harperdb 4.7.8 → 4.7.9

package/server/threads/threadServer.js

@@ -15,7 +15,7 @@
 `,t)}function DN(e){e&&cq.push(e)}var Cl,rq,nq,Dp,NN,CN,Mp,sq,Mae,Uae,tn,zg,iq,vp,wN,ON,oq,aq,cq,lq,zG,JG,jg,fq,qae,$ae,XG,ZG,pq,eq,tq,Kae,Eq,cc,Yae,hs=se(()=>{Cl=require("worker_threads"),rq=b(st());Oe();nq=b(Q()),Dp=require("path"),NN=require("fs/promises"),CN=b(Mn()),Mp=b(fe());G();Hr();sq=b(require("node:fs"));RN();bN();({getLogFilePath:Mae,forComponent:Uae}=nq.default);setTimeout(()=>{Promise.resolve().then(()=>YG())},1e3);tn=Uae("analytics").conditional;(0,Mp.initSync)();zg=new Map,iq=(0,Mp.get)(x.ANALYTICS_AGGREGATEPERIOD)>-1;a(xae,"setAnalyticsEnabled");a(Bae,"recordExistingAction");a(Fae,"recordNewAction");a(We,"recordAction");Ue.recordAnalytics=We;a(rn,"recordActionBinary");wN=0,ON=1e3,oq="analytics-report",aq=[],cq=[];a(Up,"addAnalyticsListener");lq=[.01,.1,.25,.5,.75,.9,.95,.99,.999,1];a(kae,"sendAnalytics");a(PN,"recordHostname");a(gd,"storeMetric");a(uq,"calculateCPUUtilization");a(dq,"diffResourceUsage");a(Hae,"storeTableSizeMetrics");a(WG,"storeDBSizeMetrics");a(jG,"storeVolumeMetrics");a(Gae,"aggregation");zG=0,JG=0,jg={userCPUTime:0,systemCPUTime:0},fq=a(()=>new Promise(setImmediate),"rest");a(QG,"cleanup");qae=36e5,$ae=31536e6;a(LN,"getRawAnalyticsTable");a(mq,"getAnalyticsTable");(0,rq.setChildListenerByType)(oq,hq);a(Vae,"startScheduledTasks");eq=0,tq=new Map,Kae=!1;a(hq,"recordAnalytics");Yae=1e6;a(Wae,"logAnalytics");a(DN,"onAnalyticsAggregate")});function xp(e,t,r,n){if(e.append)e.append(t,r,n);else if(e.set){let s=e.get(t);if(s)if(n)r=(typeof s=="string"?s:s.join(", "))+", "+r;else if(typeof s=="string")r=[s,r];else{s.push(r);return}return e.set(t,r)}else e[t]=(e[t]?e[t]+", ":"")+r}function _q(e,t){(typeof e.set!="function"||typeof e.has!="function")&&(e=new Bs(e));for(let[r,n]of t)e.has(r)?r.toLowerCase()==="set-cookie"&&e.append?.(r,n,!0):e.set(r,n);return e}var Bs,Bp=se(()=>{Bs=class extends Map{static{a(this,"Headers")}constructor(t){if(t)if(t[Symbol.iterator])super(t);else{super();for(let r in t)this.set(r,t[r])}else super()}set(t,r){return typeof t!="string"&&(t=""+t),typeof r!="string"&&(r=""+r),super.set(t.toLowerCase(),[t,r])}get(t){return typeof t!="string"&&(t=""+t),super.get(t.toLowerCase())?.[1]}has(t){return typeof t!="string"&&(t=""+t),super.has(t.toLowerCase())}setIfNone(t,r){typeof t!="string"&&(t=""+t),typeof r!="string"&&(r=""+r);let n=t.toLowerCase();if(!super.has(n))return super.set(n,[t,r])}append(t,r,n){typeof t!="string"&&(t=""+t),typeof r!="string"&&(r=""+r);let s=t.toLowerCase(),i=super.get(s);if(i){let o=i[1];if(n)r=(typeof o=="string"?o:o.join(", "))+", "+r;else if(typeof o=="string")r=[o,r];else{o.push(r);return}}return super.set(s,[t,r])}*[Symbol.iterator](){for(let[t,r]of super.values()){if(Array.isArray(r)&&t.toLowerCase()==="set-cookie"){for(let n of r)yield[t,n];continue}yield[t,r]}}};a(xp,"appendHeader");a(_q,"mergeHeaders")});function Xg(e,t){let r={openapi:jae,info:{title:"HarperDB HTTP REST interface",version:bq.packageJson.version},servers:[{description:"REST API",url:t}],paths:{},components:{schemas:{},securitySchemes:{basicAuth:{type:"http",scheme:"basic"},bearerAuth:{type:"http",scheme:"bearer",bearerFormat:"JWT"}}}},n=[{basicAuth:[],bearerAuth:[]}],s=a(i=>{if(i.type&&!r.components.schemas[i.type]){r.components.schemas[i.type]={};let o={},c=[];for(let l of i.properties)Qg[l.type]?o[l.name]=new MN(Qg[l.type],l.type):l.properties?(o[l.name]=new Iq(l.type),s(l)):l.elements?.properties&&(o[l.name]=new Xae(l.elements.type),s(l.elements)),l.nullable===!1&&c.push(l.name);r.components.schemas[i.type]=new Rq(o,!i.sealed,c)}},"includeDefinitionInSchema");for(let[,i]of e){if(!i.path||i.Resource.isError)continue;let{path:o}=i,c=o.split("/").pop(),{attributes:l,sealed:u}=i.Resource,{prototype:d,primaryKey:f="id"}=i.Resource;if(!l&&e.allTypes.has(i.path)){let k=e.allTypes.get(i.path);u=k.sealed,l=k.properties}if(!f)continue;let m={},p=[],h=[];if(l)for(let{type:k,name:z,elements:Y,relationship:ce,definition:de,nullable:te}of l){let Se=de??Y?.definition;Se&&s(Se),te===!1&&h.push(z),ce?k==="array"?m[z]={type:"array",items:{$ref:Fs+Y.type}}:m[z]={$ref:Fs+k}:Se?k==="array"?m[z]={type:"array",items:{$ref:Fs+Se.type}}:m[z]={$ref:Fs+Se.type}:k==="array"?Y.type==="Any"?m[z]={type:"array",items:{format:Y.type}}:m[z]={type:"array",items:new MN(Qg[Y.type],Y.type)}:k==="Any"?m[z]={format:k}:m[z]=new MN(Qg[k],k),p.push(new UN(z,"query",m[z]))}let E=Object.keys(m),_=new UN(f,"path",{type:"string",format:"ID"});_.required=!0,_.description="primary key of record";let R=new UN("property","path",{enum:E});R.required=!0,r.components.schemas[c]=new Rq(m,!u,h);let S=d.post!==Resource.prototype.post||d.update,y=typeof d.put=="function",w=typeof d.get=="function",I=typeof d.delete=="function",H=typeof d.patch=="function",X=`/${o}/`;r.paths[X]||(r.paths[X]={}),S&&(r.paths[X].post=new zae(c,n,{200:new Sd({$ref:Fs+c},{Location:{description:"primary key of new record",schema:{type:"string",format:"ID"}}})},"create a new record auto-assigning a primary key")),r.paths[X].options=new gq(p,n,{200:new Sq},"retrieve information about the communication options available for a target resource or the server as a whole, without performing any resource action"),w&&(r.paths[X].get=new vN(p,n,{200:new Sd({type:"array",items:{$ref:Fs+c}})},"search for records by the specified property name and value pairs")),I&&(r.paths[X].delete=new yq(p,n,"delete all the records that match the provided query",{204:new Tq}));let q="/"+o+"/{"+f+"}";if(r.paths[q]||(r.paths[q]={}),r.paths[q].options=new gq(p,n,{200:new Sq},"retrieve information about the communication options available for a target resource or the server as a whole, without performing any resource action"),w&&(r.paths[q].get=new vN([_],n,{200:new Sd({$ref:Fs+c})},"retrieve a record by its primary key")),y&&(r.paths[q].put=new Jae([_],n,c,{200:new Sd({$ref:Fs+c})},"create or update the record with the URL path that maps to the record's primary key")),H&&(r.paths[q].patch=new Qae([_],n,c,{200:new Sd({$ref:Fs+c})},"patch the record with the URL path that maps to the record's primary key")),I&&(r.paths[q].delete=new yq([_],n,"delete a record with the given primary key",{204:new Tq})),w&&R.schema.enum.length>0){let k=`/${o}/{${f}}.{property}`;r.paths[k]||(r.paths[k]={}),r.paths[k].get=new vN([_,R],n,{200:new Sd({enum:E})},"used to retrieve the specified property of the specified record")}}for(let[,i]of e.allTypes)s(i),i.sealed&&r.components.schemas[i.type].additionalProperties&&(r.components.schemas[i.type].additionalProperties=!1);return r}function zae(e,t,r,n){this.description=n,this.requestBody={content:{"application/json":{schema:{$ref:Fs+e}}}},this.security=t,this.responses=r}function vN(e,t,r,n){this.description=n,this.parameters=e,this.security=t,this.responses=r}function gq(e,t,r,n){this.description=n,this.parameters=e,this.security=t,this.responses=r}function Sq(){this.description=Aq,this.headers={},this.content={}}function Sd(e,t){this.description=Aq,this.content={"application/json":{schema:e}},this.headers=t}function Tq(){this.description="successfully processed request, no content returned to client"}function Jae(e,t,r,n,s){this.description=s,this.parameters=e,this.security=t,this.requestBody={content:{"application/json":{schema:{$ref:Fs+r}}}},this.responses=n}function Qae(e,t,r,n,s){this.description=s,this.parameters=e,this.security=t,this.requestBody={content:{"application/json":{schema:{$ref:Fs+r}}}},this.responses=n}function yq(e,t,r,n){this.description=r,this.parameters=e,this.security=t,this.responses=n}function Rq(e,t,r){this.type="object",this.properties=e,this.additionalProperties=t,this.required=r}function MN(e,t){this.type=e,(e==="string"||e==="number"||e==="integer")&&t!=="String"&&(this.format=t)}function Iq(e){this.$ref=`#/components/schemas/${e}`}function Xae(e){this.type="array",this.items=new Iq(e)}function UN(e,t,r){this.name=e,this.in=t,this.schema=r}var bq,jae,Qg,Fs,Aq,xN=se(()=>{bq=b(Rt()),jae="3.0.3",Qg={Int:"integer",Float:"number",Long:"integer",ID:"string",String:"string",Boolean:"boolean",Date:"string",Bytes:"string",BigInt:"integer"},Fs="#/components/schemas/",Aq="successful operation";a(Xg,"generateJsonApi");a(zae,"Post");a(vN,"Get");a(gq,"Options");a(Sq,"ResponseOptions200");a(Sd,"Response200");a(Tq,"Response204");a(Jae,"Put");a(Qae,"Patch");a(yq,"Delete");a(Rq,"ResourceSchema");a(MN,"Type");a(Iq,"Ref");a(Xae,"ArrayRef");a(UN,"Parameter")});var Nq={};ye(Nq,{Request:()=>lc,createReuseportFd:()=>Zg});var wq,lc,BN,FN,Zg,Fp=se(()=>{wq=require("os"),lc=class{static{a(this,"Request")}#e;#t;_nodeRequest;_nodeResponse;method;url;headers;isWebSocket;user;constructor(t,r){this.method=t.method;let n=t.url;this._nodeRequest=t,this._nodeResponse=r,this.url=n,this.headers=new FN(t.headers)}get absoluteURL(){return this.protocol+"://"+this.host+this.url}get pathname(){let t=this.url.indexOf("?");return t>-1?this.url.slice(0,t):this.url}set pathname(t){let r=this.url.indexOf("?");r>-1?this.url=t+this.url.slice(r):this.url=t}get protocol(){return this._nodeRequest.socket.encrypted?"https":"http"}get ip(){return this._nodeRequest.socket.remoteAddress}get authorized(){return this._nodeRequest.socket.authorized}get peerCertificate(){return this.#t===void 0&&(this.#t=this._nodeRequest.socket.getPeerCertificate?.(!0)||null),this.#t}get mtlsConfig(){return this._nodeRequest.socket.server.mtlsConfig}get body(){return this.#e||(this.#e=new BN(this._nodeRequest))}get host(){return this._nodeRequest.authority||this._nodeRequest.headers.host}get hostname(){return this._nodeRequest.headers.host}get httpVersion(){return this._nodeRequest.httpVersion}get isAborted(){return!1}get nodeRequest(){return this._nodeRequest}sendEarlyHints(t,r={}){r.link=t,this._nodeResponse.writeEarlyHints(r)}},BN=class{static{a(this,"RequestBody")}#e;constructor(t){this.#e=t}on(t,r){return this.#e.on(t,r),this}pipe(t,r){return this.#e.pipe(t,r)}},FN=class{static{a(this,"Headers")}asObject;constructor(t){this.asObject=t}set(t,r){this.asObject[t.toLowerCase()]=r}get(t){return this.asObject[t.toLowerCase()]}has(t){return Object.prototype.hasOwnProperty.call(this.asObject,t.toLowerCase())}[Symbol.iterator](){return Object.entries(this.asObject)[Symbol.iterator]()}keys(){return Object.keys(this.asObject)}values(){return Object.values(this.asObject)}delete(t){delete this.asObject[t.toLowerCase()]}forEach(t){for(let[r,n]of this)t(n,r,this)}};(0,wq.platform)()!="win32"&&(Zg=require("node-unix-socket").createReuseportFd)});var Cq,ks,eS=se(()=>{Cq=b(oi());so();ks=class extends URLSearchParams{static{a(this,"RequestTarget")}#e;pathname;search;id;isCollection;constructor(t){let r,n;if(t&&(r=t.indexOf("?"))>-1){n=t.slice(0,r);let s=t.slice(r+1);super(s),this.search=s}else super(),n=t;this.pathname=n??"",this.#e=t}toString(){return this.#e?this.#e:this.size>0?this.pathname+"?"+super.toString():this.pathname}get url(){return this.toString()}delete(t){super.delete(t),this.conditions&&(this.conditions=this.conditions.filter(r=>r.attribute!==t)),this.#e=void 0}set(t,r){this.delete(t),super.set(t,r),this.conditions?.push({attribute:t,value:r})}append(t,r){super.append(t,r),this.#e=void 0,this.conditions?.push({attribute:t,value:r})}};(0,Cq._assignPackageExport)("Resource",Qt)});var rS={};ye(rS,{parseHeaderValue:()=>HN,start:()=>tce});async function ece(e,t){let r=e.headers.asObject,n=r.accept==="text/event-stream",s=n?"CONNECT":e.method;e.search&&nS(e);let i=new Bs;try{e.responseHeaders=i;let o=e.url.slice(1),c,l;if(o!==Oq){let _=tS.getMatch(o,n?"sse":"rest");if(!_)return t(e);e.handlerPath=_.path,c=new ks(_.relativeURL),c.async=!0,l=_.Resource}if(l?.isCaching){let _=r["cache-control"];if(_){let R=HN(_);for(let S of R)switch(S.name){case"max-age":e.expiresAt=S.value*1e3+Date.now();break;case"only-if-cached":e.onlyIfCached=!0;break;case"no-cache":e.noCache=!0;break;case"no-store":e.noCacheStore=!0;break;case"stale-if-error":e.staleIfError=!0;break;case"must-revalidate":e.mustRevalidate=!0;break}}}let u=r["x-replicate-to"];if(u){let _=HN(u).map(R=>(R.next?.name==="confirm"&&R.next.value>=0&&(e.replicatedConfirmation=+R.next.value),R.name));e.replicateTo=_.length===1&&+_[0]>=0?+_[0]:_[0]==="*"?void 0:_}r["x-replicate-from"]==="none"&&(e.replicateFrom=!1);let f=await At(e,()=>{if(r["content-length"]||r["transfer-encoding"])try{e.data=Ko(r["content-type"],!0)(e.body,e.headers)}catch(_){throw new Td.ClientError(_,400)}if(e.authorize=!0,o===Oq&&s==="GET"){if(e?.user?.role?.permission?.super_user)return Xg(tS,`${e.protocol}://${e.hostname}`);throw new Td.ServerError("Forbidden",403)}switch(c.checkPermission=e.user?.role?.permission??{},s){case"GET":case"HEAD":return l.get(c,e);case"POST":return l.post(c,e.data,e);case"PUT":return l.put(c,e.data,e);case"DELETE":return l.delete(c,e);case"PATCH":return l.patch(c,e.data,e);case"OPTIONS":i.setIfNone("Allow","GET, HEAD, POST, PUT, DELETE, PATCH, OPTIONS, TRACE, QUERY, COPY, MOVE");return;case"CONNECT":return l.connect(c,null,e);case"TRACE":return"HarperDB is the terminating server";case"QUERY":return l.query(c,e.data,e);case"COPY":return l.copy(c,r.destination,e);case"MOVE":return l.move(c,r.destination,e);case"BREW":throw new Td.ClientError("HarperDB is short and stout and can't brew coffee",418);default:throw new Td.ServerError(`Method ${s} is not recognized`,501)}}),m=200,p=e.lastModified;if(f==null)m=s==="GET"||s==="HEAD"?404:204,kN.lastModified&&isFinite(p)&&i.setIfNone("Last-Modified",new Date(p).toUTCString());else if(f.status>0&&f.headers){let _=_q(f.headers,i);return f.headers!==_&&(f.headers=_),f.data!==void 0&&(f.body=Hm(f.data,e,f)),f}else if(isFinite(p)){Zae[0]=p;let _=String.fromCharCode(34,(nn[0]&63)+62,(nn[0]>>6)+(nn[1]<<2&63)+62,(nn[1]>>4)+(nn[2]<<4&63)+62,(nn[2]>>2)+62,(nn[3]&63)+62,(nn[3]>>6)+(nn[4]<<2&63)+62,(nn[4]>>4)+(nn[5]<<4&63)+62,(nn[5]>>2)+62,(nn[6]&63)+62,(nn[6]>>6)+(nn[7]<<2&63)+62,34),R=r["if-none-match"];R&&_==R?(f?.onDone&&f.onDone(),m=304,f=void 0):i.setIfNone("ETag",_),kN.lastModified&&i.setIfNone("Last-Modified",new Date(p).toUTCString())}e.createdResource&&(m=201),e.newLocation&&i.setIfNone("Location",e.newLocation);let h={status:m,headers:i,body:void 0},E=e.loadedFromSource??f?.wasLoadedFromSource?.();return E!==void 0&&(h.wasCacheMiss=E,!E&&isFinite(p)&&i.setIfNone("Age",Math.round((Date.now()-(e.lastRefreshed||p))/1e3))),f!==void 0&&(h.body=Hm(f,e,h),s==="HEAD"&&(h.body=void 0)),h}catch(o){o.statusCode?o.statusCode===500?hi.warn(o):hi.info(o):hi.error(o),o.statusCode===405&&(o.method&&(o.message+=` to handle HTTP method ${o.method.toUpperCase()||""}`),o.allow&&(o.allow.push("trace","head","options"),i.setIfNone("Allow",o.allow.map(l=>l.toUpperCase()).join(", "))));let c={status:o.statusCode||500,headers:i,body:void 0};return c.body=Hm(o instanceof Error?Dq(o):o,e,c),c}}function tce(e){kN=e,e.includeExpensiveRecordCountEstimates&&(lc.prototype.includeExpensiveRecordCountEstimates=!0),!Pq&&(Pq=!0,tS=e.resources,e.server.http(async(t,r)=>{if(!t.isWebSocket)return ece(t,r)},e),e.webSocket!==!1&&e.server.ws(async(t,r,n)=>{kp++;let s=new rs;Lq||(Lq=!0,Up(l=>{kp>0&&l.push({metric:"ws-connections",connections:kp,byThread:!0})}));let i;t.on("error",l=>{i=!0,hi.warn(l)});let o;t.on("message",a(function(u){o||(o=Ko(r.requestedContentType??r.headers.asObject["content-type"],!1));let d=o(u);We(u.length,"bytes-received",r.handlerPath,"message","ws"),s.push(d)},"message"));let c;t.on("close",()=>{kp--,rn(!i,"connection","ws","disconnect"),s.emit("close"),c&&c.return()});try{await n;let l=r.url.slice(1),u=tS.getMatch(l,"ws");if(rn(!!u,"connection","ws","connect"),u){r.handlerPath=u.path,We(h=>({count:h.count,total:kp}),"connections",r.handlerPath,"connect","ws"),r.authorize=!0;let d=new ks(u.relativeURL);d.checkPermission=r.user?.role?.permission??{};let f=u.Resource;c=(await At(r,()=>f.connect(d,s,r)))[Symbol.asyncIterator]();let p;for(;!(p=await c.next()).done;){let h=await Vo(p.value,r);t.send(h),We(h.length,"bytes-sent",r.handlerPath,"message","ws"),t._socket.writableNeedDrain&&await new Promise(E=>t._socket.once("drain",E))}}else return t.close(1011,`No resource was found to handle ${r.pathname}`)}catch(l){l.statusCode?l.statusCode===500?hi.warn(l):hi.info(l):hi.error(l),t.close(rce[l.statusCode]||1011,Dq(l))}t.close()},e))}function HN(e){return e.trim().split(",").map(t=>{let r,n=t.trim().split(";"),s;for(;s=n.pop();)if(s.includes("=")){let[i,o]=s.trim().split("=");i=i.trim(),o&&(o=o.trim()),r={name:i.toLowerCase(),value:o,next:r}}else r={name:s.toLowerCase(),next:r};return r})}var hi,Td,Dq,nn,Zae,kN,Oq,Pq,tS,Lq,kp,rce,vq=se(()=>{Go();hs();hi=b(Q()),Td=b(Ee());sS();Fu();Ya();Bp();xN();Fp();eS();({errorToString:Dq}=hi),nn=new Uint8Array(8),Zae=new Float64Array(nn.buffer,0,1),kN={},Oq="openapi";a(ece,"http");kp=0;a(tce,"start");rce={401:3e3,403:3003};a(HN,"parseHeaderValue")});var GN=M((fUe,Uq)=>{var{recordAction:iS,recordActionBinary:Mq}=(hs(),v(Jg)),nce=require("fastify-plugin"),sce=200;Uq.exports=nce(function(e,t,r){e.addHook("onResponse",async(n,s)=>{let i=s.elapsedTime}),e.addHook("onSend",async(n,s,i)=>{let o=s.elapsedTime,c=performance.now(),l=s.request.routeOptions,u,d,f;l.config?.isOperation?(u=n.body?.operation,d="operation"):(u=l.url,d="fastify-route",f=l.method),iS(o,"duration",u,f,d),Mq(s.raw.statusCode<400,"success",u,f,d),Mq(1,"response_"+s.raw.statusCode,u,f,d);let m=sce;i?.pipe?(i.on("data",_=>{m+=_.length}),i.on("end",()=>{iS(performance.now()-c,"transfer",u,f,d),iS(m,"bytes-sent",u,f,d)})):(m+=i?.length||0,iS(m,"bytes-sent",u,f,d));let p=o.toFixed(3),h=s.getHeader("Server-Timing"),E=`db;dur=${p}`;s.header("Server-Timing",h?`${h}, ${E}`:E)}),r()},{name:"hdb-request-time"})});var Bq=M((mUe,xq)=>{var ice=mt(),oce={user:{presence:!0},schema:{presence:!0},table:{presence:!0},operation:{presence:!0}};xq.exports=function(e){return ice.validateObject(e,oce)}});var oS=M((pUe,Fq)=>{"use strict";var ace=(G(),v(j)).OPERATIONS_ENUM,qN=class{static{a(this,"UpdateObject")}constructor(t,r,n,s=void 0){this.operation=ace.UPDATE,this.schema=t,this.table=r,this.records=n,this.__origin=s}};Fq.exports=qN});var qp={};ye(qp,{createTokens:()=>VN,getJWTRSAKeys:()=>dS,refreshOperationToken:()=>KN,validateOperationToken:()=>YN,validateRefreshToken:()=>fS});async function dS(){if(aS)return aS;try{let e=Hp.default.join(Gp.default.getHdbBasePath(),nA),t=await cS.default.readFile(Hp.default.join(e,Sm.JWT_PASSPHRASE_NAME),"utf8"),r=await cS.default.readFile(Hp.default.join(e,Sm.JWT_PRIVATE_KEY_NAME),"utf8");return aS={publicKey:await cS.default.readFile(Hp.default.join(e,Sm.JWT_PUBLIC_KEY_NAME),"utf8"),privateKey:r,passphrase:t},aS}catch(e){throw uS.default.error(e),new Ei.ClientError(Rd.NO_ENCRYPTION_KEYS,yd.INTERNAL_SERVER_ERROR)}}async function VN(e){let t=(0,$N.validateBySchema)(e,ao.default.object({username:ao.default.string().optional(),password:ao.default.string().optional(),role:ao.default.string().optional(),expires_in:ao.default.alternatives(ao.default.string(),ao.default.number()).optional()}));if(t)throw new Ei.ClientError(t.message);let r;try{let f=e.bypass_auth!==!0;!e.username&&!e.password&&(e.username=e.hdb_user?.username,f=!1),r=await ed(e.username,e.password,f)}catch(f){throw uS.default.error(f),new Ei.ClientError(Rd.INVALID_CREDENTIALS,yd.UNAUTHORIZED)}if(!r)throw new Ei.ClientError(Rd.INVALID_CREDENTIALS,yd.UNAUTHORIZED);let n=!1,s=!1;r.role?.permission&&(n=r.role.permission.super_user===!0,s=r.role.permission.cluster_user===!0);let i={username:e.username,super_user:n,cluster_user:s};e.role&&(i.role=e.role);let o=await dS(),c=await bd.default.sign(i,{key:o.privateKey,passphrase:o.passphrase},{expiresIn:e.expires_in??$q,algorithm:lS,subject:Ad.OPERATION}),l=await bd.default.sign(i,{key:o.privateKey,passphrase:o.passphrase},{expiresIn:cce,algorithm:lS,subject:Ad.REFRESH}),u=RI(l,$r.SHA256);if((await(0,kq.update)(new Hq.default(_m,Uu.USER_TABLE_NAME,[{username:e.username,refresh_token:u}]))).skipped_hashes.length>0)throw new Ei.ClientError(Rd.REFRESH_TOKEN_SAVE_FAILED,yd.INTERNAL_SERVER_ERROR);return Gq.default.signalUserChange(new qq.UserEventMsg(process.pid)),{operation_token:c,refresh_token:l}}async function KN(e){let t=(0,$N.validateBySchema)(e,ao.default.object({refresh_token:ao.default.string().required()}).required());if(t)throw new Ei.ClientError(t.message);let{refresh_token:r}=e;await fS(r);let n=await dS(),s=await bd.default.decode(r);return{operation_token:await bd.default.sign({username:s.username,super_user:s.super_user,cluster_user:s.cluster_user},{key:n.privateKey,passphrase:n.passphrase},{expiresIn:$q,algorithm:lS,subject:Ad.OPERATION})}}async function YN(e){return Vq(e,Ad.OPERATION)}async function fS(e){return Vq(e,Ad.REFRESH)}async function Vq(e,t){try{let r=await dS(),n=await bd.default.verify(e,r.publicKey,{algorithms:lS,subject:t});if(n.role)throw new Error("Invalid token");let s=await ed(n.username,void 0,!1);if(t===Ad.REFRESH&&!bI(s.refresh_token,e))throw new Error("Invalid token");return s}catch(r){throw uS.default.warn(r),r?.name==="TokenExpiredError"?new Ei.ClientError(Rd.TOKEN_EXPIRED,yd.FORBIDDEN):new Ei.ClientError(Rd.INVALID_TOKEN,yd.UNAUTHORIZED)}}var bd,cS,Hp,ao,$N,Ei,uS,kq,Hq,Gq,qq,Gp,yd,Rd,$q,cce,lS,Ad,aS,Id=se(()=>{bd=b(require("jsonwebtoken")),cS=b(require("fs-extra")),Hp=b(require("node:path")),ao=b(require("joi")),$N=b(mt());G();Ei=b(Ee()),uS=b(Q());II();us();kq=b(Gn()),Hq=b(oS()),Gq=b(Jo()),qq=b(ds()),Gp=b(fe()),{HTTP_STATUS_CODES:yd,AUTHENTICATION_ERROR_MSGS:Rd}=Ei.hdbErrors;Gp.default.initSync();$q=Gp.default.get(x.AUTHENTICATION_OPERATIONTOKENTIMEOUT)||"1d",cce=Gp.default.get(x.AUTHENTICATION_REFRESHTOKENTIMEOUT)||"30d",lS="RS256",Ad={OPERATION:"operation",REFRESH:"refresh"};a(dS,"getJWTRSAKeys");a(VN,"createTokens");a(KN,"refreshOperationToken");a(YN,"validateOperationToken");a(fS,"validateRefreshToken");a(Vq,"validateToken")});var WN=M((TUe,Wq)=>{"use strict";var lce=Bq(),wd=require("passport"),uce=require("passport-local").Strategy,dce=require("passport-http").BasicStrategy,fce=require("util"),mce=(us(),v(ro)),Yq=fce.callbackify(mce.findAndValidateUser),SUe=Jr(),pce=(G(),v(j)),Kq=(Id(),v(qp)),{AccessViolation:hce}=Ee();wd.use(new uce(function(e,t,r){Yq(e,t,r)}));wd.use(new dce(function(e,t,r){Yq(e,t,r)}));wd.serializeUser(function(e,t){t(null,e)});wd.deserializeUser(function(e,t){t(null,e)});function Ece(e,t,r){if(e.raw?.user!==void 0)return r(null,e.raw.user);let n,s;if(e.headers?.authorization){let o=e.headers.authorization.split(" ");n=o[0],s=o[1]}function i(o,c){return o?r(o):c?r(null,c):r(new hce)}switch(a(i,"handleResponse"),n){case"Basic":wd.authenticate("basic",{session:!1},(o,c)=>{i(o,c)})(e,t,r);break;case"Bearer":e.body?.operation&&e.body.operation===pce.OPERATIONS_ENUM.REFRESH_OPERATION_TOKEN?Kq.validateRefreshToken(s).then(o=>{e.body.refresh_token=s,r(null,o)}).catch(o=>{r(o)}):Kq.validateOperationToken(s).then(o=>{r(null,o)}).catch(o=>{r(o)});break;default:wd.authenticate("local",{session:!1},function(o,c){i(o,c)})(e,t,r);break}}a(Ece,"authorize");function _ce(e,t){let r=lce(e);if(r){t(r);return}let n={authorized:!0,messages:[]},s=e.user.role;if(!s?.permission)return t("Invalid role");let i=JSON.parse(s.permission);if(i.super_user)return t(null,n);if(!i[e.schema])return n.authorized=!1,n.messages.push(`Not authorized to access ${e.schema} schema`),t(null,n);if(!i[e.schema].tables[e.table])return n.authorized=!1,n.messages.push(`Not authorized to access ${e.table} table`),t(null,n);if(!i[e.schema].tables[e.table][e.operation])return n.authorized=!1,n.messages.push(`Not authorized to access ${e.operation} on ${e.table} table`),t(null,n);if(i[e.schema].tables[e.table].attribute_permissions&&!e.attributes)return n.authorized=!1,n.messages.push(`${e.schema}.${e.table} has attribute permissions. Missing attributes to validate`),t(null,n);if(i[e.schema].tables[e.table].attribute_permissions&&e.attributes){let o=i[e.schema].tables[e.table].attribute_permissions;for(let c in o)e.attributes.indexOf(o[c].attribute_name)>-1&&!o[c][e.operation]&&(n.authorized=!1,n.messages.push(`Not authorized to ${e.operation} ${o[c].attribute_name} `))}return t(null,n)}a(_ce,"checkPermissions");Wq.exports={authorize:Ece,checkPermissions:_ce}});var ZN=M((AUe,Qq)=>{var ES=require("clone"),_S=mt(),gce=ae(),pS=(G(),v(j)),RUe=Q(),jN=require("fs"),JN=require("joi"),{string:hS}=JN.types(),{hdbErrors:Sce,handleHDBError:mS}=Ee(),{HDB_ERROR_MSGS:bUe,HTTP_STATUS_CODES:zN}=Sce,{commonValidators:Nd}=Wi(),jq=" is required",Tce=["insert","update","upsert"],QN={database:{presence:!1,format:Nd.schema_format,length:Nd.schema_length},schema:{presence:!1,format:Nd.schema_format,length:Nd.schema_length},table:{presence:!0,format:Nd.schema_format,length:Nd.schema_length},action:{inclusion:{within:Tce,message:"is required and must be either insert, update, or upsert"}},file_path:{},csv_url:{url:{allowLocal:!0}},data:{},passthrough_headers:{}},yce={schema:hS.required(),table:hS.required(),action:hS.valid("insert","update","upsert")},{AWS_ACCESS_KEY:Rce,AWS_SECRET:bce,AWS_BUCKET:Ace,AWS_FILE_KEY:Ice,REGION:wce}=pS.S3_BUCKET_AUTH_KEYS,Nce={s3:{presence:!0},[`s3.${Rce}`]:{presence:!0,type:"String"},[`s3.${bce}`]:{presence:!0,type:"String"},[`s3.${Ace}`]:{presence:!0,type:"String"},[`s3.${Ice}`]:{presence:!0,type:"String",hasValidFileExt:[".csv",".json"]},[`s3.${wce}`]:{presence:!0,type:"String"}},zq=ES(QN);zq.data.presence={message:jq};var Jq=ES(QN);Jq.file_path.presence={message:jq};var Cce=Object.assign(ES(QN),Nce),XN=ES(yce);XN.csv_url=hS.uri().messages({"string.uri":"'csv_url' must be a valid url"}).required();XN.passthrough_headers=JN.object();function Oce(e){let t=_S.validateObject(e,zq);return gS(e,t)}a(Oce,"dataObject");function Pce(e){let t=_S.validateBySchema(e,JN.object(XN));return gS(e,t)}a(Pce,"urlObject");function Lce(e){let t=_S.validateObject(e,Jq);return gS(e,t)}a(Lce,"fileObject");function Dce(e){let t=_S.validateObject(e,Cce);return gS(e,t)}a(Dce,"s3FileObject");function gS(e,t){if(!t){let r=gce.checkGlobalSchemaTable(e.schema,e.table);if(r)return mS(new Error,r,zN.BAD_REQUEST);if(e.operation===pS.OPERATIONS_ENUM.CSV_FILE_LOAD)try{jN.accessSync(e.file_path,jN.constants.R_OK|jN.constants.F_OK)}catch(n){return n.code===pS.NODE_ERROR_CODES.ENOENT?mS(n,`No such file or directory ${n.path}`,zN.BAD_REQUEST):n.code===pS.NODE_ERROR_CODES.EACCES?mS(n,`Permission denied ${n.path}`,zN.BAD_REQUEST):mS(n)}}return t}a(gS,"postValidateChecks");Qq.exports={dataObject:Oce,urlObject:Pce,fileObject:Lce,s3FileObject:Dce}});var eC=M((wUe,Xq)=>{"use strict";var $p=Q(),SS=(G(),v(j));async function vce(e,t,r,n=void 0){if(!e||typeof e!="function")throw new Error("Invalid function parameter");let s;try{return s=await e(t),r&&await r(t,s,n),t.operation===SS.OPERATIONS_ENUM.INSERT||t.operation===SS.OPERATIONS_ENUM.UPDATE||t.operation===SS.OPERATIONS_ENUM.UPSERT?(delete s.new_attributes,delete s.txn_time):t.operation===SS.OPERATIONS_ENUM.DELETE&&delete s.txn_time,s}catch(i){throw i.message&&typeof i.message=="string"&&i.message.includes("already exists")?($p.info(i.message),i):i.http_resp_msg?($p.error(`Error calling operation: ${e.name}`),$p.error(i.http_resp_msg),i):($p.error(`Error calling operation: ${e.name}`),$p.error(i),i)}}a(vce,"callOperationFunctionAsAwait");Xq.exports={callOperationFunctionAsAwait:vce}});var tC=M((CUe,e$)=>{"use strict";var{S3:Mce,GetObjectCommand:Uce}=require("@aws-sdk/client-s3");e$.exports={getFileStreamFromS3:xce,getS3AuthObj:Zq};async function xce(e){let{s3:t}=e,r={Bucket:t.bucket,Key:t.key};return(await Zq(t.aws_access_key_id,t.aws_secret_access_key,t.region).send(new Uce(r))).Body}a(xce,"getFileStreamFromS3");function Zq(e,t,r){return new Mce({credentials:{accessKeyId:e,secretAccessKey:t},region:r})}a(Zq,"getS3AuthObj")});var r$=M((PUe,t$)=>{"use strict";var rC=class{static{a(this,"BulkLoadFileObject")}constructor(t,r,n,s,i,o,c=null){this.op=t,this.action=r,this.schema=n,this.table=s,this.file_path=i,this.file_type=o,this.role_perms=c}},nC=class{static{a(this,"BulkLoadDataObject")}constructor(t,r,n,s){this.action=t,this.schema=r,this.table=n,this.data=s}};t$.exports={BulkLoadFileObject:rC,BulkLoadDataObject:nC}});var s$=M((DUe,n$)=>{"use strict";var sC=class{static{a(this,"PermissionTableResponseObject")}constructor(t,r,n=[],s=[]){this.schema=t,this.table=r,this.required_table_permissions=n,this.required_attribute_permissions=s}};n$.exports=sC});var o$=M((MUe,i$)=>{"use strict";var iC=class{static{a(this,"PermissionAttributeResponseObject")}constructor(t,r=[]){this.attribute_name=t,this.required_permissions=r}};i$.exports=iC});var aC=M((xUe,c$)=>{"use strict";var a$=s$(),Bce=o$(),{HDB_ERROR_MSGS:Fce}=Jr(),oC=class{static{a(this,"PermissionResponseObject")}constructor(){this.error=Fce.OP_AUTH_PERMS_ERROR,this.unauthorized_access={},this.invalid_schema_items=[]}handleUnauthorizedItem(t){return this.invalid_schema_items=[],this.unauthorized_access=[t],this}handleInvalidItem(t){return this.invalid_schema_items=[t],this.unauthorized_access=[],this}addInvalidItem(t,r,n){if(r&&n){let s=`${r}_${n}`;if(this.unauthorized_access[s])return}this.invalid_schema_items.push(t)}addUnauthorizedTable(t,r,n){let s=new a$(t,r,n),i=`${t}_${r}`;this.unauthorized_access[i]=s}addUnauthorizedAttributes(t,r,n,s){let i=[];t.forEach(c=>{let l=new Bce(c,s[c]);i.push(l)});let o=`${r}_${n}`;if(this.unauthorized_access[o])this.unauthorized_access[o].required_attribute_permissions=i;else{let c=new a$(r,n,[],i);this.unauthorized_access[o]=c}}getPermsResponse(){let t=Object.values(this.unauthorized_access);return t.length>0||this.invalid_schema_items.length>0?(this.unauthorized_access=t,this):null}};c$.exports=oC});var Ol=M((kUe,f$)=>{"use strict";var FUe=_n(),Vp=Q(),{validateBySchema:l$}=mt(),ea=require("joi"),kce=Xi(),TS=ae(),{handleHDBError:yS,hdbErrors:Hce,ClientError:u$}=Ee(),{HDB_ERROR_MSGS:RS,HTTP_STATUS_CODES:cC}=Hce,d$=fe();d$.initSync();var{getDatabases:lC}=(Oe(),v(pt)),Gce=require("fs-extra"),qce=(G(),v(j));f$.exports={describeAll:$ce,describeTable:bS,describeSchema:Vce};async function $ce(e={}){try{let t=TS.isEmptyOrZeroLength(e),r=!!e.bypass_auth,n,s;!t&&!r&&(n=e.hdb_user?.role?.permission,s=n?.super_user||n?.cluster_user);let i=lC(),o={},c={},l=[],u=e?.exact_count,d=e?.include_computed;for(let m in i){o[m]=!0,!t&&!s&&!r&&(c[m]=e.hdb_user?.role?.permission[m]?.describe);let p=i[m];for(let h in p)try{let E;if(t||s||r)E=await bS({schema:m,table:h,exact_count:u,include_computed:d});else if(n&&n[m].describe&&n[m].tables[h].describe){let _=n[m].tables[h].attribute_permissions;E=await bS({schema:m,table:h,exact_count:u,include_computed:d},_)}E&&l.push(E)}catch(E){Vp.error(E)}}let f={};for(let m in l)t||s||r?