kuzzle 2.56.0 → 2.57.0-beta.2

package/dist/lib/kuzzle/internalIndexHandler.d.ts

@@ -1,181 +1,18 @@
-export = InternalIndexHandler;
+import { Store } from "../core/shared/store";
 declare class InternalIndexHandler extends Store {
+    private readonly timeout;
+    /** Indexed access rather than a new name, so it cannot drift from the config. */
+    private readonly config;
+    /** IDs for config documents */
+    private readonly _BOOTSTRAP_DONE_ID;
+    private readonly _DATAMODEL_VERSION_ID;
+    private readonly _JWT_SECRET_ID;
     constructor();
-    timeout: number;
-    config: {
-        name: string;
-        collections: {
-            users: {
-                settings: {
-                    number_of_shards: number;
-                    number_of_replicas: number;
-                };
-                mappings: {
-                    dynamic: "false" | "true" | "strict";
-                    properties: {
-                        profileIds: {
-                            type: string;
-                        };
-                    };
-                };
-            };
-            profiles: {
-                settings: {
-                    number_of_shards: number;
-                    number_of_replicas: number;
-                };
-                mappings: {
-                    dynamic: "false";
-                    properties: {
-                        tags: {
-                            type: "keyword";
-                        };
-                        policies: {
-                            properties: {
-                                roleId: {
-                                    type: "keyword";
-                                };
-                                restrictedTo: {
-                                    type: "nested";
-                                    properties: {
-                                        index: {
-                                            type: "keyword";
-                                        };
-                                        collections: {
-                                            type: "keyword";
-                                        };
-                                    };
-                                };
-                            };
-                        };
-                    };
-                };
-            };
-            roles: {
-                settings: {
-                    number_of_shards: number;
-                    number_of_replicas: number;
-                };
-                mappings: {
-                    dynamic: "false";
-                    properties: {
-                        tags: {
-                            type: "keyword";
-                        };
-                        controllers: {
-                            dynamic: "false";
-                            properties: Record<string, unknown>;
-                        };
-                    };
-                };
-            };
-            validations: {
-                settings: {
-                    number_of_shards: number;
-                    number_of_replicas: number;
-                };
-                mappings: {
-                    properties: {
-                        index: {
-                            type: "keyword";
-                        };
-                        collection: {
-                            type: "keyword";
-                        };
-                        validations: {
-                            dynamic: "false";
-                            properties: Record<string, unknown>;
-                        };
-                    };
-                };
-            };
-            config: {
-                settings: {
-                    number_of_shards: number;
-                    number_of_replicas: number;
-                };
-                mappings: {
-                    dynamic: "false";
-                    properties: Record<string, unknown>;
-                };
-            };
-            "api-keys": {
-                settings: {
-                    number_of_shards: number;
-                    number_of_replicas: number;
-                };
-                mappings: {
-                    dynamic: "false";
-                    properties: {
-                        userId: {
-                            type: "keyword";
-                        };
-                        hash: {
-                            type: "keyword";
-                        };
-                        description: {
-                            type: "text";
-                        };
-                        expiresAt: {
-                            type: "long";
-                        };
-                        ttl: {
-                            type: "keyword";
-                        };
-                        token: {
-                            type: "keyword";
-                        };
-                    };
-                };
-            };
-            installations: {
-                settings: {
-                    number_of_shards: number;
-                    number_of_replicas: number;
-                };
-                mappings: {
-                    dynamic: "strict";
-                    properties: {
-                        description: {
-                            type: "text";
-                        };
-                        handler: {
-                            type: "text";
-                        };
-                        installedAt: {
-                            type: "date";
-                        };
-                    };
-                };
-            };
-            imports: {
-                settings: {
-                    number_of_shards: number;
-                    number_of_replicas: number;
-                };
-                mappings: {
-                    dynamic: "strict";
-                    properties: {
-                        hash: {
-                            type: "keyword";
-                        };
-                    };
-                };
-            };
-        };
-    };
-    _BOOTSTRAP_DONE_ID: string;
-    _DATAMODEL_VERSION_ID: string;
