return`ws://${e}:${t}`;if(t=ZT("operationsapi_network_secureport"),t)return`wss://${e}:${t}`}function Ui(e){if(e)return new URL(e).hostname}function Pc(e,t){for(let n of Object.getOwnPropertyNames(Me))r(n);return Kh(n=>{r(n)}),fu((n,s)=>{r(n.databaseName)});function r(n){let s=Me[n];Ct.trace("Checking replication status of ",n,e?.databases),e?.databases===void 0||e.databases==="*"||e.databases.includes(n)||e.databases.some?.(i=>i.name===n)||!s?t(s,n,!0):eme(n)&&t(s,n,!1)}a(r,"forDatabase")}function eme(e){let t=Me[e];for(let r in t)if(t[r].replicate)return!0}function Mh(e){for(let t of e.getKeys({limit:1,reverse:!0}))return t}async function tme(e){let t={message:""};if(e.replicated){e.replicated=!1,Ct.trace?.("Replicating operation",e.operation,"to nodes",Ue.nodes.map(n=>n.name));let r=await Promise.allSettled(Ue.nodes.map(n=>zh(n,e)));t.replicated=r.map((n,s)=>{let i=n.status==="rejected"?{status:"failed",reason:n.reason.toString()}:n.value;return i.node=Ue.nodes[s]?.name,i})}return t}var Xs,Ct,VK,KK,ry,YK,WK,jK,zK,Kfe,Yfe,Ta,Uc,ey,qK,SP,ty,Zn=se(()=>{Ce();So();hd();ZO();Kr();Xs=b(ce()),Ct=b(Q()),VK=require("crypto");XT();KK=require("fs");Fh();mf();H();wO();ry=b(require("node:tls")),YK=b(Ee()),WK=require("worker_threads"),jK=b(Cn()),Kfe=1,Yfe=[],Ta=Xs.default.get(x.REPLICATION_ENABLEROOTCAS)!==!1?new Set(ry.rootCertificates):new Set;a(JK,"buildReplicationMtlsConfig");a(Wfe,"start");a(QK,"monitorNodeCAs");a(jfe,"disableReplication");a(zfe,"assignReplicationSource");a(ZK,"setReplicator");ey=new Map;a(Jfe,"getSubscriptionConnection");qK=new Map;a(Qfe,"getRetrievalConnectionByName");a(zh,"sendOperationToNode");a(kh,"subscribeToNode");a(IT,"unsubscribeFromNode");a(Xfe,"getCommonNameFromCert");a(st,"getThisNodeName");a(Zfe,"clearThisNodeName");Object.defineProperty(Ue,"hostname",{get(){return st()}});a($K,"getHostFromListeningPort");a(ZT,"getPortFromListeningPort");a(GT,"getThisNodeId");Ue.replication={getThisNodeId:GT,exportIdMapping:vh};a(Lc,"getThisNodeUrl");a(ny,"hostnameToUrl");a(Ui,"urlToNodeName");a(Pc,"forEachReplicatedDatabase");a(eme,"hasExplicitlyReplicatedTable");a(Mh,"lastTimeInAuditStore");a(tme,"replicateOperation")});var cy=M((UFe,sY)=>{"use strict";var If=wV(),{validateBySchema:Jh}=ht(),{commonValidators:wf,schemaRegex:TP}=lo(),Rr=require("joi"),rme=Q(),nme=require("uuid").v4,oy=ma(),Nf=(H(),L(j)),sme=require("util"),kc=gs(),{handleHDBError:ya,hdbErrors:ime,ClientError:hu}=Ee(),{HDB_ERROR_MSGS:sy,HTTP_STATUS_CODES:Ra}=ime,{SchemaEventMsg:ay}=Rs(),eY=dr(),{getDatabases:ome}=(Ce(),L(ct)),{transformReq:Cf}=ae(),{replicateOperation:tY}=(Zn(),L(Io)),{cleanupOrphans:ame}=(hs(),L(Og)),iy=Rr.string().min(1).max(wf.schema_length.maximum).pattern(TP).messages({"string.pattern.base":"{:#label} "+wf.schema_format.message}),cme=Rr.string().min(1).max(wf.schema_length.maximum).pattern(TP).messages({"string.pattern.base":"{:#label} "+wf.schema_format.message}).required(),lme=Rr.string().min(1).max(wf.schema_length.maximum).pattern(TP).messages({"string.pattern.base":"{:#label} "+wf.schema_format.message,"any.required":"'primary_key' is required","string.base":"'primary_key' must be a string"}).required();sY.exports={createSchema:ume,createSchemaStructure:rY,createTable:dme,createTableStructure:nY,createAttribute:Eme,dropSchema:fme,dropTable:mme,dropAttribute:pme,getBackup:_me,cleanupOrphanBlobs:gme};async function ume(e){let t=await rY(e);return oy.signalSchemaChange(new ay(process.pid,e.operation,e.schema)),t}a(ume,"createSchema");async function rY(e){let t=Jh(e,Rr.object({database:iy,schema:iy}));if(t)throw new hu(t.message);if(Cf(e),!await If.checkSchemaExists(e.schema))throw ya(new Error,sy.SCHEMA_EXISTS_ERR(e.schema),Ra.BAD_REQUEST,Nf.LOG_LEVELS.ERROR,sy.SCHEMA_EXISTS_ERR(e.schema),!0);return await kc.createSchema(e),`database '${e.schema}' successfully created`}a(rY,"createSchemaStructure");async function dme(e){return Cf(e),e.hash_attribute=e.primary_key??e.hash_attribute,await nY(e)}a(dme,"createTable");async function nY(e){let t=Jh(e,Rr.object({database:iy,schema:iy,table:cme,residence:Rr.array().items(Rr.string().min(1)).optional(),hash_attribute:lme}));if(t)throw new hu(t.message);if(!await If.checkSchemaTableExists(e.schema,e.table))throw ya(new Error,sy.TABLE_EXISTS_ERR(e.schema,e.table),Ra.BAD_REQUEST,Nf.LOG_LEVELS.ERROR,sy.TABLE_EXISTS_ERR(e.schema,e.table),!0);let n={name:e.table,schema:e.schema,id:nme(),hash_attribute:e.hash_attribute};try{if(e.residence)if(global.clustering_on)n.residence=e.residence,await kc.createTable(n,e);else throw ya(new Error,"Clustering does not appear to be enabled. Cannot insert table with property 'residence'.",Ra.BAD_REQUEST);else await kc.createTable(n,e);return`table '${e.schema}.${e.table}' successfully created.`}catch(s){throw s}}a(nY,"createTableStructure");async function fme(e){let t=Jh(e,Rr.object({database:Rr.string(),schema:Rr.string()}).or("database","schema").messages({"object.missing":"'database' is required"}));if(t)throw new hu(t.message);Cf(e);let r=await If.checkSchemaExists(e.schema);if(r)throw ya(new Error,r,Ra.NOT_FOUND,Nf.LOG_LEVELS.ERROR,r,!0);let n=await If.schemaDescribe.describeSchema({schema:e.schema}),s=Object.keys(global.hdb_schema[e.schema]);await kc.dropSchema(e),oy.signalSchemaChange(new ay(process.pid,e.operation,e.schema)),await eY.purgeSchemaTableStreams(e.schema,s);let i=await tY(e);return i.message=`successfully deleted '${e.schema}'`,i}a(fme,"dropSchema");async function mme(e){let t=Jh(e,Rr.object({database:Rr.string(),schema:Rr.string(),table:Rr.string().required()}));if(t)throw new hu(t.message);Cf(e);let r=await If.checkSchemaTableExists(e.schema,e.table);if(r)throw ya(new Error,r,Ra.NOT_FOUND,Nf.LOG_LEVELS.ERROR,r,!0);await kc.dropTable(e),await eY.purgeTableStream(e.schema,e.table);let n=await tY(e);return n.message=`successfully deleted table '${e.schema}.${e.table}'`,n}a(mme,"dropTable");async function pme(e){let t=Jh(e,Rr.object({database:Rr.string(),schema:Rr.string(),table:Rr.string().required(),attribute:Rr.string().required()}));if(t)throw new hu(t.message);Cf(e);let r=await If.checkSchemaTableExists(e.schema,e.table);if(r)throw ya(new Error,r,Ra.NOT_FOUND,Nf.LOG_LEVELS.ERROR,r,!0);if(e.attribute===global.hdb_schema[e.schema][e.table].hash_attribute)throw ya(new Error,"You cannot drop a hash attribute",Ra.BAD_REQUEST,void 0,void 0,!0);if(Nf.TIME_STAMP_NAMES.indexOf(e.attribute)>=0)throw ya(new Error,`cannot drop internal timestamp attribute: ${e.attribute}`,Ra.BAD_REQUEST,void 0,void 0,!0);try{return await kc.dropAttribute(e),hme(e),oy.signalSchemaChange(new ay(process.pid,e.operation,e.schema,e.table,e.attribute)),`successfully deleted attribute '${e.attribute}'`}catch(n){throw rme.error(`Got an error deleting attribute ${sme.inspect(e)}.`),n}}a(pme,"dropAttribute");function hme(e){let t=Object.values(global.hdb_schema[e.schema][e.table].attributes);for(let r=0;r<t.length;r++)t[r].attribute===e.attribute&&global.hdb_schema[e.schema][e.table].attributes.splice(r,1)}a(hme,"dropAttributeFromGlobal");async function Eme(e){Cf(e);let t=ome()[e.schema][e.table].attributes;for(let{name:r}of t)if(r===e.attribute)throw ya(new Error,`attribute '${e.attribute}' already exists in ${e.schema}.${e.table}`,Ra.BAD_REQUEST,void 0,void 0,!0);return await kc.createAttribute(e),oy.signalSchemaChange(new ay(process.pid,e.operation,e.schema,e.table,e.attribute)),`attribute '${e.schema}.${e.table}.${e.attribute}' successfully created.`}a(Eme,"createAttribute");function _me(e){return kc.getBackup(e)}a(_me,"getBackup");function gme(e){if(!e.database)throw new hu('Must provide "database" name for search for orphaned blobs');if(!databases[e.database])throw new hu(`Unknown database '${e.database}'`);return ame(databases[e.database],e.database),{message:"Orphaned blobs cleanup started, check logs for progress"}}a(gme,"cleanupOrphanBlobs")});var oY=M((BFe,iY)=>{"use strict";var{OPERATIONS_ENUM:Sme}=(H(),L(j)),yP=class{static{a(this,"ReadAuditLogObject")}constructor(t,r,n=void 0,s=void 0){this.operation=Sme.READ_AUDIT_LOG,this.schema=t,this.table=r,this.search_type=n,this.search_values=s}};iY.exports=yP});var RP=M((HFe,dY)=>{"use strict";var Tme=gs(),FFe=oY(),ly=ae(),uy=(H(),L(j)),yme=ce(),{handleHDBError:aY,hdbErrors:Rme}=Ee(),{HDB_ERROR_MSGS:cY,HTTP_STATUS_CODES:lY}=Rme,bme=Object.values(uy.READ_AUDIT_LOG_SEARCH_TYPES_ENUM),uY="To use this operation audit log must be enabled in harperdb-config.yaml";dY.exports=Ame;async function Ame(e){if(ly.isEmpty(e.schema))throw new Error(cY.SCHEMA_REQUIRED_ERR);if(ly.isEmpty(e.table))throw new Error(cY.TABLE_REQUIRED_ERR);if(!yme.get(uy.CONFIG_PARAMS.LOGGING_AUDITLOG))throw aY(new Error,uY,lY.BAD_REQUEST,uy.LOG_LEVELS.ERROR,uY,!0);let t=ly.checkSchemaTableExist(e.schema,e.table);if(t)throw aY(new Error,t,lY.NOT_FOUND,uy.LOG_LEVELS.ERROR,t,!0);if(!ly.isEmpty(e.search_type)&&bme.indexOf(e.search_type)<0)throw new Error(`Invalid searchType '${read_audit_log_object.search_type}'`);return await Tme.readAuditLog(e)}a(Ame,"readAuditLog")});var mY=M((qFe,fY)=>{"use strict";var{OPERATIONS_ENUM:Ime}=(H(),L(j)),bP=class{static{a(this,"GetBackupObject")}constructor(t,r,n=void 0,s=void 0){this.operation=Ime.GET_BACKUP,this.schema=t,this.table=r}};fY.exports=bP});var EY=M((YFe,hY)=>{"use strict";var wme=gs(),VFe=mY(),AP=ae(),Nme=(H(),L(j)),KFe=ce(),{handleHDBError:Cme,hdbErrors:Ome}=Ee(),{HDB_ERROR_MSGS:pY,HTTP_STATUS_CODES:Pme}=Ome;hY.exports=Lme;async function Lme(e){if(AP.isEmpty(e.schema))throw new Error(pY.SCHEMA_REQUIRED_ERR);if(AP.isEmpty(e.table))throw new Error(pY.TABLE_REQUIRED_ERR);let t=AP.checkSchemaTableExist(e.schema,e.table);if(t)throw Cme(new Error,t,Pme.NOT_FOUND,Nme.LOG_LEVELS.ERROR,t,!0);return await wme.getBackup(readAuditLogObject)}a(Lme,"getBackup")});var SY=M((jFe,gY)=>{"use strict";var Dme=ce(),ba=require("joi"),vme=ht(),_Y=require("moment"),Mme=require("fs-extra"),wP=require("path"),Ume=require("lodash"),Qh=(H(),L(j)),{LOG_LEVELS:Eu}=(H(),L(j)),xme="YYYY-MM-DD hh:mm:ss",Bme=wP.resolve(__dirname,"../logs");gY.exports=function(e){return vme.validateBySchema(e,kme)};var kme=ba.object({from:ba.custom(IP),until:ba.custom(IP),to:ba.custom(IP),level:ba.valid(Eu.NOTIFY,Eu.FATAL,Eu.ERROR,Eu.WARN,Eu.INFO,Eu.DEBUG,Eu.TRACE),order:ba.valid("asc","desc"),limit:ba.number().min(1),start:ba.number().min(0),log_name:ba.custom(Fme)});function IP(e,t){if(_Y(e,_Y.ISO_8601).format(xme)==="Invalid date")return t.message(`'${t.state.path[0]}' date '${e}' is invalid.