(f[l[m].schema]==null&&(f[l[m].schema]={}),f[l[m].schema][l[m].name]=l[m],o[l[m].schema]&&delete o[l[m].schema]):c[l[m].schema]&&(f[l[m].schema]==null&&(f[l[m].schema]={}),f[l[m].schema][l[m].name]=l[m],o[l[m].schema]&&delete o[l[m].schema]);for(let m in o)t||s||r?f[m]={}:c[m]&&(f[m]={});return f}catch(t){return Vp.error("Got an error in describeAll"),Vp.error(t),yS(new Error,RS.DESCRIBE_ALL_ERR)}}a($ce,"describeAll");async function bS(e,t){TS.transformReq(e);let{schema:r,table:n}=e;r=r?.toString(),n=n?.toString();let s=t;e.hdb_user&&!e.hdb_user?.role?.permission?.super_user&&(s=e.hdb_user?.role?.permission[r]?.tables[n]?.attribute_permissions);let i=l$(e,ea.object({database:ea.string(),table:ea.string().required(),exact_count:ea.boolean().strict(),include_computed:ea.boolean().strict()}));if(i)throw new u$(i.message);let c=lC()[r];if(!c)throw yS(new Error,RS.SCHEMA_NOT_FOUND(e.schema),cC.NOT_FOUND);let l=c[n];if(!l)throw yS(new Error,RS.TABLE_NOT_FOUND(e.schema,e.table),cC.NOT_FOUND);function u(p){(!p.computed||e.include_computed)&&d.push({attribute:p.attribute,type:p.type,elements:p.elements?.type,indexed:p.indexed,is_primary_key:p.isPrimaryKey,assigned_created_time:p.assignCreatedTime,assigned_updated_time:p.assignUpdatedTime,nullable:p.nullable,computed:p.computed?!0:void 0,properties:p.properties?p.properties.map(h=>({type:h.type,name:h.name})):void 0})}a(u,"pushAtt");let d=[];if(s){let p={};s.forEach(h=>{h.describe&&(p[h.attribute_name]=!0)}),l.attributes.forEach(h=>{p[h.name]&&u(h)})}else l.attributes?.forEach(p=>u(p));let f;try{f=(await Gce.stat(l.primaryStore.env.path)).size}catch(p){Vp.warn("unable to get database size",p)}let m={schema:r,name:l.tableName,hash_attribute:l.attributes.find(p=>p.isPrimaryKey||p.is_hash_attribute)?.name,audit:l.audit,schema_defined:l.schemaDefined,attributes:d,db_size:f};l.replicate!==void 0&&(m.replicate=l.replicate),l.expirationMS!==void 0&&(m.expiration=l.expirationMS/1e3+"s"),l.sealed!==void 0&&(m.sealed=l.sealed),l.sources?.length>0&&(m.sources=l.sources.map(p=>p.name).filter(p=>p&&p!=="NATSReplicator"&&p!=="Replicator")),d$.get(qce.CONFIG_PARAMS.CLUSTERING_ENABLED)&&(m.clustering_stream_name=kce.createNatsTableStreamName(m.schema,m.name));try{let p=await l.getRecordCount({exactCount:!!e.exact_count});m.record_count=p.recordCount,m.table_size=l.getSize(),m.db_audit_size=l.getAuditSize(),m.estimated_record_range=p.estimatedRange;let h=l.auditStore;if(h)for(let E of h.getKeys({reverse:!0,limit:1}))m.last_updated_record=E[0];if(!m.last_updated_record&&l.indices.__updatedtime__)for(let E of l.indices.__updatedtime__.getKeys({reverse:!0,limit:1}))m.last_updated_record=E}catch(p){Vp.warn(`unable to stat table dbi due to ${p}`)}return m}a(bS,"descTable");async function Vce(e){TS.transformReq(e);let t=l$(e,ea.object({database:ea.string(),exact_count:ea.boolean().strict(),include_computed:ea.boolean().strict()}));if(t)throw new u$(t.message);let r;e.hdb_user&&!e.hdb_user?.role?.permission?.super_user&&(r=e.hdb_user?.role?.permission[e.schema]);let n=e.schema.toString(),i=lC()[n];if(!i)throw yS(new Error,RS.SCHEMA_NOT_FOUND(e.schema),cC.NOT_FOUND);let o={};for(let c in i){let l;if(r&&r.tables[c]&&(l=r.tables[c]),TS.isEmpty(l)||l.describe){let u=await bS({schema:e.schema,table:c,exact_count:e.exact_count,include_computed:e.include_computed},l?l.attribute_permissions:null);u&&(o[u.name]=u)}}return o}a(Vce,"describeSchema")});var _$=M((GUe,E$)=>{"use strict";var Kce=Ol(),{hdbErrors:m$}=Ee(),{getDatabases:p$}=(Oe(),v(pt));E$.exports={checkSchemaExists:h$,checkSchemaTableExists:Yce,schemaDescribe:Kce};async function h$(e){if(!p$()[e])return m$.HDB_ERROR_MSGS.SCHEMA_NOT_FOUND(e)}a(h$,"checkSchemaExists");async function Yce(e,t){let r=await h$(e);if(r)return r;if(!p$()[e][t])return m$.HDB_ERROR_MSGS.TABLE_NOT_FOUND(e,t)}a(Yce,"checkSchemaTableExists")});var AS=M(($Ue,g$)=>{"use strict";var Wce=os();g$.exports={writeTransaction:jce};function jce(e,t,r){return Wce.writeTransaction(e,t,r)}a(jce,"writeTransaction")});var pC=M((jUe,P$)=>{"use strict";var{decode:zce}=require("msgpackr"),{isMainThread:KUe,parentPort:YUe,threadId:WUe}=require("worker_threads"),NS=_r(),Cd=Lt(),fC=(G(),v(j)),Rn=Q(),dC=fe(),Jce=(G(),v(j)),{onMessageByType:Qce}=st(),R$=Xi(),{recordAction:S$,recordActionBinary:Xce}=(hs(),v(Jg)),{publishToStream:Zce}=NS,{ConsumerEvents:T$}=require("nats"),ele=_n(),{promisify:tle}=require("util"),{decodeBlobsWithWrites:rle}=(ns(),v(q_)),b$=tle(setTimeout),CS=1e4,OS,wS,nle,sle,A$,Kp=new Map,Od=new Map;P$.exports={initialize:I$,ingestConsumer:mC,setSubscription:ile,setIgnoreOrigin:cle,getDatabaseSubscriptions:ale,updateConsumer:w$};async function I$(){Qce(fC.ITC_EVENT_TYPES.NATS_CONSUMER_UPDATE,async n=>{await w$(n)}),A$=!0,Rn.notify("Initializing clustering ingest service.");let{connection:e,jsm:t,js:r}=await NS.getNATSReferences();OS=e,wS=e.info.server_name,nle=t,sle=r}a(I$,"initialize");async function w$(e){if(e.status==="start"){let{js:t,jsm:r}=await N$(e.node_domain_name);mC(e.stream_name,t,r,e.node_domain_name)}else if(e.status==="stop"){let t=Kp.get(e.stream_name+e.node_domain_name);t&&(Rn.notify("Closing ingest consumer for node:",e.node_domain_name,"stream:",e.stream_name),await t.close?.(),Kp.set(e.stream_name+e.node_domain_name,"close")),Od.get(e.node_domain_name)==="failed"&&Od.set(e.node_domain_name,"close")}}a(w$,"updateConsumer");var PS=new Map;function ile(e,t,r){let n=PS.get(e);n||PS.set(e,n=new Map),n.set(t,r),A$||I$().then(ole)}a(ile,"setSubscription");async function ole(){let e=await ele.searchByValue({database:"system",table:"hdb_nodes",attribute:"name",value:"*"});for await(let t of e){let r=t.name+Cd.SERVER_SUFFIX.LEAF,n,s;for(let i of t.subscriptions||[])if(i.subscribe===!0){if(!n&&({js:n,jsm:s}=await N$(r),!n))break;let{schema:o,table:c}=i,l=R$.createNatsTableStreamName(o,c);mC(l,n,s,r)}}}a(ole,"accessConsumers");async function N$(e){let t,r,n=1;for(;!r;)try{t=await OS.jetstream({domain:e}),r=await OS.jetstreamManager({domain:e,checkAPI:!1})}catch(s){if(Od.get(e)==="close")break;Od.set(e,"failed"),n%10===1&&Rn.warn("Nats ingest attempting to connect to:",e,"Nats error:",s.message);let i=n++*100<CS?n++*100:CS;await b$(i)}return{js:t,jsm:r}}a(N$,"connectToRemoteJS");function ale(){return PS}a(ale,"getDatabaseSubscriptions");var C$;function cle(e){C$=e}a(cle,"setIgnoreOrigin");var O$=100,y$=new Array(O$),IS=0;async function mC(e,t,r,n){let{connection:s}=await NS.getNATSReferences();OS=s,wS=s.info.server_name;let i,o=1;for(;!i;)try{i=await t.consumers.get(e,wS),Rn.notify("Initializing ingest consumer for node:",n,"stream:",e)}catch(u){if(Od.get(n)==="close")break;o%10===1&&Rn.warn("Nats ingest error getting consumer:",n,"stream:",e,"Nats error:",u.message),u.code==="404"&&(Rn.notify("Nats ingest creating consumer for node:",n,"stream:",e),i=await NS.createConsumer(r,e,wS,new Date(Date.now()).toISOString()));let d=o++*100<CS?o++*100:CS;await b$(d)}let c=!1,l;for(;!c;){if(Kp.get(e+n)==="close"||Od.get(n)==="close"){Kp.delete(e+n),c=!0;continue}l=await i.consume({max_messages:dC.get(fC.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXCONSUMEMSGS)??100,bind:!0}),Kp.set(e+n,l);let u=!1;(async()=>{for await(let d of await l.status())if(d.type===T$.ConsumerDeleted&&(await l.close(),c=!0),d.type===T$.HeartbeatsMissed){let f=d.data;Rn.trace(`${f} clustering ingest consumer heartbeats missed, node: ${n} stream: ${l.consumer.stream}`),f===100&&(Rn.warn(`Restarting clustering ingest consumer due to missed heartbeat threshold being met, node: ${n} stream: ${l.consumer.stream}`),l.stop(),u=!0)}})();try{for await(let d of l)await y$[IS],y$[IS]=lle(d).catch(f=>{Rn.error(f)}),++IS>=O$&&(IS=0)}catch(d){d.message==="consumer deleted"?(Rn.notify("Nats consumer deleted, closing messages for node:",n,"stream:",l.consumer.stream),await l.close(),c=!0):Rn.error("Error consuming clustering ingest, restarting consumer",d)}}}a(mC,"ingestConsumer");async function lle(e){let t;await rle(()=>{t=zce(e.data)}),S$(e.data.length,"bytes-received",e.subject,t.operation,"ingest"),Rn.trace("Nats message processor message size:",e?.msg?._msg?.size,"bytes");let r=e.headers,n=!1,s=dC.get(fC.CONFIG_PARAMS.CLUSTERING_NODENAME);r.has(Cd.MSG_HEADERS.TRANSACTED_NODES)&&r.values(Cd.MSG_HEADERS.TRANSACTED_NODES).indexOf(s)>-1&&(n=!0);let i=r.get(Cd.MSG_HEADERS.ORIGIN);if(n||(n=i===s&&!C$),Xce(n,"echo",e.subject,t.operation,"ingest"),n){e.ack();return}r.append(Cd.MSG_HEADERS.TRANSACTED_NODES,s);try{let{operation:o,schema:c,next:l,table:u,records:d,hash_values:f,__origin:m,expiresAt:p}=t;Rn.trace("processing message:",o,c,u,(d?"records: "+d.map(I=>I?.id):"")+(f?"ids: "+f:""),"with sequence:",e.seq),Rn.trace(`messageProcessor nats msg id: ${e.headers.get(Cd.MSG_HEADERS.NATS_MSG_ID)}`);let h;d||(d=f);let E=new Promise(I=>h=I),{timestamp:_,user:R,node_name:S}=m||{},y=PS.get(c)?.get(u);if(!y)throw new Error(`Missing table for replication message: ${u}`);if(o==="define_schema")t.type=o,t.onCommit=h,y.send(t);else if(d.length===1&&!l)y.send({type:uC(o),value:d[0],id:f?.[0],expiresAt:p,timestamp:_,table:u,onCommit:h,user:R,nodeName:S});else{let I=d.map((H,X)=>({type:uC(o),value:H,expiresAt:p,id:f?.[X],table:u}));for(;l;)I.push({type:uC(l.operation),value:l.record,expiresAt:l.expiresAt,id:l.id,table:l.table}),l=l.next;y.send({type:"transaction",writes:I,table:u,timestamp:_,onCommit:h,user:R,nodeName:S})}dC.get(Jce.CONFIG_PARAMS.CLUSTERING_REPUBLISHMESSAGES)!==!1&&Zce(e.subject.split(".").slice(0,-1).join("."),R$.createNatsTableStreamName(c,u),e.headers,e.data),await E;let w=Date.now()-_;_&&S$(w,"replication-latency",e.subject,o,"ingest")}catch(o){Rn.error(o)}e.ack()}a(lle,"messageProcessor");function uC(e){switch(e){case"insert":case"upsert":case"update":return"put"}return e}a(uC,"convertOperation")});var _r=M((txe,W$)=>{"use strict";var Vr=fe();Vr.initSync();var ule=require("fs-extra"),dle=require("semver"),jp=require("path"),{monotonicFactory:fle}=require("ulidx"),D$=fle(),mle=require("util"),v$=require("child_process"),ple=mle.promisify(v$.exec),hle=v$.spawn,sn=Lt(),tt=(G(),v(j)),{packageJson:Ele,PACKAGE_ROOT:_le}=Rt(),LS=ae(),_i=Q(),DS=Xi(),gle=AS(),Yp=gt(),{broadcast:Sle,onMessageByType:Tle,getWorkerIndex:yle}=st(),{isMainThread:M$}=require("worker_threads"),{Encoder:Rle,decode:gC}=require("msgpackr"),U$=new Rle,{isEmpty:vl}=LS,x$=(us(),v(ro)),JUe=48*36e11;M$&&Tle(tt.ITC_EVENT_TYPES.RESTART,()=>{bn=void 0,Dl=void 0});var{connect:ble,StorageType:Ale,RetentionPolicy:Ile,AckPolicy:SC,DeliverPolicy:TC,DiscardPolicy:wle,NatsConnection:QUe,JetStreamManager:XUe,JetStreamClient:ZUe,StringCodec:exe,JSONCodec:Nle,createInbox:yC,headers:Cle,ErrorCode:L$}=require("nats"),{recordAction:Ole}=(hs(),v(Jg)),{encodeBlobsAsBuffers:Ple}=(ns(),v(q_)),B$=Nle(),Lle="clustering",Dle=Ele.engines[sn.NATS_SERVER_NAME],vle=jp.join(_le,"dependencies"),_C=jp.join(vle,`${process.platform}-${process.arch}`,sn.NATS_BINARY_NAME),hC,EC,Wp,Pl,Ll;W$.exports={runCommand:F$,checkNATSServerInstalled:Mle,createConnection:RC,getConnection:zp,getJetStreamManager:Jp,getJetStream:H$,getNATSReferences:co,getServerList:xle,createLocalStream:bC,listStreams:G$,deleteLocalStream:Ble,getServerConfig:Pd,listRemoteStreams:Fle,viewStream:kle,viewStreamIterator:Hle,publishToStream:Gle,request:Vle,reloadNATS:AC,reloadNATSHub:Kle,reloadNATSLeaf:Yle,extractServerName:$le,requestErrorHandler:Wle,createLocalTableStream:K$,createTableStreams:Jle,purgeTableStream:Y$,purgeSchemaTableStreams:Qle,getStreamInfo:Xle,updateLocalStreams:eue,closeConnection:Ule,getJsmServerName:vS,addNatsMsgHeader:q$,clearClientCache:k$,updateRemoteConsumer:jle,createConsumer:$$,updateConsumerIterator:zle};async function F$(e,t=void 0){let{stdout:r,stderr:n}=await ple(e,{cwd:t});if(n)throw new Error(n.replace(`
 `,""));return r.replace(`
 `,"")}a(F$,"runCommand");async function Mle(){try{await ule.access(_C)}catch{return!1}let e=await F$(`${_C} --version`,void 0),t=e.substring(e.lastIndexOf("v")+1,e.length);return dle.eq(t,Dle)}a(Mle,"checkNATSServerInstalled");async function RC(e,t,r,n=!0,s="127.0.0.1"){if(!t&&!r){let o=await x$.getClusterUser();if(vl(o))throw new Error("Unable to get nats connection. Cluster user is undefined.");t=o.username,r=o.decrypt_hash}_i.trace("create nats connection called");let i=await ble({name:s,port:e,user:t,pass:r,maxReconnectAttempts:-1,waitOnFirstConnect:n,timeout:2e5,tls:{keyFile:Vr.get(tt.CONFIG_PARAMS.CLUSTERING_TLS_PRIVATEKEY),certFile:Vr.get(tt.CONFIG_PARAMS.CLUSTERING_TLS_CERTIFICATE),caFile:Vr.get(tt.CONFIG_PARAMS.CLUSTERING_TLS_CERT_AUTH),rejectUnauthorized:!1}});return i.protocol.transport.socket.unref(),_i.trace("create connection established a nats client connection with id",i?.info?.client_id),i.closed().then(o=>{o&&_i.error("Error with Nats client connection, connection closed",o),i===bn&&k$()}),i}a(RC,"createConnection");function k$(){bn=void 0,Pl=void 0,Ll=void 0,Dl=void 0}a(k$,"clearClientCache");async function Ule(){bn&&(await bn.drain(),bn=void 0,Pl=void 0,Ll=void 0,Dl=void 0)}a(Ule,"closeConnection");var bn,Dl;async function zp(){return Dl||(Dl=RC(Vr.get(tt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_NETWORK_PORT),void 0,void 0),bn=await Dl),bn||Dl}a(zp,"getConnection");async function Jp(){if(Pl)return Pl;vl(bn)&&await zp();let{domain:e}=Pd(tt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF);if(vl(e))throw new Error("Error getting JetStream domain. Unable to get JetStream manager.");return Pl=await bn.jetstreamManager({domain:e,timeout:6e4}),Pl}a(Jp,"getJetStreamManager");async function H$(){if(Ll)return Ll;vl(bn)&&await zp();let{domain:e}=Pd(tt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF);if(vl(e))throw new Error("Error getting JetStream domain. Unable to get JetStream manager.");return Ll=bn.jetstream({domain:e,timeout:6e4}),Ll}a(H$,"getJetStream");async function co(){let e=bn||await zp(),t=Pl||await Jp(),r=Ll||await H$();return{connection:e,jsm:t,js:r}}a(co,"getNATSReferences");async function xle(e){let t=Vr.get(tt.CONFIG_PARAMS.CLUSTERING_HUBSERVER_NETWORK_PORT),{sys_name:r,decrypt_hash:n}=await x$.getClusterUser(),s=await RC(t,r,n),i=yC(),o=s.subscribe(i),c=[],l,u=(async()=>{for await(let d of o){let f=B$.decode(d.data);f.response_time=Date.now()-l,c.push(f)}})();return l=Date.now(),await s.publish("$SYS.REQ.SERVER.PING.VARZ",void 0,{reply:i}),await s.publish("$SYS.REQ.SERVER.PING",void 0,{reply:i}),await s.flush(),await LS.asyncSetTimeout(e),await o.drain(),await s.close(),await u,c}a(xle,"getServerList");async function bC(e,t){let{jsm:r}=await co(),n=Vr.get(tt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXAGE);n=n===null?0:n*1e9;let s=Vr.get(tt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXMSGS);s=s===null?-1:s;let i=Vr.get(tt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXBYTES);i=i===null?-1:i,await r.streams.add({name:e,storage:Ale.File,retention:Ile.Limits,subjects:t,discard:wle.Old,maxMsgs:s,maxBytes:i,maxAge:n})}a(bC,"createLocalStream");async function G$(){let{jsm:e}=await co(),t=await e.streams.list().next(),r=[];return t.forEach(n=>{r.push(n)}),r}a(G$,"listStreams");async function Ble(e){let{jsm:t}=await co();await t.streams.delete(e)}a(Ble,"deleteLocalStream");async function Fle(e){let{connection:t}=await co(),r=[],n=yC(),s=t.subscribe(n),i=(async()=>{for await(let o of s)r.push(B$.decode(o.data))})();return await t.publish(`$JS.${e}.API.STREAM.LIST`,void 0,{reply:n}),await t.flush(),await s.drain(),await i,r}a(Fle,"listRemoteStreams");async function kle(e,t=void 0,r=void 0){let{jsm:n,js:s}=await co(),i=D$(),o={durable_name:i,ack_policy:SC.Explicit};t&&(o.deliver_policy=TC.StartTime,o.opt_start_time=new Date(t).toISOString()),await n.consumers.add(e,o);let c=await s.consumers.get(e,i),l=r?await c.fetch({max_messages:r,expires:2e3}):await c.consume();if(c._info.num_pending===0)return[];let u=[];for await(let d of l){let f=gC(d.data),m={nats_timestamp:d.info.timestampNanos,nats_sequence:d.info.streamSequence,entry:f};if(d.headers&&(m.origin=d.headers.get(sn.MSG_HEADERS.ORIGIN)),u.push(m),d.ack(),d.info.pending===0)break}return await c.delete(),u}a(kle,"viewStream");async function*Hle(e,t=void 0,r=void 0){let{jsm:n,js:s}=await co(),i=D$(),o={durable_name:i,ack_policy:SC.Explicit};t&&(o.deliver_policy=TC.StartTime,o.opt_start_time=new Date(t).toISOString()),await n.consumers.add(e,o);let c=await s.consumers.get(e,i),l=r?await c.fetch({max_messages:r,expires:2e3}):await c.consume();if(c._info.num_pending===0)return[];for await(let u of l){let d=gC(u.data);d[0]||(d=[d]);for(let f of d){let m={nats_timestamp:u.info.timestampNanos,nats_sequence:u.info.streamSequence,entry:f};u.headers&&(m.origin=u.headers.get(sn.MSG_HEADERS.ORIGIN)),yield m}if(u.ack(),u.info.pending===0)break}await c.delete()}a(Hle,"viewStreamIterator");async function Gle(e,t,r,n){_i.trace(`publishToStream called with subject: ${e}, stream: ${t}, entries:`,n.operation),r=q$(n,r);let{js:s}=await co(),i=await vS(),o=`${e}.${i}`,c=await Ple(()=>n instanceof Uint8Array?n:U$.encode(n));try{_i.trace(`publishToStream publishing to subject: ${o}`),Ole(c.length,"bytes-sent",e,n.operation,"replication"),await s.publish(o,c,{headers:r})}catch(l){if(l.code&&l.code.toString()==="503")return V$(async()=>{try{await s.publish(o,c,{headers:r})}catch{if(l.code&&l.code.toString()==="503"){_i.trace(`publishToStream creating stream: ${t}`);let d=o.split(".");d[2]="*",await bC(t,[o]),await s.publish(o,c,{headers:r})}else throw l}});throw l}}a(Gle,"publishToStream");function q$(e,t){t===void 0&&(t=Cle());let r=Vr.get(tt.CONFIG_PARAMS.CLUSTERING_NODENAME);return!t.has(sn.MSG_HEADERS.ORIGIN)&&r&&t.append(sn.MSG_HEADERS.ORIGIN,r),t}a(q$,"addNatsMsgHeader");function Pd(e){e=e.toLowerCase();let t=jp.join(Vr.get(tt.CONFIG_PARAMS.ROOTPATH),Lle);if(e===tt.PROCESS_DESCRIPTORS.CLUSTERING_HUB.toLowerCase())return vl(EC)&&(EC={port:Yp.getConfigFromFile(tt.CONFIG_PARAMS.CLUSTERING_HUBSERVER_NETWORK_PORT),server_name:Yp.getConfigFromFile(tt.CONFIG_PARAMS.CLUSTERING_NODENAME)+sn.SERVER_SUFFIX.HUB,config_file:sn.NATS_CONFIG_FILES.HUB_SERVER,pid_file_path:jp.join(t,sn.PID_FILES.HUB),hdbNatsPath:t}),EC;if(e===tt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF.toLowerCase())return vl(hC)&&(hC={port:Yp.getConfigFromFile(tt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_NETWORK_PORT),server_name:Yp.getConfigFromFile(tt.CONFIG_PARAMS.CLUSTERING_NODENAME)+sn.SERVER_SUFFIX.LEAF,config_file:sn.NATS_CONFIG_FILES.LEAF_SERVER,domain:Yp.getConfigFromFile(tt.CONFIG_PARAMS.CLUSTERING_NODENAME)+sn.SERVER_SUFFIX.LEAF,pid_file_path:jp.join(t,sn.PID_FILES.LEAF),hdbNatsPath:t}),hC;_i.error(`Unable to get Nats server config. Unrecognized process: ${e}`)}a(Pd,"getServerConfig");async function $$(e,t,r,n){try{await e.consumers.add(t,{ack_policy:SC.Explicit,durable_name:r,deliver_policy:TC.StartTime,opt_start_time:n})}catch(s){if(s.message!=="consumer already exists")throw s}}a($$,"createConsumer");async function qle(e,t,r){await e.consumers.delete(t,r)}a(qle,"removeConsumer");function $le(e){return e.split(".")[1]}a($le,"extractServerName");async function Vle(e,t,r=6e4,n=yC()){if(!LS.isObject(t))throw new Error("data param must be an object");let s=U$.encode(t),{connection:i}=await co(),o={timeout:r};n&&(o.reply=n,o.noMux=!0);let c=await i.request(e,s,o);return gC(c.data)}a(Vle,"request");function AC(e){return new Promise(async(t,r)=>{let n=hle(_C,["--signal",`reload=${e}`],{cwd:__dirname}),s,i;n.on("error",o=>{r(o)}),n.stdout.on("data",o=>{i+=o.toString()}),n.stderr.on("data",o=>{s+=o.toString()}),n.stderr.on("close",o=>{s&&r(s),t(i)})})}a(AC,"reloadNATS");async function Kle(){let{pid_file_path:e}=Pd(tt.PROCESS_DESCRIPTORS.CLUSTERING_HUB);await AC(e)}a(Kle,"reloadNATSHub");async function Yle(){let{pid_file_path:e}=Pd(tt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF);await AC(e)}a(Yle,"reloadNATSLeaf");function Wle(e,t,r){let n;switch(e.code){case L$.NoResponders:n=`Unable to ${t}, node '${r}' is not listening.`;break;case L$.Timeout:n=`Unable to ${t}, node '${r}' is listening but did not respond.`;break;default:n=e.message;break}return n}a(Wle,"requestErrorHandler");async function jle(e,t){let r=t+sn.SERVER_SUFFIX.LEAF,{connection:n}=await co(),{jsm:s}=await rue(r),{schema:i,table:o}=e,c=DS.createNatsTableStreamName(i,o),l=e.start_time?e.start_time:new Date(Date.now()).toISOString();await V$(async()=>{if(e.subscribe===!0)await $$(s,c,n.info.server_name,l);else try{await qle(s,c,n.info.server_name)}catch(u){_i.trace(u)}})}a(jle,"updateRemoteConsumer");async function zle(e,t,r,n){let s=DS.createNatsTableStreamName(e,t),i=r+sn.SERVER_SUFFIX.LEAF,o={type:tt.ITC_EVENT_TYPES.NATS_CONSUMER_UPDATE,status:n,stream_name:s,node_domain_name:i};if(!M$&&yle()<Vr.get(tt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXINGESTTHREADS)){let{updateConsumer:c}=pC();await c(o)}await Sle(o),n==="stop"&&await LS.asyncSetTimeout(1e3)}a(zle,"updateConsumerIterator");function V$(e){return gle.writeTransaction(tt.SYSTEM_SCHEMA_NAME,tt.SYSTEM_TABLE_NAMES.NODE_TABLE_NAME,e)}a(V$,"exclusiveLock");async function K$(e,t){let r=DS.createNatsTableStreamName(e,t),n=await vS(),s=Zle(e,t,n);await bC(r,[s])}a(K$,"createLocalTableStream");async function Jle(e){for(let t=0,r=e.length;t<r;t++){let n=e[t].schema,s=e[t].table;await K$(n,s)}}a(Jle,"createTableStreams");async function Y$(e,t,r=void 0){if(Vr.get(tt.CONFIG_PARAMS.CLUSTERING_ENABLED))try{let n=DS.createNatsTableStreamName(e,t),{domain:s}=Pd(tt.PROCESS_DESCRIPTORS.CLUSTERING_LEAF);await(await(await zp()).jetstreamManager({domain:s,timeout:24e4})).streams.purge(n,r)}catch(n){if(n.message==="stream not found")_i.warn(n);else throw n}}a(Y$,"purgeTableStream");async function Qle(e,t){if(Vr.get(tt.CONFIG_PARAMS.CLUSTERING_ENABLED))for(let r=0,n=t.length;r<n;r++)await Y$(e,t[r])}a(Qle,"purgeSchemaTableStreams");async function Xle(e){return(await Jp()).streams.info(e)}a(Xle,"getStreamInfo");function Zle(e,t,r){return`${sn.SUBJECT_PREFIXES.TXN}.${e}${t?"."+t:""}.${r}`}a(Zle,"createSubjectName");async function vS(){if(Wp)return Wp;if(Wp=(await Jp())?.nc?.info?.server_name,Wp===void 0)throw new Error("Unable to get jetstream manager server name");return Wp}a(vS,"getJsmServerName");async function eue(){let e=await Jp(),t=await vS(),r=await G$();for(let n of r){let s=n.config,i=s.subjects[0];if(!i)continue;let o=tue(n),c=i.split(".");if(c[c.length-1]===t&&!o||s.name==="__HARPERDB_WORK_QUEUE__")continue;let u=i.split(".");u[u.length-1]=t;let d=u.join(".");_i.trace(`Updating stream subject name from: ${i} to: ${d}`),s.subjects[0]=d,await e.streams.update(s.name,s)}}a(eue,"updateLocalStreams");function tue(e){let{config:t}=e,r=!1,n=Vr.get(tt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXAGE);n=n===null?0:n*1e9;let s=Vr.get(tt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXBYTES);s=s===null?-1:s;let i=Vr.get(tt.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_STREAMS_MAXMSGS);return i=i===null?-1:i,n!==t.max_age&&(t.max_age=n,r=!0),s!==t.max_bytes&&(t.max_bytes=s,r=!0),i!==t.max_msgs&&(t.max_msgs=i,r=!0),r}a(tue,"updateStreamLimits");async function rue(e){let t,r;try{t=await bn.jetstream({domain:e}),r=await bn.jetstreamManager({domain:e,checkAPI:!1})}catch(n){throw _i.error("Unable to connect to:",e),n}return{js:t,jsm:r}}a(rue,"connectToRemoteJS")});function IC(e){let t=e.get(MS),r=t?(0,Ld.unpack)(t):null;r||(r={remoteNameToId:{}});let n=rt(),s=!1;r.nodeName=rt();let i=r.remoteNameToId;if(i[n]!==0){let o=0,c;for(let l in i){let u=i[l];u===0?c=l:u>o&&(o=u)}if(c){o++,i[c]=o;let l=[Symbol.for("seq"),o];e.rootStore.dbisDb.transactionSync(()=>{e.rootStore.dbisDb.get(l)||e.rootStore.dbisDb.putSync(l,{seqId:Xp(e)??1,nodes:[]})})}i[n]=0,e.putSync(MS,(0,Ld.pack)(r))}return r}function Qp(e){return IC(e).remoteNameToId}function z$(e,t){let r=IC(t),n=r.remoteNameToId,s=new Map,i=!1;for(let o in e){let c=e[o],l=n[o];if(l==null){let u=0;for(let d in n){let f=n[d];f>u&&(u=f)}l=u+1,n[o]=l,i=!0}s.set(c,l)}return i&&t.putSync(MS,(0,Ld.pack)(r)),s}function US(e,t){let r=IC(t),n=r.remoteNameToId,s=n[e];if(s==null){let i=0;for(let o in n){let c=n[o];c>i&&(i=c)}s=i+1,n[e]=s,t.putSync(MS,(0,Ld.pack)(r))}return j$.trace?.("The remote node name map",e,n,s),s}var j$,Ld,MS,wC=se(()=>{j$=b(sr());Es();Ld=require("msgpackr"),MS=Symbol.for("remote-ids");a(IC,"getIdMappingRecord");a(Qp,"exportIdMapping");a(z$,"remoteToLocalNodeId");a(US,"getIdOfRemoteNode")});function OC(e,t,r,n,s){let i=e.primaryStore.env.path,o=e.primaryStore.tableId,c;s?.crossThreads===!1?(c=Q$,nue(e.primaryStore,e.auditStore)):(c=J$,e.primaryStore.env.hasSubscriptionCommitListener||(e.primaryStore.env.hasSubscriptionCommitListener=!0,e.primaryStore.on("committed",()=>{X$(J$[i])})));let l=c[i]||(c[i]=[]);if(l.auditStore=e.auditStore,l.lastTxnTime==null&&(l.lastTxnTime=Date.now()),s?.scope==="full-database")return;let u=l[o];u||(u=l[o]=new Map,u.envs=l,u.tableId=o,u.store=e.primaryStore),t=Hu(t);let d=new CC(r);d.startTime=n;let f=u.get(t);return f?f.push(d):(u.set(t,f=[d]),f.tables=u,f.key=t),d.subscriptions=f,d}function X$(e){if(!e)return;let t=e.auditStore;t.resetReadTxn(),Z$(e.auditStore);let r;for(let{key:n,value:s}of t.getRange({start:e.lastTxnTime,exclusiveStart:!0})){e.lastTxnTime=n;let i=It(s),o=e[i.tableId];if(!o)continue;let c=i.recordId,l=Hu(c),u=0;do{let d=o.get(l);if(d){for(let m of d)if(!(u>0&&!(m.includeDescendants&&!(m.onlyChildren&&u>1)))){if(m.startTime>=n){(0,NC.info)("omitting",c,m.startTime,n);continue}try{let p;m.supportsTransactions&&m.txnInProgress!==i.version&&(p=!0,m.txnInProgress||(r?r.push(m):r=[m]),m.txnInProgress=i.version),m.listener(c,i,n,p)}catch(p){console.error(p),(0,NC.info)(p)}}}if(l==null)break;let f=l.lastIndexOf?.("/",l.length-2);f!==l.length-1&&u++,f>-1?l=l.slice(0,f+1):l=null}while(!0)}if(r)for(let n of r)n.txnInProgress=null,n.listener(null,{type:"end_txn"},e.lastTxnTime,!0)}function nue(e,t){let r=t||e,n=r.env;if(!n.hasAfterCommitListener){n.hasAfterCommitListener=!0;let s=n.path;r.on("aftercommit",({next:i,last:o,txnId:c})=>{let l=Q$[s];if(!l)return;let u=a(()=>{r.threadLocalWrites||(r.threadLocalWrites=new Float64Array(r.getUserSharedBuffer("last-thread-local-write",new ArrayBuffer(8)))),l.txnTime=r.threadLocalWrites[0]||Date.now();try{X$(l)}finally{r.threadLocalWrites[0]=l.lastTxnTime,r.unlock("thread-local-writes")}},"acquiredLock");r.attemptLock("thread-local-writes",u)&&u()})}}function Z$(e){e.nextTransaction?.resolve();let t;e.nextTransaction=new Promise(r=>{t=r}),e.nextTransaction.resolve=t}function eV(e){return e.nextTransaction||(OC({primaryStore:e,auditStore:e},null,null,0,{scope:"full-database"}),Z$(e)),e.nextTransaction}var NC,J$,Q$,CC,PC=se(()=>{NC=b(Q());Fu();Wa();$i();J$=Object.create(null),Q$=Object.create(null);a(OC,"addSubscription");CC=class extends rs{static{a(this,"Subscription")}listener;subscriptions;startTime;includeDescendants;supportsTransactions;onlyChildren;constructor(t){super(),this.listener=t,this.on("close",()=>this.end())}end(){if(this.subscriptions){if(this.subscriptions.splice(this.subscriptions.indexOf(this),1),this.subscriptions.length===0){let t=this.subscriptions.tables;if(t){let r=this.subscriptions.key;if(t.delete(r),t.size===0){let n=t.envs,s=t.dbi;delete n[s]}}}this.subscriptions=null}}toJSON(){return{name:"subscription"}}};a(X$,"notifyFromTransactionData");a(nue,"listenToCommits");a(Z$,"nextTransaction");a(eV,"whenNextTransaction")});var oV={};ye(oV,{commitsAwaitingReplication:()=>Dd,getHDBNodeTable:()=>Ht,getReplicationSharedStatus:()=>vd,iterateRoutes:()=>eh,shouldReplicateToNode:()=>Zp,subscribeToNodeUpdates:()=>Md});function Ht(){return tV||(tV=je({table:"hdb_nodes",database:"system",attributes:[{name:"name",isPrimaryKey:!0},{attribute:"subscriptions"},{attribute:"system_info"},{attribute:"url"},{attribute:"routes"},{attribute:"ca"},{attribute:"ca_info"},{attribute:"replicates"},{attribute:"revoked_certificates"},{attribute:"__createdtime__"},{attribute:"__updatedtime__"}]}))}function vd(e,t,r,n){return new Float64Array(e.getUserSharedBuffer(["replicated",t,r],new ArrayBuffer(64),n&&{callback:n}))}function Md(e){Ht().subscribe({}).then(async t=>{for await(let r of t){let n=r?.value?.name;iV.debug?.("adding node",n,"on  node",rt()," on process",process.pid),server.nodes=server.nodes.filter(i=>i.name!==n),r.type==="put"&&n!==rt()&&(r.value?server.nodes.push(r.value):console.error("Invalid node update event",r));let s=new Map;for await(let i of Ht().search({}))if(i.shard!=null){let o=s.get(i.shard);o||s.set(i.shard,o=[]),o.push(i)}server.shards=s,(r.type==="put"||r.type==="delete")&&e(r.value,r.id)}})}function Zp(e,t){let r=uc.default.get(x.REPLICATION_DATABASES);return(e.replicates===!0||e.replicates?.sends)&&databases[t]&&(r==="*"||r?.find?.(n=>(typeof n=="string"?n:n.name)===t&&(!n.sharded||e.shard===uc.default.get(x.REPLICATION_SHARD))))&&Ht().primaryStore.get(rt())?.replicates||e.subscriptions?.some(n=>(n.database||n.schema)===t&&n.subscribe)}function sue(){Md(e=>{dc({},(t,r)=>{let n=e.name,s=rV.get(n);if(s||rV.set(n,s=new Map),s.has(r))return;let i;for(let o in t)if(i=t[o].auditStore,i)break;if(i){let o=vd(i,r,n,()=>{let c=o[0],l=o.lastTime;for(let{txnTime:u,onConfirm:d}of Dd.get(r)||[])u>l&&u<=c&&d();o.lastTime=c});o.lastTime=0,s.set(r,o)}})})}function*eh(e){for(let t of e.routes||[]){let r=t.url,n;if(typeof t=="string"?t.includes("://")?r=t:n=t:n=t.hostname??t.host,n&&!r){let s=uc.default.get(x.REPLICATION_SECUREPORT)??(!uc.default.get(x.REPLICATION_PORT)&&uc.default.get(x.OPERATIONSAPI_NETWORK_SECUREPORT)),i;(i=n.match(/:(\d+)$/)?.[1])?n=n.slice(0,-i[0].length-1):t.port?i=t.port:i=s||uc.default.get(x.REPLICATION_PORT)||uc.default.get(x.OPERATIONSAPI_NETWORK_PORT);let o=i?.lastIndexOf?.(":");o>0&&(i=+i.slice(o+1).replace(/[\[\]]/g,"")),r=(s?"wss://":"ws://")+n+":"+i}if(!r){nV.isMainThread&&console.error("Invalid route, must specify a url or host (with port)");continue}yield{replicates:!t.subscriptions,url:r,subscription:t.subscriptions,routes:t.routes,startTime:t.startTime,revoked_certificates:t.revokedCertificates}}}var nV,sV,uc,iV,tV,rV,Dd,Ud=se(()=>{Oe();Es();Om();nV=require("worker_threads"),sV=b(Ee()),uc=b(fe());G();iV=b(sr());server.nodes=[];a(Ht,"getHDBNodeTable");a(vd,"getReplicationSharedStatus");a(Md,"subscribeToNodeUpdates");a(Zp,"shouldReplicateToNode");rV=new Map;rx((e,t,r)=>{if(r>server.nodes.length)throw new sV.ClientError(`Cannot confirm replication to more nodes (${r}) than are in the network (${server.nodes.length})`);Dd||(Dd=new Map,sue());let n=Dd.get(e);return n||(n=[],Dd.set(e,n)),new Promise(s=>{let i=0;n.push({txnTime:t,onConfirm:a(()=>{++i===r&&s()},"onConfirm")})})});a(sue,"startSubscriptionToReplications");a(eh,"iterateRoutes")});var mV={};ye(mV,{connectedToNode:()=>Ml,disconnectedFromNode:()=>Bd,ensureNode:()=>ta,requestClusterStatus:()=>fV,startOnMainThread:()=>LC});async function LC(e){let t=0,r=lt();for(let o of Object.getOwnPropertyNames(r)){let c=r[o];for(let l in c){let u=c[l];if(u.auditStore){xS.set(o,Xp(u.auditStore));break}}}gi.whenThreadsStarted.then(async()=>{let o=[];for await(let u of r.system.hdb_nodes?.search([])||[])o.push(u);let c=rt();function l(){let u=Ht().primaryStore.get(c);if(u!==null){let d=e.url??fc();if(u===void 0||u.url!==d||u.shard!==e.shard)return ta(c,{name:c,url:d,shard:e.shard,replicates:!0})}}a(l,"ensureThisNode"),Ht().primaryStore.get(c)&&l();for(let u of eh(e))try{let d=!u.subscriptions;if(d&&await l(),d&&u.replicates==null&&(u.replicates=!0),aV.push(u),o.find(f=>f.url===u.url))continue;s(u)}catch(d){console.error(d)}Md(s)});let n;function s(o,c=o?.name){let l=rt()&&c===rt()||fc()&&o?.url===fc();if(l){let m=!!o?.replicates;if(n!==void 0&&n!==m)for(let p of Ht().search([]))p.replicates&&p.name!==c&&s(p,p.name);n=m}if(ot.trace("Setting up node replication for",o),!o){for(let[m,p]of lo){let h;for(let[E,{worker:_,nodes:R}]of p){let S=R[0];if(S&&S.name==c){h=!0;for(let[y,{worker:w}]of p)p.delete(y),ot.warn("Node was deleted, unsubscribing from node",c,y,m),w?.postMessage({type:"unsubscribe-from-node",node:c,nodes:R,database:y,url:m});break}}if(h){lo.get(m).iterator.remove(),lo.delete(m);return}}return}if(l)return;if(!o.url){ot.info(`Node ${o.name} is missing url`);return}let u=lo.get(o.url);if(u&&u.iterator.remove(),!