-    _JWT_SECRET_ID: string;
-    logger: import("./Logger").Logger;
-    /**
-     * @returns {Promise}
-     */
-    init(): Promise<any>;
+    init(): Promise<void>;
     /**
      * @override
      */
-    override _bootstrapSequence(): Promise<void>;
+    _bootstrapSequence(): Promise<void>;
     /**
      * Creates initial roles and profiles as specified in Kuzzle configuration
      */
@@ -183,4 +20,4 @@ declare class InternalIndexHandler extends Store {
     createInitialValidations(): Promise<void>;
     _initSecret(): Promise<void>;
 }
-import { Store } from "../core/shared/store";
+export = InternalIndexHandler;

package/dist/lib/kuzzle/internalIndexHandler.js

@@ -1,3 +1,4 @@
+"use strict";
 /*
  * Kuzzle, a backend software, self-hostable and ready to use
  * to power modern apps
@@ -18,14 +19,41 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-"use strict";
-const crypto = require("crypto");
-const Bluebird = require("bluebird");
-const debug = require("../util/debug")("kuzzle:bootstrap:internalIndex");
-const { Store } = require("../core/shared/store");
-const { Mutex } = require("../util/mutex");
-const { storeScopeEnum } = require("../core/storage/storeScopeEnum");
-const kerror = require("../kerror");
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const bluebird_1 = __importDefault(require("bluebird"));
+const store_1 = require("../core/shared/store");
+const storeScopeEnum_1 = require("../core/storage/storeScopeEnum");
+const specification_1 = require("../core/validation/specification");
+const kerror = __importStar(require("../kerror"));
+const debug_1 = __importDefault(require("../util/debug"));
+const mutex_1 = require("../util/mutex"); // NOSONAR: see init()
+const debug = (0, debug_1.default)("kuzzle:bootstrap:internalIndex");
 const securitiesBootstrap = {
     profiles: {
         admin: {
@@ -70,9 +98,9 @@ const securitiesBootstrap = {
     },
 };
 const dataModelVersion = "2.0.0";
-class InternalIndexHandler extends Store {
+class InternalIndexHandler extends store_1.Store {
     constructor() {
-        super(global.kuzzle.config.services.storageEngine.internalIndex.name, storeScopeEnum.PRIVATE);
+        super(global.kuzzle.config.services.storageEngine.internalIndex.name, storeScopeEnum_1.storeScopeEnum.PRIVATE);
         this.timeout =
             global.kuzzle.config.services.internalIndex.bootstrapLockTimeout;
         this.config = global.kuzzle.config.services.storageEngine.internalIndex;
@@ -82,15 +110,13 @@ class InternalIndexHandler extends Store {
         this._JWT_SECRET_ID = "security.jwt.secret";
         this.logger = global.kuzzle.log.child("internalIndexHandler");
     }
-    /**
-     * @returns {Promise}
-     */
     async init() {
         await super.init(this.config.collections);
-        const mutex = new Mutex("InternalIndexBootstrap", {
-            timeout: -1,
-            ttl: 30000,
-        });
+        // NOSONAR: `Mutex` is deprecated in favour of `withLock`, but the two use
+        // incompatible acquisition/TTL formats and must not contend on the same
+        // key — swapping it is a behaviour change, deferred to #2894.
+        const lockOptions = { timeout: -1, ttl: 30000 };
+        const mutex = new mutex_1.Mutex("InternalIndexBootstrap", lockOptions); // NOSONAR
         await mutex.lock();
         try {
             const bootstrapped = await this.exists("config", this._BOOTSTRAP_DONE_ID);
@@ -98,13 +124,13 @@ class InternalIndexHandler extends Store {
                 await this._initSecret();
                 return;
             }
-            await Bluebird.resolve(this._bootstrapSequence()).timeout(this.timeout);
+            await bluebird_1.default.resolve(this._bootstrapSequence()).timeout(this.timeout);
             await this.create("config", { timestamp: Date.now() }, {
                 id: this._BOOTSTRAP_DONE_ID,
             });
         }
         catch (error) {
-            if (error instanceof Bluebird.TimeoutError) {
+            if (error instanceof bluebird_1.default.TimeoutError) {
                 throw kerror.get("services", "storage", "bootstrap_timeout", "internalIndex");
             }
             throw error;
@@ -132,19 +158,19 @@ class InternalIndexHandler extends Store {
      * Creates initial roles and profiles as specified in Kuzzle configuration
      */
     async createInitialSecurities() {
-        await Bluebird.map(Object.entries(securitiesBootstrap.roles), ([roleId, content]) => {
+        await bluebird_1.default.map(Object.entries(securitiesBootstrap.roles), ([roleId, content]) => {
             return this.createOrReplace("roles", roleId, content, {
                 refresh: "wait_for",
             });
         });
-        await Bluebird.map(Object.entries(securitiesBootstrap.profiles), ([profileId, content]) => {
+        await bluebird_1.default.map(Object.entries(securitiesBootstrap.profiles), ([profileId, content]) => {
             return this.createOrReplace("profiles", profileId, content, {
                 refresh: "wait_for",
             });
         });
     }
     async createInitialValidations() {
-        const initialValidations = global.kuzzle.config.validation;
+        const initialValidations = (0, specification_1.configuredSpecifications)();
         const promises = [];
         for (const [index, collection] of Object.entries(initialValidations)) {
             for (const [collectionName, validation] of Object.entries(collection)) {
@@ -152,22 +178,25 @@ class InternalIndexHandler extends Store {
                 promises.push(this.createOrReplace("validations", validationId, validation));
             }
         }
-        await Bluebird.all(promises);
+        await bluebird_1.default.all(promises);
     }
     async _initSecret() {
-        const { authToken, jwt } = global.kuzzle.config.security;
-        const configSeed = authToken?.secret ?? jwt?.secret;
+        // NOSONAR: `jwt` is the deprecated spelling of `authToken`, read second so
+        // an existing configuration keeps working. Dropping it is a breaking change
+        // for anyone who has not migrated, not a conversion's to make.