`)}a(IP,"validateDatetime");function Fme(e,t){if(Ume.invert(Qh.LOG_NAMES)[e]===void 0)return t.message(`'log_name' '${e}' is invalid.`);let n=Dme.get(Qh.HDB_SETTINGS_NAMES.LOG_PATH_KEY),s=e===void 0?Qh.LOG_NAMES.HDB:e,i=s===Qh.LOG_NAMES.INSTALL?wP.join(Bme,Qh.LOG_NAMES.INSTALL):wP.join(n,s);return Mme.existsSync(i)?null:t.message(`'log_name' '${e}' does not exist.`)}a(Fme,"validateReadLogPath")});var CP=M((JFe,yY)=>{"use strict";var dy=(H(),L(j)),Hme=Q(),Gme=ce(),qme=SY(),NP=require("path"),TY=require("fs-extra"),{once:$me}=require("events"),{handleHDBError:Vme,hdbErrors:Kme}=Ee(),{PACKAGE_ROOT:Yme}=Et(),{replicateOperation:Wme}=(Zn(),L(Io)),jme=NP.join(Yme,"logs"),zme=1e3,Jme=200;yY.exports=Qme;async function Qme(e){let t=qme(e);if(t)throw Vme(t,t.message,Kme.HTTP_STATUS_CODES.BAD_REQUEST,void 0,void 0,!0);let r=Wme(e),n=Gme.get(dy.HDB_SETTINGS_NAMES.LOG_PATH_KEY),s=e.log_name===void 0?dy.LOG_NAMES.HDB:e.log_name,i=s===dy.LOG_NAMES.INSTALL?NP.join(jme,dy.LOG_NAMES.INSTALL):NP.join(n,s);e.to===void 0&&e.until!==void 0&&(e.to=e.until);let o=e.level!==void 0,c=o?e.level:void 0,l=e.from!==void 0,u=l?new Date(e.from):void 0,d=e.to!==void 0,f=d?new Date(e.to):void 0,m=e.limit===void 0?zme:e.limit,p=e.order===void 0?void 0:e.order,h=e.start===void 0?0:e.start,E=h+m,_=0;p==="desc"&&!u&&!f&&(_=Math.max(TY.statSync(i).size-(E+5)*Jme,0));let R=TY.createReadStream(i,{start:_});R.on("error",q=>{Hme.error(q)});let S=0,y=[],w="",I;R.on("data",q=>{let F=/(?:^|\n)(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:[\d.]+Z) \[(.+?)]: /g;q=w+q;let z=0,Y;for(;(Y=F.exec(q))&&!R.destroyed;){I&&(I.message=q.slice(z,Y.index),G(I));let[le,fe,te]=Y,Se=te.split("] ["),Ne=Se[0],Ke=Se[1];Se.splice(0,2),I={timestamp:fe,thread:Ne,level:Ke,tags:Se,message:""},z=Y.index+le.length}w=q.slice(z)}),R.on("end",q=>{R.destroyed||I&&(I.message=w.trim(),G(I))}),R.resume();function G(q){let F,z,Y;switch(!0){case(o&&l&&d):F=new Date(q.timestamp),z=new Date(u),Y=new Date(f),q.level===c&&F>=z&&F<=Y&&S<h?S++:q.level===c&&F>=z&&F<=Y&&(Po(q,p,y),S++,S===E&&R.destroy());break;case(o&&l):F=new Date(q.timestamp),z=new Date(u),q.level===c&&F>=z&&S<h?S++:q.level===c&&F>=z&&(Po(q,p,y),S++,S===E&&R.destroy());break;case(o&&d):F=new Date(q.timestamp),Y=new Date(f),q.level===c&&F<=Y&&S<h?S++:q.level===c&&F<=Y&&(Po(q,p,y),S++,S===E&&R.destroy());break;case(l&&d):F=new Date(q.timestamp),z=new Date(u),Y=new Date(f),F>=z&&F<=Y&&S<h?S++:F>=z&&F<=Y&&(Po(q,p,y),S++,S===E&&R.destroy());break;case o:q.level===c&&S<h?S++:q.level===c&&(Po(q,p,y),S++,S===E&&R.destroy());break;case l:F=new Date(q.timestamp),z=new Date(u),F>=z&&S<h?S++:F>=z&&S>=h&&(Po(q,p,y),S++,S===E&&R.destroy());break;case d:F=new Date(q.timestamp),Y=new Date(f),F<=Y&&S<h?S++:F<=Y&&S>=h&&(Po(q,p,y),S++,S===E&&R.destroy());break;default:S<h?S++:(Po(q,p,y),S++,S===E&&R.destroy())}}a(G,"onLogMessage"),await $me(R,"close");let X=await r;if(X.replicated){for(let q of y)q.node=server.hostname;for(let q of X.replicated){let F=q.node;if(q.status==="failed")Po({timestamp:new Date().toISOString(),level:"error",node:F,message:`Error retrieving logs: ${q.reason}`},p,y);else for(let z of q.results)z.node=F,Po(z,p,y)}}return y}a(Qme,"readLog");function Po(e,t,r){t==="desc"?Xme(e,r):t==="asc"?Zme(e,r):r.push(e)}a(Po,"pushLineToResult");function Xme(e,t){let r=new Date(e.timestamp),n=0,s=t.length;for(;n<s;){let i=n+s>>>1;new Date(t[i].timestamp)>r?n=i+1:s=i}t.splice(n,0,e)}a(Xme,"insertDescending");function Zme(e,t){let r=new Date(e.timestamp),n=0,s=t.length;for(;n<s;){let i=n+s>>>1;new Date(t[i].timestamp)<r?n=i+1:s=i}t.splice(n,0,e)}a(Zme,"insertAscending")});var fy=M((rHe,IY)=>{"use strict";var OP=require("joi"),{string:Of,boolean:RY,date:epe}=OP.types(),tpe=ht(),{validateSchemaExists:XFe,validateTableExists:ZFe,validateSchemaName:eHe}=lo(),rpe=(H(),L(j)),npe=Nt(),bY=ce();bY.initSync();var tHe=Of.invalid(bY.get(rpe.CONFIG_PARAMS.CLUSTERING_NODENAME)??"node_name").pattern(npe.NATS_TERM_CONSTRAINTS_RX).messages({"string.pattern.base":"{:#label} invalid, must not contain ., * or >","any.invalid":"'node_name' cannot be this nodes name"}).empty(null),AY={operation:Of.valid("add_node","update_node","set_node_replication"),node_name:Of.optional(),subscriptions:OP.array().items({table:Of.optional(),schema:Of.optional(),database:Of.optional(),subscribe:RY.required(),publish:RY.required().custom(ipe),start_time:epe.iso()})};function spe(e){return tpe.validateBySchema(e,OP.object(AY))}a(spe,"addUpdateNodeValidator");function ipe(e,t){if(t.state.ancestors[2].operation==="add_node"&&e===!1&&t.state.ancestors[0].subscribe===!1)return t.message(`'subscriptions[${t.state.path[1]}]' subscribe and/or publish must be set to true when adding a node`)}a(ipe,"checkForFalsy");IY.exports={addUpdateNodeValidator:spe,validationSchema:AY}});var Pf=M((sHe,wY)=>{"use strict";var PP=class{static{a(this,"Node")}constructor(t,r,n){this.name=t,this.subscriptions=r,this.system_info=n}},LP=class{static{a(this,"NodeSubscription")}constructor(t,r,n,s){this.schema=t,this.table=r,this.publish=n,this.subscribe=s}};wY.exports={Node:PP,NodeSubscription:LP}});var CY=M((oHe,NY)=>{"use strict";var ope=(H(),L(j)).OPERATIONS_ENUM,DP=class{static{a(this,"UpsertObject")}constructor(t,r,n,s=void 0){this.operation=ope.UPSERT,this.schema=t,this.table=r,this.records=n,this.__origin=s}};NY.exports=DP});var Xh=M((cHe,OY)=>{"use strict";var vP=class{static{a(this,"RemotePayloadObject")}constructor(t,r,n,s){this.operation=t,this.node_name=r,this.subscriptions=n,this.system_info=s}},MP=class{static{a(this,"RemotePayloadSubscription")}constructor(t,r,n,s,i,o,c){this.schema=t,this.table=r,this.hash_attribute=n,this.publish=s,this.subscribe=i,this.start_time=o,c!==void 0&&(this.attributes=c)}};OY.exports={RemotePayloadObject:vP,RemotePayloadSubscription:MP}});var LY=M((uHe,PY)=>{"use strict";var UP=class{static{a(this,"TableSizeObject")}constructor(t,r,n=0,s=0,i=0,o=0){this.schema=t,this.table=r,this.table_size=n,this.record_count=s,this.transaction_log_size=i,this.transaction_log_record_count=o}};PY.exports=UP});var vY=M((EHe,DY)=>{"use strict";var ape=LY(),fHe=Xt(),mHe=St(),cpe=Q(),{getSchemaPath:pHe,getTransactionAuditStorePath:hHe}=At(),{getDatabases:lpe}=(Ce(),L(ct));DY.exports=upe;async function upe(e){let t=new ape;try{let r=lpe()[e.schema]?.[e.name],n=r.primaryStore.getStats(),s=r.auditStore?.getStats();t.schema=e.schema,t.table=e.name,t.record_count=n.entryCount,t.transaction_log_record_count=s.entryCount}catch(r){cpe.warn(`unable to stat table dbi due to ${r}`)}return t}a(upe,"lmdbGetTableSize")});var UY=M((gHe,MY)=>{"use strict";var xP=class{static{a(this,"SystemInformationObject")}constructor(t,r,n,s,i,o,c){this.system=t,this.time=r,this.cpu=n,this.memory=s,this.disk=i,this.network=o,this.harperdb_processes=c}};MY.exports=xP});var Hc=M((AHe,FY)=>{"use strict";var dpe=require("fs-extra"),fpe=require("path"),On=require("systeminformation"),Fc=Q(),xY=dr(),THe=Nt(),Lf=(H(),L(j)),mpe=vY(),ppe=eu(),{getThreadInfo:BY}=rt(),Zh=ce();Zh.initSync();var hpe=UY(),{openEnvironment:yHe}=St(),{getSchemaPath:RHe}=At(),{database:bHe,databases:BP}=(Ce(),L(ct)),my;FY.exports={getHDBProcessInfo:GP,getNetworkInfo:$P,getDiskInfo:qP,getMemoryInfo:HP,getCPUInfo:FP,getTimeInfo:kP,getSystemInformation:VP,systemInformation:Epe,getTableSize:KP,getMetrics:YP};function kP(){return On.time()}a(kP,"getTimeInfo");async function FP(){try{let{family:e,model:t,stepping:r,revision:n,voltage:s,speedmin:i,speedmax:o,governor:c,socket:l,cache:u,...d}=await On.cpu();d.cpu_speed=await On.cpuCurrentSpeed();let{rawCurrentload:f,rawCurrentloadIdle:m,rawCurrentloadIrq:p,rawCurrentloadNice:h,rawCurrentloadSystem:E,rawCurrentloadUser:_,cpus:R,...S}=await On.currentLoad();return S.cpus=[],R.forEach(y=>{let{rawLoad:w,rawLoadIdle:I,rawLoadIrq:G,rawLoadNice:X,rawLoadSystem:q,rawLoadUser:F,...z}=y;S.cpus.push(z)}),d.current_load=S,d}catch(e){return Fc.error(`error in getCPUInfo: ${e}`),{}}}a(FP,"getCPUInfo");async function HP(){try{let{buffers:e,cached:t,slab:r,buffcache:n,...s}=await On.mem();return Object.assign(s,process.memoryUsage())}catch(e){return Fc.error(`error in getMemoryInfo: ${e}`),{}}}a(HP,"getMemoryInfo");async function GP(){let