(o.replicates===!0||o.replicates?.sends)&&!o.subscriptions?.length&&!u)return;if(ot.info(`Added node ${o.name} at ${o.url} for process ${rt()}`),o.replicates&&o.subscriptions&&(o={...o,subscriptions:null}),o.name){for(let[m,p]of xd)if(o.url===p.url){xd.delete(m);break}xd.set(o.name,o)}let d=lt();if(u||(u=new Map,lo.set(o.url,u)),u.iterator=dc(e,(m,p,h)=>{h?f(p,!0):f(p,!1)}),o.subscriptions)for(let m of o.subscriptions){let p=m.database||m.schema;d[p]||(ot.warn(`Database ${p} not found for node ${o.name}, making a subscription anyway`),f(p,!1))}function f(m,p){ot.trace("Setting up replication for database",m,"on node",o.name);let h=u.get(m),E,_=[{replicateByDefault:p,...o}];xS.has(m)&&th.default.get(x.REPLICATION_FAILOVER)&&(_.push({replicateByDefault:p,name:rt(),startTime:xS.get(m),endTime:Date.now(),replicates:!0}),xS.delete(m));let R=Zp(o,m),S=gi.workers.filter(y=>y.name==="http");if(h){if(E=h.worker,h.nodes=_,R)return}else R&&(t=t%S.length,E=S[t++],E||ot.warn("No http workers available to subscribe to node",o.name,o.url),u.set(m,{worker:E,nodes:_,url:o.url}),E?.on("exit",()=>{u.get(m)?.worker===E&&(u.delete(m),f(m,p))}));if(R){let y=iue.HDB_LEADER_URL??process.env.HDB_LEADER_URL??aV[0]?.url,w=y?new URL(y).hostname:Array.from(Ht().primaryStore.getKeys({}).filter(H=>H!==rt()))[0],I=_[0].name??(_[0].url&&new URL(_[0].url).hostname);ot.warn(`Setting up subscription with leader ${w} for node ${I}`),_[0].isLeader=!w||I===w,setTimeout(()=>{let H={..._[0],type:"subscribe-to-node",database:m,nodes:_};E?E.postMessage(H):rh(H)},oue)}else{ot.info("Node no longer should be used, unsubscribing from node",{replicates:o.replicates,databaseName:m,node:o,subscriptions:o.subscriptions,hasDatabase:!!d[m],thisReplicates:Ht().primaryStore.get(rt())?.replicates}),Ht().primaryStore.get(rt())?.replicates||(n=!1,ot.info("Disabling replication, this node name",rt(),Ht().primaryStore.get(rt()),m));let y={type:"unsubscribe-from-node",database:m,url:o.url,name:o.name,nodes:_};E?E.postMessage(y):FS(y)}}a(f,"onDatabase")}a(s,"onNodeUpdate"),Bd=a(function(o){try{ot.info("Disconnected from node",o.name,o.url,"finished",!!o.finished);let c=Array.from(xd.keys()),l=c.sort(),u=l.indexOf(o.name||Si(o.url));if(u===-1){ot.warn("Disconnected node not found in node map",o.name,c);return}let d=lo.get(o.url),f=d?.get(o.database);if(!f){ot.warn("Disconnected node not found in replication map",o.database,d);return}if(f.connected=!1,o.finished||!th.default.get(x.REPLICATION_FAILOVER))return;let m=f.nodes[0];if(!(m.replicates===!0||m.replicates?.sends||m.subscriptions?.length))return;let p=m.shard,h=(u+1)%l.length;for(;u!==h;){let E=l[h],_=xd.get(E);d=lo.get(_.url);let R=d?.get(o.database);if(!R||R.connected===!1||R.nodes[0].shard!==p){h=(h+1)%l.length;continue}let{nodes:S}=R,y=!1;for(let w of f.nodes){if(S.some(I=>I.name===w.name)){ot.info(`Disconnected node is already failing over to ${E} for ${o.database}`);continue}w.endTime<Date.now()||(S.push(w),ot.info(`Failing over ${o.database} from ${o.name} to ${E}`),i(w,o.database,R.nodes[0]),y=!0)}f.nodes=[f.nodes[0]],y||ot.info(`Disconnected node ${o.name} has no nodes to fail over to ${E}`);return}ot.warn("Unable to find any other node to fail over to",o.name,o.url)}catch(c){ot.error("Error failing over node",c)}},"disconnectedFromNode"),Ml=a(function(o){let c=lo.get(o.url),l=c?.get(o.database);if(!l){ot.warn("Connected node not found in replication map, this may be because the node is being removed",o.database,c);return}l.connected=!0,l.latency=o.latency;let u=l.nodes[0];if(!u){ot.warn("Newly connected node has no node subscriptions",o.database,l);return}if(!u.name){ot.debug("Connected node is not named yet",o.database,l);return}if(!th.default.get(x.REPLICATION_FAILOVER))return;l.nodes=[u];let d=!1;for(let f of lo.values()){let m=f.get(o.database);if(!m||m==l)continue;let{worker:p,nodes:h,connected:E}=m;if(h)if(E===!1&&h[0].shard===u.shard&&node.url===u.url)for(let _ of h)i(_,o.database);else{let _=h.filter(R=>{if(R)return R.name===u.name&&R.worker?(R.worker.postMessage({type:"unsubscribe-to-node",database:o.database,url:o.url,nodes:[R]}),!1):!0});_.length<h.length&&(m.nodes=_)}}},"connectedToNode");function i(o,c,l=o){let u=gi.workers.filter(f=>f.name==="http");t=t%u.length;let d=u[t++];Object.defineProperty(o,"worker",{value:d,configurable:!0}),d?d.postMessage({url:l.url,name:l.name,type:"subscribe-to-node",database:c,nodes:[o]}):rh({url:l.url,name:l.name,database:c,nodes:[o]})}a(i,"connectToNextWorker"),(0,gi.onMessageByType)("disconnected-from-node",Bd),(0,gi.onMessageByType)("connected-to-node",Ml),(0,gi.onMessageByType)("request-cluster-status",fV)}function fV(e,t){let r=[];for(let[n,s]of xd)try{let i=lo.get(s.url);ot.info("Getting cluster status for",n,s.url,"has dbs",i?.size);let o=[];if(i){for(let[l,{worker:u,connected:d,nodes:f,latency:m}]of i)o.push({database:l,connected:d,latency:m,threadId:u?.threadId,nodes:f.filter(p=>!(p.endTime<Date.now())).map(p=>p.name)});let c=lV(s);c.database_sockets=o,delete c.ca,delete c.node_name,delete c.__updatedtime__,delete c.__createdtime__,r.push(c)}}catch(i){ot.warn("Error getting cluster status for",s?.url,i)}return t?.postMessage({type:"cluster-status",connections:r}),{connections:r}}async function ta(e,t){let r=Ht();e=e??Si(t.url),t.name=e;try{if(t.ca){let s=new uV.X509Certificate(t.ca);t.ca_info={issuer:s.issuer.replace(/\n/g," "),subject:s.subject.replace(/\n/g," "),subjectAltName:s.subjectAltName,serialNumber:s.serialNumber,validFrom:s.validFrom,validTo:s.validTo}}}catch(s){ot.error("Error parsing replication CA info for hdb_nodes table",s.message)}let n=r.primaryStore.get(e);if(ot.debug(`Ensuring node ${e} at ${t.url}, existing record:`,n,"new record:",t),!n)await r.patch(t);else{t.replicates&&!th.default.get(x.CLUSTERING_ENABLED)&&(t.subscriptions=null);for(let s in t)if(n[s]!==t[s]&&s==="subscriptions"&&t[s]&&n[s]){let i=[],o=lV(n[s]);for(let c of t[s]){let l=!1;for(let u of o)if((c.database??c.schema)===(u.database??u.schema)&&c.table===u.table){u.publish=c.publish,u.subscribe=c.subscribe,l=!0;break}l||i.push(c)}t.subscriptions=[...o,...i];break}if(Array.isArray(t.revoked_certificates)){let s=n.revoked_certificates||[];t.revoked_certificates=[...new Set([...s,...t.revoked_certificates])]}ot.info(`Updating node ${e} at ${t.url}`),await r.patch(t)}}var gi,BS,ot,cV,th,uV,dV,lV,iue,oue,lo,Bd,Ml,xd,xS,aV,nh=se(()=>{Oe();gi=b(st());Es();BS=require("worker_threads");Ud();ot=b(Q()),cV=b(require("lodash")),th=b(fe());G();uV=require("crypto"),dV=b(require("minimist")),{cloneDeep:lV}=cV.default,iue=(0,dV.default)(process.argv),oue=200,lo=new Map,xd=new Map,xS=new Map,aV=[];a(LC,"startOnMainThread");a(fV,"requestClusterStatus");BS.parentPort&&(Bd=a(e=>{BS.parentPort.postMessage({type:"disconnected-from-node",...e})},"disconnectedFromNode"),Ml=a(e=>{BS.parentPort.postMessage({type:"connected-to-node",...e})},"connectedToNode"),(0,gi.onMessageByType)("subscribe-to-node",e=>{rh(e)}),(0,gi.onMessageByType)("unsubscribe-from-node",e=>{FS(e)}));a(ta,"ensureNode")});var gs=M(Gt=>{"use strict";var gr=require("path"),{watch:aue}=require("chokidar"),Vn=require("fs-extra"),Fd=require("node-forge"),SV=require("net"),{generateKeyPair:DC,X509Certificate:ra,createPrivateKey:TV,randomBytes:cue}=require("node:crypto"),lue=require("util");DC=lue.promisify(DC);var Mt=Fd.pki,Ti=require("joi"),{v4:yV}=require("uuid"),{validateBySchema:xC}=mt(),{forComponent:uue}=Q(),_s=fe(),Hs=(G(),v(j)),{CONFIG_PARAMS:xl}=Hs,yi=FI(),{ClientError:mc}=Ee(),HS=require("node:tls"),{relative:RV,join:due}=require("node:path"),{CERTIFICATE_VALUES:pV}=yi,fue=el(),vC=gt(),{table:mue,getDatabases:pue,databases:kS}=(Oe(),v(pt)),{getJWTRSAKeys:hV}=(Id(),v(qp)),Xe=uue("tls").conditional;Gt.generateKeys=kC;Gt.updateConfigCert=PV;Gt.createCsr=yue;Gt.signCertificate=Rue;Gt.setCertTable=kd;Gt.loadCertificates=NV;Gt.reviewSelfSignedCert=GC;Gt.createTLSSelector=DV;Gt.listCertificates=MV;Gt.addCertificate=Cue;Gt.removeCertificate=Pue;Gt.createNatsCerts=Iue;Gt.generateCertsKeys=Aue;Gt.getReplicationCert=ih;Gt.getReplicationCertAuth=Tue;Gt.renewSelfSigned=wue;Gt.hostnamesFromCert=$C;Gt.getKey=Lue;Gt.getHostnamesFromCertificate=Due;Gt.getPrimaryHostName=qC;Gt.generateSerialNumber=$S;var{urlToNodeName:bV,getThisNodeUrl:hue,getThisNodeName:qS,clearThisNodeName:Eue}=(Es(),v(na)),{readFileSync:_ue,statSync:AV}=require("node:fs"),bxe=fe(),{getTicketKeys:gue,onMessageFromWorkers:Sue}=st(),{isMainThread:IV}=require("worker_threads"),{TLSSocket:wV,createSecureContext:Axe}=require("node:tls"),BC=3650,sh=["127.0.0.1","localhost","::1"],FC=[{name:"countryName",value:"USA"},{name:"stateOrProvinceName",value:"Colorado"},{name:"localityName",value:"Denver"},{name:"organizationName",value:"HarperDB, Inc."}];function $S(){let e=cue(8);return e[0]=e[0]&127|1,e.toString("hex")}a($S,"generateSerialNumber");Sue(async e=>{e.type===Hs.ITC_EVENT_TYPES.RESTART&&(_s.initSync(!0),await GC())});var on;function hc(){return on||(on=pue().system.hdb_certificate,on||(on=mue({table:"hdb_certificate",database:"system",attributes:[{name:"name",isPrimaryKey:!0},{attribute:"uses"},{attribute:"certificate"},{attribute:"is_authority"},{attribute:"private_key_name"},{attribute:"details"},{attribute:"is_self_signed"},{attribute:"__updatedtime__"}]}))),on}a(hc,"getCertTable");async function ih(){let e=DV("operations-api"),t={secureContexts:null,setSecureContext:a(s=>{},"setSecureContext")};await e.initialize(t);let r=t.secureContexts.get(qS());if(!r)return;let n=new ra(r.options.cert);return r.cert_parsed=n,r.issuer=n.issuer,r}a(ih,"getReplicationCert");async function Tue(){hc();let e=(await ih()).options.cert,r=new ra(e).issuer.match(/CN=(.*)/)?.[1];return on.get(r)}a(Tue,"getReplicationCertAuth");var EV,pc=new Map;function NV(){if(EV)return;EV=!0;let e=[{configKey:xl.TLS},{configKey:xl.OPERATIONSAPI_TLS}];hc();let t=gr.dirname(vC.getConfigFilePath()),r;for(let{configKey:n}of e){let s=vC.getConfigFromFile(n);if(s){Array.isArray(s)||(s=[s]);for(let i of s){let o=i.privateKey,c=o&&RV(due(t,"keys"),o);c&&_V(o,l=>{pc.set(c,l)},"private key");for(let l of[!1,!0]){let u=i[l?"certificateAuthority":"certificate"];if(u&&IV){let d;_V(u,f=>{if(pV.cert===f)return;let m=i.hostname??i.hostnames??i.host??i.hosts;m&&!Array.isArray(m)&&(m=[m]);let p=LV(u),h=new ra(p),E;try{E=qC(h)}catch(y){Xe.error?.("error extracting host name from certificate",y);return}if(E==null){Xe.error?.("No host name found on certificate");return}if(h.checkIssued(new ra(pV.cert)))return;let _=on.primaryStore.get(E),R=AV(u).mtimeMs,S=!_||_.is_self_signed?1:_.file_timestamp??_.__updatedtime__;if(_&&R<=S){R<S&&Xe.info?.(`Certificate ${E} at ${u} is older (${new Date(R)}) than the certificate in the database (${S>1?new Date(S):"only self signed certificate available"})`);return}r=on.put({name:E,uses:["https",...n.includes("operations")?["operations"]:[]],ciphers:i.ciphers,certificate:p,private_key_name:c,is_authority:l,hostnames:m,fileTimestamp:R,details:{issuer:h.issuer.replace(/\n/g," "),subject:h.subject?.replace(/\n/g," "),subject_alt_name:h.subjectAltName,serial_number:h.serialNumber,valid_from:h.validFrom,valid_to:h.validTo}})},l?"certificate authority":"certificate")}}}}}return r}a(NV,"loadCertificates");function _V(e,t,r){let n,s=a((i,o)=>{try{let c=o.mtimeMs;c&&c!==n&&(n&&IV&&Xe.warn?.(`Reloading ${r}:`,i),n=c,t(LV(i)))}catch(c){Xe.error?.(`Error loading ${r}:`,i,c)}},"loadFile");Vn.existsSync(e)?s(e,AV(e)):Xe.error?.(`${r} file not found:`,e),aue(e,{persistent:!1}).on("change",s)}a(_V,"loadAndWatch");function MC(){let e=hue();if(e==null){let t=sh[0];return Xe.info?.("replication url is missing from harperdb-config.yaml, using default host"+t),t}return bV(e)}a(MC,"getHost");function GS(){let e=qS();if(e==null){let t=sh[0];return Xe.info?.("replication url is missing from harperdb-config.yaml, using default host"+t),t}return e}a(GS,"getCommonName");async function yue(){let e=await ih(),t=Mt.certificateFromPem(e.options.cert),r=Mt.privateKeyFromPem(e.options.key);Xe.info?.("Creating CSR with cert named:",e.name);let n=Mt.createCertificationRequest();n.publicKey=t.publicKey;let s=[{name:"commonName",value:GS()},...FC];Xe.info?.("Creating CSR with subject",s),n.setSubject(s);let i=[{name:"unstructuredName",value:"HarperDB, Inc."},{name:"extensionRequest",extensions:CV()}];return Xe.info?.("Creating CSR with attributes",i),n.setAttributes(i),n.sign(r),Fd.pki.certificationRequestToPem(n)}a(yue,"createCsr");function CV(){let e=sh.includes(GS())?sh:[...sh,GS()];return e.includes(MC())||e.push(MC()),[{name:"basicConstraints",cA:!1,critical:!0},{name:"keyUsage",digitalSignature:!0,keyEncipherment:!0,critical:!0},{name:"extKeyUsage",serverAuth:!0,clientAuth:!0},{name:"nsCertType",client:!0,server:!0},{name:"subjectAltName",altNames:e.map(t=>SV.isIP(t)?{type:7,ip:t}:{type:2,value:t})}]}a(CV,"certExtensions");async function Rue(e){let t={},r=gr.join(_s.getHdbBasePath(),Hs.LICENSE_KEY_DIR_NAME);if(e.csr){let n,s;hc();for await(let d of on.search([]))if(d.is_authority&&!d.details.issuer.includes("HarperDB-Certificate-Authority")){if(pc.has(d.private_key_name)){n=pc.get(d.private_key_name),s=d;break}else if(d.private_key_name&&await Vn.exists(gr.join(r,d.private_key_name))){n=Vn.readFile(gr.join(r,d.private_key_name)),s=d;break}}if(!n){let d=await UC();s=d.ca,n=d.private_key}n=Mt.privateKeyFromPem(n),t.signingCA=s.certificate;let i=Mt.certificateFromPem(s.certificate);Xe.info?.("Signing CSR with cert named",s.name);let o=Mt.certificationRequestFromPem(e.csr);try{o.verify()}catch(d){return Xe.error?.(d),new Error("Error verifying CSR: "+d.message)}let c=Fd.pki.createCertificate();c.serialNumber=$S(),c.validity.notBefore=new Date;let l=new Date;c.validity.notAfter=l,c.validity.notAfter.setDate(l.getDate()+BC),Xe.info?.("sign cert setting validity:",c.validity),Xe.info?.("sign cert setting subject from CSR:",o.subject.attributes),c.setSubject(o.subject.attributes),Xe.info?.("sign cert setting issuer:",i.subject.attributes),c.setIssuer(i.subject.attributes);let u=o.getAttribute({name:"extensionRequest"}).extensions;Xe.info?.("sign cert adding extensions from CSR:",u),c.setExtensions(u),c.publicKey=o.publicKey,c.sign(n,Fd.md.sha256.create()),t.certificate=Mt.certificateToPem(c)}else Xe.info?.("Sign cert did not receive a CSR from:",e.url,"only the CA will be returned");return t}a(Rue,"signCertificate");async function bue(e,t){await kd({name:qS(),uses:["https","wss"],certificate:e,private_key_name:"privateKey.pem",is_authority:!1,is_self_signed:!0}),await kd({name:t.subject.getField("CN").value,uses:["https","wss"],certificate:Mt.certificateToPem(t),private_key_name:"privateKey.pem",is_authority:!0,is_self_signed:!0})}a(bue,"createCertificateTable");async function kd(e){let t;try{t=new ra(e.certificate)}catch(r){Xe.error?.(`Failed to parse certificate for ${e.name}:`,r.message),Xe.debug?.("Certificate record details:",JSON.stringify(e,null,2));let n=new Error(`Invalid certificate format for ${e.name}: ${r.message}. This may be due to corrupted certificate data during transfer or encoding issues.`);throw n.code="INVALID_CERTIFICATE_FORMAT",n.cause=r,n}e.details={issuer:t.issuer.replace(/\n/g," "),subject:t.subject?.replace(/\n/g," "),subject_alt_name:t.subjectAltName,serial_number:t.serialNumber,valid_from:t.validFrom,valid_to:t.validTo},hc(),await on.patch(e)}a(kd,"setCertTable");async function kC(){let e=await DC("rsa",{modulusLength:4096,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem"}});return{publicKey:Mt.publicKeyFromPem(e.publicKey),privateKey:Mt.privateKeyFromPem(e.privateKey)}}a(kC,"generateKeys");async function HC(e,t,r){let n=Mt.createCertificate();if(!t){let o=await ih();t=Mt.certificateFromPem(o.options.cert).publicKey}n.publicKey=t,n.serialNumber=$S(),n.validity.notBefore=new Date;let s=new Date;n.validity.notAfter=s,n.validity.notAfter.setDate(s.getDate()+BC);let i=[{name:"commonName",value:GS()},...FC];return n.setSubject(i),n.setIssuer(r.subject.attributes),n.setExtensions(CV()),n.sign(e,Fd.md.sha256.create()),Mt.certificateToPem(n)}a(HC,"generateCertificates");async function UC(){let e=await MV(),t;for(let r of e){if(!r.is_authority)continue;let n=await vV(r.private_key_name);if(r.private_key_name&&n&&new ra(r.certificate).checkPrivateKey(TV(n))){Xe.trace?.(`CA named: ${r.name} found with matching private key`),t={ca:r,private_key:n};break}}if(t)return t;Xe.trace?.("No CA found with matching private key")}a(UC,"getCertAuthority");async function OV(e,t,r=!0){let n=Mt.createCertificate();n.publicKey=t,n.serialNumber=$S(),n.validity.notBefore=new Date;let s=new Date;n.validity.notAfter=s,n.validity.notAfter.setDate(s.getDate()+BC);let i=[{name:"commonName",value:`HarperDB-Certificate-Authority-${_s.get(xl.REPLICATION_HOSTNAME)??bV(_s.get(xl.REPLICATION_URL))??yV().split("-")[0]}`},...FC];n.setSubject(i),n.setIssuer(i),n.setExtensions([{name:"basicConstraints",cA:!0,critical:!0},{name:"keyUsage",keyCertSign:!0,critical:!0},{name:"subjectKeyIdentifier"}]),n.sign(e,Fd.md.sha256.create());let o=gr.join(_s.getHdbBasePath(),Hs.LICENSE_KEY_DIR_NAME),c=gr.join(o,yi.PRIVATEKEY_PEM_NAME);return r&&await Vn.writeFile(c,Mt.privateKeyToPem(e)),n}a(OV,"generateCertAuthority");async function Aue(){let{privateKey:e,publicKey:t}=await kC(),r=await OV(e,t),n=await HC(e,t,r);await bue(n,r),PV()}a(Aue,"generateCertsKeys");async function Iue(){let e=await HC(Mt.privateKeyFromPem(yi.CERTIFICATE_VALUES.key),void 0,Mt.certificateFromPem(yi.CERTIFICATE_VALUES.cert)),t=gr.join(_s.getHdbBasePath(),Hs.LICENSE_KEY_DIR_NAME),r=gr.join(t,yi.NATS_CERTIFICATE_PEM_NAME);await Vn.exists(r)||await Vn.writeFile(r,e);let n=gr.join(t,yi.NATS_CA_PEM_NAME);await Vn.exists(n)||await Vn.writeFile(n,yi.CERTIFICATE_VALUES.cert)}a(Iue,"createNatsCerts");async function wue(){hc();for await(let e of on.search([{attribute:"is_self_signed",value:!0}]))await on.delete(e.name);await GC()}a(wue,"renewSelfSigned");async function GC(){Eue(),await NV(),hc();let e=await UC();if(!e){Xe.notify?.("A matching Certificate Authority and key was not found. A new CA will be created in advance, so it's available if needed.");let r=a(u=>{try{return{key:Mt.privateKeyFromPem(Vn.readFileSync(u)),keyPath:u}}catch(d){return Xe.warn?.(`Failed to parse private key from ${u}:`,d.message),{key:null,keyPath:u}}},"tryToParseKey"),n=_s.get(xl.TLS),s,i;if(Array.isArray(n)){for(let u of n)if(u.privateKey){let d=r(u.privateKey);if(s=d.key,i=d.keyPath,d.key)break}}else{let u=_s.get(xl.TLS_PRIVATEKEY),d=r(u);s=d.key,i=d.keyPath}let o=gr.join(_s.getHdbBasePath(),Hs.LICENSE_KEY_DIR_NAME),c=RV(o,i);s||(Xe.warn?.("Unable to parse the TLS key",i,"A new key will be generated and used to create Certificate Authority"),{privateKey:s}=await kC(),Vn.existsSync(gr.join(o,yi.PRIVATEKEY_PEM_NAME))&&(c=`privateKey${yV().split("-")[0]}.pem`),await Vn.writeFile(gr.join(o,c),Mt.privateKeyToPem(s)));let l=await OV(s,Mt.setRsaPublicKey(s.n,s.e),!1);await kd({name:l.subject.getField("CN").value,uses:["https"],certificate:Mt.certificateToPem(l),private_key_name:c,is_authority:!0,is_self_signed:!0})}if(!await ih()){let r=qS();Xe.notify?.(`A suitable replication certificate was not found, creating new self singed cert named: ${r}`),e=e??await UC();let n=Mt.certificateFromPem(e.ca.certificate),s=n.publicKey,i=await HC(Mt.privateKeyFromPem(e.private_key),s,n);await kd({name:r,uses:["https","operations","wss"],certificate:i,is_authority:!1,private_key_name:e.ca.private_key_name,is_self_signed:!0})}}a(GC,"reviewSelfSignedCert");function PV(){let e=fue(Object.keys(Hs.CONFIG_PARAM_MAP),!0),t=gr.join(_s.getHdbBasePath(),Hs.LICENSE_KEY_DIR_NAME),r=gr.join(t,yi.PRIVATEKEY_PEM_NAME),n=gr.join(t,yi.NATS_CERTIFICATE_PEM_NAME),s=gr.join(t,yi.NATS_CA_PEM_NAME),i=Hs.CONFIG_PARAMS,o={[i.TLS_PRIVATEKEY]:e[i.TLS_PRIVATEKEY.toLowerCase()]?e[i.TLS_PRIVATEKEY.toLowerCase()]:r};e[i.TLS_CERTIFICATE.toLowerCase()]&&(o[i.TLS_CERTIFICATE]=e[i.TLS_CERTIFICATE.toLowerCase()]),e[i.TLS_CERTIFICATEAUTHORITY.toLowerCase()]&&(o[i.TLS_CERTIFICATEAUTHORITY]=e[i.TLS_CERTIFICATEAUTHORITY.toLowerCase()]),e[i.OPERATIONSAPI_TLS_CERTIFICATE.toLowerCase()]&&(o[i.OPERATIONSAPI_TLS_CERTIFICATE]=e[i.OPERATIONSAPI_TLS_CERTIFICATE.toLowerCase()]),e[i.OPERATIONSAPI_TLS_PRIVATEKEY.toLowerCase()]&&(o[i.OPERATIONSAPI_TLS_PRIVATEKEY]=e[i.OPERATIONSAPI_TLS_PRIVATEKEY.toLowerCase()]),e[i.OPERATIONSAPI_TLS_CERTIFICATEAUTHORITY.toLowerCase()]&&(o[i.OPERATIONSAPI_TLS_CERTIFICATEAUTHORITY]=e[i.OPERATIONSAPI_TLS_CERTIFICATEAUTHORITY.toLowerCase()]),(e[i.CLUSTERING_ENABLED.toLowerCase()]||e.clustering)&&(o[i.CLUSTERING_TLS_CERTIFICATE]=e[i.CLUSTERING_TLS_CERTIFICATE.toLowerCase()]??n,o[i.CLUSTERING_TLS_CERT_AUTH]=e[i.CLUSTERING_TLS_CERT_AUTH.toLowerCase()]??s,o[i.CLUSTERING_TLS_PRIVATEKEY]=e[i.CLUSTERING_TLS_PRIVATEKEY.toLowerCase()]??r),vC.updateConfigValue(void 0,void 0,o,!1,!0)}a(PV,"updateConfigCert");function LV(e){return e.startsWith("-----BEGIN")?e:_ue(e,"utf8")}a(LV,"readPEM");var gV=HS.createSecureContext;HS.createSecureContext=function(e){if(!e.cert||!e.key)return gV(e);let t={...e};delete t.key,delete t.cert;let r=gV(t);return r.context.setCert(e.cert),r.context.setKey(e.key,void 0),r};var Nue=wV.prototype._init;wV.prototype._init=function(e,t){Nue.call(this,e,t);let r=this;this._handle.oncertcb=function(n){let s=n.servername;r._SNICallback(s,(i,o)=>{this.sni_context=o?.context||o,this.certCbDone()})}};var Ul=new Map;function DV(e,t){let r=new Map,n,s=!1;return i.initialize=o=>i.ready?i.ready:(o&&(o.secureContexts=r,o.secureContextsListeners=[]),i.ready=new Promise((c,l)=>{async function u(){try{r.clear(),Ul.clear();let d=0;if(kS===void 0){c();return}for await(let f of kS.system.hdb_certificate.search([])){let m=f.certificate,p=new ra(m);f.is_authority&&(p.asString=m,Ul.set(p.subject,m))}for await(let f of kS.system.hdb_certificate.search([]))try{if(f.is_authority)continue;let m=e==="operations-api",p=f.is_self_signed?1:3;m&&f.uses?.includes?.("operations")&&(p+=1);let h=await vV(f.private_key_name),E=f.certificate,_=new ra(E);if(Ul.has(_.issuer)&&(E+=`
-`+Ul.get(_.issuer)),!h||!E)throw new Error("Missing private key or certificate for secure server");let R={ciphers:f.ciphers,ticketKeys:gue(),availableCAs:Ul,ca:t&&Array.from(Ul.values()),cert:E,key:h,key_file:f.private_key_name,is_self_signed:f.is_self_signed};o&&(R.sessionIdContext=o.sessionIdContext);let S=f.hostnames??$C(_);Array.isArray(S)||(S=[S]);for(let I of S)I===MC()&&(p+=1);let y=HS.createSecureContext(R);y.name=f.name,y.options=R,y.quality=p,y.certificateAuthorities=Array.from(Ul),y.certStart=E.toString().slice(0,100);let w;for(let I of S)if(I){I[0]==="*"&&(s=!0,I=I.slice(1)),SV.isIP(I)&&(w=!0);let H=r.get(I)?.quality??0;Xe.trace?.("Assigning TLS for hostname",I,"if",p,">",H),p>H&&r.set(I,y)}else Xe.error?.("No hostname found for certificate at",HS.certificate);Xe.trace?.("Adding TLS",y.name,"for",o.ports||"client","cert named",f.name,"hostnames",S,"quality",p,"best quality",d),p>d&&(i.defaultContext=n=y,d=p,o&&(o.defaultContext=y))}catch(m){Xe.error?.("Error applying TLS for",f.name,m)}o?.secureContextsListeners.forEach(f=>f()),c(n)}catch(d){l(d)}}a(u,"updateTLS"),kS?.system.hdb_certificate.subscribe({listener:a(()=>setTimeout(()=>u(),1500).unref(),"listener"),omitCurrent:!0}),u()})),i;function i(o,c){Xe.info?.("TLS requested for",o||"(no SNI)");let l=o;for(;;){let d=r.get(l);if(d)return Xe.debug?.("Found certificate for",o,d.certStart),d.updatedContext&&(d=d.updatedContext),c(null,d);if(s&&l){let f=l.indexOf(".",1);f<0?l="":l=l.slice(f)}else break}o?Xe.debug?.("No certificate found to match",o,"using the default certificate"):Xe.debug?.("No SNI, using the default certificate",n?.name);let u=n;u?u.updatedContext&&(u=u.updatedContext):Xe.info?.("No default certificate found"),c(null,u)}a(i,"SNICallback")}a(DV,"createTLSSelector");async function vV(e){let t=pc.get(e);return!t&&e?await Vn.readFile(gr.join(_s.get(xl.ROOTPATH),Hs.LICENSE_KEY_DIR_NAME,e),"utf8"):t}a(vV,"getPrivateKeyByName");async function MV(){hc();let e=[];for await(let t of on.search([]))e.push(t);return e}a(MV,"listCertificates");async function Cue(e){let t=xC(e,Ti.object({name:Ti.string().required(),certificate:Ti.string().required(),is_authority:Ti.boolean().required(),private_key:Ti.string(),hosts:Ti.array(),uses:Ti.array()}));if(t)throw new mc(t.message);let{name:r,certificate:n,private_key:s,is_authority:i}=e,o=new ra(n),c=!1,l=!1,u;for(let[p,h]of pc)!s&&!c&&o.checkPrivateKey(TV(h))&&(c=!0,u=p),s&&s===h&&(l=!0,u=p);if(!i&&!s&&!c)throw new mc("A suitable private key was not found for this certificate");let d;if(!r){try{d=qC(o)}catch(p){Xe.error?.(p)}if(d==null)throw new mc("Error extracting certificate host name, please provide a name parameter")}let f=Oue(r??d);s&&!c&&!l&&(await Vn.writeFile(gr.join(_s.getHdbBasePath(),Hs.LICENSE_KEY_DIR_NAME,f+".pem"),s),pc.set(f,s));let m={name:r??d,certificate:n,is_authority:i,hosts:e.hosts,uses:e.uses};return(!i||i&&u||i&&s)&&(m.private_key_name=u??f+".pem"),e.ciphers&&(m.ciphers=e.ciphers),await kd(m),"Successfully added certificate: "+f}a(Cue,"addCertificate");function Oue(e){return e.replace(/[^a-z0-9\.]/gi,"-")}a(Oue,"sanitizeName");async function Pue(e){let t=xC(e,Ti.object({name:Ti.string().required()}));if(t)throw new mc(t.message);let{name:r}=e;hc();let n=await on.get(r);if(!n)throw new mc(r+" not found");let{private_key_name:s}=n;if(s){let i=Array.from(await on.search([{attribute:"private_key_name",value:s}]));i.length===1&&i[0].name===r&&(Xe.info?.("Removing private key named",s),await Vn.remove(gr.join(_s.getHdbBasePath(),Hs.LICENSE_KEY_DIR_NAME,s)))}return await on.delete(r),"Successfully removed "+r}a(Pue,"removeCertificate");function qC(e){let t=e.subject?.match(/CN=(.*)/)?.[1];return t||$C(e)[0]}a(qC,"getPrimaryHostName");function $C(e){if(e.subjectAltName)return e.subjectAltName.split(",").map(r=>{let n=r.indexOf(":");if(r=r.slice(n+1),r=r.trim(),r[0]==='"')try{r=JSON.parse(r)}catch{}return r.indexOf("=")>-1?r.match(/CN=([^,]*)/)?.[1]:r}).filter(r=>r);let t=e.subject?.match(/CN=(.*)/)?.[1];return t?[t]:[]}a($C,"hostnamesFromCert");async function Lue(e){if(e.bypass_auth!==!0)throw new mc("Unauthorized","401");let t=xC(e,Ti.object({name:Ti.string().required()}));if(t)throw new mc(t.message);let{name:r}=e;if(r===".jwtPrivate")return(await hV()).privateKey;if(r===".jwtPublic")return(await hV()).publicKey;if(pc.get(r))return pc.get(e.name);throw new mc("Key not found")}a(Lue,"getKey");function Due(e){return[e.subject?.CN,...e.subjectaltname.split(",").filter(t=>t.trim().startsWith("DNS:")).map(t=>t.trim().substring(4))]}a(Due,"getHostnamesFromCertificate")});var n1={};ye(n1,{BACK_PRESSURE_RATIO_POSITION:()=>t1,CONFIRMATION_STATUS_POSITION:()=>e1,LATENCY_POSITION:()=>XS,NodeReplicationConnection:()=>Gd,OPERATION_REQUEST:()=>jC,RECEIVED_TIME_POSITION:()=>zS,RECEIVED_VERSION_POSITION:()=>jS,RECEIVING_STATUS_POSITION:()=>JS,RECEIVING_STATUS_RECEIVING:()=>r1,RECEIVING_STATUS_WAITING:()=>zC,SENDING_TIME_POSITION:()=>ah,createWebSocket:()=>ZS,databaseSubscriptions:()=>_c,replicateOverWS:()=>ch,tableUpdateListeners:()=>XC});async function ZS(e,t){let{authorization:r,rejectUnauthorized:n}=t||{},s=rt(),i;if(e==null)throw new TypeError(`Invalid URL: Expected a string URL for node "${s}" but received ${e}`);if(e.includes("wss://")){if(!YC){let l=(0,JV.createTLSSelector)("operations-api"),u={secureContexts:null};await l.initialize(u),YC=u.secureContexts}if(i=YC.get(s),i&&le.debug?.("Creating web socket for URL",e,"with certificate named:",i.name),!i&&n!==!1)throw new Error("Unable to find a valid certificate to use for replication to connect to "+e)}let o={};r&&(o.Authorization=r);let c={headers:o,localAddress:s?.startsWith("127.0")?s:void 0,servername:(0,XV.isIP)(t?.serverName)?void 0:t?.serverName,noDelay:!0,highWaterMark:128*1024,rejectUnauthorized:n!==!1,secureContext:void 0};return i&&((Hd?.caCount!==sa.size||Hd?.derivedFromContext!==i)&&(Hd=QV.createSecureContext({...i.options,ca:[...sa,...i.options.availableCAs.values()]}),Hd.caCount=sa.size,Hd.derivedFromContext=i),c.secureContext=Hd),new WV.WebSocket(e,"harperdb-replication-v1",c)}function ch(e,t,r){let n=t.port||t.securePort,s=QC.pid%1e3+"-"+jV.threadId+(n?"s:"+n:"c:"+t.url?.slice(-4))+" "+Math.random().toString().slice(2,3);le.debug?.(s,"Initializing replication connection",r);let i=0,o=Buffer.allocUnsafeSlow(1024),c=0,l=new DataView(o.buffer,0,1024),u=t.database,d=t.databaseSubscriptions||_c,f,m,p=!1,h=t.subscription;h?.then&&h.then(A=>{h=A,h.auditStore&&(f=h.auditStore)});let E=t.tables||u&&lt()[u],_,R=new Map,S=[];_=r.name,_&&t.connection&&(t.connection.nodeName=_);let y,w,I,H,X,q,k,z=6e4,Y,ce=0,de=0,te=0,Se=YV.default.get(x.REPLICATION_BLOBTIMEOUT)??12e4,Ne=new Map,Ke=[],$e=0,Ir;if(t.url){let A=a(()=>{X&&de===e._socket?.bytesRead&&te===e._socket?.bytesWritten?e.terminate():(X=performance.now(),e.ping(),de=e._socket?.bytesRead,te=e._socket?.bytesWritten)},"sendPing");I=setInterval(A,VV).unref(),A()}else nr();e._socket?.setMaxListeners(200);function nr(){clearTimeout(H),de=e._socket?.bytesRead,te=e._socket?.bytesWritten,H=setTimeout(()=>{de===e._socket?.bytesRead&&te===e._socket?.bytesWritten&&(le.warn?.(`Timeout waiting for ping from ${_}, terminating connection and reconnecting`),e.terminate())},VV*2).unref()}a(nr,"resetPingTimer");let zr=0,xr=0,Ou=!1,zc=3e4;function Ft(){if(pn?.length>0){let A=performance.now(),U=A-xr;zr=(zr*zc+(Ou?U:0))/(zc+U),m&&(m[t1]=zr),xr=A}}a(Ft,"updateBackPressureRatio"),setInterval(Ft,zc).unref();function Ps(){if(!(!_||!u))return m||(m=vd(f,u,_)),m}a(Ps,"getSharedStatus"),u&&Jc(u);let Ha,o_,cm=[],a_=[],lm,ve=[],c_=[],Yb=[],Pu=150,ki=25,Ls=0,um=0,dm=!1,xo,Dn,pn,Br;e.on("message",Lu);async function Lu(A){if(r=await r,!r){le.error?.(s,"No authorization provided"),Fr(1008,"Unauthorized");return}fm(A),e.off("message",Lu),e.on("message",fm)}a(Lu,"onWSMessageWhenAuthorized");function fm(A){ce=performance.now();try{let U=A.dataView=new Hl(A.buffer,A.byteOffset,A.byteLength);if(A[0]>127){let W=(0,at.decode)(A),[J,F,he]=W;switch(J){case xV:{if(F){if(_){if(_!==F){le.error?.(s,`Node name mismatch, expecting to connect to ${_}, but peer reported name as ${F}, disconnecting`),e.send((0,at.encode)([oh])),Fr(1008,"Node name mismatch");return}}else if(_=F,t.connection?.tentativeNode){let me=t.connection.tentativeNode;me.name=_,t.connection.tentativeNode=null,ta(_,me)}if(t.connection&&(t.connection.nodeName=_),le.debug?.(s,"received node name:",_,"db:",u??W[2]),!u)try{Jc(u=W[2]),u==="system"&&(Ha=dc(t,(me,ie)=>{$a(ie)&&K(ie)}),e.on("close",()=>{Ha?.remove()}))}catch(me){le.warn?.(s,"Error setting database",me),e.send((0,at.encode)([oh])),Fr(1008,me.message);return}mm()}break}case qV:{le.debug?.(s,"Received table definitions for",F.map(me=>me.table));for(let me of F){let ie=W[2];me.database=ie;let Ce;if($a(ie)){if(u==="system")Me[ie]?.[me.table]||(Ce=D(me,Me[ie]?.[me.table]));else{if(ie!=="data"&&!Me[ie]){le.warn?.("Database not found",ie);return}Ce=D(me,Me[ie]?.[me.table])}f||(f=Ce?.auditStore),E||(E=lt()?.[ie])}}break}case oh:Fr();break;case jC:try{let me=r?.replicates||r?.subscribers||r?.name;le.debug?.("Received operation request",F,"from",_),server.operation(F,{user:r},!me).then(ie=>{le.debug?.("Requested request from finished",_,ie),Array.isArray(ie)&&(ie={results:ie}),ie.requestId=F.requestId,e.send((0,at.encode)([KS,ie]))},ie=>{le.debug?.