+        const { authToken, jwt } = global.kuzzle.config.security; // NOSONAR
+        const configSeed = authToken?.secret ?? jwt?.secret; // NOSONAR
         let storedSeed = await this.exists("config", this._JWT_SECRET_ID);
         if (!configSeed) {
             if (!storedSeed) {
-                storedSeed = crypto.randomBytes(512).toString("hex");
+                storedSeed = node_crypto_1.default.randomBytes(512).toString("hex");
                 await this.create("config", { seed: storedSeed }, { id: this._JWT_SECRET_ID });
             }
             this.logger.warn("[!] Kuzzle is using a generated seed for authentication. This is suitable for development but should NEVER be used in production. See https://docs.kuzzle.io/core/2/guides/getting-started/deploy-your-application/");
         }
-        global.kuzzle.secret = configSeed
-            ? configSeed
-            : (await this.get("config", this._JWT_SECRET_ID))._source.seed;
+        global.kuzzle.secret =
+            configSeed ||
+                (await this.get("config", this._JWT_SECRET_ID))._source.seed;
     }
 }
 module.exports = InternalIndexHandler;

package/dist/lib/kuzzle/kuzzle.d.ts

@@ -5,19 +5,21 @@ import { TokenManager } from "../core/auth/tokenManager";
 import EntryPoint from "../core/network/entryPoint";
 import Router from "../core/network/router";
 import PluginsManager from "../core/plugin/pluginsManager";
+import Statistics from "../core/statistics/statistics";
 import Validation from "../core/validation/validation";
-import { KuzzleConfiguration } from "../types/config/KuzzleConfiguration";
+import type { IKuzzleConfiguration } from "../types/config/KuzzleConfiguration";
 import AsyncStore from "../util/asyncStore";
-import { ImportConfig, InstallationConfig, StartOptions, SupportConfig } from "./../types/Kuzzle";
+import type { ImportConfig, InstallationConfig, StartOptions, SupportConfig } from "./../types/Kuzzle";
 import KuzzleEventEmitter from "./event/KuzzleEventEmitter";
 import InternalIndexHandler from "./internalIndexHandler";
 import kuzzleStateEnum from "./kuzzleStateEnum";
 import { Logger } from "./Logger";
 declare class Kuzzle extends KuzzleEventEmitter {
-    config: KuzzleConfiguration;
+    config: IKuzzleConfiguration;
     private _state;
     log: Logger;
-    private rootPath;
+    /** Read by `PluginsManager` to locate the plugins directories. */
+    rootPath: string;
     /**
      * Internal index bootstrapper and accessor
      */
@@ -36,7 +38,7 @@ declare class Kuzzle extends KuzzleEventEmitter {
     /**
      * Statistics core component
      */
-    private statistics;
+    statistics: Statistics;
     /**
      * Network entry point
      */
@@ -65,18 +67,27 @@ declare class Kuzzle extends KuzzleEventEmitter {
      * Kuzzle version
      */
     private version;
+    /**
+     * Built by `start()`, from the application's own OpenAPI declaration.
+     * Nothing reads it before then — `server:openapi` answers off it, and the
+     * API is not serving yet.
+     */
     private openApiManager;
     /**
      * List of differents imports types and their associated method
      */
     private importTypes;
+    /**
+     * The realtime engine, and the secret read out of the internal index.