e={core:[],clustering:[]};try{let t=await On.processes(),r;try{r=Number.parseInt(await dpe.readFile(fpe.join(Zh.get(Lf.CONFIG_PARAMS.ROOTPATH),Lf.HDB_PID_FILE),"utf8"))}catch(n){if(n.code===Lf.NODE_ERROR_CODES.ENOENT)Fc.warn("Unable to locate 'hdb.pid' file, try stopping and starting HarperDB. This could be because HarperDB is not running.");else throw n}t.list.forEach(n=>{n.pid===r?e.core.push(n):n.name==="nats-server"&&e.clustering.push(n)});for(let n of e.core)for(let s of t.list)s.pid===n.parentPid&&(s.name==="PM2"||s.command==="PM2")&&(n.parent="PM2");return e}catch(t){return Fc.error(`error in getHDBProcessInfo: ${t}`),e}}a(GP,"getHDBProcessInfo");async function qP(){let e={};try{if(!Zh.get(Lf.CONFIG_PARAMS.OPERATIONSAPI_SYSINFO_DISK))return e;let{rIO_sec:t,wIO_sec:r,tIO_sec:n,ms:s,...i}=await On.disksIO();e.io=i;let{rxSec:o,txSec:c,wxSec:l,...u}=await On.fsStats();return e.read_write=u,e.size=await On.fsSize(),e}catch(t){return Fc.error(`error in getDiskInfo: ${t}`),e}}a(qP,"getDiskInfo");async function $P(){let e={default_interface:null,latency:{},interfaces:[],stats:[],connections:[]};try{return Zh.get(Lf.CONFIG_PARAMS.OPERATIONSAPI_SYSINFO_NETWORK)&&(e.default_interface=await On.networkInterfaceDefault(),e.latency=await On.inetChecksite("google.com"),(await On.networkInterfaces()).forEach(n=>{let{internal:s,virtual:i,mtu:o,dhcp:c,dnsSuffix:l,ieee8021xAuth:u,ieee8021xState:d,carrierChanges:f,...m}=n;e.interfaces.push(m)}),(await On.networkStats()).forEach(n=>{let{rxSec:s,txSec:i,ms:o,...c}=n;e.stats.push(c)})),e}catch(t){return Fc.error(`error in getNetworkInfo: ${t}`),e}}a($P,"getNetworkInfo");async function VP(){if(my!==void 0)return my;let e={};try{let{codepage:t,logofile:r,serial:n,build:s,servicepack:i,uefi:o,...c}=await On.osInfo();e=c;let l=await On.versions("node, npm");return e.node_version=l.node,e.npm_version=l.npm,my=e,my}catch(t){return Fc.error(`error in getSystemInformation: ${t}`),e}}a(VP,"getSystemInformation");async function KP(){let e=[],t=await ppe.describeAll();for(let r of Object.values(t))for(let n of Object.values(r))e.push(await mpe(n));return e}a(KP,"getTableSize");async function YP(){let e={};for(let t in BP){let r=e[t]={},n=r.tables={};for(let s in BP[t])try{let i=BP[t][s];if(!r.readers&&(Object.assign(r,i.primaryStore.rootStore.getStats()),delete r.root,r.readers=i.primaryStore.rootStore.readerList().split(/\n\s+/).slice(1).map(l=>{let[u,d,f]=l.trim().split(" ");return{pid:u,thread:d,txnid:f}}),i.auditStore)){let{treeDepth:l,treeBranchPageCount:u,treeLeafPageCount:d,entryCount:f,overflowPages:m}=i.auditStore.getStats();r.audit={treeDepth:l,treeBranchPageCount:u,treeLeafPageCount:d,entryCount:f,overflowPages:m}}let o=i.primaryStore.getStats(),c={};for(let l of["treeDepth","treeBranchPageCount","treeLeafPageCount","entryCount","overflowPages"])c[l]=o[l];n[s]=c}catch(i){Fc.notify(`Error getting stats for table ${s}: ${i}`)}}return e}a(YP,"getMetrics");async function kY(){if(Zh.get(Lf.CONFIG_PARAMS.CLUSTERING_ENABLED)){let{jsm:e}=await xY.getNATSReferences(),t=await xY.listStreams(),r=[];for(let n of t){let s=[],i=await e.consumers.list(n.config.name);for await(let c of i)s.push({name:c.name,created:c.created,num_ack_pending:c.num_ack_pending,num_redelivered:c.num_redelivered,num_waiting:c.num_waiting,num_pending:c.num_pending});let o={stream_name:n.config.name,database:n.config.subjects[0].split(".")[1],table:n.config.subjects[0].split(".")[2],state:n.state,consumers:s};r.push(o)}return r}}a(kY,"getNatsStreamInfo");async function Epe(e){let t=new hpe;if(!Array.isArray(e.attributes)||e.attributes.length===0)return t.system=await VP(),t.time=kP(),t.cpu=await FP(),t.memory=await HP(),t.disk=await qP(),t.network=await $P(),t.harperdb_processes=await GP(),t.table_size=await KP(),t.metrics=await YP(),t.threads=await BY(),t.replication=await kY(),t;for(let r=0;r<e.attributes.length;r++)switch(e.attributes[r]){case"system":t.system=await VP();break;case"time":t.time=kP();break;case"cpu":t.cpu=await FP();break;case"memory":t.memory=await HP();break;case"disk":t.disk=await qP();break;case"network":t.network=await $P();break;case"harperdb_processes":t.harperdb_processes=await GP();break;case"table_size":t.table_size=await KP();break;case"database_metrics":case"metrics":t.metrics=await YP();break;case"threads":t.threads=await BY();break;case"replication":t.replication=await kY();break;default:break}return t}a(Epe,"systemInformation")});var Aa=M((OHe,$Y)=>{"use strict";var _pe=Jn(),WP=ae(),gpe=require("util"),_u=(H(),L(j)),HY=ce();HY.initSync();var Spe=WC(),GY=yn(),{Node:wHe,NodeSubscription:NHe}=Pf(),Tpe=$d(),ype=CY(),{RemotePayloadObject:Rpe,RemotePayloadSubscription:bpe}=Xh(),{handleHDBError:Ape,hdbErrors:Ipe}=Ee(),{HTTP_STATUS_CODES:wpe,HDB_ERROR_MSGS:Npe}=Ipe,Cpe=Oi(),Ope=Hc(),{packageJson:Ppe}=Et(),{getDatabases:Lpe}=(Ce(),L(ct)),CHe=gpe.promisify(Spe.authorize),Dpe=GY.searchByHash,vpe=GY.searchByValue;$Y.exports={isEmpty:Mpe,getNodeRecord:Upe,upsertNodeRecord:xpe,buildNodePayloads:Bpe,checkClusteringEnabled:kpe,getAllNodeRecords:Fpe,getSystemInfo:Hpe,reverseSubscription:qY};function Mpe(e){return e==null}a(Mpe,"isEmpty");async function Upe(e){let t=new Tpe(_u.SYSTEM_SCHEMA_NAME,_u.SYSTEM_TABLE_NAMES.NODE_TABLE_NAME,[e],["*"]);return Dpe(t)}a(Upe,"getNodeRecord");async function xpe(e){let t=new ype(_u.SYSTEM_SCHEMA_NAME,_u.SYSTEM_TABLE_NAMES.NODE_TABLE_NAME,[e]);return _pe.upsert(t)}a(xpe,"upsertNodeRecord");function qY(e){if(WP.isEmpty(e.subscribe)||WP.isEmpty(e.publish))throw new Error("Received invalid subscription object");let{schema:t,table:r,hash_attribute:n}=e,s={schema:t,table:r,hash_attribute:n};return e.subscribe===!0&&e.publish===!1?(s.subscribe=!1,s.publish=!0):e.subscribe===!1&&e.publish===!0?(s.subscribe=!0,s.publish=!1):(s.subscribe=e.subscribe,s.publish=e.publish),s}a(qY,"reverseSubscription");function Bpe(e,t,r,n){let s=[];for(let i=0,o=e.length;i<o;i++){let c=e[i],{schema:l,table:u}=c,d=WP.getTableHashAttribute(l,u),{subscribe:f,publish:m}=qY(c),p=Lpe()[l]?.[u],h=new bpe(l,u,d,m,f,c.start_time,p.schemaDefined?p.attributes:void 0);s.push(h)}return new Rpe(r,t,s,n)}a(Bpe,"buildNodePayloads");function kpe(){if(!HY.get(_u.CONFIG_PARAMS.CLUSTERING_ENABLED))throw Ape(new Error,Npe.CLUSTERING_NOT_ENABLED,wpe.BAD_REQUEST,void 0,void 0,!0)}a(kpe,"checkClusteringEnabled");async function Fpe(){let e=new Cpe(_u.SYSTEM_SCHEMA_NAME,_u.SYSTEM_TABLE_NAMES.NODE_TABLE_NAME,"name","*",void 0,["*"]);return Array.from(await vpe(e))}a(Fpe,"getAllNodeRecords");async function Hpe(){let e=await Ope.getSystemInformation();return{hdb_version:Ppe.version,node_version:e.node_version,platform:e.platform}}a(Hpe,"getSystemInfo")});var jP=M((LHe,QY)=>{"use strict";var py=dr(),VY=ae(),KY=Nt(),YY=(H(),L(j)),hy=Q(),WY=cy(),Gpe=sh(),{RemotePayloadObject:qpe}=Xh(),{handleHDBError:jY,hdbErrors:$pe}=Ee(),{HTTP_STATUS_CODES:zY}=$pe,{NodeSubscription:JY}=Pf();QY.exports=Vpe;async function Vpe(e,t){let r;try{r=await py.request(`${t}.${KY.REQUEST_SUFFIX}`,new qpe(YY.OPERATIONS_ENUM.DESCRIBE_ALL,t,void 0,void 0)),hy.trace("Response from remote describe all request:",r)}catch(o){hy.error(`addNode received error from describe all request to remote node: ${o}`);let c=py.requestErrorHandler(o,"add_node",t);throw jY(new Error,c,zY.INTERNAL_SERVER_ERROR,"error",c)}if(r.status===KY.UPDATE_REMOTE_RESPONSE_STATUSES.ERROR){let o=`Error returned from remote node ${t}: ${r.message}`;throw jY(new Error,o,zY.INTERNAL_SERVER_ERROR,"error",o)}let n=r.message,s=[],i=[];for(let o of e){let{table:c}=o,l=o.database??o.schema??"data";if(l===YY.SYSTEM_SCHEMA_NAME){await py.createLocalTableStream(l,c);let h=new JY(l,c,o.publish,o.subscribe);h.start_time=o.start_time,i.push(h);continue}let u=VY.doesSchemaExist(l),d=n[l]!==void 0,f=c?VY.doesTableExist(l,c):!0,m=c?n?.[l]?.[c]!==void 0:!0;if(!u&&!d||!f&&!m){s.push(o);continue}if(!u&&d&&(hy.trace(`addNode creating schema: ${l}`),await WY.createSchema({operation:"create_schema",schema:l})),!f&&m){hy.trace(`addNode creating table: ${c} in schema: ${l} with attributes ${JSON.stringify(n[l][c].attributes)}`);let h=new Gpe(l,c,n[l][c].hash_attribute);n[l][c].attributes&&(h.attributes=n[l][c].attributes),await WY.createTable(h)}await py.createLocalTableStream(l,c);let p=new JY(l,c,o.publish,o.subscribe);p.start_time=o.start_time,i.push(p)}return{added:i,skipped:s}}a(Vpe,"reviewSubscriptions")});var Df={};ye(Df,{addNodeBack:()=>zP,removeNodeBack:()=>JP,setNode:()=>jpe});async function jpe(e){e.node_name&&!e.hostname&&(e.hostname=e.node_name),e.verify_tls!==void 0&&(e.rejectUnauthorized=e.verify_tls);let{url:t,hostname:r}=e;t?r||(r=e.hostname=Ui(t)):t=ny(r);let n=(0,ZY.validateBySchema)(e,Wpe);if(n)throw(0,Ia.handleHDBError)(n,n.message,Ype.BAD_REQUEST,void 0,void 0,!0);if(e.operation==="remove_node"){if(!t&&!r)throw new Ia.ClientError("url or hostname is required for remove_node operation");let p=r,h=Gt(),E=await h.get(p);if(!E)throw new Ia.ClientError(p+" does not exist");try{await zh({url:E.url},{operation:V.REMOVE_NODE_BACK,name:E?.subscriptions?.length>0?st():p},void 0)}catch(_){Cs.warn(`Error removing node from target node ${p}, if it is offline and we be online in the future, you may need to clean up this node manually, or retry:`,_)}return await h.delete(p),`Successfully removed '${p}' from cluster`}if(!t)throw new Ia.ClientError("url required for this operation");let s=Lc();if(s==null)throw new Ia.ClientError("replication url is missing from harperdb-config.yaml");let i,o,c;if(t?.startsWith("wss:")){i=await(0,Zs.getReplicationCert)();let p=await(0,Zs.getReplicationCertAuth)();if(!i)throw new Error("Unable to find a certificate to use for replication");i.options.is_self_signed?