("Failed requested operation from",_,ie),e.send((0,at.encode)([KS,{requestId:F.requestId,error:VC(ie)}]))})}catch(me){e.send((0,at.encode)([KS,{requestId:F.requestId,error:VC(me)}]))}break;case KS:let{resolve:ue,reject:_e}=R.get(F.requestId);le.debug?.("Received completed operation request",_,F),F.error?_e(new Error(F.error)):ue(F),R.delete(F.requestId);break;case KC:let re=W[3];if(!E){u?le.error?.(s,"No database found for",u):le.error?.(s,"Database name never received"),Fr();return}let oe=E[re];oe=D({table:re,database:u,attributes:F.attributes,schemaDefined:F.schemaDefined},oe),cm[he]={name:re,decoder:new at.Packr({useBigIntExtension:!0,randomAccessStructure:!0,freezeData:!0,typedStructs:F.typedStructs,structures:F.structures}),getEntry(me){return oe.primaryStore.getEntry(me)},rootStore:oe.primaryStore.rootStore};break;case BV:Br=f?z$(F,f):new Map,lm=W[2],le.debug?.(s,`Acknowledged subscription request, receiving messages for nodes: ${lm}`);break;case FV:let ge=he;Yb[ge]=F;break;case GV:Ps()[e1]=F,le.trace?.(s,"received and broadcasting committed update",F),Ps().buffer.notify();break;case HV:y=F,h.send({type:"end_txn",localTime:y,remoteNodeIds:S}),Ps(),replication_shared_status[jS]=last_sequence_id_received,replication_shared_status[zS]=Date.now(),replication_shared_status[JS]=zC;break;case YS:{let me=W[1],{fileId:ie,size:Ce,finished:Be,error:He}=me,Te=Ne.get(ie);le.debug?.("Received blob",ie,"has stream",!!Te,"connectedToBlob",!!Te?.connectedToBlob,"length",W[2].length,"finished",Be),Te||(Te=new WC.PassThrough,Te.expectedSize=Ce,Ne.set(ie,Te)),Te.lastChunk=Date.now();let ht=W[2];We(ht.byteLength,"bytes-received",`${_}.${u}`,"replication","blob");try{Be?(He?(Te.on("error",()=>{}),Te.destroy(new Error("Blob error: "+He+" for record "+(Te.recordId??"unknown")+" from "+_))):Te.end(ht),Te.connectedToBlob&&Ne.delete(ie)):Te.write(ht)}catch(Ct){le.error?.(`Error receiving blob for ${Te.recordId} from ${_} and streaming to storage`,Ct),Ne.delete(ie)}break}case kV:{let me=F,ie;try{let Ce=W[3],Be=a_[he]||(a_[he]=E[W[4]]);if(!Be)return le.warn?.("Unknown table id trying to handle record request",he);let He=Be.primaryStore.getBinaryFast(Symbol.for("structures")),Te=He?.length??0;if(Te>0&&Te!==um){um=Te;let Ct=(0,at.decode)(He);e.send((0,at.encode)([KC,{typedStructs:Ct.typed,structures:Ct.named},he,Be.tableName]))}let ht=Be.primaryStore.getBinaryFast(Ce);if(ht){let Ct=Be.primaryStore.decoder.decode(ht,{valueAsBuffer:!0}),Ot=ut||{};Ot.version=(0,ZV.getLastVersion)(),ut&&ut[qd]&Xr&&(Ct=Buffer.from(Ct),xm(()=>Be.primaryStore.decoder.decode(ht),u_=>Ga(u_,Ce),Be.primaryStore.rootStore)),ie=(0,at.encode)([VS,me,{value:Ct,expiresAt:Ot.expiresAt,version:Ot.version,residencyId:Ot.residencyId,nodeId:Ot.nodeId,user:Ot.user}])}else ie=(0,at.encode)([VS,me])}catch(Ce){ie=(0,at.encode)([VS,me,{error:Ce.message}])}e.send(ie);break}case VS:{let{resolve:me,reject:ie,tableId:Ce,key:Be}=R.get(W[1]),He=W[2];if(He?.error)ie(new Error(He.error));else if(He){let Te;G_(()=>{let ht=cm[Ce].decoder.decode(He.value);He.value=ht,He.key=Be,me(He)||Te&&setTimeout(()=>Te.forEach(F_),6e4).unref()},f?.rootStore,ht=>{let Ct=qa(ht,Be);return Te||(Te=[]),Te.push(Ct),Ct})}else me();R.delete(W[1]);break}case UV:{pn=F;let me,ie,Ce=!1;if(h){if(u!==h.databaseName&&!h.then){le.error?.("Subscription request for wrong database",u,h.databaseName);return}}else h=d.get(u);if(le.debug?.(s,"received subscription request for",u,"at",pn),!h){let De;h=new Promise(ft=>{le.debug?.("Waiting for subscription to database "+u),De=ft}),h.ready=De,_c.set(u,h)}if(r.name)ie=Ht().subscribe(r.name),ie.then(async De=>{me=De;for await(let ft of me){let kr=ft.value;if(!(kr?.replicates===!0||kr?.replicates?.receives||kr?.subscriptions?.some(fr=>(fr.database||fr.schema)===u&&fr.publish!==!1))){Ce=!0,Fr(1008,`Unauthorized database subscription to ${u}`);return}}},De=>{le.error?.(s,"Error subscribing to HDB nodes",De)});else if(!(r?.role?.permission?.super_user||r.replicates)){e.send((0,at.encode)([oh])),Fr(1008,`Unauthorized database subscription to ${u}`);return}if(Dn&&(le.debug?.(s,"stopping previous subscription",u),Dn.emit("close")),pn.length===0)return;let Be=pn[0],He=a(De=>{if(De&&(Be.replicateByDefault?!Be.tables.includes(De.tableName):Be.tables.includes(De.tableName)))return{table:De}},"tableToTableEntry"),Te={txnTime:0},ht,Ct,Ot=1/0,u_,d_=a((De,ft)=>{if(De.type==="end_txn"){Te.txnTime&&(o[i]!==66&&le.error?.("Invalid encoding of message"),C(9),C(QS),O(u_=ft),nU()),i=c,Te.txnTime=0;return}let kr=De.nodeId,fr=De.tableId,zt=Ct[fr];if(!zt&&(zt=Ct[fr]=He(h.tableById[fr]),!zt))return le.debug?.("Not subscribed to table",fr);let yt=zt.table,Mu=yt.primaryStore,si=Mu.encoder;(De.extendedType&tT||!si.typedStructs)&&(si._mergeStructures(si.getStructures()),si.typedStructs&&(si.lastTypedStructuresLength=si.typedStructs.length));let f_=ht[kr];if(!(f_&&f_.startTime<ft&&(!f_.endTime||f_.endTime>ft)))return WS&&le.trace?.(s,"skipping replication update",De.recordId,"to:",_,"from:",kr,"subscribed:",ht),sU();WS&&le.trace?.(s,"sending replication update",De.recordId,"to:",_,"from:",kr,"subscribed:",ht);let Wb=De.version,Qc=De.residencyId,jb=l_(Qc,yt),m_;if(jb&&!jb.includes(_)){let Hi=l_(De.previousResidencyId,yt);if(Hi&&!Hi.includes(_)&&(De.type==="put"||De.type==="patch")||yt.getResidencyById)return sU();let Xc=De.recordId;le.trace?.(s,"sending invalidation",Xc,_,"from",kr);let pm=0;Qc&&(pm|=Fl),De.previousResidencyId&&(pm|=kl);let Qb,p_=null;for(let iU in yt.indices){if(!p_){if(Qb=De.getValue(Mu,!0),!Qb)break;p_={}}p_[iU]=Qb[iU]}m_=Bl(De.version,fr,Xc,null,kr,De.user,De.type==="put"||De.type==="patch"?"invalidate":De.type,si.encode(p_),pm,Qc,De.previousResidencyId,De.expiresAt)}function sU(){return le.trace?.(s,"skipping audit record",De.recordId),q||(q=setTimeout(()=>{q=null,(u_||0)+$V/2<Ot&&(WS&&le.trace?.(s,"sending skipped sequence update",Ot),e.send((0,at.encode)([HV,Ot])))},$V).unref()),new Promise(setImmediate)}a(sU,"skipAuditRecord");let zb=si.typedStructs,Jb=si.structures;if((zb?.length!=zt.typed_length||Jb?.length!=zt.structure_length)&&(zt.typed_length=zb?.length,zt.structure_length=Jb.length,le.debug?.(s,"send table struct",zt.typed_length,zt.structure_length),zt.sentName||(zt.sentName=!0),e.send((0,at.encode)([KC,{typedStructs:zb,structures:Jb,attributes:yt.attributes,schemaDefined:yt.schemaDefined},fr,zt.table.tableName]))),Qc&&!c_[Qc]&&(e.send((0,at.encode)([FV,jb,Qc])),c_[Qc]=!0),Te.txnTime!==Wb&&(Te.txnTime&&(WS&&le.trace?.(s,"new txn time, sending queued txn",Te.txnTime),o[i]!==66&&le.error?.("Invalid encoding of message"),nU()),Te.txnTime=Wb,i=c,O(Wb)),m_)C(m_.length),P(m_);else{let Hi=De.encoded;De.extendedType&Xr&&xm(()=>De.getValue(Mu),pm=>Ga(pm,De.recordId),Mu.rootStore);let Xc=Hi[0]===66?8:0;C(Hi.length-Xc),P(Hi,Xc),le.trace?.("wrote record",De.recordId,"length:",Hi.length)}if(e._socket.writableNeedDrain){let Hi=performance.now();return Ou=!0,Ft(),new Promise(Xc=>{le.debug?.(`Waiting for remote node ${_} to allow more commits ${e._socket.writableNeedDrain?"due to network backlog":"due to requested flow directive"}`),e._socket.once("drain",()=>{Xc(),Ou=!1,Ft()})})}else return $e>ki?new Promise(Hi=>{Ir=Hi}):new Promise(setImmediate)},"sendAuditRecord"),nU=a(()=>{c-i>8?(e.send(o.subarray(i,c)),le.debug?.(s,"Sent message, size:",c-i),u!=="system"&&We(c-i,"bytes-sent",`${_}.${u}`,"replication","egress")):le.debug?.(s,"skipping empty transaction")},"sendQueuedData");Dn=new JC.EventEmitter,Dn.once("close",()=>{Ce=!0,me?.end()});for(let{startTime:De}of pn)De<Ot&&(Ot=De);(ie||Promise.resolve()).then(async()=>{h=await h,f=h.auditStore,Ct=h.tableById.map(He),ht=[];for(let{name:ft,startTime:kr,endTime:fr}of pn){let zt=US(ft,f);le.debug?.("subscription to",ft,"using local id",zt,"starting",kr),ht[zt]={startTime:kr,endTime:fr}}K(u),Ha||(Ha=Gl(ft=>{ft.databaseName===u&&K(u)}),o_=lh(ft=>{ft===u&&(e.send((0,at.encode)([oh])),Fr())}),e.on("close",()=>{Ha?.remove(),o_?.remove()})),e.send((0,at.encode)([BV,Qp(h.auditStore),pn.map(({name:ft})=>ft)]));let De=!0;do{if(isFinite(Ot)||(le.warn?.("Invalid sequence id "+Ot),Fr(1008,"Invalid sequence id"+Ot)),De&&!Ce&&(De=!1,Ot===0)){le.info?.("Replicating all tables to",_);let ft=Date.now(),kr=eT(f);for(let fr in E){if(!He(fr))continue;let zt=E[fr];for(let yt of zt.primaryStore.getRange({snapshot:!1,versions:!0})){if(Ce)return;le.trace?.(s,"Copying record from",u,fr,yt.key,yt.localTime),ft=Math.max(yt.localTime??1,ft),Ps()[ah]=1;let Mu=Bl(yt.version,zt.tableId,yt.key,null,kr,null,"put",xm(()=>zt.primaryStore.encoder.encode(yt.value),si=>Ga(si,yt.key)),yt.metadataFlags&-256,yt.residencyId,null,yt.expiresAt);await d_({recordId:yt.key,tableId:zt.tableId,type:"put",getValue(){return yt.value},encoded:Mu,version:yt.version,residencyId:yt.residencyId,nodeId:kr,extendedType:yt.metadataFlags},yt.localTime)}}Te.txnTime||(Te.txnTime=ft,O(ft)),c-i>8&&d_({type:"end_txn"},Ot),Ps()[ah]=0,Ot=ft}for(let{key:ft,value:kr}of f.getRange({start:Ot||1,exclusiveStart:!0,snapshot:!1})){if(Ce)return;let fr=It(kr);le.debug?.("sending audit record",ft,fr.recordId),Ps()[ah]=ft,Ot=ft,await d_(fr,ft),Dn.startTime=ft}c-i>8&&d_({type:"end_txn"},Ot),Ps()[ah]=0,await eV(f)}while(!Ce)}).catch(De=>{le.error?.(s,"Error handling subscription to node",De),Fr(1008,"Error handling subscription to node")});break}}return}U.position=8;let N=!0,L,$;do{Ps();let W=U.readInt();if(W===9&&U.getUint8(U.position)==QS){U.position++,y=$=U.readFloat64(),m[jS]=y,m[zS]=Date.now(),m[JS]=zC,h.send({type:"end_txn",localTime:y,remoteNodeIds:S}),le.trace?.("received remote sequence update",y,u);break}let J=U.position,F=It(A,J,J+W),he=cm[F.tableId];he||le.error?.(`No table found with an id of ${F.tableId}`);let ue;F.residencyId&&(ue=Yb[F.residencyId],le.trace?.(s,"received residency list",ue,F.type,F.recordId));let _e=F.recordId;try{G_(()=>{L={table:he.name,id:F.recordId,type:F.type,nodeId:Br.get(F.nodeId),residencyList:ue,timestamp:F.version,value:F.getValue(he),user:F.user,beginTxn:N,expiresAt:F.expiresAt}},f?.rootStore,re=>qa(re,_e))}catch(re){throw re.message+=" record id: "+_e,re.message+=" typed structures for current decoder"+JSON.stringify(he.decoder.typedStructs),re.message+=" structures for current decoder"+JSON.stringify(he.decoder.structures),re}N=!1,le.debug?.(s,"received replication message",F.type,"id",L.id,"version",new Date(F.version),"nodeId",L.nodeId),m[jS]=F.version,m[zS]=Date.now(),m[JS]=r1,h.send(L),U.position=J+W}while(U.position<A.byteLength);Ls++,u!=="system"&&We(A.byteLength,"bytes-received",`${_}.${u}.${L?.table||"unknown_table"}`,"replication","ingest"),Ls>Pu&&!dm&&(dm=!0,e.pause(),le.debug?.(`Commit backlog causing replication back-pressure, requesting that ${_} pause replication`)),h.send({type:"end_txn",localTime:y,remoteNodeIds:S,async onCommit(){if(L){let W=Date.now()-L.timestamp;u!=="system"&&We(W,"replication-latency",_+"."+u+"."+L.table,L.type,"ingest")}Ls--,dm&&(dm=!1,e.resume(),le.debug?.(`Replication resuming ${_}`)),Ke.length>0&&await Promise.all(Ke),le.trace?.("All blobs finished"),!w&&$&&(le.trace?.(s,"queuing confirmation of a commit at",$),setTimeout(()=>{e.send((0,at.encode)([GV,w])),le.trace?.(s,"sent confirmation of a commit at",w),w=null},Mue)),w=$,le.debug?.("last sequence committed",new Date($),u)}})}catch(U){le.error?.(s,"Error handling incoming replication message",U)}}a(fm,"onWSMessage"),e.on("ping",nr),e.on("pong",()=>{if(t.connection){let A=performance.now()-X;t.connection.latency=A,Ps()&&(m[XS]=A),t.isSubscriptionConnection&&Ml({name:_,database:u,url:t.url,latency:A})}X=null}),e.on("close",(A,U)=>{clearInterval(I),clearTimeout(H),clearInterval(k),Dn&&Dn.emit("close"),xo&&xo.end();for(let[N,{reject:L}]of R)L(new Error(`Connection closed ${U?.toString()} ${A}`));le.debug?.(s,"closed",A,U?.toString())});function Fr(A,U){try{e.isFinished=!0,le.debug?.(s,"closing",_,u,A,U),e.close(A,U),t.connection?.emit("finished")}catch(N){le.error?.(s,"Error closing connection",N)}}a(Fr,"close");let Du=new Set;async function Ga(A,U){let N=k_(A);if(Du.has(N)){le.debug?.("Blob already being sent",N);return}Du.add(N);try{let L;$e++;for await(let $ of A.stream())L&&(le.debug?.("Sending blob chunk",N,"length",L.length),e.send((0,at.encode)([YS,{fileId:N,size:A.size},L]))),L=$,e._socket.writableNeedDrain&&(le.debug?.("draining",N),await new Promise(W=>e._socket.once("drain",W)),le.debug?.("drained",N)),We($.length,"bytes-sent",`${_}.${u}`,"replication","blob");le.debug?.("Sending final blob chunk",N,"length",L.length),e.send((0,at.encode)([YS,{fileId:N,size:A.size,finished:!0},L]))}catch(L){le.warn?.("Error sending blob",L,"blob id",N,"for record",U),e.send((0,at.encode)([YS,{fileId:N,finished:!0,error:VC(L)},Buffer.alloc(0)]))}finally{Du.delete(N),$e--,$e<ki&&Ir?.()}}a(Ga,"sendBlobs");function qa(A,U){let N=k_(A),L=Ne.get(N);le.debug?.("Received transaction with blob",N,"has stream",!!L,"ended",!!L?.writableEnded),L?L.writableEnded&&Ne.delete(N):(L=new WC.PassThrough,Ne.set(N,L)),L.connectedToBlob=!0,L.lastChunk=Date.now(),L.recordId=U,A.size===void 0&&L.expectedSize&&(A.size=L.expectedSize);let $=L.blob??createBlob(L,A);L.blob=$;let W=Ho(()=>Um($).saving,h.auditStore?.rootStore);return W&&(W.blobId=N,Ke.push(W),W.finally(()=>{le.debug?.(`Finished receiving blob stream ${N}`),Ke.splice(Ke.indexOf(W),1)})),$}a(qa,"receiveBlobs");function mm(){if(p||(p=!0,t.connection?.on("subscriptions-updated",mm)),!f&&h&&(f=h.auditStore),t.connection?.isFinished)throw new Error("Can not make a subscription request on a connection that is already closed");let A=new Map;f||(f=h?.auditStore);try{for(let L of h?.dbisDB?.getRange({start:Symbol.for("seq"),end:[Symbol.for("seq"),Buffer.from([255])]})||[])for(let $ of L.value.nodes||[])$.lastTxnTime>(A.get($.id)??0)&&A.set($.id,$.lastTxnTime)}catch(L){if(!L.message.includes("Can not re"))throw L}let U=t.connection?.nodeSubscriptions?.[0];S=[];let N=t.connection?.nodeSubscriptions.map((L,$)=>{let W=[],{replicateByDefault:J}=L;if(L.subscriptions){for(let _e of L.subscriptions)if(_e.subscribe&&(_e.schema||_e.database)===u){let re=_e.table;E?.[re]?.replicate!==!1&&W.push(re)}J=!1}else for(let _e in E)(J?E[_e].replicate===!1:E[_e].replicate)&&W.push(_e);let F=f&&US(L.name,f),he=h?.dbisDB?.get([Symbol.for("seq"),F])??1,ue=Math.max(he?.seqId??1,(typeof L.startTime=="string"?new Date(L.startTime).getTime():L.startTime)??1);if(le.debug?.("Starting time recorded in db",L.name,F,u,he?.seqId,"start time:",ue,new Date(ue)),U!==L){let _e=f&&US(U.name,f),re=h?.dbisDB?.get([Symbol.for("seq"),_e])??1;for(let oe of re?.nodes||[])oe.name===L.name&&(ue=oe.seqId,le.debug?.("Using sequence id from proxy node",U.name,ue))}return F===void 0?le.warn("Starting subscription request from node",L,"but no node id found"):S.push(F),A.get(F)>ue&&(ue=A.get(F),le.debug?.("Updating start time from more recent txn recorded",U.name,ue)),ue===1&&(L.isLeader?(le.warn?.(`Requesting full copy of database ${u} from ${L.url}`),ue=0):ue=Date.now()-6e4),le.trace?.(s,"defining subscription request",L.name,u,new Date(ue)),{name:L.name,replicateByDefault:J,tables:W,startTime:ue,isLeader:L.isLeader,endTime:L.endTime}});if(N)if(le.debug?.(s,"sending subscription request",N,h?.dbisDB?.path),clearTimeout(Y),N.length>0)e.send((0,at.encode)([UV,N]));else{let L=a(()=>{let $=performance.now();Y=setTimeout(()=>{ce<=$?Fr(1008,"Connection has no subscriptions and is no longer used"):L()},z).unref()},"scheduleClose");L()}}a(mm,"sendSubscriptionRequestUpdate");function l_(A,U){if(!A)return;let N=ve[A];return N||(N=U.getResidencyRecord(A),ve[A]=N),N}a(l_,"getResidence");function $a(A){return!(Ec&&Ec!="*"&&!Ec[A]&&!Ec.includes?.(A)&&!Ec.some?.(U=>U.name===A))}a($a,"checkDatabaseAccess");function Jc(A){if(h=h||d.get(A),!$a(A))throw new Error(`Access to database "${A}" is not permitted`);h||le.warn?.(`No database named "${A}" was declared and registered`),f=h?.auditStore,E||(E=lt()?.[A]);let U=rt();if(U===_)throw U?new Error("Should not connect to self",U):new Error("Node name not defined");return vu(U,A),!0}a(Jc,"setDatabase");function vu(A,U){let N=lt()?.[U],L=[];for(let $ in N){let W=N[$];L.push({table:$,schemaDefined:W.schemaDefined,attributes:W.attributes.map(J=>({name:J.name,type:J.type,isPrimaryKey:J.isPrimaryKey}))})}le.trace?.("Sending database info for node",A,"database name",U),e.send((0,at.encode)([xV,A,U,L]))}a(vu,"sendNodeDBName");function K(A){let U=lt()?.[A],N=[];for(let L in U){if(pn&&!pn.some(W=>W.replicateByDefault?!W.tables.includes(L):W.tables.includes(L)))continue;let $=U[L];N.push({table:L,schemaDefined:$.schemaDefined,attributes:$.attributes.map(W=>({name:W.name,type:W.type,isPrimaryKey:W.isPrimaryKey}))})}e.send((0,at.encode)([qV,N,A]))}a(K,"sendDBSchema"),k=setInterval(()=>{for(let[A,U]of Ne)U.lastChunk+Se<Date.now()&&(le.warn?.(`Timeout waiting for blob stream to finish ${A} for record ${U.recordId??"unknown"} from ${_}`),Ne.delete(A),U.end())},Se).unref();let g=1,T=[];return{end(){xo&&xo.end(),Dn&&Dn.emit("close")},getRecord(A){let U=g++;return new Promise((N,L)=>{let $=[kV,U,A.table.tableId,A.id];T[A.table.tableId]||($.push(A.table.tableName),T[A.table.tableId]=!0),e.send((0,at.encode)($)),ce=performance.now(),R.set(U,{tableId:A.table.tableId,key:A.id,resolve(W){let{table:J,entry:F}=A;if(N(W),W)return J._recordRelocate(F,W)},reject:L})})},sendOperation(A){let U=g++;return A.requestId=U,e.send((0,at.encode)([jC,A])),new Promise((N,L)=>{R.set(U,{resolve:N,reject:L})})}};function C(A){B(5),A<128?o[c++]=A:A<16384?(l.setUint16(c,A|32768),c+=2):A<1056964608?(l.setUint32(c,A|3221225472),c+=4):(o[c]=255,l.setUint32(c+1,A),c+=5)}function P(A,U=0,N=A.length){let L=N-U;B(L),A.copy(o,c,U,N),c+=L}function O(A){B(8),l.setFloat64(c,A),c+=8}function B(A){if(A+16>o.length-c){let U=Buffer.allocUnsafeSlow(c+A-i+65536>>10<<11);o.copy(U,0,i,c),c=c-i,i=0,o=U,l=new DataView(o.buffer,0,o.length)}}function D(A,U){let N=A.database??"data";U||(U={});let L=U.schemaDefined,$=!1,W=A.schemaDefined,J=U.attributes||[];for(let F=0;F<A.attributes?.length;F++){let he=A.attributes[F],ue=J.find(_e=>_e.name===he.name);(!ue||ue.type!==he.type)&&(L?le.error?.(`Schema for '${u}.${A.table}' is defined locally, but attribute '${he.name}: ${he.type}' from '${_}' does not match local attribute ${ue?"'"+ue.name+": "+ue.type+"'":"which does not exist"}`):($=!0,W||(he.indexed=!0),ue?J[J.indexOf(ue)]=he:J.push(he)))}return $?(le.debug?.("(Re)creating",A),je({table:A.table,database:A.database,schemaDefined:A.schemaDefined,attributes:J,...U})):U}}var YV,at,WV,jV,zV,JC,JV,QV,QC,XV,WC,ZV,vue,VC,le,UV,xV,BV,oh,FV,KC,kV,VS,jC,KS,HV,GV,qV,YS,e1,jS,zS,ah,XS,JS,t1,zC,r1,XC,_c,WS,$V,Mue,VV,YC,Hd,KV,Gd,ZC=se(()=>{Oe();$i();wC();PC();Es();YV=b(fe());G();al();at=require("msgpackr"),WV=require("ws"),jV=require("worker_threads"),zV=b(Q());nh();JC=require("events"),JV=b(gs()),QV=b(require("node:tls"));Ud();QC=b(require("node:process")),XV=require("node:net");hs();ns();WC=require("node:stream"),ZV=require("lmdb"),{forComponent:vue,errorToString:VC}=zV.default,le=vue("replication").conditional,UV=129,xV=140,BV=141,oh=142,FV=130,KC=132,kV=133,VS=134,jC=136,KS=137,HV=143,GV=144,qV=145,YS=146,e1=0,jS=1,zS=2,ah=3,XS=4,JS=5,t1=6,zC=0,r1=1,XC=new Map,_c=new Map,WS=!0,$V=300,Mue=2,VV=3e4;a(ZS,"createWebSocket");KV=500,Gd=class extends JC.EventEmitter{static{a(this,"NodeReplicationConnection")}socket;startTime;retryTime=KV;retries=0;isConnected=!0;isFinished=!1;nodeSubscriptions;latency=0;replicateTablesByDefault;session;sessionResolve;sessionReject;url;subscription;databaseName;nodeName;authorization;constructor(t,r,n,s,i){super(),this.url=t,this.subscription=r,this.databaseName=n,this.authorization=i,this.nodeName=this.nodeName??Si(t)}async connect(){this.session||this.resetSession();let t=[];this.socket=await ZS(this.url,{serverName:this.nodeName,authorization:this.authorization});let r;le.debug?.(`Connecting to ${this.url}, db: ${this.databaseName}, process ${QC.pid}`),this.socket.on("open",()=>{this.socket._socket.unref(),le[this.isConnected?"info":"warn"]?.(`Connected to ${this.url}, db: ${this.databaseName}`),this.retries=0,this.retryTime=KV,this.nodeSubscriptions&&Ml({name:this.nodeName,database:this.databaseName,url:this.url}),this.isConnected=!0,r=ch(this.socket,{database:this.databaseName,subscription:this.subscription,url:this.url,connection:this,isSubscriptionConnection:this.nodeSubscriptions!==void 0},{replicates:!0}),this.sessionResolve(r)}),this.socket.on("error",n=>{n.code==="SELF_SIGNED_CERT_IN_CHAIN"?(le.warn?.(`Can not connect to ${this.url}, this server does not have a certificate authority for the certificate provided by ${this.url}`),n.isHandled=!0):n.code!=="ECONNREFUSED"&&(n.code==="UNABLE_TO_VERIFY_LEAF_SIGNATURE"?le.error?.(`Can not connect to ${this.url}, the certificate provided by ${this.url} is not trusted, this node needs to be added to the cluster, or a certificate authority needs to be added`):le.error?.(`Error in connection to ${this.url} due to ${n.message}`)),this.sessionReject(n)}),this.socket.on("close",(n,s)=>{if(this.isConnected&&(this.nodeSubscriptions&&Bd({name:this.nodeName,database:this.databaseName,url:this.url,finished:this.socket.isFinished}),this.isConnected=!1),this.removeAllListeners("subscriptions-updated"),this.socket.isFinished){this.isFinished=!0,r?.end(),this.emit("finished");return}if(++this.retries%20===1){let i=s?.toString();le.warn?.(`${r?"Disconnected from":"Failed to connect to"} ${this.url} (db: "${this.databaseName}"), due to ${i?'"'+i+'" ':""}(code: ${n})`)}r=null,this.resetSession(),setTimeout(()=>{this.connect()},this.retryTime).unref(),this.retryTime+=this.retryTime>>8})}resetSession(){this.session=new Promise((t,r)=>{this.sessionResolve=t,this.sessionReject=r})}subscribe(t,r){this.nodeSubscriptions=t,this.replicateTablesByDefault=r,this.emit("subscriptions-updated",t)}unsubscribe(){this.socket.isFinished=!0,this.socket.close(1008,"No longer subscribed")}getRecord(t){return this.session.then(r=>r.getRecord(t))}};a(ch,"replicateOverWS")});function gc(e,t){let r=e.toString("base64"),n=[`-----BEGIN ${t}-----`];for(let s=0;s<r.length;s+=64)n.push(r.substring(s,s+64));return n.push(`-----END ${t}-----`),n.join(`
+`+Ul.get(_.issuer)),!h||!E)throw new Error("Missing private key or certificate for secure server");let R={ciphers:f.ciphers,ticketKeys:gue(),availableCAs:Ul,ca:t&&Array.from(Ul.values()),cert:E,key:h,key_file:f.private_key_name,is_self_signed:f.is_self_signed};o&&(R.sessionIdContext=o.sessionIdContext);let S=f.hostnames??$C(_);Array.isArray(S)||(S=[S]);for(let I of S)I===MC()&&(p+=1);let y=HS.createSecureContext(R);y.name=f.name,y.options=R,y.quality=p,y.certificateAuthorities=Array.from(Ul),y.certStart=E.toString().slice(0,100);let w;for(let I of S)if(I){I[0]==="*"&&(s=!0,I=I.slice(1)),SV.isIP(I)&&(w=!0);let H=r.get(I)?.quality??0;Xe.trace?.("Assigning TLS for hostname",I,"if",p,">",H),p>H&&r.set(I,y)}else Xe.error?.("No hostname found for certificate at",HS.certificate);Xe.trace?.("Adding TLS",y.name,"for",o.ports||"client","cert named",f.name,"hostnames",S,"quality",p,"best quality",d),p>d&&(i.defaultContext=n=y,d=p,o&&(o.defaultContext=y))}catch(m){Xe.error?.("Error applying TLS for",f.name,m)}o?.secureContextsListeners.forEach(f=>f()),c(n)}catch(d){l(d)}}a(u,"updateTLS"),kS?.system.hdb_certificate.subscribe({listener:a(()=>setTimeout(()=>u(),1500).unref(),"listener"),omitCurrent:!0}),u()})),i;function i(o,c){Xe.info?.("TLS requested for",o||"(no SNI)");let l=o;for(;;){let d=r.get(l);if(d)return Xe.debug?.("Found certificate for",o,d.certStart),d.updatedContext&&(d=d.updatedContext),c(null,d);if(s&&l){let f=l.indexOf(".",1);f<0?l="":l=l.slice(f)}else break}o?Xe.debug?.("No certificate found to match",o,"using the default certificate"):Xe.debug?.("No SNI, using the default certificate",n?.name);let u=n;u?u.updatedContext&&(u=u.updatedContext):Xe.info?.("No default certificate found"),c(null,u)}a(i,"SNICallback")}a(DV,"createTLSSelector");async function vV(e){let t=pc.get(e);return!t&&e?await Vn.readFile(gr.join(_s.get(xl.ROOTPATH),Hs.LICENSE_KEY_DIR_NAME,e),"utf8"):t}a(vV,"getPrivateKeyByName");async function MV(){hc();let e=[];for await(let t of on.search([]))e.push(t);return e}a(MV,"listCertificates");async function Cue(e){let t=xC(e,Ti.object({name:Ti.string().required(),certificate:Ti.string().required(),is_authority:Ti.boolean().required(),private_key:Ti.string(),hosts:Ti.array(),uses:Ti.array()}));if(t)throw new mc(t.message);let{name:r,certificate:n,private_key:s,is_authority:i}=e,o=new ra(n),c=!1,l=!1,u;for(let[p,h]of pc)!s&&!c&&o.checkPrivateKey(TV(h))&&(c=!0,u=p),s&&s===h&&(l=!0,u=p);if(!i&&!s&&!c)throw new mc("A suitable private key was not found for this certificate");let d;if(!r){try{d=qC(o)}catch(p){Xe.error?.(p)}if(d==null)throw new mc("Error extracting certificate host name, please provide a name parameter")}let f=Oue(r??d);s&&!c&&!l&&(await Vn.writeFile(gr.join(_s.getHdbBasePath(),Hs.LICENSE_KEY_DIR_NAME,f+".pem"),s),pc.set(f,s));let m={name:r??d,certificate:n,is_authority:i,hosts:e.hosts,uses:e.uses};return(!i||i&&u||i&&s)&&(m.private_key_name=u??f+".pem"),e.ciphers&&(m.ciphers=e.ciphers),await kd(m),"Successfully added certificate: "+f}a(Cue,"addCertificate");function Oue(e){return e.replace(/[^a-z0-9\.]/gi,"-")}a(Oue,"sanitizeName");async function Pue(e){let t=xC(e,Ti.object({name:Ti.string().required()}));if(t)throw new mc(t.message);let{name:r}=e;hc();let n=await on.get(r);if(!n)throw new mc(r+" not found");let{private_key_name:s}=n;if(s){let i=Array.from(await on.search([{attribute:"private_key_name",value:s}]));i.length===1&&i[0].name===r&&(Xe.info?.("Removing private key named",s),await Vn.remove(gr.join(_s.getHdbBasePath(),Hs.LICENSE_KEY_DIR_NAME,s)))}return await on.delete(r),"Successfully removed "+r}a(Pue,"removeCertificate");function qC(e){let t=e.subject?.match(/CN=(.*)/)?.[1];return t||$C(e)[0]}a(qC,"getPrimaryHostName");function $C(e){if(e.subjectAltName)return e.subjectAltName.split(",").map(r=>{let n=r.indexOf(":");if(r=r.slice(n+1),r=r.trim(),r[0]==='"')try{r=JSON.parse(r)}catch{}return r.indexOf("=")>-1?r.match(/CN=([^,]*)/)?.[1]:r}).filter(r=>r);let t=e.subject?.match(/CN=(.*)/)?.[1];return t?[t]:[]}a($C,"hostnamesFromCert");async function Lue(e){if(e.bypass_auth!==!0)throw new mc("Unauthorized","401");let t=xC(e,Ti.object({name:Ti.string().required()}));if(t)throw new mc(t.message);let{name:r}=e;if(r===".jwtPrivate")return(await hV()).privateKey;if(r===".jwtPublic")return(await hV()).publicKey;if(pc.get(r))return pc.get(e.name);throw new mc("Key not found")}a(Lue,"getKey");function Due(e){return[e.subject?.CN,...e.subjectaltname.split(",").filter(t=>t.trim().startsWith("DNS:")).map(t=>t.trim().substring(4))]}a(Due,"getHostnamesFromCertificate")});var n1={};ye(n1,{BACK_PRESSURE_RATIO_POSITION:()=>t1,CONFIRMATION_STATUS_POSITION:()=>e1,LATENCY_POSITION:()=>XS,NodeReplicationConnection:()=>Gd,OPERATION_REQUEST:()=>jC,RECEIVED_TIME_POSITION:()=>zS,RECEIVED_VERSION_POSITION:()=>jS,RECEIVING_STATUS_POSITION:()=>JS,RECEIVING_STATUS_RECEIVING:()=>r1,RECEIVING_STATUS_WAITING:()=>zC,SENDING_TIME_POSITION:()=>ah,createWebSocket:()=>ZS,databaseSubscriptions:()=>_c,replicateOverWS:()=>ch,tableUpdateListeners:()=>XC});async function ZS(e,t){let{authorization:r,rejectUnauthorized:n}=t||{},s=rt(),i;if(e==null)throw new TypeError(`Invalid URL: Expected a string URL for node "${s}" but received ${e}`);if(e.includes("wss://")){if(!YC){let l=(0,JV.createTLSSelector)("operations-api"),u={secureContexts:null};await l.initialize(u),YC=u.secureContexts}if(i=YC.get(s),i&&le.debug?.("Creating web socket for URL",e,"with certificate named:",i.name),!i&&n!==!1)throw new Error("Unable to find a valid certificate to use for replication to connect to "+e)}let o={};r&&(o.Authorization=r);let c={headers:o,localAddress:s?.startsWith("127.0")?s:void 0,servername:(0,XV.isIP)(t?.serverName)?void 0:t?.serverName,noDelay:!0,highWaterMark:128*1024,rejectUnauthorized:n!==!1,secureContext:void 0};return i&&((Hd?.caCount!==sa.size||Hd?.derivedFromContext!==i)&&(Hd=QV.createSecureContext({...i.options,ca:[...sa,...i.options.availableCAs.values()]}),Hd.caCount=sa.size,Hd.derivedFromContext=i),c.secureContext=Hd),new WV.WebSocket(e,"harperdb-replication-v1",c)}function ch(e,t,r){let n=t.port||t.securePort,s=QC.pid%1e3+"-"+jV.threadId+(n?"s:"+n:"c:"+t.url?.slice(-4))+" "+Math.random().toString().slice(2,3);le.debug?.(s,"Initializing replication connection",r);let i=0,o=Buffer.allocUnsafeSlow(1024),c=0,l=new DataView(o.buffer,0,1024),u=t.database,d=t.databaseSubscriptions||_c,f,m,p=!1,h=t.subscription;h?.then&&h.then(A=>{h=A,h.auditStore&&(f=h.auditStore)});let E=t.tables||u&&lt()[u],_,R=new Map,S=[];_=r.name,_&&t.connection&&(t.connection.nodeName=_);let y,w,I,H,X,q,k,z=6e4,Y,ce=0,de=0,te=0,Se=YV.default.get(x.REPLICATION_BLOBTIMEOUT)??12e4,Ne=new Map,Ke=[],$e=0,Ir;if(t.url){let A=a(()=>{X&&de===e._socket?.bytesRead&&te===e._socket?.bytesWritten?e.terminate():(X=performance.now(),e.ping(),de=e._socket?.bytesRead,te=e._socket?.bytesWritten)},"sendPing");I=setInterval(A,VV).unref(),A()}else nr();e._socket?.setMaxListeners(200);function nr(){clearTimeout(H),de=e._socket?.bytesRead,te=e._socket?.bytesWritten,H=setTimeout(()=>{de===e._socket?.bytesRead&&te===e._socket?.bytesWritten&&(le.warn?.(`Timeout waiting for ping from ${_}, terminating connection and reconnecting`),e.terminate())},VV*2).unref()}a(nr,"resetPingTimer");let zr=0,xr=0,Ou=!1,zc=3e4;function Ft(){if(pn?.length>0){let A=performance.now(),U=A-xr;zr=(zr*zc+(Ou?U:0))/(zc+U),m&&(m[t1]=zr),xr=A}}a(Ft,"updateBackPressureRatio"),setInterval(Ft,zc).unref();function Ps(){if(!(!_||!u))return m||(m=vd(f,u,_)),m}a(Ps,"getSharedStatus"),u&&Jc(u);let Ha,o_,cm=[],a_=[],lm,ve=[],c_=[],Yb=[],Pu=150,ki=25,Ls=0,um=0,dm=!1,xo,Dn,pn,Br;e.on("message",Lu);async function Lu(A){if(r=await r,!r){le.error?.(s,"No authorization provided"),Fr(1008,"Unauthorized");return}fm(A),e.off("message",Lu),e.on("message",fm)}a(Lu,"onWSMessageWhenAuthorized");function fm(A){ce=performance.now();try{let U=A.dataView=new Hl(A.buffer,A.byteOffset,A.byteLength);if(A[0]>127){let W=(0,at.decode)(A),[J,F,he]=W;switch(J){case xV:{if(F){if(_){if(_!==F){le.error?.(s,`Node name mismatch, expecting to connect to ${_}, but peer reported name as ${F}, disconnecting`),e.send((0,at.encode)([oh])),Fr(1008,"Node name mismatch");return}}else if(_=F,t.connection?.tentativeNode){let me=t.connection.tentativeNode;me.name=_,t.connection.tentativeNode=null,ta(_,me)}if(t.connection&&(t.connection.nodeName=_),le.debug?.(s,"received node name:",_,"db:",u??W[2]),!u)try{Jc(u=W[2]),u==="system"&&(Ha=dc(t,(me,ie)=>{$a(ie)&&K(ie)}),e.on("close",()=>{Ha?.remove()}))}catch(me){le.warn?.(s,"Error setting database",me),e.send((0,at.encode)([oh])),Fr(1008,me.message);return}mm()}break}case qV:{le.debug?.(s,"Received table definitions for",F.map(me=>me.table));for(let me of F){let ie=W[2];me.database=ie;let Ce;if($a(ie)){if(u==="system")Me[ie]?.[me.table]||(Ce=D(me,Me[ie]?.[me.table]));else{if(ie!=="data"&&!Me[ie]){le.warn?.("Database not found",ie);return}Ce=D(me,Me[ie]?.[me.table])}f||(f=Ce?.auditStore),E||(E=lt()?.[ie])}}break}case oh:Fr();break;case jC:try{let me=r?.replicates||r?.subscribers||r?.name;le.debug?.("Received operation request",F,"from",_),server.operation(F,{user:r},!me).then(ie=>{le.debug?.