+     * Both are set by `start()`, before anything that uses them is wired up.
+     */
     koncorde: Koncorde;
     secret: string;
     /**
      * Node unique ID amongst other cluster nodes
      */
     id: string;
-    constructor(config: KuzzleConfiguration);
+    constructor(config: IKuzzleConfiguration);
     /**
      * Initializes all the needed components of Kuzzle.
      *
@@ -95,9 +106,13 @@ declare class Kuzzle extends KuzzleEventEmitter {
     /**
      * Gracefully exits after processing remaining requests
      *
+     * @param exitCode - the process exit code: 0 for a requested shutdown, and
+     *   non-zero when the node leaves because of a failure (e.g. a cluster
+     *   eviction), so that an `on-failure` restart policy brings it back
+     *
      * @returns {Promise}
      */
-    shutdown(): Promise<void>;
+    shutdown(exitCode?: number): Promise<void>;
     /**
      * Execute multiple handlers only once on any given environment
      *
@@ -105,7 +120,7 @@ declare class Kuzzle extends KuzzleEventEmitter {
      *
      * @returns {Promise<void>}
      */
-    install(installations: InstallationConfig[]): Promise<void>;
+    install(installations?: InstallationConfig[]): Promise<void>;
     ask(event: string, ...args: [payload?: any, ...rest: any]): Promise<any>;
     emit(event: string, ...args: any[]): boolean;
     pipe(event: string, ...args: any[]): Promise<any>;
@@ -128,7 +143,7 @@ declare class Kuzzle extends KuzzleEventEmitter {
      * @returns {Promise<void>}
      */
     loadInitialState(toImport?: ImportConfig, toSupport?: SupportConfig): Promise<void>;
-    dump(suffix: any): Promise<any>;
+    dump(suffix: string): Promise<string>;
     hash(input: any): number;
     get state(): kuzzleStateEnum;
     set state(value: kuzzleStateEnum);
@@ -139,7 +154,7 @@ declare class Kuzzle extends KuzzleEventEmitter {
      * - uncaught-exception
      */
     registerSignalHandlers(): void;
-    dumpAndExit(suffix: any): Promise<void>;
+    dumpAndExit(suffix: string): Promise<void>;
 }
 export { Kuzzle };
 export default Kuzzle;

package/dist/lib/kuzzle/kuzzle.js

@@ -48,6 +48,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Kuzzle = void 0;
 const path_1 = __importDefault(require("path"));
+const node_util_1 = require("node:util");
 const bluebird_1 = __importDefault(require("bluebird"));
 const json_stable_stringify_1 = __importDefault(require("json-stable-stringify"));
 const koncorde_1 = require("koncorde");
@@ -79,6 +80,7 @@ const internalIndexHandler_1 = __importDefault(require("./internalIndexHandler")
 const kuzzleStateEnum_1 = __importDefault(require("./kuzzleStateEnum"));
 const Logger_1 = require("./Logger");
 const vault_1 = __importDefault(require("./vault"));
+const name_generator_1 = require("../util/name-generator");
 let _kuzzle = null;
 Reflect.defineProperty(global, "kuzzle", {
     configurable: true,
@@ -119,6 +121,16 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         this.asyncStore = new asyncStore_1.default();
         this.debugger = new kuzzleDebugger_1.KuzzleDebugger();
         this.version = package_json_1.version;
+        // `global.nodeId` when a `Backend` named this process, and a name of the
+        // same shape otherwise — the draw `ClusterIdCardHandler` makes for the
+        // same reason. This field was declared `string` and assigned nowhere, so
+        // every reader of `kuzzle.id` — the redis `SETNAME`, the ID card, the
+        // `node` field of every realtime notification — has been reading
+        // `undefined`. `accessLogger` sends `global.nodeId` to its worker and
+        // reads it back as `kuzzle.id`, which is what says the two are the same
+        // value.
+        this.id =
+            global.nodeId ?? name_generator_1.NameGenerator.generateRandomName({ prefix: "knode" });
         this.importTypes = {
             fixtures: this.importFixtures.bind(this),
             mappings: this.importMappings.bind(this),
@@ -152,7 +164,7 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             await new security_1.default().init();
             // This will init the cluster module if enabled
             await this.initKuzzleNode();
-            this.vault = vault_1.default.load(options.vaultKey, options.secretsFile);
+            this.vault = vault_1.default.load(options.vaultKey, options.secretsFile, this.config.vault?.newAlgorithm);
             this.validation.init();
             await this.tokenManager.init();
             await this.funnel.init();
@@ -172,7 +184,10 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             this.router.init();
             this.log.info("[✔] Core components loaded");
             await this.install(options.installations);
-            this.log.info(`[✔] Start "${this.pluginsManager.application.name}" application`);
+            // `application` is the very wrapper handed to the plugins manager six
+            // lines up, so reading the name back off the manager was a round trip
+            // through a getter that can answer `undefined`.