(o=await(0,Zs.createCsr)(),Cs.info("Sending CSR to target node:",t)):p&&(c=p.certificate,Cs.info("Sending CA named",p.name,"to target node",t))}let l={operation:V.ADD_NODE_BACK,hostname:(0,qc.get)(x.REPLICATION_HOSTNAME),target_hostname:r,url:s,csr:o,cert_auth:c,authorization:e.retain_authorization?e.authorization:null};if((0,qc.get)(x.REPLICATION_SHARD)!==void 0&&(l.shard=(0,qc.get)(x.REPLICATION_SHARD)),e.subscriptions?l.subscriptions=e.subscriptions.map(XY):l.subscriptions=null,e.hasOwnProperty("subscribe")||e.hasOwnProperty("publish")){let p=XY(e);l.subscribe=p.subscribe,l.publish=p.publish}e?.authorization?.username&&e?.authorization?.password&&(e.authorization="Basic "+Buffer.from(e.authorization.username+":"+e.authorization.password).toString("base64"));let u,d;try{u=await zh({url:t},l,e)}catch(p){p.message=`Error returned from ${t}: `+p.message,Cs.warn("Error adding node:",t,"to cluster:",p),d=p}if(o&&(!u?.certificate||!u?.certificate?.includes?.("BEGIN CERTIFICATE")))throw d?(d.message+=" and connection was required to sign certificate",d):new Error(`Unexpected certificate signature response from node ${t} response: ${JSON.stringify(u)}`);o&&(Cs.info("CSR response received from node:",t,"saving certificate and CA in hdb_certificate"),await(0,Zs.setCertTable)({name:Kpe.certificateFromPem(u.signingCA).issuer.getField("CN").value,certificate:u.signingCA,is_authority:!0}),u.certificate&&await(0,Zs.setCertTable)({name:st(),uses:["https","operations","wss"],certificate:u.certificate,private_key_name:i?.options?.key_file,is_authority:!1,is_self_signed:!1}),c=u.signingCA);let f={url:t,ca:u?.usingCA};if(e.hostname&&(f.name=e.hostname),e.subscriptions?f.subscriptions=e.subscriptions:f.replicates=!0,e.start_time&&(f.start_time=typeof e.start_time=="string"?new Date(e.start_time).getTime():e.start_time),e.retain_authorization&&(f.authorization=e.authorization),e.revoked_certificates&&(f.revoked_certificates=e.revoked_certificates),u?.shard!==void 0?f.shard=u.shard:e.shard!==void 0&&(f.shard=e.shard),f.replicates){let p={url:s,ca:c,replicates:!0,subscriptions:null};(0,qc.get)(x.REPLICATION_SHARD)!==void 0&&(p.shard=(0,qc.get)(x.REPLICATION_SHARD)),e.retain_authorization&&(p.authorization=e.authorization),e.start_time&&(p.start_time=e.start_time),await ga(st(),p)}await ga(u?u.nodeName:f.name??Ui(t),f);let m;return e.operation==="update_node"?m=`Successfully updated '${t}'`:m=`Successfully added '${t}' to cluster`,d&&(m+=" but there was an error updating target node: "+d.message),m}async function zP(e){Cs.trace("addNodeBack received request:",e);let t=await(0,Zs.signCertificate)(e),r;e.csr?(r=t.signingCA,Cs.info("addNodeBack received CSR from node:",e.url,"this node will use and respond with CA that was used to issue CSR")):(r=e?.cert_auth,Cs.info("addNodeBack received CA from node:",e.url));let n={url:e.url,ca:r};e.subscriptions?n.subscriptions=e.subscriptions:(n.replicates=!0,n.subscriptions=null),e.start_time&&(n.start_time=e.start_time),e.authorization&&(n.authorization=e.authorization),e.shard!==void 0&&(n.shard=e.shard);let s=await(0,Zs.getReplicationCertAuth)();if(n.replicates){let i={url:Lc(),ca:s?.certificate,replicates:!0,subscriptions:null};(0,qc.get)(x.REPLICATION_SHARD)!==void 0&&(i.shard=(0,qc.get)(x.REPLICATION_SHARD),t.shard=i.shard),e.start_time&&(i.start_time=e.start_time),e.authorization&&(i.authorization=e.authorization),await ga(st(),i)}return await ga(e.hostname,n),t.nodeName=st(),t.usingCA=s?.certificate,Cs.info("addNodeBack responding to:",e.url,"with CA named:",s?.name),t}async function JP(e){Cs.trace("removeNodeBack received request:",e),await Gt().delete(e.name)}function XY(e){let{subscribe:t,publish:r}=e;return{...e,subscribe:r,publish:t}}var Zs,ZY,Gc,qc,Cs,Ia,Kpe,Ype,Wpe,vf=se(()=>{Zs=b(Cn()),ZY=b(ht()),Gc=b(require("joi")),qc=b(ce());H();Fh();mf();Zn();Cs=b(Q()),Ia=b(Ee()),{pki:Kpe}=require("node-forge"),{HTTP_STATUS_CODES:Ype}=Ia.hdbErrors,Wpe=Gc.default.object({hostname:Gc.default.string(),verify_tls:Gc.default.boolean(),replicates:Gc.default.boolean(),subscriptions:Gc.default.array(),revoked_certificates:Gc.default.array(),shard:Gc.default.number()});a(jpe,"setNode");a(zP,"addNodeBack");a(JP,"removeNodeBack");a(XY,"reverseSubscription")});var Mf=M((HHe,tW)=>{"use strict";var{handleHDBError:Ey,hdbErrors:zpe}=Ee(),{HTTP_STATUS_CODES:_y}=zpe,{addUpdateNodeValidator:Jpe}=fy(),gy=Q(),Sy=(H(),L(j)),eW=Nt(),Qpe=ae(),eE=dr(),tE=Aa(),QP=ce(),Xpe=jP(),{Node:Zpe,NodeSubscription:ehe}=Pf(),{broadcast:the}=rt(),{setNode:rhe}=(vf(),L(Df)),kHe=ce(),FHe=(H(),L(j)),nhe="Unable to create subscriptions due to schema and/or tables not existing on the local or remote node",she="Some subscriptions were unsuccessful due to schema and/or tables not existing on the local or remote node",ihe=QP.get(Sy.CONFIG_PARAMS.CLUSTERING_NODENAME);tW.exports=ohe;async function ohe(e,t=!1){if(gy.trace("addNode called with:",e),QP.get(Sy.CONFIG_PARAMS.REPLICATION_URL)||QP.get(Sy.CONFIG_PARAMS.REPLICATION_HOSTNAME))return rhe(e);tE.checkClusteringEnabled();let r=Jpe(e);if(r)throw Ey(r,r.message,_y.BAD_REQUEST,void 0,void 0,!0);let n=e.node_name;if(!t){let f=await tE.getNodeRecord(n);if(!Qpe.isEmptyOrZeroLength(f))throw Ey(new Error,`Node '${n}' has already been added, perform update_node to proceed.`,_y.BAD_REQUEST,void 0,void 0,!0)}let{added:s,skipped:i}=await Xpe(e.subscriptions,n),o={message:void 0,added:s,skipped:i};if(s.length===0)return o.message=nhe,o;let c=tE.buildNodePayloads(s,ihe,Sy.OPERATIONS_ENUM.ADD_NODE,await tE.getSystemInfo()),l=[];for(let f=0,m=s.length;f<m;f++){let p=s[f];s[f].start_time===void 0&&delete s[f].start_time,l.push(new ehe(p.schema,p.table,p.publish,p.subscribe))}gy.trace("addNode sending remote payload:",c);let u;try{u=await eE.request(`${n}.${eW.REQUEST_SUFFIX}`,c)}catch(f){gy.error(`addNode received error from request: ${f}`);for(let p=0,h=s.length;p<h;p++){let E=s[p];E.publish=!1,E.subscribe=!1,await eE.updateRemoteConsumer(E,n)}let m=eE.requestErrorHandler(f,"add_node",n);throw Ey(new Error,m,_y.INTERNAL_SERVER_ERROR,"error",m)}if(u.status===eW.UPDATE_REMOTE_RESPONSE_STATUSES.ERROR){let f=`Error returned from remote node ${n}: ${u.message}`;throw Ey(new Error,f,_y.INTERNAL_SERVER_ERROR,"error",f)}gy.trace(u);for(let f=0,m=s.length;f<m;f++){let p=s[f];await eE.updateRemoteConsumer(p,n),p.subscribe===!0&&await eE.updateConsumerIterator(p.schema,p.table,n,"start")}let d=new Zpe(n,l,u.system_info);return await tE.upsertNodeRecord(d),the({type:"nats_update"}),i.length>0?o.message=she:o.message=`Successfully added '${n}' to manifest`,o}a(ohe,"addNode")});var tL=M(($He,nW)=>{"use strict";var{handleHDBError:XP,hdbErrors:ahe}=Ee(),{HTTP_STATUS_CODES:ZP}=ahe,{addUpdateNodeValidator:che}=fy(),rE=Q(),Ty=(H(),L(j)),rW=Nt(),qHe=ae(),nE=dr(),sE=Aa(),eL=ce(),{cloneDeep:lhe}=require("lodash"),uhe=jP(),{Node:dhe,NodeSubscription:fhe}=Pf(),{broadcast:mhe}=rt(),{setNode:phe}=(vf(),L(Df)),hhe="Unable to update subscriptions due to schema and/or tables not existing on the local or remote node",Ehe="Some subscriptions were unsuccessful due to schema and/or tables not existing on the local or remote node",_he=eL.get(Ty.CONFIG_PARAMS.CLUSTERING_NODENAME);nW.exports=ghe;async function ghe(e){if(rE.trace("updateNode called with:",e),eL.get(Ty.CONFIG_PARAMS.REPLICATION_URL)??eL.get(Ty.CONFIG_PARAMS.REPLICATION_HOSTNAME))return phe(e);sE.checkClusteringEnabled();let t=che(e);if(t)throw XP(t,t.message,ZP.BAD_REQUEST,void 0,void 0,!0);let r=e.node_name,n,s=await sE.getNodeRecord(r);s.length>0&&(n=lhe(s));let{added:i,skipped:o}=await uhe(e.subscriptions,r),c={message:void 0,updated:i,skipped:o};if(i.length===0)return c.message=hhe,c;let l=sE.buildNodePayloads(i,_he,Ty.OPERATIONS_ENUM.UPDATE_NODE,await sE.getSystemInfo());for(let d=0,f=i.length;d<f;d++){let m=i[d];rE.trace(`updateNode updating work stream for node: ${r} subscription:`,m),i[d].start_time===void 0&&delete i[d].start_time}rE.trace("updateNode sending remote payload:",l);let u;try{u=await nE.request(`${r}.