("Requested request from finished",_,ie),Array.isArray(ie)&&(ie={results:ie}),ie.requestId=F.requestId,e.send((0,at.encode)([KS,ie]))},ie=>{le.debug?.("Failed requested operation from",_,ie),e.send((0,at.encode)([KS,{requestId:F.requestId,error:VC(ie)}]))})}catch(me){e.send((0,at.encode)([KS,{requestId:F.requestId,error:VC(me)}]))}break;case KS:let{resolve:ue,reject:_e}=R.get(F.requestId);le.debug?.("Received completed operation request",_,F),F.error?_e(new Error(F.error)):ue(F),R.delete(F.requestId);break;case KC:let re=W[3];if(!E){u?le.error?.(s,"No database found for",u):le.error?.(s,"Database name never received"),Fr();return}let oe=E[re];oe=D({table:re,database:u,attributes:F.attributes,schemaDefined:F.schemaDefined},oe),cm[he]={name:re,decoder:new at.Packr({useBigIntExtension:!0,randomAccessStructure:!0,freezeData:!0,typedStructs:F.typedStructs,structures:F.structures}),getEntry(me){return oe.primaryStore.getEntry(me)},rootStore:oe.primaryStore.rootStore};break;case BV:Br=f?z$(F,f):new Map,lm=W[2],le.debug?.(s,`Acknowledged subscription request, receiving messages for nodes: ${lm}`);break;case FV:let ge=he;Yb[ge]=F;break;case GV:Ps()[e1]=F,le.trace?.(s,"received and broadcasting committed update",F),Ps().buffer.notify();break;case HV:y=F,h.send({type:"end_txn",localTime:y,remoteNodeIds:S}),Ps(),m[jS]=last_sequence_id_received,m[zS]=Date.now(),m[JS]=zC;break;case YS:{let me=W[1],{fileId:ie,size:Ce,finished:Be,error:He}=me,Te=Ne.get(ie);le.debug?.("Received blob",ie,"has stream",!!Te,"connectedToBlob",!!Te?.connectedToBlob,"length",W[2].length,"finished",Be),Te||(Te=new WC.PassThrough,Te.expectedSize=Ce,Ne.set(ie,Te)),Te.lastChunk=Date.now();let ht=W[2];We(ht.byteLength,"bytes-received",`${_}.${u}`,"replication","blob");try{Be?(He?(Te.on("error",()=>{}),Te.destroy(new Error("Blob error: "+He+" for record "+(Te.recordId??"unknown")+" from "+_))):Te.end(ht),Te.connectedToBlob&&Ne.delete(ie)):Te.write(ht)}catch(Ct){le.error?.(`Error receiving blob for ${Te.recordId} from ${_} and streaming to storage`,Ct),Ne.delete(ie)}break}case kV:{let me=F,ie;try{let Ce=W[3],Be=a_[he]||(a_[he]=E[W[4]]);if(!Be)return le.warn?.("Unknown table id trying to handle record request",he);let He=Be.primaryStore.getBinaryFast(Symbol.for("structures")),Te=He?.length??0;if(Te>0&&Te!==um){um=Te;let Ct=(0,at.decode)(He);e.send((0,at.encode)([KC,{typedStructs:Ct.typed,structures:Ct.named},he,Be.tableName]))}let ht=Be.primaryStore.getBinaryFast(Ce);if(ht){let Ct=Be.primaryStore.decoder.decode(ht,{valueAsBuffer:!0}),Ot=ut||{};Ot.version=(0,ZV.getLastVersion)(),ut&&ut[qd]&Xr&&(Ct=Buffer.from(Ct),xm(()=>Be.primaryStore.decoder.decode(ht),u_=>Ga(u_,Ce),Be.primaryStore.rootStore)),ie=(0,at.encode)([VS,me,{value:Ct,expiresAt:Ot.expiresAt,version:Ot.version,residencyId:Ot.residencyId,nodeId:Ot.nodeId,user:Ot.user}])}else ie=(0,at.encode)([VS,me])}catch(Ce){ie=(0,at.encode)([VS,me,{error:Ce.message}])}e.send(ie);break}case VS:{let{resolve:me,reject:ie,tableId:Ce,key:Be}=R.get(W[1]),He=W[2];if(He?.error)ie(new Error(He.error));else if(He){let Te;G_(()=>{let ht=cm[Ce].decoder.decode(He.value);He.value=ht,He.key=Be,me(He)||Te&&setTimeout(()=>Te.forEach(F_),6e4).unref()},f?.rootStore,ht=>{let Ct=qa(ht,Be);return Te||(Te=[]),Te.push(Ct),Ct})}else me();R.delete(W[1]);break}case UV:{pn=F;let me,ie,Ce=!1;if(h){if(u!==h.databaseName&&!h.then){le.error?.("Subscription request for wrong database",u,h.databaseName);return}}else h=d.get(u);if(le.debug?.(s,"received subscription request for",u,"at",pn),!h){let De;h=new Promise(ft=>{le.debug?.("Waiting for subscription to database "+u),De=ft}),h.ready=De,_c.set(u,h)}if(r.name)ie=Ht().subscribe(r.name),ie.then(async De=>{me=De;for await(let ft of me){let kr=ft.value;if(!(kr?.replicates===!0||kr?.replicates?.receives||kr?.subscriptions?.some(fr=>(fr.database||fr.schema)===u&&fr.publish!==!1))){Ce=!0,Fr(1008,`Unauthorized database subscription to ${u}`);return}}},De=>{le.error?.(s,"Error subscribing to HDB nodes",De)});else if(!(r?.role?.permission?.super_user||r.replicates)){e.send((0,at.encode)([oh])),Fr(1008,`Unauthorized database subscription to ${u}`);return}if(Dn&&(le.debug?.(s,"stopping previous subscription",u),Dn.emit("close")),pn.length===0)return;let Be=pn[0],He=a(De=>{if(De&&(Be.replicateByDefault?!Be.tables.includes(De.tableName):Be.tables.includes(De.tableName)))return{table:De}},"tableToTableEntry"),Te={txnTime:0},ht,Ct,Ot=1/0,u_,d_=a((De,ft)=>{if(De.type==="end_txn"){Te.txnTime&&(o[i]!==66&&le.error?.("Invalid encoding of message"),C(9),C(QS),O(u_=ft),nU()),i=c,Te.txnTime=0;return}let kr=De.nodeId,fr=De.tableId,zt=Ct[fr];if(!zt&&(zt=Ct[fr]=He(h.tableById[fr]),!zt))return le.debug?.("Not subscribed to table",fr);let yt=zt.table,Mu=yt.primaryStore,si=Mu.encoder;(De.extendedType&tT||!si.typedStructs)&&(si._mergeStructures(si.getStructures()),si.typedStructs&&(si.lastTypedStructuresLength=si.typedStructs.length));let f_=ht[kr];if(!(f_&&f_.startTime<ft&&(!f_.endTime||f_.endTime>ft)))return WS&&le.trace?.(s,"skipping replication update",De.recordId,"to:",_,"from:",kr,"subscribed:",ht),sU();WS&&le.trace?.(s,"sending replication update",De.recordId,"to:",_,"from:",kr,"subscribed:",ht);let Wb=De.version,Qc=De.residencyId,jb=l_(Qc,yt),m_;if(jb&&!jb.includes(_)){let Hi=l_(De.previousResidencyId,yt);if(Hi&&!Hi.includes(_)&&(De.type==="put"||De.type==="patch")||yt.getResidencyById)return sU();let Xc=De.recordId;le.trace?.(s,"sending invalidation",Xc,_,"from",kr);let pm=0;Qc&&(pm|=Fl),De.previousResidencyId&&(pm|=kl);let Qb,p_=null;for(let iU in yt.indices){if(!p_){if(Qb=De.getValue(Mu,!0),!Qb)break;p_={}}p_[iU]=Qb[iU]}m_=Bl(De.version,fr,Xc,null,kr,De.user,De.type==="put"||De.type==="patch"?"invalidate":De.type,si.encode(p_),pm,Qc,De.previousResidencyId,De.expiresAt)}function sU(){return le.trace?.(s,"skipping audit record",De.recordId),q||(q=setTimeout(()=>{q=null,(u_||0)+$V/2<Ot&&(WS&&le.trace?.(s,"sending skipped sequence update",Ot),e.send((0,at.encode)([HV,Ot])))},$V).unref()),new Promise(setImmediate)}a(sU,"skipAuditRecord");let zb=si.typedStructs,Jb=si.structures;if((zb?.length!=zt.typed_length||Jb?.length!=zt.structure_length)&&(zt.typed_length=zb?.length,zt.structure_length=Jb.length,le.debug?.(s,"send table struct",zt.typed_length,zt.structure_length),zt.sentName||(zt.sentName=!0),e.send((0,at.encode)([KC,{typedStructs:zb,structures:Jb,attributes:yt.attributes,schemaDefined:yt.schemaDefined},fr,zt.table.tableName]))),Qc&&!c_[Qc]&&(e.send((0,at.encode)([FV,jb,Qc])),c_[Qc]=!0),Te.txnTime!==Wb&&(Te.txnTime&&(WS&&le.trace?.(s,"new txn time, sending queued txn",Te.txnTime),o[i]!==66&&le.error?.("Invalid encoding of message"),nU()),Te.txnTime=Wb,i=c,O(Wb)),m_)C(m_.length),P(m_);else{let Hi=De.encoded;De.extendedType&Xr&&xm(()=>De.getValue(Mu),pm=>Ga(pm,De.recordId),Mu.rootStore);let Xc=Hi[0]===66?8:0;C(Hi.length-Xc),P(Hi,Xc),le.trace?.("wrote record",De.recordId,"length:",Hi.length)}if(e._socket.writableNeedDrain){let Hi=performance.now();return Ou=!0,Ft(),new Promise(Xc=>{le.debug?.(`Waiting for remote node ${_} to allow more commits ${e._socket.writableNeedDrain?"due to network backlog":"due to requested flow directive"}`),e._socket.once("drain",()=>{Xc(),Ou=!1,Ft()})})}else return $e>ki?new Promise(Hi=>{Ir=Hi}):new Promise(setImmediate)},"sendAuditRecord"),nU=a(()=>{c-i>8?(e.send(o.subarray(i,c)),le.debug?.(s,"Sent message, size:",c-i),u!=="system"&&We(c-i,"bytes-sent",`${_}.${u}`,"replication","egress")):le.debug?.(s,"skipping empty transaction")},"sendQueuedData");Dn=new JC.EventEmitter,Dn.once("close",()=>{Ce=!0,me?.end()});for(let{startTime:De}of pn)De<Ot&&(Ot=De);(ie||Promise.resolve()).then(async()=>{h=await h,f=h.auditStore,Ct=h.tableById.map(He),ht=[];for(let{name:ft,startTime:kr,endTime:fr}of pn){let zt=US(ft,f);le.debug?.("subscription to",ft,"using local id",zt,"starting",kr),ht[zt]={startTime:kr,endTime:fr}}K(u),Ha||(Ha=Gl(ft=>{ft.databaseName===u&&K(u)}),o_=lh(ft=>{ft===u&&(e.send((0,at.encode)([oh])),Fr())}),e.on("close",()=>{Ha?.remove(),o_?.remove()})),e.send((0,at.encode)([BV,Qp(h.auditStore),pn.map(({name:ft})=>ft)]));let De=!0;do{if(isFinite(Ot)||(le.warn?.("Invalid sequence id "+Ot),Fr(1008,"Invalid sequence id"+Ot)),De&&!Ce&&(De=!1,Ot===0)){le.info?.("Replicating all tables to",_);let ft=Date.now(),kr=eT(f);for(let fr in E){if(!He(fr))continue;let zt=E[fr];for(let yt of zt.primaryStore.getRange({snapshot:!1,versions:!0})){if(Ce)return;le.trace?.(s,"Copying record from",u,fr,yt.key,yt.localTime),ft=Math.max(yt.localTime??1,ft),Ps()[ah]=1;let Mu=Bl(yt.version,zt.tableId,yt.key,null,kr,null,"put",xm(()=>zt.primaryStore.encoder.encode(yt.value),si=>Ga(si,yt.key)),yt.metadataFlags&-256,yt.residencyId,null,yt.expiresAt);await d_({recordId:yt.key,tableId:zt.tableId,type:"put",getValue(){return yt.value},encoded:Mu,version:yt.version,residencyId:yt.residencyId,nodeId:kr,extendedType:yt.metadataFlags},yt.localTime)}}Te.txnTime||(Te.txnTime=ft,O(ft)),c-i>8&&d_({type:"end_txn"},Ot),Ps()[ah]=0,Ot=ft}for(let{key:ft,value:kr}of f.getRange({start:Ot||1,exclusiveStart:!0,snapshot:!1})){if(Ce)return;let fr=It(kr);le.debug?.("sending audit record",ft,fr.recordId),Ps()[ah]=ft,Ot=ft,await d_(fr,ft),Dn.startTime=ft}c-i>8&&d_({type:"end_txn"},Ot),Ps()[ah]=0,await eV(f)}while(!Ce)}).catch(De=>{le.error?.(s,"Error handling subscription to node",De),Fr(1008,"Error handling subscription to node")});break}}return}U.position=8;let N=!0,L,$;do{Ps();let W=U.readInt();if(W===9&&U.getUint8(U.position)==QS){U.position++,y=$=U.readFloat64(),m[jS]=y,m[zS]=Date.now(),m[JS]=zC,h.send({type:"end_txn",localTime:y,remoteNodeIds:S}),le.trace?.("received remote sequence update",y,u);break}let J=U.position,F=It(A,J,J+W),he=cm[F.tableId];he||le.error?.(`No table found with an id of ${F.tableId}`);let ue;F.residencyId&&(ue=Yb[F.residencyId],le.trace?.(s,"received residency list",ue,F.type,F.recordId));let _e=F.recordId;try{G_(()=>{L={table:he.name,id:F.recordId,type:F.type,nodeId:Br.get(F.nodeId),residencyList:ue,timestamp:F.version,value:F.getValue(he),user:F.user,beginTxn:N,expiresAt:F.expiresAt}},f?.rootStore,re=>qa(re,_e))}catch(re){throw re.message+=" record id: "+_e,re.message+=" typed structures for current decoder"+JSON.stringify(he.decoder.typedStructs),re.message+=" structures for current decoder"+JSON.stringify(he.decoder.structures),re}N=!1,le.debug?.(s,"received replication message",F.type,"id",L.id,"version",new Date(F.version),"nodeId",L.nodeId),m[jS]=F.version,m[zS]=Date.now(),m[JS]=r1,h.send(L),U.position=J+W}while(U.position<A.byteLength);Ls++,u!=="system"&&We(A.byteLength,"bytes-received",`${_}.${u}.${L?.table||"unknown_table"}`,"replication","ingest"),Ls>Pu&&!dm&&(dm=!0,e.pause(),le.debug?.(`Commit backlog causing replication back-pressure, requesting that ${_} pause replication`)),h.send({type:"end_txn",localTime:y,remoteNodeIds:S,async onCommit(){if(L){let W=Date.now()-L.timestamp;u!=="system"&&We(W,"replication-latency",_+"."+u+"."+L.table,L.type,"ingest")}Ls--,dm&&(dm=!1,e.resume(),le.debug?.(`Replication resuming ${_}`)),Ke.length>0&&await Promise.all(Ke),le.trace?.("All blobs finished"),!w&&$&&(le.trace?.(s,"queuing confirmation of a commit at",$),setTimeout(()=>{e.send((0,at.encode)([GV,w])),le.trace?.(s,"sent confirmation of a commit at",w),w=null},Mue)),w=$,le.debug?.("last sequence committed",new Date($),u)}})}catch(U){le.error?.(s,"Error handling incoming replication message",U)}}a(fm,"onWSMessage"),e.on("ping",nr),e.on("pong",()=>{if(t.connection){let A=performance.now()-X;t.connection.latency=A,Ps()&&(m[XS]=A),t.isSubscriptionConnection&&Ml({name:_,database:u,url:t.url,latency:A})}X=null}),e.on("close",(A,U)=>{clearInterval(I),clearTimeout(H),clearInterval(k),Dn&&Dn.emit("close"),xo&&xo.end();for(let[N,{reject:L}]of R)L(new Error(`Connection closed ${U?.toString()} ${A}`));le.debug?.(s,"closed",A,U?.toString())});function Fr(A,U){try{e.isFinished=!0,le.debug?.(s,"closing",_,u,A,U),e.close(A,U),t.connection?.emit("finished")}catch(N){le.error?.(s,"Error closing connection",N)}}a(Fr,"close");let Du=new Set;async function Ga(A,U){let N=k_(A);if(Du.has(N)){le.debug?.("Blob already being sent",N);return}Du.add(N);try{let L;$e++;for await(let $ of A.stream())L&&(le.debug?.("Sending blob chunk",N,"length",L.length),e.send((0,at.encode)([YS,{fileId:N,size:A.size},L]))),L=$,e._socket.writableNeedDrain&&(le.debug?.("draining",N),await new Promise(W=>e._socket.once("drain",W)),le.debug?.("drained",N)),We($.length,"bytes-sent",`${_}.${u}`,"replication","blob");le.debug?.("Sending final blob chunk",N,"length",L.length),e.send((0,at.encode)([YS,{fileId:N,size:A.size,finished:!0},L]))}catch(L){le.warn?.("Error sending blob",L,"blob id",N,"for record",U),e.send((0,at.encode)([YS,{fileId:N,finished:!0,error:VC(L)},Buffer.alloc(0)]))}finally{Du.delete(N),$e--,$e<ki&&Ir?.()}}a(Ga,"sendBlobs");function qa(A,U){let N=k_(A),L=Ne.get(N);le.debug?.("Received transaction with blob",N,"has stream",!!L,"ended",!!L?.writableEnded),L?L.writableEnded&&Ne.delete(N):(L=new WC.PassThrough,Ne.set(N,L)),L.connectedToBlob=!0,L.lastChunk=Date.now(),L.recordId=U,A.size===void 0&&L.expectedSize&&(A.size=L.expectedSize);let $=L.blob??createBlob(L,A);L.blob=$;let W=Ho(()=>Um($).saving,h.auditStore?.rootStore);return W&&(W.blobId=N,Ke.push(W),W.finally(()=>{le.debug?.(`Finished receiving blob stream ${N}`),Ke.splice(Ke.indexOf(W),1)})),$}a(qa,"receiveBlobs");function mm(){if(p||(p=!0,t.connection?.on("subscriptions-updated",mm)),!f&&h&&(f=h.auditStore),t.connection?.isFinished)throw new Error("Can not make a subscription request on a connection that is already closed");let A=new Map;f||(f=h?.auditStore);try{for(let L of h?.dbisDB?.getRange({start:Symbol.for("seq"),end:[Symbol.for("seq"),Buffer.from([255])]})||[])for(let $ of L.value.nodes||[])$.lastTxnTime>(A.get($.id)??0)&&A.set($.id,$.lastTxnTime)}catch(L){if(!L.message.includes("Can not re"))throw L}let U=t.connection?.nodeSubscriptions?.[0];S=[];let N=t.connection?.nodeSubscriptions.map((L,$)=>{let W=[],{replicateByDefault:J}=L;if(L.subscriptions){for(let _e of L.subscriptions)if(_e.subscribe&&(_e.schema||_e.database)===u){let re=_e.table;E?.[re]?.replicate!==!1&&W.push(re)}J=!1}else for(let _e in E)(J?E[_e].replicate===!1:E[_e].replicate)&&W.push(_e);let F=f&&US(L.name,f),he=h?.dbisDB?.get([Symbol.for("seq"),F])??1,ue=Math.max(he?.seqId??1,(typeof L.startTime=="string"?new Date(L.startTime).getTime():L.startTime)??1);if(le.debug?.("Starting time recorded in db",L.name,F,u,he?.seqId,"start time:",ue,new Date(ue)),U!==L){let _e=f&&US(U.name,f),re=h?.dbisDB?.get([Symbol.for("seq"),_e])??1;for(let oe of re?.nodes||[])oe.name===L.name&&(ue=oe.seqId,le.debug?.("Using sequence id from proxy node",U.name,ue))}return F===void 0?le.warn("Starting subscription request from node",L,"but no node id found"):S.push(F),A.get(F)>ue&&(ue=A.get(F),le.debug?.("Updating start time from more recent txn recorded",U.name,ue)),ue===1&&(L.isLeader?(le.warn?.(`Requesting full copy of database ${u} from ${L.url}`),ue=0):ue=Date.now()-6e4),le.trace?.(s,"defining subscription request",L.name,u,new Date(ue)),{name:L.name,replicateByDefault:J,tables:W,startTime:ue,isLeader:L.isLeader,endTime:L.endTime}});if(N)if(le.debug?.(s,"sending subscription request",N,h?.dbisDB?.path),clearTimeout(Y),N.length>0)e.send((0,at.encode)([UV,N]));else{let L=a(()=>{let $=performance.now();Y=setTimeout(()=>{ce<=$?Fr(1008,"Connection has no subscriptions and is no longer used"):L()},z).unref()},"scheduleClose");L()}}a(mm,"sendSubscriptionRequestUpdate");function l_(A,U){if(!A)return;let N=ve[A];return N||(N=U.getResidencyRecord(A),ve[A]=N),N}a(l_,"getResidence");function $a(A){return!(Ec&&Ec!="*"&&!Ec[A]&&!Ec.includes?.(A)&&!Ec.some?.(U=>U.name===A))}a($a,"checkDatabaseAccess");function Jc(A){if(h=h||d.get(A),!$a(A))throw new Error(`Access to database "${A}" is not permitted`);h||le.warn?.(`No database named "${A}" was declared and registered`),f=h?.auditStore,E||(E=lt()?.[A]);let U=rt();if(U===_)throw U?new Error("Should not connect to self",U):new Error("Node name not defined");return vu(U,A),!0}a(Jc,"setDatabase");function vu(A,U){let N=lt()?.[U],L=[];for(let $ in N){let W=N[$];L.push({table:$,schemaDefined:W.schemaDefined,attributes:W.attributes.map(J=>({name:J.name,type:J.type,isPrimaryKey:J.isPrimaryKey}))})}le.trace?.("Sending database info for node",A,"database name",U),e.send((0,at.encode)([xV,A,U,L]))}a(vu,"sendNodeDBName");function K(A){let U=lt()?.[A],N=[];for(let L in U){if(pn&&!pn.some(W=>W.replicateByDefault?!W.tables.includes(L):W.tables.includes(L)))continue;let $=U[L];N.push({table:L,schemaDefined:$.schemaDefined,attributes:$.attributes.map(W=>({name:W.name,type:W.type,isPrimaryKey:W.isPrimaryKey}))})}e.send((0,at.encode)([qV,N,A]))}a(K,"sendDBSchema"),k=setInterval(()=>{for(let[A,U]of Ne)U.lastChunk+Se<Date.now()&&(le.warn?.(`Timeout waiting for blob stream to finish ${A} for record ${U.recordId??"unknown"} from ${_}`),Ne.delete(A),U.end())},Se).unref();let g=1,T=[];return{end(){xo&&xo.end(),Dn&&Dn.emit("close")},getRecord(A){let U=g++;return new Promise((N,L)=>{let $=[kV,U,A.table.tableId,A.id];T[A.table.tableId]||($.push(A.table.tableName),T[A.table.tableId]=!0),e.send((0,at.encode)($)),ce=performance.now(),R.set(U,{tableId:A.table.tableId,key:A.id,resolve(W){let{table:J,entry:F}=A;if(N(W),W)return J._recordRelocate(F,W)},reject:L})})},sendOperation(A){let U=g++;return A.requestId=U,e.send((0,at.encode)([jC,A])),new Promise((N,L)=>{R.set(U,{resolve:N,reject:L})})}};function C(A){B(5),A<128?o[c++]=A:A<16384?(l.setUint16(c,A|32768),c+=2):A<1056964608?(l.setUint32(c,A|3221225472),c+=4):(o[c]=255,l.setUint32(c+1,A),c+=5)}function P(A,U=0,N=A.length){let L=N-U;B(L),A.copy(o,c,U,N),c+=L}function O(A){B(8),l.setFloat64(c,A),c+=8}function B(A){if(A+16>o.length-c){let U=Buffer.allocUnsafeSlow(c+A-i+65536>>10<<11);o.copy(U,0,i,c),c=c-i,i=0,o=U,l=new DataView(o.buffer,0,o.length)}}function D(A,U){let N=A.database??"data";U||(U={});let L=U.schemaDefined,$=!1,W=A.schemaDefined,J=U.attributes||[];for(let F=0;F<A.attributes?.length;F++){let he=A.attributes[F],ue=J.find(_e=>_e.name===he.name);(!ue||ue.type!==he.type)&&(L?le.error?.(`Schema for '${u}.${A.table}' is defined locally, but attribute '${he.name}: ${he.type}' from '${_}' does not match local attribute ${ue?"'"+ue.name+": "+ue.type+"'":"which does not exist"}`):($=!0,W||(he.indexed=!0),ue?J[J.indexOf(ue)]=he:J.push(he)))}return $?(le.debug?.("(Re)creating",A),je({table:A.table,database:A.database,schemaDefined:A.schemaDefined,attributes:J,...U})):U}}var YV,at,WV,jV,zV,JC,JV,QV,QC,XV,WC,ZV,vue,VC,le,UV,xV,BV,oh,FV,KC,kV,VS,jC,KS,HV,GV,qV,YS,e1,jS,zS,ah,XS,JS,t1,zC,r1,XC,_c,WS,$V,Mue,VV,YC,Hd,KV,Gd,ZC=se(()=>{Oe();$i();wC();PC();Es();YV=b(fe());G();al();at=require("msgpackr"),WV=require("ws"),jV=require("worker_threads"),zV=b(Q());nh();JC=require("events"),JV=b(gs()),QV=b(require("node:tls"));Ud();QC=b(require("node:process")),XV=require("node:net");hs();ns();WC=require("node:stream"),ZV=require("lmdb"),{forComponent:vue,errorToString:VC}=zV.default,le=vue("replication").conditional,UV=129,xV=140,BV=141,oh=142,FV=130,KC=132,kV=133,VS=134,jC=136,KS=137,HV=143,GV=144,qV=145,YS=146,e1=0,jS=1,zS=2,ah=3,XS=4,JS=5,t1=6,zC=0,r1=1,XC=new Map,_c=new Map,WS=!0,$V=300,Mue=2,VV=3e4;a(ZS,"createWebSocket");KV=500,Gd=class extends JC.EventEmitter{static{a(this,"NodeReplicationConnection")}socket;startTime;retryTime=KV;retries=0;isConnected=!0;isFinished=!1;nodeSubscriptions;latency=0;replicateTablesByDefault;session;sessionResolve;sessionReject;url;subscription;databaseName;nodeName;authorization;constructor(t,r,n,s,i){super(),this.url=t,this.subscription=r,this.databaseName=n,this.authorization=i,this.nodeName=this.nodeName??Si(t)}async connect(){this.session||this.resetSession();let t=[];this.socket=await ZS(this.url,{serverName:this.nodeName,authorization:this.authorization});let r;le.debug?.(`Connecting to ${this.url}, db: ${this.databaseName}, process ${QC.pid}`),this.socket.on("open",()=>{this.socket._socket.unref(),le[this.isConnected?"info":"warn"]?.(`Connected to ${this.url}, db: ${this.databaseName}`),this.retries=0,this.retryTime=KV,this.nodeSubscriptions&&Ml({name:this.nodeName,database:this.databaseName,url:this.url}),this.isConnected=!0,r=ch(this.socket,{database:this.databaseName,subscription:this.subscription,url:this.url,connection:this,isSubscriptionConnection:this.nodeSubscriptions!==void 0},{replicates:!0}),this.sessionResolve(r)}),this.socket.on("error",n=>{n.code==="SELF_SIGNED_CERT_IN_CHAIN"?(le.warn?.(`Can not connect to ${this.url}, this server does not have a certificate authority for the certificate provided by ${this.url}`),n.isHandled=!0):n.code!=="ECONNREFUSED"&&(n.code==="UNABLE_TO_VERIFY_LEAF_SIGNATURE"?le.error?.(`Can not connect to ${this.url}, the certificate provided by ${this.url} is not trusted, this node needs to be added to the cluster, or a certificate authority needs to be added`):le.error?.(`Error in connection to ${this.url} due to ${n.message}`)),this.sessionReject(n)}),this.socket.on("close",(n,s)=>{if(this.isConnected&&(this.nodeSubscriptions&&Bd({name:this.nodeName,database:this.databaseName,url:this.url,finished:this.socket.isFinished}),this.isConnected=!1),this.removeAllListeners("subscriptions-updated"),this.socket.isFinished){this.isFinished=!0,r?.end(),this.emit("finished");return}if(++this.retries%20===1){let i=s?.toString();le.warn?.(`${r?"Disconnected from":"Failed to connect to"} ${this.url} (db: "${this.databaseName}"), due to ${i?'"'+i+'" ':""}(code: ${n})`)}r=null,this.resetSession(),setTimeout(()=>{this.connect()},this.retryTime).unref(),this.retryTime+=this.retryTime>>8})}resetSession(){this.session=new Promise((t,r)=>{this.sessionResolve=t,this.sessionReject=r})}subscribe(t,r){this.nodeSubscriptions=t,this.replicateTablesByDefault=r,this.emit("subscriptions-updated",t)}unsubscribe(){this.socket.isFinished=!0,this.socket.close(1008,"No longer subscribed")}getRecord(t){return this.session.then(r=>r.getRecord(t))}};a(ch,"replicateOverWS")});function gc(e,t){let r=e.toString("base64"),n=[`-----BEGIN ${t}-----`];for(let s=0;s<r.length;s+=64)n.push(r.substring(s,s+64));return n.push(`-----END ${t}-----`),n.join(`
 `)}function i1(e){let t=[],r=e;for(;r?.raw;){let n={cert:r.raw};if(r.issuerCertificate&&r.issuerCertificate!==r&&r.issuerCertificate.raw&&(n.issuer=r.issuerCertificate.raw),t.push(n),r.issuerCertificate&&r.issuerCertificate!==r)r=r.issuerCertificate;else break}return t}function rO(e){try{let t=ql(e),n=mo.Certificate.fromBER(t).extensions?.find(c=>c.extnID==="2.5.29.31");if(!n)return uo.debug?.("Certificate has no CRL Distribution Points extension"),[];let s=fo.fromBER(n.extnValue.valueBlock.valueHexView);if(s.offset===-1)throw new Error("Failed to parse ASN.1 structure in CRL Distribution Points extension");let i=new mo.CRLDistributionPoints({schema:s.result}),o=[];for(let c of i.distributionPoints)if(c.distributionPoint&&Array.isArray(c.distributionPoint)){for(let l of c.distributionPoint)if(l.type===6&&typeof l.value=="string"){let u=l.value;(u.startsWith("http://")||u.startsWith("https://"))&&o.push(u)}}return uo.debug?.(`Found ${o.length} CRL distribution points: ${o}`),o}catch(t){return uo.warn?.(`Failed to extract CRL distribution points: ${t}`),[]}}function o1(e){try{let t=ql(e),r=mo.Certificate.fromBER(t),n=[],s=[];for(let i of r.extensions||[])if(i.extnID==="2.5.29.31")try{let o=fo.fromBER(i.extnValue.valueBlock.valueHexView);if(o.offset!==-1){let c=new mo.CRLDistributionPoints({schema:o.result});for(let l of c.distributionPoints)if(l.distributionPoint&&Array.isArray(l.distributionPoint)){for(let u of l.distributionPoint)if(u.type===6&&typeof u.value=="string"){let d=u.value;(d.startsWith("http://")||d.startsWith("https://"))&&n.push(d)}}}}catch(o){uo.warn?.(`Failed to parse CRL Distribution Points extension: ${o}`)}else if(i.extnID==="1.3.6.1.5.5.7.1.1")try{let o=fo.fromBER(i.extnValue.valueBlock.valueHexView);if(o.offset!==-1&&o.result instanceof fo.Sequence){for(let c of o.result.valueBlock.value)if(c instanceof fo.Sequence&&c.valueBlock.value.length>=2){let l=c.valueBlock.value[0],u=c.valueBlock.value[1];if(l instanceof fo.ObjectIdentifier&&l.valueBlock.toString()==="1.3.6.1.5.5.7.48.1"&&u.idBlock.tagNumber===6){let d=String.fromCharCode(...Array.from(u.valueBlock.valueHexView));(d.startsWith("http://")||d.startsWith("https://"))&&s.push(d)}}}}catch(o){uo.warn?.(`Failed to parse Authority Information Access extension: ${o}`)}return uo.debug?.(`Found ${n.length} CRL distribution points and ${s.length} OCSP responder URLs`),{crlUrls:n,ocspUrls:s}}catch(t){return uo.warn?.(`Failed to extract revocation URLs: ${t}`),{crlUrls:[],ocspUrls:[]}}}function ql(e){let t=e.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s/g,""),r=atob(t),n=new ArrayBuffer(r.length),s=new Uint8Array(n);for(let i=0;i<r.length;i++)s[i]=r.charCodeAt(i);return n}function rT(e,t,r,n){let s={certPem:e,issuerPem:t,method:r,...n},i=(0,tO.createHash)("sha256").update(JSON.stringify(s)).digest("hex");return`${r}:${i}`}function nO(e,t){return`${e}:${t}`}function a1(e){try{let t=ql(e),n=mo.Certificate.fromBER(t).serialNumber.valueBlock.valueHexView;return Array.from(n).map(s=>s.toString(16).padStart(2,"0")).join("")}catch(t){throw uo.error?.(`Failed to extract serial number: ${t}`),new Error(`Failed to extract certificate serial number: ${t.message}`)}}function sO(e){try{let t=ql(e),r=mo.Certificate.fromBER(t),n=r.extensions?.find(i=>i.extnID==="2.5.29.35");if(n)try{let i=fo.fromBER(n.extnValue.valueBlock.valueHexView);if(i.offset!==-1){let o=new mo.AuthorityKeyIdentifier({schema:i.result});if(o.keyIdentifier){let c=o.keyIdentifier.valueBlock.valueHexView;return Array.from(c).map(l=>l.toString(16).padStart(2,"0")).join("")}}}catch(i){uo.debug?.(`Failed to parse Authority Key Identifier: ${i}, falling back to hash`)}let s=r.issuer.typesAndValues.map(i=>`${i.type}=${i.value.valueBlock.value}`).join(",");return(0,tO.createHash)("sha256").update(s).digest("hex")}catch(t){throw uo.error?.(`Failed to extract issuer key ID: ${t}`),new Error(`Failed to extract issuer key ID: ${t.message}`)}}function nT(){return eO||(eO=je({table:"hdb_certificate_cache",database:"system",attributes:[{name:"certificate_id",isPrimaryKey:!0},{name:"status"},{name:"reason"},{name:"checked_at"},{name:"expiresAt",expiresAt:!0,indexed:!0},{name:"method"}]})),eO}var tO,mo,fo,s1,uo,eO,sT=se(()=>{tO=require("node:crypto"),mo=b(require("pkijs")),fo=b(require("asn1js")),s1=b(sr());Oe();uo=(0,s1.loggerWithTag)("cert-verification-utils");a(gc,"bufferToPem");a(i1,"extractCertificateChain");a(rO,"extractCRLDistributionPoints");a(o1,"extractRevocationUrls");a(ql,"pemToBuffer");a(rT,"createCacheKey");a(nO,"createRevokedCertificateId");a(a1,"extractSerialNumber");a(sO,"extractIssuerKeyId");eO=null;a(nT,"getCertificateCacheTable")});function c1(e){let{error:t,value:r}=Fue.validate(e,{abortEarly:!1,allowUnknown:!1});if(t){let n=t.details.map(s=>s.message).join("; ");throw new Error(`Invalid certificate verification configuration: ${n}`)}return r}var Kr,Uue,$d,Vd,iO,xue,Bue,Fue,l1=se(()=>{Kr=b(require("joi")),Uue="fail-closed",$d={timeout:5e3,cacheTtl:36e5,errorCacheTtl:3e5,failureMode:"fail-closed"},Vd={timeout:1e4,cacheTtl:864e5,failureMode:"fail-closed",gracePeriod:864e5},iO=Kr.default.string().valid("fail-open","fail-closed"),xue=Kr.default.alternatives().try(Kr.default.boolean().custom(e=>e===!1?{enabled:!1}:{enabled:!0,...Vd}),Kr.default.object({enabled:Kr.default.boolean().default(!0),timeout:Kr.default.number().min(1e3).default(Vd.timeout).messages({"number.min":"CRL timeout must be at least 1000ms (1 second)"}),cacheTtl:Kr.default.number().min(1e3).default(Vd.cacheTtl).messages({"number.min":"CRL cacheTtl must be at least 1000ms (1 second)"}),failureMode:iO.default(Vd.failureMode),gracePeriod:Kr.default.number().min(0).default(Vd.gracePeriod).messages({"number.min":"CRL gracePeriod must be at least 0ms"})})),Bue=Kr.default.alternatives().try(Kr.default.boolean().custom(e=>e===!1?{enabled:!1}:{enabled:!0,...$d}),Kr.default.object({enabled:Kr.default.boolean().default(!0),timeout:Kr.default.number().min(1e3).default($d.timeout).messages({"number.min":"OCSP timeout must be at least 1000ms (1 second)"}),cacheTtl:Kr.default.number().min(1e3).default($d.cacheTtl).messages({"number.min":"OCSP cacheTtl must be at least 1000ms (1 second)"}),errorCacheTtl:Kr.default.number().min(1e3).default($d.errorCacheTtl).messages({"number.min":"OCSP errorCacheTtl must be at least 1000ms (1 second)"}),failureMode:iO.default($d.failureMode)})),Fue=Kr.default.object({failureMode:iO.default(Uue),crl:xue.default({enabled:!0,...Vd}),ocsp:Bue.default({enabled:!0,...$d})});a(c1,"validateAndParseCertificateVerificationConfig")});function g1(e){if(typeof e=="boolean"||e==null){if(e===oO&&aO)return po.trace?.("Using cached validation error result (primitive) - returning disabled"),!1;if(e===oO&&iT!==null)return po.trace?.("Using cached certificate verification config (primitive)"),iT;po.trace?.("Parsing and caching certificate verification config (primitive)"),oO=e;try{return iT=f1(e),aO=null,iT}catch(n){return aO=n,po.error?.(`Certificate verification config validation failed - defaulting to disabled: ${n.message}`),!1}}if(d1.get(e))return po.trace?.("Using cached validation error result (object) - returning disabled"),!1;let r=u1.get(e);if(r!==void 0)return po.trace?.("Using cached certificate verification config (object)"),r;po.trace?.("Parsing and caching certificate verification config (object)");try{let n=f1(e);return u1.set(e,n),n}catch(n){return d1.set(e,n),po.error?.(`Certificate verification config validation failed - defaulting to disabled: ${n.message}`),!1}}function f1(e){if(po.trace?.(`getCertificateVerificationConfig called with: ${JSON.stringify({mtlsConfig:e})}`),!e)return!1;let t=e===!0?void 0:e.certificateVerification;return po.trace?.(`Certificate verification config: ${JSON.stringify({verificationConfig:t})}`),t==null||t===!1?!1:c1(t===!0?{}:t)}var m1,p1,po,h1,E1,_1,u1,oO,iT,d1,aO,cO=se(()=>{m1=b(sr()),p1=b(Rt());l1();po=(0,m1.loggerWithTag)("cert-verification-config"),h1=10080*60*1e3,E1=3e5,_1=`Harper/${p1.packageJson.version} CRL-Client`,u1=new WeakMap,oO=null,iT=null,d1=new WeakMap,aO=null;a(g1,"getCachedCertificateVerificationConfig");a(f1,"getCertificateVerificationConfig")});function uh(e){return e===T1||e===kue}function Hue(e){return e===y1||e===R1}function lO(e){return e===T1?y1:R1}function Gue(){if(S1)return;S1=!0;let e=$l.CryptoEngine.prototype,t=$l.Certificate.prototype,r={getHashAlgorithm:e.getHashAlgorithm,getAlgorithmByOID:e.getAlgorithmByOID,getAlgorithmParameters:e.getAlgorithmParameters,verifyWithPublicKey:e.verifyWithPublicKey,certificateVerify:t.verify,getPublicKey:t.getPublicKey};e.getHashAlgorithm=function(...n){let[s]=n;return uh(s.algorithmId)?"UNUSED-EDDSA-BUILTIN-HASH":r.getHashAlgorithm.call(this,s)},e.getAlgorithmByOID=function(...n){let[s]=n;return uh(s)?{name:lO(s)}:r.getAlgorithmByOID.call(this,...n)},e.getAlgorithmParameters=function(...n){let[s,i]=n;return Hue(s)?{algorithm:{name:s},usages:i==="sign"?