+            this.log.info(`[✔] Start "${application.name}" application`);
             this.openApiManager = new openapi_1.OpenApiManager(application.openApi, this.config.http.routes, this.pluginsManager.routes);
             // @deprecated
             await this.pipe("kuzzle:start");
@@ -185,7 +200,7 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             this._state = kuzzleStateEnum_1.default.RUNNING;
         }
         catch (error) {
-            this.log.error(`[X] Cannot start Kuzzle ${this.version}: ${error.message}`);
+            this.log.error(`[X] Cannot start Kuzzle ${this.version}: ${error instanceof Error ? error.message : (0, node_util_1.inspect)(error)}`);
             throw error;
         }
     }
@@ -206,13 +221,17 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
     /**
      * Gracefully exits after processing remaining requests
      *
+     * @param exitCode - the process exit code: 0 for a requested shutdown, and
+     *   non-zero when the node leaves because of a failure (e.g. a cluster
+     *   eviction), so that an `on-failure` restart policy brings it back
+     *
      * @returns {Promise}
      */
-    async shutdown() {
+    async shutdown(exitCode = 0) {
         this._state = kuzzleStateEnum_1.default.SHUTTING_DOWN;
         this.log.info("Initiating shutdown...");
         // Ask the network layer to stop accepting new request
-        this.entryPoint.dispatch("shutdown");
+        this.entryPoint.dispatch("shutdown", {});
         await this.pipe("kuzzle:shutdown");
         // @deprecated
         this.emit("core:shutdown");
@@ -220,11 +239,19 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             this.log.info(`[shutdown] Waiting: ${this.funnel.remainingRequests} remaining requests`);
             await bluebird_1.default.delay(1000);
         }
+        // The other nodes may be waiting on a lock this one holds: a node leaving
+        // mid-startup is often in the middle of one (F-13).
+        await mutex_1.Mutex.releaseAllBeforeExit(); // NOSONAR: frees locks taken through the deprecated API
         this.log.info("Halted.");
         // flush both application and Kuzzle core loggers before leaving (Could happen even if some core/application components are not initialized)
         await this?.log?.flush?.();
-        await this?.pluginsManager?.application?.log?.flush?.();
-        process.exit(0);
+        // `log` lives on the application *instance* (`Backend`), while
+        // `pluginsManager.application` is the `Plugin` wrapper around it, which
+        // nothing ever assigns a `log` to — so the previous
+        // `pluginsManager?.application?.log?.flush?.()` was a silent no-op and the
+        // application's buffered logs were dropped on shutdown (TD-51).
+        await this?.pluginsManager?.application?.instance?.log?.flush?.();
+        process.exit(exitCode);
     }
     /**
      * Execute multiple handlers only once on any given environment
@@ -234,6 +261,8 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
      * @returns {Promise<void>}
      */
     async install(installations) {
+        // Optional, which is what `options.installations` is and what the
+        // `?.length` below already read it as.
         if (!installations?.length) {
             return;
         }
@@ -393,9 +422,13 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         if (!existingRedisHash && !existingESHash) {
             // If the import is not initialized in the redis cache and in the ES, we initialize it
             this.log.info(`${type} import is not initialized, initializing...`);
-            await this.ask("core:storage:private:document:create", "kuzzle", "imports", {
+            // `createOrReplace`, not `create`: this document has a fixed id, so a
+            // conflict on it means another node initialized the same import — an
+            // outcome to converge on, not an error to die on. `create` made that
+            // conflict fatal to startup (TD-69, #2782).
+            await this.ask("core:storage:private:document:createOrReplace", "kuzzle", "imports", `backend:init:import:${type}`, {
                 hash: importPayloadHash,
-            }, { id: `backend:init:import:${type}` });
+            });
             await this.ask("core:cache:internal:store", `backend:init:import:${type}`, importPayloadHash);
         }
         else if (existingRedisHash && !existingESHash) {
@@ -403,9 +436,10 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             // We initialize it in the ES
             this.log.info(`${type} import is not initialized in %kuzzle.imports, initializing...`);
             const redisCache = await this.ask("core:cache:internal:get", `backend:init:import:${type}`);
-            await this.ask("core:storage:private:document:create", "kuzzle", "imports", {
+            // Same reasoning as above: a fixed id, so a conflict is convergence.