${rW.REQUEST_SUFFIX}`,l)}catch(d){rE.error(`updateNode received error from request: ${d}`);let f=nE.requestErrorHandler(d,"update_node",r);throw XP(new Error,f,ZP.INTERNAL_SERVER_ERROR,"error",f)}if(u.status===rW.UPDATE_REMOTE_RESPONSE_STATUSES.ERROR){let d=`Error returned from remote node ${r}: ${u.message}`;throw XP(new Error,d,ZP.INTERNAL_SERVER_ERROR,"error",d)}rE.trace(u);for(let d=0,f=i.length;d<f;d++){let m=i[d];await nE.updateRemoteConsumer(m,r),m.subscribe===!0?await nE.updateConsumerIterator(m.schema,m.table,r,"start"):await nE.updateConsumerIterator(m.schema,m.table,r,"stop")}return n||(n=[new dhe(r,[],u.system_info)]),await She(n[0],i,u.system_info),o.length>0?c.message=Ehe:c.message=`Successfully updated '${r}'`,c}a(ghe,"updateNode");async function She(e,t,r){let n=e;for(let s=0,i=t.length;s<i;s++){let o=t[s],c=!1;for(let l=0,u=e.subscriptions.length;l<u;l++){let d=n.subscriptions[l];if(d.schema===o.schema&&d.table===o.table){d.publish=o.publish,d.subscribe=o.subscribe,c=!0;break}}c||n.subscriptions.push(new fhe(o.schema,o.table,o.publish,o.subscribe))}n.system_info=r,await sE.upsertNodeRecord(n),mhe({type:"nats_update"})}a(She,"updateNodeTable")});var cW=M((KHe,aW)=>{"use strict";var oW=require("joi"),{string:sW}=oW.types(),The=ht(),iW=(H(),L(j)),yhe=ce(),Rhe=Nt();aW.exports=bhe;function bhe(e){let t=sW.invalid(yhe.get(iW.CONFIG_PARAMS.CLUSTERING_NODENAME)).pattern(Rhe.NATS_TERM_CONSTRAINTS_RX).messages({"string.pattern.base":"{:#label} invalid, must not contain ., * or >","any.invalid":"'node_name' cannot be this nodes name"}).empty(null),r=oW.object({operation:sW.valid(iW.OPERATIONS_ENUM.REMOVE_NODE).required(),node_name:t});return The.validateBySchema(e,r)}a(bhe,"removeNodeValidator")});var yy=M((WHe,mW)=>{"use strict";var{handleHDBError:lW,hdbErrors:Ahe}=Ee(),{HTTP_STATUS_CODES:uW}=Ahe,Ihe=cW(),iE=Q(),dW=Aa(),whe=ae(),Uf=(H(),L(j)),fW=Nt(),rL=dr(),nL=ce(),{RemotePayloadObject:Nhe}=Xh(),{NodeSubscription:Che}=Pf(),Ohe=nh(),Phe=kl(),{broadcast:Lhe}=rt(),{setNode:Dhe}=(vf(),L(Df)),vhe=nL.get(Uf.CONFIG_PARAMS.CLUSTERING_NODENAME);mW.exports=Mhe;async function Mhe(e){if(iE.trace("removeNode called with:",e),nL.get(Uf.CONFIG_PARAMS.REPLICATION_URL)??nL.get(Uf.CONFIG_PARAMS.REPLICATION_HOSTNAME))return Dhe(e);dW.checkClusteringEnabled();let t=Ihe(e);if(t)throw lW(t,t.message,uW.BAD_REQUEST,void 0,void 0,!0);let r=e.node_name,n=await dW.getNodeRecord(r);if(whe.isEmptyOrZeroLength(n))throw lW(new Error,`Node '${r}' was not found.`,uW.BAD_REQUEST,void 0,void 0,!0);n=n[0];let s=new Nhe(Uf.OPERATIONS_ENUM.REMOVE_NODE,vhe,[]),i,o=!1;for(let l=0,u=n.subscriptions.length;l<u;l++){let d=n.subscriptions[l];d.subscribe===!0&&await rL.updateConsumerIterator(d.schema,d.table,r,"stop");try{await rL.updateRemoteConsumer(new Che(d.schema,d.table,!1,!1),r)}catch(f){iE.error(f)}}try{i=await rL.request(`${r}.${fW.REQUEST_SUFFIX}`,s),iE.trace("Remove node reply from remote node:",r,i)}catch(l){iE.error("removeNode received error from request:",l),o=!0}let c=new Ohe(Uf.SYSTEM_SCHEMA_NAME,Uf.SYSTEM_TABLE_NAMES.NODE_TABLE_NAME,[r]);return await Phe.deleteRecord(c),Lhe({type:"nats_update"}),i?.status===fW.UPDATE_REMOTE_RESPONSE_STATUSES.ERROR||o?(iE.error("Error returned from remote node:",r,i?.message),`Successfully removed '${r}' from local manifest, however there was an error reaching remote node. Check the logs for more details.`):`Successfully removed '${r}' from manifest`}a(Mhe,"removeNode")});var EW=M((zHe,hW)=>{"use strict";var pW=require("joi"),{string:Uhe,array:xhe}=pW.types(),Bhe=ht(),khe=fy();hW.exports=Fhe;function Fhe(e){let t=pW.object({operation:Uhe.valid("configure_cluster").required(),connections:xhe.items(khe.validationSchema).required()});return Bhe.validateBySchema(e,t)}a(Fhe,"configureClusterValidator")});var sL=M((QHe,yW)=>{"use strict";var _W=(H(),L(j)),Ry=Q(),Hhe=ae(),Ghe=ce(),qhe=yy(),$he=Mf(),Vhe=Aa(),Khe=EW(),{handleHDBError:gW,hdbErrors:Yhe}=Ee(),{HTTP_STATUS_CODES:SW}=Yhe,Whe="Configure cluster complete.",jhe="Failed to configure the cluster. Check the logs for more details.",zhe="Configure cluster was partially successful. Errors occurred when attempting to configure the following nodes. Check the logs for more details.";yW.exports=Jhe;async function Jhe(e){Ry.trace("configure cluster called with:",e);let t=Khe(e);if(t)throw gW(t,t.message,SW.BAD_REQUEST,void 0,void 0,!0);let r=await Vhe.getAllNodeRecords(),n=[];if(Ghe.get(_W.CONFIG_PARAMS.CLUSTERING_ENABLED)){for(let d=0,f=r.length;d<f;d++){let m=await TW(qhe,{operation:_W.OPERATIONS_ENUM.REMOVE_NODE,node_name:r[d].name},r[d].name);n.push(m)}Ry.trace("All results from configure_cluster remove node:",n)}let s=[],i=e.connections.length;for(let d=0;d<i;d++){let f=e.connections[d],m=await TW($he,f,f.node_name);s.push(m)}Ry.trace("All results from configure_cluster add node:",s);let o=[],c=[],l=!1,u=n.concat(s);for(let d=0,f=u.length;d<f;d++){let m=u[d];m.status==="rejected"&&(Ry.error(m.node_name,m?.error?.message,m?.error?.stack),o.includes(m.node_name)||o.push(m.node_name)),(m?.result?.message?.includes?.("Successfully")||m?.result?.includes?.("Successfully"))&&(l=!0),!(typeof m.result=="string"&&m.result.includes("Successfully removed")||m.status==="rejected")&&c.push({node_name:m?.node_name,response:m?.result})}if(Hhe.isEmptyOrZeroLength(o))return{message:Whe,connections:c};if(l)return{message:zhe,failed_nodes:o,connections:c};throw gW(new Error,jhe,SW.INTERNAL_SERVER_ERROR,void 0,void 0,!0)}a(Jhe,"configureCluster");async function TW(e,t,r){try{return{node_name:r,result:await e(t)}}catch(n){return{node_name:r,error:n,status:"rejected"}}}a(TW,"functionWrapper")});var IW=M((ZHe,AW)=>{"use strict";var oE=require("joi"),Qhe=ht(),{validateSchemaExists:RW,validateTableExists:Xhe,validateSchemaName:bW}=lo(),Zhe=oE.object({operation:oE.string().valid("purge_stream"),schema:oE.string().custom(RW).custom(bW).optional(),database:oE.string().custom(RW).custom(bW).optional(),table:oE.string().custom(Xhe).required()});function eEe(e){return Qhe.validateBySchema(e,Zhe)}a(eEe,"purgeStreamValidator");AW.exports=eEe});var iL=M((tGe,wW)=>{"use strict";var{handleHDBError:tEe,hdbErrors:rEe}=Ee(),{HTTP_STATUS_CODES:nEe}=rEe,sEe=IW(),iEe=dr(),oEe=Aa();wW.exports=aEe;async function aEe(e){e.schema=e.schema??e.database;let t=sEe(e);if(t)throw tEe(t,t.message,nEe.BAD_REQUEST,void 0,void 0,!0);oEe.checkClusteringEnabled();let{schema:r,table:n,options:s}=e;return await iEe.purgeTableStream(r,n,s),`Successfully purged table '${r}.${n}'`}a(aEe,"purgeStream")});var aE=M((nGe,MW)=>{"use strict";var aL=Aa(),cEe=dr(),Ay=ce(),xf=(H(),L(j)),gu=Nt(),lEe=ae(),oL=Q(),{RemotePayloadObject:uEe}=Xh(),{ErrorCode:NW}=require("nats"),{parentPort:CW}=require("worker_threads"),{onMessageByType:dEe}=rt(),{getThisNodeName:fEe}=(Zn(),L(Io)),{requestClusterStatus:mEe}=(Fh(),L(R1)),{getReplicationSharedStatus:pEe,getHDBNodeTable:hEe}=(mf(),L(h1)),{CONFIRMATION_STATUS_POSITION:EEe,RECEIVED_VERSION_POSITION:OW,RECEIVED_TIME_POSITION:_Ee,SENDING_TIME_POSITION:gEe,RECEIVING_STATUS_POSITION:SEe,RECEIVING_STATUS_RECEIVING:TEe,BACK_PRESSURE_RATIO_POSITION:yEe}=(ZO(),L(fK)),PW=Ay.get(xf.CONFIG_PARAMS.CLUSTERING_ENABLED),LW=Ay.get(xf.CONFIG_PARAMS.CLUSTERING_NODENAME);MW.exports={clusterStatus:REe,buildNodeStatus:vW};var DW;dEe("cluster-status",async e=>{DW(e)});async function REe(){if(Ay.get(xf.CONFIG_PARAMS.REPLICATION_URL)||Ay.get(xf.CONFIG_PARAMS.REPLICATION_HOSTNAME)){let n;CW?(CW.postMessage({type:"request-cluster-status"}),n=await new Promise(i=>{DW=i})):n=mEe();for(let i of n.connections){let o=i.name;for(let c of i.database_sockets){let l=c.database,u;for(let f of Object.values(databases[l]||{}))if(u=f.auditStore,u)break;if(!u)continue;let d=pEe(u,l,o);c.lastCommitConfirmed=by(d[EEe]),c.lastReceivedRemoteTime=by(d[OW]),c.lastReceivedLocalTime=by(d[_Ee]),c.lastReceivedVersion=d[OW],c.sendingMessage=by(d[gEe]),c.backPressurePercent=d[yEe]*100,c.lastReceivedStatus=d[SEe]===TEe?"Receiving":"Waiting"}}n.node_name=fEe();let s=hEe().primaryStore.get(n.node_name);return s?.shard&&(n.shard=s.shard),s?.url&&(n.url=s.url),n.is_enabled=!0,n}let e={node_name:LW,is_enabled:PW,connections:[]};if(!PW)return e;let t=await aL.getAllNodeRecords();if(lEe.isEmptyOrZeroLength(t))return e;let r=[];for(let n=0,s=t.length;n<s;n++)r.push(vW(t[n],e.connections));return await Promise.allSettled(r),e}a(REe,"clusterStatus");function by(e){return e?e===1?"Copying":new Date(e).toUTCString():void 0}a(by,"asDate");async function vW(e,t){let r=e.name,n=new uEe(xf.OPERATIONS_ENUM.CLUSTER_STATUS,LW,void 0,await aL.getSystemInfo()),s,i,o=gu.CLUSTER_STATUS_STATUSES.OPEN;try{let l=Date.now();s=await cEe.request(gu.REQUEST_SUBJECT(r),n),i=Date.now()-l,s.status===gu.UPDATE_REMOTE_RESPONSE_STATUSES.ERROR&&(o=gu.CLUSTER_STATUS_STATUSES.CLOSED,oL.error(`Error getting node status from ${r} `,s))}catch(l){oL.warn(`Error getting node status from ${r}`,l),l.code===NW.NoResponders?o=gu.CLUSTER_STATUS_STATUSES.NO_RESPONDERS:l.code===NW.Timeout?o=gu.CLUSTER_STATUS_STATUSES.TIMEOUT:o=gu.CLUSTER_STATUS_STATUSES.CLOSED}let c=new bEe(r,o,s?.message?.ports?.clustering,s?.message?.ports?.operations_api,i,s?.message?.uptime,e.subscriptions,s?.message?.system_info);try{let l={name:r,system_info:s?.message?.system_info};e.system_info?.hdb_version!