["sign"]:["verify"]}:r.getAlgorithmParameters.call(this,...n)},t.getPublicKey=async function(...n){let[,s=$l.getCrypto(!0)]=n,i=this.subjectPublicKeyInfo.algorithm.algorithmId;if(uh(i)){let o=lO(i);return s.importKey("spki",this.subjectPublicKeyInfo.toSchema().toBER(!1),o,!0,["verify"])}return r.getPublicKey.call(this,...n)},t.verify=async function(...n){let[s]=n;if(uh(this.signatureAlgorithm.algorithmId))try{let i=this.toSchema().toBER(!1),o=s.toSchema().toBER(!1),c=new dh.X509Certificate(Buffer.from(i)),l=new dh.X509Certificate(Buffer.from(o));return c.verify(l.publicKey)}catch{return!1}return r.certificateVerify.call(this,...n)},r.verifyWithPublicKey&&(e.verifyWithPublicKey=async function(...n){let[s,i,o]=n,c=o.algorithm.algorithmId;if(uh(c)){let l=lO(c);try{let u=this.crypto?.subtle||this.subtle||$l.getCrypto(!0)?.subtle||dh.webcrypto?.subtle;if(!u)throw new Error("No crypto.subtle available");let d=await u.importKey("spki",o.toSchema().toBER(!1),l,!1,["verify"]),f=i.valueBlock.valueHexView;return"unusedBits"in i.valueBlock&&i.valueBlock.unusedBits>0&&(f=f.slice(0,f.length-1)),await u.verify(l,d,f,s)}catch{return!1}}return r.verifyWithPublicKey.call(this,...n)})}var $l,dh,T1,kue,y1,R1,S1,b1=se(()=>{$l=b(require("pkijs")),dh=require("node:crypto"),T1="1.3.101.112",kue="1.3.101.113",y1="Ed25519",R1="Ed448",S1=!1;a(uh,"isEd25519OrEd448");a(Hue,"isEdDSAAlgorithmName");a(lO,"getEdDSAAlgorithmName");a(Gue,"applyEd25519Patch");Gue()});var N1={};ye(N1,{CRLSignatureVerificationError:()=>fh,performCRLCheck:()=>Vue,verifyCRL:()=>fO});function que(){return oT||(oT=nT(),oT.sourcedFrom(Kd)),oT}function $ue(){return aT||(aT=je({table:"hdb_crl_cache",database:"system",attributes:[{name:"distribution_point",isPrimaryKey:!0},{name:"issuer_dn"},{name:"crl_blob"},{name:"this_update"},{name:"next_update"},{name:"signature_valid"},{name:"expiresAt",expiresAt:!0,indexed:!0}]}),aT.sourcedFrom(dO)),aT}function I1(){return uO||(uO=je({table:"hdb_revoked_certificates",database:"system",attributes:[{name:"composite_id",isPrimaryKey:!0},{name:"serial_number",indexed:!0},{name:"issuer_key_id",indexed:!0},{name:"revocation_date"},{name:"revocation_reason"},{name:"crl_source",indexed:!0},{name:"crl_next_update"},{name:"expiresAt",expiresAt:!0,indexed:!0}]})),uO}async function fO(e,t,r,n){if(r?.enabled===!1)return{valid:!0,status:"disabled",method:"disabled"};try{let s=gc(e,"CERTIFICATE"),i=gc(t,"CERTIFICATE"),o=n??rO(s);if(o.length===0)return{valid:!0,status:"no-crl-distribution-points",method:"crl"};let c=rT(s,i,"crl"),l=await que().get(c,{certPem:s,issuerPem:i,distributionPoint:o[0],config:{crl:r??{}}});if(!l)return Cr.error?.("Cache fetch returned null - this indicates a source configuration issue"),r.failureMode==="fail-closed"?{valid:!1,status:"error",error:"Cache fetch failed",method:"crl"}:(Cr.warn?.("CRL cache fetch failed, allowing connection (fail-open mode)"),{valid:!0,status:"error-allowed",method:"crl"});let u=l,d=l.wasLoadedFromSource?.();return Cr.trace?.(`CRL ${d?"source fetch":"cache hit"} for certificate`),{valid:u.status==="good",status:u.status,cached:!d,method:u.method||"crl"}}catch(s){return Cr.error?.(`CRL verification error: ${s}`),r.failureMode==="fail-closed"?{valid:!1,status:"error",error:s.message,method:"crl"}:(Cr.warn?.("CRL check failed, allowing connection (fail-open mode)"),{valid:!0,status:"error-allowed",method:"crl"})}}async function Vue(e,t,r,n){let s=n??rO(e);if(s.length===0)return{status:"good"};let i=a1(e),o=sO(t),c=nO(o,i);try{let u=await I1().get(c);if(u){let f=Date.now(),m=u;return m.crl_next_update>f?{status:"revoked",reason:m.revocation_reason||"unspecified",source:m.crl_source}:m.crl_next_update+r.gracePeriod>f?(Cr.warn?.("Using expired CRL data within grace period"),{status:"revoked",reason:m.revocation_reason||"unspecified",source:m.crl_source}):(Cr.warn?.("CRL data is too old, treating as unknown"),{status:"unknown",reason:"crl-expired"})}let d=await Kue(s,t,r);return d.upToDate?{status:"good",source:d.source}:(Cr.warn?.("CRL data is stale or missing, treating as unknown"),{status:"unknown",reason:d.reason||"crl-unavailable"})}catch(l){return Cr.error?.(`CRL lookup error: ${l}`),{status:"unknown",reason:l.message}}}async function Kue(e,t,r){let n=Date.now();for(let s of e)try{let i=$ue(),o=null,c=null;try{c=await i.get(s),(c&&c.next_update>n||c&&c.next_update+r.gracePeriod>n)&&(o=c)}catch{}o||(o=await w1(s,t,r.timeout));let l=o.next_update;if(l>n){if(!c)try{await i.put(s,o)}catch{}return{upToDate:!0,source:s}}else return l+r.gracePeriod>n?{upToDate:!0,source:s}:{upToDate:!1,reason:"crl-expired"}}catch(i){if(i instanceof fh)throw i}return{upToDate:!1,reason:"no-current-crl-data"}}async function w1(e,t,r){let n=new AbortController,s=setTimeout(()=>n.abort(),r);try{let i=await fetch(e,{signal:n.signal,headers:{"User-Agent":_1}});if(clearTimeout(s),!i.ok)throw new Error(`CRL download failed: ${i.status}`);let o=Buffer.from(await i.arrayBuffer()),c,l=o.toString("utf8");l.includes("-----BEGIN X509 CRL-----")?c=Buffer.from(ql(l)):c=o;let u=cT.CertificateRevocationList.fromBER(c),d=cT.Certificate.fromBER(ql(t)),f=await u.verify({issuerCertificate:d});if(!f){let _=`CRL signature verification failed for: ${e}`;throw Cr.error?.(_),new fh(_)}let m=u.thisUpdate.value.getTime(),p=u.nextUpdate?.value.getTime()??m+h1,h=d.issuer.typesAndValues.map(_=>`${_.type}=${_.value.valueBlock.value}`).join(","),E={distribution_point:e,issuer_dn:h,crl_blob:o,this_update:m,next_update:p,signature_valid:f,expiresAt:p};return Yue(u,t,e,p).catch(_=>{Cr.error?.(`Error processing revoked certificates: ${_}`)}),E}finally{clearTimeout(s)}}async function Yue(e,t,r,n){let s=I1(),i=sO(t),o=r;try{await Wue(s,o)}catch(c){Cr.warn?.(`Failed to clear existing CRL entries: ${c}`)}if(e.revokedCertificates)for(let c of e.revokedCertificates)try{let l=c.userCertificate.valueBlock.valueHexView;if(!l){Cr.warn?.("Could not extract serial number from revoked certificate");continue}let u=Array.from(l).map(h=>h.toString(16).padStart(2,"0")).join(""),d=nO(i,u),f=c.revocationDate.value.getTime(),p={composite_id:d,serial_number:u,issuer_key_id:i,revocation_date:f,revocation_reason:"unspecified",crl_source:o,crl_next_update:n,expiresAt:n};await s.create(p.composite_id,p)}catch(l){Cr.warn?.(`Failed to process revoked certificate: ${l}`)}}async function Wue(e,t){try{let r=e.search([{attribute:"crl_source",value:t}]);for await(let n of r)try{await e.delete(n.composite_id)}catch(s){Cr.warn?.(`Failed to delete revoked certificate entry: ${s}`)}}catch(r){throw Cr.error?.(`Failed to search for existing CRL entries: ${r}`),r}}var cT,A1,fh,Cr,oT,dO,aT,uO,mO=se(()=>{cT=b(require("pkijs")),A1=b(sr());Oe();so();sT();cO();pO();fh=class extends Error{static{a(this,"CRLSignatureVerificationError")}constructor(t){super(t),this.name="CRLSignatureVerificationError"}},Cr=(0,A1.loggerWithTag)("crl-verification");a(que,"getCertificateCacheTable");dO=class extends Qt{static{a(this,"CertificateRevocationListSource")}async get(t){let n=this.getContext()?.requestContext;if(!n?.distributionPoint||!n?.issuerPem)throw new Error(`No CRL data provided for cache key: ${t}`);let{distributionPoint:s,issuerPem:i,config:o}=n;try{let c=await w1(s,i,o.timeout),l=c.next_update,u=Date.now()+o.cacheTtl,d=Math.min(l,u);return{...c,expiresAt:d}}catch(c){if(Cr.error?.(`CRL fetch error for: ${s} - ${c}`),o.failureMode==="fail-closed"){let l=Date.now()+E1;return{crl_id:t,distribution_point:s,issuer_dn:"unknown",crl_blob:Buffer.alloc(0),this_update:Date.now(),next_update:l,signature_valid:!1,expiresAt:l}}return Cr.warn?.("CRL fetch failed, not caching (fail-open mode)"),null}}};a($ue,"getCRLCacheTable");a(I1,"getRevokedCertificateTable");a(fO,"verifyCRL");a(Vue,"performCRLCheck");a(Kue,"checkCRLFreshness");a(w1,"downloadAndParseCRL");a(Yue,"processRevokedCertificates");a(Wue,"clearExistingCRLEntries")});async function jue(){hO||(hO=(await Promise.resolve().then(()=>(mO(),N1))).performCRLCheck),EO||(EO=(await Promise.resolve().then(()=>(_O(),O1))).performOCSPCheck)}var C1,r0e,hO,EO,Kd,pO=se(()=>{so();C1=b(sr()),r0e=(0,C1.loggerWithTag)("cert-verification-source");a(jue,"loadVerificationFunctions");Kd=class extends Qt{static{a(this,"CertificateVerificationSource")}async get(t){let r=t.id,s=this.getContext()?.requestContext;if(!s||!s.certPem||!s.issuerPem)return null;let{certPem:i,issuerPem:o,ocspUrls:c,config:l}=s,u;r.startsWith("crl:")?u="crl":r.startsWith("ocsp:")?u="ocsp":u="unknown",await jue();let d,f;if(u==="crl"){f=l.crl;let p=s.distributionPoint?[s.distributionPoint]:void 0;d=await hO(i,o,f,p)}else if(u==="ocsp")f=l.ocsp,d=await EO(i,o,f,c);else throw new Error(`Unsupported verification method: ${u} for ID: ${r}`);let m=Date.now()+f.cacheTtl;return{certificate_id:r,status:d.status,reason:d.reason,checked_at:Date.now(),expiresAt:m,method:u}}}});var O1={};ye(O1,{performOCSPCheck:()=>Jue,verifyOCSP:()=>gO});function zue(){return uT||(uT=nT(),uT.sourcedFrom(Kd)),uT}async function gO(e,t,r,n){if(r?.enabled===!1)return{valid:!0,status:"disabled",method:"disabled"};try{let s=gc(e,"CERTIFICATE"),i=gc(t,"CERTIFICATE"),o=rT(s,i,"ocsp"),c=await zue().get(o,{certPem:s,issuerPem:i,ocspUrls:n,config:{ocsp:r??{}}});if(!c)return r.failureMode==="fail-closed"?{valid:!1,status:"error",error:"Cache fetch failed",method:"ocsp"}:(lT.warn?.("OCSP cache fetch failed, allowing connection (fail-open mode)"),{valid:!0,status:"error-allowed",method:"ocsp"});let l=c,u=c.wasLoadedFromSource?.();return lT.trace?.(`OCSP ${u?"source fetch":"cache hit"} for certificate`),{valid:l.status==="good",status:l.status,cached:!u,method:l.method||"ocsp"}}catch(s){return lT.error?.(`OCSP verification error: ${s}`),r.failureMode==="fail-closed"?{valid:!1,status:"error",error:s.message,method:"ocsp"}:(lT.warn?.("OCSP check failed, allowing connection (fail-open mode)"),{valid:!0,status:"error-allowed",method:"ocsp"})}}async function Jue(e,t,r,n){try{let s=await(0,P1.getCertStatus)(e,{ca:t,timeout:r.timeout,...n?.length&&{ocspUrl:n[0]}});switch(s.status){case"good":return{status:"good"};case"revoked":return{status:"revoked",reason:s.revocationReason?.toString()||"unspecified"};default:return{status:"unknown",reason:"unknown-status"}}}catch(s){return{status:"unknown",reason:s.name==="AbortError"?"timeout":"ocsp-error"}}}var P1,L1,lT,uT,_O=se(()=>{b1();P1=require("easy-ocsp"),L1=b(sr());sT();pO();lT=(0,L1.loggerWithTag)("ocsp-verification");a(zue,"getCertificateCacheTable");a(gO,"verifyOCSP");a(Jue,"performOCSPCheck")});async function Yd(e,t){an.debug?.(`verifyCertificate called for: ${e.subject?.CN||"unknown"}`);let r=g1(t);if(r===!1)return an.debug?.("Certificate verification disabled"),{valid:!0,status:"disabled",method:"disabled"};let n=i1(e);if(an.trace?.(`Certificate chain length: ${n.length}`),n.length<2||!n[0].issuer)return an.debug?.("Certificate chain insufficient for revocation checking - need certificate and issuer"),{valid:!0,status:"no-issuer-cert",method:"disabled"};let s=gc(n[0].cert,"CERTIFICATE"),{crlUrls:i,ocspUrls:o}=o1(s);if(an.debug?.(`Certificate extensions: CRL distribution points=${i.length}, OCSP URLs=${o.length}`),i.length>0)if(r.crl.enabled)try{an.debug?.("Attempting CRL verification");let c=await fO(n[0].cert,n[0].issuer,r.crl,i);if(c.status==="good"||c.status==="revoked")return an.debug?.(`CRL verification result: ${c.status}`),c;an.debug?.(`CRL verification inconclusive: ${c.status}, trying OCSP fallback`)}catch(c){an.warn?.(`CRL verification failed: ${c}`)}else an.debug?.("Skipping CRL - disabled in configuration");else an.debug?.("Skipping CRL - no distribution points in certificate");if(o.length>0)if(r.ocsp.enabled)try{an.debug?.("Attempting OCSP verification");let c=await gO(n[0].cert,n[0].issuer,r.ocsp,o);return an.debug?.(`OCSP verification result: ${c.status}`),c}catch(c){an.warn?.(`OCSP verification failed: ${c}`)}else an.debug?.("Skipping OCSP - disabled in configuration");else an.debug?.("Skipping OCSP - no responder URLs in certificate");return r.failureMode==="fail-closed"?{valid:!1,status:"no-verification-available",method:"disabled"}:{valid:!0,status:"verification-unavailable-allowed",method:"disabled"}}var D1,an,dT=se(()=>{D1=b(sr());sT();cO();_O();mO();an=(0,D1.loggerWithTag)("cert-verification");a(Yd,"verifyCertificate")});var na={};ye(na,{buildReplicationMtlsConfig:()=>G1,clearThisNodeName:()=>ide,disableReplication:()=>ede,enabledDatabases:()=>Ec,forEachReplicatedDatabase:()=>dc,getThisNodeId:()=>eT,getThisNodeName:()=>rt,getThisNodeUrl:()=>fc,hostnameToUrl:()=>ET,lastTimeInAuditStore:()=>Xp,monitorNodeCAs:()=>q1,replicateOperation:()=>ade,replicationCertificateAuthorities:()=>sa,sendOperationToNode:()=>mh,servers:()=>Xue,setReplicator:()=>V1,start:()=>Zue,startOnMainThread:()=>LC,subscribeToNode:()=>rh,unsubscribeFromNode:()=>FS,urlToNodeName:()=>Si});function G1(e){return e?.mtls&&typeof e.mtls=="object"?e.mtls:!0}function Zue(e){if(!e.port&&!e.securePort&&(e.port=Gs.default.get(x.OPERATIONSAPI_NETWORK_PORT),e.securePort=Gs.default.get(x.OPERATIONSAPI_NETWORK_SECUREPORT)),!rt())throw new Error("Can not load replication without a url (see replication.url in the config)");let t=new Map;for(let i of eh(e))t.set(Si(i.url),i);tde(e);let r=G1(e);e={isOperationsServer:!0,maxPayload:10*1024*1024*1024,...e,mtls:r};let n=Ue.ws(async(i,o,c,l)=>{if(wt.debug("Incoming WS connection received "+o.url),o.headers.get("sec-websocket-protocol")!=="harperdb-replication-v1")return l(i,o,c);i._socket.unref(),ch(i,e,c.then(()=>o?.user)),i.on("error",u=>{u.code!=="ECONNREFUSED"&&wt.error("Error in connection to "+this.url,u.message)})},e);e.runFirst=!0,Ue.http(async(i,o)=>{if(i.isWebSocket&&i.headers.get("Sec-WebSocket-Protocol")==="harperdb-replication-v1"){wt.debug("Incoming replication WS connection received, authorized: "+i.authorized),!i.authorized&&i._nodeRequest.socket.authorizationError&&wt.error(`Incoming client connection from ${i.ip} did not have valid certificate, you may need turn on enableRootCAs in the config if you are using a publicly signed certificate, or add the CA to the server's trusted CAs`,i._nodeRequest.socket.authorizationError);let c=Ht().primaryStore;if(i.authorized&&i.peerCertificate.subjectaltname){let l=(0,k1.getHostnamesFromCertificate)(i.peerCertificate),u;for(let d of l)if(u=d&&(c.get(d)||t.get(d)),u)break;if(u){let d=await Yd(i.peerCertificate,e.mtls);if(!d.valid){wt.warn("Certificate verification failed:",d.status,"for node",u.name,"certificate serial number",i.peerCertificate.serialNumber);return}if(u?.revoked_certificates?.includes(i.peerCertificate.serialNumber)){wt.warn("Revoked certificate used in attempt to connect to node",u.name,"certificate serial number",i.peerCertificate.serialNumber);return}else i.user=u}else wt.warn(`No node found for certificate common name/SANs: ${l}, available nodes are ${Array.from(c.getRange({}).filter(({value:d})=>d).map(({key:d})=>d)).join(", ")} and routes ${Array.from(t.keys()).join(", ")}, connection will require credentials.`)}else{let l=c.get(i.ip)||t.get(i.ip);l?i.user=l:wt.warn(`No node found for IP address ${i.ip}, available nodes are ${Array.from(new Set([...c.getKeys(),...t.keys()])).join(", ")}, connection will require credentials.`)}}return o(i)},e);let s=[];for(let i of n)if(i.secureContexts){let o=a(()=>{let c=new Set(i.secureContexts.values());i.defaultContext&&c.add(i.defaultContext);for(let l of c)try{let u=Array.from(sa);l.options.availableCAs&&u.push(...l.options.availableCAs.values());let d={...l.options,ca:u};l.updatedContext=hT.createSecureContext(d)}catch(u){wt.error("Error creating replication TLS config",u)}},"updateContexts");i.secureContextsListeners.push(o),s.push(o),Gs.default.get(x.REPLICATION_ENABLEROOTCAS)!==!1&&o()}q1(()=>{for(let i of s)i()})}function q1(e){let t=0;Md(r=>{r?.ca&&(sa.add(r.ca),sa.size!==t&&(t=sa.size,e?.()))})}function ede(e=!0){H1=e}function tde(e){H1||(lt(),Ec=e.databases,dc(e,(t,r)=>{if(!t){let n=e.databaseSubscriptions||_c;for(let[s,i]of mT){let o=i.get(r);o&&(o.subscribe([],!1),i.delete(r))}n.delete(r);return}for(let n in t){let s=t[n];V1(r,s,e),XC.get(s)?.forEach(i=>i(s))}}))}function V1(e,t,r){if(!t)return console.error(`Attempt to replicate non-existent table ${t.name} from database ${e}`);if(t.replicate===!1||t.sources?.some(s=>s.isReplicator))return;let n;t.sourcedFrom(class $1 extends Qt{static{a(this,"Replicator")}static connection;static subscription;static async subscribe(){let i=r.databaseSubscriptions||_c,o=i.get(e),c=o?.tableById||[];c[t.tableId]=t;let l=o?.ready;if(wt.trace("Setting up replicator subscription to database",e),!o?.auditStore)return this.subscription=o=new rs,i.set(e,o),o.tableById=c,o.auditStore=t.auditStore,o.dbisDB=t.dbisDB,o.databaseName=e,l&&l(o),o;this.subscription=o}static subscribeOnThisThread(i,o){return!0}static async load(i){if(i){let o=i.residencyId,c=i.residency||t.dbisDB.get([Symbol.for("residency_by_id"),o]);if(c){let l,u=new Set;do{let d,f="",m=1/0;for(let h of c){if(u.has(h)||h===Ue.hostname)continue;let E=nde(h,$1.subscription,e);if(E?.isConnected){let _=vd(t.auditStore,e,h)[XS];(!d||_<m)&&(d=E,f=h,m=_)}}if(!d)throw l||new B1.ServerError(`No connection to any other nodes are available: ${c}`,502);let p={requestId:Que++,table:t,entry:i,id:i.key};u.add(f);try{return await d.getRecord(p)}catch(h){if(d.isConnected)throw h;wt.warn("Error in load from node",pT,h),l||(l=h)}}while(!0)}}}static isReplicator=!0},{intermediateSource:!0})}function rde(e,t,r,n,s,i){let o=t+"-"+e,c=mT.get(o);c||(c=new Map,mT.set(o,c));let l=c.get(n);if(l)return l;if(r)return c.set(n,l=new Gd(t,r,n,s,i)),l.connect(),l.once("finished",()=>c.delete(n)),l}function nde(e,t,r){let n=v1.get(e);n||(n=new Map,v1.set(e,n));let s=n.get(r);if(s)return s;let i=Ht().primaryStore.get(e);return i?.url&&(s=new Gd(i.url,t,r,e,i.authorization),n.set(r,s),s.connect(),s.once("finished",()=>n.delete(r))),s}async function mh(e,t,r){r||(r={}),r.serverName=e.name;let n=await ZS(e.url,r),s=ch(n,{},{});return new Promise((i,o)=>{n.on("open",()=>{wt.debug("Sending operation connection to "+e.url+" opened",t),i(s.sendOperation(t))}),n.on("error",c=>{o(c)}),n.on("close",c=>{wt.info("Sending operation connection to "+e.url+" closed",c)})}).finally(()=>{n.close()})}function rh(e){try{F1.isMainThread&&wt.warn("Subscribing on main thread (should not happen in multi-threaded instance)",e.nodes[0].url,e.database);let t=_c.get(e.database);if(!t){let n;t=new Promise(s=>{wt.info("Waiting for subscription to database "+e.database),n=s}),t.ready=n,_c.set(e.database,t)}let r=rde(e.nodes[0].url,e.url,t,e.database,e.name,e.nodes[0].authorization);e.nodes[0].name===void 0?r.tentativeNode=e.nodes[0]:r.nodeName=e.nodes[0].name,r.subscribe(e.nodes.filter(n=>Zp(n,e.database)),e.replicateByDefault)}catch(t){wt.error("Error in subscription to node",e.nodes[0]?.url,t)}}async function FS({url:e,nodes:t,database:r}){wt.trace("Unsubscribing from node",e,r,"nodes",Array.from(Ht().primaryStore.getRange({})));let n=e+"-"+(t[0]?.url??e),s=mT.get(n);if(s){let i=s.get(r);i&&(i.unsubscribe(),s.delete(r))}}function sde(){if(SO!==void 0)return SO;let e=Gs.default.get(x.OPERATIONSAPI_TLS_CERTIFICATE)||Gs.default.get(x.TLS_CERTIFICATE);if(e)return SO=new U1.X509Certificate((0,x1.readFileSync)(e)).subject?.match(/CN=(.*)/)?.[1]??null}function rt(){return pT||(pT=Gs.default.get("replication_hostname")??Si(Gs.default.get("replication_url"))??sde()??M1("operationsapi_network_secureport")??M1("operationsapi_network_port")??"127.0.0.1")}function ide(){pT=void 0}function M1(e){let t=Gs.default.get(e),r=t?.lastIndexOf?.(":");if(r>0)return t.slice(0,r)}function fT(e){let t=Gs.default.get(e),r=t?.lastIndexOf?.(":");return r>0?+t.slice(r+1).replace(/[\[\]]/g,""):+t}function eT(e){return Qp(e)?.[rt()]}function fc(){let e=Gs.default.get("replication_url");return e||ET(rt())}function ET(e){let t=fT("replication_port");if(t)return`ws://${e}:${t}`;if(t=fT("replication_secureport"),t)return`wss://${e}:${t}`;if(t=fT("operationsapi_network_port"),t)return`ws://${e}:${t}`;if(t=fT("operationsapi_network_secureport"),t)return`wss://${e}:${t}`}function Si(e){if(e)return new URL(e).hostname}function dc(e,t){for(let n of Object.getOwnPropertyNames(Me))r(n);return lh(n=>{r(n)}),Gl((n,s)=>{r(n.databaseName)});function r(n){let s=Me[n];wt.trace("Checking replication status of ",n,e?.databases),e?.databases===void 0||e.databases==="*"||e.databases.includes(n)||e.databases.some?.(i=>i.name===n)||!s?t(s,n,!0):ode(n)&&t(s,n,!1)}a(r,"forDatabase")}function ode(e){let t=Me[e];for(let r in t)if(t[r].replicate)return!0}function Xp(e){for(let t of e.getKeys({limit:1,reverse:!0}))return t}async function ade(e){let t={message:""};if(e.replicated){e.replicated=!1,wt.trace?.("Replicating operation",e.operation,"to nodes",Ue.nodes.map(n=>n.name));let r=await Promise.allSettled(Ue.nodes.map(n=>mh(n,e)));t.replicated=r.map((n,s)=>{let i=n.status==="rejected"?{status:"failed",reason:n.reason.toString()}:n.value;return i.node=Ue.nodes[s]?.name,i})}return t}var Gs,wt,U1,x1,hT,B1,F1,k1,H1,Que,Xue,sa,Ec,mT,v1,SO,pT,Es=se(()=>{Oe();so();Fu();ZC();Hr();Gs=b(fe()),wt=b(Q()),U1=require("crypto");dT();x1=require("fs");nh();Ud();G();wC();hT=b(require("node:tls")),B1=b(Ee()),F1=require("worker_threads"),k1=b(gs()),Que=1,Xue=[],sa=Gs.default.get(x.REPLICATION_ENABLEROOTCAS)!==!1?new Set(hT.rootCertificates):new Set;a(G1,"buildReplicationMtlsConfig");a(Zue,"start");a(q1,"monitorNodeCAs");a(ede,"disableReplication");a(tde,"assignReplicationSource");a(V1,"setReplicator");mT=new Map;a(rde,"getSubscriptionConnection");v1=new Map;a(nde,"getRetrievalConnectionByName");a(mh,"sendOperationToNode");a(rh,"subscribeToNode");a(FS,"unsubscribeFromNode");a(sde,"getCommonNameFromCert");a(rt,"getThisNodeName");a(ide,"clearThisNodeName");Object.defineProperty(Ue,"hostname",{get(){return rt()}});a(M1,"getHostFromListeningPort");a(fT,"getPortFromListeningPort");a(eT,"getThisNodeId");Ue.replication={getThisNodeId:eT,exportIdMapping:Qp};a(fc,"getThisNodeUrl");a(ET,"hostnameToUrl");a(Si,"urlToNodeName");a(dc,"forEachReplicatedDatabase");a(ode,"hasExplicitlyReplicatedTable");a(Xp,"lastTimeInAuditStore");a(ade,"replicateOperation")});var yT=M((w0e,z1)=>{"use strict";var Wd=_$(),{validateBySchema:ph}=mt(),{commonValidators:jd,schemaRegex:TO}=Wi(),Sr=require("joi"),cde=Q(),lde=require("uuid").v4,ST=Jo(),zd=(G(),v(j)),ude=require("util"),Sc=os(),{handleHDBError:ia,hdbErrors:dde,ClientError:Vl}=Ee(),{HDB_ERROR_MSGS:_T,HTTP_STATUS_CODES:oa}=dde,{SchemaEventMsg:TT}=ds(),K1=_r(),{getDatabases:fde}=(Oe(),v(pt)),{transformReq:Jd}=ae(),{replicateOperation:Y1}=(Es(),v(na)),{cleanupOrphans:mde}=(ns(),v(q_)),gT=Sr.string().min(1).max(jd.schema_length.maximum).pattern(TO).messages({"string.pattern.base":"{:#label} "+jd.schema_format.message}),pde=Sr.string().min(1).max(jd.schema_length.maximum).pattern(TO).messages({"string.pattern.base":"{:#label} "+jd.schema_format.message}).required(),hde=Sr.string().min(1).max(jd.schema_length.maximum).pattern(TO).messages({"string.pattern.base":"{:#label} "+jd.schema_format.message,"any.required":"'primary_key' is required","string.base":"'primary_key' must be a string"}).required();z1.exports={createSchema:Ede,createSchemaStructure:W1,createTable:_de,createTableStructure:j1,createAttribute:Rde,dropSchema:gde,dropTable:Sde,dropAttribute:Tde,getBackup:bde,cleanupOrphanBlobs:Ade};async function Ede(e){let t=await W1(e);return ST.signalSchemaChange(new TT(process.pid,e.operation,e.schema)),t}a(Ede,"createSchema");async function W1(e){let t=ph(e,Sr.object({database:gT,schema:gT}));if(t)throw new Vl(t.message);if(Jd(e),!await Wd.checkSchemaExists(e.schema))throw ia(new Error,_T.SCHEMA_EXISTS_ERR(e.schema),oa.BAD_REQUEST,zd.LOG_LEVELS.ERROR,_T.SCHEMA_EXISTS_ERR(e.schema),!0);return await Sc.createSchema(e),`database '${e.schema}' successfully created`}a(W1,"createSchemaStructure");async function _de(e){return Jd(e),e.hash_attribute=e.primary_key??e.hash_attribute,await j1(e)}a(_de,"createTable");async function j1(e){let t=ph(e,Sr.object({database:gT,schema:gT,table:pde,residence:Sr.array().items(Sr.string().min(1)).optional(),hash_attribute:hde}));if(t)throw new Vl(t.message);if(!await Wd.checkSchemaTableExists(e.schema,e.table))throw ia(new Error,_T.TABLE_EXISTS_ERR(e.schema,e.table),oa.BAD_REQUEST,zd.LOG_LEVELS.ERROR,_T.TABLE_EXISTS_ERR(e.schema,e.table),!0);let n={name:e.table,schema:e.schema,id:lde(),hash_attribute:e.hash_attribute};try{if(e.residence)if(global.clustering_on)n.residence=e.residence,await Sc.createTable(n,e);else throw ia(new Error,"Clustering does not appear to be enabled. Cannot insert table with property 'residence'.",oa.BAD_REQUEST);else await Sc.createTable(n,e);return`table '${e.schema}.${e.table}' successfully created.`}catch(s){throw s}}a(j1,"createTableStructure");async function gde(e){let t=ph(e,Sr.object({database:Sr.string(),schema:Sr.string()}).or("database","schema").messages({"object.missing":"'database' is required"}));if(t)throw new Vl(t.message);Jd(e);let r=await Wd.checkSchemaExists(e.schema);if(r)throw ia(new Error,r,oa.NOT_FOUND,zd.LOG_LEVELS.ERROR,r,!0);let n=await Wd.schemaDescribe.describeSchema({schema:e.schema}),s=Object.keys(global.hdb_schema[e.schema]);await Sc.dropSchema(e),ST.signalSchemaChange(new TT(process.pid,e.operation,e.schema)),await K1.purgeSchemaTableStreams(e.schema,s);let i=await Y1(e);return i.message=`successfully deleted '${e.schema}'`,i}a(gde,"dropSchema");async function Sde(e){let t=ph(e,Sr.object({database:Sr.string(),schema:Sr.string(),table:Sr.string().required()}));if(t)throw new Vl(t.message);Jd(e);let r=await Wd.checkSchemaTableExists(e.schema,e.table);if(r)throw ia(new Error,r,oa.NOT_FOUND,zd.LOG_LEVELS.ERROR,r,!0);await Sc.dropTable(e),await K1.purgeTableStream(e.schema,e.table);let n=await Y1(e);return n.message=`successfully deleted table '${e.schema}.${e.table}'`,n}a(Sde,"dropTable");async function Tde(e){let t=ph(e,Sr.object({database:Sr.string(),schema:Sr.string(),table:Sr.string().required(),attribute:Sr.string().required()}));if(t)throw new Vl(t.message);Jd(e);let r=await Wd.checkSchemaTableExists(e.schema,e.table);if(r)throw ia(new Error,r,oa.NOT_FOUND,zd.LOG_LEVELS.ERROR,r,!0);if(e.attribute===global.hdb_schema[e.schema][e.table].hash_attribute)throw ia(new Error,"You cannot drop a hash attribute",oa.BAD_REQUEST,void 0,void 0,!0);if(zd.TIME_STAMP_NAMES.indexOf(e.attribute)>=0)throw ia(new Error,`cannot drop internal timestamp attribute: ${e.attribute}`,oa.BAD_REQUEST,void 0,void 0,!0);try{return await Sc.dropAttribute(e),yde(e),ST.signalSchemaChange(new TT(process.pid,e.operation,e.schema,e.table,e.attribute)),`successfully deleted attribute '${e.attribute}'`}catch(n){throw cde.error(`Got an error deleting attribute ${ude.inspect(e)}.`),n}}a(Tde,"dropAttribute");function yde(e){let t=Object.values(global.hdb_schema[e.schema][e.table].attributes);for(let r=0;r<t.length;r++)t[r].attribute===e.attribute&&global.hdb_schema[e.schema][e.table].attributes.splice(r,1)}a(yde,"dropAttributeFromGlobal");async function Rde(e){Jd(e);let t=fde()[e.schema][e.table].attributes;for(let{name:r}of t)if(r===e.attribute)throw ia(new Error,`attribute '${e.attribute}' already exists in ${e.schema}.${e.table}`,oa.BAD_REQUEST,void 0,void 0,!0);return await Sc.createAttribute(e),ST.signalSchemaChange(new TT(process.pid,e.operation,e.schema,e.table,e.attribute)),`attribute '${e.schema}.${e.table}.${e.attribute}' successfully created.`}a(Rde,"createAttribute");function bde(e){return Sc.getBackup(e)}a(bde,"getBackup");function Ade(e){if(!e.database)throw new Vl('Must provide "database" name for search for orphaned blobs');if(!databases[e.database])throw new Vl(`Unknown database '${e.database}'`);return mde(databases[e.database],e.database),{message:"Orphaned blobs cleanup started, check logs for progress"}}a(Ade,"cleanupOrphanBlobs")});var Q1=M((C0e,J1)=>{"use strict";var{OPERATIONS_ENUM:Ide}=(G(),v(j)),yO=class{static{a(this,"ReadAuditLogObject")}constructor(t,r,n=void 0,s=void 0){this.operation=Ide.READ_AUDIT_LOG,this.schema=t,this.table=r,this.search_type=n,this.search_values=s}};J1.exports=yO});var RO=M((L0e,rK)=>{"use strict";var wde=os(),P0e=Q1(),RT=ae(),bT=(G(),v(j)),Nde=fe(),{handleHDBError:X1,hdbErrors:Cde}=Ee(),{HDB_ERROR_MSGS:Z1,HTTP_STATUS_CODES:eK}=Cde,Ode=Object.values(bT.READ_AUDIT_LOG_SEARCH_TYPES_ENUM),tK="To use this operation audit log must be enabled in harperdb-config.yaml";rK.exports=Pde;async function Pde(e){if(RT.isEmpty(e.schema))throw new Error(Z1.SCHEMA_REQUIRED_ERR);if(RT.isEmpty(e.table))throw new Error(Z1.TABLE_REQUIRED_ERR);if(!Nde.get(bT.CONFIG_PARAMS.LOGGING_AUDITLOG))throw X1(new Error,tK,eK.BAD_REQUEST,bT.LOG_LEVELS.ERROR,tK,!0);let t=RT.checkSchemaTableExist(e.schema,e.table);if(t)throw X1(new Error,t,eK.NOT_FOUND,bT.LOG_LEVELS.ERROR,t,!0);if(!RT.isEmpty(e.search_type)&&Ode.indexOf(e.search_type)<0)throw new Error(`Invalid searchType '${read_audit_log_object.search_type}'`);return await wde.readAuditLog(e)}a(Pde,"readAuditLog")});var sK=M((v0e,nK)=>{"use strict";var{OPERATIONS_ENUM:Lde}=(G(),v(j)),bO=class{static{a(this,"GetBackupObject")}constructor(t,r,n=void 0,s=void 0){this.operation=Lde.GET_BACKUP,this.schema=t,this.table=r}};nK.exports=bO});var aK=M((B0e,oK)=>{"use strict";var Dde=os(),U0e=sK(),AO=ae(),vde=(G(),v(j)),x0e=fe(),{handleHDBError:Mde,hdbErrors:Ude}=Ee(),{HDB_ERROR_MSGS:iK,HTTP_STATUS_CODES:xde}=Ude;oK.exports=Bde;async function Bde(e){if(AO.isEmpty(e.schema))throw new Error(iK.SCHEMA_REQUIRED_ERR);if(AO.isEmpty(e.table))throw new Error(iK.TABLE_REQUIRED_ERR);let t=AO.checkSchemaTableExist(e.schema,e.table);if(t)throw Mde(new Error,t,xde.NOT_FOUND,vde.LOG_LEVELS.ERROR,t,!0);return await Dde.getBackup(readAuditLogObject)}a(Bde,"getBackup")});var uK=M((k0e,lK)=>{"use strict";var Fde=fe(),aa=require("joi"),kde=mt(),cK=require("moment"),Hde=require("fs-extra"),wO=require("path"),Gde=require("lodash"),hh=(G(),v(j)),{LOG_LEVELS:Kl}=(G(),v(j)),qde="YYYY-MM-DD hh:mm:ss",$de=wO.resolve(__dirname,"../logs");lK.exports=function(e){return kde.validateBySchema(e,Vde)};var Vde=aa.object({from:aa.custom(IO),until:aa.custom(IO),to:aa.custom(IO),level:aa.valid(Kl.NOTIFY,Kl.FATAL,Kl.ERROR,Kl.WARN,Kl.INFO,Kl.DEBUG,Kl.TRACE),order:aa.valid("asc","desc"),limit:aa.number().min(1),start:aa.number().min(0),log_name:aa.custom(Kde)});function IO(e,t){if(cK(e,cK.ISO_8601).format(qde)==="Invalid date")return t.message(`'${t.state.path[0]}' date '${e}' is invalid.`)}a(IO,"validateDatetime");function Kde(e,t){if(Gde.invert(hh.LOG_NAMES)[e]===void 0)return t.message(`'log_name' '${e}' is invalid.`);let n=Fde.get(hh.HDB_SETTINGS_NAMES.LOG_PATH_KEY),s=e===void 0?hh.LOG_NAMES.HDB:e,i=s===hh.LOG_NAMES.INSTALL?wO.join($de,hh.LOG_NAMES.INSTALL):wO.join(n,s);return Hde.existsSync(i)?null:t.message(`'log_name' '${e}' does not exist.`)}a(Kde,"validateReadLogPath")});var CO=M((G0e,fK)=>{"use strict";var AT=(G(),v(j)),Yde=Q(),Wde=fe(),jde=uK(),NO=require("path"),dK=require("fs-extra"),{once:zde}=require("events"),{handleHDBError:Jde,hdbErrors:Qde}=Ee(),{PACKAGE_ROOT:Xde}=Rt(),{replicateOperation:Zde}=(Es(),v(na)),efe=NO.join(Xde,"logs"),tfe=1e3,rfe=200;fK.exports=nfe;async function nfe(e){let t=jde(e);if(t)throw Jde(t,t.message,Qde.HTTP_STATUS_CODES.BAD_REQUEST,void 0,void 0,!0);let r=Zde(e),n=Wde.get(AT.HDB_SETTINGS_NAMES.LOG_PATH_KEY),s=e.log_name===void 0?AT.LOG_NAMES.HDB:e.log_name,i=s===AT.LOG_NAMES.INSTALL?NO.join(efe,AT.LOG_NAMES.INSTALL):NO.join(n,s);e.to===void 0&&e.until!==void 0&&(e.to=e.until);let o=e.level!==void 0,c=o?e.level:void 0,l=e.from!==void 0,u=l?new Date(e.from):void 0,d=e.to!