+            await this.ask("core:storage:private:document:createOrReplace", "kuzzle", "imports", `backend:init:import:${type}`, {
                 hash: redisCache,
-            }, { id: `backend:init:import:${type}` });
+            });
         }
         else if (!existingRedisHash && existingESHash) {
             // If the import is initialized in the ES but not in the redis cache
@@ -446,8 +480,28 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
                         lodash_1.default.set(importPayload, "toImport.users", toImport.users);
                         break;
                 }
-                const importPayloadHash = (0, crypto_1.sha256)((0, json_stable_stringify_1.default)(importPayload));
-                const mutex = new mutex_1.Mutex(`backend:import:${type}`, { timeout: 0 });
+                // `?? ""`: `json-stable-stringify` answers undefined for a value it
+                // cannot serialise, and the payload is built right above.
+                const importPayloadHash = (0, crypto_1.sha256)((0, json_stable_stringify_1.default)(importPayload) ?? "");
+                // `timeout: 0` means a single acquisition attempt: exactly one node
+                // runs the import and the others carry on with `locked: false`.
+                // The TTL has to outlive the import itself, because this lock is held
+                // until the `finally` below — across every import type and the wait
+                // that follows. It is still an upper bound rather than a guarantee,
+                // which is why the bookkeeping write below is idempotent (TD-69).
+                // NOSONAR: `Mutex` is deprecated in favour of `withLock`, but the two
+                // use incompatible acquisition/TTL formats and must not contend on the
+                // same key — every other node still takes this lock with `Mutex`, so
+                // swapping one site would remove the exclusion it exists for. Deferred
+                // to #2894, like the remaining call sites.
+                const lockOptions = { timeout: 0, ttl: 60000 };
+                const mutex = new mutex_1.Mutex(`backend:import:${type}`, lockOptions); // NOSONAR
+                const locked = await mutex.lock();
+                // Read the bookkeeping *after* the lock, never before: a read taken
+                // before acquiring it is not protected by it, and the holder that
+                // acted on a stale "not initialized" used to create a document the
+                // previous holder had just written — killing its own startup with
+                // `Document already exists`. See TD-69 (#2782).
                 const existingRedisHash = await this.ask("core:cache:internal:get", `backend:init:import:${type}`);
                 const existingESHash = await this.ask("core:storage:private:document:exist", "kuzzle", "imports", `backend:init:import:${type}`);
                 let initialized = false;
@@ -460,7 +514,6 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
                     const esDocument = await this.ask("core:storage:private:document:get", "kuzzle", "imports", `backend:init:import:${type}`);
                     initialized = esDocument._source.hash === importPayloadHash;
                 }
-                const locked = await mutex.lock();
                 await importMethod({ toImport, toSupport }, {
                     firstCall: !initialized && locked,
                     initialized: initialized,
@@ -497,7 +550,7 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             default:
                 inString = (0, json_stable_stringify_1.default)(input);
         }
-        return murmurhash_1.default.v3(Buffer.from(inString), this.config.internal.hash.seed);
+        return murmurhash_1.default.v3(Buffer.from(String(inString)), this.config.internal.hash.seed);
     }
     get state() {
         return this._state;
@@ -555,7 +608,11 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
         process.removeAllListeners("SIGTRAP");
         process.on("SIGTRAP", () => {
             this.log.error("Caught signal SIGTRAP => generating a core dump");
-            this.dump("signal-sigtrap");
+            // Nothing awaits this dump: a failure (another dump running, an
+            // unwritable dump path) is logged rather than left unhandled.
+            this.dump("signal-sigtrap").catch((error) => {
+                this.log.error(`Unable to dump on SIGTRAP: ${error instanceof Error ? error.message : String(error)}`);
+            });
         });
         // gracefully exits on normal termination
         for (const signal of ["SIGINT", "SIGTERM"]) {
@@ -571,7 +628,7 @@ class Kuzzle extends KuzzleEventEmitter_1.default {
             try {
                 await this.dump(suffix);
             }
-            catch (error) {
+            catch {
                 // this catch is just there to prevent unhandled rejections, there is
                 // nothing to do with that error
             }