==xf.PRE_4_0_0_VERSION&&await aL.upsertNodeRecord(l)}catch(l){oL.error("Cluster status encountered an error updating system info for node:",r,l)}t.push(c)}a(vW,"buildNodeStatus");function bEe(e,t,r,n,s,i,o,c){this.node_name=e,this.status=t,this.ports={clustering:r,operations_api:n},this.latency_ms=s,this.uptime=i,this.subscriptions=o,this.system_info=c}a(bEe,"NodeStatusObject")});var wy=M((iGe,UW)=>{"use strict";var{handleHDBError:AEe,hdbErrors:IEe}=Ee(),{HTTP_STATUS_CODES:wEe}=IEe,NEe=dr(),CEe=Aa(),cL=ae(),Iy=require("joi"),OEe=ht(),PEe=2e3,LEe=Iy.object({timeout:Iy.number().min(1),connected_nodes:Iy.boolean(),routes:Iy.boolean()});UW.exports=DEe;async function DEe(e){CEe.checkClusteringEnabled();let t=OEe.validateBySchema(e,LEe);if(t)throw AEe(t,t.message,wEe.BAD_REQUEST,void 0,void 0,!0);let{timeout:r,connected_nodes:n,routes:s}=e,i=n===void 0||cL.autoCastBoolean(n),o=s===void 0||cL.autoCastBoolean(s),c={nodes:[]},l=await NEe.getServerList(r??PEe),u={};if(i)for(let d=0,f=l.length;d<f;d++){let m=l[d].statsz;m&&(u[l[d].server.name]=m.routes)}for(let d=0,f=l.length;d<f;d++){if(l[d].statsz)continue;let m=l[d].server,p=l[d].data;if(m.name.endsWith("-hub")){let h={name:m.name.slice(0,-4),response_time:l[d].response_time};i&&(h.connected_nodes=[],u[m.name]&&u[m.name].forEach(E=>{h.connected_nodes.includes(E.name.slice(0,-4))||h.connected_nodes.push(E.name.slice(0,-4))})),o&&(h.routes=p.cluster?.urls?p.cluster?.urls.map(E=>({host:E.split(":")[0],port:cL.autoCast(E.split(":")[1])})):[]),c.nodes.push(h)}}return c}a(DEe,"clusterNetwork")});var FW=M((aGe,kW)=>{"use strict";var lL=require("joi"),xW=ht(),{routeConstraints:BW}=Hw();kW.exports={setRoutesValidator:vEe,deleteRoutesValidator:MEe};function vEe(e){let t=lL.object({server:lL.valid("hub","leaf"),routes:BW.required()});return xW.validateBySchema(e,t)}a(vEe,"setRoutesValidator");function MEe(e){let t=lL.object({routes:BW.required()});return xW.validateBySchema(e,t)}a(MEe,"deleteRoutesValidator")});var Ny=M((lGe,YW)=>{"use strict";var wa=_t(),uL=ae(),ei=(H(),L(j)),Bf=ce(),HW=FW(),{handleHDBError:GW,hdbErrors:UEe}=Ee(),{HTTP_STATUS_CODES:qW}=UEe,$W="cluster routes successfully set",VW="cluster routes successfully deleted";YW.exports={setRoutes:BEe,getRoutes:kEe,deleteRoutes:FEe};function xEe(e){let t=wa.getClusteringRoutes(),r=e.server==="hub"?t.hub_routes:t.leaf_routes,n=e.server==="hub"?t.leaf_routes:t.hub_routes,s=[],i=[];for(let o=0,c=e.routes.length;o<c;o++){let l=e.routes[o];l.port=uL.autoCast(l.port);let u=r.some(f=>f.host===l.host&&f.port===l.port),d=n.some(f=>f.host===l.host&&f.port===l.port);u||d?s.push(l):(r.push(l),i.push(l))}return e.server==="hub"?wa.updateConfigValue(ei.CONFIG_PARAMS.CLUSTERING_HUBSERVER_CLUSTER_NETWORK_ROUTES,r):wa.updateConfigValue(ei.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_NETWORK_ROUTES,r),{message:$W,set:i,skipped:s}}a(xEe,"setRoutesNats");function BEe(e){let t=HW.setRoutesValidator(e);if(t)throw GW(t,t.message,qW.BAD_REQUEST,void 0,void 0,!0);if(Bf.get(ei.CONFIG_PARAMS.CLUSTERING_ENABLED))return xEe(e);let r=[],n=[],s=Bf.get(ei.CONFIG_PARAMS.REPLICATION_ROUTES)??[];return e.routes.forEach(i=>{KW(s,i)?n.push(i):(s.push(i),r.push(i))}),wa.updateConfigValue(ei.CONFIG_PARAMS.REPLICATION_ROUTES,s),{message:$W,set:r,skipped:n}}a(BEe,"setRoutes");function KW(e,t){return typeof t=="string"?e.includes(t):typeof t=="object"&&t!==null?e.some(r=>(r.host===t.host||r.hostname===t.hostname)&&r.port===t.port):!1}a(KW,"existsInArray");function kEe(){if(Bf.get(ei.CONFIG_PARAMS.CLUSTERING_ENABLED)){let e=wa.getClusteringRoutes();return{hub:e.hub_routes,leaf:e.leaf_routes}}else return Bf.get(ei.CONFIG_PARAMS.REPLICATION_ROUTES)??[]}a(kEe,"getRoutes");function FEe(e){let t=HW.deleteRoutesValidator(e);if(t)throw GW(t,t.message,qW.BAD_REQUEST,void 0,void 0,!0);if(Bf.get(ei.CONFIG_PARAMS.CLUSTERING_ENABLED))return HEe(e);let r=[],n=[],s=Bf.get(ei.CONFIG_PARAMS.REPLICATION_ROUTES)??[],i=[];return s.forEach(o=>{KW(e.routes,o)?r.push(o):(i.push(o),n.push(o))}),wa.updateConfigValue(ei.CONFIG_PARAMS.REPLICATION_ROUTES,i),{message:VW,deleted:r,skipped:n}}a(FEe,"deleteRoutes");function HEe(e){let t=wa.getClusteringRoutes(),r=t.hub_routes,n=t.leaf_routes,s=[],i=[],o=!1,c=!1;for(let l=0,u=e.routes.length;l<u;l++){let d=e.routes[l],f=!1;for(let m=0,p=r.length;m<p;m++){let h=r[m];if(d.host===h.host&&d.port===h.port){r.splice(m,1),f=!0,o=!0,s.push(d);break}}if(!f){let m=!0;for(let p=0,h=n.length;p<h;p++){let E=n[p];if(d.host===E.host&&d.port===E.port){n.splice(p,1),c=!0,m=!1,s.push(d);break}}m&&i.push(d)}}return o&&(r=uL.isEmptyOrZeroLength(r)?null:r,wa.updateConfigValue(ei.CONFIG_PARAMS.CLUSTERING_HUBSERVER_CLUSTER_NETWORK_ROUTES,r)),c&&(n=uL.isEmptyOrZeroLength(n)?null:n,wa.updateConfigValue(ei.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_NETWORK_ROUTES,n)),{message:VW,deleted:s,skipped:i}}a(HEe,"deleteRoutesNats")});var jW=M((dGe,WW)=>{"use strict";var GEe=Nt(),dL=class{static{a(this,"HubConfigObject")}constructor(t,r,n,s,i,o,c,l,u,d,f,m,p,h){this.port=t,o===null&&(o=void 0),this.server_name=r+GEe.SERVER_SUFFIX.HUB,this.pid_file=n,this.max_payload=67108864,this.reconnect_error_reports=100,this.jetstream={enabled:!1},this.tls={cert_file:s,key_file:i,ca_file:o,insecure:c,verify:l},this.leafnodes={port:u,tls:{cert_file:s,key_file:i,ca_file:o,insecure:c}},this.cluster={name:d,port:f,routes:m,tls:{cert_file:s,key_file:i,ca_file:o,insecure:c,verify:l}},this.accounts={SYS:{users:p},HDB:{users:h}},this.system_account="SYS"}};WW.exports=dL});var QW=M((mGe,JW)=>{"use strict";var zW=Nt(),fL=class{static{a(this,"LeafConfigObject")}constructor(t,r,n,s,i,o,c,l,u,d,f){this.port=t,f===null&&(f=void 0),this.server_name=r+zW.SERVER_SUFFIX.LEAF,this.pid_file=n,this.max_payload=67108864,this.jetstream={enabled:!0,store_dir:s,domain:r+zW.SERVER_SUFFIX.LEAF},this.tls={cert_file:u,key_file:d,ca_file:f,insecure:!0},this.leafnodes={remotes:[{tls:{ca_file:f,insecure:!0},urls:i,account:"SYS"},{tls:{ca_file:f,insecure:!0},urls:o,account:"HDB"}]},this.accounts={SYS:{users:c},HDB:{users:l,jetstream:"enabled"}},this.system_account="SYS"}};JW.exports=fL});var ZW=M((hGe,XW)=>{"use strict";var mL=class{static{a(this,"HdbUserObject")}constructor(t,r){this.user=t,this.password=r}};XW.exports=mL});var tj=M((_Ge,ej)=>{"use strict";var qEe=Nt(),pL=class{static{a(this,"SysUserObject")}constructor(t,r){this.user=t+qEe.SERVER_SUFFIX.ADMIN,this.password=r}};ej.exports=pL});var Ly=M((SGe,sj)=>{"use strict";var Su=require("path"),Tu=require("fs-extra"),$Ee=jW(),VEe=QW(),KEe=ZW(),YEe=tj(),hL=(zn(),L(Ci)),Ff=ae(),ts=_t(),Oy=(H(),L(j)),cE=Nt(),{CONFIG_PARAMS:fr}=Oy,Hf=Q(),lE=ce(),rj=po(),EL=dr(),WEe=Cn(),kf="clustering",jEe=1e4,nj=50;sj.exports={generateNatsConfig:JEe,removeNatsConfig:QEe,getHubConfigPath:zEe};function zEe(){let e=lE.get(fr.ROOTPATH);return Su.join(e,kf,cE.NATS_CONFIG_FILES.HUB_SERVER)}a(zEe,"getHubConfigPath");async function JEe(e=!1,t=void 0){console.error("Warning: NATS replication is deprecated and will be removed in version 5.0 of Harper");let r=lE.get(fr.ROOTPATH);Tu.ensureDirSync(Su.join(r,"clustering","leaf")),lE.initSync();let n=ts.getConfigFromFile(fr.CLUSTERING_TLS_CERT_AUTH),s=ts.getConfigFromFile(fr.CLUSTERING_TLS_PRIVATEKEY),i=ts.getConfigFromFile(fr.CLUSTERING_TLS_CERTIFICATE);!await Tu.exists(i)&&!await Tu.exists(!n)&&await WEe.createNatsCerts();let o=Su.join(r,kf,cE.PID_FILES.HUB),c=Su.join(r,kf,cE.PID_FILES.LEAF),l=ts.getConfigFromFile(fr.CLUSTERING_LEAFSERVER_STREAMS_PATH),u=Su.join(r,kf,cE.NATS_CONFIG_FILES.HUB_SERVER),d=Su.join(r,kf,cE.NATS_CONFIG_FILES.LEAF_SERVER),f=ts.getConfigFromFile(fr.CLUSTERING_TLS_INSECURE),m=ts.getConfigFromFile(fr.CLUSTERING_TLS_VERIFY),p=ts.getConfigFromFile(fr.CLUSTERING_NODENAME),h=ts.getConfigFromFile(fr.CLUSTERING_HUBSERVER_LEAFNODES_NETWORK_PORT);await EL.checkNATSServerInstalled()||Py("nats-server dependency is either missing or the wrong version. Run 'npm install' to fix");let E=await hL.listUsers(),_=ts.getConfigFromFile(fr.CLUSTERING_USER),R=await hL.getClusterUser();(Ff.isEmpty(R)||R.active!==!0)&&Py(`Invalid cluster user '${_}'. A valid user with the role 'cluster_user' must be defined under clustering.user in harperdb-config.yaml`),e||(await Cy(fr.CLUSTERING_HUBSERVER_CLUSTER_NETWORK_PORT),await Cy(fr.CLUSTERING_HUBSERVER_LEAFNODES_NETWORK_PORT),await Cy(fr.CLUSTERING_HUBSERVER_NETWORK_PORT),await Cy(fr.CLUSTERING_LEAFSERVER_NETWORK_PORT));let S=[],y=[];for(let[z,Y]of E.entries())Y.role?.role===Oy.ROLE_TYPES_ENUM.CLUSTER_USER&&Y.active&&(S.push(new YEe(Y.username,rj.decrypt(Y.hash))),y.push(new KEe(Y.username,rj.decrypt(Y.hash))));let w=[],{hub_routes:I}=ts.getClusteringRoutes();if(!Ff.isEmptyOrZeroLength(I))for(let z of I)w.push(`tls://${R.sys_name_encoded}:${R.uri_encoded_d_hash}@${z.host}:${z.port}`);let G=new $Ee(ts.getConfigFromFile(fr.CLUSTERING_HUBSERVER_NETWORK_PORT),p,o,i,s,n,f,m,h,ts.getConfigFromFile(fr.CLUSTERING_HUBSERVER_CLUSTER_NAME),ts.getConfigFromFile(fr.CLUSTERING_HUBSERVER_CLUSTER_NETWORK_PORT),w,S,y);n==null&&(delete G.tls.ca_file,delete G.leafnodes.tls.ca_file),t=Ff.isEmpty(t)?void 0:t.toLowerCase(),(t===void 0||t===Oy.PROCESS_DESCRIPTORS.CLUSTERING_HUB.toLowerCase())&&(await Tu.writeJson(u,G),Hf.trace(`Hub server config written to ${u}`));let X=`tls://${R.sys_name_encoded}:${R.uri_encoded_d_hash}@0.0.0.0:${h}`,q=`tls://${R.uri_encoded_name}:${R.uri_encoded_d_hash}@0.0.0.0:${h}`,F=new VEe(ts.getConfigFromFile(fr.CLUSTERING_LEAFSERVER_NETWORK_PORT),p,c,l,[X],[q],S,y,i,s,n,f);n==null&&delete F.tls.ca_file,(t===void 0||t===Oy.PROCESS_DESCRIPTORS.CLUSTERING_LEAF.toLowerCase())&&(await Tu.writeJson(d,F),Hf.trace(`Leaf server config written to ${d}`))}a(JEe,"generateNatsConfig");async function Cy(e){let t=lE.get(e);return Ff.isEmpty(t)&&Py(`port undefined for '${e}'`),await Ff.isPortTaken(t)&&Py(`'${e}' port '${t}' is is in use by another process, check to see if HarperDB is already running or another process is using this port.`),!0}a(Cy,"isPortAvailable");function Py(e){let t=`Error generating clustering config: ${e}`;Hf.error(t),console.error(t),process.exit(1)}a(Py,"generateNatsConfigError");async function QEe(e){let{port:t,config_file:r}=EL.getServerConfig(e),{username:n,decrypt_hash:s}=await hL.getClusterUser(),i=0,o=2e3;for(;i<nj;){try{let d=await EL.createConnection(t,n,s,!1);if(d.protocol.connected===!0){d.close();break}}catch(d){Hf.trace(`removeNatsConfig waiting for ${e}. Caught and swallowed error ${d}`)}if(i++,i>=nj)throw new Error(`Operations API timed out attempting to connect to ${e}. This is commonly caused by incorrect clustering config. Check hdb.log for further details.