==void 0,f=d?new Date(e.to):void 0,m=e.limit===void 0?tfe:e.limit,p=e.order===void 0?void 0:e.order,h=e.start===void 0?0:e.start,E=h+m,_=0;p==="desc"&&!u&&!f&&(_=Math.max(dK.statSync(i).size-(E+5)*rfe,0));let R=dK.createReadStream(i,{start:_});R.on("error",q=>{Yde.error(q)});let S=0,y=[],w="",I;R.on("data",q=>{let k=/(?:^|\n)(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:[\d.]+Z) \[(.+?)]: /g;q=w+q;let z=0,Y;for(;(Y=k.exec(q))&&!R.destroyed;){I&&(I.message=q.slice(z,Y.index),H(I));let[ce,de,te]=Y,Se=te.split("] ["),Ne=Se[0],Ke=Se[1];Se.splice(0,2),I={timestamp:de,thread:Ne,level:Ke,tags:Se,message:""},z=Y.index+ce.length}w=q.slice(z)}),R.on("end",q=>{R.destroyed||I&&(I.message=w.trim(),H(I))}),R.resume();function H(q){let k,z,Y;switch(!0){case(o&&l&&d):k=new Date(q.timestamp),z=new Date(u),Y=new Date(f),q.level===c&&k>=z&&k<=Y&&S<h?S++:q.level===c&&k>=z&&k<=Y&&(ho(q,p,y),S++,S===E&&R.destroy());break;case(o&&l):k=new Date(q.timestamp),z=new Date(u),q.level===c&&k>=z&&S<h?S++:q.level===c&&k>=z&&(ho(q,p,y),S++,S===E&&R.destroy());break;case(o&&d):k=new Date(q.timestamp),Y=new Date(f),q.level===c&&k<=Y&&S<h?S++:q.level===c&&k<=Y&&(ho(q,p,y),S++,S===E&&R.destroy());break;case(l&&d):k=new Date(q.timestamp),z=new Date(u),Y=new Date(f),k>=z&&k<=Y&&S<h?S++:k>=z&&k<=Y&&(ho(q,p,y),S++,S===E&&R.destroy());break;case o:q.level===c&&S<h?S++:q.level===c&&(ho(q,p,y),S++,S===E&&R.destroy());break;case l:k=new Date(q.timestamp),z=new Date(u),k>=z&&S<h?S++:k>=z&&S>=h&&(ho(q,p,y),S++,S===E&&R.destroy());break;case d:k=new Date(q.timestamp),Y=new Date(f),k<=Y&&S<h?S++:k<=Y&&S>=h&&(ho(q,p,y),S++,S===E&&R.destroy());break;default:S<h?S++:(ho(q,p,y),S++,S===E&&R.destroy())}}a(H,"onLogMessage"),await zde(R,"close");let X=await r;if(X.replicated){for(let q of y)q.node=server.hostname;for(let q of X.replicated){let k=q.node;if(q.status==="failed")ho({timestamp:new Date().toISOString(),level:"error",node:k,message:`Error retrieving logs: ${q.reason}`},p,y);else for(let z of q.results)z.node=k,ho(z,p,y)}}return y}a(nfe,"readLog");function ho(e,t,r){t==="desc"?sfe(e,r):t==="asc"?ife(e,r):r.push(e)}a(ho,"pushLineToResult");function sfe(e,t){let r=new Date(e.timestamp),n=0,s=t.length;for(;n<s;){let i=n+s>>>1;new Date(t[i].timestamp)>r?n=i+1:s=i}t.splice(n,0,e)}a(sfe,"insertDescending");function ife(e,t){let r=new Date(e.timestamp),n=0,s=t.length;for(;n<s;){let i=n+s>>>1;new Date(t[i].timestamp)<r?n=i+1:s=i}t.splice(n,0,e)}a(ife,"insertAscending")});var IT=M((W0e,EK)=>{"use strict";var OO=require("joi"),{string:Qd,boolean:mK,date:ofe}=OO.types(),afe=mt(),{validateSchemaExists:$0e,validateTableExists:V0e,validateSchemaName:K0e}=Wi(),cfe=(G(),v(j)),lfe=Lt(),pK=fe();pK.initSync();var Y0e=Qd.invalid(pK.get(cfe.CONFIG_PARAMS.CLUSTERING_NODENAME)??"node_name").pattern(lfe.NATS_TERM_CONSTRAINTS_RX).messages({"string.pattern.base":"{:#label} invalid, must not contain ., * or >","any.invalid":"'node_name' cannot be this nodes name"}).empty(null),hK={operation:Qd.valid("add_node","update_node","set_node_replication"),node_name:Qd.optional(),subscriptions:OO.array().items({table:Qd.optional(),schema:Qd.optional(),database:Qd.optional(),subscribe:mK.required(),publish:mK.required().custom(dfe),start_time:ofe.iso()})};function ufe(e){return afe.validateBySchema(e,OO.object(hK))}a(ufe,"addUpdateNodeValidator");function dfe(e,t){if(t.state.ancestors[2].operation==="add_node"&&e===!1&&t.state.ancestors[0].subscribe===!1)return t.message(`'subscriptions[${t.state.path[1]}]' subscribe and/or publish must be set to true when adding a node`)}a(dfe,"checkForFalsy");EK.exports={addUpdateNodeValidator:ufe,validationSchema:hK}});var Xd=M((z0e,_K)=>{"use strict";var PO=class{static{a(this,"Node")}constructor(t,r,n){this.name=t,this.subscriptions=r,this.system_info=n}},LO=class{static{a(this,"NodeSubscription")}constructor(t,r,n,s){this.schema=t,this.table=r,this.publish=n,this.subscribe=s}};_K.exports={Node:PO,NodeSubscription:LO}});var SK=M((Q0e,gK)=>{"use strict";var ffe=(G(),v(j)).OPERATIONS_ENUM,DO=class{static{a(this,"UpsertObject")}constructor(t,r,n,s=void 0){this.operation=ffe.UPSERT,this.schema=t,this.table=r,this.records=n,this.__origin=s}};gK.exports=DO});var Eh=M((Z0e,TK)=>{"use strict";var vO=class{static{a(this,"RemotePayloadObject")}constructor(t,r,n,s){this.operation=t,this.node_name=r,this.subscriptions=n,this.system_info=s}},MO=class{static{a(this,"RemotePayloadSubscription")}constructor(t,r,n,s,i,o,c){this.schema=t,this.table=r,this.hash_attribute=n,this.publish=s,this.subscribe=i,this.start_time=o,c!==void 0&&(this.attributes=c)}};TK.exports={RemotePayloadObject:vO,RemotePayloadSubscription:MO}});var RK=M((tBe,yK)=>{"use strict";var UO=class{static{a(this,"TableSizeObject")}constructor(t,r,n=0,s=0,i=0,o=0){this.schema=t,this.table=r,this.table_size=n,this.record_count=s,this.transaction_log_size=i,this.transaction_log_record_count=o}};yK.exports=UO});var AK=M((aBe,bK)=>{"use strict";var mfe=RK(),nBe=Jt(),sBe=Et(),pfe=Q(),{getSchemaPath:iBe,getTransactionAuditStorePath:oBe}=bt(),{getDatabases:hfe}=(Oe(),v(pt));bK.exports=Efe;async function Efe(e){let t=new mfe;try{let r=hfe()[e.schema]?.[e.name],n=r.primaryStore.getStats(),s=r.auditStore?.getStats();t.schema=e.schema,t.table=e.name,t.record_count=n.entryCount,t.transaction_log_record_count=s.entryCount}catch(r){pfe.warn(`unable to stat table dbi due to ${r}`)}return t}a(Efe,"lmdbGetTableSize")});var wK=M((lBe,IK)=>{"use strict";var xO=class{static{a(this,"SystemInformationObject")}constructor(t,r,n,s,i,o,c){this.system=t,this.time=r,this.cpu=n,this.memory=s,this.disk=i,this.network=o,this.harperdb_processes=c}};IK.exports=xO});var gh=M((hBe,PK)=>{"use strict";var _fe=require("fs-extra"),gfe=require("path"),An=require("systeminformation"),Tc=Q(),NK=_r(),dBe=Lt(),Zd=(G(),v(j)),Sfe=AK(),Tfe=Ol(),{getThreadInfo:CK}=st(),_h=fe();_h.initSync();var yfe=wK(),{openEnvironment:fBe}=Et(),{getSchemaPath:mBe}=bt(),{database:pBe,databases:BO}=(Oe(),v(pt)),wT;PK.exports={getHDBProcessInfo:GO,getNetworkInfo:$O,getDiskInfo:qO,getMemoryInfo:HO,getCPUInfo:kO,getTimeInfo:FO,getSystemInformation:VO,systemInformation:Rfe,getTableSize:KO,getMetrics:YO};function FO(){return An.time()}a(FO,"getTimeInfo");async function kO(){try{let{family:e,model:t,stepping:r,revision:n,voltage:s,speedmin:i,speedmax:o,governor:c,socket:l,cache:u,...d}=await An.cpu();d.cpu_speed=await An.cpuCurrentSpeed();let{rawCurrentload:f,rawCurrentloadIdle:m,rawCurrentloadIrq:p,rawCurrentloadNice:h,rawCurrentloadSystem:E,rawCurrentloadUser:_,cpus:R,...S}=await An.currentLoad();return S.cpus=[],R.forEach(y=>{let{rawLoad:w,rawLoadIdle:I,rawLoadIrq:H,rawLoadNice:X,rawLoadSystem:q,rawLoadUser:k,...z}=y;S.cpus.push(z)}),d.current_load=S,d}catch(e){return Tc.error(`error in getCPUInfo: ${e}`),{}}}a(kO,"getCPUInfo");async function HO(){try{let{buffers:e,cached:t,slab:r,buffcache:n,...s}=await An.mem();return Object.assign(s,process.memoryUsage())}catch(e){return Tc.error(`error in getMemoryInfo: ${e}`),{}}}a(HO,"getMemoryInfo");async function GO(){let e={core:[],clustering:[]};try{let t=await An.processes(),r;try{r=Number.parseInt(await _fe.readFile(gfe.join(_h.get(Zd.CONFIG_PARAMS.ROOTPATH),Zd.HDB_PID_FILE),"utf8"))}catch(n){if(n.code===Zd.NODE_ERROR_CODES.ENOENT)Tc.warn("Unable to locate 'hdb.pid' file, try stopping and starting HarperDB. This could be because HarperDB is not running.");else throw n}t.list.forEach(n=>{n.pid===r?e.core.push(n):n.name==="nats-server"&&e.clustering.push(n)});for(let n of e.core)for(let s of t.list)s.pid===n.parentPid&&(s.name==="PM2"||s.command==="PM2")&&(n.parent="PM2");return e}catch(t){return Tc.error(`error in getHDBProcessInfo: ${t}`),e}}a(GO,"getHDBProcessInfo");async function qO(){let e={};try{if(!_h.get(Zd.CONFIG_PARAMS.OPERATIONSAPI_SYSINFO_DISK))return e;let{rIO_sec:t,wIO_sec:r,tIO_sec:n,ms:s,...i}=await An.disksIO();e.io=i;let{rxSec:o,txSec:c,wxSec:l,...u}=await An.fsStats();return e.read_write=u,e.size=await An.fsSize(),e}catch(t){return Tc.error(`error in getDiskInfo: ${t}`),e}}a(qO,"getDiskInfo");async function $O(){let e={default_interface:null,latency:{},interfaces:[],stats:[],connections:[]};try{return _h.get(Zd.CONFIG_PARAMS.OPERATIONSAPI_SYSINFO_NETWORK)&&(e.default_interface=await An.networkInterfaceDefault(),e.latency=await An.inetChecksite("google.com"),(await An.networkInterfaces()).forEach(n=>{let{internal:s,virtual:i,mtu:o,dhcp:c,dnsSuffix:l,ieee8021xAuth:u,ieee8021xState:d,carrierChanges:f,...m}=n;e.interfaces.push(m)}),(await An.networkStats()).forEach(n=>{let{rxSec:s,txSec:i,ms:o,...c}=n;e.stats.push(c)})),e}catch(t){return Tc.error(`error in getNetworkInfo: ${t}`),e}}a($O,"getNetworkInfo");async function VO(){if(wT!==void 0)return wT;let e={};try{let{codepage:t,logofile:r,serial:n,build:s,servicepack:i,uefi:o,...c}=await An.osInfo();e=c;let l=await An.versions("node, npm");return e.node_version=l.node,e.npm_version=l.npm,wT=e,wT}catch(t){return Tc.error(`error in getSystemInformation: ${t}`),e}}a(VO,"getSystemInformation");async function KO(){let e=[],t=await Tfe.describeAll();for(let r of Object.values(t))for(let n of Object.values(r))e.push(await Sfe(n));return e}a(KO,"getTableSize");async function YO(){let e={};for(let t in BO){let r=e[t]={},n=r.tables={};for(let s in BO[t])try{let i=BO[t][s];if(!r.readers&&(Object.assign(r,i.primaryStore.rootStore.getStats()),delete r.root,r.readers=i.primaryStore.rootStore.readerList().split(/\n\s+/).slice(1).map(l=>{let[u,d,f]=l.trim().split(" ");return{pid:u,thread:d,txnid:f}}),i.auditStore)){let{treeDepth:l,treeBranchPageCount:u,treeLeafPageCount:d,entryCount:f,overflowPages:m}=i.auditStore.getStats();r.audit={treeDepth:l,treeBranchPageCount:u,treeLeafPageCount:d,entryCount:f,overflowPages:m}}let o=i.primaryStore.getStats(),c={};for(let l of["treeDepth","treeBranchPageCount","treeLeafPageCount","entryCount","overflowPages"])c[l]=o[l];n[s]=c}catch(i){Tc.notify(`Error getting stats for table ${s}: ${i}`)}}return e}a(YO,"getMetrics");async function OK(){if(_h.get(Zd.CONFIG_PARAMS.CLUSTERING_ENABLED)){let{jsm:e}=await NK.getNATSReferences(),t=await NK.listStreams(),r=[];for(let n of t){let s=[],i=await e.consumers.list(n.config.name);for await(let c of i)s.push({name:c.name,created:c.created,num_ack_pending:c.num_ack_pending,num_redelivered:c.num_redelivered,num_waiting:c.num_waiting,num_pending:c.num_pending});let o={stream_name:n.config.name,database:n.config.subjects[0].split(".")[1],table:n.config.subjects[0].split(".")[2],state:n.state,consumers:s};r.push(o)}return r}}a(OK,"getNatsStreamInfo");async function Rfe(e){let t=new yfe;if(!Array.isArray(e.attributes)||e.attributes.length===0)return t.system=await VO(),t.time=FO(),t.cpu=await kO(),t.memory=await HO(),t.disk=await qO(),t.network=await $O(),t.harperdb_processes=await GO(),t.table_size=await KO(),t.metrics=await YO(),t.threads=await CK(),t.replication=await OK(),t;for(let r=0;r<e.attributes.length;r++)switch(e.attributes[r]){case"system":t.system=await VO();break;case"time":t.time=FO();break;case"cpu":t.cpu=await kO();break;case"memory":t.memory=await HO();break;case"disk":t.disk=await qO();break;case"network":t.network=await $O();break;case"harperdb_processes":t.harperdb_processes=await GO();break;case"table_size":t.table_size=await KO();break;case"database_metrics":case"metrics":t.metrics=await YO();break;case"threads":t.threads=await CK();break;case"replication":t.replication=await OK();break;default:break}return t}a(Rfe,"systemInformation")});var ca=M((TBe,MK)=>{"use strict";var bfe=Gn(),WO=ae(),Afe=require("util"),Yl=(G(),v(j)),LK=fe();LK.initSync();var Ife=WN(),DK=_n(),{Node:_Be,NodeSubscription:gBe}=Xd(),wfe=fd(),Nfe=SK(),{RemotePayloadObject:Cfe,RemotePayloadSubscription:Ofe}=Eh(),{handleHDBError:Pfe,hdbErrors:Lfe}=Ee(),{HTTP_STATUS_CODES:Dfe,HDB_ERROR_MSGS:vfe}=Lfe,Mfe=mi(),Ufe=gh(),{packageJson:xfe}=Rt(),{getDatabases:Bfe}=(Oe(),v(pt)),SBe=Afe.promisify(Ife.authorize),Ffe=DK.searchByHash,kfe=DK.searchByValue;MK.exports={isEmpty:Hfe,getNodeRecord:Gfe,upsertNodeRecord:qfe,buildNodePayloads:$fe,checkClusteringEnabled:Vfe,getAllNodeRecords:Kfe,getSystemInfo:Yfe,reverseSubscription:vK};function Hfe(e){return e==null}a(Hfe,"isEmpty");async function Gfe(e){let t=new wfe(Yl.SYSTEM_SCHEMA_NAME,Yl.SYSTEM_TABLE_NAMES.NODE_TABLE_NAME,[e],["*"]);return Ffe(t)}a(Gfe,"getNodeRecord");async function qfe(e){let t=new Nfe(Yl.SYSTEM_SCHEMA_NAME,Yl.SYSTEM_TABLE_NAMES.NODE_TABLE_NAME,[e]);return bfe.upsert(t)}a(qfe,"upsertNodeRecord");function vK(e){if(WO.isEmpty(e.subscribe)||WO.isEmpty(e.publish))throw new Error("Received invalid subscription object");let{schema:t,table:r,hash_attribute:n}=e,s={schema:t,table:r,hash_attribute:n};return e.subscribe===!0&&e.publish===!1?(s.subscribe=!1,s.publish=!0):e.subscribe===!1&&e.publish===!0?(s.subscribe=!0,s.publish=!1):(s.subscribe=e.subscribe,s.publish=e.publish),s}a(vK,"reverseSubscription");function $fe(e,t,r,n){let s=[];for(let i=0,o=e.length;i<o;i++){let c=e[i],{schema:l,table:u}=c,d=WO.getTableHashAttribute(l,u),{subscribe:f,publish:m}=vK(c),p=Bfe()[l]?.[u],h=new Ofe(l,u,d,m,f,c.start_time,p.schemaDefined?p.attributes:void 0);s.push(h)}return new Cfe(r,t,s,n)}a($fe,"buildNodePayloads");function Vfe(){if(!LK.get(Yl.CONFIG_PARAMS.CLUSTERING_ENABLED))throw Pfe(new Error,vfe.CLUSTERING_NOT_ENABLED,Dfe.BAD_REQUEST,void 0,void 0,!0)}a(Vfe,"checkClusteringEnabled");async function Kfe(){let e=new Mfe(Yl.SYSTEM_SCHEMA_NAME,Yl.SYSTEM_TABLE_NAMES.NODE_TABLE_NAME,"name","*",void 0,["*"]);return Array.from(await kfe(e))}a(Kfe,"getAllNodeRecords");async function Yfe(){let e=await Ufe.getSystemInformation();return{hdb_version:xfe.version,node_version:e.node_version,platform:e.platform}}a(Yfe,"getSystemInfo")});var jO=M((RBe,qK)=>{"use strict";var NT=_r(),UK=ae(),xK=Lt(),BK=(G(),v(j)),CT=Q(),FK=yT(),Wfe=Rp(),{RemotePayloadObject:jfe}=Eh(),{handleHDBError:kK,hdbErrors:zfe}=Ee(),{HTTP_STATUS_CODES:HK}=zfe,{NodeSubscription:GK}=Xd();qK.exports=Jfe;async function Jfe(e,t){let r;try{r=await NT.request(`${t}.${xK.REQUEST_SUFFIX}`,new jfe(BK.OPERATIONS_ENUM.DESCRIBE_ALL,t,void 0,void 0)),CT.trace("Response from remote describe all request:",r)}catch(o){CT.error(`addNode received error from describe all request to remote node: ${o}`);let c=NT.requestErrorHandler(o,"add_node",t);throw kK(new Error,c,HK.INTERNAL_SERVER_ERROR,"error",c)}if(r.status===xK.UPDATE_REMOTE_RESPONSE_STATUSES.ERROR){let o=`Error returned from remote node ${t}: ${r.message}`;throw kK(new Error,o,HK.INTERNAL_SERVER_ERROR,"error",o)}let n=r.message,s=[],i=[];for(let o of e){let{table:c}=o,l=o.database??o.schema??"data";if(l===BK.SYSTEM_SCHEMA_NAME){await NT.createLocalTableStream(l,c);let h=new GK(l,c,o.publish,o.subscribe);h.start_time=o.start_time,i.push(h);continue}let u=UK.doesSchemaExist(l),d=n[l]!==void 0,f=c?UK.doesTableExist(l,c):!0,m=c?n?.[l]?.[c]!==void 0:!0;if(!u&&!d||!f&&!m){s.push(o);continue}if(!u&&d&&(CT.trace(`addNode creating schema: ${l}`),await FK.createSchema({operation:"create_schema",schema:l})),!f&&m){CT.trace(`addNode creating table: ${c} in schema: ${l} with attributes ${JSON.stringify(n[l][c].attributes)}`);let h=new Wfe(l,c,n[l][c].hash_attribute);n[l][c].attributes&&(h.attributes=n[l][c].attributes),await FK.createTable(h)}await NT.createLocalTableStream(l,c);let p=new GK(l,c,o.publish,o.subscribe);p.start_time=o.start_time,i.push(p)}return{added:i,skipped:s}}a(Jfe,"reviewSubscriptions")});var ef={};ye(ef,{addNodeBack:()=>zO,removeNodeBack:()=>JO,setNode:()=>eme});async function eme(e){e.node_name&&!e.hostname&&(e.hostname=e.node_name),e.verify_tls!==void 0&&(e.rejectUnauthorized=e.verify_tls);let{url:t,hostname:r}=e;t?r||(r=e.hostname=Si(t)):t=ET(r);let n=(0,VK.validateBySchema)(e,Zfe);if(n)throw(0,la.handleHDBError)(n,n.message,Xfe.BAD_REQUEST,void 0,void 0,!0);if(e.operation==="remove_node"){if(!t&&!r)throw new la.ClientError("url or hostname is required for remove_node operation");let p=r,h=Ht(),E=await h.get(p);if(!E)throw new la.ClientError(p+" does not exist");try{await mh({url:E.url},{operation:V.REMOVE_NODE_BACK,name:E?.subscriptions?.length>0?rt():p},void 0)}catch(_){Ss.warn(`Error removing node from target node ${p}, if it is offline and we be online in the future, you may need to clean up this node manually, or retry:`,_)}return await h.delete(p),`Successfully removed '${p}' from cluster`}if(!t)throw new la.ClientError("url required for this operation");let s=fc();if(s==null)throw new la.ClientError("replication url is missing from harperdb-config.yaml");let i,o,c;if(t?.startsWith("wss:")){i=await(0,qs.getReplicationCert)();let p=await(0,qs.getReplicationCertAuth)();if(!i)throw new Error("Unable to find a certificate to use for replication");i.options.is_self_signed?(o=await(0,qs.createCsr)(),Ss.info("Sending CSR to target node:",t)):p&&(c=p.certificate,Ss.info("Sending CA named",p.name,"to target node",t))}let l={operation:V.ADD_NODE_BACK,hostname:(0,Rc.get)(x.REPLICATION_HOSTNAME),target_hostname:r,url:s,csr:o,cert_auth:c,authorization:e.retain_authorization?e.authorization:null};if((0,Rc.get)(x.REPLICATION_SHARD)!==void 0&&(l.shard=(0,Rc.get)(x.REPLICATION_SHARD)),e.subscriptions?l.subscriptions=e.subscriptions.map($K):l.subscriptions=null,e.hasOwnProperty("subscribe")||e.hasOwnProperty("publish")){let p=$K(e);l.subscribe=p.subscribe,l.publish=p.publish}e?.authorization?.username&&e?.authorization?.password&&(e.authorization="Basic "+Buffer.from(e.authorization.username+":"+e.authorization.password).toString("base64"));let u,d;try{u=await mh({url:t},l,e)}catch(p){p.message=`Error returned from ${t}: `+p.message,Ss.warn("Error adding node:",t,"to cluster:",p),d=p}if(o&&(!u?.certificate||!u?.certificate?.includes?.("BEGIN CERTIFICATE")))throw d?(d.message+=" and connection was required to sign certificate",d):new Error(`Unexpected certificate signature response from node ${t} response: ${JSON.stringify(u)}`);o&&(Ss.info("CSR response received from node:",t,"saving certificate and CA in hdb_certificate"),await(0,qs.setCertTable)({name:Qfe.certificateFromPem(u.signingCA).issuer.getField("CN").value,certificate:u.signingCA,is_authority:!0}),u.certificate&&await(0,qs.setCertTable)({name:rt(),uses:["https","operations","wss"],certificate:u.certificate,private_key_name:i?.options?.key_file,is_authority:!1,is_self_signed:!1}),c=u.signingCA);let f={url:t,ca:u?.usingCA};if(e.hostname&&(f.name=e.hostname),e.subscriptions?f.subscriptions=e.subscriptions:f.replicates=!0,e.start_time&&(f.start_time=typeof e.start_time=="string"?new Date(e.start_time).getTime():e.start_time),e.retain_authorization&&(f.authorization=e.authorization),e.revoked_certificates&&(f.revoked_certificates=e.revoked_certificates),u?.shard!==void 0?f.shard=u.shard:e.shard!==void 0&&(f.shard=e.shard),f.replicates){let p={url:s,ca:c,replicates:!0,subscriptions:null};(0,Rc.get)(x.REPLICATION_SHARD)!==void 0&&(p.shard=(0,Rc.get)(x.REPLICATION_SHARD)),e.retain_authorization&&(p.authorization=e.authorization),e.start_time&&(p.start_time=e.start_time),await ta(rt(),p)}await ta(u?u.nodeName:f.name??Si(t),f);let m;return e.operation==="update_node"?m=`Successfully updated '${t}'`:m=`Successfully added '${t}' to cluster`,d&&(m+=" but there was an error updating target node: "+d.message),m}async function zO(e){Ss.trace("addNodeBack received request:",e);let t=await(0,qs.signCertificate)(e),r;e.csr?(r=t.signingCA,Ss.info("addNodeBack received CSR from node:",e.url,"this node will use and respond with CA that was used to issue CSR")):(r=e?.cert_auth,Ss.info("addNodeBack received CA from node:",e.url));let n={url:e.url,ca:r};e.subscriptions?n.subscriptions=e.subscriptions:(n.replicates=!0,n.subscriptions=null),e.start_time&&(n.start_time=e.start_time),e.authorization&&(n.authorization=e.authorization),e.shard!==void 0&&(n.shard=e.shard);let s=await(0,qs.getReplicationCertAuth)();if(n.replicates){let i={url:fc(),ca:s?.certificate,replicates:!0,subscriptions:null};(0,Rc.get)(x.REPLICATION_SHARD)!==void 0&&(i.shard=(0,Rc.get)(x.REPLICATION_SHARD),t.shard=i.shard),e.start_time&&(i.start_time=e.start_time),e.authorization&&(i.authorization=e.authorization),await ta(rt(),i)}return await ta(e.hostname,n),t.nodeName=rt(),t.usingCA=s?.certificate,Ss.info("addNodeBack responding to:",e.url,"with CA named:",s?.name),t}async function JO(e){Ss.trace("removeNodeBack received request:",e),await Ht().delete(e.name)}function $K(e){let{subscribe:t,publish:r}=e;return{...e,subscribe:r,publish:t}}var qs,VK,yc,Rc,Ss,la,Qfe,Xfe,Zfe,tf=se(()=>{qs=b(gs()),VK=b(mt()),yc=b(require("joi")),Rc=b(fe());G();nh();Ud();Es();Ss=b(Q()),la=b(Ee()),{pki:Qfe}=require("node-forge"),{HTTP_STATUS_CODES:Xfe}=la.hdbErrors,Zfe=yc.default.object({hostname:yc.default.string(),verify_tls:yc.default.boolean(),replicates:yc.default.boolean(),subscriptions:yc.default.array(),revoked_certificates:yc.default.array(),shard:yc.default.number()});a(eme,"setNode");a(zO,"addNodeBack");a(JO,"removeNodeBack");a($K,"reverseSubscription")});var vT=M((LBe,YK)=>{"use strict";var{handleHDBError:OT,hdbErrors:tme}=Ee(),{HTTP_STATUS_CODES:PT}=tme,{addUpdateNodeValidator:rme}=IT(),LT=Q(),DT=(G(),v(j)),KK=Lt(),nme=ae(),Sh=_r(),Th=ca(),QO=fe(),sme=jO(),{Node:ime,NodeSubscription:ome}=Xd(),{broadcast:ame}=st(),{setNode:cme}=(tf(),v(ef)),OBe=fe(),PBe=(G(),v(j)),lme="Unable to create subscriptions due to schema and/or tables not existing on the local or remote node",ume="Some subscriptions were unsuccessful due to schema and/or tables not existing on the local or remote node",dme=QO.get(DT.CONFIG_PARAMS.CLUSTERING_NODENAME);YK.exports=fme;async function fme(e,t=!1){if(LT.trace("addNode called with:",e),QO.get(DT.CONFIG_PARAMS.REPLICATION_URL)||QO.get(DT.CONFIG_PARAMS.REPLICATION_HOSTNAME))return cme(e);Th.checkClusteringEnabled();let r=rme(e);if(r)throw OT(r,r.message,PT.BAD_REQUEST,void 0,void 0,!0);let n=e.node_name;if(!t){let f=await Th.getNodeRecord(n);if(!nme.isEmptyOrZeroLength(f))throw OT(new Error,`Node '${n}' has already been added, perform update_node to proceed.`,PT.BAD_REQUEST,void 0,void 0,!0)}let{added:s,skipped:i}=await sme(e.subscriptions,n),o={message:void 0,added:s,skipped:i};if(s.length===0)return o.message=lme,o;let c=Th.buildNodePayloads(s,dme,DT.OPERATIONS_ENUM.ADD_NODE,await Th.getSystemInfo()),l=[];for(let f=0,m=s.length;f<m;f++){let p=s[f];s[f].start_time===void 0&&delete s[f].start_time,l.push(new ome(p.schema,p.table,p.publish,p.subscribe))}LT.trace("addNode sending remote payload:",c);let u;try{u=await Sh.request(`${n}.${KK.REQUEST_SUFFIX}`,c)}catch(f){LT.error(`addNode received error from request: ${f}`);for(let p=0,h=s.length;p<h;p++){let E=s[p];E.publish=!1,E.subscribe=!1,await Sh.updateRemoteConsumer(E,n)}let m=Sh.requestErrorHandler(f,"add_node",n);throw OT(new Error,m,PT.INTERNAL_SERVER_ERROR,"error",m)}if(u.status===KK.UPDATE_REMOTE_RESPONSE_STATUSES.ERROR){let f=`Error returned from remote node ${n}: ${u.message}`;throw OT(new Error,f,PT.INTERNAL_SERVER_ERROR,"error",f)}LT.trace(u);for(let f=0,m=s.length;f<m;f++){let p=s[f];await Sh.updateRemoteConsumer(p,n),p.subscribe===!0&&await Sh.updateConsumerIterator(p.schema,p.table,n,"start")}let d=new ime(n,l,u.system_info);return await Th.upsertNodeRecord(d),ame({type:"nats_update"}),i.length>0?o.message=ume:o.message=`Successfully added '${n}' to manifest`,o}a(fme,"addNode")});var tP=M((MBe,jK)=>{"use strict";var{handleHDBError:XO,hdbErrors:mme}=Ee(),{HTTP_STATUS_CODES:ZO}=mme,{addUpdateNodeValidator:pme}=IT(),yh=Q(),MT=(G(),v(j)),WK=Lt(),vBe=ae(),Rh=_r(),bh=ca(),eP=fe(),{cloneDeep:hme}=require("lodash"),Eme=jO(),{Node:_me,NodeSubscription:gme}=Xd(),{broadcast:Sme}=st(),{setNode:Tme}=(tf(),v(ef)),yme="Unable to update subscriptions due to schema and/or tables not existing on the local or remote node",Rme="Some subscriptions were unsuccessful due to schema and/or tables not existing on the local or remote node",bme=eP.get(MT.CONFIG_PARAMS.CLUSTERING_NODENAME);jK.exports=Ame;async function Ame(e){if(yh.trace("updateNode called with:",e),eP.get(MT.CONFIG_PARAMS.REPLICATION_URL)??eP.get(MT.CONFIG_PARAMS.REPLICATION_HOSTNAME))return Tme(e);bh.checkClusteringEnabled();let t=pme(e);if(t)throw XO(t,t.message,ZO.BAD_REQUEST,void 0,void 0,!0);let r=e.node_name,n,s=await bh.getNodeRecord(r);s.length>0&&(n=hme(s));let{added:i,skipped:o}=await Eme(e.subscriptions,r),c={message:void 0,updated:i,skipped:o};if(i.length===0)return c.message=yme,c;let l=bh.buildNodePayloads(i,bme,MT.OPERATIONS_ENUM.UPDATE_NODE,await bh.getSystemInfo());for(let d=0,f=i.length;d<f;d++){let m=i[d];yh.trace(`updateNode updating work stream for node: ${r} subscription:`,m),i[d].start_time===void 0&&delete i[d].start_time}yh.trace("updateNode sending remote payload:",l);let u;try{u=await Rh.request(`${r}.${WK.REQUEST_SUFFIX}`,l)}catch(d){yh.error(`updateNode received error from request: ${d}`);let f=Rh.requestErrorHandler(d,"update_node",r);throw XO(new Error,f,ZO.INTERNAL_SERVER_ERROR,"error",f)}if(u.status===WK.UPDATE_REMOTE_RESPONSE_STATUSES.ERROR){let d=`Error returned from remote node ${r}: ${u.message}`;throw XO(new Error,d,ZO.INTERNAL_SERVER_ERROR,"error",d)}yh.trace(u);for(let d=0,f=i.length;d<f;d++){let m=i[d];await Rh.updateRemoteConsumer(m,r),m.subscribe===!0?await Rh.updateConsumerIterator(m.schema,m.table,r,"start"):await Rh.updateConsumerIterator(m.schema,m.table,r,"stop")}return n||(n=[new _me(r,[],u.system_info)]),await Ime(n[0],i,u.system_info),o.length>0?c.message=Rme:c.message=`Successfully updated '${r}'`,c}a(Ame,"updateNode");async function Ime(e,t,r){let n=e;for(let s=0,i=t.length;s<i;s++){let o=t[s],c=!1;for(let l=0,u=e.subscriptions.length;l<u;l++){let d=n.subscriptions[l];if(d.schema===o.schema&&d.table===o.table){d.publish=o.publish,d.subscribe=o.subscribe,c=!0;break}}c||n.subscriptions.push(new gme(o.schema,o.table,o.publish,o.subscribe))}n.system_info=r,await bh.upsertNodeRecord(n),Sme({type:"nats_update"})}a(Ime,"updateNodeTable")});var ZK=M((xBe,XK)=>{"use strict";var QK=require("joi"),{string:zK}=QK.types(),wme=mt(),JK=(G(),v(j)),Nme=fe(),Cme=Lt();XK.exports=Ome;function Ome(e){let t=zK.invalid(Nme.get(JK.CONFIG_PARAMS.CLUSTERING_NODENAME)).pattern(Cme.NATS_TERM_CONSTRAINTS_RX).messages({"string.pattern.base":"{:#label} invalid, must not contain ., * or >","any.invalid":"'node_name' cannot be this nodes name"}).empty(null),r=QK.object({operation:zK.valid(JK.OPERATIONS_ENUM.REMOVE_NODE).required(),node_name:t});return wme.validateBySchema(e,r)}a(Ome,"removeNodeValidator")});var UT=M((FBe,sY)=>{"use strict";var{handleHDBError:eY,hdbErrors:Pme}=Ee(),{HTTP_STATUS_CODES:tY}=Pme,Lme=ZK(),Ah=Q(),rY=ca(),Dme=ae(),rf=(G(),v(j)),nY=Lt(),rP=_r(),nP=fe(),{RemotePayloadObject:vme}=Eh(),{NodeSubscription:Mme}=Xd(),Ume=yp(),xme=ml(),{broadcast:Bme}=st(),{setNode:Fme}=(tf(),v(ef)),kme=nP.get(rf.CONFIG_PARAMS.CLUSTERING_NODENAME);sY.exports=Hme;async function Hme(e){if(Ah.trace("removeNode called with:",e),nP.get(rf.CONFIG_PARAMS.REPLICATION_URL)??nP.get(rf.CONFIG_PARAMS.REPLICATION_HOSTNAME))return Fme(e);rY.checkClusteringEnabled();let t=Lme(e);if(t)throw eY(t,t.message,tY.BAD_REQUEST,void 0,void 0,!0);let r=e.node_name,n=await rY.getNodeRecord(r);if(Dme.isEmptyOrZeroLength(n))throw eY(new Error,`Node '${r}' was not found.`,tY.BAD_REQUEST,void 0,void 0,!0);n=n[0];let s=new vme(rf.OPERATIONS_ENUM.REMOVE_NODE,kme,[]),i,o=!1;for(let l=0,u=n.subscriptions.length;l<u;l++){let d=n.subscriptions[l];d.subscribe===!0&&await rP.updateConsumerIterator(d.schema,d.table,r,"stop");try{await rP.updateRemoteConsumer(new Mme(d.schema,d.table,!1,!1),r)}catch(f){Ah.error(f)}}try{i=await rP.request(`${r}.${nY.REQUEST_SUFFIX}`,s),Ah.trace("Remove node reply from remote node:",r,i)}catch(l){Ah.error("removeNode received error from request:",l),o=!0}let c=new Ume(rf.SYSTEM_SCHEMA_NAME,rf.SYSTEM_TABLE_NAMES.NODE_TABLE_NAME,[r]);return await xme.deleteRecord(c),Bme({type:"nats_update"}),i?.status===nY.UPDATE_REMOTE_RESPONSE_STATUSES.ERROR||o?(Ah.error("Error returned from remote node:",r,i?.message),`Successfully removed '${r}' from local manifest, however there was an error reaching remote node. Check the logs for more details.`):`Successfully removed '${r}' from manifest`}a(Hme,"removeNode")});var aY=M((HBe,oY)=>{"use strict";var iY=require("joi"),{string:Gme,array:qme}=iY.types(),$me=mt(),Vme=IT();oY.exports=Kme;function Kme(e){let t=iY.object({operation:Gme.valid("configure_cluster").required(),connections:qme.items(Vme.validationSchema).required()});return $me.validateBySchema(e,t)}a(Kme,"configureClusterValidator")});var sP=M((qBe,fY)=>{"use strict";var cY=(G(),v(j)),xT=Q(),Yme=ae(),Wme=fe(),jme=UT(),zme=vT(),Jme=ca(),Qme=aY(),{handleHDBError:lY,hdbErrors:Xme}=Ee(),{HTTP_STATUS_CODES:uY}=Xme,Zme="Configure cluster complete.",epe="Failed to configure the cluster. Check the logs for more details.",tpe="Configure cluster was partially successful. Errors occurred when attempting to configure the following nodes. Check the logs for more details.";fY.exports=rpe;async function rpe(e){xT.trace("configure cluster called with:",e);let t=Qme(e);if(t)throw lY(t,t.message,uY.BAD_REQUEST,void 0,void 0,!0);let r=await Jme.getAllNodeRecords(),n=[];if(Wme.get(cY.CONFIG_PARAMS.CLUSTERING_ENABLED)){for(let d=0,f=r.length;d<f;d++){let m=await dY(jme,{operation:cY.OPERATIONS_ENUM.REMOVE_NODE,node_name:r[d].name},r[d].name);n.push(m)}xT.trace("All results from configure_cluster remove node:",n)}let s=[],i=e.connections.length;for(let d=0;d<i;d++){let f=e.connections[d],m=await dY(zme,f,f.node_name);s.push(m)}xT.trace("All results from configure_cluster add node:",s);let o=[],c=[],l=!1,u=n.concat(s);for(let d=0,f=u.length;d<f;d++){let m=u[d];m.status==="rejected"&&(xT.error(m.node_name,m?.error?.message,m?.error?.stack),o.includes(m.node_name)||o.push(m.node_name)),(m?.result?.message?.includes?.("Successfully")||m?.result?.includes?.("Successfully"))&&(l=!0),!(typeof m.result=="string"&&m.result.includes("Successfully removed")||m.status==="rejected")&&c.push({node_name:m?.node_name,response:m?.result})}if(Yme.isEmptyOrZeroLength(o))return{message:Zme,connections:c};if(l)return{message:tpe,failed_nodes:o,connections:c};throw lY(new Error,epe,uY.INTERNAL_SERVER_ERROR,void 0,void 0,!0)}a(rpe,"configureCluster");async function dY(e,t,r){try{return{node_name:r,result:await e(t)}}catch(n){return{node_name:r,error:n,status:"rejected"}}}a(dY,"functionWrapper")});var EY=M((VBe,hY)=>{"use strict";var Ih=require("joi"),npe=mt(),{validateSchemaExists:mY,validateTableExists:spe,validateSchemaName:pY}=Wi(),ipe=Ih.object({operation:Ih.string().valid("purge_stream"),schema:Ih.string().custom(mY).custom(pY).optional(),database:Ih.string().custom(mY).custom(pY).optional(),table:Ih.string().custom(spe).required()});function ope(e){return npe.validateBySchema(e,ipe)}a(ope,"purgeStreamValidator");hY.exports=ope});var iP=M((YBe,_Y)=>{"use strict";var{handleHDBError:ape,hdbErrors:cpe}=Ee(),{HTTP_STATUS_CODES:lpe}=cpe,upe=EY(),dpe=_r(),fpe=ca();_Y.exports=mpe;async function mpe(e){e.schema=e.schema??e.database;let t=upe(e);if(t)throw ape(t,t.message,lpe.BAD_REQUEST,void 0,void 0,!0);fpe.checkClusteringEnabled();let{schema:r,table:n,options:s}=e;return await dpe.purgeTableStream(r,n,s),`Successfully purged table '${r}.