`);let u=o*(i*2);u>3e4&&Hf.notify("Operations API waiting for Nats server connection. This could be caused by large Nats streams or incorrect clustering config."),await Ff.asyncSetTimeout(u)}let c="0".repeat(jEe),l=Su.join(lE.get(fr.ROOTPATH),kf,r);await Tu.writeFile(l,c),await Tu.remove(l),Hf.notify(e,"started.")}a(QEe,"removeNatsConfig")});var uj=M((yGe,lj)=>{"use strict";var Os=ce(),tt=(H(),L(j)),uE=Nt(),Na=require("path"),{PACKAGE_ROOT:vy}=Et(),ij=ce(),Dy=ae(),Gf="/dev/null",XEe=Na.join(vy,"launchServiceScripts"),oj=Na.join(vy,"utility/scripts"),ZEe=Na.join(oj,tt.HDB_RESTART_SCRIPT),aj=Na.resolve(vy,"dependencies",`${process.platform}-${process.arch}`,uE.NATS_BINARY_NAME);function cj(){let e={[tt.PROCESS_NAME_ENV_PROP]:tt.PROCESS_DESCRIPTORS.HDB,IS_SCRIPTED_SERVICE:!0,...process.env};return Dy.noBootFile()&&(e[tt.CONFIG_PARAMS.ROOTPATH.toUpperCase()]=Dy.getEnvCliRootPath()),{name:tt.PROCESS_DESCRIPTORS.HDB,script:tt.LAUNCH_SERVICE_SCRIPTS.MAIN,exec_mode:"fork",env:e,execArgv:process.execArgv,cwd:vy}}a(cj,"generateMainServerConfig");var e_e=9930;function t_e(){Os.initSync(!0);let e=Os.get(tt.CONFIG_PARAMS.ROOTPATH),t=Na.join(e,"clustering",uE.NATS_CONFIG_FILES.HUB_SERVER),r=Na.join(Os.get(tt.HDB_SETTINGS_NAMES.LOG_PATH_KEY),tt.LOG_NAMES.HDB),n=ij.get(tt.CONFIG_PARAMS.CLUSTERING_HUBSERVER_NETWORK_PORT),s=uE.LOG_LEVEL_FLAGS[Os.get(tt.CONFIG_PARAMS.CLUSTERING_LOGLEVEL)]??void 0,i={name:tt.PROCESS_DESCRIPTORS.CLUSTERING_HUB+(n!==e_e?"-"+n:""),binFile:aj,args:s?`${s} -c ${t}`:`-c ${t}`,exec_mode:"fork",env:{[tt.PROCESS_NAME_ENV_PROP]:tt.PROCESS_DESCRIPTORS.CLUSTERING_HUB},merge_logs:!0,out_file:r,error_file:r,instances:1};return Os.get(tt.HDB_SETTINGS_NAMES.LOG_TO_FILE)||(i.out_file=Gf,i.error_file=Gf),i}a(t_e,"generateNatsHubServerConfig");var r_e=9940;function n_e(){Os.initSync(!0);let e=Os.get(tt.CONFIG_PARAMS.ROOTPATH),t=Na.join(e,"clustering",uE.NATS_CONFIG_FILES.LEAF_SERVER),r=Na.join(Os.get(tt.HDB_SETTINGS_NAMES.LOG_PATH_KEY),tt.LOG_NAMES.HDB),n=ij.get(tt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_NETWORK_PORT),s=uE.LOG_LEVEL_FLAGS[Os.get(tt.CONFIG_PARAMS.CLUSTERING_LOGLEVEL)]??void 0,i={name:tt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF+(n!==r_e?"-"+n:""),binFile:aj,args:s?`${s} -c ${t}`:`-c ${t}`,exec_mode:"fork",env:{[tt.PROCESS_NAME_ENV_PROP]:tt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF},merge_logs:!0,out_file:r,error_file:r,instances:1};return Os.get(tt.HDB_SETTINGS_NAMES.LOG_TO_FILE)||(i.out_file=Gf,i.error_file=Gf),i}a(n_e,"generateNatsLeafServerConfig");function s_e(){Os.initSync();let e=Na.join(Os.get(tt.CONFIG_PARAMS.LOGGING_ROOT),tt.LOG_NAMES.HDB),t={name:tt.PROCESS_DESCRIPTORS.CLUSTERING_UPGRADE_4_0_0,binFile:tt.LAUNCH_SERVICE_SCRIPTS.NODES_UPGRADE_4_0_0,exec_mode:"fork",env:{[tt.PROCESS_NAME_ENV_PROP]:tt.PROCESS_DESCRIPTORS.CLUSTERING_UPGRADE_4_0_0},merge_logs:!0,out_file:e,error_file:e,instances:1,cwd:XEe,autorestart:!1};return Os.get(tt.HDB_SETTINGS_NAMES.LOG_TO_FILE)||(t.out_file=Gf,t.error_file=Gf),t}a(s_e,"generateClusteringUpgradeV4ServiceConfig");function i_e(){let e={[tt.PROCESS_NAME_ENV_PROP]:tt.PROCESS_DESCRIPTORS.RESTART_HDB};return Dy.noBootFile()&&(e[tt.CONFIG_PARAMS.ROOTPATH.toUpperCase()]=Dy.getEnvCliRootPath()),{...{name:tt.PROCESS_DESCRIPTORS.RESTART_HDB,exec_mode:"fork",env:e,instances:1,autorestart:!1,cwd:oj},script:ZEe}}a(i_e,"generateRestart");function o_e(){return{apps:[cj()]}}a(o_e,"generateAllServiceConfigs");lj.exports={generateAllServiceConfigs:o_e,generateMainServerConfig:cj,generateRestart:i_e,generateNatsHubServerConfig:t_e,generateNatsLeafServerConfig:n_e,generateClusteringUpgradeV4ServiceConfig:s_e}});var yu=M((AGe,_j)=>{"use strict";var Dr=(H(),L(j)),bGe=ae(),Oa=Ly(),My=dr(),Ca=Nt(),$c=uj(),gL=ce(),Vc=Q(),a_e=Aa(),{startWorker:dj,onMessageFromWorkers:c_e}=rt(),fj=require("fs"),l_e=require("node:path"),u_e=(H(),L(j)),{setTimeout:d_e}=require("node:timers/promises"),{execFile:f_e,fork:m_e}=require("node:child_process");_j.exports={start:Kc,restart:h_e,kill:S_e,startAllServices:T_e,startService:pj,restartHdb:E_e,startClusteringProcesses:hj,startClusteringThreads:Ej,isHdbRestartRunning:__e,getHdbPid:g_e,cleanupChildrenProcesses:dE,reloadClustering:R_e,expectedRestartOfChildren:mj};c_e(e=>{e.type==="restart"&&gL.initSync(!0)});var Lo=[],p_e=10,_L;function Kc(e,t=!1){let r=typeof e.args=="string"?e.args.split(" "):e.args;e.silent=!0,e.detached=!0;let n=e.script?m_e(e.script,r,e):f_e(e.binFile,r,e);n.name=e.name,n.config=e,n.on("error",(o,c)=>{console.error(o,c)}),n.on("exit",async o=>{let c=Lo.indexOf(n);c>-1&&Lo.splice(c,1),!_L&&o!==0&&(e.restarts=(e.restarts||0)+1,e.restarts<p_e&&(fj.existsSync(Oa.getHubConfigPath())?Kc(e):(await Oa.generateNatsConfig(!0),Kc(e),await new Promise(l=>setTimeout(l,3e3)),await Oa.removeNatsConfig(Dr.PROCESS_DESCRIPTORS.CLUSTERING_HUB),await Oa.removeNatsConfig(Dr.PROCESS_DESCRIPTORS.CLUSTERING_LEAF))))});let s={serviceName:e.name.replace(/ /g,"-")};function i(o){let c=gL.get(Dr.CONFIG_PARAMS.CLUSTERING_LOGLEVEL),l=/\[\d+][^\[]+\[(\w+)]/g,u,d=0,f;for(;u=l.exec(o);){if(u.index&&Ca.LOG_LEVEL_HIERARCHY[c]>=Ca.LOG_LEVEL_HIERARCHY[f||"info"]){let h=f===Ca.LOG_LEVELS.ERR||f===Ca.LOG_LEVELS.WRN?Vc.OUTPUTS.STDERR:Vc.OUTPUTS.STDOUT;Vc.logCustomLevel(f||"info",h,s,o.slice(d,u.index).trim())}let[m,p]=u;d=u.index+m.length,f=Ca.LOG_LEVELS[p]}if(Ca.LOG_LEVEL_HIERARCHY[c]>=Ca.LOG_LEVEL_HIERARCHY[f||"info"]){let m=f===Ca.LOG_LEVELS.ERR||f===Ca.LOG_LEVELS.WRN?Vc.OUTPUTS.STDERR:Vc.OUTPUTS.STDOUT;Vc.logCustomLevel(f||"info",m,s,o.toString().slice(d).trim())}}a(i,"extractMessages"),n.stdout.on("data",i),n.stderr.on("data",i),n.unref(),Lo.length===0&&(t||(process.on("exit",dE),process.on("SIGINT",dE),process.on("SIGQUIT",dE),process.on("SIGTERM",dE))),Lo.push(n)}a(Kc,"start");function dE(e=!0){if(!_L&&(_L=!0,Lo.length!==0))if(Vc.info("Killing child processes..."),Lo.map(t=>t.kill()),e)process.exit(0);else return d_e(2e3)}a(dE,"cleanupChildrenProcesses");function h_e(e){mj();for(let t of Lo)t.name===e&&t.kill()}a(h_e,"restart");function mj(){for(let e of Lo)e.config&&(e.config.restarts=0)}a(mj,"expectedRestartOfChildren");async function E_e(){await Kc($c.generateRestart())}a(E_e,"restartHdb");async function __e(){let e=await list();for(let t in e)if(e[t].name===Dr.PROCESS_DESCRIPTORS.RESTART_HDB)return!0;return!1}a(__e,"isHdbRestartRunning");function g_e(){let e=gL.getHdbBasePath();if(!e)return;let t=l_e.join(e,u_e.HDB_PID_FILE),r=b_e(t);if(!(!r||r===process.pid)&&A_e(r))return r}a(g_e,"getHdbPid");function S_e(){for(let e of Lo)e.kill();Lo=[]}a(S_e,"kill");async function T_e(){await hj(),await Ej(),await Kc($c.generateAllServiceConfigs())}a(T_e,"startAllServices");async function pj(e,t=!1){let r;switch(e=e.toLowerCase(),e){case Dr.PROCESS_DESCRIPTORS.HDB.toLowerCase():r=$c.generateMainServerConfig();break;case Dr.PROCESS_DESCRIPTORS.CLUSTERING_INGEST_SERVICE.toLowerCase():r=$c.generateNatsIngestServiceConfig();break;case Dr.PROCESS_DESCRIPTORS.CLUSTERING_REPLY_SERVICE.toLowerCase():r=$c.generateNatsReplyServiceConfig();break;case Dr.PROCESS_DESCRIPTORS.CLUSTERING_HUB.toLowerCase():r=$c.generateNatsHubServerConfig(),await Kc(r,t),await Oa.removeNatsConfig(e);return;case Dr.PROCESS_DESCRIPTORS.CLUSTERING_LEAF.toLowerCase():r=$c.generateNatsLeafServerConfig(),await Kc(r,t),await Oa.removeNatsConfig(e);return;case Dr.PROCESS_DESCRIPTORS.CLUSTERING_UPGRADE_4_0_0.toLowerCase():r=$c.generateClusteringUpgradeV4ServiceConfig();break;default:throw new Error(`Start service called with unknown service config: ${e}`)}Kc(r,t)}a(pj,"startService");var y_e;async function hj(e=!1){for(let t in Dr.CLUSTERING_PROCESSES){let r=Dr.CLUSTERING_PROCESSES[t];await pj(r,e)}}a(hj,"startClusteringProcesses");async function Ej(){y_e=dj(Dr.LAUNCH_SERVICE_SCRIPTS.NATS_REPLY_SERVICE,{name:Dr.PROCESS_DESCRIPTORS.CLUSTERING_REPLY_SERVICE});try{await My.deleteLocalStream("__HARPERDB_WORK_QUEUE__")}catch{}await My.updateLocalStreams();let e=await a_e.getAllNodeRecords();for(let t=0,r=e.length;t<r;t++)if(e[t].system_info?.hdb_version===Dr.PRE_4_0_0_VERSION){Vc.info("Starting clustering upgrade 4.0.0 process"),dj(Dr.LAUNCH_SERVICE_SCRIPTS.NODES_UPGRADE_4_0_0,{name:"Upgrade-4-0-0"});break}}a(Ej,"startClusteringThreads");async function R_e(){await Oa.generateNatsConfig(!0),await My.reloadNATSHub(),await My.reloadNATSLeaf(),await Oa.removeNatsConfig(Dr.PROCESS_DESCRIPTORS.CLUSTERING_HUB.toLowerCase()),await Oa.removeNatsConfig(Dr.PROCESS_DESCRIPTORS.CLUSTERING_LEAF.toLowerCase())}a(R_e,"reloadClustering");function b_e(e){try{return Number.parseInt(fj.readFileSync(e,"utf8"),10)}catch{return null}}a(b_e,"readPidFile");function A_e(e){try{return process.kill(e,0),!0}catch(t){return t.code==="EPERM"}}a(A_e,"isProcessRunning")});var By={};ye(By,{compactOnStart:()=>I_e,copyDb:()=>bj});async function I_e(){Pa.notify("Running compact on start"),console.log("Running compact on start");let e=(0,SL.get)(x.ROOTPATH),t=new Map,r=dt();(0,TL.updateConfigValue)(x.STORAGE_COMPACTONSTART,!1);try{for(let n in r){if(n==="system"||n.endsWith("-copy"))continue;let s;for(let l in r[n]){s=r[n][l].primaryStore.path;break}if(!s){console.log("Couldn't find any tables in database",n);continue}let i=(0,Uy.join)(e,"backup",n+".mdb"),o=(0,Uy.join)(e,Il,n+"-copy.mdb"),c=0;try{c=await gj(n),console.log("Database",n,"before compact has a total record count of",c)}catch(l){Pa.error("Error getting record count for database",n,l),console.error("Error getting record count for database",n,l)}t.set(n,{dbPath:s,copyDest:o,backupDest:i,recordCount:c}),await bj(n,o),console.log("Backing up",n,"to",i);try{await(0,Ru.move)(s,i,{overwrite:!0})}catch(l){console.log("Error moving database",s,"to",i,l)}console.log("Moving copy compacted",n,"to",s),await(0,Ru.move)(o,s,{overwrite:!0}),await(0,Ru.remove)((0,Uy.join)(e,Il,`${n}-copy.mdb-lock`))}try{$f()}catch(n){Pa.error("Error resetting databases after backup",n),console.error("Error resetting databases after backup",n)}try{$f()}catch(n){Pa.error("Error resetting databases after backup",n),console.error("Error resetting databases after backup",n),process.exit(0)}}catch(n){Pa.error("Error compacting database, rolling back operation",n),console.error("Error compacting database, rolling back operation",n),(0,TL.updateConfigValue)(x.STORAGE_COMPACTONSTART,!1);for(let[s,{dbPath:i,backupDest:o}]of t){console.error("Moving backup database",o,"back to",i);try{await(0,Ru.move)(o,i,{overwrite:!0})}catch(c){console.error(c)}}throw $f(),n}for(let[n,{backupDest:s,recordCount:i}]of t){let o=await gj(n);if(console.log("Database",n,"after compact has a total record count of",o),i!==o){let c=`There is a discrepancy between pre and post compact record count for database ${n}.
 Total record count before compaction: ${i}, total after: ${o}.
 Database backup has not been removed and can be found here: ${s}`;Pa.warn(c),console.warn(c)}(0,SL.get)(x.STORAGE_COMPACTONSTARTKEEPBACKUP)!==!0&&(console.log("Removing backup",s),await(0,Ru.remove)(s))}}async function gj(e){let t=await(0,Rj.describeSchema)({database:e}),r=0;for(let n in t)r+=t[n].record_count;return r}function qf(){}async function bj(e,t){console.log(`Copying database ${e} to ${t}`);let r=dt()[e];if(!r)throw new Error(`Source database not found: ${e}`);let n;for(let f in r){let m=r[f];m.primaryStore.put=qf,m.primaryStore.remove=qf;for(let p in m.indices){let h=m.indices[p];h.put=qf,h.remove=qf}m.auditStore&&(m.auditStore.put=qf,m.auditStore.remove=qf),n=m.primaryStore.rootStore}if(!n)throw new Error(`Source database does not have any tables: ${e}`);let s=n.dbisDb,i=n.auditStore,o=(0,Sj.open)(new Tj.default(t)),c=o.openDB(xy.INTERNAL_DBIS_NAME),l,u=0,d=s.useReadTransaction();try{for(let{key:m,value:p}of s.getRange({transaction:d})){let h=p.is_hash_attribute||p.isPrimaryKey,E,_;if(h&&(E=p.compression,_=Fy(),_?p.compression=_:delete p.compression,E?.dictionary?.toString()===_?.dictionary?.toString()&&(E=null,_=null)),c.put(m,p),!(h||p.indexed))continue;let R=new yj.OpenDBIObject(!h,h);R.encoding="binary",R.compression=E;let S=n.openDB(m,R);S.decoder=null,S.decoderCopies=!1,S.encoding="binary",R.compression=_;let y=o.openDB(m,R);y.encoder=null,console.log("copying",m,"from",e,"to",t),await f(S,y,h,d)}if(i){let m=n.openDB(xy.AUDIT_STORE_NAME,fE);console.log("copying audit log for",e,"to",t),f(i,m,!1,d)}async function f(m,p,h,E){let _=0,R=0,S=0,y=1e7,w=null;for(;y-- >0;)try{for(let I of m.getKeys({start:w,transaction:E}))try{w=I;let{value:G,version:X}=m.getEntry(I,{transaction:E});if(G?.length<14&&h){S++;continue}l=p.put(I,G,h?X:void 0),_++,E.openTimer&&(E.openTimer=0),R+=(I?.length||10)+G.length,u++>5e3&&(await l,console.log("copied",_,"entries",S,"delete records,",R,"bytes"),u=0)}catch(G){console.error("Error copying record",typeof I=="symbol"?"symbol":I,"from",e,"to",t,G)}console.log("finish copying, copied",_,"entries",S,"delete records,",R,"bytes");return}catch{if(typeof w=="string"){if(w==="z")return console.error("Reached end of dbi",w,"for",e,"to",t);w=w.slice(0,-2)+"z"}else if(typeof w=="number")w++;else return console.error("Unknown key type",w,"for",e,"to",t)}}a(f,"copyDbi"),await l,console.log("copied database "+e+" to "+t)}finally{d.done(),o.close()}}var Sj,Uy,Ru,SL,Tj,yj,xy,Rj,TL,Pa,ky=se(()=>{Ce();Sj=require("lmdb"),Uy=require("path"),Ru=require("fs-extra"),SL=b(ce()),Tj=b(Ap()),yj=b(bp()),xy=b(Xt());H();io();Rj=b(eu()),TL=b(_t()),Pa=b(Q());a(I_e,"compactOnStart");a(gj,"getTotalDBRecordCount");a(qf,"noop");a(bj,"copyDb")});var RL=M((PGe,Aj)=>{"use strict";var mE=ce();mE.initSync();var Vf=require("fs-extra"),yL=require("path"),Kf=(H(),L(j)),w_e=require("crypto"),N_e=require("uuid").v4;Aj.exports=C_e;function C_e(){if(mE.getHdbBasePath()!==void 0){let e=yL.join(mE.getHdbBasePath(),Kf.LICENSE_KEY_DIR_NAME,Kf.JWT_ENUM.JWT_PRIVATE_KEY_NAME),t=yL.join(mE.getHdbBasePath(),Kf.LICENSE_KEY_DIR_NAME,Kf.JWT_ENUM.JWT_PUBLIC_KEY_NAME),r=yL.join(mE.getHdbBasePath(),Kf.LICENSE_KEY_DIR_NAME,Kf.JWT_ENUM.JWT_PASSPHRASE_NAME);try{Vf.accessSync(r),Vf.accessSync(e),Vf.accessSync(t)}catch(n){if(n.code==="ENOENT"){let s=N_e(),i=w_e.generateKeyPairSync("rsa",{modulusLength:4096,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem",cipher:"aes-256-cbc",passphrase:s}});Vf.writeFileSync(r,s),Vf.writeFileSync(e,i.privateKey),Vf.writeFileSync(t,i.publicKey)}else throw n}}}a(C_e,"checkJWTTokenExist")});var wj=M((DGe,Ij)=>{"use strict";var bL=class{static{a(this,"HdbInfoInsertObject")}constructor(t,r,n){this.info_id=t,this.data_version_num=r,this.hdb_version_num=n}};Ij.exports={HdbInfoInsertObject:bL}});var Oj=M((MGe,Cj)=>{"use strict";var Nj=(H(),L(j)),AL=class{static{a(this,"UpgradeObject")}constructor(t,r){this[Nj.UPGRADE_JSON_FIELD_NAMES_ENUM.DATA_VERSION]=t,this[Nj.UPGRADE_JSON_FIELD_NAMES_ENUM.UPGRADE_VERSION]=r}};Cj.exports={UpgradeObject:AL}});var Hy=M((xGe,Lj)=>{"use strict";var ti=require("prompt"),Yf=require("chalk"),Pj=Q(),ki=require("os"),IL=lc(),wL=["yes","y"];async function O_e(e){let t=`${ki.EOL}`+Yf.bold.green("Your current HarperDB version requires that we complete an update process.")+`${ki.EOL}If a backup of your data has not been created, we recommend you cancel this process and backup before proceeding.${ki.EOL}${ki.EOL}You can read more about the changes in this upgrade at https://harperdb.io/developers/release-notes/${ki.EOL}`;ti.override=IL(["CONFIRM_UPGRADE"]),ti.start(),ti.message=t;let r={properties:{CONFIRM_UPGRADE:{description:Yf.magenta(`${ki.EOL}[CONFIRM_UPGRADE] Do you want to upgrade your HDB instance now? (yes/no)`),pattern:/y(es)?$|n(o)?$/,message:"Must respond 'yes' or 'no'",default:"no",required:!0}}},n;try{n=await ti.get([r])}catch(s){return Pj.error("There was an error when prompting user about an upgrade."),Pj.error(s),!1}return wL.includes(n.CONFIRM_UPGRADE)}a(O_e,"forceUpdatePrompt");async function P_e(e){let t=`${ki.EOL}`+Yf.bold.green(`Your installed HarperDB version is older than the version used to create your data. Downgrading is not recommended as it is not tested and guaranteed to work. However, if you need to downgrade, and a backup of your data has not been created, we recommend you cancel this process and backup before proceeding.${ki.EOL}`);ti.override=IL(["CONFIRM_DOWNGRADE"]),ti.start(),ti.message=t;let r={properties:{CONFIRM_DOWNGRADE:{description:Yf.magenta(`${ki.EOL}[CONFIRM_DOWNGRADE] Do you want to proceed with using your downgraded HDB instance now? (yes/no)`),pattern:/y(es)?$|n(o)?$/,message:"Must respond 'yes' or 'no'",default:"no",required:!0}}},n=await ti.get([r]);return wL.includes(n.CONFIRM_DOWNGRADE)}a(P_e,"forceDowngradePrompt");async function L_e(){let e=`${ki.EOL}`+Yf.bold.green("We now require a Certifacte Authority certificate. HarperDB can generate all new certificates for you (your existing certificates will be backed up) or you can keep any existing certificates and add your own CA certificate. To add your own CA certificate set the <certificateAuthority> parameter in harperdb-config.yaml");ti.override=IL(["GENERATE_CERTS"]),ti.start(),ti.message=e;let t={properties:{GENERATE_CERTS:{description:Yf.magenta(`${ki.EOL}[GENERATE_CERTS] Do you want HarperDB to generate all new certificates? (yes/no)`),pattern:/y(es)?$|n(o)?$/,message:"Must respond 'yes' or 'no'",default:"yes",required:!0}}},r=await ti.get([t]);return wL.includes(r.GENERATE_CERTS)}a(L_e,"upgradeCertsPrompt");Lj.exports={forceUpdatePrompt:O_e,forceDowngradePrompt:P_e,upgradeCertsPrompt:L_e}});var Gy=M((kGe,Dj)=>{"use strict";var NL=class{static{a(this,"UpgradeDirective")}constructor(t){this.version=t,this.sync_functions=[],this.async_functions=[]}};Dj.exports=NL});var Mj=M((VGe,vj)=>{"use strict";var D_e=ae(),v_e=_t(),HGe=Q(),GGe=require("path"),qGe=require("fs"),$Ge=(H(),L(j));vj.exports={getOldPropsValue:M_e};function M_e(e,t,r=!1){let n=t.getRaw(e);return D_e.isNotEmptyAndHasValue(n)?n:r?v_e.getDefaultConfig(e):""}a(M_e,"getOldPropsValue")});var kj=M((YGe,Bj)=>{"use strict";var Yc=require("path"),Wc=require("fs-extra"),U_e=require("properties-reader"),x_e=Gy(),br=Q(),{getOldPropsValue:yt}=Mj(),{HDB_SETTINGS_NAMES:be,CONFIG_PARAMS:bu}=(H(),L(j)),Au=_t(),qy=ce(),Uj=ae(),Do=(H(),L(j)),CL=new x_e("3.1.0"),xj=[];function B_e(){let e=U_e(qy.get(be.SETTINGS_PATH_KEY)),t="Updating settings file for version 3.1.0";console.log(t),br.info(t);let r=`   ;Settings for the HarperDB process.