${n}'`}a(mpe,"purgeStream")});var cP=M((jBe,IY)=>{"use strict";var aP=ca(),ppe=_r(),FT=fe(),nf=(G(),v(j)),Wl=Lt(),hpe=ae(),oP=Q(),{RemotePayloadObject:Epe}=Eh(),{ErrorCode:gY}=require("nats"),{parentPort:SY}=require("worker_threads"),{onMessageByType:_pe}=st(),{getThisNodeName:gpe}=(Es(),v(na)),{requestClusterStatus:Spe}=(nh(),v(mV)),{getReplicationSharedStatus:Tpe,getHDBNodeTable:ype}=(Ud(),v(oV)),{CONFIRMATION_STATUS_POSITION:Rpe,RECEIVED_VERSION_POSITION:TY,RECEIVED_TIME_POSITION:bpe,SENDING_TIME_POSITION:Ape,RECEIVING_STATUS_POSITION:Ipe,RECEIVING_STATUS_RECEIVING:wpe,BACK_PRESSURE_RATIO_POSITION:Npe}=(ZC(),v(n1)),yY=FT.get(nf.CONFIG_PARAMS.CLUSTERING_ENABLED),RY=FT.get(nf.CONFIG_PARAMS.CLUSTERING_NODENAME);IY.exports={clusterStatus:Cpe,buildNodeStatus:AY};var bY;_pe("cluster-status",async e=>{bY(e)});async function Cpe(){if(FT.get(nf.CONFIG_PARAMS.REPLICATION_URL)||FT.get(nf.CONFIG_PARAMS.REPLICATION_HOSTNAME)){let n;SY?(SY.postMessage({type:"request-cluster-status"}),n=await new Promise(i=>{bY=i})):n=Spe();for(let i of n.connections){let o=i.name;for(let c of i.database_sockets){let l=c.database,u;for(let f of Object.values(databases[l]||{}))if(u=f.auditStore,u)break;if(!u)continue;let d=Tpe(u,l,o);c.lastCommitConfirmed=BT(d[Rpe]),c.lastReceivedRemoteTime=BT(d[TY]),c.lastReceivedLocalTime=BT(d[bpe]),c.lastReceivedVersion=d[TY],c.sendingMessage=BT(d[Ape]),c.backPressurePercent=d[Npe]*100,c.lastReceivedStatus=d[Ipe]===wpe?"Receiving":"Waiting"}}n.node_name=gpe();let s=ype().primaryStore.get(n.node_name);return s?.shard&&(n.shard=s.shard),s?.url&&(n.url=s.url),n.is_enabled=!0,n}let e={node_name:RY,is_enabled:yY,connections:[]};if(!yY)return e;let t=await aP.getAllNodeRecords();if(hpe.isEmptyOrZeroLength(t))return e;let r=[];for(let n=0,s=t.length;n<s;n++)r.push(AY(t[n],e.connections));return await Promise.allSettled(r),e}a(Cpe,"clusterStatus");function BT(e){return e?e===1?"Copying":new Date(e).toUTCString():void 0}a(BT,"asDate");async function AY(e,t){let r=e.name,n=new Epe(nf.OPERATIONS_ENUM.CLUSTER_STATUS,RY,void 0,await aP.getSystemInfo()),s,i,o=Wl.CLUSTER_STATUS_STATUSES.OPEN;try{let l=Date.now();s=await ppe.request(Wl.REQUEST_SUBJECT(r),n),i=Date.now()-l,s.status===Wl.UPDATE_REMOTE_RESPONSE_STATUSES.ERROR&&(o=Wl.CLUSTER_STATUS_STATUSES.CLOSED,oP.error(`Error getting node status from ${r} `,s))}catch(l){oP.warn(`Error getting node status from ${r}`,l),l.code===gY.NoResponders?o=Wl.CLUSTER_STATUS_STATUSES.NO_RESPONDERS:l.code===gY.Timeout?o=Wl.CLUSTER_STATUS_STATUSES.TIMEOUT:o=Wl.CLUSTER_STATUS_STATUSES.CLOSED}let c=new Ope(r,o,s?.message?.ports?.clustering,s?.message?.ports?.operations_api,i,s?.message?.uptime,e.subscriptions,s?.message?.system_info);try{let l={name:r,system_info:s?.message?.system_info};e.system_info?.hdb_version!==nf.PRE_4_0_0_VERSION&&await aP.upsertNodeRecord(l)}catch(l){oP.error("Cluster status encountered an error updating system info for node:",r,l)}t.push(c)}a(AY,"buildNodeStatus");function Ope(e,t,r,n,s,i,o,c){this.node_name=e,this.status=t,this.ports={clustering:r,operations_api:n},this.latency_ms=s,this.uptime=i,this.subscriptions=o,this.system_info=c}a(Ope,"NodeStatusObject")});var uP=M((JBe,wY)=>{"use strict";var{handleHDBError:Ppe,hdbErrors:Lpe}=Ee(),{HTTP_STATUS_CODES:Dpe}=Lpe,vpe=_r(),Mpe=ca(),lP=ae(),kT=require("joi"),Upe=mt(),xpe=2e3,Bpe=kT.object({timeout:kT.number().min(1),connected_nodes:kT.boolean(),routes:kT.boolean()});wY.exports=Fpe;async function Fpe(e){Mpe.checkClusteringEnabled();let t=Upe.validateBySchema(e,Bpe);if(t)throw Ppe(t,t.message,Dpe.BAD_REQUEST,void 0,void 0,!0);let{timeout:r,connected_nodes:n,routes:s}=e,i=n===void 0||lP.autoCastBoolean(n),o=s===void 0||lP.autoCastBoolean(s),c={nodes:[]},l=await vpe.getServerList(r??xpe),u={};if(i)for(let d=0,f=l.length;d<f;d++){let m=l[d].statsz;m&&(u[l[d].server.name]=m.routes)}for(let d=0,f=l.length;d<f;d++){if(l[d].statsz)continue;let m=l[d].server,p=l[d].data;if(m.name.endsWith("-hub")){let h={name:m.name.slice(0,-4),response_time:l[d].response_time};i&&(h.connected_nodes=[],u[m.name]&&u[m.name].forEach(E=>{h.connected_nodes.includes(E.name.slice(0,-4))||h.connected_nodes.push(E.name.slice(0,-4))})),o&&(h.routes=p.cluster?.urls?p.cluster?.urls.map(E=>({host:E.split(":")[0],port:lP.autoCast(E.split(":")[1])})):[]),c.nodes.push(h)}}return c}a(Fpe,"clusterNetwork")});var PY=M((XBe,OY)=>{"use strict";var dP=require("joi"),NY=mt(),{routeConstraints:CY}=HI();OY.exports={setRoutesValidator:kpe,deleteRoutesValidator:Hpe};function kpe(e){let t=dP.object({server:dP.valid("hub","leaf"),routes:CY.required()});return NY.validateBySchema(e,t)}a(kpe,"setRoutesValidator");function Hpe(e){let t=dP.object({routes:CY.required()});return NY.validateBySchema(e,t)}a(Hpe,"deleteRoutesValidator")});var HT=M((eFe,BY)=>{"use strict";var ua=gt(),fP=ae(),$s=(G(),v(j)),sf=fe(),LY=PY(),{handleHDBError:DY,hdbErrors:Gpe}=Ee(),{HTTP_STATUS_CODES:vY}=Gpe,MY="cluster routes successfully set",UY="cluster routes successfully deleted";BY.exports={setRoutes:$pe,getRoutes:Vpe,deleteRoutes:Kpe};function qpe(e){let t=ua.getClusteringRoutes(),r=e.server==="hub"?t.hub_routes:t.leaf_routes,n=e.server==="hub"?t.leaf_routes:t.hub_routes,s=[],i=[];for(let o=0,c=e.routes.length;o<c;o++){let l=e.routes[o];l.port=fP.autoCast(l.port);let u=r.some(f=>f.host===l.host&&f.port===l.port),d=n.some(f=>f.host===l.host&&f.port===l.port);u||d?s.push(l):(r.push(l),i.push(l))}return e.server==="hub"?ua.updateConfigValue($s.CONFIG_PARAMS.CLUSTERING_HUBSERVER_CLUSTER_NETWORK_ROUTES,r):ua.updateConfigValue($s.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_NETWORK_ROUTES,r),{message:MY,set:i,skipped:s}}a(qpe,"setRoutesNats");function $pe(e){let t=LY.setRoutesValidator(e);if(t)throw DY(t,t.message,vY.BAD_REQUEST,void 0,void 0,!0);if(sf.get($s.CONFIG_PARAMS.CLUSTERING_ENABLED))return qpe(e);let r=[],n=[],s=sf.get($s.CONFIG_PARAMS.REPLICATION_ROUTES)??[];return e.routes.forEach(i=>{xY(s,i)?n.push(i):(s.push(i),r.push(i))}),ua.updateConfigValue($s.CONFIG_PARAMS.REPLICATION_ROUTES,s),{message:MY,set:r,skipped:n}}a($pe,"setRoutes");function xY(e,t){return typeof t=="string"?e.includes(t):typeof t=="object"&&t!==null?e.some(r=>(r.host===t.host||r.hostname===t.hostname)&&r.port===t.port):!1}a(xY,"existsInArray");function Vpe(){if(sf.get($s.CONFIG_PARAMS.CLUSTERING_ENABLED)){let e=ua.getClusteringRoutes();return{hub:e.hub_routes,leaf:e.leaf_routes}}else return sf.get($s.CONFIG_PARAMS.REPLICATION_ROUTES)??[]}a(Vpe,"getRoutes");function Kpe(e){let t=LY.deleteRoutesValidator(e);if(t)throw DY(t,t.message,vY.BAD_REQUEST,void 0,void 0,!0);if(sf.get($s.CONFIG_PARAMS.CLUSTERING_ENABLED))return Ype(e);let r=[],n=[],s=sf.get($s.CONFIG_PARAMS.REPLICATION_ROUTES)??[],i=[];return s.forEach(o=>{xY(e.routes,o)?r.push(o):(i.push(o),n.push(o))}),ua.updateConfigValue($s.CONFIG_PARAMS.REPLICATION_ROUTES,i),{message:UY,deleted:r,skipped:n}}a(Kpe,"deleteRoutes");function Ype(e){let t=ua.getClusteringRoutes(),r=t.hub_routes,n=t.leaf_routes,s=[],i=[],o=!1,c=!1;for(let l=0,u=e.routes.length;l<u;l++){let d=e.routes[l],f=!1;for(let m=0,p=r.length;m<p;m++){let h=r[m];if(d.host===h.host&&d.port===h.port){r.splice(m,1),f=!0,o=!0,s.push(d);break}}if(!f){let m=!0;for(let p=0,h=n.length;p<h;p++){let E=n[p];if(d.host===E.host&&d.port===E.port){n.splice(p,1),c=!0,m=!1,s.push(d);break}}m&&i.push(d)}}return o&&(r=fP.isEmptyOrZeroLength(r)?null:r,ua.updateConfigValue($s.CONFIG_PARAMS.CLUSTERING_HUBSERVER_CLUSTER_NETWORK_ROUTES,r)),c&&(n=fP.isEmptyOrZeroLength(n)?null:n,ua.updateConfigValue($s.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_NETWORK_ROUTES,n)),{message:UY,deleted:s,skipped:i}}a(Ype,"deleteRoutesNats")});var kY=M((rFe,FY)=>{"use strict";var Wpe=Lt(),mP=class{static{a(this,"HubConfigObject")}constructor(t,r,n,s,i,o,c,l,u,d,f,m,p,h){this.port=t,o===null&&(o=void 0),this.server_name=r+Wpe.SERVER_SUFFIX.HUB,this.pid_file=n,this.max_payload=67108864,this.reconnect_error_reports=100,this.jetstream={enabled:!1},this.tls={cert_file:s,key_file:i,ca_file:o,insecure:c,verify:l},this.leafnodes={port:u,tls:{cert_file:s,key_file:i,ca_file:o,insecure:c}},this.cluster={name:d,port:f,routes:m,tls:{cert_file:s,key_file:i,ca_file:o,insecure:c,verify:l}},this.accounts={SYS:{users:p},HDB:{users:h}},this.system_account="SYS"}};FY.exports=mP});var qY=M((sFe,GY)=>{"use strict";var HY=Lt(),pP=class{static{a(this,"LeafConfigObject")}constructor(t,r,n,s,i,o,c,l,u,d,f){this.port=t,f===null&&(f=void 0),this.server_name=r+HY.SERVER_SUFFIX.LEAF,this.pid_file=n,this.max_payload=67108864,this.jetstream={enabled:!0,store_dir:s,domain:r+HY.SERVER_SUFFIX.LEAF},this.tls={cert_file:u,key_file:d,ca_file:f,insecure:!0},this.leafnodes={remotes:[{tls:{ca_file:f,insecure:!0},urls:i,account:"SYS"},{tls:{ca_file:f,insecure:!0},urls:o,account:"HDB"}]},this.accounts={SYS:{users:c},HDB:{users:l,jetstream:"enabled"}},this.system_account="SYS"}};GY.exports=pP});var VY=M((oFe,$Y)=>{"use strict";var hP=class{static{a(this,"HdbUserObject")}constructor(t,r){this.user=t,this.password=r}};$Y.exports=hP});var YY=M((cFe,KY)=>{"use strict";var jpe=Lt(),EP=class{static{a(this,"SysUserObject")}constructor(t,r){this.user=t+jpe.SERVER_SUFFIX.ADMIN,this.password=r}};KY.exports=EP});var VT=M((uFe,zY)=>{"use strict";var jl=require("path"),zl=require("fs-extra"),zpe=kY(),Jpe=qY(),Qpe=VY(),Xpe=YY(),_P=(us(),v(ro)),af=ae(),Kn=gt(),qT=(G(),v(j)),wh=Lt(),{CONFIG_PARAMS:cr}=qT,cf=Q(),Nh=fe(),WY=Xi(),gP=_r(),Zpe=gs(),of="clustering",ehe=1e4,jY=50;zY.exports={generateNatsConfig:rhe,removeNatsConfig:nhe,getHubConfigPath:the};function the(){let e=Nh.get(cr.ROOTPATH);return jl.join(e,of,wh.NATS_CONFIG_FILES.HUB_SERVER)}a(the,"getHubConfigPath");async function rhe(e=!1,t=void 0){console.error("Warning: NATS replication is deprecated and will be removed in version 5.0 of Harper");let r=Nh.get(cr.ROOTPATH);zl.ensureDirSync(jl.join(r,"clustering","leaf")),Nh.initSync();let n=Kn.getConfigFromFile(cr.CLUSTERING_TLS_CERT_AUTH),s=Kn.getConfigFromFile(cr.CLUSTERING_TLS_PRIVATEKEY),i=Kn.getConfigFromFile(cr.CLUSTERING_TLS_CERTIFICATE);!await zl.exists(i)&&!await zl.exists(!n)&&await Zpe.createNatsCerts();let o=jl.join(r,of,wh.PID_FILES.HUB),c=jl.join(r,of,wh.PID_FILES.LEAF),l=Kn.getConfigFromFile(cr.CLUSTERING_LEAFSERVER_STREAMS_PATH),u=jl.join(r,of,wh.NATS_CONFIG_FILES.HUB_SERVER),d=jl.join(r,of,wh.NATS_CONFIG_FILES.LEAF_SERVER),f=Kn.getConfigFromFile(cr.CLUSTERING_TLS_INSECURE),m=Kn.getConfigFromFile(cr.CLUSTERING_TLS_VERIFY),p=Kn.getConfigFromFile(cr.CLUSTERING_NODENAME),h=Kn.getConfigFromFile(cr.CLUSTERING_HUBSERVER_LEAFNODES_NETWORK_PORT);await gP.checkNATSServerInstalled()||$T("nats-server dependency is either missing or the wrong version. Run 'npm install' to fix");let E=await _P.listUsers(),_=Kn.getConfigFromFile(cr.CLUSTERING_USER),R=await _P.getClusterUser();(af.isEmpty(R)||R.active!==!0)&&$T(`Invalid cluster user '${_}'. A valid user with the role 'cluster_user' must be defined under clustering.user in harperdb-config.yaml`),e||(await GT(cr.CLUSTERING_HUBSERVER_CLUSTER_NETWORK_PORT),await GT(cr.CLUSTERING_HUBSERVER_LEAFNODES_NETWORK_PORT),await GT(cr.CLUSTERING_HUBSERVER_NETWORK_PORT),await GT(cr.CLUSTERING_LEAFSERVER_NETWORK_PORT));let S=[],y=[];for(let[z,Y]of E.entries())Y.role?.role===qT.ROLE_TYPES_ENUM.CLUSTER_USER&&Y.active&&(S.push(new Xpe(Y.username,WY.decrypt(Y.hash))),y.push(new Qpe(Y.username,WY.decrypt(Y.hash))));let w=[],{hub_routes:I}=Kn.getClusteringRoutes();if(!af.isEmptyOrZeroLength(I))for(let z of I)w.push(`tls://${R.sys_name_encoded}:${R.uri_encoded_d_hash}@${z.host}:${z.port}`);let H=new zpe(Kn.getConfigFromFile(cr.CLUSTERING_HUBSERVER_NETWORK_PORT),p,o,i,s,n,f,m,h,Kn.getConfigFromFile(cr.CLUSTERING_HUBSERVER_CLUSTER_NAME),Kn.getConfigFromFile(cr.CLUSTERING_HUBSERVER_CLUSTER_NETWORK_PORT),w,S,y);n==null&&(delete H.tls.ca_file,delete H.leafnodes.tls.ca_file),t=af.isEmpty(t)?void 0:t.toLowerCase(),(t===void 0||t===qT.PROCESS_DESCRIPTORS.CLUSTERING_HUB.toLowerCase())&&(await zl.writeJson(u,H),cf.trace(`Hub server config written to ${u}`));let X=`tls://${R.sys_name_encoded}:${R.uri_encoded_d_hash}@0.0.0.0:${h}`,q=`tls://${R.uri_encoded_name}:${R.uri_encoded_d_hash}@0.0.0.0:${h}`,k=new Jpe(Kn.getConfigFromFile(cr.CLUSTERING_LEAFSERVER_NETWORK_PORT),p,c,l,[X],[q],S,y,i,s,n,f);n==null&&delete k.tls.ca_file,(t===void 0||t===qT.PROCESS_DESCRIPTORS.CLUSTERING_LEAF.toLowerCase())&&(await zl.writeJson(d,k),cf.trace(`Leaf server config written to ${d}`))}a(rhe,"generateNatsConfig");async function GT(e){let t=Nh.get(e);return af.isEmpty(t)&&$T(`port undefined for '${e}'`),await af.isPortTaken(t)&&$T(`'${e}' port '${t}' is is in use by another process, check to see if HarperDB is already running or another process is using this port.`),!0}a(GT,"isPortAvailable");function $T(e){let t=`Error generating clustering config: ${e}`;cf.error(t),console.error(t),process.exit(1)}a($T,"generateNatsConfigError");async function nhe(e){let{port:t,config_file:r}=gP.getServerConfig(e),{username:n,decrypt_hash:s}=await _P.getClusterUser(),i=0,o=2e3;for(;i<jY;){try{let d=await gP.createConnection(t,n,s,!1);if(d.protocol.connected===!0){d.close();break}}catch(d){cf.trace(`removeNatsConfig waiting for ${e}. Caught and swallowed error ${d}`)}if(i++,i>=jY)throw new Error(`Operations API timed out attempting to connect to ${e}. This is commonly caused by incorrect clustering config. Check hdb.log for further details.`);let u=o*(i*2);u>3e4&&cf.notify("Operations API waiting for Nats server connection. This could be caused by large Nats streams or incorrect clustering config."),await af.asyncSetTimeout(u)}let c="0".repeat(ehe),l=jl.join(Nh.get(cr.ROOTPATH),of,r);await zl.writeFile(l,c),await zl.remove(l),cf.notify(e,"started.")}a(nhe,"removeNatsConfig")});var tW=M((fFe,eW)=>{"use strict";var Ts=fe(),et=(G(),v(j)),Ch=Lt(),da=require("path"),{PACKAGE_ROOT:YT}=Rt(),JY=fe(),KT=ae(),lf="/dev/null",she=da.join(YT,"launchServiceScripts"),QY=da.join(YT,"utility/scripts"),ihe=da.join(QY,et.HDB_RESTART_SCRIPT),XY=da.resolve(YT,"dependencies",`${process.platform}-${process.arch}`,Ch.NATS_BINARY_NAME);function ZY(){let e={[et.PROCESS_NAME_ENV_PROP]:et.PROCESS_DESCRIPTORS.HDB,IS_SCRIPTED_SERVICE:!0,...process.env};return KT.noBootFile()&&(e[et.CONFIG_PARAMS.ROOTPATH.toUpperCase()]=KT.getEnvCliRootPath()),{name:et.PROCESS_DESCRIPTORS.HDB,script:et.LAUNCH_SERVICE_SCRIPTS.MAIN,exec_mode:"fork",env:e,execArgv:process.execArgv,cwd:YT}}a(ZY,"generateMainServerConfig");var ohe=9930;function ahe(){Ts.initSync(!0);let e=Ts.get(et.CONFIG_PARAMS.ROOTPATH),t=da.join(e,"clustering",Ch.NATS_CONFIG_FILES.HUB_SERVER),r=da.join(Ts.get(et.HDB_SETTINGS_NAMES.LOG_PATH_KEY),et.LOG_NAMES.HDB),n=JY.get(et.CONFIG_PARAMS.CLUSTERING_HUBSERVER_NETWORK_PORT),s=Ch.LOG_LEVEL_FLAGS[Ts.get(et.CONFIG_PARAMS.CLUSTERING_LOGLEVEL)]??void 0,i={name:et.PROCESS_DESCRIPTORS.CLUSTERING_HUB+(n!==ohe?"-"+n:""),binFile:XY,args:s?`${s} -c ${t}`:`-c ${t}`,exec_mode:"fork",env:{[et.PROCESS_NAME_ENV_PROP]:et.PROCESS_DESCRIPTORS.CLUSTERING_HUB},merge_logs:!0,out_file:r,error_file:r,instances:1};return Ts.get(et.HDB_SETTINGS_NAMES.LOG_TO_FILE)||(i.out_file=lf,i.error_file=lf),i}a(ahe,"generateNatsHubServerConfig");var che=9940;function lhe(){Ts.initSync(!0);let e=Ts.get(et.CONFIG_PARAMS.ROOTPATH),t=da.join(e,"clustering",Ch.NATS_CONFIG_FILES.LEAF_SERVER),r=da.join(Ts.get(et.HDB_SETTINGS_NAMES.LOG_PATH_KEY),et.LOG_NAMES.HDB),n=JY.get(et.CONFIG_PARAMS.CLUSTERING_LEAFSERVER_NETWORK_PORT),s=Ch.LOG_LEVEL_FLAGS[Ts.get(et.CONFIG_PARAMS.CLUSTERING_LOGLEVEL)]??void 0,i={name:et.PROCESS_DESCRIPTORS.CLUSTERING_LEAF+(n!==che?"-"+n:""),binFile:XY,args:s?`${s} -c ${t}`:`-c ${t}`,exec_mode:"fork",env:{[et.PROCESS_NAME_ENV_PROP]:et.PROCESS_DESCRIPTORS.CLUSTERING_LEAF},merge_logs:!0,out_file:r,error_file:r,instances:1};return Ts.get(et.HDB_SETTINGS_NAMES.LOG_TO_FILE)||(i.out_file=lf,i.error_file=lf),i}a(lhe,"generateNatsLeafServerConfig");function uhe(){Ts.initSync();let e=da.join(Ts.get(et.CONFIG_PARAMS.LOGGING_ROOT),et.LOG_NAMES.HDB),t={name:et.PROCESS_DESCRIPTORS.CLUSTERING_UPGRADE_4_0_0,binFile:et.LAUNCH_SERVICE_SCRIPTS.NODES_UPGRADE_4_0_0,exec_mode:"fork",env:{[et.PROCESS_NAME_ENV_PROP]:et.PROCESS_DESCRIPTORS.CLUSTERING_UPGRADE_4_0_0},merge_logs:!0,out_file:e,error_file:e,instances:1,cwd:she,autorestart:!1};return Ts.get(et.HDB_SETTINGS_NAMES.LOG_TO_FILE)||(t.out_file=lf,t.error_file=lf),t}a(uhe,"generateClusteringUpgradeV4ServiceConfig");function dhe(){let e={[et.PROCESS_NAME_ENV_PROP]:et.PROCESS_DESCRIPTORS.RESTART_HDB};return KT.noBootFile()&&(e[et.CONFIG_PARAMS.ROOTPATH.toUpperCase()]=KT.getEnvCliRootPath()),{...{name:et.PROCESS_DESCRIPTORS.RESTART_HDB,exec_mode:"fork",env:e,instances:1,autorestart:!1,cwd:QY},script:ihe}}a(dhe,"generateRestart");function fhe(){return{apps:[ZY()]}}a(fhe,"generateAllServiceConfigs");eW.exports={generateAllServiceConfigs:fhe,generateMainServerConfig:ZY,generateRestart:dhe,generateNatsHubServerConfig:ahe,generateNatsLeafServerConfig:lhe,generateClusteringUpgradeV4ServiceConfig:uhe}});var uf=M((hFe,cW)=>{"use strict";var Or=(G(),v(j)),pFe=ae(),ma=VT(),WT=_r(),fa=Lt(),bc=tW(),TP=fe(),Ac=Q(),mhe=ca(),{startWorker:rW,onMessageFromWorkers:phe}=st(),nW=require("fs"),hhe=require("node:path"),Ehe=(G(),v(j)),{setTimeout:_he}=require("node:timers/promises"),{execFile:ghe,fork:She}=require("node:child_process");cW.exports={start:Ic,restart:yhe,kill:Ihe,startAllServices:whe,startService:iW,restartHdb:Rhe,startClusteringProcesses:oW,startClusteringThreads:aW,isHdbRestartRunning:bhe,getHdbPid:Ahe,cleanupChildrenProcesses:Oh,reloadClustering:Che,expectedRestartOfChildren:sW};phe(e=>{e.type==="restart"&&TP.initSync(!0)});var Eo=[],The=10,SP;function Ic(e,t=!1){let r=typeof e.args=="string"?e.args.split(" "):e.args;e.silent=!0,e.detached=!0;let n=e.script?She(e.script,r,e):ghe(e.binFile,r,e);n.name=e.name,n.config=e,n.on("error",(o,c)=>{console.error(o,c)}),n.on("exit",async o=>{let c=Eo.indexOf(n);c>-1&&Eo.splice(c,1),!SP&&o!==0&&(e.restarts=(e.restarts||0)+1,e.restarts<The&&(nW.existsSync(ma.getHubConfigPath())?Ic(e):(await ma.generateNatsConfig(!0),Ic(e),await new Promise(l=>setTimeout(l,3e3)),await ma.removeNatsConfig(Or.PROCESS_DESCRIPTORS.CLUSTERING_HUB),await ma.removeNatsConfig(Or.PROCESS_DESCRIPTORS.CLUSTERING_LEAF))))});let s={serviceName:e.name.replace(/ /g,"-")};function i(o){let c=TP.get(Or.CONFIG_PARAMS.CLUSTERING_LOGLEVEL),l=/\[\d+][^\[]+\[(\w+)]/g,u,d=0,f;for(;u=l.exec(o);){if(u.index&&fa.LOG_LEVEL_HIERARCHY[c]>=fa.LOG_LEVEL_HIERARCHY[f||"info"]){let h=f===fa.LOG_LEVELS.ERR||f===fa.LOG_LEVELS.WRN?Ac.OUTPUTS.STDERR:Ac.OUTPUTS.STDOUT;Ac.logCustomLevel(f||"info",h,s,o.slice(d,u.index).trim())}let[m,p]=u;d=u.index+m.length,f=fa.LOG_LEVELS[p]}if(fa.LOG_LEVEL_HIERARCHY[c]>=fa.LOG_LEVEL_HIERARCHY[f||"info"]){let m=f===fa.LOG_LEVELS.ERR||f===fa.LOG_LEVELS.WRN?Ac.OUTPUTS.STDERR:Ac.OUTPUTS.STDOUT;Ac.logCustomLevel(f||"info",m,s,o.toString().slice(d).trim())}}a(i,"extractMessages"),n.stdout.on("data",i),n.stderr.on("data",i),n.unref(),Eo.length===0&&(t||(process.on("exit",Oh),process.on("SIGINT",Oh),process.on("SIGQUIT",Oh),process.on("SIGTERM",Oh))),Eo.push(n)}a(Ic,"start");function Oh(e=!0){if(!SP&&(SP=!0,Eo.length!==0))if(Ac.info("Killing child processes..."),Eo.map(t=>t.kill()),e)process.exit(0);else return _he(2e3)}a(Oh,"cleanupChildrenProcesses");function yhe(e){sW();for(let t of Eo)t.name===e&&t.kill()}a(yhe,"restart");function sW(){for(let e of Eo)e.config&&(e.config.restarts=0)}a(sW,"expectedRestartOfChildren");async function Rhe(){await Ic(bc.generateRestart())}a(Rhe,"restartHdb");async function bhe(){let e=await list();for(let t in e)if(e[t].name===Or.PROCESS_DESCRIPTORS.RESTART_HDB)return!0;return!1}a(bhe,"isHdbRestartRunning");function Ahe(){let e=TP.getHdbBasePath();if(!e)return;let t=hhe.join(e,Ehe.HDB_PID_FILE),r=Ohe(t);if(!(!r||r===process.pid)&&Phe(r))return r}a(Ahe,"getHdbPid");function Ihe(){for(let e of Eo)e.kill();Eo=[]}a(Ihe,"kill");async function whe(){await oW(),await aW(),await Ic(bc.generateAllServiceConfigs())}a(whe,"startAllServices");async function iW(e,t=!1){let r;switch(e=e.toLowerCase(),e){case Or.PROCESS_DESCRIPTORS.HDB.toLowerCase():r=bc.generateMainServerConfig();break;case Or.PROCESS_DESCRIPTORS.CLUSTERING_INGEST_SERVICE.toLowerCase():r=bc.generateNatsIngestServiceConfig();break;case Or.PROCESS_DESCRIPTORS.CLUSTERING_REPLY_SERVICE.toLowerCase():r=bc.generateNatsReplyServiceConfig();break;case Or.PROCESS_DESCRIPTORS.CLUSTERING_HUB.toLowerCase():r=bc.generateNatsHubServerConfig(),await Ic(r,t),await ma.removeNatsConfig(e);return;case Or.PROCESS_DESCRIPTORS.CLUSTERING_LEAF.toLowerCase():r=bc.generateNatsLeafServerConfig(),await Ic(r,t),await ma.removeNatsConfig(e);return;case Or.PROCESS_DESCRIPTORS.CLUSTERING_UPGRADE_4_0_0.toLowerCase():r=bc.generateClusteringUpgradeV4ServiceConfig();break;default:throw new Error(`Start service called with unknown service config: ${e}`)}Ic(r,t)}a(iW,"startService");var Nhe;async function oW(e=!1){for(let t in Or.CLUSTERING_PROCESSES){let r=Or.CLUSTERING_PROCESSES[t];await iW(r,e)}}a(oW,"startClusteringProcesses");async function aW(){Nhe=rW(Or.LAUNCH_SERVICE_SCRIPTS.NATS_REPLY_SERVICE,{name:Or.PROCESS_DESCRIPTORS.CLUSTERING_REPLY_SERVICE});try{await WT.deleteLocalStream("__HARPERDB_WORK_QUEUE__")}catch{}await WT.updateLocalStreams();let e=await mhe.getAllNodeRecords();for(let t=0,r=e.length;t<r;t++)if(e[t].system_info?.hdb_version===Or.PRE_4_0_0_VERSION){Ac.info("Starting clustering upgrade 4.0.0 process"),rW(Or.LAUNCH_SERVICE_SCRIPTS.NODES_UPGRADE_4_0_0,{name:"Upgrade-4-0-0"});break}}a(aW,"startClusteringThreads");async function Che(){await ma.generateNatsConfig(!0),await WT.reloadNATSHub(),await WT.reloadNATSLeaf(),await ma.removeNatsConfig(Or.PROCESS_DESCRIPTORS.CLUSTERING_HUB.toLowerCase()),await ma.removeNatsConfig(Or.PROCESS_DESCRIPTORS.CLUSTERING_LEAF.toLowerCase())}a(Che,"reloadClustering");function Ohe(e){try{return Number.parseInt(nW.readFileSync(e,"utf8"),10)}catch{return null}}a(Ohe,"readPidFile");function Phe(e){try{return process.kill(e,0),!0}catch(t){return t.code==="EPERM"}}a(Phe,"isProcessRunning")});var bP={};ye(bP,{compactOnStart:()=>Lhe,copyDb:()=>pW});async function Lhe(){pa.notify("Running compact on start"),console.log("Running compact on start");let e=(0,yP.get)(x.ROOTPATH),t=new Map,r=lt();(0,RP.updateConfigValue)(x.STORAGE_COMPACTONSTART,!1);try{for(let n in r){if(n==="system"||n.endsWith("-copy"))continue;let s;for(let l in r[n]){s=r[n][l].primaryStore.path;break}if(!s){console.log("Couldn't find any tables in database",n);continue}let i=(0,jT.join)(e,"backup",n+".mdb"),o=(0,jT.join)(e,Zc,n+"-copy.mdb"),c=0;try{c=await lW(n),console.log("Database",n,"before compact has a total record count of",c)}catch(l){pa.error("Error getting record count for database",n,l),console.error("Error getting record count for database",n,l)}t.set(n,{dbPath:s,copyDest:o,backupDest:i,recordCount:c}),await pW(n,o),console.log("Backing up",n,"to",i);try{await(0,Jl.move)(s,i,{overwrite:!0})}catch(l){console.log("Error moving database",s,"to",i,l)}console.log("Moving copy compacted",n,"to",s),await(0,Jl.move)(o,s,{overwrite:!0}),await(0,Jl.remove)((0,jT.join)(e,Zc,`${n}-copy.mdb-lock`))}try{ff()}catch(n){pa.error("Error resetting databases after backup",n),console.error("Error resetting databases after backup",n)}try{ff()}catch(n){pa.error("Error resetting databases after backup",n),console.error("Error resetting databases after backup",n),process.exit(0)}}catch(n){pa.error("Error compacting database, rolling back operation",n),console.error("Error compacting database, rolling back operation",n),(0,RP.updateConfigValue)(x.STORAGE_COMPACTONSTART,!1);for(let[s,{dbPath:i,backupDest:o}]of t){console.error("Moving backup database",o,"back to",i);try{await(0,Jl.move)(o,i,{overwrite:!0})}catch(c){console.error(c)}}throw ff(),n}for(let[n,{backupDest:s,recordCount:i}]of t){let o=await lW(n);if(console.log("Database",n,"after compact has a total record count of",o),i!==o){let c=`There is a discrepancy between pre and post compact record count for database ${n}.
 Total record count before compaction: ${i}, total after: ${o}.
 Database backup has not been removed and can be found here: ${s}`;pa.warn(c),console.warn(c)}(0,yP.get)(x.STORAGE_COMPACTONSTARTKEEPBACKUP)!==!0&&(console.log("Removing backup",s),await(0,Jl.remove)(s))}}async function lW(e){let t=await(0,mW.describeSchema)({database:e}),r=0;for(let n in t)r+=t[n].record_count;return r}function df(){}async function pW(e,t){console.log(`Copying database ${e} to ${t}`);let r=lt()[e];if(!r)throw new Error(`Source database not found: ${e}`);let n;for(let f in r){let m=r[f];m.primaryStore.put=df,m.primaryStore.remove=df;for(let p in m.indices){let h=m.indices[p];h.put=df,h.remove=df}m.auditStore&&(m.auditStore.put=df,m.auditStore.remove=df),n=m.primaryStore.rootStore}if(!n)throw new Error(`Source database does not have any tables: ${e}`);let s=n.dbisDb,i=n.auditStore,o=(0,uW.open)(new dW.default(t)),c=o.openDB(zT.INTERNAL_DBIS_NAME),l,u=0,d=s.useReadTransaction();try{for(let{key:m,value:p}of s.getRange({transaction:d})){let h=p.is_hash_attribute||p.isPrimaryKey,E,_;if(h&&(E=p.compression,_=JT(),_?p.compression=_:delete p.compression,E?.dictionary?.toString()===_?.dictionary?.toString()&&(E=null,_=null)),c.put(m,p),!(h||p.indexed))continue;let R=new fW.OpenDBIObject(!h,h);R.encoding="binary",R.compression=E;let S=n.openDB(m,R);S.decoder=null,S.decoderCopies=!1,S.encoding="binary",R.compression=_;let y=o.openDB(m,R);y.encoder=null,console.log("copying",m,"from",e,"to",t),await f(S,y,h,d)}if(i){let m=n.openDB(zT.AUDIT_STORE_NAME,Ph);console.log("copying audit log for",e,"to",t),f(i,m,!1,d)}async function f(m,p,h,E){let _=0,R=0,S=0,y=1e7,w=null;for(;y-- >0;)try{for(let I of m.getKeys({start:w,transaction:E}))try{w=I;let{value:H,version:X}=m.getEntry(I,{transaction:E});if(H?.length<14&&h){S++;continue}l=p.put(I,H,h?X:void 0),_++,E.openTimer&&(E.openTimer=0),R+=(I?.length||10)+H.length,u++>5e3&&(await l,console.log("copied",_,"entries",S,"delete records,",R,"bytes"),u=0)}catch(H){console.error("Error copying record",typeof I=="symbol"?"symbol":I,"from",e,"to",t,H)}console.log("finish copying, copied",_,"entries",S,"delete records,",R,"bytes");return}catch{if(typeof w=="string"){if(w==="z")return console.error("Reached end of dbi",w,"for",e,"to",t);w=w.slice(0,-2)+"z"}else if(typeof w=="number")w++;else return console.error("Unknown key type",w,"for",e,"to",t)}}a(f,"copyDbi"),await l,console.log("copied database "+e+" to "+t)}finally{d.done(),o.close()}}var uW,jT,Jl,yP,dW,fW,zT,mW,RP,pa,AP=se(()=>{Oe();uW=require("lmdb"),jT=require("path"),Jl=require("fs-extra"),yP=b(fe()),dW=b(qm()),fW=b(Gm()),zT=b(Jt());G();$i();mW=b(Ol()),RP=b(gt()),pa=b(Q());a(Lhe,"compactOnStart");a(lW,"getTotalDBRecordCount");a(df,"noop");a(pW,"copyDb")});var wP=M((yFe,hW)=>{"use strict";var Lh=fe();Lh.initSync();var mf=require("fs-extra"),IP=require("path"),pf=(G(),v(j)),Dhe=require("crypto"),vhe=require("uuid").v4;hW.exports=Mhe;function Mhe(){if(Lh.getHdbBasePath()!==void 0){let e=IP.join(Lh.getHdbBasePath(),pf.LICENSE_KEY_DIR_NAME,pf.JWT_ENUM.JWT_PRIVATE_KEY_NAME),t=IP.join(Lh.getHdbBasePath(),pf.LICENSE_KEY_DIR_NAME,pf.JWT_ENUM.JWT_PUBLIC_KEY_NAME),r=IP.join(Lh.getHdbBasePath(),pf.LICENSE_KEY_DIR_NAME,pf.JWT_ENUM.JWT_PASSPHRASE_NAME);try{mf.accessSync(r),mf.accessSync(e),mf.accessSync(t)}catch(n){if(n.code==="ENOENT"){let s=vhe(),i=Dhe.generateKeyPairSync("rsa",{modulusLength:4096,publicKeyEncoding:{type:"spki",format:"pem"},privateKeyEncoding:{type:"pkcs8",format:"pem",cipher:"aes-256-cbc",passphrase:s}});mf.writeFileSync(r,s),mf.writeFileSync(e,i.privateKey),mf.writeFileSync(t,i.publicKey)}else throw n}}}a(Mhe,"checkJWTTokenExist")});var _W=M((bFe,EW)=>{"use strict";var NP=class{static{a(this,"HdbInfoInsertObject")}constructor(t,r,n){this.info_id=t,this.data_version_num=r,this.hdb_version_num=n}};EW.exports={HdbInfoInsertObject:NP}});var TW=M((IFe,SW)=>{"use strict";var gW=(G(),v(j)),CP=class{static{a(this,"UpgradeObject")}constructor(t,r){this[gW.UPGRADE_JSON_FIELD_NAMES_ENUM.DATA_VERSION]=t,this[gW.UPGRADE_JSON_FIELD_NAMES_ENUM.UPGRADE_VERSION]=r}};SW.exports={UpgradeObject:CP}});var QT=M((NFe,RW)=>{"use strict";var Vs=require("prompt"),hf=require("chalk"),yW=Q(),Ri=require("os"),OP=el(),PP=["yes","y"];async function Uhe(e){let t=`${Ri.EOL}`+hf.bold.green("Your current HarperDB version requires that we complete an update process.")+`${Ri.EOL}If a backup of your data has not been created, we recommend you cancel this process and backup before proceeding.${Ri.EOL}${Ri.EOL}You can read more about the changes in this upgrade at https://harperdb.io/developers/release-notes/${Ri.EOL}`;Vs.override=OP(["CONFIRM_UPGRADE"]),Vs.start(),Vs.message=t;let r={properties:{CONFIRM_UPGRADE:{description:hf.magenta(`${Ri.EOL}[CONFIRM_UPGRADE] Do you want to upgrade your HDB instance now? (yes/no)`),pattern:/y(es)?$|n(o)?$/,message:"Must respond 'yes' or 'no'",default:"no",required:!0}}},n;try{n=await Vs.get([r])}catch(s){return yW.error("There was an error when prompting user about an upgrade."),yW.error(s),!1}return PP.includes(n.CONFIRM_UPGRADE)}a(Uhe,"forceUpdatePrompt");async function xhe(e){let t=`${Ri.EOL}`+hf.bold.green(`Your installed HarperDB version is older than the version used to create your data. Downgrading is not recommended as it is not tested and guaranteed to work. However, if you need to downgrade, and a backup of your data has not been created, we recommend you cancel this process and backup before proceeding.${Ri.EOL}`);Vs.override=OP(["CONFIRM_DOWNGRADE"]),Vs.start(),Vs.message=t;let r={properties:{CONFIRM_DOWNGRADE:{description:hf.magenta(`${Ri.EOL}[CONFIRM_DOWNGRADE] Do you want to proceed with using your downgraded HDB instance now? (yes/no)`),pattern:/y(es)?$|n(o)?$/,message:"Must respond 'yes' or 'no'",default:"no",required:!0}}},n=await Vs.get([r]);return PP.includes(n.CONFIRM_DOWNGRADE)}a(xhe,"forceDowngradePrompt");async function Bhe(){let e=`${Ri.EOL}`+hf.bold.green("We now require a Certifacte Authority certificate. HarperDB can generate all new certificates for you (your existing certificates will be backed up) or you can keep any existing certificates and add your own CA certificate. To add your own CA certificate set the <certificateAuthority> parameter in harperdb-config.yaml");Vs.override=OP(["GENERATE_CERTS"]),Vs.start(),Vs.message=e;let t={properties:{GENERATE_CERTS:{description:hf.magenta(`${Ri.EOL}[GENERATE_CERTS] Do you want HarperDB to generate all new certificates? (yes/no)`),pattern:/y(es)?$|n(o)?$/,message:"Must respond 'yes' or 'no'",default:"yes",required:!0}}},r=await Vs.get([t]);return PP.includes(r.GENERATE_CERTS)}a(Bhe,"upgradeCertsPrompt");RW.exports={forceUpdatePrompt:Uhe,forceDowngradePrompt:xhe,upgradeCertsPrompt:Bhe}});var XT=M((OFe,bW)=>{"use strict";var LP=class{static{a(this,"UpgradeDirective")}constructor(t){this.version=t,this.sync_functions=[],this.async_functions=[]}};bW.exports=LP});var IW=M((UFe,AW)=>{"use strict";var Fhe=ae(),khe=gt(),LFe=Q(),DFe=require("path"),vFe=require("fs"),MFe=(G(),v(j));AW.exports={getOldPropsValue:Hhe};function Hhe(e,t,r=!1){let n=t.getRaw(e);return Fhe.isNotEmptyAndHasValue(n)?n:r?khe.getDefaultConfig(e):""}a(Hhe,"getOldPropsValue")});var OW=M((BFe,CW)=>{"use strict";var wc=require("path"),Nc=require("fs-extra"),Ghe=require("properties-reader"),qhe=XT(),Tr=Q(),{getOldPropsValue:St}=IW(),{HDB_SETTINGS_NAMES:be,CONFIG_PARAMS:Ql}=(G(),v(j)),Xl=gt(),ZT=fe(),wW=ae(),_o=(G(),v(j)),DP=new qhe("3.1.0"),NW=[];function $he(){let e=Ghe(ZT.get(be.SETTINGS_PATH_KEY)),t="Updating settings file for version 3.1.0";console.log(t),Tr.info(t);let r=`   ;Settings for the HarperDB process.